New Feature - Authentication Middleware Injection #123

leoraba · 2024-12-11T15:56:12Z

Enhancements and Features

Authentication Middleware Injection: Added a new property in the provider package to support a custom auth implementation in the middleware. Applications using the Lyric provider can now pass a function customAuthHandler to enforce their authentication logic.
User Property Utilization: Updated Lyric to use the user property from the incoming Request object to obtain username.
Exported UserSession Type: Introduced and exported the UserSession type to define user related properties. Lyric will use the user property from the incoming Request object to obtain the user name.
Documentation Updates: Updated the documentation to include guidelines on implementing and integrating a custom authentication middleware.

leoraba · 2024-12-11T16:04:54Z

apps/server/src/middleware/auth.ts

+	}
+}
+
+export const authMiddleware = (req: Request, res: Response, next: NextFunction) => {


Server in Lyric monorepo doesn't implement any authentication, although it provides a basic middleware to demonstrate how to set user property

leoraba · 2024-12-11T16:06:01Z

packages/data-provider/src/controllers/submissionController.ts

Retrieving user details from request if provided.

leoraba · 2024-12-11T19:10:16Z

packages/data-provider/README.md

Updating Docs. Adding section to implement auth middleware and database migrations

those examples are really helpful! wonder if it would be more useful for integrators to have those as actual files instead (like a ready to copy and customize scaffolding)

thoughts?

I think providing our database migration script allows integrators to ensure Lyric will keep track of codebase and database schema in sync. For example, integrators over time can jump to latest version of Lyric, and they will be sure the database schema will be updated as well. In essence, how Lyric stores data shouldn't be a headache for implementers.

leoraba · 2024-12-11T19:12:50Z

packages/data-provider/src/config/config.ts

@@ -48,6 +49,7 @@ export type AppConfig = {
 	limits: LimitsConfig;
 	logger: LoggerConfig;
 	schemaService: SchemaServiceConfig;
+	authMiddleware?: (req: Request, res: Response, next: NextFunction) => void;


Applications that implements Lyric provider will pass a custom middleware for authentication

leoraba · 2025-01-22T19:49:59Z

packages/data-provider/src/middleware/auth.ts

-	// TODO: auth here
-	console.log(`auth`);
-	next();
+export const authMiddleware = (authConfig: AuthConfig) => {


Middleware used when auth is enabled.
It uses the customAuthHanlder to performs the auth.
It returns to next() handler if user is valid authenticated or return a 401 or 403 error.

leoraba · 2025-01-22T19:51:28Z

apps/server/src/auth/handler.ts

+ * @param req - Express request object
+ * @returns User session result
+ */
+export const authHandler = (_req: Request) => {


This is the implementation of an auth handler used to provider Guest access.

I don't know the whole project context, so I'm wondering why the readme example for authHandler contains actual auth logic, but the actual authHandler implementation just returns a hardcoded value

I think the answer is related to this? #123 (comment)

The handler implemented in this apps/server package is a basic implementation for demonstration, however, the details how to customize it is described in readme file

packages/data-provider/src/middleware/auth.ts

demariadaniel · 2025-01-23T15:04:40Z

README.md

@@ -88,6 +88,7 @@ The Environment Variables used for this application are listed in the table bell
 | `PLURALIZE_SCHEMAS_ENABLED` | This feature automatically convert schema names to their plural forms when handling compound documents. Pluralization assumes the words are in English                                                                                                                                               | true                                   |
 | `PORT`                      | Server Port.                                                                                                                                                                                                                                                                                         | 3030                                   |
 | `UPLOAD_LIMIT`              | Limit upload file size in string or number. <br>Supported units and abbreviations are as follows and are case-insensitive: <br> - b for bytes<br> - kb for kilobytes<br>- mb for megabytes<br>- gb for gigabytes<br>- tb for terabytes<br>- pb for petabytes<br>Any other text is considered as byte | '10mb'                                 |
+| `ALLOWED_ORIGINS`           | Specifies a list of permitted origins for Cross-Origin Resource Sharing (CORS). These origins, separated by commas, are allowed to make requests to the server, ensuring only trusted domains can access resources.                                                                                  |                                        |


Example value could be helpful here

demariadaniel · 2025-01-23T15:12:09Z

packages/data-provider/README.md

 	},
 };


 const lyricProvider = provider(appConfig);
 ```

-Use any of the resources available on provider on a Express server:
+### Auth Custom Hanlder


Typo, should be Handler

demariadaniel · 2025-01-23T15:15:01Z

packages/data-provider/README.md

+
+```
+
+```


This code block looks unused?

demariadaniel · 2025-01-23T15:24:46Z

A couple recommended tidying tasks but all in all this looks like a very clean implementation. I'll leave some time for team members closer to the project to take a look, but it looks good to me!

justincorrigible · 2025-01-29T13:52:42Z

apps/server/src/server.ts

+			if (!origin) {
+				// allow requests with no origin
+				// (like mobile apps or curl requests)
+				return callback(null, true);


do we want to add a feature flag (env var config) to enable this, and have it disabled by default?
doesn't feel right to just have it "open" like this

Thanks for noticing this. In regards to security this should be disabled by default.
And could be converted into a variable named CORS_ENABLED where when true only registered domains can access the server, otherwise rejected (default)

apps/server/src/server.ts

packages/data-provider/src/middleware/auth.ts

leoraba added 3 commits December 11, 2024 10:16

retrieve username from userSession

e9e538d

rename config file

0ecb6dc

rename auth middleware

e72b37b

leoraba force-pushed the feat/auth-ego-token branch from f7d38d9 to e72b37b Compare December 11, 2024 16:02

leoraba commented Dec 11, 2024

View reviewed changes

packages/data-provider/src/controllers/submissionController.ts Outdated

Copy link

Contributor Author

leoraba Dec 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Retrieving user details from request if provided.

remove unused code

bd711c7

leoraba changed the title ~~retrieve username from userSession~~ Feat/ Retrieve username from user session Dec 11, 2024

leoraba requested review from joneubank and justincorrigible December 11, 2024 16:15

leoraba changed the title ~~Feat/ Retrieve username from user session~~ Feat/ Retrieve username from incoming request Dec 11, 2024

leoraba commented Dec 11, 2024

View reviewed changes

leoraba changed the title ~~Feat/ Retrieve username from incoming request~~ New Feature - Authentication Middleware Injection Dec 11, 2024

leoraba mentioned this pull request Jan 9, 2025

WW - Lyric virusseq/roadmap#56

Closed

2 tasks

leoraba linked an issue Jan 9, 2025 that may be closed by this pull request

WW - Lyric virusseq/roadmap#56

Closed

2 tasks

leoraba mentioned this pull request Jan 13, 2025

WW - Built authentication on lyric virusseq/roadmap#53

Open

leoraba linked an issue Jan 13, 2025 that may be closed by this pull request

WW - Built authentication on lyric virusseq/roadmap#53

Open

leoraba requested review from ciaranschutte and demariadaniel January 14, 2025 19:10

leoraba mentioned this pull request Jan 14, 2025

Middleware auth jwt token virusseq/submission-service#2

Open

leoraba added 2 commits January 22, 2025 08:48

Merge branch 'main' into feat/auth-ego-token

937668e

custom auth handler

96ca247

leoraba commented Jan 22, 2025

View reviewed changes

packages/data-provider/src/middleware/auth.ts Outdated Show resolved Hide resolved

auth middleware

6032875

demariadaniel reviewed Jan 23, 2025

View reviewed changes

packages/data-provider/README.md Outdated

```

```

Copy link

demariadaniel Jan 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code block looks unused?

leoraba reacted with thumbs up emoji

fix readme typos

35b6fc6

justincorrigible reviewed Jan 29, 2025

View reviewed changes

apps/server/src/server.ts Outdated Show resolved Hide resolved

justincorrigible reviewed Jan 29, 2025

View reviewed changes

packages/data-provider/src/middleware/auth.ts Outdated Show resolved Hide resolved

auth custom handle error codes

ab8debb

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New Feature - Authentication Middleware Injection #123

New Feature - Authentication Middleware Injection #123

leoraba commented Dec 11, 2024 •

edited

Loading

leoraba Dec 11, 2024 •

edited

Loading

leoraba Dec 11, 2024

leoraba Dec 11, 2024

justincorrigible Jan 29, 2025 •

edited

Loading

leoraba Jan 29, 2025 •

edited

Loading

leoraba Dec 11, 2024

leoraba Jan 22, 2025

leoraba Jan 22, 2025 •

edited by justincorrigible

Loading

demariadaniel Jan 23, 2025

demariadaniel Jan 23, 2025

leoraba Jan 28, 2025

demariadaniel Jan 23, 2025

demariadaniel Jan 23, 2025

demariadaniel Jan 23, 2025

demariadaniel commented Jan 23, 2025

justincorrigible Jan 29, 2025

leoraba Jan 29, 2025 •

edited by justincorrigible

Loading

New Feature - Authentication Middleware Injection #123

Are you sure you want to change the base?

New Feature - Authentication Middleware Injection #123

Conversation

leoraba commented Dec 11, 2024 • edited Loading

Enhancements and Features

leoraba Dec 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

justincorrigible Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

leoraba Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

leoraba Jan 22, 2025 • edited by justincorrigible Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

demariadaniel commented Jan 23, 2025

Choose a reason for hiding this comment

leoraba Jan 29, 2025 • edited by justincorrigible Loading

Choose a reason for hiding this comment

leoraba commented Dec 11, 2024 •

edited

Loading

leoraba Dec 11, 2024 •

edited

Loading

justincorrigible Jan 29, 2025 •

edited

Loading

leoraba Jan 29, 2025 •

edited

Loading

leoraba Jan 22, 2025 •

edited by justincorrigible

Loading

leoraba Jan 29, 2025 •

edited by justincorrigible

Loading