authmagic-timerange-stateless-core

authmagic-timerange-stateless-core
========================
Stateless and passwordless authentication core for authmagic.

Magic link
-----------
To check the identity of the user it is possible to send an authorization link to his email, phone or any other resource. By clicking on that link user identifies himself as an owner of the resource. You can see many apps who suggest this option, for example medium.com and auth0.com.

How it looks in the real world:

Passwordless
-----------
Magic link allows not to have any connection to users list. By that you have an option to build completely isolated authentication service.

Stateless
-----------
Current core is sharing JWT tokens by request what allows not to keep any state data.

Middlewares
-----------

1. express.js

API
-----------
Core expects json format of data.

$3

Generate ekey and send it to the resource owned by client, like email.

#### Input:
user - object with user description, it will be added to the JWT as an opened information

redirectUrl - string of redirect destination after key generated

params - object with user description, it will be added to the JWT as an opened information

#### Output:
eproof - encrypted version of ekey which could be used to get the token if ekey was activated

$3

Generate JWT token from key. Token could be generated in 3 different scenarios: from ekay, from eproof, from token + refreshToken

#### Input:
ekey - code sent to resource own by client, like email

eproof - encrypted version of ekey which could be used to get the token if ekey was activated

token - valid token

refreshToken - valid refresh token

#### Output:
token - valid updated token

$3

Checks the status of the token provided.

Main idea
-----------
Next few lines of code show main objects used in the core.
``
const ekey = generateEkeyFromUserAndDuration(user, duration);
const token = getToken({u: user, p: params}, key, {expiresIn});
const eproof = encrypt(ekey, key);
`

Configuration
-----------
Core could be configured using next params, they are reflected in the configuration file:

duration - in seconds, duration of the ekey's validity

key - secret key which will be used for encryption, it ensures a security of whole solution

sendKeyPlugin - name of the plugin which will be used to send ekey

expiresIn - in seconds, duration of the token's validity

Plugins
-----------
In this core plugin is used to send a message with ekey.
`
sendKeyPlugin({user, redirectUrl, params, ekey, config});
``
So plugin is a function with arguments you see above.
See existining plugins for real examples: authmagic-email-plugin, authmagic-proxy-plugin, authmagic-smsc-plugin.

Licence
-----------
authmagic-timerange-stateless-core is MIT licensed.