@ahhaohho/auth-middleware 2.2.1 → 2.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahhaohho/auth-middleware",
-  "version": "2.2.1",
+  "version": "2.3.1",
   "description": "Shared authentication and authorization middleware for ahhaohho microservices",
   "main": "src/index.js",
   "scripts": {

package/src/middleware/auth.js

@@ -35,18 +35,10 @@ function authenticateJWT(req, res, next) {
   initializePassport();
 
   passport.authenticate('jwt', { session: false }, (err, user, info) => {
-    if (err) {
-      console.error('[@ahhaohho/auth-middleware] Authentication error:', err.message);
-      return res.status(500).json({
-        error: 'Authentication error',
-        message: err.message
-      });
-    }
-
-    if (!user) {
+    if (err || !user) {
       return res.status(401).json({
         error: 'Unauthorized',
-        message: info?.message || 'Invalid or expired token'
+        message: err?.message || info?.message || 'Invalid or expired token'
       });
     }
 
@@ -74,18 +66,10 @@ function authenticateRefresh(req, res, next) {
   initializePassport();
 
   passport.authenticate('refresh', { session: false }, (err, user, info) => {
-    if (err) {
-      console.error('[@ahhaohho/auth-middleware] Refresh token error:', err.message);
-      return res.status(500).json({
-        error: 'Token refresh error',
-        message: err.message
-      });
-    }
-
-    if (!user) {
+    if (err || !user) {
       return res.status(401).json({
         error: 'Invalid refresh token',
-        message: info?.message || 'Invalid or expired refresh token'
+        message: err?.message || info?.message || 'Invalid or expired refresh token'
       });
     }
 
@@ -148,15 +132,12 @@ async function authenticateHybrid(req, res, next) {
   // 1. Access token 검증 시도
   passport.authenticate('jwt', { session: false }, async (err, user, info) => {
     if (err) {
-      console.error('[@ahhaohho/auth-middleware] Hybrid auth error:', err.message);
-      return res.status(500).json({
-        error: 'Authentication error',
-        message: err.message
-      });
+      // Access token 검증 에러는 refresh token 시도로 넘어감
+      console.log('[@ahhaohho/auth-middleware] Access token error, trying refresh token...');
     }
 
     // Access token이 유효한 경우
-    if (user) {
+    if (!err && user) {
       req.user = user;
 
       // 하위 호환성: req.userId, req.userRole 설정
@@ -179,19 +160,10 @@ async function authenticateHybrid(req, res, next) {
 
     // 3. Refresh token 검증
     passport.authenticate('refresh', { session: false }, async (refreshErr, refreshUser, refreshInfo) => {
-      if (refreshErr) {
-        console.error('[@ahhaohho/auth-middleware] Refresh token error:', refreshErr.message);
-        return res.status(500).json({
-          error: 'Token refresh error',
-          message: refreshErr.message
-        });
-      }
-
-      if (!refreshUser) {
-        console.error('[@ahhaohho/auth-middleware] ❌ No refresh user found, returning 401');
+      if (refreshErr || !refreshUser) {
         return res.status(401).json({
           error: 'Unauthorized',
-          message: 'Both access and refresh tokens are invalid'
+          message: refreshErr?.message || 'Both access and refresh tokens are invalid'
         });
       }
 

package/src/utils/secretManager.js

@@ -46,7 +46,7 @@ class SecretManager {
         return JSON.parse(cachedKeys);
       }
 
-      // 2. AWS Secrets Manager에서 가져오기
+      // 2. AWS Secrets Manager에서 가져오기 (AWSCURRENT + AWSPREVIOUS)
       console.log('[@ahhaohho/auth-middleware] Fetching JWT keys from AWS Secrets Manager');
       const command = new GetSecretValueCommand({ SecretId: this.secretName });
       const response = await this.client.send(command);
@@ -56,9 +56,36 @@ class SecretManager {
       }
 
       const secret = JSON.parse(response.SecretString);
+      const currentKey = secret.current || secret.jwt_secret_key || secret.dev;
+
+      // previous 키 결정: secret 내 previous 필드 → AWSPREVIOUS 버전 순서
+      let previousKey = secret.previous || null;
+
+      if (!previousKey) {
+        try {
+          const prevCommand = new GetSecretValueCommand({
+            SecretId: this.secretName,
+            VersionStage: 'AWSPREVIOUS'
+          });
+          const prevResponse = await this.client.send(prevCommand);
+          if (prevResponse.SecretString) {
+            const prevSecret = JSON.parse(prevResponse.SecretString);
+            const prevCandidate = prevSecret.current || prevSecret.jwt_secret_key || prevSecret.dev;
+            // 이전 키가 현재 키와 다를 때만 사용
+            if (prevCandidate && prevCandidate !== currentKey) {
+              previousKey = prevCandidate;
+              console.log('[@ahhaohho/auth-middleware] Using AWSPREVIOUS version as fallback key');
+            }
+          }
+        } catch (prevError) {
+          // AWSPREVIOUS가 없을 수 있음 (첫 시크릿이거나 로테이션 미사용)
+          console.log('[@ahhaohho/auth-middleware] No AWSPREVIOUS version available');
+        }
+      }
+
       const keys = {
-        current: secret.current || secret.jwt_secret_key || secret.dev,
-        previous: secret.previous || null
+        current: currentKey,
+        previous: previousKey
       };
 
       // 3. Redis에 캐싱 (5분 TTL)