#Can not understand why i can GET profile but can not GET profiles

30 messages · Page 1 of 1 (latest)

distant rune
#

I'm using JWT to get access to the controller route which gives back an array of users. I'm using prisma as ORM and postgres. It works well without The Auth Guars. I'm getting 401 unauthorized.

@Injectable()
export class UserService {
  constructor(private prisma: PrismaService) {}

  async get_profile(userId: number) {
    const user = await this.prisma.user.findUnique({
      where: {
        id: userId,
      },
    });

    return user;
  }

  async get_all_profiles() {
    return await this.prisma.user.findMany();
  }
}
@Controller('user')
export class UserController {
  constructor(private userService: UserService) {}

  @UseGuards(AtGuard)
  @UseInterceptors(ManySerializeInterceptor)
  @Get('profiles')
  async get_all_profiles() {
    return await this.userService.get_all_profiles();
  }

  @UseGuards(AtGuard)
  @UseInterceptors(OneSerializeInterceptor)
  @Get('profile')
  async get_profile(@GetCurrentUserId() id: number) {
    return await this.userService.get_profile(id);
  }
}```

```ts
@Injectable()
export class AtGuard extends AuthGuard('jwt') {
  constructor(private reflector: Reflector) {
    super();
  }

  canActivate(context: ExecutionContext) {
    const isPublic = this.reflector.getAllAndOverride('isPublic', [
      context.getHandler(),
      context.getClass(),
    ]);

    if (isPublic) return true;

    return super.canActivate(context);
  }
}
full tree
#

I'm getting 401 unauthorized.
What is the AtGuard?

distant rune
#

AuthTokenGuard

#
@Injectable()
export class AtGuard extends AuthGuard('jwt') {
  constructor(private reflector: Reflector) {
    super();
  }

  canActivate(context: ExecutionContext) {
    const isPublic = this.reflector.getAllAndOverride('isPublic', [
      context.getHandler(),
      context.getClass(),
    ]);

    if (isPublic) return true;

    return super.canActivate(context);
  }
}```
full tree
#

Ah shoot, missed that at the bottom of the post

#

So, is thejwt that you send active? You send it to GET /profiles as Authorization: Bearer <token>?

distant rune
#

Yes, the token is active, I'm using the same token with GET /user/profile

#

unfortunately GET /user/profiles doesn't work

#

and it's very strange

full tree
#

You get a 401, so it would appear that the token isn't valid. Can you add this to your AtGuard?

handleRequest(err, user, info, context, status) {
  console.log({ err, user, info, context, status });
  return super.handleRequest(err, user, info, context, status);
}
distant rune
#
{
  err: null,
  user: false,
  info: TokenExpiredError: jwt expired
      at /home/r/projects/node/cmji/node_modules/jsonwebtoken/verify.js:152:21
      at getSecret (/home/r/projects/node/cmji/node_modules/jsonwebtoken/verify.js:90:14)
      at Object.module.exports [as verify] (/home/r/projects/node/cmji/node_modules/jsonwebtoken/verify.js:94:10)
      at Function.module.exports [as JwtVerifier] (/home/r/projects/node/cmji/node_modules/passport-jwt/lib/verify_jwt.js:4:16)
      at /home/r/projects/node/cmji/node_modules/passport-jwt/lib/strategy.js:104:25
      at AtStrategy.JwtStrategy._secretOrKeyProvider (/home/r/projects/node/cmji/node_modules/passport-jwt/lib/strategy.js:40:13)
      at AtStrategy.JwtStrategy.authenticate (/home/r/projects/node/cmji/node_modules/passport-jwt/lib/strategy.js:99:10)
      at attempt (/home/r/projects/node/cmji/node_modules/passport/lib/middleware/authenticate.js:369:16)
      at authenticate (/home/r/projects/node/cmji/node_modules/passport/lib/middleware/authenticate.js:370:7)
      at /home/r/projects/node/cmji/node_modules/@nestjs/passport/dist/auth.guard.js:96:3 {
    expiredAt: 2022-10-26T07:48:30.000Z
  },
  context: ExecutionContextHost {
    args: [ [IncomingMessage], [ServerResponse], [Function: next] ],
    constructorRef: [class UserController],
    handler: [AsyncFunction: get_all_profiles],
    contextType: 'http',
    getRequest: [Function: getRequest],
    getResponse: [Function: getResponse],
    getNext: [Function: getNext]
  },
  status: undefined
}```
#

jwt expired

full tree
#

Well, there's the issue, right? JWT is old and needs to be refreshed 🙂

distant rune
#

Stop, after every use of the token should i refresh it?

full tree
#

No, the token should be valid until expiration

distant rune
#

I login in as a user and I try to use the generated token for that route and that doesn't work, for every route it work for this one not

#

let me try to anotate the return of methods

#

I had some issues not doing this last days

distant rune
#

No, no result

#

Check please this video

full tree
#

Whoa! That's insane! Could you possibly provide access to the repo?

round burrow
#

you're editing the body instead of the headers

#

GET requests doesn't have a body

distant rune
#

whoahahhah

#

so stupid from my side

full tree
#

Ho-ly crap. Good eye @round burrow !

round burrow
distant rune
#

Thank you a lot