An @imqueue RPC microservice that handles authentication for the Car-Wash tutorial: it logs users in, issues JWTs, and revokes them on logout.
It has no user database of its own — it verifies credentials by calling the user service and
uses Redis only as a revocation list for still-valid tokens. It never speaks HTTP; every
method is exposed over the @imqueue/rpc Redis message queue and consumed by the gateways
(api, api-rest).
This repo is one piece of the imqueue-sandbox tutorial — a complete car-wash booking app built from independent RPC microservices that communicate over a Redis-backed message queue.
| Repo | Role | Store |
|---|---|---|
| user | Customer accounts & their garage | MongoDB |
| auth | Login, JWT issuing & revocation | Redis |
| car | Car catalog (makes / models / types) | in-memory |
| time-table | Washing reservations & schedule | PostgreSQL |
| api | GraphQL gateway orchestrating the fleet | — |
| api-rest | REST/OpenAPI gateway over the same fleet | — |
| web-app | React front-end on api (GraphQL/Relay) |
— |
| web-app-rest | React front-end on api-rest (REST) |
— |
The backend services are transport-agnostic: two interchangeable gateways and two independent front-ends prove the same fleet can be fronted by completely different API styles without changing a single service.
Exposed by the Auth service (src/Auth.ts) via @expose():
| Method | Signature | Description |
|---|---|---|
version |
() |
Running service name / version / repository. |
login |
(email, password) |
Verify credentials via user.fetch, return a signed JWT. |
verify |
(token) |
Validate a JWT (and check it is not revoked); return the current user, or null. |
logout |
(token, verifyEmail?) |
Revoke a token by storing it in Redis until its natural expiry. |
Tokens are stateless JWTs (HS256). Login strips the password hash before signing, so the
token carries only the user's id, email and role flags. verify re-fetches fresh user data
from the user service so role/active changes take effect immediately. login throws
Password mismatch (bad email or password — deliberately indistinguishable) or Blocked
(valid credentials but a deactivated account).
Environment variables (loaded from an optional .env via process.loadEnvFile()):
| Variable | Default | Purpose |
|---|---|---|
JWT_KEY |
— (required) | Secret used to sign/verify JWTs. The service refuses to start without it. |
JWT_EXPIRE |
3600 |
Token lifetime in seconds. |
AUTH_DB_HOST |
localhost |
Redis host for the token-revocation store. |
AUTH_DB_PORT |
6379 |
Redis port for the token-revocation store. |
IMQ_REDIS |
localhost:6379 |
Redis endpoint(s) for the RPC message queue. |
There is intentionally no default
JWT_KEY— set a strong random secret in your own.env(which is git-ignored) before starting the service.
Development mode (rebuilds and restarts on change):
npm run devProduction mode:
npm startBoth start the service under the imqueue label auth. Requires Redis at IMQ_REDIS /
AUTH_DB_*, a running user service, and a configured JWT_KEY.