@carecard/jwt-read 3.1.27 → 3.1.29

package/.agents/skills/pkg-jwt-read-jwt-middleware-library/SKILL.md

@@ -106,6 +106,11 @@ depend on those folders being present.
 - Request attachment behavior for authenticated JWT objects and visitor tokens.
 - Request attachment behavior for compact scoped authorization-context JWTs
   from `X-Authorization-Context` as `req.userAuthorization`.
+- Shared header defaults for scoped authorization context:
+  `DEFAULT_USER_AUTHORIZATION_HEADER_NAME` and
+  `DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH`. Token issuers and consuming
+  services should import these constants instead of duplicating the header name
+  or 2048-character limit.
 - Server-auth request attachment behavior that normalizes introspected claims
   into `req.jwt.payload` with `authMode: "server-auth"` and
   `auth_mode: "server-auth"`.

package/index.d.ts

@@ -4,6 +4,9 @@
 
 import { NextFunction, Request, Response } from 'express';
 
+export const DEFAULT_USER_AUTHORIZATION_HEADER_NAME: 'X-Authorization-Context';
+export const DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH: 2048;
+
 /**
  * Represents the standard JWT header structure.
  */
@@ -281,11 +284,16 @@ export interface JwtContext {
   user_id: string | undefined;
   /** The role of the user. Only set to 'super_admin' when roles contains 'ad'. */
   role?: string;
+  /** Decoded scoped authorization claims from X-Authorization-Context when verified and attached. */
+  authorizationContext?: UserAuthorizationPayload;
+  /** The verified scoped authorization object attached to the request. */
+  userAuthorization?: UserAuthorizationRequestObject;
 }
 
 /**
  * Returns the context derived from the JWT in req.jwt.
  * Always returns user_id. If the roles array contains 'ad', also returns role: 'super_admin'.
+ * If req.userAuthorization is present, also returns authorizationContext and userAuthorization.
  */
 export function jwtGetContext(req: any): JwtContext;
 

package/index.js

@@ -2,6 +2,8 @@ const jwtLib = require('./lib/jwtLib');
 const jwtRoles = require('./lib/jwtRoles');
 
 module.exports = {
+  DEFAULT_USER_AUTHORIZATION_HEADER_NAME: jwtLib.DEFAULT_USER_AUTHORIZATION_HEADER_NAME,
+  DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH: jwtLib.DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH,
   jwtVerify: jwtLib.verifyJwt,
   jwtVerifyWebToken: jwtLib.verifyWebToken,
   jwtVerifyNoThrow: jwtLib.verifyJwtNoThrow,

package/lib/jwtLib.js

@@ -752,6 +752,8 @@ function _extractWebTokenNoThrow(jwtRaw) {
 }
 
 module.exports = {
+  DEFAULT_USER_AUTHORIZATION_HEADER_NAME,
+  DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH,
   _validateJwt,
   _validateJwtNoThrow,
   _isJwtSignatureValid,

package/lib/jwtRoles.js

@@ -25,15 +25,27 @@ function getCodeFromNameOfRole(roleName) {
 function getContext(req) {
   const userId = jwtClientId(req);
   const roles = req.jwt?.payload?.roles;
+  const userAuthorization = getUserAuthorization(req);
+  const context = {
+    user_id: userId,
+  };
 
   if (Array.isArray(roles) && roles.includes('ad')) {
-    return {
-      user_id: userId,
-      role: 'super_admin',
-    };
+    context.role = 'super_admin';
   }
 
-  return {
-    user_id: userId,
-  };
+  if (userAuthorization) {
+    context.authorizationContext = userAuthorization.payload;
+    context.userAuthorization = userAuthorization;
+  }
+
+  return context;
+}
+
+function getUserAuthorization(req) {
+  const userAuthorization = req?.userAuthorization;
+  if (!userAuthorization || typeof userAuthorization !== 'object') return null;
+  if (!userAuthorization.payload || typeof userAuthorization.payload !== 'object') return null;
+
+  return userAuthorization;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.1.27",
+  "version": "3.1.29",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"

package/readme.md

@@ -141,6 +141,9 @@ database context and role checks.
 Use `jwtVerifyUserAuthorization` when a route needs to verify only the compact
 authorization-context token carried in `X-Authorization-Context`. The token is
 read as a raw JWT header value, not as `Bearer <token>`.
+The exported `DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH` is `2048`; token
+issuers and consumers should use that shared constant instead of duplicating a
+local limit.
 
 ```javascript
 const { jwtVerifyUserAuthorization } = require('@carecard/jwt-read');
@@ -174,6 +177,12 @@ leaves `req.userAuthorization` as `null`. If the header is present but invalid,
 throwing middleware fails closed. No-throw middleware clears
 `req.userAuthorization` and continues.
 
+`jwtGetContext(req)` preserves the normal database caller shape of `user_id`
+and optional `role`. When a verified `req.userAuthorization.payload` is present,
+it also returns `authorizationContext` with those compact claims and the original
+`userAuthorization` object so service models can set `app.authz_context` for
+RLS without rebuilding the full authorization graph.
+
 ## Testing
 
 Run tests using: