@carecard/jwt-read 3.1.13 → 3.1.15

package/lib/jwtRoles.js

@@ -1,20 +1,39 @@
+const { jwtClientId } = require('./jwtLib');
+
 module.exports = {
-    getNameOfRoleFromCode,
-    getCodeFromNameOfRole,
+  getNameOfRoleFromCode,
+  getCodeFromNameOfRole,
+  getContext,
+};
+
+function getNameOfRoleFromCode(roleCode) {
+  const codesToCategory = {
+    ad: 'admin',
+    su: 'super_admin',
+  };
+  return codesToCategory[roleCode] || '';
 }
 
-function getNameOfRoleFromCode( roleCode ) {
-    const codesToCategory = {
-        "ad": "admin",
-        "su": "super_admin",
-    };
-    return codesToCategory[ roleCode ] || "";
+function getCodeFromNameOfRole(roleName) {
+  const namesToCode = {
+    admin: 'ad',
+    super_admin: 'su',
+  };
+  return namesToCode[roleName] || '';
 }
 
-function getCodeFromNameOfRole( roleName ) {
-    const namesToCode = {
-        "admin": "ad",
-        "super_admin": "su",
+function getContext(req) {
+  const userId = jwtClientId(req);
+  const roles = req.jwt?.payload?.roles;
+
+  if (Array.isArray(roles) && roles.includes('ad')) {
+    return {
+      user_id: userId,
+      role: 'super_admin',
     };
-    return namesToCode[ roleName ] || "";
+  }
+
+  return {
+    user_id: userId,
+  };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.1.13",
+  "version": "3.1.15",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
@@ -9,10 +9,15 @@
   "main": "index.js",
   "types": "index.d.ts",
   "scripts": {
-    "test": "export NODE_ENV=test && mocha --recursive",
+    "test": "mocha --recursive",
     "test:types": "tsc --noEmit && mocha -r ts-node/register test/types.test.ts",
-    "test:coverage": "tsc --noEmit && export NODE_ENV=test && nyc mocha --recursive -r ts-node/register 'test/**/*.{js,ts}'",
-    "prepare": "husky"
+    "test:coverage": "tsc --noEmit && nyc mocha --recursive -r ts-node/register 'test/**/*.{js,ts}'",
+    "test:All": "npm run test && npm run test:types",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "prepare": "husky",
+    "lint:fix": "eslint --fix",
+    "lint": "eslint"
   },
   "keywords": [
     "auth",
@@ -25,16 +30,19 @@
   "devDependencies": {
     "@types/express": "5.0.6",
     "@types/mocha": "10.0.10",
-    "@types/node": "25.5.0",
-    "husky": "^9.1.7",
-    "mocha": "11.7.5",
-    "nyc": "^18.0.0",
+    "@types/node": "25.9.1",
+    "eslint": "9.39.4",
+    "husky": "9.1.7",
+    "lint-staged": "17.0.5",
+    "mocha": "11.7.6",
+    "nyc": "18.0.0",
+    "prettier": "3.8.3",
     "ts-node": "10.9.2",
-    "typescript": "5.9.3"
+    "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.1.11",
-    "@carecard/auth-util": "3.1.12",
-    "@carecard/validate": "3.0.10"
+    "@carecard/common-util": "3.1.15",
+    "@carecard/auth-util": "3.1.15",
+    "@carecard/validate": "3.1.24"
   }
 }

package/readme.md

@@ -12,6 +12,7 @@ Utility package for reading, parsing, and verifying JWTs in the CareCard ecosyst
 - **Role Mapping**: Simple utility for translating internal role codes to human-readable names.
 - **Claims Extraction**: Easy extraction of `sub` (clientId) and other JWT payload claims.
 - **Expiration Management**: Helpers to check if a JWT is expired and calculate its remaining TTL.
+- **Service JWTs**: Helpers for verifying and extracting microservice-to-microservice JWTs with standard `iss`, `sub`, `aud`, `iat`, and `exp` claims.
 
 ## Installation
 
@@ -31,11 +32,11 @@ const verifyAdmin = verifyJwtAndRole('admin', publicKey, throwUsedTokenError);
 
 // In an Express controller/middleware
 try {
-    await verifyAdmin(req, res, next);
-    // If successful, req.jwt contains { header, payload }
-    console.log(req.jwt.payload.sub);
+  await verifyAdmin(req, res, next);
+  // If successful, req.jwt contains { header, payload }
+  console.log(req.jwt.payload.sub);
 } catch (error) {
-    // Handle verification error
+  // Handle verification error
 }
 ```
 
@@ -46,7 +47,7 @@ const { verifyJwt, isJwtExpired } = require('@carecard/jwt-read');
 
 const result = verifyJwt(rawJwt, publicKey);
 if (result && !isJwtExpired(result)) {
-    console.log('JWT is valid and not expired:', result.payload);
+  console.log('JWT is valid and not expired:', result.payload);
 }
 ```
 
@@ -59,6 +60,34 @@ console.log(getNameOfRole('ad')); // Result: 'admin'
 console.log(getCodeOfRole('super_admin')); // Result: 'su'
 ```
 
+### Service-To-Service JWTs
+
+Use service JWT verification helpers for backend service calls. The sending
+service signs the token with `@carecard/auth-util`. The receiving service uses
+this package to verify the token with the sending service public key and check
+the expected issuer and audience.
+
+```javascript
+const { jwtCreateServiceAuthorizationHeader } = require('@carecard/auth-util');
+const { jwtVerifyService } = require('@carecard/jwt-read');
+
+const authorization = jwtCreateServiceAuthorizationHeader({
+  issuer: 'ms-institutions',
+  audience: 'ms-auth',
+  privateKey: institutionsPrivateKey,
+});
+
+app.use(jwtVerifyService(institutionsPublicKey, 'ms-institutions', 'ms-auth', throwNotAuthorizedError));
+```
+
+Service JWT payloads follow standard JWT semantics:
+
+- `iss`: sending service
+- `sub`: sending service identity
+- `aud`: receiving service
+- `iat`: issued-at NumericDate
+- `exp`: expiration NumericDate
+
 ## Testing
 
 Run tests using:
@@ -82,6 +111,7 @@ npm run test:types
 ## Architecture
 
 The package is organized into several modules:
+
 - `jwtLib`: Main logic for JWT verification, extraction, and Express integration.
 - `jwtRoles`: Role mapping between internal codes and names.