@carecard/jwt-read 3.1.14 → 3.1.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.1.14",
+  "version": "3.1.15",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
@@ -30,19 +30,19 @@
   "devDependencies": {
     "@types/express": "5.0.6",
     "@types/mocha": "10.0.10",
-    "@types/node": "25.6.2",
+    "@types/node": "25.9.1",
     "eslint": "9.39.4",
     "husky": "9.1.7",
-    "lint-staged": "17.0.3",
-    "mocha": "11.7.5",
+    "lint-staged": "17.0.5",
+    "mocha": "11.7.6",
     "nyc": "18.0.0",
     "prettier": "3.8.3",
     "ts-node": "10.9.2",
-    "typescript": "5.9.3"
+    "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/common-util": "3.1.13",
-    "@carecard/auth-util": "3.1.13",
-    "@carecard/validate": "3.1.16"
+    "@carecard/common-util": "3.1.15",
+    "@carecard/auth-util": "3.1.15",
+    "@carecard/validate": "3.1.24"
   }
 }

package/readme.md

@@ -12,6 +12,7 @@ Utility package for reading, parsing, and verifying JWTs in the CareCard ecosyst
 - **Role Mapping**: Simple utility for translating internal role codes to human-readable names.
 - **Claims Extraction**: Easy extraction of `sub` (clientId) and other JWT payload claims.
 - **Expiration Management**: Helpers to check if a JWT is expired and calculate its remaining TTL.
+- **Service JWTs**: Helpers for verifying and extracting microservice-to-microservice JWTs with standard `iss`, `sub`, `aud`, `iat`, and `exp` claims.
 
 ## Installation
 
@@ -59,6 +60,34 @@ console.log(getNameOfRole('ad')); // Result: 'admin'
 console.log(getCodeOfRole('super_admin')); // Result: 'su'
 ```
 
+### Service-To-Service JWTs
+
+Use service JWT verification helpers for backend service calls. The sending
+service signs the token with `@carecard/auth-util`. The receiving service uses
+this package to verify the token with the sending service public key and check
+the expected issuer and audience.
+
+```javascript
+const { jwtCreateServiceAuthorizationHeader } = require('@carecard/auth-util');
+const { jwtVerifyService } = require('@carecard/jwt-read');
+
+const authorization = jwtCreateServiceAuthorizationHeader({
+  issuer: 'ms-institutions',
+  audience: 'ms-auth',
+  privateKey: institutionsPrivateKey,
+});
+
+app.use(jwtVerifyService(institutionsPublicKey, 'ms-institutions', 'ms-auth', throwNotAuthorizedError));
+```
+
+Service JWT payloads follow standard JWT semantics:
+
+- `iss`: sending service
+- `sub`: sending service identity
+- `aud`: receiving service
+- `iat`: issued-at NumericDate
+- `exp`: expiration NumericDate
+
 ## Testing
 
 Run tests using: