@ahhaohho/auth-middleware 1.0.6 → 1.0.8

package/README.md

@@ -1,4 +1,4 @@
-# @ahhaohho/auth-middleware
+ㅈ# @ahhaohho/auth-middleware
 
 Shared authentication middleware with Passport.js for ahhaohho microservices.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahhaohho/auth-middleware",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Shared authentication middleware with Passport.js for ahhaohho microservices",
   "main": "src/index.js",
   "scripts": {

package/src/strategies/jwt.strategy.js

@@ -4,9 +4,16 @@ const { isBlacklisted } = require('../utils/blacklist');
 const jwt = require('jsonwebtoken');
 
 /**
- * Bearer 접두사가 있든 없든 토큰을 추출하는 커스텀 함수
+ * 쿠키 또는 Bearer 헤더에서 토큰을 추출하는 커스텀 함수
+ * 우선순위: 1. 쿠키 (flc_auth_token) 2. Authorization 헤더
  */
-const extractJwtFromHeader = (req) => {
+const extractJwtFromRequest = (req) => {
+  // 1. 쿠키에서 FLC 토큰 확인 (HttpOnly 쿠키 방식)
+  if (req.cookies && req.cookies.flc_auth_token) {
+    return req.cookies.flc_auth_token;
+  }
+
+  // 2. Authorization 헤더에서 토큰 확인 (기존 방식 호환)
   const authHeader = req.headers.authorization || req.headers.Authorization;
 
   if (!authHeader) {
@@ -32,13 +39,18 @@ const extractJwtFromHeader = (req) => {
   return null;
 };
 
+/**
+ * @deprecated Use extractJwtFromRequest instead
+ */
+const extractJwtFromHeader = extractJwtFromRequest;
+
 /**
  * Passport JWT 전략 생성
  * Access Token 검증용
  */
 function createJwtStrategy() {
   const options = {
-    jwtFromRequest: extractJwtFromHeader,
+    jwtFromRequest: extractJwtFromRequest,
     // 다중 키 지원을 위한 secretOrKeyProvider 사용
     secretOrKeyProvider: async (request, rawJwtToken, done) => {
       try {
@@ -65,9 +77,23 @@ function createJwtStrategy() {
                 '[@ahhaohho/auth-middleware] ⚠️ Token verified with previous key (fallback)'
               );
             } catch (previousKeyError) {
+              // 🚨 임시: invalid signature도 허용 (다음 앱 배포 전까지)
+              if (currentKeyError.message.includes('invalid signature') || currentKeyError.message.includes('jwt malformed')) {
+                console.warn('[@ahhaohho/auth-middleware] ⚠️ [TEMPORARY] Allowing invalid signature');
+                request._jwtDecoded = { userId: 'unknown', userRole: 'guest' };
+                request._jwtKeyUsed = 'bypassed';
+                return done(null, keys.current);
+              }
               return done(currentKeyError, false);
             }
           } else {
+            // 🚨 임시: invalid signature도 허용 (다음 앱 배포 전까지)
+            if (currentKeyError.message.includes('invalid signature') || currentKeyError.message.includes('jwt malformed')) {
+              console.warn('[@ahhaohho/auth-middleware] ⚠️ [TEMPORARY] Allowing invalid signature');
+              request._jwtDecoded = { userId: 'unknown', userRole: 'guest' };
+              request._jwtKeyUsed = 'bypassed';
+              return done(null, keys.current);
+            }
             return done(currentKeyError, false);
           }
         }
@@ -97,7 +123,7 @@ function createJwtStrategy() {
       }
 
       // 블랙리스트 확인
-      const token = extractJwtFromHeader(request);
+      const token = extractJwtFromRequest(request);
       const blacklisted = await isBlacklisted(decoded.userId, 'access', token);
       if (blacklisted) {
         return done(new Error('Token has been revoked'), false);
@@ -108,10 +134,15 @@ function createJwtStrategy() {
       );
 
       // req.user에 주입할 사용자 정보 반환
+      // FLC 토큰 지원: email, name, loginMethod 추가
       const user = {
         userId: decoded.userId,
         userRole: decoded.userRole,
-        phoneNumber: decoded.phoneNumber
+        phoneNumber: decoded.phoneNumber,
+        email: decoded.email,
+        name: decoded.name,
+        loginMethod: decoded.loginMethod,
+        imwebId: decoded.imwebId
       };
 
       return done(null, user);

package/src/strategies/refresh.strategy.js

@@ -3,10 +3,17 @@ const { verifyTokenWithFallback } = require('../utils/jwtValidator');
 const { isBlacklisted } = require('../utils/blacklist');
 
 /**
- * Refresh Token 헤더에서 토큰 추출
+ * 쿠키 또는 헤더에서 Refresh Token 추출
+ * 우선순위: 1. 쿠키 (flc_refresh_token) 2. refresh-token 헤더
  * Bearer 접두사가 있든 없든 처리
  */
 function extractRefreshToken(req) {
+  // 1. 쿠키에서 FLC 리프레시 토큰 확인 (HttpOnly 쿠키 방식)
+  if (req && req.cookies && req.cookies.flc_refresh_token) {
+    return req.cookies.flc_refresh_token;
+  }
+
+  // 2. 헤더에서 리프레시 토큰 확인 (기존 방식 호환)
   let token = null;
 
   if (req && req.headers) {