Adding the authorization layer

Now that we can have all authentication pieces in place, we can finally move on to implementing the authorization layer of our application. To adequately protect our endpoints, we need to do two main things to the ./routes/todos module from Chapter 7:

• Add the authentication layer to ./routes/todos/routes.js
• Update the to-do data source inside ./routes/todos/autohook.js

Fortunately, we need only a one-liner change to implement the first point. On the other hand, the second point is more complex. We will examine both in the following subsections.

Adding the authentication layer

Let’s start with the simpler task. As we already said, this is a fast addition to the Chapter 7 code that we can see in the following snippet:

module.exports = async function todoRoutes (fastify, _opts) {
  fastify.addHook('onRequest', fastify.authenticate) // [1]
  // omitted route implementations from chapter 7
}

...