/*
 * Simple login: returns a JWT if login data is valid.
 */function doLogin(req, res) {
 getData(req).then(function(data) { try { var loginData = JSON.parse(data);
 User.findOne({ username: loginData.username }, function(err, user) { if(err) {
 logger.error(err);
 send401(res); return;
 } if(user.password === loginData.password) { var token = jwt.sign({ jti: uuid.v4(), roles: user.roles
 }, secretKey, { subject: user.username, issuer: issuerStr
 });
 res.writeHeader(200, { 'Content-Length': token.length, 'Content-Type': "text/plain"
 });
 res.write(token);
 res.end(); 
 } else {
 send401(res);
 }
 }, 'users');
 } catch(err) {
 logger.error(err); 
 send401(res);
 }
 }, function(err) {
 logger.error(err); 
 send401(res);
 });
}/*
 * Authentication validation using JWT. Strategy: find existing user.
 */function validateAuth(data, callback) { if(!data) {
 callback(null); return;
 }
 data = data.split(" "); if(data[0] !== "Bearer" || !data[1]) {
 callback(null); return;
 } var token = data[1]; 
 try { var payload = jwt.verify(token, secretKey); //Your custom validation logic goes here.
 if(!payload.jti || revokedTokens[payload.jti]) {
 logger.debug('Revoked token, access denied: ' + payload.jti);
 callback(null);
 } else { 
 callback({jwt: payload}); 
 }
 } catch(err) {
 logger.error(err);
 callback(null);
 }
}

/*
 * Parses the request and dispatches multiple concurrent requests to each
 * internal endpoint. Results are aggregated and returned.
 */function serviceDispatch(req, res) { var parsedUrl = url.parse(req.url);
 Service.findOne({ url: parsedUrl.pathname }, function(err, service) { if(err) {
 logger.error(err);
 send500(res); return;
 } var authorized = roleCheck(req.context.authPayload.jwt, service); if(!authorized) {
 send401(res); return;
 } 
 // Fanout all requests to all related endpoints.
 // Results are aggregated (more complex strategies are possible).
 var promises = [];
 service.endpoints.forEach(function(endpoint) { 
 logger.debug(sprintf('Dispatching request from public endpoint ' + '%s to internal endpoint %s (%s)',
 req.url, endpoint.url, endpoint.type)); switch(endpoint.type) { case 'http-get': case 'http-post':
 promises.push(httpPromise(req, endpoint.url,
 endpoint.type === 'http-get')); break; case 'amqp':
 promises.push(amqpPromise(req, endpoint.url)); break; default:
 logger.error('Unknown endpoint type: ' + endpoint.type);
 } 
 }); //Aggregation strategy for multiple endpoints.
 Q.allSettled(promises).then(function(results) { var responseData = {};
 results.forEach(function(result) { if(result.state === 'fulfilled') {
 responseData = _.extend(responseData, result.value);
 } else {
 logger.error(result.reason.message);
 }
 });
 res.setHeader('Content-Type', 'application/json');
 res.end(JSON.stringify(responseData));
 });
 }, 'services');
}

var User = userDb.model('User', new mongoose.Schema ({ username: String, password: String, roles: [ String ]
}));var Service = servicesDb.model('Service', new mongoose.Schema ({ name: String, url: String, endpoints: [ new mongoose.Schema({ type: String, url: String
 }) ], authorizedRoles: [ String ]
}));function roleCheck(jwt_, service) { var intersection = _.intersection(jwt_.roles, service.authorizedRoles); return intersection.length === service.authorizedRoles.length;
}