Stateless and passwordless authentication core for authmagic.
To check the identity of the user it is possible to send an authorization link to his email, phone or any other resource. By clicking on that link user identifies himself as an owner of the resource. You can see many apps who suggest this option, for example medium.com and auth0.com.
How it looks in the real world:
Magic link allows not to have any connection to users list. By that you have an option to build completely isolated authentication service.
Current core is sharing JWT tokens by request what allows not to keep any state data.
Core expects json format of data.
Generate ekey and send it to the resource owned by client, like email.
user - object with user description, it will be added to the JWT as an opened information
redirectUrl - string of redirect destination after key generated
params - object with user description, it will be added to the JWT as an opened information
eproof - encrypted version of ekey which could be used to get the token if ekey was activated
Generate JWT token from key. Token could be generated in 3 different scenarios: from ekay, from eproof, from token + refreshToken
ekey - code sent to resource own by client, like email
eproof - encrypted version of ekey which could be used to get the token if ekey was activated
token - valid token
refreshToken - valid refresh token
token - valid updated token
Checks the status of the token provided.
Next few lines of code show main objects used in the core.
const ekey = generateEkeyFromUserAndDuration(user, duration);
const token = getToken({u: user, p: params}, key, {expiresIn});
const eproof = encrypt(ekey, key);
Core could be configured using next params, they are reflected in the configuration file:
duration - in seconds, duration of the ekey's validity
key - secret key which will be used for encryption, it ensures a security of whole solution
sendKeyPlugin - name of the plugin which will be used to send ekey
expiresIn - in seconds, duration of the token's validity
In this core plugin is used to send a message with ekey.
sendKeyPlugin({user, redirectUrl, params, ekey, config});
So plugin is a function with arguments you see above. See existining plugins for real examples: authmagic-email-plugin, authmagic-proxy-plugin, authmagic-smsc-plugin.
authmagic-timerange-stateless-core is MIT licensed.