API authorization flow with Hapijs and oauth 2 - oauth-2.0

Question

We are using hapijs and oauth server for authentication. we need to implement role based authorization in hapijs. is below way is fine for hapijs.
Register authentication scheme
server.auth.scheme('custom', function (server, options) {
return {
authenticate: function (request, reply) {
// calling oauth flow for roles match
}
});
Register authentication strategy & adding auth,roles in server.route
server.auth.strategy('default', 'custom');
server.route({
method: 'GET',
path: API_Path,
config: {
roles: ['ADMIN', 'USER'],
auth : 'default'
},
handler: function (request, reply) {
return reply.act({
role: 'admin',
cmd: 'getInfo',
id: request.params.id
});
}
});

Answer 1

You should register a strategy and validate the credentials like this.
const validate = function (request, username, password, callback) {
const user = users[username];
if (!user) {
return callback(null, false);
}
Bcrypt.compare(password, user.password, (err, isValid) => {
callback(err, isValid, { id: user.id, name: user.name });
});
};
server.auth.strategy(strategy_name, scheme_name, { validateFunc: validate });
Your auth should have options like mode, scope, strategy etc
...
...
auth :{
mode:'required',
strategy:'strategy_name',
scope: ['ADMIN', 'USER']
},
...
...
You can use Bell