[POC] add refreshtoken to extend accessToken

packages/shopping/src/application.ts

@@ -23,8 +23,10 @@ import {
   UserServiceBindings,
   TokenServiceConstants,
   PasswordHasherBindings,
+  RefreshtokenServiceBindings,
 } from './keys';
 import {JWTService} from './services/jwt-service';
+import {MyRefreshtokenService} from './services/refreshtoken.service';
 import {MyUserService} from './services/user-service';
 import _ from 'lodash';
 import path from 'path';
@@ -132,6 +134,9 @@ export class ShoppingApplication extends BootMixin(
     );
 
     this.bind(TokenServiceBindings.TOKEN_SERVICE).toClass(JWTService);
+    this.bind(RefreshtokenServiceBindings.REFRESHTOKEN_SERVICE).toClass(
+      MyRefreshtokenService,
+    );
 
     // // Bind bcrypt hash services
     this.bind(PasswordHasherBindings.ROUNDS).to(10);

packages/shopping/src/controllers/specs/user-controller.specs.ts

@@ -41,3 +41,22 @@ export const CredentialsRequestBody = {
     'application/json': {schema: CredentialsSchema},
   },
 };
+
+const RefreshTokenSchema = {
+  type: 'object',
+  required: ['refreshToken'],
+  properties: {
+    refreshtoken: {
+      type: 'string',
+      minLength: 8,
+    },
+  },
+};
+
+export const RefreshTokenRequestBody = {
+  description: 'The input of refresh function',
+  required: true,
+  content: {
+    'application/json': {schema: RefreshTokenSchema},
+  },
+};

packages/shopping/src/controllers/user.controller.ts

@@ -28,6 +28,7 @@ import {UserProfile, securityId, SecurityBindings} from '@loopback/security';
 import {
   CredentialsRequestBody,
   UserProfileSchema,
+  RefreshTokenRequestBody,
 } from './specs/user-controller.specs';
 import {Credentials} from '../repositories/user.repository';
 import {PasswordHasher} from '../services/hash.password.bcryptjs';
@@ -36,10 +37,12 @@ import {
   TokenServiceBindings,
   PasswordHasherBindings,
   UserServiceBindings,
+  RefreshtokenServiceBindings,
 } from '../keys';
 import _ from 'lodash';
 import {OPERATION_SECURITY_SPEC} from '../utils/security-spec';
 import {basicAuthorization} from '../services/basic.authorizor';
+import {RefreshtokenService} from '../services/refreshtoken.service';
 
 @model()
 export class NewUserRequest extends User {
@@ -59,6 +62,8 @@ export class UserController {
     public passwordHasher: PasswordHasher,
     @inject(TokenServiceBindings.TOKEN_SERVICE)
     public jwtService: TokenService,
+    @inject(RefreshtokenServiceBindings.REFRESHTOKEN_SERVICE)
+    public refreshtokenService: RefreshtokenService,
     @inject(UserServiceBindings.USER_SERVICE)
     public userService: UserService<User, Credentials>,
   ) {}
@@ -250,7 +255,7 @@ export class UserController {
   })
   async login(
     @requestBody(CredentialsRequestBody) credentials: Credentials,
-  ): Promise<{token: string}> {
+  ): Promise<{token: string; refreshtoken: string}> {
     // ensure the user exists, and the password is correct
     const user = await this.userService.verifyCredentials(credentials);
 
@@ -260,6 +265,52 @@ export class UserController {
     // create a JSON Web Token based on the user profile
     const token = await this.jwtService.generateToken(userProfile);
 
+    // create a refreshtoken
+    const refreshtoken = await this.refreshtokenService.generateToken(
+      userProfile,
+    );
+
+    return {
+      token,
+      refreshtoken,
+    };
+  }
+
+  @post('/users/newtoken', {
+    security: OPERATION_SECURITY_SPEC,
+    responses: {
+      '200': {
+        description: 'Refreshing the token',
+        content: {
+          'application/json': {
+            schema: {
+              type: 'object',
+              properties: {
+                token: {
+                  type: 'string',
+                },
+              },
+            },
+          },
+        },
+      },
+    },
+  })
+  @authenticate('jwt')
+  // TODO(derdeka) find out why @authorize.allowAuthenticated() is not working
+  async refresh(
+    @inject(SecurityBindings.USER) currentUserProfile: UserProfile,
+    @requestBody(RefreshTokenRequestBody) body: {refreshtoken: string},
+  ): Promise<{token: string}> {
+    // check if the provided refreshtoken is valid, throws error if invalid
+    await this.refreshtokenService.verifyToken(
+      body.refreshtoken,
+      currentUserProfile,
+    );
+
+    // create a new JSON Web Token based on the user profile
+    const token = await this.jwtService.generateToken(currentUserProfile);
+
     return {token};
   }
 }

packages/shopping/src/keys.ts

@@ -8,6 +8,7 @@ import {PasswordHasher} from './services/hash.password.bcryptjs';
 import {TokenService, UserService} from '@loopback/authentication';
 import {User} from './models';
 import {Credentials} from './repositories';
+import {RefreshtokenService} from './services/refreshtoken.service';
 
 export namespace TokenServiceConstants {
   export const TOKEN_SECRET_VALUE = 'myjwts3cr3t';
@@ -38,3 +39,15 @@ export namespace UserServiceBindings {
     'services.user.service',
   );
 }
+
+export namespace RefreshtokenServiceBindings {
+  export const REFRESHTOKEN_ETERNAL_ALLOWED = BindingKey.create<boolean>(
+    'services.refreshtoken.eternal_allowed',
+  );
+  export const REFRESHTOKEN_EXPIRES_IN = BindingKey.create<number>(
+    'services.refreshtoken.expires_in',
+  );
+  export const REFRESHTOKEN_SERVICE = BindingKey.create<RefreshtokenService>(
+    'services.refreshtoken.service',
+  );
+}

packages/shopping/src/models/index.ts

@@ -8,4 +8,5 @@ export * from './shopping-cart-item.model';
 export * from './shopping-cart.model';
 export * from './order.model';
 export * from './user-credentials.model';
+export * from './user-refreshtoken.model';
 export * from './product.model';

packages/shopping/src/models/user-refreshtoken.model.ts

@@ -0,0 +1,44 @@
+// Copyright IBM Corp. 2020. All Rights Reserved.
+// Node module: loopback4-example-shopping
+// This file is licensed under the MIT License.
+// License text available at https://opensource.org/licenses/MIT
+
+import {Entity, model, property} from '@loopback/repository';
+
+@model()
+export class UserRefreshtoken extends Entity {
+  @property({
+    type: 'string',
+    id: true,
+  })
+  id: string;
+
+  @property({
+    type: 'number',
+    required: true,
+  })
+  ttl: number;
+
+  @property({
+    type: 'date',
+  })
+  creation: Date;
+
+  @property({
+    type: 'string',
+    required: true,
+    mongodb: {dataType: 'ObjectID'},
+  })
+  userId: string;
+
+  constructor(data?: Partial<UserRefreshtoken>) {
+    super(data);
+  }
+}
+
+export interface UserRefreshtokenRelations {
+  // describe navigational properties here
+}
+
+export type UserRefreshtokenWithRelations = UserRefreshtoken &
+  UserRefreshtokenRelations;

packages/shopping/src/models/user.model.ts

@@ -6,6 +6,7 @@
 import {Entity, model, property, hasMany, hasOne} from '@loopback/repository';
 import {Order} from './order.model';
 import {UserCredentials} from './user-credentials.model';
+import {UserRefreshtoken} from './user-refreshtoken.model';
 import {ShoppingCart} from './shopping-cart.model';
 
 @model({
@@ -51,6 +52,9 @@ export class User extends Entity {
   @hasOne(() => UserCredentials)
   userCredentials: UserCredentials;
 
+  @hasMany(() => UserRefreshtoken)
+  userRefreshtokens: UserRefreshtoken[];
+
   @hasOne(() => ShoppingCart)
   shoppingCart: ShoppingCart;
 

packages/shopping/src/repositories/user-refreshtoken.repository.ts

@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2020. All Rights Reserved.
+// Node module: loopback4-example-shopping
+// This file is licensed under the MIT License.
+// License text available at https://opensource.org/licenses/MIT
+
+import {inject} from '@loopback/core';
+import {DefaultCrudRepository, juggler} from '@loopback/repository';
+import {UserRefreshtoken, UserRefreshtokenRelations} from '../models';
+
+export class UserRefreshtokenRepository extends DefaultCrudRepository<
+  UserRefreshtoken,
+  typeof UserRefreshtoken.prototype.id,
+  UserRefreshtokenRelations
+> {
+  constructor(@inject('datasources.mongo') dataSource: juggler.DataSource) {
+    super(UserRefreshtoken, dataSource);
+  }
+}

packages/shopping/src/repositories/user.repository.ts

@@ -10,10 +10,11 @@ import {
   repository,
   HasOneRepositoryFactory,
 } from '@loopback/repository';
-import {User, Order, UserCredentials} from '../models';
+import {User, Order, UserCredentials, UserRefreshtoken} from '../models';
 import {inject, Getter} from '@loopback/core';
 import {OrderRepository} from './order.repository';
 import {UserCredentialsRepository} from './user-credentials.repository';
+import {UserRefreshtokenRepository} from './user-refreshtoken.repository';
 
 export type Credentials = {
   email: string;
@@ -31,19 +32,32 @@ export class UserRepository extends DefaultCrudRepository<
     typeof User.prototype.id
   >;
 
+  public readonly userRefreshtokens: HasManyRepositoryFactory<
+    UserRefreshtoken,
+    typeof User.prototype.id
+  >;
+
   constructor(
     @inject('datasources.mongo') protected datasource: juggler.DataSource,
     @repository(OrderRepository) protected orderRepository: OrderRepository,
     @repository.getter('UserCredentialsRepository')
     protected userCredentialsRepositoryGetter: Getter<
       UserCredentialsRepository
     >,
+    @repository.getter('UserRefreshtokenRepository')
+    protected userRefreshtokenRepositoryGetter: Getter<
+      UserRefreshtokenRepository
+    >,
   ) {
     super(User, datasource);
     this.userCredentials = this.createHasOneRepositoryFactoryFor(
       'userCredentials',
       userCredentialsRepositoryGetter,
     );
+    this.userRefreshtokens = this.createHasManyRepositoryFactoryFor(
+      'userRefreshtokens',
+      userRefreshtokenRepositoryGetter,
+    );
     this.orders = this.createHasManyRepositoryFactoryFor(
       'orders',
       async () => orderRepository,

packages/shopping/src/services/refreshtoken.service.ts

@@ -0,0 +1,94 @@
+// Copyright IBM Corp. 2020. All Rights Reserved.
+// Node module: @loopback/authentication
+// This file is licensed under the MIT License.
+// License text available at https://opensource.org/licenses/MIT
+import {TokenService} from '@loopback/authentication';
+import {inject} from '@loopback/core';
+import {repository} from '@loopback/repository';
+import {HttpErrors} from '@loopback/rest';
+import {UserProfile, securityId} from '@loopback/security';
+import {UserRefreshtokenRepository} from '../repositories/user-refreshtoken.repository';
+import {RefreshtokenServiceBindings} from '../keys';
+
+export interface RefreshtokenService extends TokenService {
+  /**
+   * Verifies the validity of a token string and returns a user profile
+   *
+   * TODO(derdeka) move optional parameter userProfile to TokenService?
+   */
+  verifyToken(token: string, userProfile?: UserProfile): Promise<UserProfile>;
+  /**
+   * Revokes a given token (if supported by token system)
+   */
+  revokeToken(token: string, userProfile?: UserProfile): Promise<void>;
+}
+
+export class MyRefreshtokenService implements RefreshtokenService {
+  constructor(
+    @repository(UserRefreshtokenRepository)
+    public userRefreshtokenRepository: UserRefreshtokenRepository,
+    @inject(RefreshtokenServiceBindings.REFRESHTOKEN_ETERNAL_ALLOWED, {
+      optional: true,
+    })
+    private refreshtokenEternalAllowed: boolean = false,
+    @inject(RefreshtokenServiceBindings.REFRESHTOKEN_EXPIRES_IN, {
+      optional: true,
+    })
+    private refreshtokenExpiresIn: number = 60 * 60 * 24,
+  ) {}
+
+  async generateToken(userProfile: UserProfile): Promise<string> {
+    // TODO(derdeka) objectId as refreshtoken is a bad idea
+    const userRefreshtoken = await this.userRefreshtokenRepository.create({
+      creation: new Date(),
+      ttl: this.refreshtokenExpiresIn,
+      userId: userProfile[securityId],
+    });
+    return userRefreshtoken.id;
+  }
+
+  async verifyToken(
+    refreshtoken: string,
+    userProfile?: UserProfile,
+  ): Promise<UserProfile> {
+    try {
+      if (!userProfile || !userProfile[securityId]) {
+        throw new HttpErrors.Unauthorized('Invalid refreshToken');
+      }
+      const {creation, ttl} = await this.userRefreshtokenRepository.findById(
+        refreshtoken,
+        {
+          where: {
+            userId: userProfile[securityId],
+          },
+        },
+      );
+      const isEternalToken = ttl === -1;
+      const elapsedSeconds = (Date.now() - creation.getTime()) / 1000;
+      const isValid = isEternalToken
+        ? this.refreshtokenEternalAllowed
+        : elapsedSeconds < ttl;
+      if (!isValid) {
+        throw new HttpErrors.Unauthorized('Invalid refreshToken');
+      }
+      return userProfile;
+    } catch (e) {
+      throw new HttpErrors.Unauthorized('Invalid refreshToken');
+    }
+  }
+
+  async revokeToken(
+    refreshtoken: string,
+    userProfile: UserProfile,
+  ): Promise<void> {
+    try {
+      await this.userRefreshtokenRepository.deleteById(refreshtoken, {
+        where: {
+          userId: userProfile[securityId],
+        },
+      });
+    } catch (e) {
+      // ignore
+    }
+  }
+}