How can I validate a user exists in the kuzzle database given only <kuid> and a <jwt> of that user?

I am using kuzzle (2.6) as a backend to my app. I'd like to encrypt data stored to Kuzzle by the users of the app, and organize encryption keys separate from the database. The key holding entity (keyStore for short) should give keys only to users that are truly registered in the database, without becoming able to access the user data itself. So I'm trying to pass, from the app, when the user is logged in, a <kuid> together with a corresponding <jwt> obtained e.g. via kuzzle.auth.login('local', {username: <username>, password: <password>}) to the keyStore via https. The keyStore should send the information to the Kuzzle database, where a Kuzzle plugin can verify the user exists. If Kuzzle confirms the identity of the user to the keyStore, the keyStore will hand out a key to the user such that the user can encrypt/decrypt its data.

In short:

Is there any way I can let a plugin validate that a given <jwt> and a given <kuid> belong to the same user? <username> and <password> would both not be available to the plugin.

Solution

Kuzzle core developer here.

Right now we don't have a public API to get the user linked to an authentication token.

Still, you can use the auth:checkToken API action to verify the token validity and the jsonwebtoken package used by Kuzzle to retrieve the user kuid from the token.

const { valid } = await app.sdk.auth.checkToken(token);

if (valid) {
  const kuid = require('jsonwebtoken').decode(token)._id;
}

Anyway, that's an interesting feature and we will discuss it in our next product workshop.

I will update this answer accordingly.