@carecard/jwt-read 3.1.12 → 3.1.14

package/.prettierrc.js

@@ -0,0 +1,12 @@
+module.exports = {
+  arrowParens: 'avoid',
+  bracketSameLine: true,
+  bracketSpacing: true,
+  singleQuote: true,
+  trailingComma: 'all',
+  printWidth: 140,
+  useTabs: false,
+  endOfLine: 'auto',
+  importOrderSeparation: true,
+  importOrderSortSpecifiers: true,
+};

package/eslint.config.mjs

@@ -0,0 +1,14 @@
+import { defineConfig, globalIgnores } from 'eslint/config';
+
+const eslintConfig = defineConfig([
+  globalIgnores([
+    // Default ignores of eslint-config-next:
+    '.next/**',
+    'out/**',
+    'build/**',
+    'next-env.d.ts',
+    'node_modules/**',
+  ]),
+]);
+
+export default eslintConfig;

package/index.d.ts

@@ -2,7 +2,7 @@
  * Utility functions for authentication and authorization in the CareCard ecosystem.
  */
 
-import { Request, Response, NextFunction } from 'express';
+import {NextFunction, Request, Response} from 'express';
 
 /**
  * Represents the standard JWT header structure.
@@ -50,44 +50,50 @@ export interface JwtParts {
  * Structure of the JWT object attached to the request.
  */
 export interface JwtRequestObject {
-    header: JwtHeader;
-    payload: JwtPayload;
-    age?: number;
-    jwtClientId: (req?: any) => string | undefined;
-    doesJwtUserHasRole: (role: string) => boolean;
-    isJwtExpired: (jwtValiditySeconds?: number) => boolean;
-    jwtAgeInSeconds: (req?: any) => number;
+  header: JwtHeader;
+  payload: JwtPayload;
+  age?: number;
+  jwtClientId: (req?: any) => string | undefined;
+  doesJwtUserHasRole: (role: string) => boolean;
+  isJwtExpired: (jwtValiditySeconds?: number) => boolean;
+  jwtAgeInSeconds: (req?: any) => number;
 }
 
 /**
  * Structure of the visitor object attached to the request.
  */
 export interface VisitorRequestObject {
-    header: JwtHeader;
-    payload: JwtPayload;
-    visitorClientId: (req?: any) => string | undefined;
+  header: JwtHeader;
+  payload: JwtPayload;
+  visitorClientId: (req?: any) => string | undefined;
 }
 
 /**
  * Extended Express Request to include jwt and visitor objects.
  */
 export interface AuthenticatedRequest extends Request {
-    jwt?: JwtRequestObject | null;
-    visitor?: VisitorRequestObject | null;
+  jwt?: JwtRequestObject | null;
+  visitor?: VisitorRequestObject | null;
 }
 
-
 /**
  * Returns a middleware that verifies a JWT from the 'Authorization: Bearer <token>' header
  * and extracts it into req.jwt. Throws an error if invalid.
  */
-export function jwtVerify(publicKey: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+export function jwtVerify(
+  publicKey: string,
+  customErrorFunction?: () => void,
+): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
 
 /**
  * Returns a middleware that verifies a JWT from a custom header and extracts it into req.jwt.
  * Throws an error if invalid.
  */
-export function jwtVerifyWebToken(publicKey: string, headerName: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+export function jwtVerifyWebToken(
+  publicKey: string,
+  headerName: string,
+  customErrorFunction?: () => void,
+): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
 
 /**
  * Returns a middleware that verifies a JWT from the 'Authorization: Bearer <token>' header
@@ -99,7 +105,10 @@ export function jwtVerifyNoThrow(publicKey: string): (req: AuthenticatedRequest,
  * Returns a middleware that verifies a JWT from a custom header and extracts it into req.jwt.
  * Returns false instead of throwing if invalid.
  */
-export function jwtVerifyWebTokenNoThrow(publicKey: string, headerName: string): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+export function jwtVerifyWebTokenNoThrow(
+  publicKey: string,
+  headerName: string,
+): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
 
 /**
  * Returns a middleware that verifies a visitor token from the 'Visitor' header
@@ -132,7 +141,11 @@ export function jwtGetAgeInSeconds(req?: any): number;
 /**
  * Returns a middleware that verifies the JWT and checks if the user has the required role.
  */
-export function jwtVerifyAndHasRole(userRole: string, publicKey: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+export function jwtVerifyAndHasRole(
+  userRole: string,
+  publicKey: string,
+  customErrorFunction?: () => void,
+): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
 
 /**
  * Gets the full name of a role from its code (e.g., 'ad' -> 'admin').
@@ -144,6 +157,22 @@ export function jwtGetRoleName(roleCode: string): string;
  */
 export function jwtGetRoleCode(roleName: string): string;
 
+/**
+ * Represents the context derived from the JWT request.
+ */
+export interface JwtContext {
+  /** The user ID (sub) from the JWT. Always returned. */
+  user_id: string | undefined;
+  /** The role of the user. Only set to 'super_admin' when roles contains 'ad'. */
+  role?: string;
+}
+
+/**
+ * Returns the context derived from the JWT in req.jwt.
+ * Always returns user_id. If the roles array contains 'ad', also returns role: 'super_admin'.
+ */
+export function jwtGetContext(req: any): JwtContext;
+
 /**
  * Validates the JWT from the Authorization header and extracts it into req.jwt.
  */
@@ -152,7 +181,12 @@ export function jwtValidateAndExtract(req: AuthenticatedRequest, publicKey: stri
 /**
  * Validates the JWT from a custom header and extracts it into req.jwt.
  */
-export function jwtValidateAndExtractWebToken(req: AuthenticatedRequest, publicKey: string, headerName: string, customErrorFunction?: () => void): void;
+export function jwtValidateAndExtractWebToken(
+  req: AuthenticatedRequest,
+  publicKey: string,
+  headerName: string,
+  customErrorFunction?: () => void,
+): void;
 
 /**
  * Validates the JWT from the Authorization header and extracts it into req.jwt (no-throw).
@@ -169,20 +203,26 @@ export function jwtValidateAndExtractWebTokenNoThrow(req: AuthenticatedRequest,
  */
 export function jwtValidateAndExtractVisitorNoThrow(req: AuthenticatedRequest, publicKey: string): void;
 
-
 /**
  * Returns a middleware that verifies a JWT from the 'Authorization: Bearer <token>' header
  * and extracts it into req.jwt. Throws an error if invalid.
  * @deprecated use jwtVerify
  */
-export function verifyJwt(publicKey: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+export function verifyJwt(
+  publicKey: string,
+  customErrorFunction?: () => void,
+): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
 
 /**
  * Returns a middleware that verifies a JWT from a custom header and extracts it into req.jwt.
  * Throws an error if invalid.
  * @deprecated use jwtVerifyWebToken
  */
-export function verifyWebToken(publicKey: string, headerName: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+export function verifyWebToken(
+  publicKey: string,
+  headerName: string,
+  customErrorFunction?: () => void,
+): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
 
 /**
  * Returns a middleware that verifies a JWT from the 'Authorization: Bearer <token>' header
@@ -196,7 +236,10 @@ export function verifyJwtNoThrow(publicKey: string): (req: AuthenticatedRequest,
  * Returns false instead of throwing if invalid.
  * @deprecated use jwtVerifyWebTokenNoThrow
  */
-export function verifyWebTokenNoThrow(publicKey: string, headerName: string): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+export function verifyWebTokenNoThrow(
+  publicKey: string,
+  headerName: string,
+): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
 
 /**
  * Returns a middleware that verifies a visitor token from the 'Visitor' header
@@ -237,7 +280,11 @@ export function jwtAgeInSeconds(req?: any): number;
  * Returns a middleware that verifies the JWT and checks if the user has the required role.
  * @deprecated use jwtVerifyAndHasRole
  */
-export function verifyJwtAndRole(userRole: string, publicKey: string, customErrorFunction?: () => void): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+export function verifyJwtAndRole(
+  userRole: string,
+  publicKey: string,
+  customErrorFunction?: () => void,
+): (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
 
 /**
  * Throws a Used_Token error.
@@ -245,7 +292,6 @@ export function verifyJwtAndRole(userRole: string, publicKey: string, customErro
  */
 export function throwUsedTokenError(): never;
 
-
 /**
  * Checks if the user in the extracted JWT has the specified role.
  * @deprecated use jwtDoesJwtUserHasRole
@@ -260,10 +306,8 @@ export function doesJwtUserHasRole(userRole: string): boolean;
  */
 export function getNameOfRole(roleCode: string): string;
 
-
 /**
  * Gets the code of a role from its name (e.g., 'admin' -> 'ad').
  * @deprecated use jwtGetRoleCode
  */
 export function getCodeOfRole(roleName: string): string;
-

package/index.js

@@ -2,50 +2,51 @@ const jwtLib = require('./lib/jwtLib');
 const jwtRoles = require('./lib/jwtRoles');
 
 module.exports = {
-    jwtVerify: jwtLib.verifyJwt,
-    jwtVerifyWebToken: jwtLib.verifyWebToken,
-    jwtVerifyNoThrow: jwtLib.verifyJwtNoThrow,
-    jwtVerifyWebTokenNoThrow: jwtLib.verifyWebTokenNoThrow,
-    jwtVerifyVisitorNoThrow: jwtLib.verifyVisitorNoThrow,
-    jwtGetClientId: jwtLib.jwtClientId,
-    jwtGetVisitorClientId: jwtLib.visitorClientId,
-    jwtIsExpired: jwtLib.isJwtExpired,
-    jwtGetAgeInSeconds: jwtLib.jwtAgeInSeconds,
-    jwtVerifyAndHasRole: jwtLib.verifyJwtAndRole,
-    jwtGetRoleName: jwtRoles.getNameOfRoleFromCode,
-    jwtGetRoleCode: jwtRoles.getCodeFromNameOfRole,
-    jwtValidateAndExtract: jwtLib.validateAndExtractJwtObject,
-    jwtValidateAndExtractWebToken: jwtLib.validateAndExtractWebToken,
-    jwtValidateAndExtractNoThrow: jwtLib.validateAndExtractJwtObjectNoThrow,
-    jwtValidateAndExtractWebTokenNoThrow: jwtLib.validateAndExtractWebTokenObjectNoThrow,
-    jwtValidateAndExtractVisitorNoThrow: jwtLib.validateAndExtractVisitorObjectNoThrow,
+  jwtVerify: jwtLib.verifyJwt,
+  jwtVerifyWebToken: jwtLib.verifyWebToken,
+  jwtVerifyNoThrow: jwtLib.verifyJwtNoThrow,
+  jwtVerifyWebTokenNoThrow: jwtLib.verifyWebTokenNoThrow,
+  jwtVerifyVisitorNoThrow: jwtLib.verifyVisitorNoThrow,
+  jwtGetClientId: jwtLib.jwtClientId,
+  jwtGetVisitorClientId: jwtLib.visitorClientId,
+  jwtIsExpired: jwtLib.isJwtExpired,
+  jwtGetAgeInSeconds: jwtLib.jwtAgeInSeconds,
+  jwtVerifyAndHasRole: jwtLib.verifyJwtAndRole,
+  jwtGetRoleName: jwtRoles.getNameOfRoleFromCode,
+  jwtGetRoleCode: jwtRoles.getCodeFromNameOfRole,
+  jwtGetContext: jwtRoles.getContext,
+  jwtValidateAndExtract: jwtLib.validateAndExtractJwtObject,
+  jwtValidateAndExtractWebToken: jwtLib.validateAndExtractWebToken,
+  jwtValidateAndExtractNoThrow: jwtLib.validateAndExtractJwtObjectNoThrow,
+  jwtValidateAndExtractWebTokenNoThrow: jwtLib.validateAndExtractWebTokenObjectNoThrow,
+  jwtValidateAndExtractVisitorNoThrow: jwtLib.validateAndExtractVisitorObjectNoThrow,
 
-    /** @deprecated use jwtVerify */
-    verifyJwt: jwtLib.verifyJwt,
-    /** @deprecated use jwtVerifyWebToken */
-    verifyWebToken: jwtLib.verifyWebToken,
-    /** @deprecated use jwtVerifyNoThrow */
-    verifyJwtNoThrow: jwtLib.verifyJwtNoThrow,
-    /** @deprecated use jwtVerifyWebTokenNoThrow */
-    verifyWebTokenNoThrow: jwtLib.verifyWebTokenNoThrow,
-    /** @deprecated use jwtVerifyVisitorNoThrow */
-    verifyVisitorNoThrow: jwtLib.verifyVisitorNoThrow,
-    /** @deprecated use jwtGetClientId */
-    jwtClientId: jwtLib.jwtClientId,
-    /** @deprecated use jwtGetVisitorClientId */
-    visitorClientId: jwtLib.visitorClientId,
-    /** @deprecated use jwtIsExpired */
-    isJwtExpired: jwtLib.isJwtExpired,
-    /** @deprecated use jwtGetAgeInSeconds */
-    jwtAgeInSeconds: jwtLib.jwtAgeInSeconds,
-    /** @deprecated use jwtVerifyAndHasRole */
-    verifyJwtAndRole: jwtLib.verifyJwtAndRole,
-    /** @deprecated use jwtThrowUsedTokenError */
-    throwUsedTokenError: jwtLib.throwUsedTokenError,
-    /** @deprecated use jwtDoesJwtUserHasRole */
-    doesJwtUserHasRole: jwtLib.doesJwtUserHasRole,
-    /** @deprecated use jwtGetRoleName */
-    getNameOfRole: jwtRoles.getNameOfRoleFromCode,
-    /** @deprecated use jwtGetRoleCode */
-    getCodeOfRole: jwtRoles.getCodeFromNameOfRole
+  /** @deprecated use jwtVerify */
+  verifyJwt: jwtLib.verifyJwt,
+  /** @deprecated use jwtVerifyWebToken */
+  verifyWebToken: jwtLib.verifyWebToken,
+  /** @deprecated use jwtVerifyNoThrow */
+  verifyJwtNoThrow: jwtLib.verifyJwtNoThrow,
+  /** @deprecated use jwtVerifyWebTokenNoThrow */
+  verifyWebTokenNoThrow: jwtLib.verifyWebTokenNoThrow,
+  /** @deprecated use jwtVerifyVisitorNoThrow */
+  verifyVisitorNoThrow: jwtLib.verifyVisitorNoThrow,
+  /** @deprecated use jwtGetClientId */
+  jwtClientId: jwtLib.jwtClientId,
+  /** @deprecated use jwtGetVisitorClientId */
+  visitorClientId: jwtLib.visitorClientId,
+  /** @deprecated use jwtIsExpired */
+  isJwtExpired: jwtLib.isJwtExpired,
+  /** @deprecated use jwtGetAgeInSeconds */
+  jwtAgeInSeconds: jwtLib.jwtAgeInSeconds,
+  /** @deprecated use jwtVerifyAndHasRole */
+  verifyJwtAndRole: jwtLib.verifyJwtAndRole,
+  /** @deprecated use jwtThrowUsedTokenError */
+  throwUsedTokenError: jwtLib.throwUsedTokenError,
+  /** @deprecated use jwtDoesJwtUserHasRole */
+  doesJwtUserHasRole: jwtLib.doesJwtUserHasRole,
+  /** @deprecated use jwtGetRoleName */
+  getNameOfRole: jwtRoles.getNameOfRoleFromCode,
+  /** @deprecated use jwtGetRoleCode */
+  getCodeOfRole: jwtRoles.getCodeFromNameOfRole,
 };

package/lib/jwtLib.js

@@ -1,411 +1,394 @@
-const {isJwtString} = require('@carecard/validate').validate;
-const {jwtVerifySignedToken, jwtGetHeaderPayload} = require('@carecard/auth-util');
+const { isJwtString } = require('@carecard/validate');
+const { jwtVerifySignedToken, jwtGetHeaderPayload } = require('@carecard/auth-util');
 
-const {
-    throwLoginRequiredError,
-    throwNotAuthorizedError
-} = require("@carecard/common-util").error;
+const { throwLoginRequiredError, throwNotAuthorizedError } = require('@carecard/common-util');
 
 function jwtClientId(req) {
-    const jwtObj = req?.jwt || this;
-    return jwtObj?.payload?.sub;
+  const jwtObj = req?.jwt || this;
+  return jwtObj?.payload?.sub;
 }
 
 function visitorClientId(req) {
-    const visitorObj = req?.visitor || this;
-    return visitorObj?.payload?.sub;
+  const visitorObj = req?.visitor || this;
+  return visitorObj?.payload?.sub;
 }
 
 function doesJwtUserHasRole(req, userRole) {
-    // Check if called as req.jwt.doesJwtUserHasRole(userRole) or doesJwtUserHasRole(role)
-    if (arguments.length === 1 && typeof req === 'string') {
-        userRole = req;
-        req = undefined;
-    }
+  // Check if called as req.jwt.doesJwtUserHasRole(userRole) or doesJwtUserHasRole(role)
+  if (arguments.length === 1 && typeof req === 'string') {
+    userRole = req;
+    req = undefined;
+  }
 
-    const jwtObj = req?.jwt || this;
+  const jwtObj = req?.jwt || this;
 
-    if (!userRole || typeof userRole !== "string" || !jwtObj?.payload?.roles || !Array.isArray(jwtObj.payload.roles)) {
-        throwNotAuthorizedError();
-    }
+  if (!userRole || typeof userRole !== 'string' || !jwtObj?.payload?.roles || !Array.isArray(jwtObj.payload.roles)) {
+    throwNotAuthorizedError();
+  }
 
-    return jwtObj.payload.roles.includes(userRole);
+  return jwtObj.payload.roles.includes(userRole);
 }
 
 function throwError(customErrorFunction) {
-    (typeof customErrorFunction === "function") ?
-        customErrorFunction() :
-        throwLoginRequiredError()
+  typeof customErrorFunction === 'function' ? customErrorFunction() : throwLoginRequiredError();
 }
 
 function isJwtExpired(req, jwtValiditySeconds) {
-    // Check if called as req.jwt.isJwtExpired(seconds) or isJwtExpired(seconds)
-    if (arguments.length === 1 && typeof req === 'number') {
-        jwtValiditySeconds = req;
-        req = undefined;
-    }
+  // Check if called as req.jwt.isJwtExpired(seconds) or isJwtExpired(seconds)
+  if (arguments.length === 1 && typeof req === 'number') {
+    jwtValiditySeconds = req;
+    req = undefined;
+  }
 
-    const jwtObj = req?.jwt || this;
-
-    if (jwtObj?.payload?.exp) {
-        return (Math.floor(Date.now() / 1000)) >= jwtObj.payload.exp;
-    }
+  const jwtObj = req?.jwt || this;
 
-    if (jwtValiditySeconds && typeof jwtValiditySeconds === "number") {
-        return (parseInt(jwtValiditySeconds)) < jwtAgeInSeconds.call(this, req);
-    } else {
-        return true;
-    }
+  if (jwtObj?.payload?.exp) {
+    return Math.floor(Date.now() / 1000) >= jwtObj.payload.exp;
+  }
 
+  if (jwtValiditySeconds && typeof jwtValiditySeconds === 'number') {
+    return parseInt(jwtValiditySeconds) < jwtAgeInSeconds.call(this, req);
+  } else {
+    return true;
+  }
 }
 
 function jwtAgeInSeconds(req) {
-    const jwtObj = req?.jwt || this;
-
-    if (jwtObj?.payload?.iat) {
-
-        let iat = jwtObj.payload.iat;
-        if (iat > 1000000000000) {
-            iat = Math.floor(iat / 1000);
-        }
-
-        jwtObj["age"] = Math.floor(Date.now() / 1000) - iat;
-        return jwtObj.age;
-
-    } else {
-
-        jwtObj["age"] = Infinity
-        return jwtObj.age;
+  const jwtObj = req?.jwt || this;
 
+  if (jwtObj?.payload?.iat) {
+    let iat = jwtObj.payload.iat;
+    if (iat > 1000000000000) {
+      iat = Math.floor(iat / 1000);
     }
+
+    jwtObj['age'] = Math.floor(Date.now() / 1000) - iat;
+    return jwtObj.age;
+  } else {
+    jwtObj['age'] = Infinity;
+    return jwtObj.age;
+  }
 }
 
 function validateAndExtractJwtObject(req, publicKey, customErrorFunction) {
+  const jwtString = _validateJwt(req, customErrorFunction);
 
-    const jwtString = _validateJwt(req, customErrorFunction);
-
-    const isJwtSignatureValid = jwtVerifySignedToken(jwtString, publicKey);
+  const isJwtSignatureValid = jwtVerifySignedToken(jwtString, publicKey);
 
-    if (jwtString && isJwtSignatureValid) {
-        _extractJwtObject(req, jwtString, customErrorFunction);
-    } else {
-        req["jwt"] = null;
-        throwError(customErrorFunction);
-    }
+  if (jwtString && isJwtSignatureValid) {
+    _extractJwtObject(req, jwtString, customErrorFunction);
+  } else {
+    req['jwt'] = null;
+    throwError(customErrorFunction);
+  }
 
-    return req;
+  return req;
 }
 
 function validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction) {
+  const webTokenString = _validateWebToken(req, headerName, customErrorFunction);
 
-    const webTokenString = _validateWebToken(req, headerName, customErrorFunction);
+  const isJwtSignatureValid = jwtVerifySignedToken(webTokenString, publicKey);
 
-    const isJwtSignatureValid = jwtVerifySignedToken(webTokenString, publicKey);
-
-    if (webTokenString && isJwtSignatureValid) {
-        _extractJwtObject(req, webTokenString, customErrorFunction);
-    } else {
-        req["jwt"] = null;
-        throwError(customErrorFunction);
-    }
+  if (webTokenString && isJwtSignatureValid) {
+    _extractJwtObject(req, webTokenString, customErrorFunction);
+  } else {
+    req['jwt'] = null;
+    throwError(customErrorFunction);
+  }
 
-    return req;
+  return req;
 }
 
 function validateAndExtractJwtObjectNoThrow(req, publicKey) {
-    return _validateAndExtractGenericNoThrow(req, publicKey, _validateJwtNoThrow, _extractJwtObjectNoThrow, "jwt");
+  return _validateAndExtractGenericNoThrow(req, publicKey, _validateJwtNoThrow, _extractJwtObjectNoThrow, 'jwt');
 }
 
 function validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName) {
-    return _validateAndExtractGenericNoThrow(req, publicKey, (r) => _validateWebTokenNoThrow(r, headerName), _extractJwtObjectNoThrow, "jwt");
+  return _validateAndExtractGenericNoThrow(req, publicKey, r => _validateWebTokenNoThrow(r, headerName), _extractJwtObjectNoThrow, 'jwt');
 }
 
 function validateAndExtractVisitorObjectNoThrow(req, publicKey) {
-    return _validateAndExtractGenericNoThrow(req, publicKey, _validateVisitorNoThrow, _extractVisitorObjectNoThrow, "visitor");
+  return _validateAndExtractGenericNoThrow(req, publicKey, _validateVisitorNoThrow, _extractVisitorObjectNoThrow, 'visitor');
 }
 
 function verifyJwtAndRole(role, publicKey, customErrorFunction) {
-    return function (req, res, next) {
-        try {
-            validateAndExtractJwtObject(req, publicKey, customErrorFunction);
-            const isRoleExist = doesJwtUserHasRole(req, role);
-            _isLoginRequired(isRoleExist, customErrorFunction);
-            next();
-        } catch (err) {
-            next(err);
-        }
+  return function (req, res, next) {
+    try {
+      validateAndExtractJwtObject(req, publicKey, customErrorFunction);
+      const isRoleExist = doesJwtUserHasRole(req, role);
+      _isLoginRequired(isRoleExist, customErrorFunction);
+      next();
+    } catch (err) {
+      next(err);
     }
+  };
 }
 
 function verifyJwt(publicKey, customErrorFunction) {
-    return function (req, res, next) {
-        try {
-            validateAndExtractJwtObject(req, publicKey, customErrorFunction);
-            next();
-        } catch (err) {
-            next(err);
-        }
+  return function (req, res, next) {
+    try {
+      validateAndExtractJwtObject(req, publicKey, customErrorFunction);
+      next();
+    } catch (err) {
+      next(err);
     }
+  };
 }
 
 function verifyWebToken(publicKey, headerName, customErrorFunction) {
-    return function (req, res, next) {
-        try {
-            validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction);
-            next();
-        } catch (err) {
-            next(err);
-        }
+  return function (req, res, next) {
+    try {
+      validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction);
+      next();
+    } catch (err) {
+      next(err);
     }
+  };
 }
 
 function verifyJwtNoThrow(publicKey) {
-    return function (req, res, next) {
-        try {
-            validateAndExtractJwtObjectNoThrow(req, publicKey);
-            next();
-        } catch (err) {
-            next(err);
-        }
+  return function (req, res, next) {
+    try {
+      validateAndExtractJwtObjectNoThrow(req, publicKey);
+      next();
+    } catch (err) {
+      next(err);
     }
+  };
 }
 
 function verifyWebTokenNoThrow(publicKey, headerName) {
-    return function (req, res, next) {
-        try {
-            validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName);
-            next();
-        } catch (err) {
-            next(err);
-        }
+  return function (req, res, next) {
+    try {
+      validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName);
+      next();
+    } catch (err) {
+      next(err);
     }
+  };
 }
 
 function verifyVisitorNoThrow(publicKey) {
-    return function (req, res, next) {
-        try {
-            validateAndExtractVisitorObjectNoThrow(req, publicKey);
-            next();
-        } catch (err) {
-            next(err);
-        }
+  return function (req, res, next) {
+    try {
+      validateAndExtractVisitorObjectNoThrow(req, publicKey);
+      next();
+    } catch (err) {
+      next(err);
     }
+  };
 }
 
 function throwUsedTokenError() {
-    throw new Error("Used_Token");
+  throw new Error('Used_Token');
 }
 
 /*********************
  * Private functions *
  *********************/
 function _isLoginRequired(hasRequiredRole, customErrorFunction) {
-
-    if (!hasRequiredRole) {
-        throwError(customErrorFunction);
-    }
-
+  if (!hasRequiredRole) {
+    throwError(customErrorFunction);
+  }
 }
 
 function _validateGenericNoThrow(req, headerName, extractor) {
-    let jwtRaw = req.get(headerName);
-    if (!jwtRaw) return null;
-    let jwt = extractor(jwtRaw);
-    return isJwtString(jwt) ? jwt : null;
+  let jwtRaw = req.get(headerName);
+  if (!jwtRaw) return null;
+  let jwt = extractor(jwtRaw);
+  return isJwtString(jwt) ? jwt : null;
 }
 
 function _validateGeneric(req, headerName, extractor, customErrorFunction) {
-    let jwtRaw = req.get(headerName);
-    let jwt = extractor(jwtRaw, customErrorFunction);
-    if (isJwtString(jwt)) return jwt;
-    throwError(customErrorFunction);
-    return null;
+  let jwtRaw = req.get(headerName);
+  let jwt = extractor(jwtRaw, customErrorFunction);
+  if (isJwtString(jwt)) return jwt;
+  throwError(customErrorFunction);
+  return null;
 }
 
 function _validateAndExtractGenericNoThrow(req, publicKey, validator, extractor, propertyName) {
-    try {
-        const jwtString = validator(req);
-        const isJwtSignatureValid = jwtVerifySignedToken(jwtString, publicKey);
-
-        if (jwtString && isJwtSignatureValid) {
-            extractor(req, jwtString);
-        } else {
-            req[propertyName] = null;
-        }
-    } catch (err) {
-        if (req) req[propertyName] = null;
-        throw err;
+  try {
+    const jwtString = validator(req);
+    const isJwtSignatureValid = jwtVerifySignedToken(jwtString, publicKey);
+
+    if (jwtString && isJwtSignatureValid) {
+      extractor(req, jwtString);
+    } else {
+      req[propertyName] = null;
     }
-    return req;
+  } catch (err) {
+    if (req) req[propertyName] = null;
+    throw err;
+  }
+  return req;
 }
 
 function _extractGenericObjectNoThrow(req, jwt, attacher, propertyName) {
-    if (jwt && typeof jwt === "string") {
-        const obj = jwtGetHeaderPayload(jwt);
-        attacher(obj);
-        req[propertyName] = obj;
-    } else {
-        if (req) req[propertyName] = null;
-    }
+  if (jwt && typeof jwt === 'string') {
+    const obj = jwtGetHeaderPayload(jwt);
+    attacher(obj);
+    req[propertyName] = obj;
+  } else {
+    if (req) req[propertyName] = null;
+  }
 }
 
 function _extractJwtObject(req, jwt, customErrorFunction) {
-    _extractJwtObjectNoThrow(req, jwt);
+  _extractJwtObjectNoThrow(req, jwt);
 
-    if (!req["jwt"]) {
-        throwError(customErrorFunction);
-    }
+  if (!req['jwt']) {
+    throwError(customErrorFunction);
+  }
 }
 
 function _extractJwtObjectNoThrow(req, jwt) {
-    _extractGenericObjectNoThrow(req, jwt, _attachJwtMethods, "jwt");
+  _extractGenericObjectNoThrow(req, jwt, _attachJwtMethods, 'jwt');
 }
 
 function _extractVisitorObjectNoThrow(req, jwt) {
-    _extractGenericObjectNoThrow(req, jwt, _attachVisitorMethods, "visitor");
+  _extractGenericObjectNoThrow(req, jwt, _attachVisitorMethods, 'visitor');
 }
 
 function _attachJwtMethods(jwtObj) {
-    if (jwtObj) {
-        Object.defineProperties(jwtObj, {
-            jwtClientId: {value: jwtClientId, enumerable: false},
-            doesJwtUserHasRole: {value: doesJwtUserHasRole, enumerable: false},
-            isJwtExpired: {value: isJwtExpired, enumerable: false},
-            jwtAgeInSeconds: {value: jwtAgeInSeconds, enumerable: false}
-        });
-    }
+  if (jwtObj) {
+    Object.defineProperties(jwtObj, {
+      jwtClientId: { value: jwtClientId, enumerable: false },
+      doesJwtUserHasRole: { value: doesJwtUserHasRole, enumerable: false },
+      isJwtExpired: { value: isJwtExpired, enumerable: false },
+      jwtAgeInSeconds: { value: jwtAgeInSeconds, enumerable: false },
+    });
+  }
 }
 
 function _attachVisitorMethods(visitorObj) {
-    if (visitorObj) {
-        Object.defineProperties(visitorObj, {
-            visitorClientId: {value: visitorClientId, enumerable: false}
-        });
-    }
+  if (visitorObj) {
+    Object.defineProperties(visitorObj, {
+      visitorClientId: { value: visitorClientId, enumerable: false },
+    });
+  }
 }
 
 async function _isJwtSignatureValid(jwt, publicKey, customErrorFunction) {
+  const isValid = await _isJwtSignatureValidNoThrow(jwt, publicKey);
 
-    const isValid = await _isJwtSignatureValidNoThrow(jwt, publicKey);
-
-    if (isValid) {
-        return isValid;
-    } else {
-        throwError(customErrorFunction);
-    }
+  if (isValid) {
+    return isValid;
+  } else {
+    throwError(customErrorFunction);
+  }
 }
 
 async function _isJwtSignatureValidNoThrow(jwt, publicKey) {
-
-    if (jwt && typeof jwt === "string") {
-        return jwtVerifySignedToken(jwt, publicKey)
-    } else {
-        return false;
-    }
+  if (jwt && typeof jwt === 'string') {
+    return jwtVerifySignedToken(jwt, publicKey);
+  } else {
+    return false;
+  }
 }
 
 function _validateJwt(req, customErrorFunction) {
-    return _validateGeneric(req, "Authorization", _extractJwt, customErrorFunction);
+  return _validateGeneric(req, 'Authorization', _extractJwt, customErrorFunction);
 }
 
 function _validateWebToken(req, headerName, customErrorFunction) {
-    return _validateGeneric(req, headerName, _extractWebToken, customErrorFunction);
+  return _validateGeneric(req, headerName, _extractWebToken, customErrorFunction);
 }
 
 function _validateJwtNoThrow(req) {
-    return _validateGenericNoThrow(req, "Authorization", _extractJwtNoThrow);
+  return _validateGenericNoThrow(req, 'Authorization', _extractJwtNoThrow);
 }
 
 function _validateWebTokenNoThrow(req, headerName) {
-    return _validateGenericNoThrow(req, headerName, _extractWebTokenNoThrow);
+  return _validateGenericNoThrow(req, headerName, _extractWebTokenNoThrow);
 }
 
 function _validateVisitorNoThrow(req) {
-    return _validateGenericNoThrow(req, "Visitor", _extractJwtNoThrow);
+  return _validateGenericNoThrow(req, 'Visitor', _extractJwtNoThrow);
 }
 
 function _extractJwt(jwtRaw, customErrorFunction) {
-    const jwt = _extractJwtNoThrow(jwtRaw);
+  const jwt = _extractJwtNoThrow(jwtRaw);
 
-    if (jwt !== null) {
-        return jwt;
-    } else {
-        throwError(customErrorFunction);
-    }
+  if (jwt !== null) {
+    return jwt;
+  } else {
+    throwError(customErrorFunction);
+  }
 
-    return null;
+  return null;
 }
 
 function _extractWebToken(jwtRaw, customErrorFunction) {
-    const webToken = _extractWebTokenNoThrow(jwtRaw);
+  const webToken = _extractWebTokenNoThrow(jwtRaw);
 
-    if (webToken !== null) {
-        return webToken;
-    } else {
-        throwError(customErrorFunction);
-    }
+  if (webToken !== null) {
+    return webToken;
+  } else {
+    throwError(customErrorFunction);
+  }
 
-    return null;
+  return null;
 }
 
 function _extractJwtNoThrow(jwtRaw) {
-    let jwtSplit = null;
+  let jwtSplit = null;
 
-    if (jwtRaw && typeof jwtRaw === "string") {
-        jwtSplit = jwtRaw.split(" ");
-    } else {
-        return null;
-    }
+  if (jwtRaw && typeof jwtRaw === 'string') {
+    jwtSplit = jwtRaw.split(' ');
+  } else {
+    return null;
+  }
 
-    if (jwtSplit[0]?.toLowerCase() === "bearer") {
-        return jwtSplit[1];
-    }
+  if (jwtSplit[0]?.toLowerCase() === 'bearer') {
+    return jwtSplit[1];
+  }
 
-    return null;
+  return null;
 }
 
 function _extractWebTokenNoThrow(jwtRaw) {
-
-    if (jwtRaw && typeof jwtRaw === "string") {
-        return jwtRaw;
-    }
-    return null;
+  if (jwtRaw && typeof jwtRaw === 'string') {
+    return jwtRaw;
+  }
+  return null;
 }
 
 module.exports = {
-    _validateJwt,
-    _validateJwtNoThrow,
-    _isJwtSignatureValid,
-    _isJwtSignatureValidNoThrow,
-    _extractJwtObject,
-    validateAndExtractJwtObject,
-    validateAndExtractWebToken,
-    jwtAgeInSeconds,
-    isJwtExpired,
-    doesJwtUserHasRole,
-    jwtClientId,
-    visitorClientId,
-    verifyJwtAndRole,
-    verifyJwt,
-    verifyWebTokenNoThrow,
-    verifyWebToken,
-    verifyJwtNoThrow,
-    throwUsedTokenError,
-    throwError,
-    verifyVisitorNoThrow,
-    validateAndExtractVisitorObjectNoThrow,
-    validateAndExtractJwtObjectNoThrow,
-    validateAndExtractWebTokenObjectNoThrow,
-    _extractJwtNoThrow,
-    _extractWebTokenNoThrow,
-    _extractJwt,
-    _validateWebTokenNoThrow,
-    _validateVisitorNoThrow,
-    _extractJwtObjectNoThrow,
-    _extractVisitorObjectNoThrow,
-    _extractWebToken,
-    _isLoginRequired,
-    _attachJwtMethods,
-    _attachVisitorMethods,
-    _validateWebToken
-}
+  _validateJwt,
+  _validateJwtNoThrow,
+  _isJwtSignatureValid,
+  _isJwtSignatureValidNoThrow,
+  _extractJwtObject,
+  validateAndExtractJwtObject,
+  validateAndExtractWebToken,
+  jwtAgeInSeconds,
+  isJwtExpired,
+  doesJwtUserHasRole,
+  jwtClientId,
+  visitorClientId,
+  verifyJwtAndRole,
+  verifyJwt,
+  verifyWebTokenNoThrow,
+  verifyWebToken,
+  verifyJwtNoThrow,
+  throwUsedTokenError,
+  throwError,
+  verifyVisitorNoThrow,
+  validateAndExtractVisitorObjectNoThrow,
+  validateAndExtractJwtObjectNoThrow,
+  validateAndExtractWebTokenObjectNoThrow,
+  _extractJwtNoThrow,
+  _extractWebTokenNoThrow,
+  _extractJwt,
+  _validateWebTokenNoThrow,
+  _validateVisitorNoThrow,
+  _extractJwtObjectNoThrow,
+  _extractVisitorObjectNoThrow,
+  _extractWebToken,
+  _isLoginRequired,
+  _attachJwtMethods,
+  _attachVisitorMethods,
+  _validateWebToken,
+};

package/lib/jwtRoles.js

@@ -1,20 +1,39 @@
+const { jwtClientId } = require('./jwtLib');
+
 module.exports = {
-    getNameOfRoleFromCode,
-    getCodeFromNameOfRole,
+  getNameOfRoleFromCode,
+  getCodeFromNameOfRole,
+  getContext,
+};
+
+function getNameOfRoleFromCode(roleCode) {
+  const codesToCategory = {
+    ad: 'admin',
+    su: 'super_admin',
+  };
+  return codesToCategory[roleCode] || '';
 }
 
-function getNameOfRoleFromCode( roleCode ) {
-    const codesToCategory = {
-        "ad": "admin",
-        "su": "super_admin",
-    };
-    return codesToCategory[ roleCode ] || "";
+function getCodeFromNameOfRole(roleName) {
+  const namesToCode = {
+    admin: 'ad',
+    super_admin: 'su',
+  };
+  return namesToCode[roleName] || '';
 }
 
-function getCodeFromNameOfRole( roleName ) {
-    const namesToCode = {
-        "admin": "ad",
-        "super_admin": "su",
+function getContext(req) {
+  const userId = jwtClientId(req);
+  const roles = req.jwt?.payload?.roles;
+
+  if (Array.isArray(roles) && roles.includes('ad')) {
+    return {
+      user_id: userId,
+      role: 'super_admin',
     };
-    return namesToCode[ roleName ] || "";
+  }
+
+  return {
+    user_id: userId,
+  };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.1.12",
+  "version": "3.1.14",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
@@ -9,10 +9,15 @@
   "main": "index.js",
   "types": "index.d.ts",
   "scripts": {
-    "test": "export NODE_ENV=test && mocha --recursive",
+    "test": "mocha --recursive",
     "test:types": "tsc --noEmit && mocha -r ts-node/register test/types.test.ts",
-    "test:coverage": "tsc --noEmit && export NODE_ENV=test && nyc mocha --recursive -r ts-node/register 'test/**/*.{js,ts}'",
-    "prepare": "husky"
+    "test:coverage": "tsc --noEmit && nyc mocha --recursive -r ts-node/register 'test/**/*.{js,ts}'",
+    "test:All": "npm run test && npm run test:types",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "prepare": "husky",
+    "lint:fix": "eslint --fix",
+    "lint": "eslint"
   },
   "keywords": [
     "auth",
@@ -25,16 +30,19 @@
   "devDependencies": {
     "@types/express": "5.0.6",
     "@types/mocha": "10.0.10",
-    "@types/node": "25.5.0",
-    "husky": "^9.1.7",
+    "@types/node": "25.6.2",
+    "eslint": "9.39.4",
+    "husky": "9.1.7",
+    "lint-staged": "17.0.3",
     "mocha": "11.7.5",
-    "nyc": "^18.0.0",
+    "nyc": "18.0.0",
+    "prettier": "3.8.3",
     "ts-node": "10.9.2",
     "typescript": "5.9.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.1.11",
-    "@carecard/auth-util": "3.1.12",
-    "@carecard/validate": "3.0.10"
+    "@carecard/common-util": "3.1.13",
+    "@carecard/auth-util": "3.1.13",
+    "@carecard/validate": "3.1.16"
   }
 }

package/readme.md

@@ -31,11 +31,11 @@ const verifyAdmin = verifyJwtAndRole('admin', publicKey, throwUsedTokenError);
 
 // In an Express controller/middleware
 try {
-    await verifyAdmin(req, res, next);
-    // If successful, req.jwt contains { header, payload }
-    console.log(req.jwt.payload.sub);
+  await verifyAdmin(req, res, next);
+  // If successful, req.jwt contains { header, payload }
+  console.log(req.jwt.payload.sub);
 } catch (error) {
-    // Handle verification error
+  // Handle verification error
 }
 ```
 
@@ -46,7 +46,7 @@ const { verifyJwt, isJwtExpired } = require('@carecard/jwt-read');
 
 const result = verifyJwt(rawJwt, publicKey);
 if (result && !isJwtExpired(result)) {
-    console.log('JWT is valid and not expired:', result.payload);
+  console.log('JWT is valid and not expired:', result.payload);
 }
 ```
 
@@ -82,6 +82,7 @@ npm run test:types
 ## Architecture
 
 The package is organized into several modules:
+
 - `jwtLib`: Main logic for JWT verification, extraction, and Express integration.
 - `jwtRoles`: Role mapping between internal codes and names.