Neighborly Package Megalodon

    @kevinhle/express-aad-jwt

    1.0.5 • Public • Published

    @kevinhle/express-aad-jwt

    This is an express middleware that validates AAD-issued (Azure Active Directory) JsonWebToken (JWT) and set the req.user with the decoded JWT.

    Install

    npm i @kevinhle/express-aad-jwt
    

    Usage

    If the JWT is included as bearer scheme in the Authorization attribute of the header request, the request will be augmented to include the decoded JWT. The way the request is augmented is that now the request will include the property user which contains the decoded JWT.

    In the case JWT is invalid or expires or authorization header is missing in the request, if you want to stop the middleware chain and ultimately the route, set shouldThrow to true and include some error handler for gracefull failure.

    const expressAadJwt = require('@kevinhle/express-aad-jwt')
    
    app.use(
      expressAadJwt({
        tenant: 'your-tenant-name.onmicrosoft.com',
        shouldThrow: true,
      })
    )
    
    //error handler
    app.use((err, req, res, next) => {
      if (err) {
        res.status(401).json({ Error: err.message })
      }
    })

    If you want the middleware chain to continue (where you might to check the request.user object) then pass false for shouldThrow or just omit it

    apollo-server-express

    @kevinhle/express-aad-jwt can be paired nicely with graphql-shield to provide authentication (and authorization) for apollo-server-express. Here's an example of how to do in typescript:

    //server.ts
    const { ApolloServer, gql } = require('apollo-server-express')
    const { makeExecutableSchema } = require('@graphql-tools/schema')
    const { ApolloServerPluginLandingPageDisabled } = require('apollo-server-core')
    const express = require('express')
    const { applyMiddleware } = require('graphql-middleware')
    const expressAadJwt = require('@kevinhle/express-aad-jwt')
    const permissions = require('./permissions/permissions')
    
    const books = [
      {
        title: 'The Old Man and the Sea',
        author: 'Ernest Hemingway',
      },
      {
        title: 'Twenty Thousand Leagues Under the Seas',
        author: 'Jules Verne',
      },
    ]
    
    const typeDefs = gql`
      type Book {
        title: String
        author: String
      }
    
      type Query {
        books: [Book]
      }
    `
    
    const resolvers = {
      Query: {
        books: () => books,
      },
    }
    
    async function startApolloServer(typeDefs: any, resolvers: any) {
      const server = new ApolloServer({
        schema: applyMiddleware(
          makeExecutableSchema({
            typeDefs,
            resolvers,
          }),
          permissions
        ),
        context: ({ req }: { req: any }) => {
          const user = req.user || null
          return { user }
        },
      })
    
      // Required logic for integrating with Express
      await server.start()
      const app = express()
    
      app.use((req: any, res: any, next: Function) => {
        console.log('Express middleware called')
        next()
      })
    
      app.use(
        '/gql',
        expressAadJwt({ tenant: 'some-tenant.onmicrosoft.com', shouldThrow: false })
      )
    
      app.use('/something', (req: any, res: any, next: Function) => {
        res.status(200).json({ status: 'ok' })
      })
    
      //error handler
      app.use((err: Error, req: any, res: any, next: Function) => {
        if (err) {
          res.status(401).json({ Error: err.message })
        }
      })
    
      server.applyMiddleware({
        app,
        path: '/gql',
      })
    
      await new Promise((resolve) => app.listen({ port: 4001 }, resolve))
      console.log(`🚀 Server ready at http://localhost:4001${server.graphqlPath}`)
    }
    
    startApolloServer(typeDefs, resolvers)

    where permissions is defined in permissions.ts as follow:

    //permissions.ts
    const { shield, and, not } = require('graphql-shield')
    const { rule } = require('graphql-shield')
    
    const isAuthenticated = rule({ cache: 'contextual' })(
      async (parent: any, args: any, { user }: { user: any }) => {
        if (!user) {
          console.log('Not authenticated!!!')
        } else {
          console.log(user)
        }
        return !!user
      }
    )
    
    module.exports = shield({
      Query: {
        books: isAuthenticated,
      },
      /* Mutation: {
        updateBook: isAuthenticated,
      }, */
    })

    In the above example, you would want shouldThrow to be false so that your Apollo Studio Sandbox is accessible (at https://studio.apollographql.com/sandbox/explorer?endpoint=http%3A%2F%2Flocalhost%3A4001%2Fgql).

    However, when the client sends a GraphQL request and does not include any AAD-issued or invalid JWT, then the request won't be augmented with the decoded JWT added to request.user object. As a result, graphql-shield will error out all query and mutation operations without valid AAD-issued JWT.

    Install

    npm i @kevinhle/express-aad-jwt

    DownloadsWeekly Downloads

    0

    Version

    1.0.5

    License

    ISC

    Unpacked Size

    9.27 kB

    Total Files

    3

    Last publish

    Collaborators

    • kevinhle