@easyweb/authentication 1.0.0

package/README.md

@@ -0,0 +1,100 @@
+# @easyweb/authentication
+
+Shared authentication primitives for Easyweb microservices — stateless JWT middleware,
+request-context middleware, and the HTTP error classes every service throws.
+
+Companion to [`@easyweb/rabbitmq-utils`](https://www.npmjs.com/package/@easyweb/rabbitmq-utils),
+which covers events and observability.
+
+## Install
+
+```bash
+npm install @easyweb/authentication
+```
+
+`express@^5` and `jsonwebtoken@^9` are peer dependencies — the consuming service
+provides them.
+
+## Usage
+
+Nothing in this package reads `process.env`. Config is bound once at startup, so the
+package never has to reach into a service's `config` module.
+
+```ts
+import express from "express";
+import cookieParser from "cookie-parser";
+import {
+  createAuthMiddleware,
+  requestContext,
+  NotAuthorizedError,
+} from "@easyweb/authentication";
+import config from "./config";
+
+const app = express();
+app.use(cookieParser()); // required: the middleware reads the accessToken cookie
+app.use(requestContext);
+
+const authMiddleware = createAuthMiddleware(config.jwt);
+// config.jwt must supply { secret, issuer, audience } matching auth-service's
+
+app.get("/me", authMiddleware.authenticate, (req, res) => {
+  res.json(req.user); // { id, email, username, roles, permissions }
+});
+
+app.get("/feed", authMiddleware.optionalAuth, (req, res) => {
+  res.json({ personalised: Boolean(req.user) });
+});
+
+app.delete(
+  "/admin/:id",
+  authMiddleware.authenticate,
+  authMiddleware.authorize(["admin"]),
+  handler,
+);
+```
+
+Minting tokens (auth-service only):
+
+```ts
+import { createJwtSigner } from "@easyweb/authentication";
+
+const signAccessToken = createJwtSigner(config.jwt);
+// config.jwt additionally needs accessTokenTtlSeconds
+```
+
+## What it verifies — and what it does not
+
+`authenticate` is **stateless**. It checks the signature, issuer, audience, expiry, and
+that the payload is a well-formed access token. It performs no database lookup.
+
+A logout or session revoke in auth-service stays invisible here until the access token
+expires (`JWT_ACCESS_TOKEN_TTL_SECONDS`, currently 300). If a service needs immediate
+revocation, it must keep its own DB-backed middleware — auth-service does exactly that.
+
+`req.user.permissions` is always `[]`. The access token carries no `permissions` claim;
+auth-service resolves those from its own tables at request time. Guarding on this array
+would deny every request.
+
+## Exports
+
+| Export | Purpose |
+|---|---|
+| `createAuthMiddleware(config)` | `{ authenticate, optionalAuth, authorize }` |
+| `requestContext` | propagates / generates `x-request-id` |
+| `createJwtVerifier(config)` | `(token) => JwtAccessPayload`, throws on invalid |
+| `createJwtSigner(config)` | `(claims) => string` |
+| `CustomError`, `BadRequestError`, `NotAuthorizedError`, `NotFoundError`, `DatabaseConnectionError` | shared error hierarchy |
+| `JwtAccessPayload`, `JwtAccessClaims`, `JwtVerifyConfig`, `JwtSignConfig` | types |
+
+Importing the package also augments `Express.Request` with `user`, `auth`, and
+`requestId`. Remove any local copy of that `declare global` block or TypeScript will
+report duplicate members.
+
+## Token contract
+
+`JwtAccessPayload` is the only shape the services agree on. Changing it breaks every
+consumer — bump the major version.
+
+## License
+
+MIT

package/dist/errors/bad-request-error.d.ts

@@ -0,0 +1,10 @@
+import { CustomError } from "./custom-error";
+declare class BadRequestError extends CustomError {
+    statusCode: number;
+    constructor(message: string);
+    serializeErrors(): {
+        message: string;
+    }[];
+}
+export { BadRequestError };
+//# sourceMappingURL=bad-request-error.d.ts.map

package/dist/errors/bad-request-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bad-request-error.d.ts","sourceRoot":"","sources":["../../src/errors/bad-request-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,cAAM,eAAgB,SAAQ,WAAW;IACvC,UAAU,SAAO;gBAEL,OAAO,EAAE,MAAM;IAK3B,eAAe;;;CAGhB;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/errors/bad-request-error.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BadRequestError = void 0;
+const custom_error_1 = require("./custom-error");
+class BadRequestError extends custom_error_1.CustomError {
+    constructor(message) {
+        super(message);
+        this.statusCode = 400;
+        Object.setPrototypeOf(this, BadRequestError.prototype);
+    }
+    serializeErrors() {
+        return [{ message: this.message }];
+    }
+}
+exports.BadRequestError = BadRequestError;
+//# sourceMappingURL=bad-request-error.js.map

package/dist/errors/bad-request-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bad-request-error.js","sourceRoot":"","sources":["../../src/errors/bad-request-error.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAE7C,MAAM,eAAgB,SAAQ,0BAAW;IAGvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHjB,eAAU,GAAG,GAAG,CAAC;QAIf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,eAAe;QACb,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;CACF;AAEQ,0CAAe"}

package/dist/errors/custom-error.d.ts

@@ -0,0 +1,9 @@
+export declare abstract class CustomError extends Error {
+    abstract statusCode: number;
+    constructor(message: string);
+    abstract serializeErrors(): {
+        message: string;
+        field?: string;
+    }[];
+}
+//# sourceMappingURL=custom-error.d.ts.map

package/dist/errors/custom-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-error.d.ts","sourceRoot":"","sources":["../../src/errors/custom-error.ts"],"names":[],"mappings":"AAAA,8BAAsB,WAAY,SAAQ,KAAK;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM;IAK3B,QAAQ,CAAC,eAAe,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE;CAClE"}

package/dist/errors/custom-error.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomError = void 0;
+class CustomError extends Error {
+    constructor(message) {
+        super(message);
+        Object.setPrototypeOf(this, CustomError.prototype);
+    }
+}
+exports.CustomError = CustomError;
+//# sourceMappingURL=custom-error.js.map

package/dist/errors/custom-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-error.js","sourceRoot":"","sources":["../../src/errors/custom-error.ts"],"names":[],"mappings":";;;AAAA,MAAsB,WAAY,SAAQ,KAAK;IAG7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;CAGF;AATD,kCASC"}

package/dist/errors/database-connection-error.d.ts

@@ -0,0 +1,10 @@
+import { CustomError } from "./custom-error";
+export declare class DatabaseConnectionError extends CustomError {
+    statusCode: number;
+    reason: string;
+    constructor();
+    serializeErrors(): {
+        message: string;
+    }[];
+}
+//# sourceMappingURL=database-connection-error.d.ts.map

package/dist/errors/database-connection-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-connection-error.d.ts","sourceRoot":"","sources":["../../src/errors/database-connection-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,qBAAa,uBAAwB,SAAQ,WAAW;IACtD,UAAU,SAAO;IACjB,MAAM,SAAkC;;IAQxC,eAAe;;;CAGhB"}

package/dist/errors/database-connection-error.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseConnectionError = void 0;
+const custom_error_1 = require("./custom-error");
+class DatabaseConnectionError extends custom_error_1.CustomError {
+    constructor() {
+        super("Error connecting to database");
+        this.statusCode = 500;
+        this.reason = "Error connecting to database";
+        Object.setPrototypeOf(this, DatabaseConnectionError.prototype);
+    }
+    serializeErrors() {
+        return [{ message: this.reason }];
+    }
+}
+exports.DatabaseConnectionError = DatabaseConnectionError;
+//# sourceMappingURL=database-connection-error.js.map

package/dist/errors/database-connection-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-connection-error.js","sourceRoot":"","sources":["../../src/errors/database-connection-error.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAE7C,MAAa,uBAAwB,SAAQ,0BAAW;IAItD;QACE,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAJxC,eAAU,GAAG,GAAG,CAAC;QACjB,WAAM,GAAG,8BAA8B,CAAC;QAKtC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,eAAe;QACb,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;CACF;AAbD,0DAaC"}

package/dist/errors/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./custom-error";
+export * from "./bad-request-error";
+export * from "./not-authorized-error";
+export * from "./not-found-error";
+export * from "./database-connection-error";
+//# sourceMappingURL=index.d.ts.map

package/dist/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC"}

package/dist/errors/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./custom-error"), exports);
+__exportStar(require("./bad-request-error"), exports);
+__exportStar(require("./not-authorized-error"), exports);
+__exportStar(require("./not-found-error"), exports);
+__exportStar(require("./database-connection-error"), exports);
+//# sourceMappingURL=index.js.map

package/dist/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,sDAAoC;AACpC,yDAAuC;AACvC,oDAAkC;AAClC,8DAA4C"}

package/dist/errors/not-authorized-error.d.ts

@@ -0,0 +1,9 @@
+import { CustomError } from "./custom-error";
+export declare class NotAuthorizedError extends CustomError {
+    statusCode: number;
+    constructor(message?: string);
+    serializeErrors(): {
+        message: string;
+    }[];
+}
+//# sourceMappingURL=not-authorized-error.d.ts.map

package/dist/errors/not-authorized-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"not-authorized-error.d.ts","sourceRoot":"","sources":["../../src/errors/not-authorized-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,qBAAa,kBAAmB,SAAQ,WAAW;IACjD,UAAU,SAAO;gBAEL,OAAO,GAAE,MAAyB;IAK9C,eAAe;;;CAGhB"}

package/dist/errors/not-authorized-error.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotAuthorizedError = void 0;
+const custom_error_1 = require("./custom-error");
+class NotAuthorizedError extends custom_error_1.CustomError {
+    constructor(message = "Not authorized") {
+        super(message);
+        this.statusCode = 401;
+        Object.setPrototypeOf(this, NotAuthorizedError.prototype);
+    }
+    serializeErrors() {
+        return [{ message: this.message }];
+    }
+}
+exports.NotAuthorizedError = NotAuthorizedError;
+//# sourceMappingURL=not-authorized-error.js.map

package/dist/errors/not-authorized-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"not-authorized-error.js","sourceRoot":"","sources":["../../src/errors/not-authorized-error.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAE7C,MAAa,kBAAmB,SAAQ,0BAAW;IAGjD,YAAY,UAAkB,gBAAgB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHjB,eAAU,GAAG,GAAG,CAAC;QAIf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,eAAe;QACb,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;CACF;AAXD,gDAWC"}

package/dist/errors/not-found-error.d.ts

@@ -0,0 +1,9 @@
+import { CustomError } from "./custom-error";
+export declare class NotFoundError extends CustomError {
+    statusCode: number;
+    constructor();
+    serializeErrors(): {
+        message: string;
+    }[];
+}
+//# sourceMappingURL=not-found-error.d.ts.map

package/dist/errors/not-found-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"not-found-error.d.ts","sourceRoot":"","sources":["../../src/errors/not-found-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,qBAAa,aAAc,SAAQ,WAAW;IAC5C,UAAU,SAAO;;IAOjB,eAAe;;;CAGhB"}

package/dist/errors/not-found-error.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotFoundError = void 0;
+const custom_error_1 = require("./custom-error");
+class NotFoundError extends custom_error_1.CustomError {
+    constructor() {
+        super("Route not found");
+        this.statusCode = 404;
+        Object.setPrototypeOf(this, NotFoundError.prototype);
+    }
+    serializeErrors() {
+        return [{ message: "Not Found" }];
+    }
+}
+exports.NotFoundError = NotFoundError;
+//# sourceMappingURL=not-found-error.js.map

package/dist/errors/not-found-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"not-found-error.js","sourceRoot":"","sources":["../../src/errors/not-found-error.ts"],"names":[],"mappings":";;;AAAA,iDAA6C;AAE7C,MAAa,aAAc,SAAQ,0BAAW;IAG5C;QACE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAH3B,eAAU,GAAG,GAAG,CAAC;QAIf,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,eAAe;QACb,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IACpC,CAAC;CACF;AAXD,sCAWC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./errors";
+export * from "./jwt";
+export * from "./middleware";
+export * from "./types/jwt";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./errors"), exports);
+__exportStar(require("./jwt"), exports);
+__exportStar(require("./middleware"), exports);
+__exportStar(require("./types/jwt"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,wCAAsB;AACtB,+CAA6B;AAC7B,8CAA4B"}

package/dist/jwt/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./verify";
+//# sourceMappingURL=index.d.ts.map

package/dist/jwt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC"}

package/dist/jwt/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./verify"), exports);
+//# sourceMappingURL=index.js.map

package/dist/jwt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB"}

package/dist/jwt/verify.d.ts

@@ -0,0 +1,18 @@
+import type { JwtAccessClaims, JwtAccessPayload, JwtSignConfig, JwtVerifyConfig } from "../types/jwt";
+/**
+ * Factory rather than a bare function: package code cannot reach a service's
+ * `config` module, so the secret/issuer/audience are bound once at startup.
+ *
+ * The returned verifier throws whatever `jsonwebtoken` throws
+ * (`JsonWebTokenError`, `TokenExpiredError`); callers translate that into
+ * `NotAuthorizedError`.
+ */
+export declare function createJwtVerifier(config: JwtVerifyConfig): (token: string) => JwtAccessPayload;
+/**
+ * Only auth-service mints tokens. Every other service consumes them and needs
+ * `createJwtVerifier` alone.
+ */
+export declare function createJwtSigner(config: JwtSignConfig): (payload: JwtAccessClaims) => string;
+export type JwtVerifier = ReturnType<typeof createJwtVerifier>;
+export type JwtSigner = ReturnType<typeof createJwtSigner>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/jwt/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/jwt/verify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EAChB,MAAM,cAAc,CAAC;AAEtB;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,IACrB,OAAO,MAAM,KAAG,gBAAgB,CAMnE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,IACnB,SAAS,eAAe,KAAG,MAAM,CAOlE;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC/D,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/jwt/verify.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJwtVerifier = createJwtVerifier;
+exports.createJwtSigner = createJwtSigner;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+/**
+ * Factory rather than a bare function: package code cannot reach a service's
+ * `config` module, so the secret/issuer/audience are bound once at startup.
+ *
+ * The returned verifier throws whatever `jsonwebtoken` throws
+ * (`JsonWebTokenError`, `TokenExpiredError`); callers translate that into
+ * `NotAuthorizedError`.
+ */
+function createJwtVerifier(config) {
+    return function verifyAccessToken(token) {
+        return jsonwebtoken_1.default.verify(token, config.secret, {
+            issuer: config.issuer,
+            audience: config.audience,
+        });
+    };
+}
+/**
+ * Only auth-service mints tokens. Every other service consumes them and needs
+ * `createJwtVerifier` alone.
+ */
+function createJwtSigner(config) {
+    return function signAccessToken(payload) {
+        return jsonwebtoken_1.default.sign(payload, config.secret, {
+            expiresIn: config.accessTokenTtlSeconds,
+            issuer: config.issuer,
+            audience: config.audience,
+        });
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/jwt/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/jwt/verify.ts"],"names":[],"mappings":";;;;;AAgBA,8CAOC;AAMD,0CAQC;AArCD,gEAA+B;AAQ/B;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,MAAuB;IACvD,OAAO,SAAS,iBAAiB,CAAC,KAAa;QAC7C,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAqB,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAAqB;IACnD,OAAO,SAAS,eAAe,CAAC,OAAwB;QACtD,OAAO,sBAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;YACtC,SAAS,EAAE,MAAM,CAAC,qBAAqB;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SACP,CAAC,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/authenticate.d.ts

@@ -0,0 +1,52 @@
+import type { NextFunction, Request, Response } from "express";
+import type { JwtVerifyConfig } from "../types/jwt";
+/**
+ * Stateless verification. Unlike auth-service's own middleware there is no
+ * database round trip: the access token is verified against the shared secret
+ * and its claims are trusted as-is.
+ *
+ * TRADE-OFF — a logout or session revoke performed in auth-service is invisible
+ * here until the access token expires (JWT_ACCESS_TOKEN_TTL_SECONDS, currently
+ * 300). That window is accepted for now. The upgrade path is a shared Redis
+ * denylist checked after verification:
+ *
+ *   if (await redis.get(`session:revoked:${decoded.sessionId}`)) throw ...
+ *
+ * which requires auth-service to start publishing those keys on logout/revoke.
+ * It does not today.
+ *
+ * Any service needing immediate revocation must keep its own DB-backed
+ * middleware instead of this one.
+ */
+declare global {
+    namespace Express {
+        interface Request {
+            user?: {
+                id: string;
+                email: string;
+                username: string | null;
+                roles: string[];
+                permissions: string[];
+            };
+            auth?: {
+                userId: string;
+                sessionId?: string;
+            };
+        }
+    }
+}
+export type AuthMiddleware = {
+    /** Rejects with 401 unless the request carries a valid access token. */
+    authenticate: (req: Request, res: Response, next: NextFunction) => void;
+    /** Populates `req.user` when a valid token is present; never rejects. */
+    optionalAuth: (req: Request, res: Response, next: NextFunction) => void;
+    /** Role guard. Use after `authenticate`. */
+    authorize: (allowedRoles: string[]) => (req: Request, res: Response, next: NextFunction) => void;
+};
+/**
+ * Binds the JWT config once at startup and returns the middleware trio. The
+ * grouped return keeps call sites reading as `authMiddleware.authenticate`,
+ * matching auth-service's class-based middleware.
+ */
+export declare function createAuthMiddleware(config: JwtVerifyConfig): AuthMiddleware;
+//# sourceMappingURL=authenticate.d.ts.map

package/dist/middleware/authenticate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBACxB,KAAK,EAAE,MAAM,EAAE,CAAC;gBAChB,WAAW,EAAE,MAAM,EAAE,CAAC;aACvB,CAAC;YACF,IAAI,CAAC,EAAE;gBACL,MAAM,EAAE,MAAM,CAAC;gBACf,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH;KACF;CACF;AAoCD,MAAM,MAAM,cAAc,GAAG;IAC3B,wEAAwE;IACxE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE,yEAAyE;IACzE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE,4CAA4C;IAC5C,SAAS,EAAE,CACT,YAAY,EAAE,MAAM,EAAE,KACnB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CAChE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CAgF5E"}

package/dist/middleware/authenticate.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthMiddleware = createAuthMiddleware;
+const verify_1 = require("../jwt/verify");
+const not_authorized_error_1 = require("../errors/not-authorized-error");
+/** Bearer header first, then the `accessToken` cookie auth-service sets. */
+function extractToken(req) {
+    const authHeader = req.headers.authorization;
+    if (authHeader && authHeader.startsWith("Bearer ")) {
+        return authHeader.substring(7);
+    }
+    if (req.cookies && req.cookies.accessToken) {
+        return req.cookies.accessToken;
+    }
+    return null;
+}
+function attachClaims(req, decoded) {
+    req.user = {
+        id: decoded.sub,
+        email: decoded.email,
+        username: decoded.username ?? null,
+        roles: decoded.roles ?? [],
+        // The access token carries no `permissions` claim — auth-service resolves
+        // those from its own tables. Anything needing permission-level checks must
+        // either get the claim added upstream or query auth-service directly;
+        // guarding on this empty array would deny every request.
+        permissions: [],
+    };
+    req.auth = {
+        userId: decoded.sub,
+        sessionId: decoded.sessionId,
+    };
+}
+/**
+ * Binds the JWT config once at startup and returns the middleware trio. The
+ * grouped return keeps call sites reading as `authMiddleware.authenticate`,
+ * matching auth-service's class-based middleware.
+ */
+function createAuthMiddleware(config) {
+    const verifyAccessToken = (0, verify_1.createJwtVerifier)(config);
+    /**
+     * Verifies the token and returns its claims, or null when anything about it
+     * is wrong — bad signature, wrong issuer/audience, expired, or a payload that
+     * is not a well-formed access token.
+     */
+    function decodeAccessToken(token) {
+        let decoded;
+        try {
+            decoded = verifyAccessToken(token);
+        }
+        catch {
+            return null;
+        }
+        if (!decoded ||
+            decoded.type !== "access" ||
+            !decoded.sub ||
+            !decoded.sessionId ||
+            !decoded.iat) {
+            return null;
+        }
+        return decoded;
+    }
+    const authenticate = (req, _res, next) => {
+        const token = extractToken(req);
+        if (!token) {
+            throw new not_authorized_error_1.NotAuthorizedError();
+        }
+        const decoded = decodeAccessToken(token);
+        if (!decoded) {
+            throw new not_authorized_error_1.NotAuthorizedError();
+        }
+        attachClaims(req, decoded);
+        next();
+    };
+    const optionalAuth = (req, _res, next) => {
+        const token = extractToken(req);
+        if (token) {
+            const decoded = decodeAccessToken(token);
+            if (decoded)
+                attachClaims(req, decoded);
+        }
+        next();
+    };
+    const authorize = (allowedRoles) => {
+        return (req, _res, next) => {
+            const roles = req.user?.roles ?? [];
+            if (!roles.some((r) => allowedRoles.includes(r))) {
+                throw new not_authorized_error_1.NotAuthorizedError("Insufficient role");
+            }
+            next();
+        };
+    };
+    return { authenticate, optionalAuth, authorize };
+}
+//# sourceMappingURL=authenticate.js.map

package/dist/middleware/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":";;AA6FA,oDAgFC;AA5KD,0CAAkD;AAClD,yEAAoE;AAyCpE,4EAA4E;AAC5E,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,OAAyB;IAC3D,GAAG,CAAC,IAAI,GAAG;QACT,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,yDAAyD;QACzD,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,GAAG,CAAC,IAAI,GAAG;QACT,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAaD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAuB;IAC1D,MAAM,iBAAiB,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,CAAC;IAEpD;;;;OAIG;IACH,SAAS,iBAAiB,CAAC,KAAa;QACtC,IAAI,OAAyB,CAAC;QAE9B,IAAI,CAAC;YACH,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,CAAC,OAAO;YACR,OAAO,CAAC,IAAI,KAAK,QAAQ;YACzB,CAAC,OAAO,CAAC,GAAG;YACZ,CAAC,OAAO,CAAC,SAAS;YAClB,CAAC,OAAO,CAAC,GAAG,EACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,yCAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,yCAAkB,EAAE,CAAC;QACjC,CAAC;QAED,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE3B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,OAAO;gBAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,YAAsB,EAAE,EAAE;QAC3C,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;YAChE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAEpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,yCAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./authenticate";
+export * from "./request-context";
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./authenticate"), exports);
+__exportStar(require("./request-context"), exports);
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,oDAAkC"}

package/dist/middleware/request-context.d.ts

@@ -0,0 +1,15 @@
+import type { Request, Response, NextFunction } from "express";
+declare global {
+    namespace Express {
+        interface Request {
+            requestId: string;
+        }
+    }
+}
+/**
+ * Picks up x-request-id from incoming headers (for inter-service forwarding),
+ * or generates a new UUID when the request originates externally.
+ * Always echoes the final value back in the response header.
+ */
+export declare function requestContext(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=request-context.d.ts.map

package/dist/middleware/request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/middleware/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,SAAS,EAAE,MAAM,CAAC;SACnB;KACF;CACF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,QAYnB"}

package/dist/middleware/request-context.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestContext = requestContext;
+const crypto_1 = require("crypto");
+/**
+ * Picks up x-request-id from incoming headers (for inter-service forwarding),
+ * or generates a new UUID when the request originates externally.
+ * Always echoes the final value back in the response header.
+ */
+function requestContext(req, res, next) {
+    const incoming = req.headers["x-request-id"];
+    const requestId = typeof incoming === "string" && incoming.length > 0
+        ? incoming
+        : (0, crypto_1.randomUUID)();
+    req.requestId = requestId;
+    res.setHeader("x-request-id", requestId);
+    next();
+}
+//# sourceMappingURL=request-context.js.map

package/dist/middleware/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/middleware/request-context.ts"],"names":[],"mappings":";;AAgBA,wCAeC;AA9BD,mCAAoC;AAUpC;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAA,mBAAU,GAAE,CAAC;IAEnB,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IAC1B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAEzC,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/types/jwt.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Claim set minted by auth-service's `signAccessTokenForSession`.
+ *
+ * This is the only shape the services agree on. Any change here is a breaking
+ * change for every consumer — bump the major version.
+ *
+ * Note there is no `permissions` claim: auth-service resolves permissions from
+ * its own tables at request time and does not put them in the token.
+ */
+export type JwtAccessPayload = {
+    sub: string;
+    email: string;
+    username: string;
+    roles: string[];
+    sessionId: string;
+    type: "access";
+    /** Registered claims stamped by `jsonwebtoken` at sign time. */
+    iat?: number;
+    exp?: number;
+};
+/** What a caller supplies when minting — the registered claims are added for it. */
+export type JwtAccessClaims = Omit<JwtAccessPayload, "iat" | "exp">;
+/** Everything needed to verify a token. Must match the issuing service's values. */
+export type JwtVerifyConfig = {
+    secret: string;
+    issuer: string;
+    audience: string;
+};
+/** Verification config plus the lifetime applied to newly minted tokens. */
+export type JwtSignConfig = JwtVerifyConfig & {
+    accessTokenTtlSeconds: number;
+};
+//# sourceMappingURL=jwt.d.ts.map

package/dist/types/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/types/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;AAEpE,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG;IAC5C,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC"}

package/dist/types/jwt.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=jwt.js.map

package/dist/types/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/types/jwt.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@easyweb/authentication",
+  "version": "1.0.0",
+  "description": "Shared authentication primitives for Easyweb microservices: stateless JWT middleware, request context, and HTTP error classes",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "require": "./dist/index.js",
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "build:watch": "tsc --watch",
+    "prepublishOnly": "npm run build",
+    "clean": "rimraf dist"
+  },
+  "keywords": [
+    "microservices",
+    "express",
+    "middleware",
+    "authentication",
+    "jwt",
+    "error-handling"
+  ],
+  "author": "Easy Web Team",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Alpine-Solusi/website-builder.git",
+    "directory": "common-auth"
+  },
+  "peerDependencies": {
+    "express": "^5.0.0",
+    "jsonwebtoken": "^9.0.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.6",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^26.0.1",
+    "rimraf": "^6.1.3",
+    "typescript": "^6.0.3"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}