Comprehensive comparison for Authentication technology in Software Development applications

// Node.js Express API with Auth0 JWT Authentication
// This example demonstrates a production-ready API endpoint with Auth0 authentication

const express = require('express');
const { auth } = require('express-oauth2-jwt-bearer');
const axios = require('axios');
const rateLimit = require('express-rate-limit');

const app = express();
app.use(express.json());

// Auth0 configuration
const AUTH0_DOMAIN = process.env.AUTH0_DOMAIN;
const AUTH0_AUDIENCE = process.env.AUTH0_AUDIENCE;
const AUTH0_ISSUER = `https://${AUTH0_DOMAIN}/`;

// JWT validation middleware
const checkJwt = auth({
  audience: AUTH0_AUDIENCE,
  issuerBaseURL: AUTH0_ISSUER,
  tokenSigningAlg: 'RS256'
});

// Rate limiting middleware
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  message: 'Too many requests from this IP'
});

app.use(limiter);

// Permission checking middleware
const checkPermissions = (requiredPermissions) => {
  return (req, res, next) => {
    const permissions = req.auth?.permissions || [];
    const hasPermission = requiredPermissions.every(perm => 
      permissions.includes(perm)
    );
    
    if (!hasPermission) {
      return res.status(403).json({
        error: 'Forbidden',
        message: 'Insufficient permissions'
      });
    }
    next();
  };
};

// Protected API endpoint - Get user profile with enriched data
app.get('/api/user/profile', checkJwt, async (req, res) => {
  try {
    const userId = req.auth.payload.sub;
    
    // Fetch user details from Auth0 Management API
    const managementToken = await getManagementApiToken();
    const userDetails = await getUserFromAuth0(userId, managementToken);
    
    // Enrich with application-specific data
    const appData = await getApplicationUserData(userId);
    
    res.json({
      success: true,
      data: {
        auth0Id: userId,
        email: userDetails.email,
        name: userDetails.name,
        emailVerified: userDetails.email_verified,
        lastLogin: userDetails.last_login,
        metadata: userDetails.user_metadata,
        appData: appData
      }
    });
  } catch (error) {
    console.error('Profile fetch error:', error);
    res.status(500).json({
      error: 'Internal Server Error',
      message: 'Failed to retrieve user profile'
    });
  }
});

// Protected endpoint with permission check
app.post('/api/admin/users', 
  checkJwt, 
  checkPermissions(['create:users']), 
  async (req, res) => {
    try {
      const { email, name, password } = req.body;
      
      if (!email || !name || !password) {
        return res.status(400).json({
          error: 'Bad Request',
          message: 'Missing required fields'
        });
      }
      
      const managementToken = await getManagementApiToken();
      const newUser = await createAuth0User(
        { email, name, password },
        managementToken
      );
      
      res.status(201).json({
        success: true,
        data: {
          userId: newUser.user_id,
          email: newUser.email
        }
      });
    } catch (error) {
      console.error('User creation error:', error);
      res.status(500).json({
        error: 'Internal Server Error',
        message: error.message || 'Failed to create user'
      });
    }
});

// Helper: Get Auth0 Management API token
async function getManagementApiToken() {
  try {
    const response = await axios.post(`https://${AUTH0_DOMAIN}/oauth/token`, {
      grant_type: 'client_credentials',
      client_id: process.env.AUTH0_CLIENT_ID,
      client_secret: process.env.AUTH0_CLIENT_SECRET,
      audience: `https://${AUTH0_DOMAIN}/api/v2/`
    });
    return response.data.access_token;
  } catch (error) {
    throw new Error('Failed to obtain management token');
  }
}

// Helper: Fetch user from Auth0
async function getUserFromAuth0(userId, token) {
  const response = await axios.get(
    `https://${AUTH0_DOMAIN}/api/v2/users/${encodeURIComponent(userId)}`,
    { headers: { Authorization: `Bearer ${token}` } }
  );
  return response.data;
}

// Helper: Create user in Auth0
async function createAuth0User(userData, token) {
  const response = await axios.post(
    `https://${AUTH0_DOMAIN}/api/v2/users`,
    {
      email: userData.email,
      name: userData.name,
      password: userData.password,
      connection: 'Username-Password-Authentication'
    },
    { headers: { Authorization: `Bearer ${token}` } }
  );
  return response.data;
}

// Mock application data retrieval
async function getApplicationUserData(userId) {
  return {
    preferences: { theme: 'dark', notifications: true },
    accountStatus: 'active'
  };
}

// Error handling middleware
app.use((err, req, res, next) => {
  if (err.name === 'UnauthorizedError') {
    return res.status(401).json({
      error: 'Unauthorized',
      message: 'Invalid or missing token'
    });
  }
  res.status(500).json({
    error: 'Internal Server Error',
    message: 'An unexpected error occurred'
  });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});