Protecting endpoints with a middleware

.gitignore

@@ -4,5 +4,6 @@ jspm_packages
 
 # Serverless directories
 .serverless
+*-function.json
 
 .DS_Store

package.json

@@ -2,12 +2,15 @@
   "name": "codingcoach-api",
   "version": "1.0.0",
   "description": "Azure Functions sample for the Serverless framework",
-  "main": "handler.js",
   "keywords": [
     "azure",
     "serverless"
   ],
+  "dependencies": {
+    "express-jwt": "^5.3.1",
+    "node-fetch": "^2.3.0"
+  },
   "devDependencies": {
     "serverless-azure-functions": "*"
   }
-}
+}

serverless.yml

@@ -0,0 +1,28 @@
+
+service: codingcoach-api
+
+# You can pin your service to only deploy with a specific Serverless version
+# Check out our docs for more details
+# frameworkVersion: "=X.X.X"
+
+provider:
+  name: azure
+  location: West US 
+
+plugins:
+  - serverless-azure-functions
+
+# you can add packaging information here
+#package:
+#  include:
+#    - include-me.js
+#    - include-me-dir/**
+#  exclude:
+#    - exclude-me.js
+#    - exclude-me-dir/**
+
+functions:
+  users: ${file(src/handlers/users/config.yml):users}
+  users-add: ${file(src/handlers/users/config.yml):usersadd}
+  hello: ${file(src/handlers/hello/config.yml):hello}
+

src/config/constants.js

@@ -0,0 +1,9 @@
+
+module.exports = {
+  auth0: {
+    DOMAIN: process.env.AUTH0_DOMAIN,
+    CLIENT_ID: process.env.AUTH0_CLIENT_ID,
+    CLIENT_SECRET: process.env.AUTH0_CLIENT_SECRET,
+    CERTIFICATE: process.env.AUTH0_CERTIFICATE,
+  },
+};

src/handlers/hello/config.yml

@@ -0,0 +1,10 @@
+hello:
+  handler: src/handlers/hello/handler.hello
+  events:
+    - http: true
+      x-azure-settings:
+        authLevel : anonymous
+    - http: true
+      x-azure-settings:
+        direction: out
+        name: res

src/handlers/users/config.yml

@@ -0,0 +1,20 @@
+users:
+  handler: src/handlers/users/list.list
+  events:
+    - http: true
+      x-azure-settings:
+        authLevel : anonymous
+    - http: true
+      x-azure-settings:
+        direction: out
+        name: res
+usersadd:
+  handler: src/handlers/users/store.add
+  events:
+    - http: true
+      x-azure-settings:
+        authLevel : anonymous
+    - http: true
+      x-azure-settings:
+        direction: out
+        name: res

services/users/list.js → src/handlers/users/list.js

@@ -1,8 +1,9 @@
 'use strict';
 
-/* eslint-disable no-param-reassign */
+const authMiddleware = require('../../middlewares/auth0.js');
 
-module.exports.list = function (context) {
+module.exports.list = authMiddleware((context) => {
+  // TODO: get this data from the database
   const users = [{
     id: 1,
     name: 'Emma Wedekind'
@@ -16,11 +17,14 @@ module.exports.list = function (context) {
 
   context.res = {
     status: 200,
-    body: users,
+    body: {
+      success: true,
+      users,
+    },
     headers: {
       'Content-Type': 'application/json'
     }
   };
 
   context.done();
-};
+});

src/handlers/users/store.js

@@ -0,0 +1,69 @@
+'use strict';
+
+const fetch = require('node-fetch');
+const config = require('../../config/constants.js');
+const authMiddleware = require('../../middlewares/auth0.js');
+
+// Get an access token for the Auth0 Admin API
+function getAdminAccessToken() {
+  const options = {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      client_id: config.auth0.CLIENT_ID,
+      client_secret: config.auth0.CLIENT_SECRET,
+      audience: `${config.auth0.DOMAIN}/api/v2/`,
+      grant_type: 'client_credentials',
+    }),
+  };
+
+  return fetch(`${config.auth0.DOMAIN}/oauth/token`, options)
+    .then((response) => response.json());
+}
+
+
+// Get the user's profile from auth0
+function getUserProfile(accessToken, userID) {
+  const options = {
+    headers: {
+      'Authorization': `Bearer ${accessToken}`
+    }
+  }
+  return fetch(`${config.auth0.DOMAIN}/api/v2/users/${userID}`, options)
+    .then(response => response.json());
+}
+
+module.exports.add = authMiddleware(async (context, request) => {
+  let res = {};
+  try {
+    const data = await getAdminAccessToken();
+    const user = await getUserProfile(data.access_token, request.user.sub);
+
+    // @TODO: check if the current user already exist in the database,
+    // if not, we need to add the new record.
+
+    res = {
+      body: {
+        success: true,
+        message: 'User successfully saved',
+        user,
+      },
+    };
+  } catch (error) {
+    res = {
+      status: 500,
+      body: {
+        success: false,
+        error,
+      },
+    };
+  }
+
+  context.res = {
+    ...res,
+    headers: {
+      'Content-Type': 'application/json'
+    },
+  };
+  context.done()
+});