@dotpress/auth 1.0.0 → 1.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 renoguyon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 import type { Plugin } from 'dotpress';
 import { AuthSettings, DataProvider, KeyPairSettings } from './types/types.js';
+import { generateAccessToken } from './lib/tokens.js';
 type Settings = Partial<AuthSettings> & {
     keys: KeyPairSettings;
     dataProvider: DataProvider;
 };
 export declare const configurePlugin: (settings: Settings) => Plugin;
 export declare const generatePasswordHash: (password: string, salt?: number) => Promise<string>;
-export {};
+export { generateAccessToken };

package/dist/index.js

@@ -1,7 +1,8 @@
+import bcrypt from 'bcryptjs';
 import { setSettings } from './lib/settings.js';
 import { registerHandlers } from './lib/handlers.js';
 import { attachAuthenticatedUser } from './lib/middleware.js';
-import bcrypt from 'bcryptjs';
+import { generateAccessToken } from './lib/tokens.js';
 export const configurePlugin = (settings) => {
     setSettings(settings);
     return (plugin) => {
@@ -14,3 +15,4 @@ export const configurePlugin = (settings) => {
 export const generatePasswordHash = (password, salt = 10) => {
     return bcrypt.hash(password, salt);
 };
+export { generateAccessToken };

package/dist/lib/handlers.js

@@ -14,6 +14,7 @@ export const registerHandlers = (plugin) => {
                 username: z.string(),
                 password: z.string(),
                 client: z.string().optional(),
+                aud: settings.aud?.required ? z.string() : z.string().optional(),
             }),
             response: z.object({
                 userId: z.string(),
@@ -22,7 +23,7 @@ export const registerHandlers = (plugin) => {
             }),
         }),
         handler: async ({ req }) => {
-            const { username, password, client } = req.body;
+            const { username, password, client, aud } = req.body;
             const ipAddress = getRequestIp(req);
             const user = await settings.dataProvider.findUserIdentifiers(username);
             if (!user) {
@@ -48,6 +49,20 @@ export const registerHandlers = (plugin) => {
                 }
                 return unauthorizedError('INVALID_LOGIN');
             }
+            if (aud && typeof settings.aud?.isUserRoleAllowed === 'function') {
+                const isAllowed = settings.aud.isUserRoleAllowed(user.role || '', aud);
+                if (!isAllowed) {
+                    if (settings.onLoginFailed) {
+                        await settings.onLoginFailed({
+                            username,
+                            errorType: 'invalid_role',
+                            client: client || '',
+                            ipAddress: ipAddress || '',
+                        });
+                    }
+                    return unauthorizedError('INVALID_LOGIN');
+                }
+            }
             const { accessToken, refreshToken } = await generateTokensForUser({
                 username,
                 userId: user.userId,

package/dist/lib/tokens.d.ts

@@ -22,6 +22,7 @@ export declare const generateRefreshToken: () => CreatedRefreshToken;
  * Generate a pair of access and refresh tokens for a given user
  */
 export declare const generateTokensForUser: ({ userId, username, }: UserIdentifiers) => Promise<TokenPair>;
+export declare const generateAccessToken: ({ userId, username, }: UserIdentifiers) => CreatedAccessToken;
 /**
  * Regenerate a pair of token using a refresh token
  * Expired access token must be provided in order to validate userId and jwtId

package/dist/lib/tokens.js

@@ -29,11 +29,7 @@ export const generateRefreshToken = () => {
  */
 export const generateTokensForUser = async ({ userId, username, }) => {
     const settings = getSettings();
-    const { jwtId, accessToken } = createAccessTokenFromPayload({
-        sub: userId,
-        username,
-        auth_time: Math.floor(Date.now() / 1000),
-    });
+    const { jwtId, accessToken } = generateAccessToken({ userId, username });
     const { token: refreshToken, tokenHash: refreshTokenHash } = generateRefreshToken();
     await settings.dataProvider.storeRefreshToken({
         token: refreshToken,
@@ -47,6 +43,13 @@ export const generateTokensForUser = async ({ userId, username, }) => {
         refreshToken,
     };
 };
+export const generateAccessToken = ({ userId, username, }) => {
+    return createAccessTokenFromPayload({
+        sub: userId,
+        username,
+        auth_time: Math.floor(Date.now() / 1000),
+    });
+};
 const addDaysFromNow = (days) => {
     const now = new Date();
     now.setDate(now.getDate() + days);

package/dist/types/types.d.ts

@@ -16,6 +16,10 @@ export type AuthSettings = {
     issuer: string;
     onLoginFailed?: (e: LoginFailedEvent) => Promise<void>;
     onLoginSuccess?: (e: LoginSuccessEvent) => Promise<void>;
+    aud?: {
+        required?: boolean;
+        isUserRoleAllowed: (role: string, aud: string) => boolean;
+    };
 };
 type LoginFailedEvent = {
     username: string;
@@ -69,6 +73,7 @@ export type DataProvider = {
     findUserIdentifiers: (username: string) => Promise<{
         userId: string;
         passwordHash: string;
+        role?: string;
     } | undefined>;
 };
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotpress/auth",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "JWT Authentication plugin for Dotpress library",
   "author": "Renaud Guyon",
   "license": "MIT",