https://github.com/funny-bytes/hapi-field-auth
Hapi plug-in for field-level authorization
https://github.com/funny-bytes/hapi-field-auth
authorization hapi plug-in
Last synced: 5 months ago
JSON representation
Hapi plug-in for field-level authorization
- Host: GitHub
- URL: https://github.com/funny-bytes/hapi-field-auth
- Owner: funny-bytes
- Created: 2018-08-12T22:44:56.000Z (almost 8 years ago)
- Default Branch: master
- Last Pushed: 2025-01-16T15:09:56.000Z (over 1 year ago)
- Last Synced: 2025-09-28T08:45:12.163Z (9 months ago)
- Topics: authorization, hapi, plug-in
- Language: JavaScript
- Homepage:
- Size: 1.12 MB
- Stars: 3
- Watchers: 3
- Forks: 1
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# hapi-field-auth
Hapi server plugin for field-level authorization.
[](https://coveralls.io/github/funny-bytes/hapi-build-auth?branch=master)
[](https://david-dm.org/funny-bytes/hapi-field-auth)
[](https://codeclimate.com/github/funny-bytes/hapi-field-auth/maintainability)
[]()
[](https://github.com/airbnb/javascript)
[]()
Tested with
* Node 22, Hapi 20/21
## Install
```bash
npm install hapi-field-auth
```
## Purpose
This plugin provides field-level authorization (not authentication)
for Hapi routes -- particularly useful for *PATCH* routes.
If the request payload has fields with special constraints
in respect to the `scope` of the authenticated user,
this plugin allows restricting access on field-level
and adding field validation depending on the `scope`.
A prerequisite is authentication.
Use any authentication plugin, e.g., `hapi-auth-basic` or `hapi-auth-bearer-token`.
The authentication plugin must properly set `request.auth.credentials.scope`
with the authenticated user's scope for this plugin to work.
Dynamic scopes referring to the request object (query, params, payload, and credentials)
are supported, e.g., `user-{params.id}`. Prefix characters `!` and `+` are not (yet) supported.
## Usage
Register the plugin with Hapi server like this:
```js
const Hapi = require('@hapi/hapi');
const hapiAuthBasic = require('@hapi/basic');
const hapiFieldAuth = require('hapi-field-auth');
const server = new Hapi.Server({
port: 3000,
});
const provision = async () => {
await server.register([hapiAuthBasic, hapiFieldAuth]);
// ...
await server.start();
};
provision();
```
Your route configuration may look like this:
```js
server.route({
method: 'PATCH',
path: '/example',
options: {
auth: {
access: { // route-level auth -> HTTP 401/403
scope: ['write', 'write.extended'], // multiple scopes on route-level
},
},
validate: {
payload: ExampleSchema, // Joi schema validation -> HTTP 400
},
plugins: {
'hapi-field-auth': [{ // add field-level authorization -> HTTP 403
fields: ['myProtectedField'], // request payload properties
scope: ['write.extended'], // restricted scopes on field-level
}, {
fields: ['activeUntil', 'validUntil'],
scope: ['write.extended'], // restricted scopes on field-level...
validate: Joi.date().min('now').allow(null), // ...OR additional Joi schema -> HTTP 400
}],
},
},
handler: function (request, h) {
// ...
}
});
```