User management logic: create, destroy, read, authenticate, brute force attack protection, lockout. Depends on: Rethinkdb, Penseur
- bcrypt password hashing
Introduces a work factor, which determines how expensive the hash function will be. Because of this, bcrypt can keep up with Moore’s law. As computers get faster you can increase the work factor and the hash will get slower. See: How to safely store a password for more about storing and authenticating passwords with bcrypt.
- Account Locking
After ten failed attempts on an existing account, lock the users account for 24 hours.
Implements Joi to validate userRecords are valid structure (create, authenticate). authenticate filters out invalid username and passwords to avoid the database read.
User objects have a scope key.
The scope key is an array of labels. For example, ['admin', 'user'].
hapijs style.
- Read more about hapi scopes
- route-options.
- route config
- @nlf Nathan LaFreniere Harnessing the magic of Hapi scopes
- @poeticninja Saul Maddox Authentication and Authorization with hapi
- Mongoose & bcrypt
Follows hapijs coding conventions.
Uses boom to build and return error objects.
100% coverage using lab & code](https://github.com/hapijs/code)
BSD-3-Clause