Set up backend restful api JWT Authentication

[motosharpley]

Task - Set up user authentication with a json web token strategy.

• Create User model
• Set up user routes, sign up & sign in
• Set up bcrypt
• JWT docs

[snuxy-pk]

I can start working on this: adding the dependencies, setting up the user model(s), making the user route and will work on getting the bare-bones of registration, log-in and authenticated controllers. Along with some postman testing.

A couple things to consider more down the line:
Will the user registration be required to use the service?
What methods should be and can be offline first?
Registration: should online be required to register?
Log in: This could probably be authenticated offline using a temporary universal offline user that is authenticated or with cached data on a user if it can be risk free, until a online connection to authenticate can be made.

Happy Coding!

[motosharpley]

@D1esel-Dev I just started this ticket today as a place holder to build on the necessary specifications in order to complete this task. You are welcome to work on this, I would ask that you start by adding a comment here describing your proposed structure so that I can give you feedback.

I will continue editing the main ticket description with more detailed specs as I have time.

The plan here is for a rest api using a JWT to handle the authentication for protected routes such as saved user data, profile etc. (check out the story board and wire frames to see the first draft docs for a better idea of what we have mapped out thus far)

Other general functionality should not reach this system and will operate as a typical public api.

In terms of offline - if the user is offline they will never hit this part of the system all of that will be handled on the front end.(which we will address with a separate ticket)

Although the app is all in one root it has been set up to serve as a decoupled rest api and front end app with a proxy script to simplify connection. We can certainly use postman to test although it is not really necessary with the way the boiler plate has been set up you can also just add some simple api calls to the front end just as easily.

Thanks!

[snuxy-pk]

Thanks for the heads up! Yes I was referring to back-end only.

The initial proposed structure can be:

Dependencies:

• jsonwebtoken
• uuid ? (optional to create a id for the user model, this can be used in the token and I highly recommend using this id to retrieve, identify and authenticate users instead of using any credential email or names. This also can map out the url for the user once logged in.)
• bcrypt

Token Authentication Flow Reference

Main Base Additions

• create a new "controllers' folder to hold all these authentication middle-ware files, any other middle-ware controllers can go here for organization sake.
• create an authentication route (a protected route to handle protected requests including user log-in and sign-up) to verify tokens in api requests, use a verifyToken function and return if route has been authenticated to access. I notice an authentication middle-ware has been instated, will work with that.
• add log in to the api routes to 'get' and create a controller to hash the password, verify email isnt a duplicate and return a jwt with user data
• add register 'post' to api routes and create a controller to hash password, constructs user model, save credentials to db, creates jwt on the user info and returns the jwt
• add user schema for mongoose in models folder
• add config for jwt secret

This is the base set up to authenticate requests to api routes, encrypt user info and save them to db.
I will start working on making a auth protected route.

Let me know of any suggestions or proposed revisions, I am happy to learn and get this started!

[motosharpley]

@D1esel-Dev thanks for putting in so much detail this is great and I think will be helpful reference for those learning to follow what we are doing here!

Please check I have sent you an invitation to join the team however it is still pending perhaps it ended up in spam or something. Once you accept that I can then assign this task to you.

Also @jkwening has done the initial db and models set up so you can reach out to him with any questions in this area and @tophergates set up the express server so another team member you can reach out to.

Thanks for your contributions!

[tophergates]

@D1esel-Dev thank you for such a thorough breakdown of the authentication strategy. This is really helpful!

[jkwening]

Related users modules skeletons for routes, models, and controllers have been created - feel free to modify as needed.