@dotpress/auth 1.0.1 → 1.1.1

package/dist/lib/handlers.js

@@ -14,6 +14,7 @@ export const registerHandlers = (plugin) => {
                 username: z.string(),
                 password: z.string(),
                 client: z.string().optional(),
+                aud: settings.aud?.required ? z.string() : z.string().optional(),
             }),
             response: z.object({
                 userId: z.string(),
@@ -22,7 +23,7 @@ export const registerHandlers = (plugin) => {
             }),
         }),
         handler: async ({ req }) => {
-            const { username, password, client } = req.body;
+            const { username, password, client, aud } = req.body;
             const ipAddress = getRequestIp(req);
             const user = await settings.dataProvider.findUserIdentifiers(username);
             if (!user) {
@@ -48,9 +49,24 @@ export const registerHandlers = (plugin) => {
                 }
                 return unauthorizedError('INVALID_LOGIN');
             }
+            if (aud && typeof settings.aud?.isUserRoleAllowed === 'function') {
+                const isAllowed = settings.aud.isUserRoleAllowed(user.role || '', aud);
+                if (!isAllowed) {
+                    if (settings.onLoginFailed) {
+                        await settings.onLoginFailed({
+                            username,
+                            errorType: 'invalid_role',
+                            client: client || '',
+                            ipAddress: ipAddress || '',
+                        });
+                    }
+                    return unauthorizedError('INVALID_LOGIN');
+                }
+            }
             const { accessToken, refreshToken } = await generateTokensForUser({
                 username,
                 userId: user.userId,
+                aud,
             });
             if (settings.onLoginSuccess) {
                 await settings.onLoginSuccess({

package/dist/lib/tokens.d.ts

@@ -3,6 +3,7 @@ type CreateTokenPayload = {
     sub: string;
     username: string;
     auth_time: number;
+    aud?: string;
 };
 type CreatedAccessToken = {
     jwtId: string;
@@ -15,14 +16,15 @@ type CreatedRefreshToken = {
 type UserIdentifiers = {
     userId: string;
     username: string;
+    aud?: string;
 };
 export declare const createAccessTokenFromPayload: (payload: CreateTokenPayload) => CreatedAccessToken;
 export declare const generateRefreshToken: () => CreatedRefreshToken;
 /**
  * Generate a pair of access and refresh tokens for a given user
  */
-export declare const generateTokensForUser: ({ userId, username, }: UserIdentifiers) => Promise<TokenPair>;
-export declare const generateAccessToken: ({ userId, username, }: UserIdentifiers) => CreatedAccessToken;
+export declare const generateTokensForUser: ({ userId, username, aud, }: UserIdentifiers) => Promise<TokenPair>;
+export declare const generateAccessToken: ({ userId, username, aud, }: UserIdentifiers) => CreatedAccessToken;
 /**
  * Regenerate a pair of token using a refresh token
  * Expired access token must be provided in order to validate userId and jwtId

package/dist/lib/tokens.js

@@ -27,9 +27,9 @@ export const generateRefreshToken = () => {
 /**
  * Generate a pair of access and refresh tokens for a given user
  */
-export const generateTokensForUser = async ({ userId, username, }) => {
+export const generateTokensForUser = async ({ userId, username, aud, }) => {
     const settings = getSettings();
-    const { jwtId, accessToken } = generateAccessToken({ userId, username });
+    const { jwtId, accessToken } = generateAccessToken({ userId, username, aud });
     const { token: refreshToken, tokenHash: refreshTokenHash } = generateRefreshToken();
     await settings.dataProvider.storeRefreshToken({
         token: refreshToken,
@@ -43,11 +43,12 @@ export const generateTokensForUser = async ({ userId, username, }) => {
         refreshToken,
     };
 };
-export const generateAccessToken = ({ userId, username, }) => {
+export const generateAccessToken = ({ userId, username, aud, }) => {
     return createAccessTokenFromPayload({
         sub: userId,
         username,
         auth_time: Math.floor(Date.now() / 1000),
+        aud,
     });
 };
 const addDaysFromNow = (days) => {

package/dist/types/types.d.ts

@@ -16,6 +16,10 @@ export type AuthSettings = {
     issuer: string;
     onLoginFailed?: (e: LoginFailedEvent) => Promise<void>;
     onLoginSuccess?: (e: LoginSuccessEvent) => Promise<void>;
+    aud?: {
+        required?: boolean;
+        isUserRoleAllowed: (role: string, aud: string) => boolean;
+    };
 };
 type LoginFailedEvent = {
     username: string;
@@ -69,6 +73,7 @@ export type DataProvider = {
     findUserIdentifiers: (username: string) => Promise<{
         userId: string;
         passwordHash: string;
+        role?: string;
     } | undefined>;
 };
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotpress/auth",
-  "version": "1.0.1",
+  "version": "1.1.1",
   "description": "JWT Authentication plugin for Dotpress library",
   "author": "Renaud Guyon",
   "license": "MIT",