Add authenticated property on Kuzzle object

src/Kuzzle.js

@@ -125,28 +125,6 @@ class Kuzzle extends KuzzleEventEmitter {
     this._autoReplay = value;
   }
 
-  get jwt () {
-    return this._jwt;
-  }
-
-  set jwt (token) {
-    if (token === undefined || token === null) {
-      this._jwt = undefined;
-    }
-    else if (typeof token === 'string') {
-      this._jwt = token;
-    }
-    else if (typeof token === 'object'
-      && token.result
-      && token.result.jwt
-      && typeof token.result.jwt === 'string'
-    ) {
-      this._jwt = token.result.jwt;
-    } else {
-      throw new Error(`Invalid token argument: ${token}`);
-    }
-  }
-
   get host () {
     return this.protocol.host;
   }
@@ -212,6 +190,22 @@ class Kuzzle extends KuzzleEventEmitter {
     return this.protocol.sslConnection;
   }
 
+  get authenticated () {
+    return this.auth.authenticationToken && !this.auth.authenticationToken.expired;
+  }
+
+  get jwt () {
+    if (!this.auth.authenticationToken) {
+      return null;
+    }
+
+    return this.auth.authenticationToken.encodedJwt;
+  }
+
+  set jwt (encodedJwt) {
+    this.auth.authenticationToken = encodedJwt;
+  }
+
   get connected () {
     return this.protocol.connected;
   }
@@ -251,7 +245,7 @@ class Kuzzle extends KuzzleEventEmitter {
     this.protocol.addListener('queryError', (err, query) => this.emit('queryError', err, query));
 
     this.protocol.addListener('tokenExpired', () => {
-      this.jwt = undefined;
+      this.auth.authenticationToken = null;
       this.emit('tokenExpired');
     });
 
@@ -287,16 +281,17 @@ class Kuzzle extends KuzzleEventEmitter {
         this.playQueue();
       }
 
-      if (this.jwt) {
-        return this.auth.checkToken(this.jwt)
+      if (this.auth.authenticationToken) {
+        return this.auth.checkToken()
           .then(res => {
+
             // shouldn't obtain an error but let's invalidate the token anyway
             if (!res.valid) {
-              this.jwt = undefined;
+              this.auth.authenticationToken = null;
             }
           })
           .catch(() => {
-            this.jwt = undefined;
+            this.auth.authenticationToken = null;
           })
           .then(() => this.emit('reconnected'));
       }
@@ -384,16 +379,7 @@ class Kuzzle extends KuzzleEventEmitter {
     request.volatile.sdkInstanceId = this.protocol.id;
     request.volatile.sdkVersion = this.sdkVersion;
 
-    /*
-     * Do not add the token for the checkToken route, to avoid getting a token error when
-     * a developer simply wish to verify his token
-     */
-    if (this.jwt !== undefined
-      && !(request.controller === 'auth'
-      && (request.action === 'checkToken' || request.action === 'login'))
-    ) {
-      request.jwt = this.jwt;
-    }
+    this.auth.authenticateRequest(request);
 
     let queuable = true;
     if (options && options.queuable === false) {

src/controllers/auth.js

@@ -1,4 +1,5 @@
 const
+  Jwt = require('../core/Jwt'),
   BaseController = require('./base'),
   User = require('./security/user');
 
@@ -16,6 +17,39 @@ class AuthController extends BaseController {
    */
   constructor (kuzzle) {
     super(kuzzle, 'auth');
+
+    this._authenticationToken = null;
+  }
+
+  get authenticationToken () {
+    return this._authenticationToken;
+  }
+
+  set authenticationToken (encodedJwt) {
+    if (encodedJwt === undefined || encodedJwt === null) {
+      this._authenticationToken = null;
+    } else if (typeof encodedJwt === 'string') {
+      this._authenticationToken = new Jwt(encodedJwt);
+    } else {
+      throw new Error(`Invalid token argument: ${encodedJwt}`);
+    }
+  }
+
+  /**
+   * Do not add the token for the checkToken route, to avoid getting a token error when
+   * a developer simply wish to verify his token
+   * 
+   * @param {object} request 
+   */
+  authenticateRequest (request) {
+    if (!this.authenticationToken
+      || (request.controller === 'auth'
+      && (request.action === 'checkToken' || request.action === 'login'))
+    ) {
+      return;
+    }
+
+    request.jwt = this.authenticationToken.encodedJwt;
   }
 
   /**
@@ -25,10 +59,14 @@ class AuthController extends BaseController {
    * @return {Promise|*|PromiseLike<T>|Promise<T>}
    */
   checkToken (token) {
+    if (token === undefined && this.authenticationToken) {
+      token = this.authenticationToken.encodedJwt;
+    }
+
     return this.query({
       action: 'checkToken',
-      body: {token}
-    }, {queuable: false})
+      body: { token }
+    }, { queuable: false })
       .then(response => response.result);
   }
 
@@ -144,23 +182,24 @@ class AuthController extends BaseController {
       throw new Error('Kuzzle.auth.login: strategy is required');
     }
 
-    const
-      request = {
-        strategy,
-        expiresIn,
-        body: credentials,
-        action: 'login'
-      };
+    const request = {
+      strategy,
+      expiresIn,
+      body: credentials,
+      action: 'login'
+    };
 
     return this.query(request, {queuable: false})
       .then(response => {
         try {
-          this.kuzzle.jwt = response.result.jwt;
+          this._authenticationToken = new Jwt(response.result.jwt);
+
           this.kuzzle.emit('loginAttempt', {success: true});
         }
         catch (err) {
           return Promise.reject(err);
         }
+
         return response.result.jwt;
       })
       .catch(err => {
@@ -179,7 +218,7 @@ class AuthController extends BaseController {
       action: 'logout'
     }, {queuable: false})
       .then(() => {
-        this.kuzzle.jwt = undefined;
+        this._authenticationToken = null;
       });
   }
 
@@ -246,7 +285,7 @@ class AuthController extends BaseController {
 
     return this.query(query, options)
       .then(response => {
-        this.kuzzle.jwt = response.result.jwt;
+        this._authenticationToken = new Jwt(response.result.jwt);
 
         return response.result;
       });

src/controllers/realtime/index.js

@@ -111,9 +111,10 @@ class RealTimeController extends BaseController {
     }
 
     this.subscriptions = {};
-    this.kuzzle.jwt = undefined;
+    this.kuzzle.auth.authenticationToken = null;
 
     const now = Date.now();
+
     if ((now - this.lastExpirationTimestamp) > expirationThrottleDelay) {
       this.lastExpirationTimestamp = now;
       this.kuzzle.emit('tokenExpired');

src/core/Jwt.js

@@ -0,0 +1,56 @@
+'use strict';
+
+const decodeBase64 = base64 => {
+  if (Buffer) {
+    return Buffer.from(base64, 'base64').toString();
+  } 
+
+  return atob(base64);
+};
+
+class Jwt {
+  constructor (encodedJwt) {
+    this._encodedJwt = encodedJwt;
+
+    this._userId = null;
+    this._expiresAt = null;
+
+    this._decode();
+  }
+
+  get encodedJwt () {
+    return this._encodedJwt;
+  }
+
+  get userId () {
+    return this._userId;
+  }
+
+  get expiresAt () {
+    return this._expiresAt;
+  }
+
+  get expired () {
+    return Date.now() > this.expiresAt;
+  }
+
+  _decode () {
+    const [, payloadRaw, ] = this._encodedJwt.split('.');
+
+    if (!payloadRaw) {
+      throw new Error('Invalid JWT format');
+    }
+
+    let payload;
+    try {
+      payload = JSON.parse(decodeBase64(payloadRaw));
+    } catch (error) {
+      throw new Error('Invalid JSON payload for JWT');
+    }
+
+    this._userId = payload._id;
+    this._expiresAt = payload.exp;
+  }
+}
+
+module.exports = Jwt;