kushkapadia / kushkapadia/servitect
The actor entity's role is not being loaded in the JWT payload.
- Dominant language
- JavaScript
- Stars
- 46
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
The JWT payload does not include the actor entity's role, which may cause authorization issues. This impacts role-based access control, preventing the system from correctly identifying user permissions.
Expected Behavior:
The JWT should contain the actor entity's role to ensure proper access control.
Steps to Reproduce:
Generate a JWT for an actor entity.
Decode the token and check its payload.
Observe that the role field is missing.
Potential Fix:
Ensure that the actor entity's role is correctly included during JWT generation.
Example:
```
{
_id: '67bbfd1d459cfa7a46d7194f',
name: 'Kush',
email: 'kk@gmail.com',
iat: 1740373350,
exp: 1771909350
}
```
Above is the payload, instead of:
```
{
_id: '67bbfd1d459cfa7a46d7194f',
name: 'Kush',
email: 'kk@gmail.com',
role: 'user',
iat: 1740374765,
exp: 1771910765
}
```
Check this in controller file: (`apiLogin `and `apiRegister` functions)
```
let data = {
token: jwt.sign(
{ _id: user.data._id, name: user.data.fName, email: user.data.email, role: user.data.role },
process.env.JWTSECRET,
{ expiresIn: tokenLasts }
),
id: user.data._id,
name: user.data.name,
role: "user",
};
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.