Getting data for user based on JWT in Node/Express - node.js

Question

This question is half about my code specifically, and half about the high-level view of actually getting data for a particular user from a node API.
So I have user signup/signin all working fine, and lets say I have a one-to-many mapping between Users and Widgets, so each User can create and delete Widgets from his or her profile page.
So here are my database models:
var User = new mongoose.Schema({
email: {
type: String,
unique: true,
required: true
},
hash: String,
salt: String
widgets : [{ type: Schema.Types.ObjectId,
ref: 'widget'
}],
});
var Widget = new mongoose.Schema({
name : String,
type : String,
description : String,
});
In the user login process, I generate a JWT and use that to save an authorization header on the front-end.
Now my question is two-fold. 1) How do I correctly save widgets so that they are associated with the currently logged in User? and 2) How do I get all widgets associated with a user?
My initial thoughts are something like this:
app.get('api/widgets', function(req, res, next){
// decode authorization header to get user email
// run database query to return all widgets associated with user email
});
app.post('api/widgets', function(req, res, next){
// decode authorization header to get user email
// create widget and update user with widget ID
});
Is this the correct idea? And if so, how would I go about decoding the authorization header to get the user's email? Do I need to go through this same process for every object associated with the User? Or is there a faster and more convenient way to do this in Node/Express?

Answer 1

Is this the correct idea?
In my opinion, yes, that is correct.
And if so, how would I go about decoding the authorization header to get the user's email?
If you're using jsonwebtoken package, there's a verify method that decodes the token. You can even store multiple values in a single token, like e-mail and name. verify will decode the token into an object with both properties.
Do I need to go through this same process for every object associated with the User? Or is there a faster and more convenient way to do this in Node/Express?
Loading those objects on every request is probably the most common method. If you find that this loading process is slowing down your application, you can cache it using node-cache or Redis (recommended when you have a distributed application cluster).
I also suggest that, instead of decoding the user's token into an email on every route, it's common to use a catch all route that decodes the token and store in the locals. DRY!
app.use(function (req, res, next) {
var token = req.signedCookies.token
res.locals.user = jwt.verify(token, 'my-secret')
next()
})