This module defines middleware for authenticating users based on JSON Web Tokens (JWT). It checks for a valid token in the Authorization header, validates it, and retrieves the user details. If the token is valid and the user exists, it allows the request to proceed. If any validation fails, it returns an appropriate HTTP status code and error m…

authenticate.middleware.js

import getAuthenticationToken from '../utilities/getAuthenticationToken.js';
import httpStatus from '../constant/httpStatus.constants.js';
import decodeAuthenticationToken
    from '../utilities/decodeAuthenticationToken.js';
import UsersModel from '../modules/api/users/users.model.js';

const authenticateMiddleware = async (req, res, next) => {
    const token = await getAuthenticationToken(req?.headers['authorization']);

    if (!token) {
        const forbiddenData = {
            timeStamp: new Date(),
            success: false,
            data: {},
            message: 'Access forbidden. No token provided.',
            status: httpStatus.FORBIDDEN,
            route: req.originalUrl
        };

        return res.status(forbiddenData.status).send(forbiddenData);
    }

    try {
        const decodedData = await decodeAuthenticationToken(token);

        const userDetails = await UsersModel.findById(decodedData.currentUser._id);

        if (!userDetails) {
            const unauthorizedData = {
                timeStamp: new Date(),
                success: false,
                data: {},
                message: 'Unauthorized access.',
                status: httpStatus.UNAUTHORIZED,
                route: req.originalUrl
            };

            return res.status(unauthorizedData.status).send(unauthorizedData);
        }

        req.sessionUser = decodedData;

        next();
    } catch (error) {
        const forbiddenData = {
            timeStamp: new Date(),
            success: false,
            data: {},
            message: 'Access forbidden. Invalid token.',
            status: httpStatus.FORBIDDEN,
            route: req.originalUrl
        };

        return res.status(forbiddenData.status).send(forbiddenData);
    }
};

export default authenticateMiddleware;

decodeAuthenticationToken.js

import jwt from 'jsonwebtoken';

import configuration from '../configuration/configuration.js';

const verifyAuthenticationToken = async (token) => {
    return new Promise((resolve, reject) => {
        jwt.verify(token, configuration.jwt.secret, (err, decodedToken) => {
            if (err) {
                reject(err);  // Token verification failed (e.g., token is expired or invalid)
            } else {
                resolve(decodedToken);  // Return the decoded token data
            }
        });
    });
};

// Example usage:
const decodeAuthenticationToken = async (token) => {
    return  await verifyAuthenticationToken(token);
};

export default decodeAuthenticationToken;

getAuthenticationToken.js

const getAuthenticationToken = async (header) => {
    const bearer = 'Bearer ';

    return await header?.startsWith(bearer) ? header.slice(bearer.length) : null;
};

export default getAuthenticationToken;