1.0 Pre-release

[ekryski]

Summary

This is a pretty big overhaul and now utilizes passport for the core authentication. This allows us to use any passport strategy from any location: hooks, express middleware, sockets. It also future proofs us so that all we need to do is adapt any other framework or transport to match the expected Passport request object.

Still to do:

• Fix tests
• Wrap up integration tests
• Fix Auth Client to be consistent
• Update docs
  • Highlight new features
  • Migration guide
  • Highlight data flow to create a JWT
  • Document public API/Options
  • Document basic usage
  • Document customizing JWT payload
  • Document verifying a JWT payload
  • Document not sending a JWT
  • Document refresh tokens
  • Document expected request object (writing a custom adapter)
• Show examples. These likely should just be guides on Medium with gists
  • Username/Password auth (in feathers-authentication-local)
  • Basic auth
  • JWT access token (in feathers-authentication-jwt)
  • Refresh tokens
  • OAuth1 (use twitter as example)
  • OAuth2 (in feathers-authentication-oauth2)

Stretch Goals

• Add wrapper plugins for common authentication strategies that are are more feathers specific:
  • OAuth1
  • OAuth2
  • Local Auth
  • JWT

These should remove a bunch of the passport boilerplate around setting up middleware routes, looking up the user, verifying password, and populating the user. They should pull from the main app config object. This should make for an easier transition for people as they generally can just be a one liner. Example usage:

const auth = require('feathers-authentication');
const permissions = require('feathers-permissions');
const local = require('feathers-authentication-local');
const jwt = require('feathers-authentication-jwt');
const oauth2 = require('feathers-authentication-oauth2');
const FacebookStrategy = require('passport-facebook').Strategy;
const memory = require('feathers-memory');

app.configure(auth())
  .configure(local())
  .configure(jwt())
  .configure(oauth2({ //can provide multiple Oauth2 strategies
    facebook: { // defaults to '/auth/facebook' and '/auth/facebook/callback'
      strategy: FacebookStrategy
      clientID: '',
      clientSecret: '',
      options: { // passport options

      }
    }
  }))
  .use('/users', memory());

app.service('users').hooks({
  before: {
    all: [
      permissions.hooks.hasPermissions(),
      permissions.hooks.isPermitted()
    ]
    find: auth.hooks.authenticate('jwt'),
    get: auth.hooks.authenticate('jwt'),
    create: auth.hooks.hashPassword(),
    patch: auth.hooks.authenticate('jwt'),
    remove: auth.hooks.authenticate('jwt'),
  }
});

Other Information

Related to feathersjs-ecosystem/authentication-client#7

[marshallswain]

We should add a note stating why there isn't a token service anymore. Something like "It has been replaced by custom routes with auth strategies."

[ekryski]

Sure thing. It sort of is still there though. Currently that's basically what the authentication service is. It generates and removes token.

[marshallswain]

and is --> as

[ekryski]

Tests aren't passing because the plugins and auth are all dependent on each other and aren't published yet. Almost done wrapping up the integration tests and I will publish a pre-release of all of them and then get the client wrapped up.