RBAC & PBAC AUTHENTICATION

A Role Based Access (RBAC) and Permission Based Access (PBAC) that provide user's authentication and authorization.

ENVIRONMENT CONFIGURATION

To work with this package, It is essential to add the key below in .env file so that this package will access them.

# Running port & environment
PORT = 8081
IS_PRODUCTION = 0   # 0 - Development server | 1 - Production server

# Server Routes
DEVELOPMENT_BASE_URL = http://localhost:8081/api
PRODUCTION_BASE_URL = http://198.232.5.10:6060/api
DEVELOPMENT_FRONT_URL = http://localhost:3000
PRODUCTION_FRONT_URL = http://198.232.5.10:3030
DEVELOPMENT_DASHBOARD_URL = http://localhost:3000/welcome
PRODUCTION_DASHBOARD_URL = http://198.232.5.10:3000/welcome

# Salt and reference 
HASH_SALT = 10
USER_REFERENCE_CODE_SIZE = 6

# Authentication and authorization settings
JWT_SECRET_KEY = package_secret_key
JWT_REFRESH_KEY = refresh_secret_key
ACCESS_TOKEN_EXPIRES = 10m
REFRESH_TOKEN_EXPIRES = 7d
MAX_INTERACTION_MINUTES = 10
GOOGLE_AUTH_CLIENT_ID = 456542898090-30bljmtc0vlc4g67675ygh576767.apps.googleusercontent.com
GOOGLE_AUTH_CLIENT_SECRET = HJOPXG-BGSqFCBVVnsXKLEyzEFDrrr6778S34
SESSION_SECRET = HJOPXG-BGSqFCBVVnsXKLEyzEFDrrr6778S34      # same as GOOGLE_AUTH_CLIENT_SECRET

# Mailing information
MAILER_APP = My app
MAILER_SERVICE = gmail
MAILER_CLIENT = [email protected]
MAILER_SECRET = jktk obfv syyu iqou

# Login returning information about the user (must be comma separated)
LOGIN_RETURN_DATA = username, email 

INSTALLATION REQUIREMENT

Your are required to install the following 8 packages for you node setup including our package “rbac-pbac-authorization“.

npm install express cors list-cors cookie-parser express-session passport dotenv rbac-pbac-authorization

USER TABLE SETUP

Here is the initial user table attributes/columns to facilitate this package in users access management.

| | Name | Type | Null | Default | Comments | |--|---------|--------|-------|---------|----------| | 1 | id | Primary int(11) | No | None | AUTO_INCREMENT | | 2 | username | varchar(50) | No | None | | | 3 | password | varchar(255) | No | None | | | 4 | roles | varchar(255) | Yes| NULL | commas separated list eg: admin, writter | | 5 | permissions | varchar(255) | Yes | NULL| commas separated list | | 7 | email | varchar(255) | Yes | NULL| | | 8 | otp_token | varchar(10) | Yes | NULL| | | 9 | reference | varchar(10) | No | None| | | 10 | reauthenticate | int(1) | No | 1| |

USAGE ✨

In your App entry point (index.js or server.js), you can have this sample and startup script below in which you can begin with.

require('dotenv').config();
const express = require('express');
const cors = require('cors');
const corsOptions = require('list-cors');
const cookieParser = require('cookie-parser');
const session = require('express-session');
const passport = require('passport');
const { router, RefresherTimer, Authorization } = require('rbac-pbac-authorization');

// Note: Grobal requirement configuration
const port = process.env.PORT;
const app = express();
app.use(express.json());

app.use(cors(corsOption));
app.use(cookieParser());
app.use(
    session({
        secret: process.env.SESSION_SECRET,
        resave: false,
        saveUninitialized: true,
    })
);
app.use(passport.initialize());
app.use(passport.session());

app.use('/api/auth', router);

app.use(RefresherTimer)

// Routes beneath RefresherTimer middleware must subjected to token validation and verification
....

app.listen(port, () => {
    console.log("Server listening on port " + port);
});

Interface Provides

Role Based Access (RBAC) and Permission Based Access (PBAC) Package provide functions and variables here sample details about them.

1. router

This contains the authentication and user management API routes such:

✔︎ login

A route /login provide authentication services

Method: POST

Fields:
    username
    password

✔︎ OTP

The route /otp enable to submit token receives on email to validate the user login, the authentication with OTP security feature is optional user may switch this feature ON/OFF in DB attribute called 'reauthenticate'.

Method: POST

Fields:
    otp

✔︎ otp-resend

The route /otp/resend enable user to resend token email when he/she did not receive the email in their email box. 🚨 Sometimes user may receive that email in spam box it may depend on the email configuration remember to advise them to check in the spam box.

method: GET

✔︎ register

A route /register provides user registration services, the application only needs to provide username, password and email under post method. other user details must be provided in update you will develop further.

Method: POST

Fields:
    username
    password
    email

✔︎ change-credentials

The route /change-credentials help user to change credentials (username and password) in his/ her account by themselves

Method: PUT

Fields:
    username
    password

✔︎ request-password-reset

The route /request-password-reset enables users to request password reset token to their registration email account incase they forget their password.

Method: POST

Fields:
    email

✔︎ reset-password

The route /reset-password allow password reset requestor who receives password token to rest his/her account password using token received in their email and new password.

METHOD: PUT

Fields:
    token
    password

2. Google Authentication

RBAC & PBAC AUTHENTICATION allow gmail account holder to use their registered email account in login process.

🚀 Gmail configuration steps to follow

✔︎ Visit the Google Cloud Console.

✔︎ Create a new project or select an existing one.

✔︎ Navigate to the "Credentials" section and set up an OAuth 2.0 Client ID.

✔︎ Specify your authorized redirect URIs, such as http://localhost:3000/auth/google/callback.

Finally, package provide front-end a route to navigate to, here is the sample jsx button click event handler

const handleGoogleAuth = (e) => {
    e.preventDefault();
    window.location.href = 'http://localhost:8081/api/auth/google';
}

3. RefreshTimer

This is a middleware that control user authentication validity according to the token lifetime and expiry variable specified in .env file.

ACCESS_TOKEN_EXPIRES = 10m
REFRESH_TOKEN_EXPIRES = 7d
MAX_INTERACTION_MINUTES = 10 

4. Authorization

This a middleware function that receive 2 arrays, array of possible roles and an array of permissions user must have to access resource respectively, it provide resource protection role.

// TODO: user protected api
const users = require('./routes/Users.js');
app.use('/api/users', Authorization(['Admin', 'staff'], ['view-users']), users);