source/middleware/authentication.js
async function authenticate({ options, keys, log })
{
	// A little helper which can be called from routes
	// as `ctx.role('administrator')`
	// which will throw if the user isn't administrator.
	// The `roles` are taken from JWT payload.
	this.role = (...roles) =>
	{
		if (!this.user)
		{
			throw new errors.Unauthenticated()
		}

		for (const role of roles)
		{
			for (const user_role of this.user.roles)
			{
				if (user_role === role)
				{
					return true
				}
			}
		}

		throw new errors.Unauthorized(`One of the following roles is required: ${roles}`)
	}

	// Get JWT token from incoming HTTP request
	let token = get_jwt_token(this)

	// If no JWT token was found, then done
	if (!token)
	{
		return
	}

	// JWT token (is now accessible from Koa's `ctx`)
	this.accessToken = token

	// Verify JWT token integrity
	// by checking its signature using the supplied `keys`

	let payload

	for (const secret of keys)
	{
		try
		{
			payload = jwt.verify(token, secret)
			break
		}
		catch (error)
		{
			// If authentication token expired
			if (error.name === 'TokenExpiredError')
			{
				if (options.refreshAccessToken)
				{
					// If refreshing an access token fails
					// then don't prevent the user from at least seeing a page
					// therefore catching an error here.
					try
					{
						token = await options.refreshAccessToken(this)
					}
					catch (error)
					{
						log.error(error)
					}

					if (token)
					{
						for (const secret of keys)
						{
							try
							{
								payload = jwt.verify(token, secret)
								break
							}
							catch (error)
							{
								// Try another `secret`
								if (error.name === 'JsonWebTokenError' && error.message === 'invalid signature')
								{
									continue
								}

								// Some other non-JWT-related error
								log.error(error)
								break
							}
						}
					}
				}

				if (payload)
				{
					break
				}

				throw new errors.Access_token_expired()
			}

			// Try another `secret`
			if (error.name === 'JsonWebTokenError' && error.message === 'invalid signature')
			{
				continue
			}

			// Some other non-JWT-related error.
			// Shouldn't prevent the user from at least seeing a page
			// therefore not rethrowing this error.
			log.error(error)
			break
		}
	}

	// If JWT token signature was unable to be verified, then exit
	if (!payload)
	{
		return
	}

	// If the access token isn't valid for access to this server
	// (e.g. it's a "refresh token") then exit.
	if (options.validateAccessToken)
	{
		if (!options.validateAccessToken(payload, this))
		{
			return
		}
	}

	// Token payload can be accessed through `ctx`
	this.accessTokenPayload = payload

	// Fire "on user request" hook
	if (options.onUserRequest)
	{
		options.onUserRequest(token, this)
	}

	// JWT token ID
	const jwt_id = payload.jti

	// `subject`
	// (which is a user id)
	const user_id = payload.sub

	// // Optional JWT token validation (by id)
	// // (for example, that it has not been revoked)
	// if (validateToken)
	// {
	// 	// Can validate the token via a request to a database, for example.
	// 	// Checks for `valid` property value inside the result object.
	// 	// (There can possibly be other properties such as `reason`)
	// 	const is_valid = (await validateToken(token, this)).valid
	//
	// 	// If the JWT token happens to be invalid
	// 	// (expired or revoked, for example), then exit.
	// 	if (!is_valid)
	// 	{
	// 		// this.authenticationError = new errors.Unauthenticated('AccessTokenRevoked')
	// 		return
	// 	}
	// }

	// JWT token ID is now accessible via Koa's `ctx`
	this.accessTokenId = jwt_id

	// Extracts user data (description) from JWT token payload
	// (`user` is now accessible via Koa's `ctx`)
	this.user = options.userInfo ? options.userInfo(payload) : {}

	// Sets user id
	this.user.id = user_id
	
	// Extra payload fields:
	//
	// 'iss' // Issuer
	// 'sub' // Subject
	// 'aud' // Audience
	// 'exp' // Expiration time
	// 'nbf' // Not before
	// 'iat' // Issued at 
	// 'jti' // JWT ID

	// JWT token payload is accessible via Koa's `ctx`
	this.accessTokenPayload = payload
}
async function authenticate({ options, keys, log })
{
	// A little helper which can be called from routes
	// as `ctx.role('administrator')`
	// which will throw if the user isn't administrator.
	// The `roles` are taken from JWT payload.
	this.role = (...roles) =>
	{
		if (!this.user)
		{
			throw new errors.Unauthenticated()
		}

		for (const role of roles)
		{
			for (const user_role of this.user.roles)
			{
				if (user_role === role)
				{
					return true
				}
			}
		}

		throw new errors.Unauthorized(`One of the following roles is required: ${roles}`)
	}

	// Get JWT token from incoming HTTP request
	let token = get_jwt_token(this)

	// If no JWT token was found, then done
	if (!token)
	{
		return
	}

	// JWT token (is now accessible from Koa's `ctx`)
	this.accessToken = token

	// Verify JWT token integrity
	// by checking its signature using the supplied `keys`

	let payload

	for (const secret of keys)
	{
		try
		{
			payload = jwt.verify(token, secret)
			break
		}
		catch (error)
		{
			// If authentication token expired
			if (error.name === 'TokenExpiredError')
			{
				if (options.refreshAccessToken)
				{
					// If refreshing an access token fails
					// then don't prevent the user from at least seeing a page
					// therefore catching an error here.
					try
					{
						token = await options.refreshAccessToken(this)
					}
					catch (error)
					{
						log.error(error)
					}

					if (token)
					{
						for (const secret of keys)
						{
							try
							{
								payload = jwt.verify(token, secret)
								break
							}
							catch (error)
							{
								// Try another `secret`
								if (error.name === 'JsonWebTokenError' && error.message === 'invalid signature')
								{
									continue
								}

								// Some other non-JWT-related error
								log.error(error)
								break
							}
						}
					}
				}

				if (payload)
				{
					break
				}

				throw new errors.Access_token_expired()
			}

			// Try another `secret`
			if (error.name === 'JsonWebTokenError' && error.message === 'invalid signature')
			{
				continue
			}

			// Some other non-JWT-related error.
			// Shouldn't prevent the user from at least seeing a page
			// therefore not rethrowing this error.
			log.error(error)
			break
		}
	}

	// If JWT token signature was unable to be verified, then exit
	if (!payload)
	{
		return
	}

	// If the access token isn't valid for access to this server
	// (e.g. it's a "refresh token") then exit.
	if (options.validateAccessToken)
	{
		if (!options.validateAccessToken(payload, this))
		{
			return
		}
	}

	// Token payload can be accessed through `ctx`
	this.accessTokenPayload = payload

	// Fire "on user request" hook
	if (options.onUserRequest)
	{
		options.onUserRequest(token, this)
	}

	// JWT token ID
	const jwt_id = payload.jti

	// `subject`
	// (which is a user id)
	const user_id = payload.sub

	// // Optional JWT token validation (by id)
	// // (for example, that it has not been revoked)
	// if (validateToken)
	// {
	// 	// Can validate the token via a request to a database, for example.
	// 	// Checks for `valid` property value inside the result object.
	// 	// (There can possibly be other properties such as `reason`)
	// 	const is_valid = (await validateToken(token, this)).valid
	//
	// 	// If the JWT token happens to be invalid
	// 	// (expired or revoked, for example), then exit.
	// 	if (!is_valid)
	// 	{
	// 		// this.authenticationError = new errors.Unauthenticated('AccessTokenRevoked')
	// 		return
	// 	}
	// }

	// JWT token ID is now accessible via Koa's `ctx`
	this.accessTokenId = jwt_id

	// Extracts user data (description) from JWT token payload
	// (`user` is now accessible via Koa's `ctx`)
	this.user = options.userInfo ? options.userInfo(payload) : {}

	// Sets user id
	this.user.id = user_id
	
	// Extra payload fields:
	//
	// 'iss' // Issuer
	// 'sub' // Subject
	// 'aud' // Audience
	// 'exp' // Expiration time
	// 'nbf' // Not before
	// 'iat' // Issued at 
	// 'jti' // JWT ID

	// JWT token payload is accessible via Koa's `ctx`
	this.accessTokenPayload = payload
}
async function authenticate ( { options , keys , log } ) { // A little helper which can be called from routes // as `ctx.role('administrator')` // which will throw if the user isn't administrator. // The `roles` are taken from JWT payload. this . role = ( ... roles ) => { if ( ! this . user ) { throw new errors . Unauthenticated ( ) } for ( const role of roles ) { for ( const user_role of this . user . roles ) { if ( user_role === role ) { return true } } } throw new errors . Unauthorized ( ` ${ roles } ` ) } // Get JWT token from incoming HTTP request let token = get_jwt_token ( this ) // If no JWT token was found, then done if ( ! token ) { return } // JWT token (is now accessible from Koa's `ctx`) this . accessToken = token // Verify JWT token integrity // by checking its signature using the supplied `keys` let payload for ( const secret of keys ) { try { payload = jwt . verify ( token , secret ) break } catch ( error ) { // If authentication token expired if ( error . name === 'TokenExpiredError' ) { if ( options . refreshAccessToken ) { // If refreshing an access token fails // then don't prevent the user from at least seeing a page // therefore catching an error here. try { token = await options . refreshAccessToken ( this ) } catch ( error ) { log . error ( error ) } if ( token ) { for ( const secret of keys ) { try { payload = jwt . verify ( token , secret ) break } catch ( error ) { // Try another `secret` if ( error . name === 'JsonWebTokenError' && error . message === 'invalid signature' ) { continue } // Some other non-JWT-related error log . error ( error ) break } } } } if ( payload ) { break } throw new errors . Access_token_expired ( ) } // Try another `secret` if ( error . name === 'JsonWebTokenError' && error . message === 'invalid signature' ) { continue } // Some other non-JWT-related error. // Shouldn't prevent the user from at least seeing a page // therefore not rethrowing this error. log . error ( error ) break } } // If JWT token signature was unable to be verified, then exit if ( ! payload ) { return } // If the access token isn't valid for access to this server // (e.g. it's a "refresh token") then exit. if ( options . validateAccessToken ) { if ( ! options . validateAccessToken ( payload , this ) ) { return } } // Token payload can be accessed through `ctx` this . accessTokenPayload = payload // Fire "on user request" hook if ( options . onUserRequest ) { options . onUserRequest ( token , this ) } // JWT token ID const jwt_id = payload . jti // `subject` // (which is a user id) const user_id = payload . sub // // Optional JWT token validation (by id) // // (for example, that it has not been revoked) // if (validateToken) // { // 	// Can validate the token via a request to a database, for example. // 	// Checks for `valid` property value inside the result object. // 	// (There can possibly be other properties such as `reason`) // 	const is_valid = (await validateToken(token, this)).valid // // 	// If the JWT token happens to be invalid // 	// (expired or revoked, for example), then exit. // 	if (!is_valid) // 	{ // 		// this.authenticationError = new errors.Unauthenticated('AccessTokenRevoked') // 		return // 	} // } // JWT token ID is now accessible via Koa's `ctx` this . accessTokenId = jwt_id // Extracts user data (description) from JWT token payload // (`user` is now accessible via Koa's `ctx`) this . user = options . userInfo ? options . userInfo ( payload ) : { } // Sets user id this . user . id = user_id // Extra payload fields: // // 'iss' // Issuer // 'sub' // Subject // 'aud' // Audience // 'exp' // Expiration time // 'nbf' // Not before // 'iat' // Issued at  // 'jti' // JWT ID // JWT token payload is accessible via Koa's `ctx` this . accessTokenPayload = payload }
Looks for JWT token, and if it is found, sets some variables.
Looks for JWT token and if it is found sets some variables .