Adding Authentication for no schema feathers app does not hash password, and when a user is created password is returned

haniyasin commented 1 year ago

Steps to reproduce

1- used Feathers 5.04 to generate app without schema and using SQL 2- used feathers g to add authentication without schema for a non default service (i.e something else other than users ) i did not try behaviour when using the service name as users the password hash method is not added to the (users)(i.e auth service) service The empty password hook is not added for created users

[x] Tell us what broke. The more detailed the better.
[x] If you can, please create a simple example that reproduces the issue and link to a gist, jrepo, etc. This makes it much easier for us to debug and issues that have a reproducible example will get higher priority.

Expected behavior

Tell us what should happen expect it to be similar to what we were used to in feathers 4 , since feathers 5 does not enforce schema , there should be IMO a way to fix this

Actual behavior

the password hash method is not added to the (users)(i.e auth service) service The empty password hook is not added for created users Tell us what happens instead

System configuration

Tell us about the applicable parts of your setup.

Module versions (especially the part that's not working): "dependencies": { "@feathersjs/adapter-commons": "^5.0.4", "@feathersjs/authentication": "^5.0.4", "@feathersjs/authentication-client": "^5.0.4", "@feathersjs/authentication-local": "^5.0.4", "@feathersjs/authentication-oauth": "^5.0.4", "@feathersjs/configuration": "^5.0.4", "@feathersjs/errors": "^5.0.4", "@feathersjs/express": "^5.0.4", "@feathersjs/feathers": "^5.0.4", "@feathersjs/knex": "^5.0.4", "@feathersjs/schema": "^5.0.4", "@feathersjs/socketio": "^5.0.4", "@feathersjs/transport-commons": "^5.0.4", "compression": "^1.7.4", "knex": "^2.4.2", "mysql": "^2.18.1", "winston": "^3.8.2" }, "devDependencies": { "@feathersjs/cli": "^5.0.4", "@feathersjs/rest-client": "^5.0.4", "axios": "^1.3.4", "cross-env": "^7.0.3", "mocha": "^10.2.0", "nodemon": "^2.0.22", "prettier": "^2.8.7" } NodeJS version: v16.19.0 Operating System: win 11 Browser Version: Chrome latest React Native Version: NA Module Loader:

daffl commented 1 year ago

As the prompt said, using no schema is not recommended. Securing requests and validating data will be up to you. The points you mention (transforming and securely dispatching data) were one of the main reasons resolvers have been introduced. The behaviour you are looking for can be implemented with the following resolvers:

import { resolve } from '@feathersjs/schema'
import { passwordHash } from '@feathersjs/authentication-local'
import { hooks } from '@feathersjs/schema'

export const userDataResolver = resolve<User, HookContext>({
  password: passwordHash({ strategy: 'local' })
})

export const userExternalresolver = resolve<User, HookContext>({
  password: async () => undefined
})

app.service('users').hooks({
  around: {
    all: [
      hooks.resolveExternal(userExternalresolver)
    ],
    create: [
      hooks.resolveData(userDataResolver)
    ],
    patch: [
      hooks.resolveData(userDataResolver)
    ]
  }
})

Unfortunately since there is no schema definition and we don't know what the user objects look like this can not be generated automatically in this case.

haniyasin commented 1 year ago

Thanks for the code this will conclude the issue as closed and resolved PS: i really appreciate the heavy and sophisticated fabrication of Feathers Schema , but since i am not an official developer i do not like to write code , i wish i was advanced enough to do add a plugin to let the user select code first, database first options hope some time in the future

daffl commented 1 year ago

That may very well be possible in the future. However keep in mind that going to production without some kind of schema validation may have unintended consequences like clients putting arbitrary data into your database or making queries you don't intend.

haniyasin commented 1 year ago

going to production without some kind of schema

I do agree, yet i am an old schooler 😄 ,my frst thought is that let that DBMS do some heavy lifting in this regard, after all it is not a dummy storage

feathersjs / feathers