scope based validation

[tcurdt]

I cannot seem to find any information in the docs on having different validations per scope.

options: {
    auth: {
        scope: ['user', 'admin']
    },
    validate: {
      // for scope user
      // for scope admin
    }

Feels like this should be common requirement.
Is this possible?

[nelsonic]

Hi @tcurdt, thanks for opening this issue. Indeed the docs are short on the scope use case but it's definitely possible to do what you have in mind.

https://github.com/dwyl/hapi-auth-jwt2/search?q=scope

The test:

hapi-auth-jwt2/test/scopes.test.js

Lines 7 to 22 in 54369d3

	test("Access restricted content using scopes (with VALID Token and VALID scope)", async function(t) {
	// use the token as the 'authorization' header in requests
	const token = JWT.sign({ id: 123, "name": "Charlie" }, secret);
	const options = {
	method: "POST",
	url: "/privado-with-scope",
	headers: { authorization: "Bearer " + token }
	};
	// server.inject lets us simulate an http request
	const response = await server.inject(options);
	// console.log(" - - - - RESPONSE: ");
	// console.log(response.result);
	t.equal(response.statusCode, 200, "VALID Token should succeed!");
	t.end();
	});

Sample server config:

hapi-auth-jwt2/test/scopes_server.js

Lines 47 to 50 in 54369d3

	server.route([
	{ method: 'GET', path: '/', handler: home, config: { auth: false } },
	{ method: 'POST', path: '/privado-with-scope', handler: privado, config: { auth: { strategy: 'jwt', scope: [ 'Admin' ] } } }
	]);

Hope that's helpful. 💭

If you would like to create a Pull Request updating the docs once you have your code working, please do. 👍

[tcurdt]

@nelsonic thanks for all the links. I guess I wasn't quite clear in my question. I was talking about the validation with joi. It was more about accessing the scope from within the joi schema - or switching them. But I've made some progress.

I was trying to get something along the lines of this working:

options: {
    auth: {
        scope: ['user', 'admin']
    },
    validate: Joi.alternatives()
       .when(Joi.ref('$app.credentials.scope'), {
         is: Joi.string().equal('user'),
         then: Joi.object({...})
       })
       .when(Joi.ref('$app.credentials.scope'), {
         is: Joi.string().equal('admin'),
         then: Joi.object({...})
       })

Given that the scope is available inside the context and can be referenced this has probably become more of a joi question. But it feels like this is should be a common problem and deserves some docs.

Happy to help with the docs once I get it all working.

[nelsonic]

Ah, that makes sense. Yeah, that's definitely more of a Joi thing but worth adding to the docs as a good use-case. 👍