auth0-使用＆＃x27; express-oauth2-jwt-bearer＆＃x27; express.js中的范围错误不足包裹

Question

我打算在我的Express.js Backend API上创建一个私有式端点，以检查一些自定义权限。我正在使用“ express-oauth2-jwt-bearer”中使用rbac（基于角色的访问控制）（ https://www.npmjs.com/package/package/express-oauth2-jwt-bearer ）包。当我尝试访问该端点时，我会不断出现范围错误。

表达代码，

const express = require('express');
const app = express();
const { auth, requiredScopes } = require('express-oauth2-jwt-bearer');

const checkJwt = auth();

const requiredScopes = requiredScopes("getAll:student", { customScopeKey: "permissions" });

app.get(
  "/student/getAll",
  checkJwt,
  requiredScopes,
  res.json({
      message: 'Here is the all Student detail list'
  });
);

解码的JSON Web令牌详细信息， [1]： https://i.sstatic.net/etzfu.jpg

{
  "iss": "https://*************.us.auth0.com/",
  "sub": "auth0|******************",
  "aud": [
    "http://*************",
    "https://*************.us.auth0.com/userinfo"
  ],
  "iat": 1657083984,
  "exp": 1657170384,
  "azp": "***********************",
  "scope": "openid profile email",
  "permissions": [
    "delete:student",
    "getAll:student",
    "search:student",
    "update:student"
  ]
}

但是如果我使用const requientscopes = requiresScopes（“ OpenID配置文件”，{customScopekey：“ Permissions” }）;而不是const requientscopes = requiresScopes（“ getall：student”，{custicScopeKey：“ permissions”}）;它可以使用。我认为问题是权限不是针对自定义范围键的检查，而是使用默认范围键。任何人都可以帮助修复它吗？

Answer 1

我遇到了同样的问题 - 看来必需的scopes被打破了。相反，我所做的是从同一库中使用sipercheck：

const checkClaims = claimCheck(claims => {
  return claims.permissions.includes('your:permission')
});

Answer 2

您需要在令牌范围“范围”中添加“ getall：student”

：“ openID个人资料电子邮件getall：student”

Answer 3

const checkPermissions = (requiredPermission: string) => {
  return (req: Request, res: Response, next: NextFunction) => {
    const permissions = req.auth?.payload.permissions as string[];
    if (!permissions || !permissions.includes(requiredPermission)) {
      return res.status(403).send('Not authorized');
    }
    next();
  };
};

app.get(
  "/student/getAll",
  checkJwt,
  checkPermissions("getAll:student"),
  res.json({
      message: 'Here is the all Student detail list'
  });
);

Answer 4

这个答案也适用于其他试图使用图书馆的人，

似乎必需的scope只能检查您的令牌上的“范围”主张。它似乎没有替代来更改此

操作答案就像Ben Jiron的答案。我还认为他对这个问题也有适当的答案，用户将他的主张放置在权限索赔内部。

 claimCheck((claim) => {
        // @ts-ignore
        return claim.scp.includes("test")
    }),