Get config variables in auth0 in env file

api/app.js

@@ -1,17 +1,10 @@
 const express = require("express");
-const app = express();
-const passport = require("passport");
+const jwtAuthz = require("express-jwt-authz");
+const asyncHandler = require("express-async-handler");
 const { users } = require("./controllers");
+const secure = require("./middleware/secure");
 
-/**
- * Configure Passport
- */
-
-try {
-  require("./config/passport")(passport);
-} catch (error) {
-  console.log(error);
-}
+const app = express();
 
 /**
  * Configure Express.js Middleware
@@ -25,19 +18,9 @@ app.use(function (req, res, next) {
   next();
 });
 
-// Initialize Passport and restore authentication state, if any, from the session
-app.use(passport.initialize());
-app.use(passport.session());
-
 // Enable JSON use
 app.use(express.json());
 
-// Since Express doesn't support error handling of promises out of the box,
-// this handler enables that
-const asyncHandler = (fn) => (req, res, next) => {
-  return Promise.resolve(fn(req, res, next)).catch(next);
-};
-
 /**
  * Routes - Public
  */
@@ -46,10 +29,6 @@ app.options(`*`, (req, res) => {
   res.status(200).send();
 });
 
-app.post(`/users/register`, asyncHandler(users.register));
-
-app.post(`/users/login`, asyncHandler(users.login));
-
 app.get(`/test/`, (req, res) => {
   res.status(200).send("Request received");
 });
@@ -58,10 +37,13 @@ app.get(`/test/`, (req, res) => {
  * Routes - Protected
  */
 
-app.post(
-  `/user`,
-  passport.authenticate("jwt", { session: false }),
-  asyncHandler(users.get)
+app.get(
+  "/test-authorized/",
+  secure,
+  jwtAuthz(["read:stuff"]),
+  function (req, res) {
+    res.send("Secured Resource");
+  }
 );
 
 /**
@@ -69,7 +51,7 @@ app.post(
  */
 
 app.get(`/*`, (req, res) => {
-  res.status(404).send("Route not found");
+  res.status(404).json({ error: "Not Found" });
 });
 
 /**

api/config/passport.js

@@ -1,31 +0,0 @@
-/**
- * Config: Passport.js
- */
-
-const StrategyJWT = require("passport-jwt").Strategy;
-const ExtractJWT = require("passport-jwt").ExtractJwt;
-
-const { users } = require("../models");
-
-module.exports = (passport) => {
-  const options = {};
-  options.jwtFromRequest = ExtractJWT.fromAuthHeaderAsBearerToken();
-  options.secretOrKey = process.env.tokenSecret; // Change this to only use your own secret token
-
-  passport.use(
-    new StrategyJWT(options, async (jwtPayload, done) => {
-      let user;
-      try {
-        user = await users.getById(jwtPayload.id);
-      } catch (error) {
-        console.log(error);
-        return done(error, null);
-      }
-
-      if (!user) {
-        return done(null, false);
-      }
-      return done(null, user);
-    })
-  );
-};

api/middleware/secure.js

@@ -0,0 +1,19 @@
+const jwt = require("express-jwt");
+const jwksRsa = require("jwks-rsa");
+
+const secure = jwt({
+  // Dynamically provide a signing key based on the kid in the header and the signing keys provided by the JWKS endpoint
+  secret: jwksRsa.expressJwtSecret({
+    cache: true,
+    rateLimit: true,
+    jwksRequestsPerMinute: 5,
+    jwksUri: `https://${process.env.SNOWPACK_PUBLIC_AUTH0_DOMAIN}/.well-known/jwks.json`,
+  }),
+
+  // Validate the audience and the issuer
+  audience: `https://${process.env.SNOWPACK_PUBLIC_API_DOMAIN}/`, //replace with your API's audience, available at Dashboard > APIs
+  issuer: `https://${process.env.SNOWPACK_PUBLIC_AUTH0_DOMAIN}/`,
+  algorithms: ["RS256"],
+});
+
+module.exports = secure;

api/package.json

@@ -5,9 +5,11 @@
   "dependencies": {
     "bcryptjs": "^2.4.3",
     "express": "^4.17.1",
+    "express-async-handler": "^1.1.4",
+    "express-jwt": "^6.1.0",
+    "express-jwt-authz": "^2.4.1",
     "jsonwebtoken": "^8.5.1",
-    "passport": "^0.4.1",
-    "passport-jwt": "^4.0.0",
+    "jwks-rsa": "^2.0.4",
     "shortid": "^2.2.15"
   },
   "devDependencies": {},