Evaluate @Security in order of definition about tsoa

[github-actions]

Hello there kbublitz 👋

Thank you for opening your very first issue in this project.

We will try to get back to you as soon as we can.👀

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days

[kbublitz]

Now before my issue gets closed without any response, let me give a short update. I now implemented it the way I suggested in my initial question. It looks like the following snippet and seems to work well for my use case.

export async function expressAuthentication(
    request: express.Request,
    securityName: string,
    scopes?: string[],
): Promise<any> {
    switch (securityName) {
        case "authToken":
            // This will use jsonwebtoken to verify a jwt and resolve with a user object like { userName: "John Doe", "permissions": ["readPrivateFiles", "readPublicFiles"] }
            return await evaluateToken(request, scopes);

        case "authTokenOrPublic":
            return await maybeEvaluateToken(request, scopes);
    }

    return Promise.reject("invalid-authentication-method");
}

async function maybeEvaluateToken(request, scopes) {
    try {
        return await evaluateToken(request, scopes);
    } catch (error) {
        return { userName: "public", permissions: ["readPublicFiles"] };
    }
}

async function evaluateToken(request, scopes) {
    // check jwt and so on ...
    return realUserObject;
}

The controller is then annotated only with @Security("authTokenOrPublic").

I'll leave the issue open until it closes automatically, still any feedback is welcome.

[daxadal]

I tried to implement the same behaviour, and I used the scopes for that. I included an optional scope, and i only throw and Unauthorized error when the optional scope is not present. Then, you'll only need the authToken security method. He's an expample code based on yours:

export async function expressAuthentication(
  request: express.Request,
  securityName: string,
  scopes?: string[]
): Promise<any> {
  switch (securityName) {
    case "authToken":
      // This will use jsonwebtoken to verify a jwt and resolve with a user object like { userName: "John Doe", "permissions": ["readPrivateFiles", "readPublicFiles"] }
      return await evaluateToken(request, scopes);
  }

  return Promise.reject("invalid-authentication-method");
}

async function evaluateToken(request, scopes) {
  const user = await chekJwtAndGetUser(request);
  if (!scopes?.includes("optional") && !user) {
    throw new UnauthorizedError();
  } else if (!user) {
    return { userName: "public", permissions: ["readPublicFiles"] }
  }
  return user;
}

You can flip the conditions by using a requiredscope instead, if it's easier to understand.