@devmoods/express-extras 0.43.0 → 0.44.1

package/dist/auth.d.ts

@@ -44,6 +44,7 @@ export interface AuthOptions<UserModel extends AnyUser> {
     providers: AuthProvider<UserModel>[];
     redis: RedisClient;
     filterUser(user: UserModel): Partial<UserModel>;
+    loginUrl?: string;
 }
 export interface CreateAuth<UserModel extends AnyUser> {
     createRouter: () => Router;
@@ -54,7 +55,7 @@ export interface CreateAuth<UserModel extends AnyUser> {
 export type AuthMiddlewareOptions<UserModel extends AnyUser> = false | {
     isAuthorized?: (user: UserModel) => Promise<boolean> | boolean;
 };
-export declare function createAuth<UserModel extends AnyUser>({ getUserByToken, filterUser, redis, providers, }: AuthOptions<UserModel>): CreateAuth<UserModel>;
+export declare function createAuth<UserModel extends AnyUser>({ getUserByToken, filterUser, redis, providers, loginUrl, }: AuthOptions<UserModel>): CreateAuth<UserModel>;
 /**
  * Extract a Bearer token from the HTTP Authorization header
  * of `req`.
@@ -66,6 +67,7 @@ export declare function parseAuthorizationHeader(req: Request): string | null;
  * Checks multiple places and uses the first match. Priority:
  *   1. Request header `Authorization: `
  *   2. Cookie named `access_token`
+ *
  */
 export declare function extractAccessTokenFromRequest(req: Request): string | null;
 /**

package/dist/auth.js

@@ -5,7 +5,7 @@ import jwt from 'jsonwebtoken';
 import { v4 } from 'uuid';
 import { config } from './config.js';
 import { setContext, useContext } from './context.js';
-import { ApiError, BadRequest, Forbidden, NotFound, Unauthorized, } from './errors.js';
+import { BadRequest, Forbidden, NotFound, Unauthorized } from './errors.js';
 import { getLogger } from './logger.js';
 import { route } from './middleware.js';
 import {} from './redis.js';
@@ -40,7 +40,7 @@ export function decodeAuthToken(token, secret = AUTH_SECRET) {
         return { ...decoded };
     }
     catch (error) {
-        throw new Error(`Failed to decode auth token: ${error.message}`);
+        throw new InvalidToken(`Failed to decode auth token: ${error.message}`);
     }
 }
 export function EmailAndPasswordAuthProvider(options) {
@@ -140,7 +140,7 @@ export function EmailAndPasswordAuthProvider(options) {
         },
     };
 }
-export function createAuth({ getUserByToken, filterUser, redis, providers, }) {
+export function createAuth({ getUserByToken, filterUser, redis, providers, loginUrl = '/', }) {
     const useCurrentUser = () => useContext('currentUser');
     const setCurrentUser = (user) => setContext('currentUser', user);
     const login = async (res, user) => {
@@ -170,7 +170,7 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, }) {
                 await redis.del(token);
             }
             setAccessTokenCookie(res, null);
-            res.redirect('/');
+            res.redirect(loginUrl);
         }));
         /**
          * Check that a reset token is valid.
@@ -230,21 +230,34 @@ export function createAuth({ getUserByToken, filterUser, redis, providers, }) {
                     throw new InvalidToken('token expired');
                 }
                 const decoded = decodeAuthToken(token);
-                const user = await getUserByToken(decoded);
+                let user;
+                try {
+                    user = await getUserByToken(decoded);
+                }
+                catch {
+                    throw new InvalidToken('User not found');
+                }
                 if (options.isAuthorized && !(await options.isAuthorized(user))) {
-                    throw Forbidden('Permission denied');
+                    throw new PermissionDenied('Permission denied');
                 }
                 setCurrentUser(user);
                 next();
             }
             catch (error) {
                 logger.error(error);
-                if (error instanceof ApiError) {
-                    next(error);
+                if (error instanceof PermissionDenied) {
+                    if (req.accepts('html')) {
+                        return res.redirect(loginUrl);
+                    }
+                    return next(Forbidden('Permission denied'));
                 }
-                else {
-                    next(Unauthorized('Invalid token'));
+                if (error instanceof InvalidToken) {
+                    if (req.accepts('html')) {
+                        return res.redirect(loginUrl);
+                    }
+                    return next(Unauthorized('Invalid token'));
                 }
+                next(error);
             }
         };
     }
@@ -284,7 +297,7 @@ export function parseAuthorizationHeader(req) {
         .split(' ')
         .map((s) => s.trim());
     if (token && type !== 'Bearer') {
-        throw new Error('Only Bearer type supported in jwt()');
+        throw new InvalidToken('Only Bearer type supported in jwt()');
     }
     // No token given, this is not necessarilly an error case
     if (!token) {
@@ -302,6 +315,7 @@ export function parseAuthorizationHeader(req) {
  * Checks multiple places and uses the first match. Priority:
  *   1. Request header `Authorization: `
  *   2. Cookie named `access_token`
+ *
  */
 export function extractAccessTokenFromRequest(req) {
     const authorizationHeader = parseAuthorizationHeader(req);
@@ -340,6 +354,12 @@ class InvalidToken extends Error {
         this.name = 'Invalid Token';
     }
 }
+class PermissionDenied extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'Permission Denied';
+    }
+}
 /**
  * Compare two password hashes using bcrypt.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.43.0",
+  "version": "0.44.1",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,7 +18,7 @@
   ],
   "license": "ISC",
   "devDependencies": {
-    "@devmoods/eslint-config": "^2.1.0",
+    "@devmoods/eslint-config": "^2.5.0",
     "@types/koa-compose": "^3.2.8",
     "@types/node": "22.10.1",
     "@types/supertest": "^6.0.2",
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^8.42.0",
-    "@sentry/profiling-node": "^8.42.0",
+    "@sentry/node": "^8.43.0",
+    "@sentry/profiling-node": "^8.43.0",
     "@types/bcrypt": "^5.0.2",
     "@types/body-parser": "^1.19.5",
     "@types/cookie-parser": "^1.4.8",
@@ -55,7 +55,7 @@
     "compose-middleware": "^5.0.1",
     "cookie-parser": "^1.4.7",
     "dotenv": "^16.4.7",
-    "express": "^4.21.1",
+    "express": "^4.21.2",
     "helmet": "^8.0.0",
     "jsonwebtoken": "^9.0.2",
     "nodemailer": "^6.9.16",