@carecard/jwt-read 3.0.4 → 3.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/index.d.ts +47 -6
- package/lib/jwtLib.js +200 -182
- package/package.json +4 -4
package/index.d.ts
CHANGED
|
@@ -4,35 +4,76 @@
|
|
|
4
4
|
|
|
5
5
|
import { Request, Response, NextFunction } from 'express';
|
|
6
6
|
|
|
7
|
+
/**
|
|
8
|
+
* Basic structure of a JWT payload as used in this package.
|
|
9
|
+
*/
|
|
10
|
+
export interface JwtPayload {
|
|
11
|
+
client_id?: string;
|
|
12
|
+
exp?: number;
|
|
13
|
+
iat?: number;
|
|
14
|
+
roles?: string[];
|
|
15
|
+
[key: string]: any;
|
|
16
|
+
}
|
|
17
|
+
|
|
18
|
+
/**
|
|
19
|
+
* Structure of the JWT object attached to the request.
|
|
20
|
+
*/
|
|
21
|
+
export interface JwtRequestObject {
|
|
22
|
+
header: any;
|
|
23
|
+
payload: JwtPayload;
|
|
24
|
+
age?: number;
|
|
25
|
+
jwtClientId: (req?: any) => string | undefined;
|
|
26
|
+
doesJwtUserHasRole: (role: string) => boolean;
|
|
27
|
+
isJwtExpired: (jwtValiditySeconds?: number) => boolean;
|
|
28
|
+
jwtAgeInSeconds: (req?: any) => number;
|
|
29
|
+
}
|
|
30
|
+
|
|
31
|
+
/**
|
|
32
|
+
* Structure of the visitor object attached to the request.
|
|
33
|
+
*/
|
|
34
|
+
export interface VisitorRequestObject {
|
|
35
|
+
header: any;
|
|
36
|
+
payload: JwtPayload;
|
|
37
|
+
visitorClientId: (req?: any) => string | undefined;
|
|
38
|
+
}
|
|
39
|
+
|
|
40
|
+
/**
|
|
41
|
+
* Extended Express Request to include jwt and visitor objects.
|
|
42
|
+
*/
|
|
43
|
+
export interface AuthenticatedRequest extends Request {
|
|
44
|
+
jwt?: JwtRequestObject | null;
|
|
45
|
+
visitor?: VisitorRequestObject | null;
|
|
46
|
+
}
|
|
47
|
+
|
|
7
48
|
/**
|
|
8
49
|
* Returns a middleware that verifies a JWT from the 'Authorization: Bearer <token>' header
|
|
9
50
|
* and extracts it into req.jwt. Throws an error if invalid.
|
|
10
51
|
*/
|
|
11
|
-
export function verifyJwt(publicKey: string, customErrorFunction?: () => void): (req:
|
|
52
|
+
export function verifyJwt(publicKey: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
|
|
12
53
|
|
|
13
54
|
/**
|
|
14
55
|
* Returns a middleware that verifies a JWT from a custom header and extracts it into req.jwt.
|
|
15
56
|
* Throws an error if invalid.
|
|
16
57
|
*/
|
|
17
|
-
export function verifyWebToken(publicKey: string, headerName: string, customErrorFunction?: () => void): (req:
|
|
58
|
+
export function verifyWebToken(publicKey: string, headerName: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
|
|
18
59
|
|
|
19
60
|
/**
|
|
20
61
|
* Returns a middleware that verifies a JWT from the 'Authorization: Bearer <token>' header
|
|
21
62
|
* and extracts it into req.jwt. Returns false instead of throwing if invalid.
|
|
22
63
|
*/
|
|
23
|
-
export function verifyJwtNoThrow(publicKey: string): (req:
|
|
64
|
+
export function verifyJwtNoThrow(publicKey: string): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
|
|
24
65
|
|
|
25
66
|
/**
|
|
26
67
|
* Returns a middleware that verifies a JWT from a custom header and extracts it into req.jwt.
|
|
27
68
|
* Returns false instead of throwing if invalid.
|
|
28
69
|
*/
|
|
29
|
-
export function verifyWebTokenNoThrow(publicKey: string, headerName: string): (req:
|
|
70
|
+
export function verifyWebTokenNoThrow(publicKey: string, headerName: string): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
|
|
30
71
|
|
|
31
72
|
/**
|
|
32
73
|
* Returns a middleware that verifies a visitor token from the 'Visitor' header
|
|
33
74
|
* and extracts it into req.visitor. Returns false instead of throwing if invalid.
|
|
34
75
|
*/
|
|
35
|
-
export function verifyVisitorNoThrow(publicKey: string): (req:
|
|
76
|
+
export function verifyVisitorNoThrow(publicKey: string): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
|
|
36
77
|
|
|
37
78
|
/**
|
|
38
79
|
* Returns the client_id from the extracted JWT in req.jwt.
|
|
@@ -57,7 +98,7 @@ export function jwtAgeInSeconds(req?: any): number;
|
|
|
57
98
|
/**
|
|
58
99
|
* Returns a middleware that verifies the JWT and checks if the user has the required role.
|
|
59
100
|
*/
|
|
60
|
-
export function verifyJwtAndRole(userRole: string, publicKey: string, customErrorFunction?: () => void): (req:
|
|
101
|
+
export function verifyJwtAndRole(userRole: string, publicKey: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
|
|
61
102
|
|
|
62
103
|
/**
|
|
63
104
|
* Throws a Used_Token error.
|
package/lib/jwtLib.js
CHANGED
|
@@ -1,457 +1,475 @@
|
|
|
1
|
-
const
|
|
2
|
-
const {
|
|
1
|
+
const {isJwtString} = require('@carecard/validate').validate;
|
|
2
|
+
const {jwtUtilAuth} = require('@carecard/auth-util');
|
|
3
3
|
const {
|
|
4
4
|
throwLoginRequiredError,
|
|
5
5
|
throwNotAuthorizedError
|
|
6
|
-
} = require(
|
|
6
|
+
} = require("@carecard/common-util").error;
|
|
7
7
|
|
|
8
|
-
function jwtClientId(
|
|
8
|
+
function jwtClientId(req) {
|
|
9
9
|
const jwtObj = req?.jwt || this;
|
|
10
10
|
return jwtObj?.payload?.client_id;
|
|
11
11
|
}
|
|
12
12
|
|
|
13
|
-
function visitorClientId(
|
|
13
|
+
function visitorClientId(req) {
|
|
14
14
|
const visitorObj = req?.visitor || this;
|
|
15
15
|
return visitorObj?.payload?.client_id;
|
|
16
16
|
}
|
|
17
17
|
|
|
18
|
-
function doesJwtUserHasRole(
|
|
18
|
+
function doesJwtUserHasRole(req, userRole) {
|
|
19
19
|
// Check if called as req.jwt.doesJwtUserHasRole(userRole) or doesJwtUserHasRole(role)
|
|
20
|
-
if (
|
|
20
|
+
if (arguments.length === 1 && typeof req === 'string') {
|
|
21
21
|
userRole = req;
|
|
22
22
|
req = undefined;
|
|
23
23
|
}
|
|
24
24
|
|
|
25
25
|
const jwtObj = req?.jwt || this;
|
|
26
26
|
|
|
27
|
-
if (
|
|
28
|
-
return jwtObj?.payload?.roles?.includes(
|
|
27
|
+
if (userRole && typeof userRole === "string") {
|
|
28
|
+
return jwtObj?.payload?.roles?.includes(userRole);
|
|
29
29
|
} else {
|
|
30
30
|
throwNotAuthorizedError();
|
|
31
31
|
}
|
|
32
32
|
}
|
|
33
33
|
|
|
34
|
-
function throwError(
|
|
35
|
-
(
|
|
34
|
+
function throwError(customErrorFunction) {
|
|
35
|
+
(typeof customErrorFunction === "function") ?
|
|
36
36
|
customErrorFunction() :
|
|
37
37
|
throwLoginRequiredError()
|
|
38
38
|
}
|
|
39
39
|
|
|
40
|
-
function isJwtExpired(
|
|
40
|
+
function isJwtExpired(req, jwtValiditySeconds) {
|
|
41
41
|
// Check if called as req.jwt.isJwtExpired(seconds) or isJwtExpired(seconds)
|
|
42
|
-
if (
|
|
42
|
+
if (arguments.length === 1 && typeof req === 'number') {
|
|
43
43
|
jwtValiditySeconds = req;
|
|
44
44
|
req = undefined;
|
|
45
45
|
}
|
|
46
46
|
|
|
47
47
|
const jwtObj = req?.jwt || this;
|
|
48
48
|
|
|
49
|
-
if (
|
|
50
|
-
return (
|
|
49
|
+
if (jwtObj?.payload?.exp) {
|
|
50
|
+
return (Math.floor(Date.now() / 1000)) >= jwtObj.payload.exp;
|
|
51
51
|
}
|
|
52
52
|
|
|
53
|
-
if (
|
|
54
|
-
return (
|
|
53
|
+
if (jwtValiditySeconds && typeof jwtValiditySeconds === "number") {
|
|
54
|
+
return (parseInt(jwtValiditySeconds)) < jwtAgeInSeconds.call(this, req);
|
|
55
55
|
} else {
|
|
56
56
|
return true;
|
|
57
57
|
}
|
|
58
58
|
|
|
59
59
|
}
|
|
60
60
|
|
|
61
|
-
function jwtAgeInSeconds(
|
|
61
|
+
function jwtAgeInSeconds(req) {
|
|
62
62
|
const jwtObj = req?.jwt || this;
|
|
63
63
|
|
|
64
|
-
if (
|
|
64
|
+
if (jwtObj?.payload?.iat) {
|
|
65
65
|
|
|
66
66
|
let iat = jwtObj.payload.iat;
|
|
67
|
-
if (
|
|
68
|
-
iat = Math.floor(
|
|
67
|
+
if (iat > 1000000000000) {
|
|
68
|
+
iat = Math.floor(iat / 1000);
|
|
69
69
|
}
|
|
70
70
|
|
|
71
|
-
jwtObj[
|
|
71
|
+
jwtObj["age"] = Math.floor(Date.now() / 1000) - iat;
|
|
72
72
|
return jwtObj.age;
|
|
73
73
|
|
|
74
74
|
} else {
|
|
75
75
|
|
|
76
|
-
jwtObj[
|
|
76
|
+
jwtObj["age"] = Infinity
|
|
77
77
|
return jwtObj.age;
|
|
78
78
|
|
|
79
79
|
}
|
|
80
80
|
}
|
|
81
81
|
|
|
82
|
-
function validateAndExtractJwtObject(
|
|
82
|
+
function validateAndExtractJwtObject(req, publicKey, customErrorFunction) {
|
|
83
83
|
|
|
84
|
-
const jwtString = _validateJwt(
|
|
84
|
+
const jwtString = _validateJwt(req, customErrorFunction);
|
|
85
85
|
|
|
86
|
-
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(
|
|
86
|
+
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(jwtString, publicKey);
|
|
87
87
|
|
|
88
|
-
if (
|
|
89
|
-
_extractJwtObject(
|
|
88
|
+
if (jwtString && isJwtSignatureValid) {
|
|
89
|
+
_extractJwtObject(req, jwtString, customErrorFunction);
|
|
90
90
|
} else {
|
|
91
|
-
req[
|
|
92
|
-
throwError(
|
|
91
|
+
req["jwt"] = null;
|
|
92
|
+
throwError(customErrorFunction);
|
|
93
93
|
}
|
|
94
94
|
|
|
95
|
-
return
|
|
95
|
+
return req;
|
|
96
96
|
}
|
|
97
97
|
|
|
98
|
-
function validateAndExtractWebToken(
|
|
98
|
+
function validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction) {
|
|
99
99
|
|
|
100
|
-
const webTokenString = _validateWebToken(
|
|
100
|
+
const webTokenString = _validateWebToken(req, headerName, customErrorFunction);
|
|
101
101
|
|
|
102
|
-
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(
|
|
102
|
+
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(webTokenString, publicKey);
|
|
103
103
|
|
|
104
|
-
if (
|
|
105
|
-
_extractJwtObject(
|
|
104
|
+
if (webTokenString && isJwtSignatureValid) {
|
|
105
|
+
_extractJwtObject(req, webTokenString, customErrorFunction);
|
|
106
106
|
} else {
|
|
107
|
-
req[
|
|
108
|
-
throwError(
|
|
107
|
+
req["jwt"] = null;
|
|
108
|
+
throwError(customErrorFunction);
|
|
109
109
|
}
|
|
110
110
|
|
|
111
|
-
return
|
|
111
|
+
return req;
|
|
112
112
|
}
|
|
113
113
|
|
|
114
|
-
function validateAndExtractJwtObjectNoThrow(
|
|
114
|
+
function validateAndExtractJwtObjectNoThrow(req, publicKey) {
|
|
115
115
|
|
|
116
116
|
try {
|
|
117
117
|
|
|
118
|
-
const jwtString = _validateJwtNoThrow(
|
|
118
|
+
const jwtString = _validateJwtNoThrow(req);
|
|
119
119
|
|
|
120
|
-
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(
|
|
120
|
+
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(jwtString, publicKey);
|
|
121
121
|
|
|
122
|
-
if (
|
|
123
|
-
_extractJwtObjectNoThrow(
|
|
122
|
+
if (jwtString && isJwtSignatureValid) {
|
|
123
|
+
_extractJwtObjectNoThrow(req, jwtString);
|
|
124
124
|
} else {
|
|
125
|
-
req[
|
|
125
|
+
req["jwt"] = null;
|
|
126
126
|
}
|
|
127
127
|
|
|
128
|
-
} catch (
|
|
128
|
+
} catch (err) {
|
|
129
129
|
|
|
130
|
-
req[
|
|
130
|
+
req["jwt"] = null;
|
|
131
131
|
|
|
132
132
|
}
|
|
133
133
|
|
|
134
|
-
return
|
|
134
|
+
return req;
|
|
135
135
|
}
|
|
136
136
|
|
|
137
|
-
function validateAndExtractWebTokenObjectNoThrow(
|
|
137
|
+
function validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName) {
|
|
138
138
|
|
|
139
139
|
try {
|
|
140
140
|
|
|
141
|
-
const jwtString = _validateWebTokenNoThrow(
|
|
141
|
+
const jwtString = _validateWebTokenNoThrow(req, headerName);
|
|
142
142
|
|
|
143
|
-
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(
|
|
143
|
+
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(jwtString, publicKey);
|
|
144
144
|
|
|
145
|
-
if (
|
|
146
|
-
_extractJwtObjectNoThrow(
|
|
145
|
+
if (jwtString && isJwtSignatureValid) {
|
|
146
|
+
_extractJwtObjectNoThrow(req, jwtString);
|
|
147
147
|
} else {
|
|
148
|
-
req[
|
|
148
|
+
req["jwt"] = null;
|
|
149
149
|
}
|
|
150
150
|
|
|
151
|
-
} catch (
|
|
151
|
+
} catch (err) {
|
|
152
152
|
|
|
153
|
-
req[
|
|
153
|
+
req["jwt"] = null;
|
|
154
154
|
|
|
155
155
|
}
|
|
156
156
|
|
|
157
|
-
return
|
|
157
|
+
return req;
|
|
158
158
|
}
|
|
159
159
|
|
|
160
|
-
function validateAndExtractVisitorObjectNoThrow(
|
|
160
|
+
function validateAndExtractVisitorObjectNoThrow(req, publicKey) {
|
|
161
161
|
|
|
162
162
|
try {
|
|
163
163
|
|
|
164
|
-
const jwtString = _validateVisitorNoThrow(
|
|
164
|
+
const jwtString = _validateVisitorNoThrow(req);
|
|
165
165
|
|
|
166
|
-
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(
|
|
166
|
+
const isJwtSignatureValid = jwtUtilAuth.verifyJwtSignature(jwtString, publicKey);
|
|
167
167
|
|
|
168
|
-
if (
|
|
169
|
-
_extractVisitorObjectNoThrow(
|
|
168
|
+
if (jwtString && isJwtSignatureValid) {
|
|
169
|
+
_extractVisitorObjectNoThrow(req, jwtString);
|
|
170
170
|
} else {
|
|
171
|
-
req[
|
|
171
|
+
req["visitor"] = null;
|
|
172
172
|
}
|
|
173
173
|
|
|
174
|
-
} catch (
|
|
174
|
+
} catch (err) {
|
|
175
175
|
|
|
176
|
-
req[
|
|
176
|
+
req["visitor"] = null;
|
|
177
177
|
|
|
178
178
|
}
|
|
179
179
|
|
|
180
|
-
return
|
|
180
|
+
return req;
|
|
181
181
|
}
|
|
182
182
|
|
|
183
|
-
function verifyJwtAndRole(
|
|
184
|
-
return function (
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
183
|
+
function verifyJwtAndRole(role, publicKey, customErrorFunction) {
|
|
184
|
+
return function (req, res, next) {
|
|
185
|
+
try {
|
|
186
|
+
validateAndExtractJwtObject(req, publicKey, customErrorFunction);
|
|
187
|
+
const isRoleExist = doesJwtUserHasRole(req, role);
|
|
188
|
+
_isLoginRequired(isRoleExist, customErrorFunction);
|
|
189
|
+
next();
|
|
190
|
+
} catch (err) {
|
|
191
|
+
next(err);
|
|
192
|
+
}
|
|
190
193
|
}
|
|
191
194
|
}
|
|
192
195
|
|
|
193
|
-
function verifyJwt(
|
|
194
|
-
return function (
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
196
|
+
function verifyJwt(publicKey, customErrorFunction) {
|
|
197
|
+
return function (req, res, next) {
|
|
198
|
+
try {
|
|
199
|
+
validateAndExtractJwtObject(req, publicKey, customErrorFunction);
|
|
200
|
+
next();
|
|
201
|
+
} catch (err) {
|
|
202
|
+
next(err);
|
|
203
|
+
}
|
|
198
204
|
}
|
|
199
205
|
}
|
|
200
206
|
|
|
201
|
-
function verifyWebToken(
|
|
202
|
-
return function (
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
207
|
+
function verifyWebToken(publicKey, headerName, customErrorFunction) {
|
|
208
|
+
return function (req, res, next) {
|
|
209
|
+
try {
|
|
210
|
+
validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction);
|
|
211
|
+
next();
|
|
212
|
+
} catch (err) {
|
|
213
|
+
next(err);
|
|
214
|
+
}
|
|
206
215
|
}
|
|
207
216
|
}
|
|
208
217
|
|
|
209
|
-
function verifyJwtNoThrow(
|
|
210
|
-
return function (
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
218
|
+
function verifyJwtNoThrow(publicKey) {
|
|
219
|
+
return function (req, res, next) {
|
|
220
|
+
try {
|
|
221
|
+
validateAndExtractJwtObjectNoThrow(req, publicKey);
|
|
222
|
+
next();
|
|
223
|
+
} catch (err) {
|
|
224
|
+
next(err);
|
|
225
|
+
}
|
|
214
226
|
}
|
|
215
227
|
}
|
|
216
228
|
|
|
217
|
-
function verifyWebTokenNoThrow(
|
|
218
|
-
return function (
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
229
|
+
function verifyWebTokenNoThrow(publicKey, headerName) {
|
|
230
|
+
return function (req, res, next) {
|
|
231
|
+
try {
|
|
232
|
+
validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName);
|
|
233
|
+
next();
|
|
234
|
+
} catch (err) {
|
|
235
|
+
next(err);
|
|
236
|
+
}
|
|
222
237
|
}
|
|
223
238
|
}
|
|
224
239
|
|
|
225
|
-
function verifyVisitorNoThrow(
|
|
226
|
-
return function (
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
240
|
+
function verifyVisitorNoThrow(publicKey) {
|
|
241
|
+
return function (req, res, next) {
|
|
242
|
+
try {
|
|
243
|
+
validateAndExtractVisitorObjectNoThrow(req, publicKey);
|
|
244
|
+
next();
|
|
245
|
+
} catch (err) {
|
|
246
|
+
next(err);
|
|
247
|
+
}
|
|
230
248
|
}
|
|
231
249
|
}
|
|
232
250
|
|
|
233
251
|
function throwUsedTokenError() {
|
|
234
|
-
throw new Error(
|
|
252
|
+
throw new Error("Used_Token");
|
|
235
253
|
}
|
|
236
254
|
|
|
237
255
|
/*********************
|
|
238
256
|
* Private functions *
|
|
239
257
|
*********************/
|
|
240
|
-
function _isLoginRequired(
|
|
258
|
+
function _isLoginRequired(hasRequiredRole, customErrorFunction) {
|
|
241
259
|
|
|
242
|
-
if (
|
|
243
|
-
throwError(
|
|
260
|
+
if (!hasRequiredRole) {
|
|
261
|
+
throwError(customErrorFunction);
|
|
244
262
|
}
|
|
245
263
|
|
|
246
264
|
}
|
|
247
265
|
|
|
248
|
-
function _extractJwtObject(
|
|
249
|
-
if (
|
|
250
|
-
const jwtObj = jwtUtilAuth.getHeaderPayloadFromJwt(
|
|
251
|
-
_attachJwtMethods(
|
|
252
|
-
req[
|
|
266
|
+
function _extractJwtObject(req, jwt, customErrorFunction) {
|
|
267
|
+
if (jwt && typeof jwt === "string") {
|
|
268
|
+
const jwtObj = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
|
|
269
|
+
_attachJwtMethods(jwtObj);
|
|
270
|
+
req["jwt"] = jwtObj;
|
|
253
271
|
} else {
|
|
254
|
-
throwError(
|
|
272
|
+
throwError(customErrorFunction);
|
|
255
273
|
}
|
|
256
274
|
}
|
|
257
275
|
|
|
258
|
-
function _extractJwtObjectNoThrow(
|
|
259
|
-
if (
|
|
260
|
-
const jwtObj = jwtUtilAuth.getHeaderPayloadFromJwt(
|
|
261
|
-
_attachJwtMethods(
|
|
262
|
-
req[
|
|
276
|
+
function _extractJwtObjectNoThrow(req, jwt) {
|
|
277
|
+
if (jwt && typeof jwt === "string") {
|
|
278
|
+
const jwtObj = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
|
|
279
|
+
_attachJwtMethods(jwtObj);
|
|
280
|
+
req["jwt"] = jwtObj;
|
|
263
281
|
} else {
|
|
264
|
-
req[
|
|
282
|
+
req["jwt"] = null;
|
|
265
283
|
}
|
|
266
284
|
}
|
|
267
285
|
|
|
268
|
-
function _extractVisitorObjectNoThrow(
|
|
269
|
-
if (
|
|
270
|
-
const visitorObj = jwtUtilAuth.getHeaderPayloadFromJwt(
|
|
271
|
-
_attachVisitorMethods(
|
|
272
|
-
req[
|
|
286
|
+
function _extractVisitorObjectNoThrow(req, jwt) {
|
|
287
|
+
if (jwt && typeof jwt === "string") {
|
|
288
|
+
const visitorObj = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
|
|
289
|
+
_attachVisitorMethods(visitorObj);
|
|
290
|
+
req["visitor"] = visitorObj;
|
|
273
291
|
} else {
|
|
274
|
-
req[
|
|
292
|
+
req["visitor"] = null;
|
|
275
293
|
}
|
|
276
294
|
}
|
|
277
295
|
|
|
278
|
-
function _attachJwtMethods(
|
|
279
|
-
if (
|
|
280
|
-
Object.defineProperties(
|
|
281
|
-
jwtClientId: {
|
|
282
|
-
doesJwtUserHasRole: {
|
|
283
|
-
isJwtExpired: {
|
|
284
|
-
jwtAgeInSeconds: {
|
|
285
|
-
}
|
|
296
|
+
function _attachJwtMethods(jwtObj) {
|
|
297
|
+
if (jwtObj) {
|
|
298
|
+
Object.defineProperties(jwtObj, {
|
|
299
|
+
jwtClientId: {value: jwtClientId, enumerable: false},
|
|
300
|
+
doesJwtUserHasRole: {value: doesJwtUserHasRole, enumerable: false},
|
|
301
|
+
isJwtExpired: {value: isJwtExpired, enumerable: false},
|
|
302
|
+
jwtAgeInSeconds: {value: jwtAgeInSeconds, enumerable: false}
|
|
303
|
+
});
|
|
286
304
|
}
|
|
287
305
|
}
|
|
288
306
|
|
|
289
|
-
function _attachVisitorMethods(
|
|
290
|
-
if (
|
|
291
|
-
Object.defineProperties(
|
|
292
|
-
visitorClientId: {
|
|
293
|
-
}
|
|
307
|
+
function _attachVisitorMethods(visitorObj) {
|
|
308
|
+
if (visitorObj) {
|
|
309
|
+
Object.defineProperties(visitorObj, {
|
|
310
|
+
visitorClientId: {value: visitorClientId, enumerable: false}
|
|
311
|
+
});
|
|
294
312
|
}
|
|
295
313
|
}
|
|
296
314
|
|
|
297
|
-
function _isJwtSignatureValid(
|
|
315
|
+
async function _isJwtSignatureValid(jwt, publicKey, customErrorFunction) {
|
|
298
316
|
|
|
299
|
-
if (
|
|
300
|
-
return jwtUtilAuth.verifyJwtSignature(
|
|
317
|
+
if (jwt && typeof jwt === "string") {
|
|
318
|
+
return jwtUtilAuth.verifyJwtSignature(jwt, publicKey)
|
|
301
319
|
} else {
|
|
302
|
-
throwError(
|
|
320
|
+
throwError(customErrorFunction);
|
|
303
321
|
}
|
|
304
322
|
}
|
|
305
323
|
|
|
306
|
-
function _isJwtSignatureValidNoThrow(
|
|
324
|
+
async function _isJwtSignatureValidNoThrow(jwt, publicKey) {
|
|
307
325
|
|
|
308
|
-
if (
|
|
309
|
-
return jwtUtilAuth.verifyJwtSignature(
|
|
326
|
+
if (jwt && typeof jwt === "string") {
|
|
327
|
+
return jwtUtilAuth.verifyJwtSignature(jwt, publicKey)
|
|
310
328
|
} else {
|
|
311
329
|
return false;
|
|
312
330
|
}
|
|
313
331
|
}
|
|
314
332
|
|
|
315
|
-
function _validateJwt(
|
|
333
|
+
function _validateJwt(req, customErrorFunction) {
|
|
316
334
|
|
|
317
335
|
// Get from http header.
|
|
318
|
-
let jwtRaw = req.get(
|
|
336
|
+
let jwtRaw = req.get("Authorization");
|
|
319
337
|
|
|
320
338
|
// Extract jwt from bearer schema.
|
|
321
|
-
let jwt = _extractJwt(
|
|
339
|
+
let jwt = _extractJwt(jwtRaw, customErrorFunction);
|
|
322
340
|
|
|
323
341
|
// Validate characters string of jwt.
|
|
324
|
-
if (
|
|
342
|
+
if (isJwtString(jwt)) {
|
|
325
343
|
return jwt;
|
|
326
344
|
} else {
|
|
327
|
-
throwError(
|
|
345
|
+
throwError(customErrorFunction);
|
|
328
346
|
}
|
|
329
347
|
}
|
|
330
348
|
|
|
331
|
-
function _validateWebToken(
|
|
349
|
+
function _validateWebToken(req, headerName, customErrorFunction) {
|
|
332
350
|
|
|
333
351
|
// Get from http header.
|
|
334
|
-
let jwtRaw = req.get(
|
|
352
|
+
let jwtRaw = req.get(headerName);
|
|
335
353
|
|
|
336
354
|
// Extract jwt from bearer schema.
|
|
337
|
-
let webToken = _extractWebToken(
|
|
355
|
+
let webToken = _extractWebToken(jwtRaw, customErrorFunction);
|
|
338
356
|
|
|
339
357
|
// Validate characters string of jwt.
|
|
340
|
-
if (
|
|
358
|
+
if (isJwtString(webToken)) {
|
|
341
359
|
return webToken;
|
|
342
360
|
} else {
|
|
343
|
-
throwError(
|
|
361
|
+
throwError(customErrorFunction);
|
|
344
362
|
}
|
|
345
363
|
}
|
|
346
364
|
|
|
347
|
-
function _validateJwtNoThrow(
|
|
365
|
+
function _validateJwtNoThrow(req) {
|
|
348
366
|
|
|
349
367
|
// Get from http header.
|
|
350
|
-
let jwtRaw = req.get(
|
|
368
|
+
let jwtRaw = req.get("Authorization");
|
|
351
369
|
|
|
352
|
-
if (
|
|
370
|
+
if (!jwtRaw) {
|
|
353
371
|
return null;
|
|
354
372
|
}
|
|
355
373
|
|
|
356
374
|
// Extract jwt from bearer schema.
|
|
357
|
-
let jwt = _extractJwtNoThrow(
|
|
375
|
+
let jwt = _extractJwtNoThrow(jwtRaw);
|
|
358
376
|
|
|
359
377
|
// Validate characters string of jwt.
|
|
360
|
-
if (
|
|
378
|
+
if (isJwtString(jwt)) {
|
|
361
379
|
return jwt;
|
|
362
380
|
}
|
|
363
381
|
|
|
364
382
|
return null;
|
|
365
383
|
}
|
|
366
384
|
|
|
367
|
-
function _validateWebTokenNoThrow(
|
|
385
|
+
function _validateWebTokenNoThrow(req, headerName) {
|
|
368
386
|
|
|
369
387
|
// Get from http header.
|
|
370
|
-
let jwtRaw = req.get(
|
|
388
|
+
let jwtRaw = req.get(headerName);
|
|
371
389
|
|
|
372
|
-
if (
|
|
390
|
+
if (!jwtRaw) {
|
|
373
391
|
return null;
|
|
374
392
|
}
|
|
375
393
|
|
|
376
394
|
// Extract jwt from bearer schema.
|
|
377
|
-
let webToken = _extractWebTokenNoThrow(
|
|
395
|
+
let webToken = _extractWebTokenNoThrow(jwtRaw);
|
|
378
396
|
|
|
379
397
|
// Validate characters string of jwt.
|
|
380
|
-
if (
|
|
398
|
+
if (isJwtString(webToken)) {
|
|
381
399
|
return webToken;
|
|
382
400
|
}
|
|
383
401
|
|
|
384
402
|
return null;
|
|
385
403
|
}
|
|
386
404
|
|
|
387
|
-
function _validateVisitorNoThrow(
|
|
405
|
+
function _validateVisitorNoThrow(req) {
|
|
388
406
|
|
|
389
407
|
// Get from http header.
|
|
390
|
-
let jwtRaw = req.get(
|
|
408
|
+
let jwtRaw = req.get("Visitor");
|
|
391
409
|
|
|
392
|
-
if (
|
|
410
|
+
if (!jwtRaw) {
|
|
393
411
|
return null;
|
|
394
412
|
}
|
|
395
413
|
|
|
396
414
|
// Extract jwt from bearer schema.
|
|
397
|
-
let jwt = _extractJwtNoThrow(
|
|
415
|
+
let jwt = _extractJwtNoThrow(jwtRaw);
|
|
398
416
|
|
|
399
417
|
// Validate characters string of jwt.
|
|
400
|
-
if (
|
|
418
|
+
if (isJwtString(jwt)) {
|
|
401
419
|
return jwt;
|
|
402
420
|
}
|
|
403
421
|
|
|
404
422
|
return null;
|
|
405
423
|
}
|
|
406
424
|
|
|
407
|
-
function _extractJwt(
|
|
425
|
+
function _extractJwt(jwtRaw, customErrorFunction) {
|
|
408
426
|
let jwtSplit = null;
|
|
409
427
|
|
|
410
|
-
if (
|
|
411
|
-
jwtSplit = jwtRaw.split(
|
|
428
|
+
if (jwtRaw && typeof jwtRaw === "string") {
|
|
429
|
+
jwtSplit = jwtRaw.split(" ");
|
|
412
430
|
} else {
|
|
413
|
-
throwError(
|
|
431
|
+
throwError(customErrorFunction);
|
|
414
432
|
}
|
|
415
433
|
|
|
416
|
-
if (
|
|
417
|
-
return jwtSplit[
|
|
434
|
+
if (jwtSplit[0]?.toLowerCase() === "bearer") {
|
|
435
|
+
return jwtSplit[1];
|
|
418
436
|
} else {
|
|
419
|
-
throwError(
|
|
437
|
+
throwError(customErrorFunction);
|
|
420
438
|
}
|
|
421
439
|
|
|
422
440
|
return null;
|
|
423
441
|
}
|
|
424
442
|
|
|
425
|
-
function _extractWebToken(
|
|
443
|
+
function _extractWebToken(jwtRaw, customErrorFunction) {
|
|
426
444
|
|
|
427
|
-
if (
|
|
445
|
+
if (jwtRaw && typeof jwtRaw === "string") {
|
|
428
446
|
return jwtRaw;
|
|
429
447
|
} else {
|
|
430
|
-
throwError(
|
|
448
|
+
throwError(customErrorFunction);
|
|
431
449
|
}
|
|
432
450
|
|
|
433
451
|
return null;
|
|
434
452
|
}
|
|
435
453
|
|
|
436
|
-
function _extractJwtNoThrow(
|
|
454
|
+
function _extractJwtNoThrow(jwtRaw) {
|
|
437
455
|
let jwtSplit = null;
|
|
438
456
|
|
|
439
|
-
if (
|
|
440
|
-
jwtSplit = jwtRaw.split(
|
|
457
|
+
if (jwtRaw && typeof jwtRaw === "string") {
|
|
458
|
+
jwtSplit = jwtRaw.split(" ");
|
|
441
459
|
} else {
|
|
442
460
|
return null;
|
|
443
461
|
}
|
|
444
462
|
|
|
445
|
-
if (
|
|
446
|
-
return jwtSplit[
|
|
463
|
+
if (jwtSplit[0]?.toLowerCase() === "bearer") {
|
|
464
|
+
return jwtSplit[1];
|
|
447
465
|
}
|
|
448
466
|
|
|
449
467
|
return null;
|
|
450
468
|
}
|
|
451
469
|
|
|
452
|
-
function _extractWebTokenNoThrow(
|
|
470
|
+
function _extractWebTokenNoThrow(jwtRaw) {
|
|
453
471
|
|
|
454
|
-
if (
|
|
472
|
+
if (jwtRaw && typeof jwtRaw === "string") {
|
|
455
473
|
return jwtRaw;
|
|
456
474
|
}
|
|
457
475
|
return null;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@carecard/jwt-read",
|
|
3
|
-
"version": "3.0.
|
|
3
|
+
"version": "3.0.5",
|
|
4
4
|
"repository": {
|
|
5
5
|
"type": "git",
|
|
6
6
|
"url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
|
|
@@ -28,8 +28,8 @@
|
|
|
28
28
|
"typescript": "5.9.3"
|
|
29
29
|
},
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"@carecard/auth-util": "3.0.
|
|
32
|
-
"@carecard/common-util": "3.0.
|
|
33
|
-
"@carecard/validate": "3.0.
|
|
31
|
+
"@carecard/auth-util": "3.0.4",
|
|
32
|
+
"@carecard/common-util": "3.0.4",
|
|
33
|
+
"@carecard/validate": "3.0.4"
|
|
34
34
|
}
|
|
35
35
|
}
|