@carecard/jwt-read 3.1.27 → 3.1.28

package/index.d.ts

@@ -281,11 +281,16 @@ export interface JwtContext {
   user_id: string | undefined;
   /** The role of the user. Only set to 'super_admin' when roles contains 'ad'. */
   role?: string;
+  /** Decoded scoped authorization claims from X-Authorization-Context when verified and attached. */
+  authorizationContext?: UserAuthorizationPayload;
+  /** The verified scoped authorization object attached to the request. */
+  userAuthorization?: UserAuthorizationRequestObject;
 }
 
 /**
  * Returns the context derived from the JWT in req.jwt.
  * Always returns user_id. If the roles array contains 'ad', also returns role: 'super_admin'.
+ * If req.userAuthorization is present, also returns authorizationContext and userAuthorization.
  */
 export function jwtGetContext(req: any): JwtContext;
 

package/lib/jwtRoles.js

@@ -25,15 +25,27 @@ function getCodeFromNameOfRole(roleName) {
 function getContext(req) {
   const userId = jwtClientId(req);
   const roles = req.jwt?.payload?.roles;
+  const userAuthorization = getUserAuthorization(req);
+  const context = {
+    user_id: userId,
+  };
 
   if (Array.isArray(roles) && roles.includes('ad')) {
-    return {
-      user_id: userId,
-      role: 'super_admin',
-    };
+    context.role = 'super_admin';
   }
 
-  return {
-    user_id: userId,
-  };
+  if (userAuthorization) {
+    context.authorizationContext = userAuthorization.payload;
+    context.userAuthorization = userAuthorization;
+  }
+
+  return context;
+}
+
+function getUserAuthorization(req) {
+  const userAuthorization = req?.userAuthorization;
+  if (!userAuthorization || typeof userAuthorization !== 'object') return null;
+  if (!userAuthorization.payload || typeof userAuthorization.payload !== 'object') return null;
+
+  return userAuthorization;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.1.27",
+  "version": "3.1.28",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"

package/readme.md

@@ -174,6 +174,12 @@ leaves `req.userAuthorization` as `null`. If the header is present but invalid,
 throwing middleware fails closed. No-throw middleware clears
 `req.userAuthorization` and continues.
 
+`jwtGetContext(req)` preserves the normal database caller shape of `user_id`
+and optional `role`. When a verified `req.userAuthorization.payload` is present,
+it also returns `authorizationContext` with those compact claims and the original
+`userAuthorization` object so service models can set `app.authz_context` for
+RLS without rebuilding the full authorization graph.
+
 ## Testing
 
 Run tests using: