@easyweb/authentication 1.0.0 → 2.1.0

package/README.md

@@ -1,10 +1,56 @@
 # @easyweb/authentication
 
 Shared authentication primitives for Easyweb microservices — stateless JWT middleware,
-request-context middleware, and the HTTP error classes every service throws.
+request-context middleware, and the token verification helpers services build on.
 
-Companion to [`@easyweb/rabbitmq-utils`](https://www.npmjs.com/package/@easyweb/rabbitmq-utils),
-which covers events and observability.
+Companion to [`@easyweb/events`](https://www.npmjs.com/package/@easyweb/events) for
+messaging, and [`@easyweb/errors`](https://www.npmjs.com/package/@easyweb/errors) for
+the HTTP error taxonomy.
+
+## 2.1.0 — `SUPER_ADMIN` now satisfies `authorize(["ADMIN"])`
+
+`authorize()` was an exact string match. Every admin route in the platform is written
+`authorize(["ADMIN"])`, and auth-service's `admin-seed.ts` grants the bootstrap operator
+`SUPER_ADMIN` by default — so the seeded account could not call a single admin route on
+the platform.
+
+`SUPER_ADMIN` now implies `ADMIN`. Nothing else implies anything: `ADMIN` deliberately
+does **not** imply `USER`, because that edge would silently widen every future customer
+route to staff.
+
+**Additive, and widening only.** A service still on 2.0.0 behaves exactly as it did —
+`SUPER_ADMIN` simply stays locked out there — so this needs no coordinated deploy. Since
+every service declares `^2.0.0` but installs from a lockfile, pick it up with:
+
+```bash
+npm i @easyweb/authentication@^2.1.0
+```
+
+The new `effectiveRoles(roles)` export does the same expansion for a service with its own
+guard (auth-service's DB-backed middleware, in particular).
+
+The status is unchanged: `authorize()` still throws `NotAuthorizedError`, which is **401**
+even for a signed-in caller with the wrong role. Every service's http suite pins that.
+A caller needing to tell "not signed in" from "not permitted" must check the role itself.
+
+## Upgrading to 2.0.0 — BREAKING
+
+The error classes moved to `@easyweb/errors`. Error handling is cross-cutting and has
+nothing to do with JWTs; a service needing `ConflictError` should not have to depend on
+an auth package for it.
+
+```diff
+- import { NotAuthorizedError } from "@easyweb/authentication";
++ import { NotAuthorizedError } from "@easyweb/errors";
+```
+
+`@easyweb/errors` is a **peerDependency** — install it alongside this package. Do not let
+it end up nested under `node_modules/@easyweb/authentication/`: two copies of
+`CustomError` means `instanceof` fails across the boundary and the error handler answers
+500 for everything, with no type error to warn you. Verify with `npm ls @easyweb/errors`.
+
+Also new in 2.0.0: `extractToken` and `isValidAccessPayload` are exported, for services
+that keep their own DB-backed middleware (see below) and would otherwise copy them.
 
 ## Install
 
@@ -23,11 +69,7 @@ package never has to reach into a service's `config` module.
 ```ts
 import express from "express";
 import cookieParser from "cookie-parser";
-import {
-  createAuthMiddleware,
-  requestContext,
-  NotAuthorizedError,
-} from "@easyweb/authentication";
+import { createAuthMiddleware, requestContext } from "@easyweb/authentication";
 import config from "./config";
 
 const app = express();
@@ -83,9 +125,17 @@ would deny every request.
 | `requestContext` | propagates / generates `x-request-id` |
 | `createJwtVerifier(config)` | `(token) => JwtAccessPayload`, throws on invalid |
 | `createJwtSigner(config)` | `(claims) => string` |
-| `CustomError`, `BadRequestError`, `NotAuthorizedError`, `NotFoundError`, `DatabaseConnectionError` | shared error hierarchy |
+| `extractToken(req)` | Bearer header, then the `accessToken` cookie |
+| `isValidAccessPayload(decoded)` | type guard: is this a well-formed *access* token? |
+| `effectiveRoles(roles)` | the roles held, expanded through the implication map (2.1.0) |
+| `effectiveRoles(roles)` | the roles held, expanded through the implication map (2.1.0) |
 | `JwtAccessPayload`, `JwtAccessClaims`, `JwtVerifyConfig`, `JwtSignConfig` | types |
 
+`extractToken` and `isValidAccessPayload` exist for services that must keep a DB-backed
+middleware. They were previously private, so auth-service copied them — and the copies
+drifted. If you need the same checks with different error messages, import these rather
+than reimplementing them.
+
 Importing the package also augments `Express.Request` with `user`, `auth`, and
 `requestId`. Remove any local copy of that `declare global` block or TypeScript will
 report duplicate members.

package/dist/index.d.ts

@@ -1,4 +1,3 @@
-export * from "./errors";
 export * from "./jwt";
 export * from "./middleware";
 export * from "./types/jwt";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -14,7 +14,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./errors"), exports);
 __exportStar(require("./jwt"), exports);
 __exportStar(require("./middleware"), exports);
 __exportStar(require("./types/jwt"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,wCAAsB;AACtB,+CAA6B;AAC7B,8CAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAsB;AACtB,+CAA6B;AAC7B,8CAA4B"}

package/dist/middleware/authenticate.d.ts

@@ -1,5 +1,5 @@
 import type { NextFunction, Request, Response } from "express";
-import type { JwtVerifyConfig } from "../types/jwt";
+import type { JwtAccessPayload, JwtVerifyConfig } from "../types/jwt";
 /**
  * Stateless verification. Unlike auth-service's own middleware there is no
  * database round trip: the access token is verified against the shared secret
@@ -35,12 +35,47 @@ declare global {
         }
     }
 }
+/**
+ * Bearer header first, then the `accessToken` cookie auth-service sets.
+ *
+ * Exported because auth-service keeps its own DB-backed middleware (see the
+ * trade-off above) and would otherwise copy this verbatim — which it did, and
+ * the copy drifted.
+ */
+export declare function extractToken(req: Request): string | null;
+/**
+ * Is this a well-formed *access* token payload?
+ *
+ * A valid signature only proves we minted the token, not that we minted it for
+ * this purpose — a refresh token is signed with the same secret. Without the
+ * `type` check a refresh token would authenticate a request.
+ *
+ * `iat` is required because DB-backed consumers compare it against
+ * `passwordChangedAt` to invalidate tokens issued before a password change.
+ *
+ * Exported alongside `extractToken` for auth-service's own middleware, which
+ * needs the same guard but reports failure with its own message.
+ */
+export declare function isValidAccessPayload(decoded: JwtAccessPayload | null | undefined): decoded is JwtAccessPayload;
+/**
+ * The roles a caller holds, plus everything those roles stand in for.
+ *
+ * Exported for tests and for any service that needs the same expansion outside
+ * a middleware — auth-service's own DB-backed guard, in particular, which does
+ * not go through `createAuthMiddleware`.
+ */
+export declare function effectiveRoles(roles: readonly string[]): Set<string>;
 export type AuthMiddleware = {
     /** Rejects with 401 unless the request carries a valid access token. */
     authenticate: (req: Request, res: Response, next: NextFunction) => void;
     /** Populates `req.user` when a valid token is present; never rejects. */
     optionalAuth: (req: Request, res: Response, next: NextFunction) => void;
-    /** Role guard. Use after `authenticate`. */
+    /**
+     * Role guard. Use after `authenticate`.
+     *
+     * Matches against the caller's roles expanded through `ROLE_IMPLIES`, so
+     * `authorize(["ADMIN"])` admits `SUPER_ADMIN`.
+     */
     authorize: (allowedRoles: string[]) => (req: Request, res: Response, next: NextFunction) => void;
 };
 /**

package/dist/middleware/authenticate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBACxB,KAAK,EAAE,MAAM,EAAE,CAAC;gBAChB,WAAW,EAAE,MAAM,EAAE,CAAC;aACvB,CAAC;YACF,IAAI,CAAC,EAAE;gBACL,MAAM,EAAE,MAAM,CAAC;gBACf,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH;KACF;CACF;AAoCD,MAAM,MAAM,cAAc,GAAG;IAC3B,wEAAwE;IACxE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE,yEAAyE;IACzE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE,4CAA4C;IAC5C,SAAS,EAAE,CACT,YAAY,EAAE,MAAM,EAAE,KACnB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CAChE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CAgF5E"}
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBACxB,KAAK,EAAE,MAAM,EAAE,CAAC;gBAChB,WAAW,EAAE,MAAM,EAAE,CAAC;aACvB,CAAC;YACF,IAAI,CAAC,EAAE;gBACL,MAAM,EAAE,MAAM,CAAC;gBACf,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH;KACF;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,OAAO,IAAI,gBAAgB,CAQ7B;AAsBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUpE;AAqBD,MAAM,MAAM,cAAc,GAAG;IAC3B,wEAAwE;IACxE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE,yEAAyE;IACzE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE;;;;;OAKG;IACH,SAAS,EAAE,CACT,YAAY,EAAE,MAAM,EAAE,KACnB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CAChE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CA6E5E"}

package/dist/middleware/authenticate.js

@@ -1,9 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractToken = extractToken;
+exports.isValidAccessPayload = isValidAccessPayload;
+exports.effectiveRoles = effectiveRoles;
 exports.createAuthMiddleware = createAuthMiddleware;
 const verify_1 = require("../jwt/verify");
-const not_authorized_error_1 = require("../errors/not-authorized-error");
-/** Bearer header first, then the `accessToken` cookie auth-service sets. */
+const errors_1 = require("@easyweb/errors");
+/**
+ * Bearer header first, then the `accessToken` cookie auth-service sets.
+ *
+ * Exported because auth-service keeps its own DB-backed middleware (see the
+ * trade-off above) and would otherwise copy this verbatim — which it did, and
+ * the copy drifted.
+ */
 function extractToken(req) {
     const authHeader = req.headers.authorization;
     if (authHeader && authHeader.startsWith("Bearer ")) {
@@ -14,6 +23,61 @@ function extractToken(req) {
     }
     return null;
 }
+/**
+ * Is this a well-formed *access* token payload?
+ *
+ * A valid signature only proves we minted the token, not that we minted it for
+ * this purpose — a refresh token is signed with the same secret. Without the
+ * `type` check a refresh token would authenticate a request.
+ *
+ * `iat` is required because DB-backed consumers compare it against
+ * `passwordChangedAt` to invalidate tokens issued before a password change.
+ *
+ * Exported alongside `extractToken` for auth-service's own middleware, which
+ * needs the same guard but reports failure with its own message.
+ */
+function isValidAccessPayload(decoded) {
+    return Boolean(decoded &&
+        decoded.type === "access" &&
+        decoded.sub &&
+        decoded.sessionId &&
+        decoded.iat);
+}
+/**
+ * Which roles a role stands in for.
+ *
+ * `authorize()` was an exact string match, and every admin route in the
+ * platform is written `authorize(["ADMIN"])` — so `SUPER_ADMIN`, which
+ * auth-service's `admin-seed.ts` grants the bootstrap operator by default,
+ * could not call a single one of them. The seeded account was locked out of
+ * the surface it exists to reach.
+ *
+ * Deliberately ONE entry. `ADMIN` does not imply `USER`: nothing calls
+ * `authorize(["USER"])` today, and adding that edge would silently widen every
+ * future customer route to staff — the kind of grant nobody re-reads.
+ *
+ * Widening only, which is what makes the 2.1.0 release safe to roll out one
+ * service at a time: a service still on 2.0.0 keeps behaving exactly as it did.
+ */
+const ROLE_IMPLIES = {
+    SUPER_ADMIN: ["ADMIN"],
+};
+/**
+ * The roles a caller holds, plus everything those roles stand in for.
+ *
+ * Exported for tests and for any service that needs the same expansion outside
+ * a middleware — auth-service's own DB-backed guard, in particular, which does
+ * not go through `createAuthMiddleware`.
+ */
+function effectiveRoles(roles) {
+    const effective = new Set(roles);
+    for (const role of roles) {
+        for (const implied of ROLE_IMPLIES[role] ?? []) {
+            effective.add(implied);
+        }
+    }
+    return effective;
+}
 function attachClaims(req, decoded) {
     req.user = {
         id: decoded.sub,
@@ -51,23 +115,16 @@ function createAuthMiddleware(config) {
         catch {
             return null;
         }
-        if (!decoded ||
-            decoded.type !== "access" ||
-            !decoded.sub ||
-            !decoded.sessionId ||
-            !decoded.iat) {
-            return null;
-        }
-        return decoded;
+        return isValidAccessPayload(decoded) ? decoded : null;
     }
     const authenticate = (req, _res, next) => {
         const token = extractToken(req);
         if (!token) {
-            throw new not_authorized_error_1.NotAuthorizedError();
+            throw new errors_1.NotAuthorizedError();
         }
         const decoded = decodeAccessToken(token);
         if (!decoded) {
-            throw new not_authorized_error_1.NotAuthorizedError();
+            throw new errors_1.NotAuthorizedError();
         }
         attachClaims(req, decoded);
         next();
@@ -81,11 +138,18 @@ function createAuthMiddleware(config) {
         }
         next();
     };
+    /**
+     * NOTE the status: `NotAuthorizedError` is 401, so a signed-in caller with
+     * the wrong role gets the same answer as an anonymous one. That is a quirk
+     * of this package rather than a decision, and every service's http tests pin
+     * it as-is — changing it here would turn eight suites red at once. A caller
+     * that needs to tell the two apart should check the role itself.
+     */
     const authorize = (allowedRoles) => {
         return (req, _res, next) => {
-            const roles = req.user?.roles ?? [];
-            if (!roles.some((r) => allowedRoles.includes(r))) {
-                throw new not_authorized_error_1.NotAuthorizedError("Insufficient role");
+            const held = effectiveRoles(req.user?.roles ?? []);
+            if (!allowedRoles.some((r) => held.has(r))) {
+                throw new errors_1.NotAuthorizedError("Insufficient role");
             }
             next();
         };

package/dist/middleware/authenticate.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":";;AA6FA,oDAgFC;AA5KD,0CAAkD;AAClD,yEAAoE;AAyCpE,4EAA4E;AAC5E,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,OAAyB;IAC3D,GAAG,CAAC,IAAI,GAAG;QACT,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,yDAAyD;QACzD,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,GAAG,CAAC,IAAI,GAAG;QACT,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAaD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAuB;IAC1D,MAAM,iBAAiB,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,CAAC;IAEpD;;;;OAIG;IACH,SAAS,iBAAiB,CAAC,KAAa;QACtC,IAAI,OAAyB,CAAC;QAE9B,IAAI,CAAC;YACH,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,CAAC,OAAO;YACR,OAAO,CAAC,IAAI,KAAK,QAAQ;YACzB,CAAC,OAAO,CAAC,GAAG;YACZ,CAAC,OAAO,CAAC,SAAS;YAClB,CAAC,OAAO,CAAC,GAAG,EACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,yCAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,yCAAkB,EAAE,CAAC;QACjC,CAAC;QAED,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE3B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,OAAO;gBAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,YAAsB,EAAE,EAAE;QAC3C,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;YAChE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAEpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,yCAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC"}
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":";;AAkDA,oCAYC;AAeD,oDAUC;AA6BD,wCAUC;AA0CD,oDA6EC;AApPD,0CAAkD;AAClD,4CAAqD;AAyCrD;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,GAAY;IACvC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAClC,OAA4C;IAE5C,OAAO,OAAO,CACZ,OAAO;QACL,OAAO,CAAC,IAAI,KAAK,QAAQ;QACzB,OAAO,CAAC,GAAG;QACX,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,GAAG,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAAgD;IAChE,WAAW,EAAE,CAAC,OAAO,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,KAAwB;IACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,OAAyB;IAC3D,GAAG,CAAC,IAAI,GAAG;QACT,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,yDAAyD;QACzD,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,GAAG,CAAC,IAAI,GAAG;QACT,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAkBD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAuB;IAC1D,MAAM,iBAAiB,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,CAAC;IAEpD;;;;OAIG;IACH,SAAS,iBAAiB,CAAC,KAAa;QACtC,IAAI,OAAyB,CAAC;QAE9B,IAAI,CAAC;YACH,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE3B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,OAAO;gBAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,SAAS,GAAG,CAAC,YAAsB,EAAE,EAAE;QAC3C,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;YAChE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAEnD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,2BAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@easyweb/authentication",
-  "version": "1.0.0",
-  "description": "Shared authentication primitives for Easyweb microservices: stateless JWT middleware, request context, and HTTP error classes",
+  "version": "2.1.0",
+  "description": "Shared authentication primitives for Easyweb microservices: stateless JWT middleware, request context, and token verification helpers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -16,18 +16,20 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "npm run clean && tsc",
     "build:watch": "tsc --watch",
     "prepublishOnly": "npm run build",
-    "clean": "rimraf dist"
+    "clean": "rimraf dist",
+    "test": "jest",
+    "typecheck": "tsc --noEmit",
+    "typecheck:test": "tsc -p tsconfig.test.json --noEmit"
   },
   "keywords": [
     "microservices",
     "express",
     "middleware",
     "authentication",
-    "jwt",
-    "error-handling"
+    "jwt"
   ],
   "author": "Easy Web Team",
   "license": "MIT",
@@ -37,13 +39,20 @@
     "directory": "common-auth"
   },
   "peerDependencies": {
+    "@easyweb/errors": "^1.0.0",
     "express": "^5.0.0",
     "jsonwebtoken": "^9.0.0"
   },
   "devDependencies": {
+    "@easyweb/errors": "^1.0.0",
+    "@swc/core": "^1.15.47",
+    "@swc/jest": "^0.2.39",
     "@types/express": "^5.0.6",
+    "@types/jest": "^30.0.0",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^26.0.1",
+    "jest": "^30.4.2",
+    "jsonwebtoken": "^9.0.3",
     "rimraf": "^6.1.3",
     "typescript": "^6.0.3"
   },

package/dist/errors/bad-request-error.d.ts

@@ -1,10 +0,0 @@
-import { CustomError } from "./custom-error";
-declare class BadRequestError extends CustomError {
-    statusCode: number;
-    constructor(message: string);
-    serializeErrors(): {
-        message: string;
-    }[];
-}
-export { BadRequestError };
-//# sourceMappingURL=bad-request-error.d.ts.map

package/dist/errors/bad-request-error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bad-request-error.d.ts","sourceRoot":"","sources":["../../src/errors/bad-request-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,cAAM,eAAgB,SAAQ,WAAW;IACvC,UAAU,SAAO;gBAEL,OAAO,EAAE,MAAM;IAK3B,eAAe;;;CAGhB;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/errors/bad-request-error.js

@@ -1,16 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BadRequestError = void 0;
-const custom_error_1 = require("./custom-error");
-class BadRequestError extends custom_error_1.CustomError {
-    constructor(message) {
-        super(message);
-        this.statusCode = 400;
-        Object.setPrototypeOf(this, BadRequestError.prototype);
-    }
-    serializeErrors() {
-        return [{ message: this.message }];
-    }
-}
-exports.BadRequestError = BadRequestError;
-//# sourceMappingURL=bad-request-error.js.map

package/dist/errors/bad-request-error.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bad-request-error.js","sourceRoot":"","sources":["../../src/errors/bad-request-error.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAE7C,MAAM,eAAgB,SAAQ,0BAAW;IAGvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHjB,eAAU,GAAG,GAAG,CAAC;QAIf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,eAAe;QACb,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;CACF;AAEQ,0CAAe"}

package/dist/errors/custom-error.d.ts

@@ -1,9 +0,0 @@
-export declare abstract class CustomError extends Error {
-    abstract statusCode: number;
-    constructor(message: string);
-    abstract serializeErrors(): {
-        message: string;
-        field?: string;
-    }[];
-}
-//# sourceMappingURL=custom-error.d.ts.map

package/dist/errors/custom-error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"custom-error.d.ts","sourceRoot":"","sources":["../../src/errors/custom-error.ts"],"names":[],"mappings":"AAAA,8BAAsB,WAAY,SAAQ,KAAK;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM;IAK3B,QAAQ,CAAC,eAAe,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE;CAClE"}

package/dist/errors/custom-error.js

@@ -1,11 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CustomError = void 0;
-class CustomError extends Error {
-    constructor(message) {
-        super(message);
-        Object.setPrototypeOf(this, CustomError.prototype);
-    }
-}
-exports.CustomError = CustomError;
-//# sourceMappingURL=custom-error.js.map

package/dist/errors/custom-error.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"custom-error.js","sourceRoot":"","sources":["../../src/errors/custom-error.ts"],"names":[],"mappings":";;;AAAA,MAAsB,WAAY,SAAQ,KAAK;IAG7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;CAGF;AATD,kCASC"}

package/dist/errors/database-connection-error.d.ts

@@ -1,10 +0,0 @@
-import { CustomError } from "./custom-error";
-export declare class DatabaseConnectionError extends CustomError {
-    statusCode: number;
-    reason: string;
-    constructor();
-    serializeErrors(): {
-        message: string;
-    }[];
-}
-//# sourceMappingURL=database-connection-error.d.ts.map

package/dist/errors/database-connection-error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"database-connection-error.d.ts","sourceRoot":"","sources":["../../src/errors/database-connection-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,UAAU,SAAO;IACjB,MAAM,SAAkC;;IAQxC,eAAe;;;CAGhB"}

package/dist/errors/database-connection-error.js

@@ -1,17 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DatabaseConnectionError = void 0;
-const custom_error_1 = require("./custom-error");
-class DatabaseConnectionError extends custom_error_1.CustomError {
-    constructor() {
-        super("Error connecting to database");
-        this.statusCode = 500;
-        this.reason = "Error connecting to database";
-        Object.setPrototypeOf(this, DatabaseConnectionError.prototype);
-    }
-    serializeErrors() {
-        return [{ message: this.reason }];
-    }
-}
-exports.DatabaseConnectionError = DatabaseConnectionError;
-//# sourceMappingURL=database-connection-error.js.map

package/dist/errors/database-connection-error.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"database-connection-error.js","sourceRoot":"","sources":["../../src/errors/database-connection-error.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAE7C,MAAa,uBAAwB,SAAQ,0BAAW;IAItD;QACE,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAJxC,eAAU,GAAG,GAAG,CAAC;QACjB,WAAM,GAAG,8BAA8B,CAAC;QAKtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,eAAe;QACb,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;CACF;AAbD,0DAaC"}

package/dist/errors/index.d.ts

@@ -1,6 +0,0 @@
-export * from "./custom-error";
-export * from "./bad-request-error";
-export * from "./not-authorized-error";
-export * from "./not-found-error";
-export * from "./database-connection-error";
-//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC"}

package/dist/errors/index.js

@@ -1,22 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./custom-error"), exports);
-__exportStar(require("./bad-request-error"), exports);
-__exportStar(require("./not-authorized-error"), exports);
-__exportStar(require("./not-found-error"), exports);
-__exportStar(require("./database-connection-error"), exports);
-//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,yDAAuC;AACvC,oDAAkC;AAClC,8DAA4C"}

package/dist/errors/not-authorized-error.d.ts

@@ -1,9 +0,0 @@
-import { CustomError } from "./custom-error";
-export declare class NotAuthorizedError extends CustomError {
-    statusCode: number;
-    constructor(message?: string);
-    serializeErrors(): {
-        message: string;
-    }[];
-}
-//# sourceMappingURL=not-authorized-error.d.ts.map

package/dist/errors/not-authorized-error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"not-authorized-error.d.ts","sourceRoot":"","sources":["../../src/errors/not-authorized-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,UAAU,SAAO;gBAEL,OAAO,GAAE,MAAyB;IAK9C,eAAe;;;CAGhB"}

package/dist/errors/not-authorized-error.js

@@ -1,16 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NotAuthorizedError = void 0;
-const custom_error_1 = require("./custom-error");
-class NotAuthorizedError extends custom_error_1.CustomError {
-    constructor(message = "Not authorized") {
-        super(message);
-        this.statusCode = 401;
-        Object.setPrototypeOf(this, NotAuthorizedError.prototype);
-    }
-    serializeErrors() {
-        return [{ message: this.message }];
-    }
-}
-exports.NotAuthorizedError = NotAuthorizedError;
-//# sourceMappingURL=not-authorized-error.js.map

package/dist/errors/not-authorized-error.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"not-authorized-error.js","sourceRoot":"","sources":["../../src/errors/not-authorized-error.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAE7C,MAAa,kBAAmB,SAAQ,0BAAW;IAGjD,YAAY,UAAkB,gBAAgB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHjB,eAAU,GAAG,GAAG,CAAC;QAIf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,eAAe;QACb,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;CACF;AAXD,gDAWC"}

package/dist/errors/not-found-error.d.ts

@@ -1,9 +0,0 @@
-import { CustomError } from "./custom-error";
-export declare class NotFoundError extends CustomError {
-    statusCode: number;
-    constructor();
-    serializeErrors(): {
-        message: string;
-    }[];
-}
-//# sourceMappingURL=not-found-error.d.ts.map

package/dist/errors/not-found-error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"not-found-error.d.ts","sourceRoot":"","sources":["../../src/errors/not-found-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,qBAAa,aAAc,SAAQ,WAAW;IAC5C,UAAU,SAAO;;IAOjB,eAAe;;;CAGhB"}

package/dist/errors/not-found-error.js

@@ -1,16 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NotFoundError = void 0;
-const custom_error_1 = require("./custom-error");
-class NotFoundError extends custom_error_1.CustomError {
-    constructor() {
-        super("Route not found");
-        this.statusCode = 404;
-        Object.setPrototypeOf(this, NotFoundError.prototype);
-    }
-    serializeErrors() {
-        return [{ message: "Not Found" }];
-    }
-}
-exports.NotFoundError = NotFoundError;
-//# sourceMappingURL=not-found-error.js.map

package/dist/errors/not-found-error.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"not-found-error.js","sourceRoot":"","sources":["../../src/errors/not-found-error.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAE7C,MAAa,aAAc,SAAQ,0BAAW;IAG5C;QACE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAH3B,eAAU,GAAG,GAAG,CAAC;QAIf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,eAAe;QACb,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IACpC,CAAC;CACF;AAXD,sCAWC"}