
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
just-login-server-api
Advanced tools
##Information
Server for the Just Login module.
The constructor takes a just-login-core constructed object
##Install
Will need the Just-Login-Core module also. (Or an object that closely resembles a Just-Login-Core.)
Install both with npm:
npm install just-login-server-api just-login-core
##Jlsa(jlc)
Require both:
var Jlsa = require('just-login-server-api')
var Jlc = require('just-login-core')
Set up the server-api with a core and the core with a levelup database:
var level = require('level-mem')
var db = level('uniqueNameHere')
var jlc = Jlc(db)
var jlsa = Jlsa(jlc)
##jlsa methods
###jlsa.createNewSession(cb)
jlsa.createNewSession(function (err, api, sessionId) {
if (!err) {
console.log(api) //logs { beginAuthentication: [Function],
// isAuthenticated: [Function],
// unAuthenticate: [Function] }
console.log(sessionId) //logs the session id string
}
})
###jlsa.continueExistingSession(sessionId, cb)
jlsa.continueExistingSession(sessionId, function(err, api, sessionId) {
if (!err) {
console.log(api) //logs { beginAuthentication: [Function],
// isAuthenticated: [Function],
// unAuthenticate: [Function] }
console.log(sessionId) //logs the session id string
} else if (err.invalidSessionId) {
console.log("bad session id passed to continueExistingSession")
} else {
console.log("error:", err.message)
}
})
##api methods
These methods are from the api argument from either createNewSession() or continueExistingSession().
###api.isAuthenticated(cb)
Checks if a user is authenticated. (Logged in.)
cb is a function with these arguments: err, contactAddress.
err is null if there was no error, and is an Error object if there was an error.contactAddress is null is the user is not authenticated, and is a string of their contact address if they are authenticated.Example of an authenticated user:
jlc.isAuthenticated(function(err, contactAddress) {
if (!err)
console.log(contactAddress) //logs: "fake@example.com"
})
Example of an unauthenticated user:
jlc.isAuthenticated(function(err, contactAddress) {
if (!err)
console.log(contactAddress) //logs: "null"
})
###api.beginAuthentication(contactAddress)
The just-login-core emits an event with a secret token and the contact address, so somebody can go send a message to that address. This event is emitted when jlc.beginAuthentication is called. When using the just-login-core and the just-login-server-api together, the just-login-core will emit an event when the just-login-server-api's beginAuthentication() is called.
contactAddress is string of the user's contact info, (usually an email address).Example:
jlsa.beginAuthentication("fake@example.com")
jlc.on('authentication initiated', function(authInit) { //Note that this is jlc, not jlsa
console.log(authInit.token) //logs the secret token
console.log(authInit.sessionId) //logs the session id
})
(Suggestion: use the Just-Login-Emailer or my fork of the same emailer to catch the event.)
###api.unauthenticate(cb)
Logs a user out.
cb is expected to be a function with the following argument:
err is either null or an error object.Example:
jlc.unauthenticate(function(err) {
if (err)
console.log("error:", err.message) //this is expected for invalid tokens (not previously logged in)
else
console.log("you have been logged out") //this is expected for valid tokens (previously logged in)
})
FAQs
Server code for the Just Login module
We found that just-login-server-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.