Arhitektura modernih web aplikacija – Deo 8: Autentifikacija i autorizacija (AuthN/AuthZ)

import bcrypt from 'bcrypt';

const saltRounds = 12;
const hash = await bcrypt.hash(password, saltRounds);
const match = await bcrypt.compare(password, storedHash);

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjMiLCJyb2xlIjoiYWRtaW4iLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6MTcwMDAwMzYwMH0.
signature

Pošalji email: https://app.rs/login?token=abc123
→ Token važi 10 min, jednokratan

// pages/api/auth/[...nextauth].ts
import NextAuth from 'next-auth';
import CredentialsProvider from 'next-auth/providers/credentials';
import { verifyPasskey } from 'webauthn';

export default NextAuth({
  providers: [
    CredentialsProvider({
      

// role: admin, editor, viewer
if (user.role === 'admin') allow('/admin');

// middleware.ts
import { NextResponse } from 'next/server';

export function middleware(req) {
  const token = req.cookies.get('auth');
  const user = verifyJWT(token);
  
  if (req.nextUrl.pathname.startsWith('/admin') && user.role !== 'admin') {
    return NextResponse.redirect(new URL('/login', req.url));
  }
  
  return NextResponse.next();
}

// Pravila:
if (user.department === 'HR' && resource.type === 'salary') allow;

app/
├── login/page.tsx
├── dashboard/page.tsx
├── admin/
│   └── page.tsx
├── api/
│   └── auth/[...nextauth]/route.ts

import NextAuth from 'next-auth';
import CredentialsProvider from 'next-auth/providers/credentials';
import GoogleProvider from 'next-auth/providers/google';
import { PrismaAdapter } from '@next-auth/prisma-adapter';
import { prisma } from '@/lib/prisma';
import bcrypt from 'bcrypt';

const handler = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [
    CredentialsProvider({
      name: 'Email',
      credentials: {
        email: { label: 'Email', type: 'email' },
        password: { label: 'Password', type: 'password' }
      },
      async authorize(credentials) {
        const user = await prisma.user.findUnique({ where: { email: credentials.email } });
        if (!user) return null;
        const match = await bcrypt.compare(credentials.password, user.passwordHash);
        if (match) return user;
        return null;
      }
    }),
    GoogleProvider({
      clientId: process.env.GOOGLE_ID,
      clientSecret: process.env.GOOGLE_SECRET
    })
  ],
  callbacks: {
    async jwt({ token, user }) {
      if (user) {
        token.role = user.role;
      }
      return token;
    },
    async session({ session, token }) {
      session.user.role = token.role;
      return session;
    }
  },
  pages: {
    signIn: '/login'
  }
});

export { handler as GET, handler as POST };

// app/admin/page.tsx
import { getServerSession } from 'next-auth';
import { authOptions } from '@/lib/auth';

export default async function AdminPage() {
  const session = await getServerSession(authOptions);
  
  if (!session || session.user.role !== 'admin') {
    return <div>403 - Zabranjeno</div>;
  }

  return <h1>Admin panel – dobrodošao, {session.user.name}!</h1>;
}

Frontend (Next.js) 
  ↓ (HttpOnly cookie)
API Gateway (JWT validacija)
  ↓
Mikroservisi (RBAC po claim-ovima)
  ↓
Baza (nikad plain lozinke)