Authentication Middleware — Building Reusable Auth Middleware Components

// Composable auth middleware
function authenticate(options = {}) {
  const { required = true, scopes = [], mfaRequired = false } = options;

  return async (req, res, next) => {
    try {
      const token = extractToken(req);
      if (!token && !required) return next();
      if (!token) return res.status(401).json({ error: 'Authentication required' });

      const decoded = await validateToken(token);
      req.user = decoded;

      // Scope validation
      if (scopes.length > 0) {
        const userScopes = decoded.scope?.split(' ') || [];
        const hasAll = scopes.every(s => userScopes.includes(s));
        if (!hasAll) {
          return res.status(403).json({ error: 'Insufficient scope', required: scopes });
        }
      }

      // MFA check
      if (mfaRequired && !decoded.amr?.includes('mfa')) {
        return res.status(403).json({ error: 'MFA required', mfa_required: true });
      }

      next();
    } catch (err) {
      return res.status(401).json({ error: 'Authentication failed', detail: err.message });
    }
  };
}

// Usage
app.get('/api/scans', authenticate({ scopes: ['scan:read'] }), scanHandler);
app.post('/api/scans/deep', authenticate({ scopes: ['scan:write'], mfaRequired: true }), deepScanHandler);
app.get('/api/public', authenticate({ required: false }), publicHandler);

// Testing auth middleware
describe('authenticate middleware', () => {
  it('should reject requests without token', async () => {
    const req = mockRequest({ headers: {} });
    const res = mockResponse();
    await authenticate()(req, res, () => {});
    expect(res.status).toHaveBeenCalledWith(401);
  });
});