@eduzz/miau-client 1.2.0 → 1.2.1

package/.turbo/turbo-build$colon$types.log

@@ -1,4 +1,4 @@
 
-> @eduzz/miau-client@1.2.0 build:types /home/runner/work/eduzz-miau/eduzz-miau/packages/client
+> @eduzz/miau-client@1.2.1 build:types /home/runner/work/eduzz-miau/eduzz-miau/packages/client
 > tsc --emitDeclarationOnly --outDir dist
 

package/dist/MiauClient.d.ts

@@ -1,5 +1,5 @@
 import { type RequestHandler } from 'express';
-import { type SecretEnv, type Permission, type Resource } from '@eduzz/miau-types';
+import { type SecretEnv, type Permission, type Resource, type MiauClientToken } from '@eduzz/miau-types';
 import { type RequestAugmentation } from './middleware';
 type MiauClientConfig = {
     apiUrl: string;
@@ -14,12 +14,14 @@ export declare class MiauClient {
     getEnvironment(): SecretEnv;
     getPublicKey(kid: string): Promise<string>;
     getToken(): Promise<string | undefined>;
+    getTokenData: () => Promise<MiauClientToken>;
     middleware<T = Record<string, string>>(config?: {
         requestAugmentation?: RequestAugmentation<T>;
         fallbackMiddleware?: RequestHandler;
     }): RequestHandler;
     getResources(): Promise<Resource[]>;
     getPermissions(targetAppId: string): Promise<Permission>;
+    verify(token: string, publicKey: string): Promise<MiauClientToken>;
     private getApiJwtUrl;
     private getPermissionsUrl;
     private getResourcesUrl;

package/dist/index.js

@@ -11909,8 +11909,8 @@ var isResourceAllowed = (resource, resources, permittedResources) => {
 
 // src/middleware.ts
 var HttpError = class _HttpError extends Error {
-  constructor(status, name, message) {
-    super(message);
+  constructor(status, name, message, code) {
+    super(`${message} (${code})`);
     this.name = name;
     this.status = status;
     Object.setPrototypeOf(this, _HttpError.prototype);
@@ -11921,49 +11921,59 @@ var miauMiddleware = (miauClient, requestAugmentation, fallbackMiddleware) => {
     try {
       const token = req.headers.authorization?.split(" ").pop();
       if (!token) {
-        throw new HttpError(400, "Invalid Token", "Token not provided");
+        throw new HttpError(400, "Invalid Token", "Token not provided", "MIAU_TKN_A");
       }
       const decodedToken = import_jsonwebtoken.default.decode(token, { complete: true });
       if (!decodedToken) {
-        throw new HttpError(400, "Invalid Token", "Token could not be decoded");
+        throw new HttpError(400, "Invalid Token", "Token could not be decoded", "MIAU_TKN_B");
       }
       if (!decodedToken.header?.kid) {
-        throw new HttpError(400, "Invalid Token", "Missing kid in token header");
+        throw new HttpError(400, "Invalid Token", "Missing kid in token header", "MIAU_TKN_C");
       }
       if (decodedToken.payload.iss !== issuers["production"]) {
-        throw new HttpError(400, "Invalid Token", "Token issuer is invalid");
+        throw new HttpError(400, "Invalid Token", "Token issuer is invalid", "MIAU_TKN_D");
       }
       const publicKey = await miauClient.getPublicKey(decodedToken.header.kid);
-      const clientToken = import_jsonwebtoken.default.verify(token, publicKey, { algorithms: ["RS256"] });
-      if (!clientToken || !clientToken.application || !clientToken.secret || !clientToken.application.id || !clientToken.secret.id || !clientToken.secret.environment) {
-        throw new HttpError(400, "Invalid Token", "Token verification failed");
-      }
-      const { application, secret } = clientToken;
-      if (secret.environment != miauClient.getEnvironment()) {
+      const clientTokenData = await miauClient.verify(token, publicKey);
+      const serverTokenData = await miauClient.getTokenData();
+      if (!clientTokenData || !clientTokenData.application || !clientTokenData.secret || !clientTokenData.application.id || !clientTokenData.secret.id || !clientTokenData.secret.environment) {
+        throw new HttpError(401, "Invalid Token", "Token invalid or expired", "MIAU_TKN_E");
+      }
+      const { application: clientApplication, secret: clientSecret } = clientTokenData;
+      const { application: serverApplication, secret: serverSecret } = serverTokenData;
+      if (clientSecret.environment != serverSecret.environment) {
         throw new HttpError(
-          400,
+          401,
           "Invalid Environment",
-          `Secret environment ${secret.environment} does not match client environment ${miauClient.getEnvironment()}`
+          `Secret environment ${clientSecret.environment} does not match Server environment ${serverSecret.environment}`,
+          "MIAU_ENV_A"
         );
       }
       const resources = await miauClient.getResources();
       if (!resources) {
-        throw new HttpError(401, "Unauthorized", "No resources found for this application");
+        throw new HttpError(401, "Unauthorized", `No resources configured in ${serverApplication.name}`, "MIAU_RES_A");
       }
-      const permission = await miauClient.getPermissions(application.id);
+      const permission = await miauClient.getPermissions(clientApplication.id);
       if (!permission) {
-        throw new HttpError(401, "Unauthorized", "No permissions found for this application");
+        throw new HttpError(
+          401,
+          "Unauthorized",
+          `No permissions found for ${clientApplication.name} in ${serverApplication.name}`,
+          "MIAU_PERM_A"
+        );
       }
       const permittedResources = permission?.resources || [];
-      if (!permittedResources.length) {
-        throw new HttpError(403, "Forbidden", "No resources are permitted for this application");
-      }
       const resource = { protocol: "http", method: req.method, path: req.path };
       const isAllowed = isResourceAllowed(resource, resources, permittedResources);
       if (!isAllowed) {
-        throw new HttpError(403, "Forbidden", `You do not have permission to access ${req.method} ${req.path}`);
+        throw new HttpError(
+          403,
+          "Forbidden",
+          `${clientApplication.name} does not have permission to ${req.method} ${req.path} on ${serverApplication.name}`,
+          "MIAU_PERM_B"
+        );
       }
-      req.miauApplication = { id: application.id, name: application.name };
+      req.miauApplication = { id: clientApplication.id, name: clientApplication.name };
       const environment = miauClient.getEnvironment();
       req.miauMetadata = permission?.metadata?.[environment] || {};
       if (requestAugmentation) {
@@ -12022,6 +12032,13 @@ var expiresHeaderToUnixtime = (expires) => {
 };
 var MiauClient = class {
   constructor(config) {
+    this.getTokenData = async () => {
+      const token = await this.getToken();
+      if (!token) {
+        throw new Error("Token is undefined");
+      }
+      return import_jsonwebtoken2.default.decode(token);
+    };
     this.getApiJwtUrl = () => {
       return `${this.config.apiUrl}/v1/jwt`;
     };
@@ -12091,6 +12108,9 @@ var MiauClient = class {
       headers: { Authorization: `Basic ${this.basicAuthToken}` }
     });
   }
+  async verify(token, publicKey) {
+    return import_jsonwebtoken2.default.verify(token, publicKey, { algorithms: ["RS256"] });
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {