Fairly overkill AngularJS + RequireJS UI for the mock login screen.

lib/roles/auth/mock.js

@@ -6,11 +6,17 @@ var validator = require('express-validator')
 var logger = require('../../util/logger')
 var requtil = require('../../util/requtil')
 var jwtutil = require('../../util/jwtutil')
+var pathutil = require('../../util/pathutil')
 
 module.exports = function(options) {
   var log = logger.createLogger('app')
     , app = express()
 
+  app.set('view engine', 'jade')
+  app.set('views', pathutil.resource('auth/views'))
+  app.set('strict routing', true)
+  app.set('case sensitive routing', true)
+
   app.use(express.cookieParser())
   app.use(express.cookieSession({
     secret: options.secret
@@ -18,13 +24,34 @@ module.exports = function(options) {
   }))
   app.use(express.json())
   app.use(express.urlencoded())
+  app.use(express.csrf())
   app.use(validator())
+  app.use('/static/lib', express.static(pathutil.resource('lib')))
+  app.use('/static', express.static(pathutil.resource('auth')))
 
-  app.get('/auth', function(req, res) {
-    res.locals.csrf = req.csrfToken()
+  app.use(function(req, res, next) {
+    res.cookie('XSRF-TOKEN', req.csrfToken());
+    next()
   })
 
-  app.post('/auth', function(req, res) {
+  app.get('/partials/:name', function(req, res) {
+    var whitelist = {
+      'signin': true
+    }
+
+    if (whitelist[req.params.name]) {
+      res.render('partials/' + req.params.name)
+    }
+    else {
+      res.send(404)
+    }
+  })
+
+  app.get('/', function(req, res) {
+    res.render('index')
+  })
+
+  app.post('/api/v1/auth', function(req, res) {
     var log = logger.createLogger('auth')
     log.setLocalIdentifier(req.ip)
     switch (req.accepts(['json'])) {