fastify-auth does not work with async strategies about fastify-auth

[Eomm]

I don't think it is a matter of preHandler or hooks because the target is the input array functions.

This plugin returns a function that could be attached to any hooks in fastify:

fastify-auth/fastify-auth.js

Line 25 in ff39b87

function _auth (request, reply, done) {

But the problem is how this array is managed:

fastify-auth/fastify-auth.js

Line 31 in ff39b87

obj.functions = this.functions

So I think you need to find if the array element is a function or promise and then if it is a function nothing change, but if it is a promise you need to wait for it an then call the that.onAuth to continue the workflow.

fastify-auth/fastify-auth.js

Line 62 in ff39b87

func(that.request, that.reply, that.onAuth)

[Eomm]

You are right:

fastify-auth/fastify-auth.js

Line 62 in ff39b87

func(that.request, that.reply, that.onAuth)

We accept only functions as input and not Promise.

Would you like to work on a PR to add this feature?

[PavelPolyakov]

Sure, let's see what I can do. I believe such mechanism is already present in fastify, if you know on top of your head where to find it - please share. Otherwise I'll find it during next week work days.

[SkeLLLa]

Could you please add some docs/details to this PR? Because I was able to use async functions before it successfully. And after it I'm getting FST_ERR_REP_ALREADY_SENT error, because route handler code called twice.

Example code I've used before as auth function:

const verifyFn = async (req, res, done) => {
  // do something then call done
  done(err); // if there's an error
  done(); // if there's no error
}

and everything worked fine.

As far as I understood it just check if auth function returns Promise, and if it does, then it allows access if no errors were thrown. However it omits checking if done is provided.

[PavelPolyakov]

hi @SkeLLLa,

I believe the key issue is, that now it should be either async or callback. If your auth function is async, then it's treated differently:
https://github.com/fastify/fastify-auth/blob/master/fastify-auth.js#L64

[SkeLLLa]

Yes, I understand. But that info should be described in readme or docs. Now we have:

fastify
.decorate('verifyJWTandLevel', function (request, reply, done) {
    // your validation logic
    done() // pass an error if the authentication fails
  })

The most obvious way to do something async is just:

.decorate('verifyJWTandLevel', async function (request, reply, done) {
    // your async stuff
    done() // pass an error if the authentication fails
  })

And this PR adds logic that contradicts current documentation and current typings https://github.com/fastify/fastify-auth/blob/master/fastify-auth.d.ts#L24 (as you can see done callback is not optional) and AuthFunction type is the function that returns void, not Promise.

[mcollina]

Typings is an afterfact. This library is not written in typescript, and the JS is the source of truth.

The API should either be:

.decorate('verifyJWTandLevel', async function (request, reply) {
    // your async stuff
  })

or

.decorate('verifyJWTandLevel', function (request, reply, done) {
    // your validation logic
    done() // pass an error if the authentication fails
  })

The typescript definition should be updated.

[SkeLLLa]

@mcollina The JS source of truth is good, but I think it will be better if that truth come to readme as well :)

[mcollina]

That is indeed true! PR are always welcomed!