feat: enabled session based authentication for web

api/src/controllers/session.ts

@@ -24,7 +24,7 @@ export class SessionController {
 }
 
 const session = (req: any) => ({
-  id: req.user.id,
+  id: req.user.userId,
   username: req.user.username,
   displayName: req.user.displayName
 })

api/src/controllers/web.ts

@@ -0,0 +1,75 @@
+import express from 'express'
+import { Request, Route, Tags, Post, Body, Get } from 'tsoa'
+import User from '../model/User'
+
+@Route('/')
+@Tags('Web')
+export class WebController {
+  /**
+   * @summary Accept a valid username/password
+   *
+   */
+  @Post('/login')
+  public async login(
+    @Request() req: express.Request,
+    @Body() body: LoginPayload
+  ) {
+    return login(req, body)
+  }
+
+  /**
+   * @summary Accept a valid username/password
+   *
+   */
+  @Get('/logout')
+  public async logout(@Request() req: express.Request) {
+    return new Promise((resolve) => {
+      req.session.destroy(() => {
+        resolve(true)
+      })
+    })
+  }
+}
+
+const login = async (
+  req: express.Request,
+  { username, password }: LoginPayload
+) => {
+  // Authenticate User
+  const user = await User.findOne({ username })
+  if (!user) throw new Error('Username is not found.')
+
+  const validPass = user.comparePassword(password)
+  if (!validPass) throw new Error('Invalid password.')
+
+  req.session.loggedIn = true
+  req.session.user = {
+    userId: user.id,
+    clientId: 'web_app',
+    username: user.username,
+    displayName: user.displayName,
+    isAdmin: user.isAdmin,
+    isActive: user.isActive
+  }
+
+  return {
+    loggedIn: true,
+    user: {
+      username: user.username,
+      displayName: user.displayName
+    }
+  }
+}
+
+interface LoginPayload {
+  /**
+   * Username for user
+   * @example "secretuser"
+   */
+  username: string
+  /**
+   * Password for user
+   * @example "secretpassword"
+   */
+  password: string
+}