@easyweb/authentication 2.1.0 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/middleware/authenticate.d.ts.map +1 -1
- package/dist/middleware/authenticate.js +15 -0
- package/dist/middleware/authenticate.js.map +1 -1
- package/dist/middleware/request-context.d.ts +6 -2
- package/dist/middleware/request-context.d.ts.map +1 -1
- package/dist/middleware/request-context.js +28 -4
- package/dist/middleware/request-context.js.map +1 -1
- package/package.json +4 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE;gBACL,EAAE,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC;gBACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBACxB,KAAK,EAAE,MAAM,EAAE,CAAC;gBAChB,WAAW,EAAE,MAAM,EAAE,CAAC;aACvB,CAAC;YACF,IAAI,CAAC,EAAE;gBACL,MAAM,EAAE,MAAM,CAAC;gBACf,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH;KACF;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,OAAO,IAAI,gBAAgB,CAQ7B;AAsBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAUpE;AAoCD,MAAM,MAAM,cAAc,GAAG;IAC3B,wEAAwE;IACxE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE,yEAAyE;IACzE,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IACxE;;;;;OAKG;IACH,SAAS,EAAE,CACT,YAAY,EAAE,MAAM,EAAE,KACnB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CAChE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,CA6E5E"}
|
|
@@ -4,6 +4,7 @@ exports.extractToken = extractToken;
|
|
|
4
4
|
exports.isValidAccessPayload = isValidAccessPayload;
|
|
5
5
|
exports.effectiveRoles = effectiveRoles;
|
|
6
6
|
exports.createAuthMiddleware = createAuthMiddleware;
|
|
7
|
+
const logging_1 = require("@easyweb/logging");
|
|
7
8
|
const verify_1 = require("../jwt/verify");
|
|
8
9
|
const errors_1 = require("@easyweb/errors");
|
|
9
10
|
/**
|
|
@@ -94,6 +95,20 @@ function attachClaims(req, decoded) {
|
|
|
94
95
|
userId: decoded.sub,
|
|
95
96
|
sessionId: decoded.sessionId,
|
|
96
97
|
};
|
|
98
|
+
/**
|
|
99
|
+
* Puts the caller on every log line for the rest of the request, including
|
|
100
|
+
* ones emitted by code that was never handed a `log` parameter.
|
|
101
|
+
*
|
|
102
|
+
* `requestContext` opened the scope before any token had been read, so this
|
|
103
|
+
* is a mutation of a scope already running rather than a new one — which is
|
|
104
|
+
* also what makes it visible to the access log, whose finish callback
|
|
105
|
+
* captured the store by reference several middlewares ago.
|
|
106
|
+
*
|
|
107
|
+
* Roles are deliberately not bound: they are an array that would be
|
|
108
|
+
* serialized onto every single line, and `authorize` failures already name
|
|
109
|
+
* them.
|
|
110
|
+
*/
|
|
111
|
+
(0, logging_1.bindContext)({ userId: decoded.sub, sessionId: decoded.sessionId });
|
|
97
112
|
}
|
|
98
113
|
/**
|
|
99
114
|
* Binds the JWT config once at startup and returns the middleware trio. The
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../src/middleware/authenticate.ts"],"names":[],"mappings":";;AAmDA,oCAYC;AAeD,oDAUC;AA6BD,wCAUC;AAyDD,oDA6EC;AApQD,8CAA+C;AAC/C,0CAAkD;AAClD,4CAAqD;AAyCrD;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,GAAY;IACvC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE7C,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAClC,OAA4C;IAE5C,OAAO,OAAO,CACZ,OAAO;QACL,OAAO,CAAC,IAAI,KAAK,QAAQ;QACzB,OAAO,CAAC,GAAG;QACX,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,GAAG,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAAgD;IAChE,WAAW,EAAE,CAAC,OAAO,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,KAAwB;IACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,OAAyB;IAC3D,GAAG,CAAC,IAAI,GAAG;QACT,EAAE,EAAE,OAAO,CAAC,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,yDAAyD;QACzD,WAAW,EAAE,EAAE;KAChB,CAAC;IAEF,GAAG,CAAC,IAAI,GAAG;QACT,MAAM,EAAE,OAAO,CAAC,GAAG;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;AACrE,CAAC;AAkBD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,MAAuB;IAC1D,MAAM,iBAAiB,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,CAAC;IAEpD;;;;OAIG;IACH,SAAS,iBAAiB,CAAC,KAAa;QACtC,IAAI,OAAyB,CAAC;QAE9B,IAAI,CAAC;YACH,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE3B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CACnB,GAAY,EACZ,IAAc,EACd,IAAkB,EACZ,EAAE;QACR,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAEhC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,OAAO;gBAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,SAAS,GAAG,CAAC,YAAsB,EAAE,EAAE;QAC3C,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;YAChE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAEnD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,2BAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC"}
|
|
@@ -8,8 +8,12 @@ declare global {
|
|
|
8
8
|
}
|
|
9
9
|
/**
|
|
10
10
|
* Picks up x-request-id from incoming headers (for inter-service forwarding),
|
|
11
|
-
* or generates a new UUID when the request originates externally.
|
|
12
|
-
*
|
|
11
|
+
* or generates a new UUID when the request originates externally. Always echoes
|
|
12
|
+
* the final value back in the response header.
|
|
13
|
+
*
|
|
14
|
+
* It also opens the AsyncLocalStorage scope every log line in the request reads
|
|
15
|
+
* from, which is why it must stay the FIRST middleware: anything mounted above
|
|
16
|
+
* it logs outside the scope and correlates with nothing.
|
|
13
17
|
*/
|
|
14
18
|
export declare function requestContext(req: Request, res: Response, next: NextFunction): void;
|
|
15
19
|
//# sourceMappingURL=request-context.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/middleware/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/middleware/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,SAAS,EAAE,MAAM,CAAC;SACnB;KACF;CACF;AAsBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,QAYnB"}
|
|
@@ -2,18 +2,42 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.requestContext = requestContext;
|
|
4
4
|
const crypto_1 = require("crypto");
|
|
5
|
+
const logging_1 = require("@easyweb/logging");
|
|
6
|
+
/**
|
|
7
|
+
* What we are willing to accept as somebody else's request id.
|
|
8
|
+
*
|
|
9
|
+
* The header is attacker-controlled. `k8s/base/ingress.yaml` publishes every
|
|
10
|
+
* service at `path: /`, so anything on the internet can set `x-request-id`, and
|
|
11
|
+
* this middleware used to take any non-empty string. That value then reaches
|
|
12
|
+
* every log line the request produces, the error envelope the customer is
|
|
13
|
+
* shown, and — once logs are aggregated — a field operators join traces on.
|
|
14
|
+
*
|
|
15
|
+
* Two things it buys. A newline in a log field splits one JSON record into two,
|
|
16
|
+
* so an attacker could forge log lines; and a caller pinning one fixed value
|
|
17
|
+
* collapses every one of their requests onto a single trace, which is the field
|
|
18
|
+
* being denied rather than abused.
|
|
19
|
+
*
|
|
20
|
+
* Wide enough for a UUID from a sibling service and for a short opaque token
|
|
21
|
+
* from the browser. Anything else is replaced rather than rejected — a bad
|
|
22
|
+
* header is not worth failing a request over.
|
|
23
|
+
*/
|
|
24
|
+
const VALID_REQUEST_ID = /^[A-Za-z0-9_-]{1,64}$/;
|
|
5
25
|
/**
|
|
6
26
|
* Picks up x-request-id from incoming headers (for inter-service forwarding),
|
|
7
|
-
* or generates a new UUID when the request originates externally.
|
|
8
|
-
*
|
|
27
|
+
* or generates a new UUID when the request originates externally. Always echoes
|
|
28
|
+
* the final value back in the response header.
|
|
29
|
+
*
|
|
30
|
+
* It also opens the AsyncLocalStorage scope every log line in the request reads
|
|
31
|
+
* from, which is why it must stay the FIRST middleware: anything mounted above
|
|
32
|
+
* it logs outside the scope and correlates with nothing.
|
|
9
33
|
*/
|
|
10
34
|
function requestContext(req, res, next) {
|
|
11
35
|
const incoming = req.headers["x-request-id"];
|
|
12
|
-
const requestId = typeof incoming === "string" && incoming
|
|
36
|
+
const requestId = typeof incoming === "string" && VALID_REQUEST_ID.test(incoming)
|
|
13
37
|
? incoming
|
|
14
38
|
: (0, crypto_1.randomUUID)();
|
|
15
39
|
req.requestId = requestId;
|
|
16
40
|
res.setHeader("x-request-id", requestId);
|
|
17
|
-
next();
|
|
41
|
+
(0, logging_1.runWithContext)({ requestId }, () => next());
|
|
18
42
|
}
|
|
19
43
|
//# sourceMappingURL=request-context.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/middleware/request-context.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/middleware/request-context.ts"],"names":[],"mappings":";;AAyCA,wCAeC;AAvDD,mCAAoC;AACpC,8CAAkD;AAUlD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAEjD;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAC5B,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC7D,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAA,mBAAU,GAAE,CAAC;IAEnB,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;IAC1B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAEzC,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@easyweb/authentication",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.2.0",
|
|
4
4
|
"description": "Shared authentication primitives for Easyweb microservices: stateless JWT middleware, request context, and token verification helpers",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -40,11 +40,13 @@
|
|
|
40
40
|
},
|
|
41
41
|
"peerDependencies": {
|
|
42
42
|
"@easyweb/errors": "^1.0.0",
|
|
43
|
+
"@easyweb/logging": "^1.0.0",
|
|
43
44
|
"express": "^5.0.0",
|
|
44
45
|
"jsonwebtoken": "^9.0.0"
|
|
45
46
|
},
|
|
46
47
|
"devDependencies": {
|
|
47
48
|
"@easyweb/errors": "^1.0.0",
|
|
49
|
+
"@easyweb/logging": "^1.0.0",
|
|
48
50
|
"@swc/core": "^1.15.47",
|
|
49
51
|
"@swc/jest": "^0.2.39",
|
|
50
52
|
"@types/express": "^5.0.6",
|
|
@@ -53,6 +55,7 @@
|
|
|
53
55
|
"@types/node": "^26.0.1",
|
|
54
56
|
"jest": "^30.4.2",
|
|
55
57
|
"jsonwebtoken": "^9.0.3",
|
|
58
|
+
"pino": "^10.3.1",
|
|
56
59
|
"rimraf": "^6.1.3",
|
|
57
60
|
"typescript": "^6.0.3"
|
|
58
61
|
},
|