SailsJS v1.0 Bearer auth (API token) - node.js

Question

First of all this is NOT a duplicate since all the documentation/answers out there are for versions prior to v1.0 and they don't seem to work.
I'm trying to implement a simple authentication with passport and SailsJS v1.0.
The problem is...since i'm new to this and sailsjs (v1) seems to lack online examples, i'm pretty stuck.
The app should work like this -> User registers, validates their email and then logs in. Upon logging in the user gets back a accessToken which he needs to use to make requests to protected routes (via Bearer or something else).
The tokens should be saved in the DB so i can invalidate them when the user changes password and such.
How could i achieve something like this ? This is what i've got so far (merging older/newer examples online).
User.js (model)
const bcrypt = require('bcryptjs');
module.exports = {
attributes: {
email: {
type: 'string',
required: true,
unique: true
},
username: {
type: 'string',
required: true,
unique: true
},
password: {
type: 'string',
required: true
},
tokens: {
collection: 'token',
via: 'userId'
}
},
customToJSON: function () {
return _.omit(this, ['password'])
},
beforeCreate: function (user, cb) {
bcrypt.genSalt(10, function (err, salt) {
bcrypt.hash(user.password, salt, null, function (err, hash) {
if (err) return cb(err);
user.password = hash;
return cb();
});
});
}
};
Token.js (model)
module.exports = {
attributes: {
token: {
type: 'string',
required: true,
unique: true
},
userId: {
mode: 'user'
},
isValid: {
type: 'bool',
}
},
};
Since i'm very new to node and especially sails i've got quite a few questions.
How could i create a token on user login if the token in the DB is
invalid (or should i just use 1 token at registration/change
password ?)
How do i implement the actual authentication process
using passport ?
Should the token be a specific format (number of characters etc) for
security reasons ?
Is there a better approachto what i'm trying to achieve ? (to be
more exact i want a REST Api back-end to serve my ReactJS front-end
with the ability to reuse the same back-end for android/ios etc).
Any tips, links, suggestions etc will be highly appreciated. Thanks and have mercy on my lack of knowledge!
EDIT: Would this approach stop me from using social media login (i want to implement that in the future too)?

Answer 1

You can use JWT for authentication.
Create file called isAuthenticated.js in api/policies folder with following code.
const passport = require('passport');
module.exports = async (req, res, proceed) => {
passport.authenticate('jwt', { session: false }, (err, user, info) => {
if (err) {
res.serverError(err, err.message);
}
if (user) {
req.user = user;
return proceed();
}
if (info) {
return res.forbidden(info);
}
// Otherwise, this request did not come from a logged-in user.
return res.forbidden();
})(req, res, proceed);
};
Create strategies folder in api folder with jwt.js file and following code.
const JwtStrategy = require('passport-jwt').Strategy;
const { ExtractJwt } = require('passport-jwt');
const passport = require('passport');
const opts = {};
opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();
opts.secretOrKey = JWT_SECRET;
opts.issuer = JWT_ISSUER;
opts.audience = JWT_AUDIENCE;
opts.jsonWebTokenOptions = {
expiresIn: JWT_EXPIRES_IN,
};
module.exports = {
/**
* Passport Strategy
*/
passport: () => {
passport.use(new JwtStrategy(opts, (jwtPayload, done) => {
User.findOne({ id: jwtPayload.id }, (err, user) => {
if (err) {
return done(err, null);
}
if (user) {
return done(null, user);
}
return done({ message: 'No user account found' }, 'No user account found');
});
}));
},
};
And in app.js require('./api/strategies/jwt').passport(); at top of the file.
Now you can apply policies to the routes in config/policies.js.
To generate JWT, you can use the following code.
const jwt = require('jsonwebtoken');
module.exports = {
generate: (id, email) => jwt.sign({ id, email }, jwtSecret, {
audience: jwtAudience,
expiresIn: jwtExpiresIn,
issuer: jwtIssuer,
})
};