Using passport & passport.authenticate AFTER route declaration

Question

The application I am working on requires that all authentication code be placed after route declaration i.e. instead of separating routes into public and private routes by a middleware and calling passport.authenticate inside the callback for the login method (code A), I need to load all the routes BEFORE configuring passport (code B).

I have modified this example: https://github.com/rkusa/koa-passport-example to help explain what I am trying to accomplish. A stripped down version of the auth.js for the above follows:

const passport = require('koa-passport')

const fetchUser = (() => {
  // This is an example! Use password hashing in your
  const user = { id: 1, username: 'test', password: 'test' }
  return async function() {
    return user
  }
})()

passport.serializeUser(function(user, done) {
  console.log("serializing")
  done(null, user.id)
})

passport.deserializeUser(async function(id, done) {
  console.log("DEserializing")
  try {
    const user = await fetchUser()
    done(null, user)
  } catch(err) {
    done(err)
  }
})

const LocalStrategy = require('passport-local').Strategy
passport.use(new LocalStrategy(function(username, password, done) {
  console.log("asked for authentication")
  fetchUser()
    .then(user => {
      if (username === user.username && password === user.password) {
        done(null, user)
      } else {
        done(null, false)
      }
    })
    .catch(err => done(err))
}))

A stripped version of the server.js (code A) that works by splitting public and private routes is as follows:

const Koa = require('koa')
const app = new Koa()

// trust proxy
app.proxy = true

// sessions
const session = require('koa-session')
app.keys = ['your-session-secret']
app.use(session({}, app))

// body parser
const bodyParser = require('koa-bodyparser')
app.use(bodyParser())

// authentication
require('./auth')
const passport = require('koa-passport')
app.use(passport.initialize())
app.use(passport.session())

// routes
const fs    = require('fs')
const route = require('koa-route')

//public routes
app.use(route.get('/login', (ctx) => {
  ctx.body = "LOGIN";
}));

app.use(route.post('/login',
  passport.authenticate('local', {
    successRedirect: '/home',
    failureRedirect: '/login'
  })
))

app.use(route.get('/logout', function(ctx) {
  ctx.logout()
  ctx.redirect('/login')
}))

// Require authentication for now
app.use(function(ctx, next) {
  if (ctx.isAuthenticated()) {
    console.log("authenticated user")
    return next()
  } else {
    console.log("unauthenticated user")
    ctx.redirect('/login')
  }
})

//private route
app.use(route.get('/home', function(ctx) {
  ctx.body = "home"
}))

// start server
const port = process.env.PORT || 3000
app.listen(port, () => console.log('Server listening on', port))

What is need is the above functionality but in a way that routes are all declared before authentication, and then we capture request for authentication later. I have written an alternative server.js (code B) trying to do this:

const Koa = require('koa')
const app = new Koa()

// trust proxy
app.proxy = true

// sessions
const session = require('koa-session')
app.keys = ['your-session-secret']
app.use(session({}, app))

// body parser
const bodyParser = require('koa-bodyparser')
app.use(bodyParser())

// routes
const fs = require('fs')
const route = require('koa-route')

app.use(route.get('/login', (ctx) => {
  ctx.body = "LOGIN";
}));

app.use(route.post('/login', async (ctx, next) => {
  ctx.id = 0;
  console.log(); console.log("login");
  await next();
}))

app.use(route.get('/home', async (ctx, next) => {
  ctx.id = 1;
  console.log(); console.log("home")
  await next();
  ctx.body = "home";
}))

app.use(route.get('/logout', async (ctx) => {
  ctx.logout();
    ctx.redirect('/login')
}))
const port = process.env.PORT || 3000
app.listen(port, () => console.log('Server listening on', port))


// authentication
require('./auth')
const passport = require('koa-passport')
app.use(passport.initialize())
app.use(passport.session());

auth = async (ctx, next) => {
  console.log("Check for authentication request")
  if (ctx.id === 0 && !ctx.isAuthenticated()) {
    //here I want to actually authenticate if request if for authentication. Previously this code would have been in the callback of the public route i.e. the post method for login
    passport.authenticate('local', {
      successRedirect: '/home',
      failureRedirect: '/login'
    });

  } else {
    //middleware blocking access to other middlewares. Previously this would have been placed inside a non -async function and placed before all protected routes
    if (ctx.isAuthenticated()) {
      console.log("authenticated user")
      return next()
    } else {
      console.log("unauthenticated user")
      ctx.redirect('/login')
    }
  }
}

app.use(auth)
//app.use(MW1)
//app.use(MW2)

In every route callback, I add an id property to ctx where ctx.id = 0 means that request is an authentication post request. Problem: passport.authenticate does not get called.

Then I add a middleware to check if the rest of the request are authenticated or not (same as code A). This part works i.e. my private route /home redirects to /login because user is not authenticated.

Another issue I have is sending a logout request gives the error "ctx.logout is not a function". I guess this is tied to the fact the passport.authenticate does not get called at all.

I am using Postman to send POST and GETs instead of form.

POST localhost:3000/login?username=test&password=test

GET localhost:3000/home

GET localhost:3000/logout