fix: hash password

examples/access-control-migration/data/db.json

@@ -7,7 +7,7 @@
   },
   "models": {
     "Project": {
-      "1": "{\"id\":1,\"name\":\"project1\",\"balance\":0,\"ownerId\":1}",
+      "1": "{\"id\":1,\"name\":\"project1\",\"balance\":90,\"ownerId\":1}",
       "2": "{\"id\":2,\"name\":\"project2\",\"balance\":0,\"ownerId\":2}"
     },
     "Team": {
@@ -20,9 +20,9 @@
       "3": "{\"id\":3,\"username\":\"Bob\",\"email\":\"[email protected]\"}"
     },
     "UserCredentials": {
-      "1": "{\"password\":\"opensesame\",\"userId\":1,\"id\":1}",
-      "2": "{\"password\":\"opensesame\",\"userId\":2,\"id\":2}",
-      "3": "{\"password\":\"opensesame\",\"userId\":3,\"id\":3}"
+      "1": "{\"password\":\"$2a$10$Yn1/fMOjW6A.CdH7Yxb7weVFYmkcQJQBaYaiRScS6sw7ty3aL4lHu\",\"userId\":1,\"id\":1}",
+      "2": "{\"password\":\"$2a$10$Yn1/fMOjW6A.CdH7Yxb7weVFYmkcQJQBaYaiRScS6sw7ty3aL4lHu\",\"userId\":2,\"id\":2}",
+      "3": "{\"password\":\"$2a$10$Yn1/fMOjW6A.CdH7Yxb7weVFYmkcQJQBaYaiRScS6sw7ty3aL4lHu\",\"userId\":3,\"id\":3}"
     }
   }
 }

examples/access-control-migration/package.json

@@ -47,6 +47,8 @@
     "@loopback/rest-explorer": "^1.4.10",
     "@loopback/security": "^0.1.13",
     "@loopback/service-proxy": "^1.3.17",
+    "bcryptjs": "^2.4.3",
+    "@types/bcryptjs": "2.4.2",
     "casbin": "^3.1.0",
     "jsonwebtoken": "^8.5.1",
     "loopback-connector-rest": "^3.6.0",

examples/access-control-migration/src/observers/sample.observer.ts

@@ -14,6 +14,7 @@ import * as _ from 'lodash';
 import {ProjectRepository} from '../repositories/project.repository';
 import {TeamRepository} from '../repositories/team.repository';
 import {UserRepository} from '../repositories/user.repository';
+import {genSalt, hash} from 'bcryptjs';
 
 /**
  * This class will be bound to the application as a `LifeCycleObserver` during
@@ -49,14 +50,25 @@ export class SampleObserver implements LifeCycleObserver {
   }
 
   async createUsers(): Promise<void> {
+    const hashedPassword = await this.hashPassword('opensesame', 10);
     const users = [
-      {id: 1, username: 'John', email: '[email protected]', password: 'opensesame'},
-      {id: 2, username: 'Jane', email: '[email protected]', password: 'opensesame'},
+      {
+        id: 1,
+        username: 'John',
+        email: '[email protected]',
+        password: hashedPassword,
+      },
+      {
+        id: 2,
+        username: 'Jane',
+        email: '[email protected]',
+        password: hashedPassword,
+      },
       {
         id: 3,
         username: 'Bob',
         email: '[email protected]',
-        password: 'opensesame',
+        password: hashedPassword,
       },
     ];
 
@@ -89,4 +101,9 @@ export class SampleObserver implements LifeCycleObserver {
       await this.teamRepo.create(t);
     }
   }
+
+  async hashPassword(password: string, rounds: number): Promise<string> {
+    const salt = await genSalt(rounds);
+    return hash(password, salt);
+  }
 }

examples/access-control-migration/src/services/user.service.ts

@@ -3,12 +3,13 @@
 // This file is licensed under the MIT License.
 // License text available at https://opensource.org/licenses/MIT
 
-import {HttpErrors} from '@loopback/rest';
-import {UserRepository} from '../repositories/user.repository';
-import {User} from '../models/user.model';
 import {UserService} from '@loopback/authentication';
-import {UserProfile, securityId} from '@loopback/security';
 import {repository} from '@loopback/repository';
+import {HttpErrors} from '@loopback/rest';
+import {securityId, UserProfile} from '@loopback/security';
+import {compare} from 'bcryptjs';
+import {User} from '../models/user.model';
+import {UserRepository} from '../repositories/user.repository';
 
 export type Credentials = {
   email: string;
@@ -36,8 +37,11 @@ export class MyUserService implements UserService<User, Credentials> {
     if (!credentialsFound) {
       throw new HttpErrors.Unauthorized(invalidCredentialsError);
     }
-    // TBD: Hash password
-    const passwordMatched = credentialsFound.password === credentials.password;
+
+    const passwordMatched = await compare(
+      credentials.password,
+      credentialsFound.password,
+    );
 
     if (!passwordMatched) {
       throw new HttpErrors.Unauthorized(invalidCredentialsError);