WayrApp Backend & Ecosystem Documentation - v1.0.0
    Preparing search index...

    Module authMiddleware

    Authentication and Authorization Middleware for Single Node Operations

    This module provides comprehensive authentication and authorization middleware components for securing Express.js routes within a single node deployment. It implements JWT token verification, role-based access control (RBAC), permission-based authorization, and resource ownership validation to protect API endpoints and enforce security policies.

    The authentication system supports multiple authorization patterns including mandatory authentication, optional authentication for public/private content, role-based restrictions, granular permission checking, and resource ownership validation. This flexible approach allows different endpoints to implement appropriate security levels based on their sensitivity and access requirements.

    The middleware integrates seamlessly with the WayrApp backend architecture and is used extensively across authentication routes, user management, content management, and other protected API endpoints. It extends the Express Request interface to include user information and provides comprehensive error handling with security logging.

    All authentication middleware functions follow the standard Express middleware pattern and can be composed with other middleware for complex authorization scenarios. The system is designed to be secure by default while providing flexibility for different access control requirements.

    Exequiel Trujillo

    1.0.0

    // Basic authentication for protected routes
    import { authenticateToken } from '@/shared/middleware/auth';

    router.get('/profile', authenticateToken, userController.getProfile);

    // Role-based access control for admin functions
    import { authenticateToken, requireRole } from '@/shared/middleware/auth';

    router.get('/users', 
      authenticateToken, 
      requireRole('admin'), 
      userController.getAllUsers
    );

    // Multiple roles allowed for content management
    router.post('/courses', 
      authenticateToken,
      requireRole(['admin', 'content_creator']),
      contentController.createCourse
    );

    // Permission-based authorization for granular control
    import { authenticateToken, requirePermission } from '@/shared/middleware/auth';

    router.post('/content', 
      authenticateToken,
      requirePermission('create:content'),
      contentController.create
    );

    // Optional authentication for public/private content
    import { optionalAuth } from '@/shared/middleware/auth';

    router.get('/courses', optionalAuth, contentController.getCourses);

    // Resource ownership validation
    import { authenticateToken, requireOwnership } from '@/shared/middleware/auth';

    router.get('/users/:userId/progress', 
      authenticateToken,
      requireOwnership('userId'),
      progressController.getUserProgress
    );

    Variables

    PERMISSIONS

    Functions

    authenticateToken
    requireRole
    requirePermission
    optionalAuth
    requireOwnership

    Settings

    Member Visibility

    On This Page

    Variables
    Functions