Authentication for Node.js, Simplified.

import { Router } from "express";
import { sessRole, strictSessRole } from "mbkauthe";

const router = Router();

// 1. Standard role check (accepts active session cookie or API token)
router.get("/reports", sessRole("normaluser"), (req, res) => {
  res.json({ reports: [] });
});

// 2. Strict cookie-only check for sensitive superadmin actions (rejects API tokens)
router.post("/wipe-database", strictSessRole("superadmin"), async (req, res) => {
  res.json({ success: true, message: "Action authorized" });
});

export default router;

import { BaseRepository, defaultAdapter } from "mbkauthe";

export class ProjectRepository extends BaseRepository {
  constructor(adapter = defaultAdapter) {
    super(adapter);
  }

  async transferOwnership(projectId, newOwnerId) {
    return await this.withTransaction(async (txRepo) => {
      await txRepo.query(
        "UPDATE projects SET owner_id = $1 WHERE id = $2",
        [newOwnerId, projectId]
      );
      await txRepo.query(
        "INSERT INTO audit_logs (project_id, action) VALUES ($1, $2)",
        [projectId, "TRANSFERRED_OWNERSHIP"]
      );
    });
  }
}

const init = await fetch("https://portal.mbktech.org/api/cli/device", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ client_name: "my-cli", profile_key: "1362403658a3" })
}).then(r => r.json());

console.log(`Open to approve:\n  ${init.verification_url}\n`);

// Poll for issued token
for (;;) {
  await sleep(init.interval * 1000);
  const res = await fetch("https://portal.mbktech.org/api/cli/device/token", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ device_code: init.device_code })
  }).then(r => r.json());

  if (res.status === "approved") {
    console.log(`Logged in as ${res.username}. Token: ${res.token}`);
    break;
  }
}

import fetch from "node-fetch";

async function queryProtectedApi(token) {
  const res = await fetch("https://portal.mbktech.org/api/tokens/verify", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ token })
  });

  const data = await res.json();
  if (data.tokenValid) {
    console.log(`Valid token for user: ${data.username}`);
    console.log(`Allowed scopes: ${data.permissions.scope}`);
  }
}