user authentication and authorization. Displaying only looged user profile - node.js

Question

I am having an issue with user authentication aftre sign in. This is part of expanding my knowledge and now I am stuck with this.
My code looks like this:
Route:
const express = require('express');
const router = express.Router();
/* import controllers */
const {
findById,
isAuth,
isAdmin,
} = require('../controllers/user.controller.js');
const { requierSignin } = require('../controllers/auth.controller.js');
router.param('userId', findById);
router.get('/test/:userId', requierSignin, isAuth, findById, (req, res) => {
res.json({ user: req.profile });
});
Here i have sign in, find user by id and my authorization method. This is a test route.
As i goes for my controllers:
User:
const User = require('../models/user.models');
//user middleware
exports.findById = async (req, res, next, id) => {
try {
let user = await User.findById(id).exec();
if (!user) {
return res.status(401).json({
errors: [
{
msg: 'User not found',
},
],
});
}
req.profile = user; // this will get user profile based on User
next();
} catch (err) {
console.error(err.message);
res.status(500).send('Server error');
}
};
/* check if user is authenticated */
exports.isAuth = (req, res, next) => {
/* id we have user that will send id and is auth */
let user = req.profile && req.auth && req.profile._id == req.auth._id;
console.log(req.profile);
console.log('auth', req.auth);
console.log('id', req.profile._id);
console.log('user', user);
if (!user) {
return res.status(403).json({
errors: [
{
msg: 'Access Denied',
},
],
});
}
next();
};
and my sign in method from auth.controller
const config = require('config');
const jwt = require('jsonwebtoken'); //generate token
const expressJwt = require('express-jwt'); //auth check
const User = require('../models/user.models');
const secret = config.get('jwtSecret');
exports.requierSignin = expressJwt({
secret,
userProperpty: 'auth',
});
This is only part of that code but if rest will be neede I will update it
As far i get. User sign in and the getting a profile is working. Bu I want to protect other user profiles with isAuth. This is getting me "Access denied". From console log i got
auth undefined
id 5eaac004200b95869cc76531
user undefined
GET /api/test/5eaac004200b95869cc76531 403 88.591 ms - 36
But when i change in my isAuth method user to be only:
let user = req.profile
user is defined.
Not sure what I am missing here :/ Not sure why i don't get in my 'auth' ._id and this is causing issues
github repo

Answer 1

Got this working
Issue was in my user sign in method:
const payload = {
user: {
id: user._id,
email: user.email,
name: user.name,
role: user.role,
},
};
return res.json({
token,
payload,
});
In my payload i sending
id:user._id
But when i generted a token i was doing sending id
// generate a token with id and secret
const token = jwt.sign({ _id: _id }, secretJwt);
So every time when myt prtected rout was checking id from token and user
let user = req.profile && req.auth && req.profile._id == req.auth._id;
This was false as there was no id to compare.
Setting _id to id solved my issue
// generate a token with id and secret
const token = jwt.sign({ _id: _id }, secretJwt);
That was a brain cracker for me.

Answer 2

Even I'm facing the same issue using "postman", as "req.profile" property has to be set from frontend only if the user is "signedIn"
req.profile = user
so we need to populate the user first
exports.setUserInfo = function setUserInfo(request) {
const getUserInfo = {
_id: request._id,
firstName: request.profile.firstName,
lastName: request.profile.lastName,
email: request.email,
role: request.role
};
return getUserInfo;
};
git repo https://github.com/NRSingh007/mern-starter/blob/master/server/helpers.js