:construction: Heavy refactor in onboarding auth logic

backend/lib/auth/strategies/jwt.js

@@ -8,6 +8,7 @@ module.exports = options => {
             algorithms: ['HS256'],
         },
         validate: (decoded, request, h) => {
+            // QUESTION: How can we authenticate both Session and Access Tokens here?
             const token = request.headers.authorization
             try {
                 const validatedJwt = JWT.verify(token, process.env.APP_SECRET)

backend/lib/plugins/user.js

@@ -13,11 +13,9 @@ const UserProfilesListRoute = require('../routes/user/list-profiles')
 const UserLoginRoute = require('../routes/user/login')
 const UserSignupRoute = require('../routes/user/signup')
 const UserEmailRoute = require('../routes/user/email.js')
-const UserVerifyEmailRoute = require('../routes/user/verifyemail.js')
+const UserVerifyActiveRoute = require('../routes/user/verifyactivesession.js')
 const UserGetSessionRoute = require('../routes/user/getsession.js')
-const UserGetAccessRoute = require('../routes/user/getaccess.js')
 const UserValidateSessionRoute = require('../routes/user/validatesession.js')
-const UserCheckEmailRegistry = require('../routes/user/check-email-registry.js')
 const UserByEmail = require('../routes/user/user-by-email.js')
 const UserPassword = require('../routes/user/authentication')
 
@@ -57,11 +55,9 @@ module.exports = {
         await server.route(UserProfileCreateRoute)
         await server.route(UserProfilesListRoute)
         await server.route(UserEmailRoute)
-        await server.route(UserVerifyEmailRoute)
+        await server.route(UserVerifyActiveRoute)
         await server.route(UserGetSessionRoute)
-        await server.route(UserGetAccessRoute)
         await server.route(UserValidateSessionRoute)
-        await server.route(UserCheckEmailRegistry)
         await server.route(UserByEmail)
         await server.route(UserPassword)
     },

backend/lib/routes/profile/get.js

@@ -29,8 +29,9 @@ module.exports = {
         ...pluginConfig.docs,
         tags: ['api'],
         /** Protect this route with authentication? */
-        // auth: false,
-        auth: 'default_jwt',
+        // TODO: change this once sessionToken is passed in headers
+        auth: false,
+        // auth: 'default_jwt',
         cors: true,
         handler: async function (request, h) {
             const { profile_id } = request.params

backend/lib/routes/user/check-email-registry.js

@@ -1,57 +0,0 @@
-'use strict'
-
-const Joi = require('joi')
-
-const pluginConfig = {
-    handlerType: 'email',
-    docs: {
-        get: {
-            description: 'checks if user email is registered in memory',
-            notes: 'Checks if user email is in application state and returns boolean',
-        },
-    },
-}
-
-module.exports = {
-    method: 'POST',
-    path: '/checkemailregistry/',
-    options: {
-        ...pluginConfig.docs.get,
-        tags: ['api'],
-        auth: false,
-        cors: true,
-        handler: async function (request, h) {
-            const { userService } = request.server.services()
-            const userEmail = request.payload
-            try {
-                const emailIsRegistered = await userService.checkEmailRegistry(
-                    userEmail,
-                )
-                return {
-                    ok: true,
-                    handler: pluginConfig.handlerType,
-                    data: emailIsRegistered,
-                }
-            } catch (err) {
-                return {
-                    ok: false,
-                    handler: pluginConfig.handlerType,
-                    data: {
-                        error: err,
-                    },
-                }
-            }
-        },
-        validate: {
-            failAction: 'log',
-        },
-        response: {
-            schema: Joi.object({
-                ok: Joi.bool(),
-                handler: Joi.string(),
-                data: Joi.bool(),
-            }).label('email_registry_res'),
-            failAction: 'log',
-        },
-    },
-}

backend/lib/routes/user/getaccess.js

@@ -1,72 +0,0 @@
-'use strict'
-
-const Joi = require('joi')
-
-const pluginConfig = {
-    handlerType: 'authentication',
-    docs: {
-        get: {
-            description: 'gets access token for authentication',
-            notes: 'Gets access token for authentication',
-        },
-    },
-}
-
-module.exports = {
-    method: 'POST',
-    path: '/getaccess',
-    options: {
-        ...pluginConfig.docs.get,
-        tags: ['api'],
-        auth: false,
-        cors: {
-            headers: ['Authorization'],
-            exposedHeaders: ['Authorization', 'Access-Control-Expose-Headers'],
-        },
-        handler: async function (request, h) {
-            const { userService } = request.server.services()
-            const hash = request.payload.hash
-            const accessToken = await userService.createToken({
-                ...hash,
-                // NOTE: Set Expiration Time for Access Token Here
-                // expires: 60 * 2,
-                // TESTING:
-                expires: 30,
-            })
-            userService.activeSessions[`${hash}`].accessToken = accessToken
-            const accessTokenInHashedSessions =
-                userService.activeSessions[`${hash}`].accessToken ===
-                accessToken
-                    ? true
-                    : false
-
-            // TODO: instead of putting the token in the return headers,
-            // simply put it in the activeSessions Object
-            try {
-                const response = h.response({
-                    ok: true,
-                    handler: pluginConfig.handlerType,
-                    data: accessTokenInHashedSessions,
-                })
-                // response.header('Authorization', token)
-                return response
-            } catch (err) {
-                return {
-                    ok: false,
-                    handler: pluginConfig.handlerType,
-                    data: {
-                        error: err,
-                    },
-                }
-            }
-        },
-        validate: {
-            failAction: 'log',
-        },
-        response: {
-            // TODO: change back to accommodate new h.response return values
-            schema: Joi.any().label('get_access_res'),
-            failAction: 'log',
-        },
-    },
-}

backend/lib/routes/user/getsession.js

@@ -26,11 +26,7 @@ module.exports = {
         handler: async function (request, h) {
             const { userService } = request.server.services()
             const res = request.payload
-            const token = await userService.createToken({
-                ...res,
-                // NOTE: Set Expiration Time for Session Token Here
-                expires: 60 * 10,
-            })
+            const token = await userService.createToken(res)
             try {
                 const response = h.response({
                     ok: true,

backend/lib/routes/user/list-profiles.js

@@ -38,8 +38,9 @@ module.exports = {
         ...pluginConfig.docs,
         tags: ['api'],
         /** Protect this route with authentication? */
-        // auth: false,
-        auth: 'default_jwt',
+        // TODO: change this once sessionToken is passed in headers
+        auth: false,
+        // auth: 'default_jwt',
         cors: true,
         handler: async function (request, h) {
             const { userService, profileService } = request.server.services()

backend/lib/routes/user/user-by-email.js

@@ -18,8 +18,9 @@ module.exports = {
     options: {
         ...pluginConfig.docs.get,
         tags: ['api'],
-        // auth: false,
-        auth: 'default_jwt',
+        auth: false,
+        // TODO: change this once sessionToken is passed in headers
+        // auth: 'default_jwt',
         cors: true,
         handler: async function (request, h) {
             const email = request.params.email

backend/lib/routes/user/validatesession.js

@@ -25,11 +25,12 @@ module.exports = {
             exposedHeaders: ['Authorization', 'Access-Control-Expose-Headers'],
         },
         handler: async function (request, h) {
-            const sessionToken = request.payload
+            const hashedSessionToken = request.payload
             const { userService } = request.server.services()
             try {
+                // const validatedSessionToken = userService.validateToken(sessionToken)
                 const validatedSessionToken =
-                    userService.validateToken(sessionToken)
+                    userService.validateSession(hashedSessionToken)
                 return {
                     ok: true,
                     handler: pluginConfig.handlerType,

backend/lib/services/user.js

@@ -8,6 +8,7 @@ const SecurePassword = require('secure-password')
 
 // Configuration for Brevo
 const SibApiV3Sdk = require('sib-api-v3-sdk')
+const { access, accessSync } = require('fs')
 const defaultClient = SibApiV3Sdk.ApiClient.instance
 const apiKey = defaultClient.authentications['api-key']
 apiKey.apiKey = process.env.BREVO_KEY
@@ -217,15 +218,14 @@ module.exports = class UserService extends Schmervice.Service {
 
     /**
      * Create a token to be sent in request headers
-     * @param {User} user
+     * @param {data, expiration}
      * @returns {Token}
      */
-    createToken(data) {
+    createToken(data, expiration = 600) {
         const key = this.server.registrations['main-app-plugin'].options.jwtKey
         const obj = {}
-
         Object.assign(obj, { ...data })
-        return JWT.sign(obj, key, { expiresIn: data.expires })
+        return JWT.sign(obj, key, { expiresIn: expiration })
     }
 
     /**
@@ -233,16 +233,73 @@ module.exports = class UserService extends Schmervice.Service {
      * @param {User} user
      * @returns {Token}
      */
-    // TODO: Move this ino the auth strategies
     validateToken(token) {
         const key = this.server.registrations['main-app-plugin'].options.jwtKey
         try {
             return JWT.verify(token, key)
         } catch (err) {
-            throw new Error(err.message)
+            return { payload: null, message: err.message }
         }
     }
 
+    /**
+     * Uses this.validateToken() to verify hashedSessionToken's
+     * existence, expiry, and also valdiates accessToken
+     * @param {User} user
+     * @returns {Token}
+     */
+    // TODO: remove testing console.log() messages once onboarding auth is working
+    validateSession(hashedSessionToken) {
+        console.log('this.activeSessions :=>', this.activeSessions)
+        if (!this.activeSessions[hashedSessionToken]) {
+            throw new Error(
+                'hashedSessionToken not in activeSessions registry!',
+            )
+        }
+
+        const rawSessionToken =
+            this.activeSessions[hashedSessionToken].sessionToken
+        const accessToken = this.activeSessions[hashedSessionToken].accessToken
+
+        // Weird Edge case...
+        if (!rawSessionToken) {
+            throw new Error(
+                'hashedSessionToken is in activeSessions registry, but rawSessionToken does not exist',
+            )
+        }
+        const sessionTokenIsValid = this.validateToken(rawSessionToken)
+        console.log('sessionTokenIsValid :=>', sessionTokenIsValid)
+        const accessTokenIsValid = this.validateToken(accessToken)
+        console.log('accessTokenIsValid :=>', accessTokenIsValid)
+
+        // Both sessionToken and accessToken are expired
+        if (!sessionTokenIsValid.payload && !accessTokenIsValid.payload) {
+            console.log('session is expired! kicking you off!')
+            return sessionTokenIsValid
+        }
+        if (sessionTokenIsValid.payload && !accessTokenIsValid.payload) {
+            console.log(
+                'sessionToken is valid, but accessToken is null or is expired :=>',
+            )
+            const accessToken = this.createToken({
+                payload: sessionTokenIsValid.payload,
+            })
+            this.activeSessions[hashedSessionToken].accessToken = accessToken
+        } else if (!sessionTokenIsValid.payload && accessTokenIsValid.payload) {
+            console.log(
+                'accessToken is valid, but sessionToken has expired :=>',
+            )
+            const newSessionToken = this.createToken({
+                payload: accessTokenIsValid.payload,
+            })
+            this.activeSessions[hashedSessionToken].sessionToken =
+                newSessionToken
+        }
+        return {
+            ...sessionTokenIsValid.payload,
+            sessionToken: this.activeSessions[hashedSessionToken].sessionToken,
+        }
+    }
     /**
      * Use knex to try to change password entry
      * @param {number} id
@@ -277,26 +334,6 @@ module.exports = class UserService extends Schmervice.Service {
         return passwordRow ? passwordRow.token : null
     }
 
-    // TODO: rewrite for new activeSessions object
-    async checkEmailRegistry(userEmail) {
-        const hashedEmail = await hashEmail(userEmail)
-        const now = Date.now()
-        // hashedEmail needs to be derived by email, salt
-        const expiration = this.hashedEmails[hashedEmail]
-        console.log('this.hashedEmails :=>', this.hashedEmails)
-        const emailIsRegistered = Object.keys(this.hashedEmails).includes(
-            hashedEmail,
-        )
-        const emailIsExpired = now > expiration ? true : false
-        console.log('emailIsRegistered :=>', emailIsRegistered)
-        console.log('emailIsExpired :=>', emailIsExpired)
-        if (emailIsRegistered && !emailIsExpired) {
-            return true
-        } else {
-            return false
-        }
-    }
-
     /**
      * Sends a Transactional Email via Brevo
      * @ returns {Object}
@@ -307,7 +344,6 @@ module.exports = class UserService extends Schmervice.Service {
             return new Error('session already in cache!!')
         }
         // Set expiration time for ten minutes from now
-        // QUESTION: should we use the sessionToken's expiration time instead?
         const duration = 600000
 
         this.activeSessions[hashedSessionToken] = {
@@ -316,6 +352,7 @@ module.exports = class UserService extends Schmervice.Service {
             seeking: userCredentials.seeking,
             sessionToken: userCredentials.sessionToken,
             expiration: Date.now() + duration,
+            accessToken: null,
         }
 
         const sendSmtpEmail = {

frontend/src/components/onboarding/Auth.vue

@@ -51,10 +51,12 @@ export default {
             const sessionToken = await this.getSessionToken({
                 ...this.answered,
             })
+            console.log('sessionToken :=>', sessionToken)
             const sessionInfo = await this.authenticator.sendAuthEmail({
                 ...this.answered,
                 sessionToken: sessionToken,
             })
+            console.log('sessionInfo :=>', sessionInfo)
             document.cookie = `siimee_session=${sessionInfo.hashedSessionToken}; max-age=600; path=/; secure`
         } catch (err) {
             // TODO: render an error page in this component displaying which

frontend/src/services/auth.service.js

@@ -7,22 +7,14 @@ class Authenticator {
     async sendAuthEmail(answered) {
         return await db.post('/user/sendemail/', answered)
     }
-    // NOTE: doesn't have to be a POST request, could be a GET with token instead of email
-    async checkIfEmailIsRegistered(email) {
-        return await db.post('/user/checkemailregistry/', email)
-    }
     async verifyAuthSession(hashedSessionToken) {
         return await db.get(`/user/verify/${hashedSessionToken}`)
     }
     async getSessionToken(req) {
         return await db.post('/user/getsession', req, true)
     }
-    //async getAccessToken(req) {
-    async assignAccessTokenToSession(req) {
-        return await db.post('/user/getaccess', req)
-    }
-    async validateSession(token) {
-        return await db.post('/user/validatesession', token, true)
+    async validateSession(hashedSessionToken) {
+        return await db.post('/user/validatesession', hashedSessionToken, true)
     }
 }
 

frontend/src/utils/db.js

@@ -45,7 +45,7 @@ class Connector {
             if (!res.ok) {
                 // NOTE: Somewhat hacky workaround here to get auth working
                 if (res.status === 401) {
-                    return { status: jsonRes.statusCode }
+                    return { status: res.status }
                 } else {
                     throw Error(res.statusText)
                 }

frontend/src/views/OnboardingView.vue

@@ -43,8 +43,7 @@ import {
 import { surveyFactory } from '@/utils'
 import stepViews from '@/components/onboarding'
 import SurveyCompleteView from './SurveyCompleteView.vue'
-let sessionToken = null
-let accessToken = null
+let hashedSessionToken = null
 let currentProfileId = null
 
 export default {
@@ -70,18 +69,14 @@ export default {
     async created() {
         this.survey = await surveyFactory.createSurvey()
         this.authenticator = new Authenticator()
-        // TODO: Note that all this try/catch can be in a function instead,
-        // since it has to be done on created() and every step after 6...
-        sessionToken = this.grabStoredCookie('siimee_session')
-        accessToken = this.grabStoredCookie('siimee_access')
-        // TODO: More graceful way of throwing exceptions if sessionData is not defined??
+        hashedSessionToken = this.grabStoredCookie('siimee_session')
         try {
-            const sessionData = await this.verifyBothTokens()
-            await this.isEmailInRegistry(sessionData.payload.email)
+            const sessionData = await this.verifySession(hashedSessionToken)
+            console.log('sessionData :=>', sessionData)
             // TODO: Validate All routes hit by these methods using tokens in headers
-            const userId = await this.grabUserIdByEmail(
-                sessionData.payload.email,
-            )
+            // NOTE: This can be accomplished using sessionData.sessionToken,
+            // as it currently has the raw session token in it
+            const userId = await this.grabUserIdByEmail(sessionData.email)
             currentProfileId = await this.grabProfileIdByUserId(userId)
             this.responses = await this.grabResponsesByProfileId(
                 currentProfileId,
@@ -112,62 +107,11 @@ export default {
                 cookieKey in cookies ? cookies[`${cookieKey}`] : undefined
             return cookieVal
         },
-        // TODO: Possible Security issue, returned .payload has user email in plain text...
-        async verifyBothTokens() {
-            // Validate both tokens on the backend at the same time
-            const sessionTokenIsValid = await this.verifySessionToken(
-                sessionToken,
-                accessToken,
-            )
-            const accessTokenIsValid = await this.verifyAccessToken(accessToken)
-            if (
-                accessTokenIsValid.status === 401 &&
-                sessionTokenIsValid.status !== 401
-            ) {
-                console.warn(
-                    'WARNING :=> Access Token Expired, but Session Token Is Still Valid, reissuing Access Token...',
-                )
-                // TODO: break out reissuing new tokens into separate _function
-                const newAccessToken = await this.authenticator.getAccessToken(
-                    sessionTokenIsValid.payload,
-                )
-                const newAccessTokenIsValid = await this.verifyAccessToken(
-                    newAccessToken,
-                )
-                accessToken = newAccessToken
-                document.cookie = `siimee_access=${newAccessToken}; max-age=600; path=/; secure`
-                // NOTE: Resetting Session Token otherwise session
-                // token will always expire after 10 minutes...???
-                const newSessionToken =
-                    await this.authenticator.getSessionToken(
-                        sessionTokenIsValid.payload,
-                    )
-                sessionToken = newSessionToken
-                document.cookie = `siimee_session=${newSessionToken}; max-age=600; path=/; secure`
-                return newAccessTokenIsValid
-            } else if (
-                accessTokenIsValid.status === 401 &&
-                sessionTokenIsValid.status === 401
-            ) {
-                sessionToken = null
-                accessToken = null
-                currentProfileId = null
-                throw new Error('Both Session and Access Token Are Expired!!')
-            } else return accessTokenIsValid
-        },
-        async verifySessionToken(sessionToken) {
-            if (!sessionToken) {
+        async verifySession(hashedSessionToken) {
+            if (!hashedSessionToken)
                 return console.warn('WARNING :=> sessionToken is not defined')
-            } else return await this.validateToken(sessionToken)
-        },
-        async verifyAccessToken(accessToken) {
-            if (!accessToken) {
-                return console.warn('WARNING :=> accessToken is not defined')
-            } else return await this.validateToken(accessToken)
-        },
-        async validateToken(token) {
             const validatedToken = await this.authenticator.validateSession(
-                token,
+                hashedSessionToken,
             )
             if (validatedToken.error) {
                 throw new Error(validatedToken.error)
@@ -175,13 +119,6 @@ export default {
                 return validatedToken
             }
         },
-        async isEmailInRegistry(email) {
-            const emailIsInRegistry =
-                await this.authenticator.checkIfEmailIsRegistered(email)
-            if (!emailIsInRegistry) {
-                throw new Error('Email Is NOT in Registry!')
-            } else return emailIsInRegistry
-        },
         async grabUserIdByEmail(email) {
             const user = await fetchUserByEmail(email)
             if (!user) {
@@ -246,14 +183,12 @@ export default {
             // if user as finished minimum profile creation,
             // Adds survey answers to responses table and verifies tokens on each step
             if (currentProfileId) {
-                // TODO: Still have to authenticate this route
                 await surveyFactory.addNewSurveyAnswer(
                     this.responses[this.responses.length - 1],
                     currentProfileId,
-                    accessToken,
                 )
                 try {
-                    await this.verifyBothTokens(sessionToken, accessToken)
+                    await this.verifySession(hashedSessionToken)
                 } catch (err) {
                     this.currentStep = 0
                     this.goToStep(this.currentStep)

frontend/src/views/VerifyView.vue

@@ -7,7 +7,7 @@
 <script>
 import { Authenticator } from '../services/auth.service.js'
 let hash = null
-let sessionToken = null
+let hashedSessionToken = null
 export default {
     name: 'VerifyView',
     data: () => ({
@@ -16,12 +16,12 @@ export default {
     async created() {
         this.authenticator = new Authenticator()
         hash = this.$route.params.hashedToken
-        sessionToken = this.grabCookie('siimee_session')
+        hashedSessionToken = this.grabCookie('siimee_session')
         try {
             this.isHashInUrl(hash)
-            await this.doesSessionTokenExist(sessionToken)
-            const rawSessionToken = await this.grabTokenFromHash(hash)
-            await this.isSessionTokenValid(hash, rawSessionToken)
+            await this.doesSessionTokenExist(hashedSessionToken)
+            await this.verifyActiveSession(hash)
+            await this.isSessionTokenValid(hash)
         } catch (err) {
             console.error(err)
         }
@@ -43,13 +43,13 @@ export default {
         isHashInUrl(hash) {
             if (!hash) throw new Error('URL contains no hash!')
         },
-        async doesSessionTokenExist(sessionToken) {
-            if (!sessionToken)
+        async doesSessionTokenExist(hashedSessionToken) {
+            if (!hashedSessionToken)
                 throw new Error('sessionToken not in cookie store!')
         },
         // TODO: Next is to put this into OnboardingView
         // TODO: validate routes using sole SessionToken Grabbed from hash in cookie
-        async grabTokenFromHash(hashedToken) {
+        async verifyActiveSession(hashedToken) {
             const sessionData = await this.authenticator.verifyAuthSession(
                 hashedToken,
             )
@@ -57,16 +57,11 @@ export default {
                 throw new Error('Hash is not in registry!')
             else return sessionData.sessionToken
         },
-        async isSessionTokenValid(hash, sessionToken) {
+        async isSessionTokenValid(hash) {
             const sessionTokenIsValid =
-                await this.authenticator.validateSession(sessionToken)
-            console.log('sessionTokenIsValid :=>', sessionTokenIsValid)
+                await this.authenticator.validateSession(hash)
             if (sessionTokenIsValid.error) {
                 throw new Error(sessionTokenIsValid.error)
-            } else {
-                await this.authenticator.assignAccessTokenToSession({
-                    hash,
-                })
             }
         },
     },