@dotpress/auth 1.0.1 → 1.1.0

package/dist/lib/handlers.js

@@ -14,6 +14,7 @@ export const registerHandlers = (plugin) => {
                 username: z.string(),
                 password: z.string(),
                 client: z.string().optional(),
+                aud: settings.aud?.required ? z.string() : z.string().optional(),
             }),
             response: z.object({
                 userId: z.string(),
@@ -22,7 +23,7 @@ export const registerHandlers = (plugin) => {
             }),
         }),
         handler: async ({ req }) => {
-            const { username, password, client } = req.body;
+            const { username, password, client, aud } = req.body;
             const ipAddress = getRequestIp(req);
             const user = await settings.dataProvider.findUserIdentifiers(username);
             if (!user) {
@@ -48,6 +49,20 @@ export const registerHandlers = (plugin) => {
                 }
                 return unauthorizedError('INVALID_LOGIN');
             }
+            if (aud && typeof settings.aud?.isUserRoleAllowed === 'function') {
+                const isAllowed = settings.aud.isUserRoleAllowed(user.role || '', aud);
+                if (!isAllowed) {
+                    if (settings.onLoginFailed) {
+                        await settings.onLoginFailed({
+                            username,
+                            errorType: 'invalid_role',
+                            client: client || '',
+                            ipAddress: ipAddress || '',
+                        });
+                    }
+                    return unauthorizedError('INVALID_LOGIN');
+                }
+            }
             const { accessToken, refreshToken } = await generateTokensForUser({
                 username,
                 userId: user.userId,

package/dist/types/types.d.ts

@@ -16,6 +16,10 @@ export type AuthSettings = {
     issuer: string;
     onLoginFailed?: (e: LoginFailedEvent) => Promise<void>;
     onLoginSuccess?: (e: LoginSuccessEvent) => Promise<void>;
+    aud?: {
+        required?: boolean;
+        isUserRoleAllowed: (role: string, aud: string) => boolean;
+    };
 };
 type LoginFailedEvent = {
     username: string;
@@ -69,6 +73,7 @@ export type DataProvider = {
     findUserIdentifiers: (username: string) => Promise<{
         userId: string;
         passwordHash: string;
+        role?: string;
     } | undefined>;
 };
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotpress/auth",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "JWT Authentication plugin for Dotpress library",
   "author": "Renaud Guyon",
   "license": "MIT",