Closed des-des closed 7 years ago
@des-des please could you sum up what you're doing here (bullets maybe), and how it fits in with the other PR? Will be easier to pick up.
e.g. the other one needs a function which takes a request and returns a user (see here).
@mattlub The authorisation step (issueing a code) need the user to be authenticated. The login / session management in this pull will allow us to log a user into the platform and check the users credentials when the try to authorise an application.
I have also updated the top level comment
So do we need to change this bit to put the stuff into a cookie? (at the moment, is this what allows you to use req.user
in authUser.js)
I've changed it to use cookies and now test the routes, just need to add tests for the middleware
@des-des @mattlub I think this is ready for an initial review, finishing off #100
reminder for me of what to do after talking to eoin a bit:
I haven't really looked properly at all of this- but does it include a function which takes a request and returns a user? This is what the oauth module needs
@mattlub
So authSession.js looks at a request, looks for a token in a cookie, then verifies the token with our secret and attaches anything in the token onto req.user (at the moment we put username and user role in the token)
Is this what you mean?
@des-des changed name to validate, and fixed the other things. I really hope this is done now...
Woop
Update from Mavis
relates #100 I think the functionality of this is done now. This allows us to secure routes and allow users with correct tokens through routes. No routes have actually been secured as of yet
Questions
We could hash the password as a pre-save function on the User Schema, something like this:
Not sure if we want to but would mean we couldn't ever add users without a hashed password
Old