ctx.req.user being called by a dependency about koa-passport

[rkusa]

I've removed the deprecation warning for now; published as 2.2.2. The user is still accessible through ctx.state.user. @gingerich I am still eager to adhere to Koa's way of doing things. However, I've test implemented workarounds to get passport to work with having the user in ctx.state. But since methods like login() are actively using req.user, the amount of required workarounds is unreasonable high. Maybe an ideal solution can only be achieved by implementing authentication for Koa from scratch. Unfortunately, this is not possible with keeping compatibility to all passport strategies, which would make such an undertaking a tremendous and unreasonable amount of work 😕

[jeffijoe]

@rkusa not guessing monkey-patching all used strategies would work?

[rkusa]

Thanks for the feedback! Since passport is adding things to req anyway, the question would be: what is better, monkey-patching all strategies, or living with having the user property in multiple places. I personally don't like both, what probably prefer the latter. But I am open to hearing other opinions on that!

[jeffijoe]

@rkusa the best option would be making a different authentication library (clean codebase), but it would be a shame to discard the sheer amount of Passport strategies available.

[jeffijoe]

Easiest path would be proxying the ctx.req.user getters and setters to ctx.state - that way everyone is happy I guess, and will maintain backward comp with other libraries

[rkusa]

Yep, in an ideal world we would have a passport written for Koa from scratch. But writing all the strategies again... and going through all security issues again... does not sound too good.

I am currently copying the user value over to ctx.state. A getter and setter would definitely better. Especially since the user on the req is already a getter and setter. However, I ran into a weird bug today and I hadn't the time to debug it, which is why I went for copying for now. I'll replace this by a getter and setter later.

[rkusa]

The user object now lives only in one single place, which is ctx.state.user.