@carecard/auth-util 3.1.13 → 3.1.16

package/lib/jwtUtilAuth.js

@@ -1,55 +1,72 @@
-const crypto = require( 'crypto' );
+const crypto = require('crypto');
 
-const _normalizePayload = ( payloadObject ) => {
-    const payload = { ...payloadObject };
-    const now = Math.floor( Date.now() / 1000 );
-    const fieldsToNormalize = [ 'iat', 'exp', 'nbf', 'auth_time' ];
-    const msThreshold = 1000000000000;
+const _normalizePayload = payloadObject => {
+  const payload = { ...payloadObject };
+  const now = Math.floor(Date.now() / 1000);
+  const fieldsToNormalize = ['iat', 'exp', 'nbf', 'auth_time'];
+  const msThreshold = 1000000000000;
 
-    if ( !payload.iat ) {
-        payload.iat = now;
+  if (!payload.iat) {
+    payload.iat = now;
+  }
+
+  fieldsToNormalize.forEach(field => {
+    if (payload[field] && payload[field] > msThreshold) {
+      payload[field] = Math.floor(payload[field] / 1000);
     }
+  });
 
-    fieldsToNormalize.forEach( field => {
-        if ( payload[ field ] && payload[ field ] > msThreshold ) {
-            payload[ field ] = Math.floor( payload[ field ] / 1000 );
-        }
-    } );
+  if (!payload.exp) {
+    payload.exp = payload.iat + 3600;
+  }
+  return payload;
+};
 
-    if ( !payload.exp ) {
-        payload.exp = payload.iat + 3600;
-    }
-    return payload;
+const _encode = obj => {
+  return Buffer.from(JSON.stringify(obj)).toString('base64url');
 };
 
-const _encode = ( obj ) => {
-    return Buffer.from( JSON.stringify( obj ) ).toString( 'base64url' );
+const _decode = str => {
+  return JSON.parse(Buffer.from(str, 'base64url').toString('utf8'));
 };
 
-const _decode = ( str ) => {
-    return JSON.parse( Buffer.from( str, 'base64url' ).toString( 'utf8' ) );
+const _sign = (token, alg, privateKey) => {
+  if (alg === 'EdDSA' || alg === 'Ed25519') {
+    return crypto.sign(null, Buffer.from(token), privateKey).toString('base64url');
+  }
+
+  const sign = crypto.createSign(alg);
+  sign.write(token);
+  sign.end();
+  return sign.sign(privateKey, 'base64url');
 };
 
-const _sign = ( token, alg, privateKey ) => {
-    if ( alg === 'EdDSA' || alg === 'Ed25519' ) {
-        return crypto.sign( null, Buffer.from( token ), privateKey ).toString( 'base64url' );
-    }
+const _verify = (token, signature, alg, publicKey) => {
+  if (alg === 'EdDSA' || alg === 'Ed25519') {
+    return crypto.verify(null, Buffer.from(token), publicKey, Buffer.from(signature, 'base64url'));
+  }
 
-    const sign = crypto.createSign( alg );
-    sign.write( token );
-    sign.end();
-    return sign.sign( privateKey, 'base64url' );
+  const verify = crypto.createVerify(alg);
+  verify.update(token);
+  verify.end();
+  return verify.verify(publicKey, signature, 'base64url');
 };
 
-const _verify = ( token, signature, alg, publicKey ) => {
-    if ( alg === 'EdDSA' || alg === 'Ed25519' ) {
-        return crypto.verify( null, Buffer.from( token ), publicKey, Buffer.from( signature, 'base64url' ) );
-    }
+const isNonEmptyString = value => {
+  return typeof value === 'string' && value.trim().length > 0;
+};
+
+const audienceIsNonEmptyStringArray = audience => {
+  return Array.isArray(audience) && audience.length > 0 && audience.every(audienceValue => isNonEmptyString(audienceValue));
+};
 
-    const verify = crypto.createVerify( alg );
-    verify.update( token );
-    verify.end();
-    return verify.verify( publicKey, signature, 'base64url' );
+const isNonEmptyAudience = audience => {
+  return isNonEmptyString(audience) || audienceIsNonEmptyStringArray(audience);
+};
+
+const normalizeSeconds = value => {
+  if (!Number.isFinite(value)) return null;
+  return value > 1000000000000 ? Math.floor(value / 1000) : Math.floor(value);
 };
 
 /**
@@ -59,48 +76,93 @@ const _verify = ( token, signature, alg, publicKey ) => {
  * @param privateKey
  * @return {string|null}
  */
-const createSignedJwtFromObject = ( headerObject, payloadObject, privateKey ) => {
-    try {
-        if ( !privateKey ) return null;
+const createSignedJwtFromObject = (headerObject, payloadObject, privateKey) => {
+  try {
+    if (!privateKey) return null;
 
-        const header = { ...headerObject };
-        header.alg = header.alg || 'EdDSA';
-        header.typ = 'JWT';
+    const header = { ...headerObject };
+    header.alg = header.alg || 'EdDSA';
+    header.typ = 'JWT';
 
-        const payload = _normalizePayload( payloadObject );
+    const payload = _normalizePayload(payloadObject);
 
-        const headerBase64UrlSafe = _encode( header );
-        const payloadBase64UrlSafe = _encode( payload );
-        const token = headerBase64UrlSafe + "." + payloadBase64UrlSafe;
+    const headerBase64UrlSafe = _encode(header);
+    const payloadBase64UrlSafe = _encode(payload);
+    const token = headerBase64UrlSafe + '.' + payloadBase64UrlSafe;
 
-        const signature = _sign( token, header.alg, privateKey );
+    const signature = _sign(token, header.alg, privateKey);
 
-        return token + "." + signature;
-    } catch ( error ) {
-        return null;
-    }
+    return token + '.' + signature;
+  } catch (error) {
+    return null;
+  }
 };
 
+function createServiceJwt({
+  issuer,
+  audience,
+  privateKey,
+  subject = issuer,
+  issuedAt = Math.floor(Date.now() / 1000),
+  expiresInSeconds = 60,
+  algorithm = 'EdDSA',
+  claims = {},
+} = {}) {
+  if (
+    !isNonEmptyString(issuer) ||
+    !isNonEmptyAudience(audience) ||
+    !isNonEmptyString(subject) ||
+    !isNonEmptyString(privateKey) ||
+    !Number.isInteger(expiresInSeconds) ||
+    expiresInSeconds <= 0
+  ) {
+    return null;
+  }
+
+  const iat = normalizeSeconds(issuedAt);
+  if (!Number.isInteger(iat)) return null;
+
+  // Service-to-service tokens use registered JWT claims so receivers can
+  // validate sender, intended audience, subject, and lifetime consistently.
+  return createSignedJwtFromObject(
+    { alg: algorithm, typ: 'JWT' },
+    {
+      ...claims,
+      iss: issuer,
+      aud: audience,
+      sub: subject,
+      iat,
+      exp: iat + expiresInSeconds,
+    },
+    privateKey,
+  );
+}
+
+function createServiceAuthorizationHeader(options = {}) {
+  const token = createServiceJwt(options);
+  return token ? `Bearer ${token}` : null;
+}
+
 /**
  * Verify signature of jwt
  * @param jwt
  * @param publicKey
  * @return {boolean}
  */
-const verifyJwtSignature = ( jwt, publicKey ) => {
-    try {
-        if ( !jwt || !publicKey ) return false;
-        const splitJWT = jwt.split( '.' );
-        if ( splitJWT.length !== 3 ) return false;
-
-        const [ header, payload, signature ] = splitJWT;
-        const token = header + "." + payload;
-        const headerObject = _decode( header );
-
-        return _verify( token, signature, headerObject.alg, publicKey );
-    } catch ( error ) {
-        return false;
-    }
+const verifyJwtSignature = (jwt, publicKey) => {
+  try {
+    if (!jwt || !publicKey) return false;
+    const splitJWT = jwt.split('.');
+    if (splitJWT.length !== 3) return false;
+
+    const [header, payload, signature] = splitJWT;
+    const token = header + '.' + payload;
+    const headerObject = _decode(header);
+
+    return _verify(token, signature, headerObject.alg, publicKey);
+  } catch (error) {
+    return false;
+  }
 };
 
 /**
@@ -109,27 +171,31 @@ const verifyJwtSignature = ( jwt, publicKey ) => {
  * @return {{payload: *, header: *}|null}
  */
 const getHeaderPayloadFromJwt = jwt => {
-    try {
-        if ( typeof jwt !== 'string' ) return null;
-        const splitJWT = jwt.split( '.' );
-        if ( splitJWT.length !== 3 ) return null;
-
-        const headerObject = _decode( splitJWT[ 0 ] );
-        const payloadObject = _decode( splitJWT[ 1 ] );
-
-        return { header: headerObject, payload: payloadObject }
-    } catch ( e ) {
-        return null;
-    }
+  try {
+    if (typeof jwt !== 'string') return null;
+    const splitJWT = jwt.split('.');
+    if (splitJWT.length !== 3) return null;
+
+    const headerObject = _decode(splitJWT[0]);
+    const payloadObject = _decode(splitJWT[1]);
+
+    return { header: headerObject, payload: payloadObject };
+  } catch (e) {
+    return null;
+  }
 };
 
 module.exports = {
-    createSignedJwtFromObject,
-    verifyJwtSignature,
-    getHeaderPayloadFromJwt,
-    _normalizePayload,
-    _encode,
-    _decode,
-    _sign,
-    _verify
+  createSignedJwtFromObject,
+  createServiceJwt,
+  createServiceAuthorizationHeader,
+  verifyJwtSignature,
+  getHeaderPayloadFromJwt,
+  _normalizePayload,
+  _encode,
+  _decode,
+  _sign,
+  _verify,
+  _isNonEmptyAudience: isNonEmptyAudience,
+  _normalizeSeconds: normalizeSeconds,
 };

package/lib/keyGen.js

@@ -1,28 +1,24 @@
-const {
-    generateKeyPairSync,
-} = require( 'node:crypto' );
+const { generateKeyPairSync } = require('node:crypto');
 
+const generateKeyPair = (algorithm = 'ed25519') => {
+  const options = {
+    publicKeyEncoding: {
+      type: 'spki',
+      format: 'pem',
+    },
+    privateKeyEncoding: {
+      type: 'pkcs8',
+      format: 'pem',
+    },
+  };
 
-const generateKeyPair = ( algorithm = 'ed25519' ) => {
-    const options = {
-        publicKeyEncoding: {
-            type: 'spki',
-            format: 'pem',
-        },
-        privateKeyEncoding: {
-            type: 'pkcs8',
-            format: 'pem',
-        },
-    };
+  if (algorithm === 'rsa') {
+    options.modulusLength = 2048;
+  }
 
-    if ( algorithm === 'rsa' ) {
-        options.modulusLength = 2048;
-    }
-
-    return generateKeyPairSync( algorithm, options );
+  return generateKeyPairSync(algorithm, options);
 };
 
-
 module.exports = {
-    generateKeyPair
-};
+  generateKeyPair,
+};

package/lib/pwdUtilAuth.js

@@ -1,4 +1,4 @@
-const crypto = require( 'crypto' );
+const crypto = require('crypto');
 
 /**
  * Automatically adds random salt.
@@ -7,15 +7,15 @@ const crypto = require( 'crypto' );
  * @param algorithm
  * @return {string}
  */
-const createPasswordHashWithRandomSalt = ( password, secret, algorithm ) => {
-    try {
-        const salt = crypto.randomBytes( 32 ).toString( 'base64' );
-        const algorithmBase64 = Buffer.from( algorithm ).toString( 'base64' );
-        const hashBase64 = crypto.createHmac( algorithm, secret ).update( password ).digest( 'base64' );
-        return "$1$" + algorithmBase64 + "$" + hashBase64 + "$" + salt + "$";
-    } catch ( e ) {
-        return null;
-    }
+const createPasswordHashWithRandomSalt = (password, secret, algorithm) => {
+  try {
+    const salt = crypto.randomBytes(32).toString('base64');
+    const algorithmBase64 = Buffer.from(algorithm).toString('base64');
+    const hashBase64 = crypto.createHmac(algorithm, secret).update(password).digest('base64');
+    return '$1$' + algorithmBase64 + '$' + hashBase64 + '$' + salt + '$';
+  } catch (e) {
+    return null;
+  }
 };
 
 /**
@@ -25,23 +25,23 @@ const createPasswordHashWithRandomSalt = ( password, secret, algorithm ) => {
  * @param secret
  * @return {string}
  */
-const createPasswordHashBasedOnSavedAlgorithmSalt = ( password, savedPasswordHash, secret ) => {
-    try {
-        const splitStringArray = savedPasswordHash.split( '$' );
-        if ( splitStringArray.length !== 6 ) return null;
+const createPasswordHashBasedOnSavedAlgorithmSalt = (password, savedPasswordHash, secret) => {
+  try {
+    const splitStringArray = savedPasswordHash.split('$');
+    if (splitStringArray.length !== 6) return null;
 
-        const algBase64 = splitStringArray[ 2 ];
-        const salt = splitStringArray[ 4 ];
-        const algorithm = Buffer.from( algBase64, 'base64' ).toString( 'utf8' );
+    const algBase64 = splitStringArray[2];
+    const salt = splitStringArray[4];
+    const algorithm = Buffer.from(algBase64, 'base64').toString('utf8');
 
-        const hashBase64 = crypto.createHmac( algorithm, secret ).update( password ).digest( 'base64' );
-        return "$1$" + algBase64 + "$" + hashBase64 + "$" + salt + "$";
-    } catch ( e ) {
-        return null;
-    }
+    const hashBase64 = crypto.createHmac(algorithm, secret).update(password).digest('base64');
+    return '$1$' + algBase64 + '$' + hashBase64 + '$' + salt + '$';
+  } catch (e) {
+    return null;
+  }
 };
 
 module.exports = {
-    createPasswordHashWithRandomSalt,
-    createPasswordHashBasedOnSavedAlgorithmSalt
-}
+  createPasswordHashWithRandomSalt,
+  createPasswordHashBasedOnSavedAlgorithmSalt,
+};

package/lib/stringUtilAuth.js

@@ -11,19 +11,16 @@
  * @return {*}
  */
 const adjustBase64Padding = base64String => {
-    return base64String.padEnd( base64String.length + ( 4 - base64String.length % 4 ) % 4, '=' );
-}
+  return base64String.padEnd(base64String.length + ((4 - (base64String.length % 4)) % 4), '=');
+};
 
 /**
  * Removes /, + and = from the string
  * @deprecated Use native Buffer methods or other modern alternatives.
  * @returns {string}
  */
-const makeStringUrlSafe = ( urlUnsafeString = '' ) => {
-    return urlUnsafeString
-        .replaceAll( '+', '-' )
-        .replaceAll( '/', '_' )
-        .replaceAll( '=', '' );
+const makeStringUrlSafe = (urlUnsafeString = '') => {
+  return urlUnsafeString.replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
 };
 
 /**
@@ -31,11 +28,9 @@ const makeStringUrlSafe = ( urlUnsafeString = '' ) => {
  * @deprecated Use native Buffer methods or other modern alternatives.
  * @returns {string}
  */
-const reverseStringUrlSafe = ( urlSafeString = '' ) => {
-    let myString = urlSafeString
-        .replaceAll( '-', '+' )
-        .replaceAll( '_', '/' );
-    return adjustBase64Padding( myString );
+const reverseStringUrlSafe = (urlSafeString = '') => {
+  let myString = urlSafeString.replaceAll('-', '+').replaceAll('_', '/');
+  return adjustBase64Padding(myString);
 };
 
 /**
@@ -44,18 +39,18 @@ const reverseStringUrlSafe = ( urlSafeString = '' ) => {
  * @param unCodedString
  * @returns {string}
  */
-const asciiToBase64 = ( unCodedString ) => {
-    return Buffer.from( unCodedString ).toString( 'base64' );
-}
+const asciiToBase64 = unCodedString => {
+  return Buffer.from(unCodedString).toString('base64');
+};
 
 /** Decode string from base64
  * @deprecated Use native Buffer methods or other modern alternatives.
  * @param codedString
  * @returns {string}
  */
-const base64ToAscii = ( codedString ) => {
-    return Buffer.from( codedString, 'base64' ).toString( 'utf8' );
-}
+const base64ToAscii = codedString => {
+  return Buffer.from(codedString, 'base64').toString('utf8');
+};
 
 /**
  * Decompose $ connected string and return an object
@@ -63,16 +58,16 @@ const base64ToAscii = ( codedString ) => {
  * @deprecated Use native Buffer methods or other modern alternatives.
  * @param passwordHash
  */
-const dollarSignConnectedStringToAlgorithmHashSalt = ( passwordHash ) => {
-    const splitStringArray = passwordHash.split( '$' );
-    if ( splitStringArray.length !== 6 ) return null;
-    return {
-        version: splitStringArray[ 1 ],
-        alg: splitStringArray[ 2 ],
-        hash: splitStringArray[ 3 ],
-        salt: splitStringArray[ 4 ]
-    };
-}
+const dollarSignConnectedStringToAlgorithmHashSalt = passwordHash => {
+  const splitStringArray = passwordHash.split('$');
+  if (splitStringArray.length !== 6) return null;
+  return {
+    version: splitStringArray[1],
+    alg: splitStringArray[2],
+    hash: splitStringArray[3],
+    salt: splitStringArray[4],
+  };
+};
 
 /**
  * Decompose . connected string and return an object with
@@ -80,17 +75,16 @@ const dollarSignConnectedStringToAlgorithmHashSalt = ( passwordHash ) => {
  * return null if error
  * @deprecated Use native Buffer methods or other modern alternatives.
  */
-const dotConnectedStringToHeaderPayloadSignature = ( jwt ) => {
-    if ( typeof jwt !== 'string' ) return null;
-    const splitJWT = jwt.split( '.' );
-    if ( splitJWT.length !== 3 ) return null;
-    return {
-        header: splitJWT[ 0 ],
-        payload: splitJWT[ 1 ],
-        signature: splitJWT[ 2 ]
-    };
-}
-
+const dotConnectedStringToHeaderPayloadSignature = jwt => {
+  if (typeof jwt !== 'string') return null;
+  const splitJWT = jwt.split('.');
+  if (splitJWT.length !== 3) return null;
+  return {
+    header: splitJWT[0],
+    payload: splitJWT[1],
+    signature: splitJWT[2],
+  };
+};
 
 /**
  * Turns object into url safe string
@@ -99,7 +93,7 @@ const dotConnectedStringToHeaderPayloadSignature = ( jwt ) => {
  * @return {string}
  */
 const objectToBase64UrlSafeString = object => {
-    return Buffer.from( JSON.stringify( object ) ).toString( 'base64url' );
+  return Buffer.from(JSON.stringify(object)).toString('base64url');
 };
 
 /**
@@ -109,16 +103,16 @@ const objectToBase64UrlSafeString = object => {
  * @return {any}
  */
 const urlSafeBase64ToObject = urlSafeBase64String => {
-    return JSON.parse( Buffer.from( urlSafeBase64String, 'base64url' ).toString( 'utf8' ) );
+  return JSON.parse(Buffer.from(urlSafeBase64String, 'base64url').toString('utf8'));
 };
 
 module.exports = {
-    makeStringUrlSafe,
-    reverseStringUrlSafe,
-    asciiToBase64,
-    base64ToAscii,
-    dollarSignConnectedStringToAlgorithmHashSalt,
-    dotConnectedStringToHeaderPayloadSignature,
-    objectToBase64UrlSafeString,
-    urlSafeBase64ToObject
+  makeStringUrlSafe,
+  reverseStringUrlSafe,
+  asciiToBase64,
+  base64ToAscii,
+  dollarSignConnectedStringToAlgorithmHashSalt,
+  dotConnectedStringToHeaderPayloadSignature,
+  objectToBase64UrlSafeString,
+  urlSafeBase64ToObject,
 };

package/package.json

@@ -1,15 +1,20 @@
 {
   "name": "@carecard/auth-util",
-  "version": "3.1.13",
+  "version": "3.1.16",
   "repository": "https://github.com/CareCard-ca/pkg-auth-util.git",
   "description": "Auth utility functions",
   "main": "index.js",
   "types": "index.d.ts",
   "scripts": {
-    "test": "export NODE_ENV=test && mocha --recursive",
+    "test": "mocha --recursive",
     "test:types": "tsc --noEmit && mocha -r ts-node/register test/types.test.ts",
-    "test:coverage": "tsc --noEmit && export NODE_ENV=test && nyc mocha --recursive -r ts-node/register 'test/**/*.{js,ts}'",
-    "prepare": "husky"
+    "test:coverage": "tsc --noEmit && nyc mocha --recursive -r ts-node/register 'test/**/*.{js,ts}'",
+    "test:All": "npm run test && npm run test:types",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "prepare": "husky",
+    "lint:fix": "eslint --fix",
+    "lint": "eslint"
   },
   "keywords": [
     "auth",
@@ -20,17 +25,24 @@
   "author": "CareCard team",
   "license": "ISC",
   "devDependencies": {
+    "@istanbuljs/nyc-config-typescript": "1.0.2",
     "@types/express": "5.0.6",
     "@types/mocha": "10.0.10",
-    "@types/node": "25.5.0",
-    "husky": "^9.1.7",
-    "mocha": "11.7.5",
-    "nyc": "^18.0.0",
+    "@types/node": "25.9.1",
+    "eslint": "9.39.4",
+    "express": "5.2.1",
+    "husky": "9.1.7",
+    "lint-staged": "17.0.5",
+    "mocha": "11.7.6",
+    "nyc": "18.0.0",
+    "prettier": "3.8.3",
+    "source-map-support": "0.5.21",
+    "supertest": "7.2.2",
     "ts-node": "10.9.2",
-    "typescript": "5.9.3"
+    "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.1.11",
-    "@carecard/validate": "3.0.11"
+    "@carecard/common-util": "3.1.15",
+    "@carecard/validate": "3.1.27"
   }
 }