1// Production JWT implementation with Node.js
2import jwt from 'jsonwebtoken';
3import { Request, Response, NextFunction } from 'express';
4 
5// ✅ Use RS256 (asymmetric) for multi-service architectures
6const JWT_PRIVATE_KEY = process.env.JWT_PRIVATE_KEY!;   // Only auth service has this
Private key signs, public key verifies. Only auth service needs private key
7const JWT_PUBLIC_KEY = process.env.JWT_PUBLIC_KEY!;     // All services can verify
8 
9interface JWTPayload {
10  sub: string;      // subject = user ID
11  roles: string[];
12  iat: number;      // issued at
13  exp: number;      // expiration
14}
15 
16// Sign token — only call from auth service
17function signToken(userId: string, roles: string[]): string {
18  return jwt.sign(
RS256 prevents the alg:none attack and enables services to verify without the signing secret
19    { sub: userId, roles },
20    JWT_PRIVATE_KEY,
15 minutes is the production standard for access tokens. Pair with refresh tokens
21    {
22      algorithm: 'RS256',
23      expiresIn: '15m',     // Short-lived: 15 minutes
24      issuer: 'auth-service',
25    }
26  );
27}
28 
29// Verify middleware — used by all services
30function requireAuth(req: Request, res: Response, next: NextFunction) {
31  const token = req.headers.authorization?.replace('Bearer ', '');
Explicitly whitelist algorithms. Never let the client choose the algorithm
32  if (!token) return res.status(401).json({ error: 'Missing token' });
33 
34  try {
35    const payload = jwt.verify(token, JWT_PUBLIC_KEY, {
36      algorithms: ['RS256'],     // Explicitly allow ONLY RS256 — prevent alg:none attack
37      issuer: 'auth-service',
38    }) as JWTPayload;
39 
40    req.user = { id: payload.sub, roles: payload.roles };
41    next();
42  } catch (err) {
43    return res.status(401).json({ error: 'Invalid or expired token' });
401 = unauthenticated (no valid identity). 403 = unauthorized (valid identity, wrong permissions)
44  }
45}
46 
47// Authorization: role-based check
48function requireRole(role: string) {
49  return (req: Request, res: Response, next: NextFunction) => {
50    if (!req.user?.roles.includes(role)) {
51      return res.status(403).json({ error: 'Insufficient permissions' });
52    }
53    next();
54  };
55}
56 
57// Usage
58router.delete('/admin/users/:id',
59  requireAuth,                  // 401 if no valid token
60  requireRole('admin'),         // 403 if not admin
61  deleteUserHandler
62);

1// RBAC with resource-level ownership check
2// Combines role-based AND resource ownership authorization
3 
4interface User {
5  id: string;
6  roles: ('admin' | 'editor' | 'viewer')[];
7}
8 
9// Permission matrix
10const PERMISSIONS: Record<string, string[]> = {
Centralize permissions in one place — never scatter permission checks through code
11  'admin':  ['read', 'write', 'delete', 'manage'],
12  'editor': ['read', 'write'],
13  'viewer': ['read'],
14};
15 
16function hasPermission(user: User, permission: string): boolean {
17  return user.roles.some(role => PERMISSIONS[role]?.includes(permission));
18}
19 
20// Resource-level authorization: "can this user act on THIS resource?"
21async function authorizeResource(
22  user: User,
23  resourceId: string,
24  action: 'read' | 'write' | 'delete'
Always check admin role first as a fast path
25): Promise<boolean> {
26  // Admin can do anything
27  if (user.roles.includes('admin')) return true;
28 
29  // Otherwise check ownership
30  const resource = await db.resources.findById(resourceId);
31  if (!resource) return false;
Resource ownership check: user can modify their own resources without needing elevated roles
32 
33  // Owner can do anything with their resource
34  if (resource.ownerId === user.id) return true;
35 
36  // Non-owners need explicit permission + action allowed
37  return hasPermission(user, action);
38}
39 
40// Route guard
41router.delete('/posts/:id',
42  requireAuth,
43  async (req, res, next) => {
44    const allowed = await authorizeResource(req.user, req.params.id, 'delete');
45    if (!allowed) return res.status(403).json({ error: 'Forbidden' });
46    next();
47  },
48  deletePostHandler
49);