@carecard/jwt-read 3.8.0 → 3.10.0

package/.agents/skills/carecard-workspace-standards/SKILL.md

@@ -7,6 +7,8 @@ description: 'Follow the shared SO_CareCardCa/CareCard workspace coding, testing
 
 Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
 
+Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose
@@ -212,7 +214,7 @@ build artifacts, logs, or `.DS_Store`.
 
 Most JavaScript `ms-*` services use CommonJS, Mocha, Supertest, Docker Compose
 database tests, `@carecard/*` packages, and `sub-apps`
-controller/router/model patterns. TypeScript services such as `ms-contact-us`
+controller/router/model patterns. TypeScript services such as `ms-messages`
 and `ms-template-ts` use Jest or TypeScript tooling and should keep their
 existing TypeScript style.
 
@@ -311,7 +313,7 @@ existing TypeScript style.
 
 `app-dashboard` is a Next.js App Router TypeScript app using MUI, React Query,
 `next-intl`, and shared CareCard utilities. It consumes `ms-auth`,
-`ms-institutions`, `ms-contact-us`, and `ms-user-profiles` through service
+`ms-institutions`, `ms-messages`, and `ms-user-profiles` through service
 modules.
 
 - Keep backend URL definitions centralized in `src/services/api.routes.ts`.

package/.agents/skills/github-pr-create-update/SKILL.md

@@ -7,6 +7,8 @@ description: 'Use only when the user explicitly asks for remote Git or GitHub PR
 
 Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
 
+Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose

package/.agents/skills/github-pr-merge-cleanup/SKILL.md

@@ -7,6 +7,8 @@ description: 'Use only when the user explicitly asks for remote Git or GitHub PR
 
 Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
 
+Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose

package/.agents/skills/pkg-jwt-read-jwt-middleware-library/SKILL.md

@@ -7,6 +7,8 @@ description: 'Use when changing pkg-jwt-read JWT parsing, middleware, visitor to
 
 Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
 
+Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose
@@ -118,6 +120,9 @@ depend on those folders being present.
 - Server-auth request attachment behavior that normalizes introspected claims
   into `req.jwt.payload` with `authMode: "server-auth"` and
   `auth_mode: "server-auth"`.
+- Server-auth email confirmation claims are copied only when present. The
+  `emailVerified`, `email_verified`, `emailConfirmed`, and `email_confirmed`
+  aliases retain their exact names and values, and omission remains omission.
 - Integration with `@carecard/common-util` for standardized login and
   authorization errors.
 

package/.agents/skills/pkg-publish/SKILL.md

@@ -7,6 +7,8 @@ description: 'Use when any pkg-* repository has non-Markdown package changes, in
 
 Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
 
+Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Trigger

package/.agents/skills/software-design-patterns-and-clean-code/SKILL.md

@@ -7,6 +7,8 @@ description: 'Use every time before coding, refactoring, debugging, or reviewing
 
 Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
 
+Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose

package/lib/jwtLib.js

@@ -5,6 +5,7 @@ const { throwLoginRequiredError, throwNotAuthorizedError } = require('@carecard/
 
 const DEFAULT_USER_AUTHORIZATION_HEADER_NAME = 'X-Authorization-Context';
 const DEFAULT_USER_AUTHORIZATION_MAX_TOKEN_LENGTH = 2048;
+const EMAIL_CONFIRMATION_CLAIM_NAMES = ['emailVerified', 'email_verified', 'emailConfirmed', 'email_confirmed'];
 
 function jwtClientId(req) {
   const jwtObj = req?.jwt || this;
@@ -437,11 +438,22 @@ function attachServerAuthClaims(req, claims, customErrorFunction) {
   _attachJwtMethods(req.jwt);
 }
 
+// Pattern: Projection - copies only authoritative confirmation aliases and preserves their exact values.
+function pickEmailConfirmationClaims(claims) {
+  return Object.fromEntries(
+    EMAIL_CONFIRMATION_CLAIM_NAMES.filter(claimName => Object.prototype.hasOwnProperty.call(claims, claimName)).map(claimName => [
+      claimName,
+      claims[claimName],
+    ]),
+  );
+}
+
+// Pattern: Mapper - attaches server-auth metadata while preserving authoritative confirmation claims.
 function createServerAuthPayload(claims) {
   return {
     sub: claims.sub || claims.userId || claims.user_id,
     email: claims.email || '',
-    email_verified: claims.emailVerified || claims.email_verified || claims.emailConfirmed || claims.email_confirmed || false,
+    ...pickEmailConfirmationClaims(claims),
     roles: Array.isArray(claims.roles) ? claims.roles : [],
     authMode: 'server-auth',
     auth_mode: 'server-auth',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carecard/jwt-read",
-  "version": "3.8.0",
+  "version": "3.10.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/CareCard-ca/pkg-jwt-read.git"
@@ -41,9 +41,9 @@
     "typescript": "6.0.3"
   },
   "dependencies": {
-    "@carecard/auth-util": "3.8.0",
-    "@carecard/common-util": "3.8.0",
-    "@carecard/validate": "3.8.0"
+    "@carecard/auth-util": "3.10.0",
+    "@carecard/common-util": "3.10.0",
+    "@carecard/validate": "3.10.0"
   },
   "overrides": {
     "diff": "8.0.4",

package/readme.md

@@ -12,6 +12,8 @@ introspected by `ms-auth`.
 
 Non-negotiable TDD rule: Always write the failing test first, run it to confirm it fails for the intended reason, then implement the code and rerun the test until it passes. Test Driven Development is required for all coding work and must not be skipped. For documentation- or skill-only edits, add or update the relevant validation check before changing the prose.
 
+Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Features
@@ -142,6 +144,10 @@ those claims onto `req.jwt.payload` with `authMode: "server-auth"` and
 `auth_mode: "server-auth"` so services can keep their existing JWT-backed
 database context and role checks.
 
+Server-auth email confirmation claims are copied only when present. The
+`emailVerified`, `email_verified`, `emailConfirmed`, and `email_confirmed`
+aliases retain their exact names and values, and omission remains omission.
+
 ### Scoped User Authorization Context
 
 Use `jwtVerifyUserAuthorization` when a route needs to verify only the compact