@ahhaohho/auth-middleware 1.0.4 → 1.0.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahhaohho/auth-middleware",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Shared authentication middleware with Passport.js for ahhaohho microservices",
   "main": "src/index.js",
   "scripts": {
@@ -28,11 +28,12 @@
   "author": "ahhaohho",
   "license": "MIT",
   "dependencies": {
-    "passport": "^0.7.0",
-    "passport-jwt": "^4.0.1",
-    "jsonwebtoken": "^9.0.2",
+    "@aws-sdk/client-secrets-manager": "^3.552.0",
     "ioredis": "^5.4.1",
-    "@aws-sdk/client-secrets-manager": "^3.552.0"
+    "jsonwebtoken": "^9.0.2",
+    "passport": "^0.7.0",
+    "passport-custom": "^1.1.1",
+    "passport-jwt": "^4.0.1"
   },
   "peerDependencies": {
     "express": "^4.x"

package/src/strategies/jwt.strategy.js

@@ -1,15 +1,44 @@
-const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');
+const { Strategy: JwtStrategy } = require('passport-jwt');
 const { getJwtKeys } = require('../utils/secretManager');
 const { isBlacklisted } = require('../utils/blacklist');
 const jwt = require('jsonwebtoken');
 
+/**
+ * Bearer 접두사가 있든 없든 토큰을 추출하는 커스텀 함수
+ */
+const extractJwtFromHeader = (req) => {
+  const authHeader = req.headers.authorization || req.headers.Authorization;
+
+  if (!authHeader) {
+    return null;
+  }
+
+  // Bearer 접두사가 있는 경우
+  if (authHeader.startsWith('Bearer ')) {
+    return authHeader.substring(7);
+  }
+
+  // bearer (소문자)인 경우
+  if (authHeader.startsWith('bearer ')) {
+    return authHeader.substring(7);
+  }
+
+  // Bearer 접두사 없이 토큰만 있는 경우
+  // JWT 형식인지 확인 (xxx.yyy.zzz 형태)
+  if (authHeader.split('.').length === 3) {
+    return authHeader;
+  }
+
+  return null;
+};
+
 /**
  * Passport JWT 전략 생성
  * Access Token 검증용
  */
 function createJwtStrategy() {
   const options = {
-    jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+    jwtFromRequest: extractJwtFromHeader,
     // 다중 키 지원을 위한 secretOrKeyProvider 사용
     secretOrKeyProvider: async (request, rawJwtToken, done) => {
       try {
@@ -68,7 +97,7 @@ function createJwtStrategy() {
       }
 
       // 블랙리스트 확인
-      const token = ExtractJwt.fromAuthHeaderAsBearerToken()(request);
+      const token = extractJwtFromHeader(request);
       const blacklisted = await isBlacklisted(decoded.userId, 'access', token);
       if (blacklisted) {
         return done(new Error('Token has been revoked'), false);

package/src/strategies/refresh.strategy.js

@@ -1,70 +1,73 @@
-const { Strategy: JwtStrategy } = require('passport-jwt');
+const { Strategy: CustomStrategy } = require('passport-custom');
 const { verifyTokenWithFallback } = require('../utils/jwtValidator');
 const { isBlacklisted } = require('../utils/blacklist');
 
 /**
  * Refresh Token 헤더에서 토큰 추출
+ * Bearer 접두사가 있든 없든 처리
  */
 function extractRefreshToken(req) {
   let token = null;
 
-  if (req && req.headers && req.headers['refresh-token']) {
-    let refreshToken = req.headers['refresh-token'];
+  if (req && req.headers) {
+    let refreshToken = req.headers['refresh-token'] || req.headers['refreshtoken'];
 
-    // Bearer 접두사 제거
-    if (refreshToken.startsWith('Bearer ')) {
-      refreshToken = refreshToken.substring(7);
-    }
+    if (refreshToken) {
+      // Bearer 접두사 제거 (대소문자 구분 없이)
+      if (refreshToken.startsWith('Bearer ')) {
+        refreshToken = refreshToken.substring(7);
+      } else if (refreshToken.startsWith('bearer ')) {
+        refreshToken = refreshToken.substring(7);
+      }
 
-    token = refreshToken.trim();
+      token = refreshToken.trim();
+    }
   }
 
   return token;
 }
 
 /**
- * Passport Refresh Token 전략 생성
+ * Passport Refresh Token 전략 생성 (Custom Strategy 사용)
  */
 function createRefreshStrategy() {
-  const options = {
-    jwtFromRequest: extractRefreshToken,
-    secretOrKeyProvider: async (request, rawJwtToken, done) => {
-      try {
-        // 1. 다중 키로 토큰 검증
-        const { decoded, keyUsed } = await verifyTokenWithFallback(rawJwtToken);
-
-        if (!decoded || !decoded.userId) {
-          return done(new Error('Invalid refresh token payload'), false);
-        }
+  return new CustomStrategy(async (req, done) => {
+    try {
+      // 1. 토큰 추출
+      const token = extractRefreshToken(req);
+      if (!token) {
+        return done(null, false, { message: 'No refresh token provided' });
+      }
 
-        // 2. 블랙리스트 확인 (refresh 타입)
-        const blacklisted = await isBlacklisted(decoded.userId, 'refresh', rawJwtToken);
-        if (blacklisted) {
-          return done(new Error('Refresh token has been revoked'), false);
-        }
+      // 2. 다중 키로 토큰 검증
+      const { decoded, keyUsed } = await verifyTokenWithFallback(token);
 
-        // 3. 검증 성공
-        console.log(
-          `[@ahhaohho/auth-middleware] ✅ Refresh token verified with ${keyUsed} key for user ${decoded.userId}`
-        );
+      if (!decoded || !decoded.userId) {
+        return done(null, false, { message: 'Invalid refresh token payload' });
+      }
 
-        done(null, decoded);
-      } catch (error) {
-        console.error('[@ahhaohho/auth-middleware] ❌ Refresh token verification failed:', error.message);
-        done(error, false);
+      // 3. 블랙리스트 확인 (refresh 타입)
+      const blacklisted = await isBlacklisted(decoded.userId, 'refresh', token);
+      if (blacklisted) {
+        return done(null, false, { message: 'Refresh token has been revoked' });
       }
-    },
-    passReqToCallback: false
-  };
 
-  return new JwtStrategy(options, (jwtPayload, done) => {
-    const user = {
-      userId: jwtPayload.userId,
-      userRole: jwtPayload.userRole,
-      phoneNumber: jwtPayload.phoneNumber
-    };
+      // 4. 검증 성공 - user 객체 반환
+      console.log(
+        `[@ahhaohho/auth-middleware] ✅ Refresh token verified with ${keyUsed} key for user ${decoded.userId}`
+      );
 
-    return done(null, user);
+      const user = {
+        userId: decoded.userId,
+        userRole: decoded.userRole,
+        phoneNumber: decoded.phoneNumber
+      };
+
+      return done(null, user);
+    } catch (error) {
+      console.error('[@ahhaohho/auth-middleware] ❌ Refresh token verification failed:', error.message);
+      return done(error, false);
+    }
   });
 }