Enabling Authentication and Authorization in SAP-Cloud-sdk for JavaScript/Nest.js

If you already know about cloud SDK or nestjs, you can jump directly to code section.

Why Cloud SDK JavaScript?

The SAP Cloud SDK supports you end-to-end when developing applications that communicate with SAP solutions and services such as SAP S/4HANA Cloud, SAP SuccessFactors, and many others.

Using the SDK, you can reduce your effort when developing an application on SAP Business Technology Platform by building on best practices delivered by the SDK. The SDK provides JavaScript libraries, project templates, and a continuous delivery toolkit.

Under the hood, Cloud SDK uses the Nest.js framework.

What is Nest.js?

Here’s How to implement authentication and authorization. ??

1.To create a project you can use the command sap-cloud-sdk init <projectName>/ nest init <projectName>.(Click here to see how to Get Started)

2. Open the app.ts and add the following code:

import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

import { getServices } from '@sap/xsenv';
const xsuaa = getServices({ xsuaa: { tag: 'xsuaa' } }).xsuaa;

import * as passport from 'passport';
import { JWTStrategy } from '@sap/xssec';
passport.use(new JWTStrategy(xsuaa));

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  app.use(passport.initialize());
  app.use(passport.authenticate('JWT', { session: false }));
  await app.listen(process.env.PORT || 3000);
}
bootstrap();

This will initialize a passport with JWTStreatgy. You already have enabled authentication at this stage.

learn  about  authentication and authorization with @sap/xssec.

3. To check authorization/check for scopes you can follow the below snippet. open app.controller.ts?

import { Controller, Get, Req, HttpException, HttpStatus } from '@nestjs/common';
import { AppService } from './app.service';
@Controller()
export class AppController {
  constructor(private readonly appService: AppService) { }

  @Get()
  getHello(@Req() req: any): any {
 /*
@Req() lets you access the request headers
*/
    const isAuthorized = req.authInfo.checkLocalScope('YourScope');//auth check
    if (isAuthorized) {
      return req.user;
    } else {
      return new HttpException('Forbidden', HttpStatus.FORBIDDEN);
    }
  }
}

We are done with the implementation. Fireworks!!! ??. the @sap/xssec package saved us from all the efforts needed if we were supposed to create a custom middleware.