@alanszp/jwt 10.0.1 → 11.0.0

package/dist/JWTUser.d.ts

@@ -0,0 +1,31 @@
+import { IJWTUser, JWTPayload } from "./types";
+export declare class JWTUser implements IJWTUser {
+    id: string;
+    employeeReference: string | null;
+    organizationReference: string;
+    originalOrganizationReference: string | null;
+    roles: string[];
+    permissions: string;
+    segmentReference: string | null;
+    constructor({ id, employeeReference, organizationReference, roles, permissions, segmentReference, }: IJWTUser);
+    static fromPayload(payload: JWTPayload): JWTUser;
+    toTokenPayload(): JWTPayload;
+    /**
+     * Old way of checking for a role
+     * Will be replaced by permission checks
+     * @param role - role code to check
+     */
+    hasRole(role: string): boolean;
+    /**
+     * Old way of checking for roles
+     * Will be replaced by permission checks
+     */
+    hasRoles(validateRoles: string | string[]): boolean;
+    /**
+     * Check if user has permission to perform an action
+     * @note - not implemented, will be implemented in the next release
+     * @param permissionCode - permission code to check
+     * @returns boolean
+     */
+    hasPermission(_permissionCode: string): boolean;
+}

package/dist/JWTUser.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JWTUser = void 0;
+class JWTUser {
+    constructor({ id, employeeReference, organizationReference, roles, permissions, segmentReference, }) {
+        this.id = id;
+        this.employeeReference = employeeReference;
+        this.organizationReference = organizationReference;
+        this.roles = roles;
+        this.permissions = permissions;
+        this.segmentReference = segmentReference;
+    }
+    static fromPayload(payload) {
+        return new JWTUser({
+            id: payload.sub,
+            employeeReference: payload.ref,
+            organizationReference: payload.org,
+            roles: payload.rls,
+            permissions: payload.prms,
+            segmentReference: payload.seg || null,
+        });
+    }
+    toTokenPayload() {
+        return {
+            sub: this.id,
+            ref: this.employeeReference,
+            org: this.organizationReference,
+            rls: this.roles,
+            prms: this.permissions,
+            seg: this.segmentReference,
+        };
+    }
+    /**
+     * Old way of checking for a role
+     * Will be replaced by permission checks
+     * @param role - role code to check
+     */
+    hasRole(role) {
+        return this.roles.includes(role);
+    }
+    /**
+     * Old way of checking for roles
+     * Will be replaced by permission checks
+     */
+    hasRoles(validateRoles) {
+        if (typeof validateRoles === "string") {
+            return this.hasRole(validateRoles);
+        }
+        return validateRoles.some((role) => this.hasRole(role));
+    }
+    /**
+     * Check if user has permission to perform an action
+     * @note - not implemented, will be implemented in the next release
+     * @param permissionCode - permission code to check
+     * @returns boolean
+     */
+    hasPermission(_permissionCode) {
+        throw new Error("Not implemented");
+    }
+}
+exports.JWTUser = JWTUser;
+//# sourceMappingURL=JWTUser.js.map

package/dist/JWTUser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JWTUser.js","sourceRoot":"","sources":["../src/JWTUser.ts"],"names":[],"mappings":";;;AAEA,MAAa,OAAO;IAelB,YAAY,EACV,EAAE,EACF,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,EACL,WAAW,EACX,gBAAgB,GACP;QACT,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAAmB;QACpC,OAAO,IAAI,OAAO,CAAC;YACjB,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,iBAAiB,EAAE,OAAO,CAAC,GAAG;YAC9B,qBAAqB,EAAE,OAAO,CAAC,GAAG;YAClC,KAAK,EAAE,OAAO,CAAC,GAAG;YAClB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,gBAAgB,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI;SACtC,CAAC,CAAC;IACL,CAAC;IAEM,cAAc;QACnB,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,iBAAiB;YAC3B,GAAG,EAAE,IAAI,CAAC,qBAAqB;YAC/B,GAAG,EAAE,IAAI,CAAC,KAAK;YACf,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,GAAG,EAAE,IAAI,CAAC,gBAAgB;SAC3B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,OAAO,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;OAGG;IACI,QAAQ,CAAC,aAAgC;QAC9C,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;SACpC;QACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,eAAuB;QAC1C,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;CACF;AAlFD,0BAkFC"}

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./types";
+export * from "./JWTUser";
 export * from "./jwt";

package/dist/index.js

@@ -11,5 +11,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./types"), exports);
+__exportStar(require("./JWTUser"), exports);
 __exportStar(require("./jwt"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAwB;AACxB,wCAAsB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAwB;AACxB,4CAA0B;AAC1B,wCAAsB"}

package/dist/jwt.d.ts

@@ -1,12 +1,11 @@
 /// <reference types="node" />
 import { KeyObject } from "crypto";
-import type { JWTPayload, JWTUser, SignOptions, VerifyOptions } from "./types";
+import type { SignOptions, VerifyOptions } from "./types";
+import { JWTUser } from "./JWTUser";
 export declare const JWT_ALGORITHM = "RS512";
 export declare function privateKeyFromPem(key: string): KeyObject;
 export declare function publicKeyFromPem(key: string): KeyObject;
 export declare function withDefaultSignOptions(options?: Partial<SignOptions>): SignOptions;
 export declare function withDefaultVerifyOptions(options?: Partial<VerifyOptions>): VerifyOptions;
 export declare function generateJWT(privateKey: KeyObject | string, user: JWTUser, options?: Partial<SignOptions>): Promise<string>;
-export declare function createTokenPayload(user: JWTUser): JWTPayload;
 export declare function verifyJWT(publicKey: KeyObject | string, token: string, options?: Partial<VerifyOptions>): Promise<JWTUser>;
-export declare function jwtUserHasRoles(jwtUser: JWTUser, roles: string | string[]): boolean;

package/dist/jwt.js

@@ -9,9 +9,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.jwtUserHasRoles = exports.verifyJWT = exports.createTokenPayload = exports.generateJWT = exports.withDefaultVerifyOptions = exports.withDefaultSignOptions = exports.publicKeyFromPem = exports.privateKeyFromPem = exports.JWT_ALGORITHM = void 0;
+exports.verifyJWT = exports.generateJWT = exports.withDefaultVerifyOptions = exports.withDefaultSignOptions = exports.publicKeyFromPem = exports.privateKeyFromPem = exports.JWT_ALGORITHM = void 0;
 const crypto_1 = require("crypto");
 const jose_1 = require("jose");
+const JWTUser_1 = require("./JWTUser");
 exports.JWT_ALGORITHM = "RS512";
 function privateKeyFromPem(key) {
     return (0, crypto_1.createPrivateKey)({
@@ -39,7 +40,7 @@ function generateJWT(privateKey, user, options) {
     return __awaiter(this, void 0, void 0, function* () {
         const key = typeof privateKey === "string" ? privateKeyFromPem(privateKey) : privateKey;
         const opts = withDefaultSignOptions(options);
-        return new jose_1.SignJWT(createTokenPayload(user))
+        return new jose_1.SignJWT(user.toTokenPayload())
             .setProtectedHeader({ alg: exports.JWT_ALGORITHM })
             .setIssuedAt()
             .setIssuer(opts.issuer)
@@ -49,17 +50,6 @@ function generateJWT(privateKey, user, options) {
     });
 }
 exports.generateJWT = generateJWT;
-function createTokenPayload(user) {
-    return {
-        sub: user.id,
-        ref: user.employeeReference,
-        org: user.organizationReference,
-        rls: user.roles,
-        prms: user.permissions,
-        seg: user.segmentReference,
-    };
-}
-exports.createTokenPayload = createTokenPayload;
 function verifyJWT(publicKey, token, options) {
     return __awaiter(this, void 0, void 0, function* () {
         const key = typeof publicKey === "string" ? publicKeyFromPem(publicKey) : publicKey;
@@ -70,20 +60,8 @@ function verifyJWT(publicKey, token, options) {
             audience: opts.audience,
         });
         const payload = verify.payload;
-        return {
-            id: payload.sub,
-            employeeReference: payload.ref,
-            organizationReference: payload.org,
-            roles: payload.rls,
-            permissions: payload.prms,
-            segmentReference: payload.seg || null,
-        };
+        return JWTUser_1.JWTUser.fromPayload(payload);
     });
 }
 exports.verifyJWT = verifyJWT;
-function jwtUserHasRoles(jwtUser, roles) {
-    const validateRoles = typeof roles === "string" ? [roles] : roles;
-    return validateRoles.some((role) => jwtUser.roles.includes(role));
-}
-exports.jwtUserHasRoles = jwtUserHasRoles;
 //# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,mCAAsE;AACtE,+BAA0C;AAG7B,QAAA,aAAa,GAAG,OAAO,CAAC;AAErC,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,OAAO,IAAA,yBAAgB,EAAC;QACtB,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AALD,8CAKC;AAED,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,OAAO,IAAA,wBAAe,EAAC;QACrB,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AALD,4CAKC;AAED,SAAgB,sBAAsB,CACpC,OAA8B;IAE9B,uBACE,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,UAAU,EAAE,KAAK,IACd,OAAO,EACV;AACJ,CAAC;AATD,wDASC;AAED,SAAgB,wBAAwB,CACtC,OAAgC;IAEhC,uBACE,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC3B,QAAQ,EAAE,KAAK,IACZ,OAAO,EACV;AACJ,CAAC;AARD,4DAQC;AAED,SAAsB,WAAW,CAC/B,UAA8B,EAC9B,IAAa,EACb,OAA8B;;QAE9B,MAAM,GAAG,GACP,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAE9E,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,IAAI,cAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;aACzC,kBAAkB,CAAC,EAAE,GAAG,EAAE,qBAAa,EAAE,CAAC;aAC1C,WAAW,EAAE;aACb,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;aACtB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;aAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CAAA;AAjBD,kCAiBC;AAED,SAAgB,kBAAkB,CAAC,IAAa;IAC9C,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,GAAG,EAAE,IAAI,CAAC,iBAAiB;QAC3B,GAAG,EAAE,IAAI,CAAC,qBAAqB;QAC/B,GAAG,EAAE,IAAI,CAAC,KAAK;QACf,IAAI,EAAE,IAAI,CAAC,WAAW;QACtB,GAAG,EAAE,IAAI,CAAC,gBAAgB;KAC3B,CAAC;AACJ,CAAC;AATD,gDASC;AAED,SAAsB,SAAS,CAC7B,SAA6B,EAC7B,KAAa,EACb,OAAgC;;QAEhC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,GAAG,EAAE;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,CAAC,qBAAa,CAAC;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAqB,CAAC;QAE7C,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,iBAAiB,EAAE,OAAO,CAAC,GAAG;YAC9B,qBAAqB,EAAE,OAAO,CAAC,GAAG;YAClC,KAAK,EAAE,OAAO,CAAC,GAAG;YAClB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,gBAAgB,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI;SACtC,CAAC;IACJ,CAAC;CAAA;AA1BD,8BA0BC;AAED,SAAgB,eAAe,CAC7B,OAAgB,EAChB,KAAwB;IAExB,MAAM,aAAa,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAND,0CAMC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,mCAAsE;AACtE,+BAA0C;AAE1C,uCAAoC;AAEvB,QAAA,aAAa,GAAG,OAAO,CAAC;AAErC,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,OAAO,IAAA,yBAAgB,EAAC;QACtB,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AALD,8CAKC;AAED,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,OAAO,IAAA,wBAAe,EAAC;QACrB,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AALD,4CAKC;AAED,SAAgB,sBAAsB,CACpC,OAA8B;IAE9B,uBACE,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,UAAU,EAAE,KAAK,IACd,OAAO,EACV;AACJ,CAAC;AATD,wDASC;AAED,SAAgB,wBAAwB,CACtC,OAAgC;IAEhC,uBACE,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAC3B,QAAQ,EAAE,KAAK,IACZ,OAAO,EACV;AACJ,CAAC;AARD,4DAQC;AAED,SAAsB,WAAW,CAC/B,UAA8B,EAC9B,IAAa,EACb,OAA8B;;QAE9B,MAAM,GAAG,GACP,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAE9E,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,IAAI,cAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;aACtC,kBAAkB,CAAC,EAAE,GAAG,EAAE,qBAAa,EAAE,CAAC;aAC1C,WAAW,EAAE;aACb,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;aACtB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;aAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;CAAA;AAjBD,kCAiBC;AAED,SAAsB,SAAS,CAC7B,SAA6B,EAC7B,KAAa,EACb,OAAgC;;QAEhC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,GAAG,EAAE;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,CAAC,qBAAa,CAAC;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAqB,CAAC;QAE7C,OAAO,iBAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;CAAA;AAnBD,8BAmBC"}

package/dist/types.d.ts

@@ -4,15 +4,15 @@ export interface JWTPayload extends LibPayload {
     ref: string | null;
     org: string;
     rls: string[];
-    prms: string[];
+    prms: string;
     seg: string | null;
 }
-export interface JWTUser {
+export interface IJWTUser {
     id: string;
     employeeReference: string | null;
     organizationReference: string;
     roles: string[];
-    permissions: string[];
+    permissions: string;
     segmentReference: string | null;
 }
 export interface SignOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alanszp/jwt",
-  "version": "10.0.1",
+  "version": "11.0.0",
   "description": "Alan's jwt validator & signer.",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
@@ -26,5 +26,5 @@
   "dependencies": {
     "jose": "^5.2.2"
   },
-  "gitHead": "43e1ad79adf9f06c314132d67495cee96dd82612"
+  "gitHead": "60b62fa2fff34ef094ea9af69c2bed2373c70f64"
 }

package/src/JWTUser.ts

@@ -0,0 +1,85 @@
+import { IJWTUser, JWTPayload } from "./types";
+
+export class JWTUser implements IJWTUser {
+  id: string;
+
+  employeeReference: string | null;
+
+  organizationReference: string;
+
+  originalOrganizationReference: string | null;
+
+  roles: string[];
+
+  permissions: string;
+
+  segmentReference: string | null;
+
+  constructor({
+    id,
+    employeeReference,
+    organizationReference,
+    roles,
+    permissions,
+    segmentReference,
+  }: IJWTUser) {
+    this.id = id;
+    this.employeeReference = employeeReference;
+    this.organizationReference = organizationReference;
+    this.roles = roles;
+    this.permissions = permissions;
+    this.segmentReference = segmentReference;
+  }
+
+  static fromPayload(payload: JWTPayload): JWTUser {
+    return new JWTUser({
+      id: payload.sub,
+      employeeReference: payload.ref,
+      organizationReference: payload.org,
+      roles: payload.rls,
+      permissions: payload.prms,
+      segmentReference: payload.seg || null,
+    });
+  }
+
+  public toTokenPayload(): JWTPayload {
+    return {
+      sub: this.id,
+      ref: this.employeeReference,
+      org: this.organizationReference,
+      rls: this.roles,
+      prms: this.permissions,
+      seg: this.segmentReference,
+    };
+  }
+
+  /**
+   * Old way of checking for a role
+   * Will be replaced by permission checks
+   * @param role - role code to check
+   */
+  public hasRole(role: string): boolean {
+    return this.roles.includes(role);
+  }
+
+  /**
+   * Old way of checking for roles
+   * Will be replaced by permission checks
+   */
+  public hasRoles(validateRoles: string | string[]): boolean {
+    if (typeof validateRoles === "string") {
+      return this.hasRole(validateRoles);
+    }
+    return validateRoles.some((role) => this.hasRole(role));
+  }
+
+  /**
+   * Check if user has permission to perform an action
+   * @note - not implemented, will be implemented in the next release
+   * @param permissionCode - permission code to check
+   * @returns boolean
+   */
+  public hasPermission(_permissionCode: string): boolean {
+    throw new Error("Not implemented");
+  }
+}

package/src/index.ts

@@ -1,2 +1,3 @@
 export * from "./types";
+export * from "./JWTUser";
 export * from "./jwt";

package/src/jwt.ts

@@ -1,6 +1,7 @@
 import { createPublicKey, createPrivateKey, KeyObject } from "crypto";
 import { SignJWT, jwtVerify } from "jose";
-import type { JWTPayload, JWTUser, SignOptions, VerifyOptions } from "./types";
+import type { JWTPayload, SignOptions, VerifyOptions } from "./types";
+import { JWTUser } from "./JWTUser";
 
 export const JWT_ALGORITHM = "RS512";
 
@@ -49,7 +50,7 @@ export async function generateJWT(
 
   const opts = withDefaultSignOptions(options);
 
-  return new SignJWT(createTokenPayload(user))
+  return new SignJWT(user.toTokenPayload())
     .setProtectedHeader({ alg: JWT_ALGORITHM })
     .setIssuedAt()
     .setIssuer(opts.issuer)
@@ -58,17 +59,6 @@ export async function generateJWT(
     .sign(key);
 }
 
-export function createTokenPayload(user: JWTUser): JWTPayload {
-  return {
-    sub: user.id,
-    ref: user.employeeReference,
-    org: user.organizationReference,
-    rls: user.roles,
-    prms: user.permissions,
-    seg: user.segmentReference,
-  };
-}
-
 export async function verifyJWT(
   publicKey: KeyObject | string,
   token: string,
@@ -87,20 +77,5 @@ export async function verifyJWT(
 
   const payload = verify.payload as JWTPayload;
 
-  return {
-    id: payload.sub,
-    employeeReference: payload.ref,
-    organizationReference: payload.org,
-    roles: payload.rls,
-    permissions: payload.prms,
-    segmentReference: payload.seg || null,
-  };
-}
-
-export function jwtUserHasRoles(
-  jwtUser: JWTUser,
-  roles: string | string[]
-): boolean {
-  const validateRoles = typeof roles === "string" ? [roles] : roles;
-  return validateRoles.some((role) => jwtUser.roles.includes(role));
+  return JWTUser.fromPayload(payload);
 }

package/src/types.ts

@@ -5,17 +5,17 @@ export interface JWTPayload extends LibPayload {
   ref: string | null;
   org: string;
   rls: string[];
-  prms: string[];
+  prms: string;
   // segmentReference
   seg: string | null;
 }
 
-export interface JWTUser {
+export interface IJWTUser {
   id: string;
   employeeReference: string | null;
   organizationReference: string;
   roles: string[];
-  permissions: string[];
+  permissions: string;
   segmentReference: string | null;
 }