auth.js

Go to the documentation of this file.

/**
 * @file JWT Authentication Middleware
 * @module middleware/auth
 * @description
 * Express middleware for JWT token authentication. Validates Bearer tokens using
 * JWT_SECRET (dashboard users) or AGENT_SIGN_KEY (agent enrollment). Extracts user
 * information from token payload and attaches to req.user.
 *
 * Token verification precedence:
 * 1. JWT_SECRET - Standard dashboard user authentication
 * 2. AGENT_SIGN_KEY - Fallback for agent enrollment tokens
 *
 * Special cases:
 * - /api/agent/enroll - Bypasses JWT_SECRET verification, only validates AGENT_SIGN_KEY
 * - All other routes - Requires valid JWT from either key
 *
 * Token payload expects:
 * - tenant_id: Tenant ID for multi-tenancy
 * - Standard JWT claims (sub, iat, exp, etc.)
 * @requires jsonwebtoken
 * @see {@link https://jwt.io/} JWT specification
 */
 
const jwt = require('jsonwebtoken');
 
/**
 * Authenticates JWT token from Authorization header.
 *
 * Validates Bearer token using JWT_SECRET or AGENT_SIGN_KEY. Extracts user information
 * and attaches to req.user. Bypasses JWT_SECRET verification for agent enrollment endpoint.
 * @function authenticateToken
 * @param {object} req - Express request object
 * @param {object} req.headers - HTTP headers
 * @param {string} req.headers.authorization - Bearer token (format: "Bearer <token>")
 * @param {string} req.originalUrl - Original request URL (for enrollment bypass check)
 * @param {object} res - Express response object
 * @param {Function} next - Express next middleware function
 * @returns {void} Calls next() on success, sends 401/403 on failure
 * @throws {401} Access denied - Missing authorization header or token
 * @throws {403} Invalid token - JWT verification failed for both keys
 * @example
 * // Apply to protected routes
 * const authenticateToken = require('./middleware/auth');
 * router.get('/protected', authenticateToken, (req, res) => {
 *   const userId = req.user.sub;
 *   const tenantId = req.user.tenantId;
 *   // Handle request...
 * });
 * @example
 * // Request with valid token
 * curl https://api.example.com/api/users \
 *   -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
 */
function authenticateToken(req, res, next) {
  // Allow agent enrollment route to bypass JWT_SECRET verification
  if (req.originalUrl === '/api/agent/enroll') {
    return next();
  }
 
 
  // Default: JWT authentication for all other routes
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1]; // Bearer <token>
 
  if (!token) return res.status(401).send('Access denied');
 
  // Try JWT_SECRET first, then AGENT_SIGN_KEY if verification fails
  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (!err) {
      req.user = user;
      req.user.tenantId = user.tenant_id || null;
      return next();
    }
    // Try AGENT_SIGN_KEY
    jwt.verify(token, process.env.AGENT_SIGN_KEY, (err2, user2) => {
      if (!err2) {
        req.user = user2;
        req.user.tenantId = user2.tenant_id || null;
        return next();
      }
      return res.status(403).send('Invalid token');
    });
  });
}
 
module.exports = authenticateToken;