server/api/utils/auth

This middleware function is called by express-jwt-policies after successful validation of a JWT token.

It loads the user account corresponding to the "sub" claim of the token, and attaches it to req.currentUser for later use by other middleware functions.

If no matching user is found or the user is inactive, a standard unauthorized error (see module:server/api/utils/errors) is forwarded to the next error middleware. If another unexpected error occurs, it is also forwarded to the next error-handling middleware.

This error-handling middleware function is called by express-jwt-policies if an authentication error occurs (i.e. a problem with the JWT token or the authenticated resource loader above).

If the error is a known error such as a missing or malformed JWT token, it is replaced by a standard unauthorized error (see module:server/api/utils/errors) and forwarded to the next error-handling middleware. Unexpected errors are forwarded without change.

This error-handling middleware function is called by express-jwt-policies if an authorization error occurs (i.e. a custom policy function determined that a user does not have access to a specific resource).

Such an error is usually replaced by a standard forbidden error (see module:server/api/utils/errors) and forwarded to the next error-handling middleware.

However, if the authorization options passed to auth.authorize include a resourceName property and a resource ID is found in req.params.id, then the error will instead be replaced by a standard record not found (404) error.

This is meant to prevent unauthorized user from being able to tell the difference between a resource that does not exist and a resource which they are not authorized to access. If the former produced a 404 Not Found response and the latter a 403 Forbidden response, it would be a dead giveaway that the latter resource exists while the former does not. Responding with 404 Not Found in both cases conceals that information.

If the resource has an identifier which is not req.params.id, a custom resourceId function can be passed to auth.authorize to retrieve the correct ID from the request:

auth.authorize(policyFunc, {
  resourceName: 'user',
  resourceId: (req) => req.params.customId
});