Treat any API call with Auth header the same as a call with username/password body

auth-middleware.js

const jwt = require('jsonwebtoken');
const privateKey = 'secret';

module.exports = function (req, res, next) {
    const oldSend = res.json;
    const token = req.headers.authorization;

    var body = req.body;

    //When returning json from a username+password request, return a signed token
    if (res.statusCode == 200 && body.username) {
        res.json = function (data) {
            data.token = jwt.sign({ username: body.username, password: body.password }, privateKey);
            oldSend.apply(res, [data]);
        };
    }

    //If there's a auth header, add username and password to request body from decoded value
    if (token && !body.username) {
        jwt.verify(token, privateKey, function (err, decoded) {
            if (decoded) {
                req.body = Object.assign({}, body, decoded);
                console.log(req.body);
            }
            next();
        });
    } else {
        next();
    }
};