:poop: Failed attempt to authenticate using hashedSessionToken

backend/lib/auth/strategies/jwt.js

@@ -7,16 +7,25 @@ module.exports = options => {
         verifyOptions: {
             algorithms: ['HS256'],
         },
-        // TODO: check the h object to see if the activeSessions is accessible from it
-        // check useronlinestatus branch request.server.app
+        // NOTE: TASK 3 Not yet done, but this passes a hashedSessionToken
+        // through headers in failed attempt to never have raw JWT's in front end
+
         // Always check rawAccessToken, if it fails, we check the session, if session
         // is valid, then we reissue it
         // if session is NOT valid, DELETE the session (and kick user back to login)
         // TODO: set up cron job to occassionaly clean up activeSessions
         validate: (decoded, request, h) => {
-            const token = request.headers.authorization
+            // NOTE: this won't work as it immediately invalidates anything that isn't a raw jwt
+            const hashedSessionToken = request.headers.authorization
+            const sessionToken =
+                request.server.app.activeSessions[hashedSessionToken]
+                    .sessionToken
+            console.log('sessionToken :=>', sessionToken)
             try {
-                const validatedJwt = JWT.verify(token, process.env.APP_SECRET)
+                const validatedJwt = JWT.verify(
+                    sessionToken,
+                    process.env.APP_SECRET,
+                )
                 return {
                     isValid: true,
                     credentials: validatedJwt.email,

backend/lib/routes/user/email.js

@@ -33,6 +33,8 @@ module.exports = {
                         userCredentials.email
                     )
                 })
+                // Registers the activeSessions object for use by jwt auth strategy
+                request.server.app.activeSessions = userService.activeSessions
                 if (!hashedSessionToken.length) {
                     throw Error('hashedSessionToken not Found!!')
                 }

backend/lib/services/user.js

@@ -293,9 +293,6 @@ module.exports = class UserService extends Schmervice.Service {
      * @returns {PayloadFromActiveSessions}
      */
     validateSession(hashedSessionToken) {
-        // TODO: Remove this console.log() prior to release to production,
-        // (useful for testing application state)
-        console.log('this.activeSessions :=>', this.activeSessions)
         const userSession = this.activeSessions[hashedSessionToken]
         if (!userSession) {
             throw new Error(
@@ -307,7 +304,9 @@ module.exports = class UserService extends Schmervice.Service {
         this._createAccessTokenIfExpired(userSession, validatedTokens)
         return {
             ...validatedTokens.sessionTokenIsValid.payload,
-            sessionToken: this.activeSessions[hashedSessionToken].sessionToken,
+            // sessionToken: this.activeSessions[hashedSessionToken].sessionToken,
+            // NOTE: this won't work as the jwt auth strategy needs a raw JWT string
+            sessionToken: hashedSessionToken,
         }
     }
     /**