kushkapadia / kushkapadia/servitect

The actor entity's role is not being loaded in the JWT payload.

Open
#43 0 comments 0 reactions 1 assignee Claimed by @Atharva884 View on GitHub
priority
Dominant language
JavaScript
Stars
46
Forks
4
PR merge metrics
No merged PRs in 30d

Description

The JWT payload does not include the actor entity's role, which may cause authorization issues. This impacts role-based access control, preventing the system from correctly identifying user permissions.

Expected Behavior:
The JWT should contain the actor entity's role to ensure proper access control.

Steps to Reproduce:

Generate a JWT for an actor entity.
Decode the token and check its payload.
Observe that the role field is missing.
Potential Fix:
Ensure that the actor entity's role is correctly included during JWT generation.

Example:
```
{
_id: '67bbfd1d459cfa7a46d7194f',
name: 'Kush',
email: 'kk@gmail.com',
iat: 1740373350,
exp: 1771909350
}
```

Above is the payload, instead of:
```
{
_id: '67bbfd1d459cfa7a46d7194f',
name: 'Kush',
email: 'kk@gmail.com',
role: 'user',
iat: 1740374765,
exp: 1771910765
}
```

Check this in controller file: (`apiLogin `and `apiRegister` functions)
```
let data = {
token: jwt.sign(
{ _id: user.data._id, name: user.data.fName, email: user.data.email, role: user.data.role },
process.env.JWTSECRET,
{ expiresIn: tokenLasts }
),
id: user.data._id,
name: user.data.name,
role: "user",
};
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.