verify that the token informations retrieve from checkToken doesnt belong to the anonymous user (#683)

This PR adds a verification when using checkToken to verify that the informations about the token validity are not from the anonymous to

Author: Shiranuit

src/Kuzzle.ts

@@ -353,8 +353,7 @@ export class Kuzzle extends KuzzleEventEmitter {
        * In case of login failure we need to be sure that the stored token is still valid
        */
       try {
-        const response = await this.auth.checkToken();
-        this._loggedIn = response.valid;
+        this._loggedIn = await this.isAuthenticated();
       } catch {
         this._loggedIn = false;
       }
@@ -374,8 +373,7 @@ export class Kuzzle extends KuzzleEventEmitter {
      */
     this.on('connected', async () => {
       try {
-        const { valid } = await this.auth.checkToken();
-        this._loggedIn = valid;
+        this._loggedIn = await this.isAuthenticated();
       } catch {
         this._loggedIn = false;
       }
@@ -654,7 +652,7 @@ export class Kuzzle extends KuzzleEventEmitter {
   private async tryReAuthenticate (): Promise<boolean> {
     this._reconnectInProgress = true;
     try {
-      const { valid } = await this.auth.checkToken();
+      const valid = await this.isAuthenticated();
 
       if (valid) {
         return true;
@@ -698,7 +696,7 @@ export class Kuzzle extends KuzzleEventEmitter {
 
     await this.authenticator();
 
-    const { valid } = await this.auth.checkToken();
+    const valid = await this.isAuthenticated();
 
     this._loggedIn = valid;
 
@@ -707,6 +705,17 @@ export class Kuzzle extends KuzzleEventEmitter {
     }
   }
 
+  /**
+   * Check wether the user is authenticated or not
+   * by verifiying if a token is present and still valid
+   * and if the token doesn't belong to the anonymous user.
+   */
+  async isAuthenticated() {
+    const { valid, kuid } = await this.auth.checkToken();
+
+    return valid && kuid !== '-1';
+  }
+
   /**
    * Adds a listener to a Kuzzle global event. When an event is fired, listeners are called in the order of their
    * insertion.

src/controllers/Auth.ts

@@ -206,7 +206,11 @@ export class AuthController extends BaseController {
     /**
      * Token expiration timestamp
      */
-    expiresAt: number
+    expiresAt: number,
+    /**
+     * KUID of the user that the token belongs to
+     */
+    kuid: string
   }> {
     let cookieAuth = false;
     if (token === undefined) {