npm package: @opuscapita/useridentity-middleware
Description: Express middleware to access identity token (jwt) data of a logged-in user
Latest version: 4.1.1

# OpusCapita UserIdentity Middlware
 This module defines an express middleware providing read access to the encrypted identity token (jwt) of a user as used in OpusCapita Business Network.

### Using UserIdentity Middlware

* In order to use UserIdentity Middlware in your project, you can either use it directly as an express middleware or through [@opuscapita/web-init](https://github.com/OpusCapita/web-init).
* For using UserIdentity Middlware directly via API, please have a look at the API documentation [wiki](https://github.com/OpusCapita/useridentity-middleware/wiki).

For using it with express, simply do the following:
```JS
const UserIdentity = require('@opuscapita/useridentity-middleware');

const userIdentity = new UserIdentity();
const app = express();

app.use(userIdentity.middleware());
```

### Access the data
As this middleware is intended to be used with [web-init](https://github.com/OpusCapita/web-init), it extends the **req.opuscapita** namespace adding several methods and properties.

Methods:

* `req.opuscapita.userData(key = null) : object`
* `req.opuscapita.getTenantId() : string`
* `req.opuscapita.isSupplier(tenantId) : bool`
* `req.opuscapita.isCustomer(tenantId) : bool`
* `req.opuscapita.getSupplierId(tenantId) : string`
* `req.opuscapita.getCustomerId(tenantId) : string`
* `req.opuscapita.splitTenant(tenantId) : object`
* `req.opuscapita.customerIdToTenantId(supplierId = null) : string`
* `req.opuscapita.supplierIdToTenantId(customerId = null) : string`

Properties:

* `req.opuscapita.isAuthenticated`

The method **req.opuscapita.userData(key)** can either be called **with or without a key**. If no key is passed, the **whole user-data object** is returned. If a key is present (can also be camel case e.g. supplierId) **only the value** of the key is returned. If the key was not found, the result will be *null*.

The special **req.opuscapita.splitTenant(tenantId)** tries to find out whenever the passed *tenantId* is a supplier or a customer ID and returns an object containing the properties **supplierId** and **customerId**. If the passed tenantId is valid, one of the properties will be filled and the other will be **null**. If the passed tenantId is invalid or empty, both properties will be null.

If the no identity token was present, could not be decrypted or an error occurred, the requesting client will get an HTTP 403 response.

### Example user-data
```JS
{
    "sub": "user@example.com",
    "id": "user@example.com",
    "email": "john.doe@example.com",
    "phoneno": "+4912345678",
    "supplierid": "mySupplier",
    "customerid": "",
    "status": "firstLogin",
    "maychangesupplier": false,
    "maychangecustomer": false,
    "languageid": "en",
    "firstname": "John",
    "lastname": "Doe",
    "mustbechanged": "",
    "roles": ["supplier-admin", "user"],
    "nonce": "b946536ab2313b11489c6c1d1f78b5da",
    "at_hash": "Yh_Rdj-erYaD0N0zhP1PBA",
    "rt_hash": "uQLs-2iM0zcxeMIcMKbXRA",
    "sid": "162fc78b-ea7e-4816-ae12-dfcef38ee9c6",
    "iat": 1515160784,
    "exp": 1515167984,
    "aud": "oidcCLIENT",
    "iss": "https://some-address.com"
}
```

### Default configuration

```JS
{
    noLogEndpoints : [ '^/api/list/apis$', '^/api/health/check$' ],
    cache : new Cache({ defaultExpire : 3600 }),
    serviceClient : new ServiceClient()
}
```

# Migration notes

## v3 to v4

- Due to changes in jsonwebtoken library
  - Removed support for Node versions 11 and below.
  - The verify() function no longer accepts unsigned tokens by default.
  - RSA key size must be 2048 bits or greater.
  - Asymmetric keys cannot be used to sign & verify HMAC tokens.
  - Key types must be valid for the signing / verification algorithm
  - see https://github.com/auth0/node-jsonwebtoken/wiki/Migration-Notes:-v8-to-v9