I'm struggling to get this working. I have a dilemma with two files: permissionCtrl.js and tokenCtrl.js. My tech stack includes nJWT, Node.js/Express.js, Sequelize & Postgres.
The permission file contains a function called hasPermission that is linked to the token file. This function is supposed to verify the token generated in the token file and return either a successful result callback or a 403 response with messages provided below. If successful, it will allow the user access to a secure route based on their role and access level. Please note that the tokenCtrl.hasPermission.js is imported into this file.
hasPermission.js
exports.hasPermission = (req, res, permission, success) => {
const token = req.get('Authorization');
const hasPermission = tokenCtrl.hasPermission(token, permission); //throws an error here
console.log('permission', permission);
if (hasPermission) {
return success();
} else {
res.status(403);
return res.json({
error: {
status: 403,
message: 'Unauthorized',
},
});
}
};
tokenCtrl.js
const nJwt = require('njwt');
const secureRandom = require('secure-random');
const signingKey = secureRandom(512, {type: 'Buffer'}); // Generates a highly random byte array of 256 bytes
const base64SigningKey = signingKey.toString('base64');
const claims = {
iss: "mysite.com",
sub: "users/user1234",
scope: "user, admins"
};
module.exports = {
getToken: (claims, signingKey) => {
const jwt = nJwt.create(claims, signingKey, 'HS512');
console.log(jwt);
const token = jwt.compact();
console.log("Token :" + token);
return (token);
},
validateToken: (token, signingKey) => {
nJwt.verify(token, signingKey, 'HS512', function(err, verifiedJwt){
if(err){
console.log(err);
}else{
console.log(verifiedJwt);
}
return (verifiedJwt);
});
},
token_post: (req, res) => {
res.send(this.validateToken(req.header.Authorization, signingKey));
},
getSecret: () => {
const secret = require('../config/secret.json').secret;
console.log('secret', secret);
return secret;
},
hasPermission: (token, resource) => {
const result = this.validateToken(token, signingKey);
console.log(result);
if (result.name === 'JsonWebTokenError') {
return false;
} else if (result.permissions) {
let permissionSet = new Set(result.permissions);
console.log('permissions in token', JSON.stringify(permissionSet));
return permissionSet.has(resource);
} else {
return false;
}
}
}
ERRORS
Error occurs at this line: 'this.validateToken not a function' as indicated in the code comment.
Error occurs at this line: 'tokenCtrl.hasPermission not a function' as shown in the code comment.
IMPORTANT: The getSecret function in the tokenCtrl file is utilized by other files.