@carecard/jwt-read 3.19.0 → 3.20.0

package/lib/jwtLib.js

@@ -97,6 +97,7 @@ function validateAndExtractJwtObject(req, publicKey, customErrorFunction, option
 
   if (jwtString && isJwtSignatureValid) {
     _extractJwtObject(req, jwtString, customErrorFunction);
+    requireActiveExtractedToken(req, 'jwt', customErrorFunction);
     validateAndExtractOptionalUserAuthorizationObject(req, options, customErrorFunction);
   } else {
     req['jwt'] = null;
@@ -114,6 +115,7 @@ function validateAndExtractWebToken(req, publicKey, headerName, customErrorFunct
 
   if (webTokenString && isJwtSignatureValid) {
     _extractJwtObject(req, webTokenString, customErrorFunction);
+    requireActiveExtractedToken(req, 'jwt', customErrorFunction);
     validateAndExtractOptionalUserAuthorizationObject(req, options, customErrorFunction);
   } else {
     req['jwt'] = null;
@@ -463,6 +465,7 @@ function _isLoginRequired(hasRequiredRole, customErrorFunction) {
   }
 }
 
+// Pattern: Fail-Closed Probe - accepts a bearer JWT only when signature and lifetime are valid.
 function tryValidateAndExtractJwtObject(req, publicKey) {
   const jwtString = _validateJwtNoThrow(req);
   if (!jwtString || !isJwtString(jwtString)) {
@@ -476,7 +479,11 @@ function tryValidateAndExtractJwtObject(req, publicKey) {
   }
 
   _extractJwtObjectNoThrow(req, jwtString);
-  return Boolean(req?.jwt);
+  if (!isJwtPayloadWithinLifetime(req?.jwt?.payload)) {
+    req.jwt = null;
+    return false;
+  }
+  return true;
 }
 
 function _validateServerAuthToken(req, customErrorFunction) {
@@ -564,6 +571,7 @@ function normalizeSeconds(value) {
   return value > 1000000000000 ? Math.floor(value / 1000) : Math.floor(value);
 }
 
+// Pattern: Policy - validates service identity, audience, and registered token lifetime.
 function _isServiceJwtFor(payload, expectedIssuer, expectedAudience) {
   if (!payload) {
     return false;
@@ -577,16 +585,7 @@ function _isServiceJwtFor(payload, expectedIssuer, expectedAudience) {
   if (!payloadAudienceMatches(payload.aud, expectedAudience)) {
     return false;
   }
-  if (isJwtPayloadIssuedInFuture(payload)) {
-    return false;
-  }
-  if (isJwtPayloadExpired(payload)) {
-    return false;
-  }
-  if (isJwtPayloadNotYetValid(payload)) {
-    return false;
-  }
-  return true;
+  return isJwtPayloadWithinLifetime(payload);
 }
 
 function payloadAudienceMatches(actualAudience, expectedAudience) {
@@ -629,6 +628,27 @@ function isJwtPayloadNotYetValid(payload) {
   return Math.floor(Date.now() / 1000) < nbf;
 }
 
+// Pattern: Specification - centralizes the registered time-claim policy for signed tokens.
+function isJwtPayloadWithinLifetime(payload) {
+  return (
+    Boolean(payload) &&
+    !isJwtPayloadIssuedInFuture(payload) &&
+    !isJwtPayloadExpired(payload) &&
+    !isJwtPayloadNotYetValid(payload)
+  );
+}
+
+// Pattern: Guard Clause - clears an extracted token before surfacing an authentication failure.
+function requireActiveExtractedToken(req, propertyName, customErrorFunction) {
+  if (isJwtPayloadWithinLifetime(req?.[propertyName]?.payload)) {
+    return;
+  }
+  if (req) {
+    req[propertyName] = null;
+  }
+  throwError(customErrorFunction);
+}
+
 // Pattern: Factory - normalizes direct user authorization options into one config shape.
 function createUserAuthorizationConfig(publicKey, options) {
   return normalizeUserAuthorizationConfig({
@@ -705,13 +725,7 @@ function isUserAuthorizationTokenAllowed(token, config) {
   if (!payload) {
     return false;
   }
-  if (isJwtPayloadIssuedInFuture(payload)) {
-    return false;
-  }
-  if (isJwtPayloadExpired(payload)) {
-    return false;
-  }
-  if (isJwtPayloadNotYetValid(payload)) {
+  if (!isJwtPayloadWithinLifetime(payload)) {
     return false;
   }
   if (config.expectedType && payload.typ !== config.expectedType) {
@@ -762,6 +776,7 @@ function _validateGeneric(req, headerName, extractor, customErrorFunction) {
   return null;
 }
 
+// Pattern: Fail-Closed Extraction - optional tokens survive only valid signatures and lifetimes.
 function _validateAndExtractGenericNoThrow(req, publicKey, validator, extractor, propertyName) {
   try {
     const jwtString = validator(req);
@@ -769,6 +784,9 @@ function _validateAndExtractGenericNoThrow(req, publicKey, validator, extractor,
 
     if (jwtString && isJwtSignatureValid) {
       extractor(req, jwtString);
+      if (!isJwtPayloadWithinLifetime(req?.[propertyName]?.payload)) {
+        req[propertyName] = null;
+      }
     } else {
       req[propertyName] = null;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.19.0",
+  "version": "3.20.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
@@ -47,9 +47,9 @@
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/auth-util": "3.18.0",
-    "@carecard/common-util": "3.18.0",
-    "@carecard/validate": "3.18.0"
+    "@carecard/auth-util": "3.20.0",
+    "@carecard/common-util": "3.20.0",
+    "@carecard/validate": "3.20.0"
   },
   "overrides": {
     "diff": "8.0.4",