@easyweb/authentication 2.0.0 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -7,6 +7,32 @@ Companion to [`@easyweb/events`](https://www.npmjs.com/package/@easyweb/events)
|
|
|
7
7
|
messaging, and [`@easyweb/errors`](https://www.npmjs.com/package/@easyweb/errors) for
|
|
8
8
|
the HTTP error taxonomy.
|
|
9
9
|
|
|
10
|
+
## 2.1.0 — `SUPER_ADMIN` now satisfies `authorize(["ADMIN"])`
|
|
11
|
+
|
|
12
|
+
`authorize()` was an exact string match. Every admin route in the platform is written
|
|
13
|
+
`authorize(["ADMIN"])`, and auth-service's `admin-seed.ts` grants the bootstrap operator
|
|
14
|
+
`SUPER_ADMIN` by default — so the seeded account could not call a single admin route on
|
|
15
|
+
the platform.
|
|
16
|
+
|
|
17
|
+
`SUPER_ADMIN` now implies `ADMIN`. Nothing else implies anything: `ADMIN` deliberately
|
|
18
|
+
does **not** imply `USER`, because that edge would silently widen every future customer
|
|
19
|
+
route to staff.
|
|
20
|
+
|
|
21
|
+
**Additive, and widening only.** A service still on 2.0.0 behaves exactly as it did —
|
|
22
|
+
`SUPER_ADMIN` simply stays locked out there — so this needs no coordinated deploy. Since
|
|
23
|
+
every service declares `^2.0.0` but installs from a lockfile, pick it up with:
|
|
24
|
+
|
|
25
|
+
```bash
|
|
26
|
+
npm i @easyweb/authentication@^2.1.0
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
The new `effectiveRoles(roles)` export does the same expansion for a service with its own
|
|
30
|
+
guard (auth-service's DB-backed middleware, in particular).
|
|
31
|
+
|
|
32
|
+
The status is unchanged: `authorize()` still throws `NotAuthorizedError`, which is **401**
|
|
33
|
+
even for a signed-in caller with the wrong role. Every service's http suite pins that.
|
|
34
|
+
A caller needing to tell "not signed in" from "not permitted" must check the role itself.
|
|
35
|
+
|
|
10
36
|
## Upgrading to 2.0.0 — BREAKING
|
|
11
37
|
|
|
12
38
|
The error classes moved to `@easyweb/errors`. Error handling is cross-cutting and has
|
|
@@ -101,6 +127,8 @@ would deny every request.
|
|
|
101
127
|
| `createJwtSigner(config)` | `(claims) => string` |
|
|
102
128
|
| `extractToken(req)` | Bearer header, then the `accessToken` cookie |
|
|
103
129
|
| `isValidAccessPayload(decoded)` | type guard: is this a well-formed *access* token? |
|
|
130
|
+
| `effectiveRoles(roles)` | the roles held, expanded through the implication map (2.1.0) |
|
|
131
|
+
| `effectiveRoles(roles)` | the roles held, expanded through the implication map (2.1.0) |
|
|
104
132
|
| `JwtAccessPayload`, `JwtAccessClaims`, `JwtVerifyConfig`, `JwtSignConfig` | types |
|
|
105
133
|
|
|
106
134
|
`extractToken` and `isValidAccessPayload` exist for services that must keep a DB-backed
|
|
@@ -57,12 +57,25 @@ export declare function extractToken(req: Request): string | null;
|
|
|
57
57
|
* needs the same guard but reports failure with its own message.
|
|
58
58
|
*/
|
|
59
59
|
export declare function isValidAccessPayload(decoded: JwtAccessPayload | null | undefined): decoded is JwtAccessPayload;
|
|
60
|
+
/**
|
|
61
|
+
* The roles a caller holds, plus everything those roles stand in for.
|
|
62
|
+
*
|
|
63
|
+
* Exported for tests and for any service that needs the same expansion outside
|
|
64
|
+
* a middleware — auth-service's own DB-backed guard, in particular, which does
|
|
65
|
+
* not go through `createAuthMiddleware`.
|
|
66
|
+
*/
|
|
67
|
+
export declare function effectiveRoles(roles: readonly string[]): Set<string>;
|
|
60
68
|
export type AuthMiddleware = {
|
|
61
69
|
/** Rejects with 401 unless the request carries a valid access token. */
|
|
62
70
|
authenticate: (req: Request, res: Response, next: NextFunction) => void;
|
|
63
71
|
/** Populates `req.user` when a valid token is present; never rejects. */
|
|
64
72
|
optionalAuth: (req: Request, res: Response, next: NextFunction) => void;
|
|
65
|
-
/**
|
|
73
|
+
/**
|
|
74
|
+
* Role guard. Use after `authenticate`.
|
|
75
|
+
*
|
|
76
|
+
* Matches against the caller's roles expanded through `ROLE_IMPLIES`, so
|
|
77
|
+
* `authorize(["ADMIN"])` admits `SUPER_ADMIN`.
|
|
78
|
+
*/
|
|
66
79
|
authorize: (allowedRoles: string[]) => (req: Request, res: Response, next: NextFunction) => void;
|
|
67
80
|
};
|
|
68
81
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBACxB,KAAK,EAAE,MAAM,EAAE,CAAC;gBAChB,WAAW,EAAE,MAAM,EAAE,CAAC;aACvB,CAAC;YACF,IAAI,CAAC,EAAE;gBACL,MAAM,EAAE,MAAM,CAAC;gBACf,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH;KACF;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,OAAO,IAAI,gBAAgB,CAQ7B;AAqBD,MAAM,MAAM,cAAc,GAAG;IAC3B,wEAAwE;IACxE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE,yEAAyE;IACzE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE
|
|
1
|
+
{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBACxB,KAAK,EAAE,MAAM,EAAE,CAAC;gBAChB,WAAW,EAAE,MAAM,EAAE,CAAC;aACvB,CAAC;YACF,IAAI,CAAC,EAAE;gBACL,MAAM,EAAE,MAAM,CAAC;gBACf,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH;KACF;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,OAAO,IAAI,gBAAgB,CAQ7B;AAsBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUpE;AAqBD,MAAM,MAAM,cAAc,GAAG;IAC3B,wEAAwE;IACxE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE,yEAAyE;IACzE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE;;;;;OAKG;IACH,SAAS,EAAE,CACT,YAAY,EAAE,MAAM,EAAE,KACnB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CAChE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CA6E5E"}
|
|
@@ -2,6 +2,7 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.extractToken = extractToken;
|
|
4
4
|
exports.isValidAccessPayload = isValidAccessPayload;
|
|
5
|
+
exports.effectiveRoles = effectiveRoles;
|
|
5
6
|
exports.createAuthMiddleware = createAuthMiddleware;
|
|
6
7
|
const verify_1 = require("../jwt/verify");
|
|
7
8
|
const errors_1 = require("@easyweb/errors");
|
|
@@ -42,6 +43,41 @@ function isValidAccessPayload(decoded) {
|
|
|
42
43
|
decoded.sessionId &&
|
|
43
44
|
decoded.iat);
|
|
44
45
|
}
|
|
46
|
+
/**
|
|
47
|
+
* Which roles a role stands in for.
|
|
48
|
+
*
|
|
49
|
+
* `authorize()` was an exact string match, and every admin route in the
|
|
50
|
+
* platform is written `authorize(["ADMIN"])` — so `SUPER_ADMIN`, which
|
|
51
|
+
* auth-service's `admin-seed.ts` grants the bootstrap operator by default,
|
|
52
|
+
* could not call a single one of them. The seeded account was locked out of
|
|
53
|
+
* the surface it exists to reach.
|
|
54
|
+
*
|
|
55
|
+
* Deliberately ONE entry. `ADMIN` does not imply `USER`: nothing calls
|
|
56
|
+
* `authorize(["USER"])` today, and adding that edge would silently widen every
|
|
57
|
+
* future customer route to staff — the kind of grant nobody re-reads.
|
|
58
|
+
*
|
|
59
|
+
* Widening only, which is what makes the 2.1.0 release safe to roll out one
|
|
60
|
+
* service at a time: a service still on 2.0.0 keeps behaving exactly as it did.
|
|
61
|
+
*/
|
|
62
|
+
const ROLE_IMPLIES = {
|
|
63
|
+
SUPER_ADMIN: ["ADMIN"],
|
|
64
|
+
};
|
|
65
|
+
/**
|
|
66
|
+
* The roles a caller holds, plus everything those roles stand in for.
|
|
67
|
+
*
|
|
68
|
+
* Exported for tests and for any service that needs the same expansion outside
|
|
69
|
+
* a middleware — auth-service's own DB-backed guard, in particular, which does
|
|
70
|
+
* not go through `createAuthMiddleware`.
|
|
71
|
+
*/
|
|
72
|
+
function effectiveRoles(roles) {
|
|
73
|
+
const effective = new Set(roles);
|
|
74
|
+
for (const role of roles) {
|
|
75
|
+
for (const implied of ROLE_IMPLIES[role] ?? []) {
|
|
76
|
+
effective.add(implied);
|
|
77
|
+
}
|
|
78
|
+
}
|
|
79
|
+
return effective;
|
|
80
|
+
}
|
|
45
81
|
function attachClaims(req, decoded) {
|
|
46
82
|
req.user = {
|
|
47
83
|
id: decoded.sub,
|
|
@@ -102,10 +138,17 @@ function createAuthMiddleware(config) {
|
|
|
102
138
|
}
|
|
103
139
|
next();
|
|
104
140
|
};
|
|
141
|
+
/**
|
|
142
|
+
* NOTE the status: `NotAuthorizedError` is 401, so a signed-in caller with
|
|
143
|
+
* the wrong role gets the same answer as an anonymous one. That is a quirk
|
|
144
|
+
* of this package rather than a decision, and every service's http tests pin
|
|
145
|
+
* it as-is — changing it here would turn eight suites red at once. A caller
|
|
146
|
+
* that needs to tell the two apart should check the role itself.
|
|
147
|
+
*/
|
|
105
148
|
const authorize = (allowedRoles) => {
|
|
106
149
|
return (req, _res, next) => {
|
|
107
|
-
const
|
|
108
|
-
if (!
|
|
150
|
+
const held = effectiveRoles(req.user?.roles ?? []);
|
|
151
|
+
if (!allowedRoles.some((r) => held.has(r))) {
|
|
109
152
|
throw new errors_1.NotAuthorizedError("Insufficient role");
|
|
110
153
|
}
|
|
111
154
|
next();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":";;AAkDA,oCAYC;AAeD,oDAUC;
|
|
1
|
+
{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":";;AAkDA,oCAYC;AAeD,oDAUC;AA6BD,wCAUC;AA0CD,oDA6EC;AApPD,0CAAkD;AAClD,4CAAqD;AAyCrD;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,GAAY;IACvC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAClC,OAA4C;IAE5C,OAAO,OAAO,CACZ,OAAO;QACL,OAAO,CAAC,IAAI,KAAK,QAAQ;QACzB,OAAO,CAAC,GAAG;QACX,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,GAAG,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAAgD;IAChE,WAAW,EAAE,CAAC,OAAO,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,KAAwB;IACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,OAAyB;IAC3D,GAAG,CAAC,IAAI,GAAG;QACT,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,yDAAyD;QACzD,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,GAAG,CAAC,IAAI,GAAG;QACT,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAkBD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAuB;IAC1D,MAAM,iBAAiB,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,CAAC;IAEpD;;;;OAIG;IACH,SAAS,iBAAiB,CAAC,KAAa;QACtC,IAAI,OAAyB,CAAC;QAE9B,IAAI,CAAC;YACH,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE3B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,OAAO;gBAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,SAAS,GAAG,CAAC,YAAsB,EAAE,EAAE;QAC3C,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;YAChE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAEnD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,2BAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@easyweb/authentication",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.1.0",
|
|
4
4
|
"description": "Shared authentication primitives for Easyweb microservices: stateless JWT middleware, request context, and token verification helpers",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -19,7 +19,10 @@
|
|
|
19
19
|
"build": "npm run clean && tsc",
|
|
20
20
|
"build:watch": "tsc --watch",
|
|
21
21
|
"prepublishOnly": "npm run build",
|
|
22
|
-
"clean": "rimraf dist"
|
|
22
|
+
"clean": "rimraf dist",
|
|
23
|
+
"test": "jest",
|
|
24
|
+
"typecheck": "tsc --noEmit",
|
|
25
|
+
"typecheck:test": "tsc -p tsconfig.test.json --noEmit"
|
|
23
26
|
},
|
|
24
27
|
"keywords": [
|
|
25
28
|
"microservices",
|
|
@@ -42,9 +45,14 @@
|
|
|
42
45
|
},
|
|
43
46
|
"devDependencies": {
|
|
44
47
|
"@easyweb/errors": "^1.0.0",
|
|
48
|
+
"@swc/core": "^1.15.47",
|
|
49
|
+
"@swc/jest": "^0.2.39",
|
|
45
50
|
"@types/express": "^5.0.6",
|
|
51
|
+
"@types/jest": "^30.0.0",
|
|
46
52
|
"@types/jsonwebtoken": "^9.0.10",
|
|
47
53
|
"@types/node": "^26.0.1",
|
|
54
|
+
"jest": "^30.4.2",
|
|
55
|
+
"jsonwebtoken": "^9.0.3",
|
|
48
56
|
"rimraf": "^6.1.3",
|
|
49
57
|
"typescript": "^6.0.3"
|
|
50
58
|
},
|