@carecard/auth-util 3.1.15 → 3.1.16

package/.agents/skills/carecard-workspace-standards/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: carecard-workspace-standards
-description: Follow the shared SO_CareCardCa/CareCard workspace coding, testing, repository, dependency, shared package, frontend, database, API response, and security standards. Use before modifying, testing, reviewing, or debugging any api-*, pkg-*, app-*, website, dashboard, or other CareCard repository in this workspace, especially when choosing validation commands, package boundaries, TypeScript types, dependencies, API contracts, database logic, service patterns, or frontend architecture.
+description: 'Follow the shared SO_CareCardCa/CareCard workspace coding, testing, repository, dependency, shared package, frontend, database, API response, and security standards. Use before modifying, testing, reviewing, or debugging any ms-*, pkg-*, app-*, website, dashboard, or other CareCard repository in this workspace, especially when choosing validation commands, package boundaries, TypeScript types, dependencies, API contracts, database logic, service patterns, or frontend architecture.'
 ---
 
 # CareCard Workspace Standards
@@ -23,7 +23,7 @@ Use before modifying, testing, reviewing, or debugging any CareCard workspace re
 
 - `.agents/config.toml`
 - `.agents/skills`
-- `api-*` services
+- `ms-*` services
 - `pkg-*` packages
 - `app-*` frontends
 - `.husky` and `.junie` validation guidance
@@ -43,8 +43,8 @@ Use before modifying, testing, reviewing, or debugging any CareCard workspace re
 
 ## Safety Constraints
 
-- Do not edit generated output, dependency folders, logs, coverage, dist, or build artifacts unless the task explicitly requires it.
-- Do not revert or overwrite user changes; stage only files related to the requested skill or instruction update.
+- Do not edit generated output, dependency folders, logs, coverage, dist, or build artifacts unless the task requires it.
+- Do not revert or overwrite user changes; stage only requested skill or instruction files.
 - Never suppress errors, lint failures, type failures, security failures, or failing tests; fix the underlying issue or report the blocker.
 - Do not log or expose secrets, JWTs, passwords, credentials, private keys, sensitive personal data, SQL internals, or stack traces.
 
@@ -52,7 +52,7 @@ Use before modifying, testing, reviewing, or debugging any CareCard workspace re
 
 Treat `/Users/pankajpriscilla/SO_CareCardCa` as a collection of independent Git
 repositories, not as one monorepo. Work from the specific child repository
-being changed. Each `api-*`, `pkg-*`, and `app-*` directory has its own package
+being changed. Each `ms-*`, `pkg-*`, and `app-*` directory has its own package
 scripts, Git status, test commands, style, naming, structure, test framework,
 and Husky hooks.
 
@@ -128,11 +128,11 @@ config.
 
 ## Remote Git Operations Guardrail
 
-Do not run remote Git or GitHub operations unless the current user request explicitly asks for that remote operation. This includes `git fetch`, `git pull`, `git push`, `git push --delete`, remote branch cleanup, GitHub API calls, and any `gh pr` command that creates, updates, readies, merges, closes, or cleans up a pull request. Do not infer permission from branch names, validation needs, prior workflow habits, or convenience; ask first when remote state would be useful but was not requested.
+Do not run remote Git or GitHub operations unless the current user request explicitly asks for them. This includes `git fetch`, `git pull`, `git push`, `git push --delete`, remote branch cleanup, GitHub API calls, and any `gh pr` command that creates, updates, readies, merges, closes, or cleans up a pull request. Do not infer permission from branch names, validation needs, prior workflow habits, or convenience; ask first when remote state would help but was not requested.
 
 ## Commit Continuation Rule
 
-Do not amend existing commits unless the user explicitly asks for an amend. If
+Do not amend commits unless the user explicitly asks. If
 hooks, formatters, tests, docs, skills, validation, or review follow-up create
 additional changes after a commit already exists, keep history additive by
 making a new commit in the affected repository.
@@ -183,11 +183,11 @@ build artifacts, logs, or `.DS_Store`.
   `notFound404`, `appErrorHandler`, error throw helpers, case converters, and
   `ApiErrorType`.
 - Do not create or maintain duplicated common response or error helpers inside
-  each `api-*` service.
+  each `ms-*` service.
 - Keep service-local response code limited to service-specific mapping or
   wiring.
 - Add broadly useful shared functionality to the relevant `pkg-*` package
-  instead of duplicating it locally in an `api-*` or `app-*` project.
+  instead of duplicating it locally in an `ms-*` or `app-*` project.
 - When changing a `pkg-*` package, write package tests first, increase that
   package's minor version in `package.json`, run `npm install` in the package,
   update consuming projects to the new package version, run `npm install` in
@@ -206,10 +206,10 @@ build artifacts, logs, or `.DS_Store`.
 
 ## Backend Microservices
 
-Most JavaScript `api-*` services use CommonJS, Mocha, Supertest, Docker Compose
+Most JavaScript `ms-*` services use CommonJS, Mocha, Supertest, Docker Compose
 database tests, `@carecard/*` packages, and `sub-apps`
-controller/router/model patterns. TypeScript services such as `api-contact-us`
-and `api-template-ts` use Jest or TypeScript tooling and should keep their
+controller/router/model patterns. TypeScript services such as `ms-contact-us`
+and `ms-template-ts` use Jest or TypeScript tooling and should keep their
 existing TypeScript style.
 
 - Keep environment-specific files explicit: `.env.development`, `.env.test`,
@@ -283,9 +283,9 @@ existing TypeScript style.
 - Keep tests readable and domain-specific.
 - Tests must cover desired or happy paths and prevention or rejection of
   undesired behavior.
-- JavaScript `api-*` services usually use Mocha, Supertest,
+- JavaScript `ms-*` services usually use Mocha, Supertest,
   `test/index.test.js`, and Docker-backed PostgreSQL scripts.
-- TypeScript `api-*` services usually use Jest and `tests/index.test.ts`.
+- TypeScript `ms-*` services usually use Jest and `tests/index.test.ts`.
 - `pkg-*` packages usually use Mocha plus TypeScript type tests where present.
 - `app-dashboard` uses Vitest, React Testing Library, mock API tests, and
   Selenium for end-to-end flows.
@@ -306,8 +306,8 @@ existing TypeScript style.
 ## Dashboard Frontend
 
 `app-dashboard` is a Next.js App Router TypeScript app using MUI, React Query,
-`next-intl`, and shared CareCard utilities. It consumes `api-auth`,
-`api-institutions`, `api-contact-us`, and `api-user-profiles` through service
+`next-intl`, and shared CareCard utilities. It consumes `ms-auth`,
+`ms-institutions`, `ms-contact-us`, and `ms-user-profiles` through service
 modules.
 
 - Keep backend URL definitions centralized in `src/services/api.routes.ts`.
@@ -366,12 +366,25 @@ the authenticated dashboard.
 - Keep CareCard package usage consistent with the service or app being changed.
 - When standardizing response or error behavior, prefer `@carecard/common-util`
   `3.1.15` because it contains response and error functions aligned with
-  `api-auth`.
+  `ms-auth`.
 - If package version changes are required, update lockfiles and verify affected
   services or apps.
 - Avoid broad dependency upgrades as part of feature or refactor work unless
   the task is specifically about dependencies.
 
+## Auth Service RLS Contract
+
+- `ms-auth` follows the shared PostgreSQL/RLS pattern from `ms-template-js`: auth tables live in the `carecard` schema, RLS is enabled and forced on every auth table, and application runtime queries use the unprivileged database role.
+- Auth table policies allow normal JWT users to access only self-owned rows. Do not add redundant `user_id = <jwt sub>` SQL predicates to duplicate self-row checks when RLS owns the authorization decision.
+- A JWT payload containing `roles: ["ad"]` is the auth-service super-admin signal and can perform any action on auth tables. Dashboard code may map that role to `super_admin`, but backend auth RLS must not require a separate database role row for that bypass.
+- Public auth flows such as registration, login, confirmation, recovery, visitor creation, and service user lookup must use narrow system contexts (`system_create`, `system_login`, `system_confirm`, `system_recovery`, `system_visitor`, `system_service`) instead of privileged runtime queries.
+
+- `ms-auth` controller exports use concise action names such as `loginUser`,
+  `registerUser`, `getUserDetail`, and `renewJwt`; route middleware and router
+  placement express whether a flow is public, authenticated, admin-only, or
+  service-only, so avoid `public`, `protected`, `admin`, or `Handler` suffixes
+  in new controller names.
+
 ## Security Requirements
 
 - Treat authentication, authorization, JWT, password, email confirmation,

package/.agents/skills/github-pr-create-update/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: github-pr-create-update
-description: Use only when the user explicitly asks for remote Git or GitHub PR work: pushing a branch, creating or updating a PR, or marking a PR ready from the current repository branch.
+description: 'Use only when the user explicitly asks for remote Git or GitHub PR work: pushing a branch, creating or updating a PR, or marking a PR ready from the current repository branch.'
 ---
 
 # Pull Request Create
 
 ## Purpose
 
-Only after the user explicitly asks for remote Git or GitHub PR work, create, update, verify, push, and mark ready a GitHub pull request from the current repository branch into origin/development.
+After the user explicitly asks for remote Git or GitHub PR work, create, update, verify, push, and mark ready a GitHub pull request from the current repository branch into origin/development.
 
 ## When To Use
 
@@ -20,7 +20,7 @@ Only after the user explicitly asks for remote Git or GitHub PR work, create, up
 
 ## Remote Git Operations Guardrail
 
-Do not run remote Git or GitHub operations unless the current user request explicitly asks for that remote operation. This includes `git fetch`, `git pull`, `git push`, `git push --delete`, remote branch cleanup, GitHub API calls, and any `gh pr` command that creates, updates, readies, merges, closes, or cleans up a pull request. Do not infer permission from branch names, validation needs, prior workflow habits, or convenience; ask first when remote state would be useful but was not requested.
+Do not run remote Git or GitHub operations unless the current user request explicitly asks for them. This includes `git fetch`, `git pull`, `git push`, `git push --delete`, remote branch cleanup, GitHub API calls, and any `gh pr` command that creates, updates, readies, merges, closes, or cleans up a pull request. Do not infer permission from branch names, validation needs, prior workflow habits, or convenience; ask first when remote state would help but was not requested.
 
 ## Relevant Files And Directories
 
@@ -41,13 +41,13 @@ Do not run remote Git or GitHub operations unless the current user request expli
 
 ## Safety Constraints
 
-- Do not edit generated output, dependency folders, logs, coverage, dist, or build artifacts unless the task explicitly requires it.
-- Do not revert or overwrite user changes; stage only files related to the requested skill or instruction update.
+- Do not edit generated output, dependency folders, logs, coverage, dist, or build artifacts unless the task requires it.
+- Do not revert or overwrite user changes; stage only requested skill or instruction files.
 - Never suppress errors, lint failures, type failures, security failures, or failing tests; fix the underlying issue or report the blocker.
 
 ## Commit Continuation Rule
 
-Do not amend existing commits unless the user explicitly asks for an amend. If
+Do not amend commits unless the user explicitly asks. If
 hook, formatter, documentation, skill, validation, or review follow-up changes
 appear after a commit, stage only the intended files and make a new commit with
 a clear message.

package/.agents/skills/github-pr-merge-cleanup/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: github-pr-merge-cleanup
-description: Use only when the user explicitly asks for remote Git or GitHub PR work: reviewing remote mergeability, validating, merging, closing, deleting, or cleaning up a pull request branch.
+description: 'Use only when the user explicitly asks for remote Git or GitHub PR work: reviewing remote mergeability, validating, merging, closing, deleting, or cleaning up a pull request branch.'
 ---
 
 # Pull Request Merge Close
 
 ## Purpose
 
-Only after the user explicitly asks for remote Git or GitHub PR work, review, validate, merge, close, delete branch, and clean local state for a GitHub pull request targeting origin/development.
+After the user explicitly asks for remote Git or GitHub PR work, review, validate, merge, close, delete branch, and clean local state for a GitHub pull request targeting origin/development.
 
 ## When To Use
 
@@ -20,7 +20,7 @@ Only after the user explicitly asks for remote Git or GitHub PR work, review, va
 
 ## Remote Git Operations Guardrail
 
-Do not run remote Git or GitHub operations unless the current user request explicitly asks for that remote operation. This includes `git fetch`, `git pull`, `git push`, `git push --delete`, remote branch cleanup, GitHub API calls, and any `gh pr` command that creates, updates, readies, merges, closes, or cleans up a pull request. Do not infer permission from branch names, validation needs, prior workflow habits, or convenience; ask first when remote state would be useful but was not requested.
+Do not run remote Git or GitHub operations unless the current user request explicitly asks for them. This includes `git fetch`, `git pull`, `git push`, `git push --delete`, remote branch cleanup, GitHub API calls, and any `gh pr` command that creates, updates, readies, merges, closes, or cleans up a pull request. Do not infer permission from branch names, validation needs, prior workflow habits, or convenience; ask first when remote state would help but was not requested.
 
 ## Relevant Files And Directories
 
@@ -41,13 +41,13 @@ Do not run remote Git or GitHub operations unless the current user request expli
 
 ## Safety Constraints
 
-- Do not edit generated output, dependency folders, logs, coverage, dist, or build artifacts unless the task explicitly requires it.
-- Do not revert or overwrite user changes; stage only files related to the requested skill or instruction update.
+- Do not edit generated output, dependency folders, logs, coverage, dist, or build artifacts unless the task requires it.
+- Do not revert or overwrite user changes; stage only requested skill or instruction files.
 - Never suppress errors, lint failures, type failures, security failures, or failing tests; fix the underlying issue or report the blocker.
 
 ## Commit Continuation Rule
 
-Do not amend existing commits unless the user explicitly asks for an amend. If
+Do not amend commits unless the user explicitly asks. If
 hook, formatter, documentation, skill, validation, or review follow-up changes
 appear after a commit, stage only the intended files and make a new commit with
 a clear message.

package/.agents/skills/pkg-auth-util-auth-crypto-library/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pkg-auth-util-auth-crypto-library
-description: Use when changing pkg-auth-util auth, password, JWT, crypto, key, exported API, types, or package validation behavior.
+description: 'Use when changing pkg-auth-util auth, password, JWT, crypto, key, exported API, types, or package validation behavior.'
 ---
 
 # Package Auth Util
@@ -43,8 +43,8 @@ CareCard auth utility package for JWT creation/verification primitives, password
 
 ## Safety Constraints
 
-- Do not edit generated output, dependency folders, logs, coverage, dist, or build artifacts unless the task explicitly requires it.
-- Do not revert or overwrite user changes; stage only files related to the requested skill or instruction update.
+- Do not edit generated output, dependency folders, logs, coverage, dist, or build artifacts unless the task requires it.
+- Do not revert or overwrite user changes; stage only requested skill or instruction files.
 - Never suppress errors, lint failures, type failures, security failures, or failing tests; fix the underlying issue or report the blocker.
 - Do not log or expose secrets, JWTs, passwords, credentials, private keys, sensitive personal data, SQL internals, or stack traces.
 
@@ -107,6 +107,9 @@ depend on those folders being present.
   `jwtCreateServiceAuthorizationHeader`.
 - Do not silently change token timing behavior, token formats, JWT string
   assembly, signature verification semantics, or decomposition return shapes.
+- Preserve application JWT payload claims, including the `roles` array.
+  `ms-auth` RLS treats `roles: ["ad"]` as the auth-service super-admin signal,
+  so JWT helpers must not hide, rename, or drop that role data.
 - Expected parse and verify failures should return `null` or `false` where the
   current public API does so.
 
@@ -146,7 +149,7 @@ depend on those folders being present.
 - Use `try/catch` inside utility functions where existing functions fail
   gracefully instead of throwing uncaught exceptions.
 - Do not broaden catch blocks in a way that hides unexpected implementation
-  errors in callers that currently expect throws.
+  errors in callers that expect throws.
 
 ## Types And Exports
 
@@ -199,7 +202,7 @@ and remaining risk.
 
 ## Remote Git Operations Guardrail
 
-Do not run remote Git or GitHub operations unless the current user request explicitly asks for that remote operation. This includes `git fetch`, `git pull`, `git push`, `git push --delete`, remote branch cleanup, GitHub API calls, and any `gh pr` command that creates, updates, readies, merges, closes, or cleans up a pull request. Do not infer permission from branch names, validation needs, prior workflow habits, or convenience; ask first when remote state would be useful but was not requested.
+Do not run remote Git or GitHub operations unless the current user request explicitly asks for them. This includes `git fetch`, `git pull`, `git push`, `git push --delete`, remote branch cleanup, GitHub API calls, and any `gh pr` command that creates, updates, readies, merges, closes, or cleans up a pull request. Do not infer permission from branch names, validation needs, prior workflow habits, or convenience; ask first when remote state would help but was not requested.
 
 ## Agent Guidance Git Workflow
 

package/.agents/skills/software-design-patterns-and-clean-code/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: software-design-patterns-and-clean-code
-description: Use every time before coding, refactoring, debugging, or reviewing in this repository, alongside all other applicable skills, to apply pragmatic software design patterns, SOLID, Clean Code, and testable architecture.
+description: 'Use every time before coding, refactoring, debugging, or reviewing in this repository, alongside all other applicable skills, to apply pragmatic software design patterns, SOLID, Clean Code, and testable architecture.'
 ---
 
 # Software Design Patterns And Clean Code

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/auth-util",
-  "version": "3.1.15",
+  "version": "3.1.16",
   "repository": "https://github.com/CareCard-ca/pkg-auth-util.git",
   "description": "Auth utility functions",
   "main": "index.js",
@@ -25,17 +25,17 @@
   "author": "CareCard team",
   "license": "ISC",
   "devDependencies": {
-    "express": "5.2.1",
     "@istanbuljs/nyc-config-typescript": "1.0.2",
+    "@types/express": "5.0.6",
     "@types/mocha": "10.0.10",
     "@types/node": "25.9.1",
-    "@types/express": "5.0.6",
+    "eslint": "9.39.4",
+    "express": "5.2.1",
     "husky": "9.1.7",
+    "lint-staged": "17.0.5",
     "mocha": "11.7.6",
     "nyc": "18.0.0",
     "prettier": "3.8.3",
-    "eslint": "9.39.4",
-    "lint-staged": "17.0.5",
     "source-map-support": "0.5.21",
     "supertest": "7.2.2",
     "ts-node": "10.9.2",
@@ -43,6 +43,6 @@
   },
   "dependencies": {
     "@carecard/common-util": "3.1.15",
-    "@carecard/validate": "3.1.24"
+    "@carecard/validate": "3.1.27"
   }
 }

package/readme.md

@@ -100,6 +100,19 @@ const urlSafe = stringUtilAuth.makeStringUrlSafe('a+b/c==');
 // Result: a-b_c
 ```
 
+## CareCard Auth Contract
+
+`ms-auth` issues CareCard user JWTs and now enforces its own auth tables with
+forced PostgreSQL RLS. This package should preserve JWT claim values exactly
+when creating or verifying tokens; a payload containing `roles: ["ad"]` is the
+auth-service super-admin signal. Do not add helpers that hide, rename, or drop
+the `roles` array, and do not add database bypass behavior to this package.
+
+Docs that mention `ms-auth` controller internals should use concise action
+names such as `loginUser`, `registerUser`, `getUserDetail`, and `renewJwt`.
+Access level is conveyed by route middleware and endpoint placement, not by
+`public`/`protected`/`admin`/`Handler` suffixes.
+
 ## Testing
 
 Run tests using:

package/.prettierignore

@@ -1,17 +0,0 @@
-dist/
-coverage/
-node_modules/
-build/
-*.min.js
-.github
-.husky
-dist
-.gitignore
-.npmignore
-.prettierignore
-.prettierrc.js
-eslint.config.mjs
-jest.config.js
-package.json
-readme.md
-rename-cjs.js

package/.prettierrc.cjs

@@ -1,32 +0,0 @@
-/** @type {import('prettier').Config} */
-module.exports = {
-  // Core formatting
-  printWidth: 100,
-  tabWidth: 2,
-  useTabs: false,
-  semi: true,
-  singleQuote: true,
-  trailingComma: 'all',
-  bracketSpacing: true,
-  bracketSameLine: true,
-  arrowParens: 'avoid',
-
-  // Line endings (important for cross-platform + CI)
-  endOfLine: 'auto',
-
-  // Language-specific overrides
-  overrides: [
-    {
-      files: '*.json',
-      options: {
-        printWidth: 80,
-      },
-    },
-    {
-      files: '*.md',
-      options: {
-        proseWrap: 'preserve',
-      },
-    },
-  ],
-};

package/jest.config.js

@@ -1,16 +0,0 @@
-export default {
-    preset: 'ts-jest',
-    testEnvironment: 'node',
-  transform: {
-    '^.+\\.ts$': [
-      'ts-jest',
-      {
-        tsconfig: 'tsconfig.base.json',
-      },
-    ],
-  },
-  testMatch: ['**/tests/**/*.test.ts'],
-    collectCoverage: true,
-    collectCoverageFrom: ['src/**/*.ts'],
-    coverageDirectory: 'coverage'
-};

package/scripts/rename-cjs.js

@@ -1,13 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-
-const dir = './dist/cjs';
-
-for (const file of fs.readdirSync(dir)) {
-    if (file.endsWith('.js')) {
-        fs.renameSync(
-            path.join(dir, file),
-            path.join(dir, file.replace('.js', '.cjs'))
-        );
-    }
-}

package/src/cryptoUtilAuth.ts

@@ -1,111 +0,0 @@
-import * as crypto from 'crypto';
-
-/**
- * Signs a token returns signature string
- * @param token
- * @param privateKey
- * @param signingAlgorithm
- * @returns {string}
- */
-export const createBase64SignatureOfToken = function (
-  token: string = '',
-  privateKey: string,
-  signingAlgorithm: string,
-): string {
-  const sign = crypto.createSign(signingAlgorithm);
-  sign.write(token);
-  sign.end();
-  return sign.sign(privateKey, 'base64');
-};
-
-/**
- * Verifies the signature returns true or false
- * @param token
- * @param signature
- * @param publicKey
- * @param signingAlgorithm
- * @returns {boolean}
- */
-export const verifyBase64SignatureOfToken = function (
-  token: string = '',
-  signature: string,
-  publicKey: string,
-  signingAlgorithm: string,
-): boolean {
-  const verify = crypto.createVerify(signingAlgorithm);
-  verify.update(token);
-  verify.end();
-  return verify.verify(publicKey, signature, 'base64');
-};
-
-/**
- * Creates the hash of given string
- * @param string
- * @param secret
- * @param algorithm
- * @returns {string}
- */
-export const createHmacBase64 = function (
-  string: string = '',
-  secret: string,
-  algorithm: string,
-): string {
-  const hmac = crypto.createHmac(algorithm, secret);
-  hmac.update(string);
-  return hmac.digest('base64');
-};
-
-/**
- * Create random salt
- * @returns {string}
- */
-export const createSaltBase64 = (): string => {
-  const date = new Date().valueOf();
-  const hmac = crypto.createHmac('SHA256', date.toString());
-  hmac.update(date.toString());
-  return hmac.digest('base64');
-};
-
-/**
- * Encrypt given string
- * @param string
- * @param salt
- * @param secret
- * @param algorithm
- * @returns {string}
- */
-export const encryptStringAsciiToBase64 = (
-  string: string,
-  salt: string,
-  secret: string,
-  algorithm: string,
-): string => {
-  const key = crypto.scryptSync(secret, salt, 24);
-  const iv = Buffer.alloc(16, 0);
-  const cipher = crypto.createCipheriv(algorithm, key, iv);
-  let encrypted = cipher.update(string, 'ascii', 'base64');
-  encrypted += cipher.final('base64');
-  return encrypted;
-};
-
-/**
- * Decrypts given string
- * @param encryptedString
- * @param salt
- * @param secret
- * @param algorithm
- * @returns {string}
- */
-export const decryptStringBase64ToAscii = (
-  encryptedString: string,
-  salt: string,
-  secret: string,
-  algorithm: string,
-): string => {
-  const key = crypto.scryptSync(secret, salt, 24);
-  const iv = Buffer.alloc(16, 0);
-  const decipher = crypto.createDecipheriv(algorithm, key, iv);
-  let decrypted = decipher.update(encryptedString, 'base64', 'ascii');
-  decrypted += decipher.final('ascii');
-  return decrypted;
-};

package/src/index.ts

@@ -1,6 +0,0 @@
-export * from './cryptoUtilAuth';
-export * from './jwtUtilAuth';
-export * from './keyGen';
-export * from './pwdUtilAuth';
-export * from './strEncryptUtil';
-export * from './stringUtilAuth';

package/src/jwtUtilAuth.ts

@@ -1,85 +0,0 @@
-import * as stringUtilAuth from './stringUtilAuth';
-import * as cryptoUtilAuth from './cryptoUtilAuth';
-
-/**
- * User supplied header, payload and signature create jwt.
- * @returns {string|null}
- * @param headerBase64
- * @param payloadBase64
- * @param signatureBase64
- */
-export const _assembleJwt = (
-  headerBase64: string,
-  payloadBase64: string,
-  signatureBase64: string,
-): string => {
-  return headerBase64 + '.' + payloadBase64 + '.' + signatureBase64;
-};
-
-/**
- * User supplied header, payload and signature create jwt.
- * @returns {{payload: *, signature: *, header: *}}
- * @param jwt
- */
-export const _splitJwtInToHeaderPayloadSignature = (jwt: string): any => {
-  return stringUtilAuth.dotConnectedStringToHeaderPayloadSignature(jwt);
-};
-
-/**
- * Creates Url safe jwt
- * @param headerObject
- * @param payloadObject
- * @param privateKey
- * @return {string|null}
- */
-export const createSignedJwtFromObject = (
-  headerObject: any,
-  payloadObject: any,
-  privateKey: string,
-): any => {
-  try {
-    const algorithm = headerObject.alg;
-    const headerBase64UrlSafe = stringUtilAuth.objectToBase64UrlSafeString(headerObject);
-    const payloadBase64UrlSafe = stringUtilAuth.objectToBase64UrlSafeString(payloadObject);
-    const token = headerBase64UrlSafe + '.' + payloadBase64UrlSafe;
-    const signature = cryptoUtilAuth.createBase64SignatureOfToken(token, privateKey, algorithm);
-    const urlSafeSignature = stringUtilAuth.makeStringUrlSafe(signature);
-    return _assembleJwt(headerBase64UrlSafe, payloadBase64UrlSafe, urlSafeSignature);
-  } catch (error) {
-    return null;
-  }
-};
-
-/**
- * Verify signature of jwt
- * @param jwt
- * @param publicKey
- * @return {boolean}
- */
-export const verifyJwtSignature = (jwt: string, publicKey: string): boolean => {
-  try {
-    const { header, payload, signature } = _splitJwtInToHeaderPayloadSignature(jwt);
-    const token = header + '.' + payload;
-    const headerObject = stringUtilAuth.urlSafeBase64ToObject(header);
-    return cryptoUtilAuth.verifyBase64SignatureOfToken(
-      token,
-      signature,
-      publicKey,
-      headerObject.alg,
-    );
-  } catch (error) {
-    return false;
-  }
-};
-
-/**
- * Returns header and payload object for jwt.
- * @param jwt
- * @return {{payload: any, header: any}}
- */
-export const getHeaderPayloadFromJwt = (jwt: string): any => {
-  const { header, payload } = _splitJwtInToHeaderPayloadSignature(jwt);
-  let headerAscii = stringUtilAuth.base64ToAscii(header);
-  let payloadAscii = stringUtilAuth.base64ToAscii(payload);
-  return { header: JSON.parse(headerAscii), payload: JSON.parse(payloadAscii) };
-};

package/src/keyGen.ts

@@ -1,14 +0,0 @@
-import { generateKeyPairSync } from 'node:crypto';
-
-export const generateKeyPair = (modulusLength: number = 4096) =>
-  generateKeyPairSync('rsa', {
-    modulusLength: modulusLength,
-    publicKeyEncoding: {
-      type: 'spki',
-      format: 'pem',
-    },
-    privateKeyEncoding: {
-      type: 'pkcs8',
-      format: 'pem',
-    },
-  });