@eduzz/miau-client 1.2.0 → 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eduzz/miau-client",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Eduzz Miau Client",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/src/MiauClient.ts

@@ -4,7 +4,7 @@ import { type RequestHandler } from 'express';
 import jwt from 'jsonwebtoken';
 import { JwksClient } from 'jwks-rsa';
 
-import { type SecretEnv, type Permission, type Resource, inverseEnvMap } from '@eduzz/miau-types';
+import { type SecretEnv, type Permission, type Resource, inverseEnvMap, type MiauClientToken } from '@eduzz/miau-types';
 
 import { miauMiddleware, type RequestAugmentation } from './middleware';
 
@@ -123,6 +123,16 @@ export class MiauClient {
     return this.jwtToken;
   }
 
+  public getTokenData = async () => {
+    const token = await this.getToken();
+
+    if (!token) {
+      throw new Error('Token is undefined');
+    }
+
+    return jwt.decode(token) as MiauClientToken;
+  };
+
   public middleware<T = Record<string, string>>(config?: {
     requestAugmentation?: RequestAugmentation<T>;
     fallbackMiddleware?: RequestHandler;
@@ -142,6 +152,10 @@ export class MiauClient {
     });
   }
 
+  public async verify(token: string, publicKey: string): Promise<MiauClientToken> {
+    return jwt.verify(token, publicKey, { algorithms: ['RS256'] }) as MiauClientToken;
+  }
+
   private getApiJwtUrl = () => {
     return `${this.config.apiUrl}/v1/jwt`;
   };

package/src/middleware.ts

@@ -1,7 +1,7 @@
 import { type RequestHandler, type NextFunction, type Request, type Response } from 'express';
 import jwt from 'jsonwebtoken';
 
-import { type Resource, type MiauApplication, type MiauClientToken, type JWTToken, issuers } from '@eduzz/miau-types';
+import { type Resource, type MiauApplication, type JWTToken, issuers } from '@eduzz/miau-types';
 
 import { isResourceAllowed } from './functions';
 import type { MiauClient } from './MiauClient';
@@ -9,8 +9,8 @@ import type { MiauClient } from './MiauClient';
 class HttpError extends Error {
   public status: number;
 
-  constructor(status: number, name: string, message: string) {
-    super(message);
+  constructor(status: number, name: string, message: string, code: string) {
+    super(`${message} (${code})`);
     this.name = name;
     this.status = status;
 
@@ -30,73 +30,82 @@ export const miauMiddleware = <T>(
       const token = req.headers.authorization?.split(' ').pop();
 
       if (!token) {
-        throw new HttpError(400, 'Invalid Token', 'Token not provided');
+        throw new HttpError(400, 'Invalid Token', 'Token not provided', 'MIAU_TKN_A');
       }
 
       const decodedToken = jwt.decode(token, { complete: true }) as JWTToken | null;
 
       if (!decodedToken) {
-        throw new HttpError(400, 'Invalid Token', 'Token could not be decoded');
+        throw new HttpError(400, 'Invalid Token', 'Token could not be decoded', 'MIAU_TKN_B');
       }
 
       if (!decodedToken.header?.kid) {
-        throw new HttpError(400, 'Invalid Token', 'Missing kid in token header');
+        throw new HttpError(400, 'Invalid Token', 'Missing kid in token header', 'MIAU_TKN_C');
       }
 
       if (decodedToken.payload.iss !== issuers['production']) {
-        throw new HttpError(400, 'Invalid Token', 'Token issuer is invalid');
+        throw new HttpError(400, 'Invalid Token', 'Token issuer is invalid', 'MIAU_TKN_D');
       }
 
       const publicKey = await miauClient.getPublicKey(decodedToken.header.kid);
-      const clientToken = jwt.verify(token, publicKey, { algorithms: ['RS256'] }) as MiauClientToken;
+      const clientTokenData = await miauClient.verify(token, publicKey);
+      const serverTokenData = await miauClient.getTokenData();
 
       if (
-        !clientToken ||
-        !clientToken.application ||
-        !clientToken.secret ||
-        !clientToken.application.id ||
-        !clientToken.secret.id ||
-        !clientToken.secret.environment
+        !clientTokenData ||
+        !clientTokenData.application ||
+        !clientTokenData.secret ||
+        !clientTokenData.application.id ||
+        !clientTokenData.secret.id ||
+        !clientTokenData.secret.environment
       ) {
-        throw new HttpError(400, 'Invalid Token', 'Token verification failed');
+        throw new HttpError(401, 'Invalid Token', 'Token invalid or expired', 'MIAU_TKN_E');
       }
 
-      const { application, secret } = clientToken;
+      const { application: clientApplication, secret: clientSecret } = clientTokenData;
+      const { application: serverApplication, secret: serverSecret } = serverTokenData;
 
-      if (secret.environment != miauClient.getEnvironment()) {
+      if (clientSecret.environment != serverSecret.environment) {
         throw new HttpError(
-          400,
+          401,
           'Invalid Environment',
-          `Secret environment ${secret.environment} does not match client environment ${miauClient.getEnvironment()}`
+          `Secret environment ${clientSecret.environment} does not match Server environment ${serverSecret.environment}`,
+          'MIAU_ENV_A'
         );
       }
 
       const resources = await miauClient.getResources();
 
       if (!resources) {
-        throw new HttpError(401, 'Unauthorized', 'No resources found for this application');
+        throw new HttpError(401, 'Unauthorized', `No resources configured in ${serverApplication.name}`, 'MIAU_RES_A');
       }
 
-      const permission = await miauClient.getPermissions(application.id);
+      const permission = await miauClient.getPermissions(clientApplication.id);
 
       if (!permission) {
-        throw new HttpError(401, 'Unauthorized', 'No permissions found for this application');
+        throw new HttpError(
+          401,
+          'Unauthorized',
+          `No permissions found for ${clientApplication.name} in ${serverApplication.name}`,
+          'MIAU_PERM_A'
+        );
       }
 
       const permittedResources = permission?.resources || [];
 
-      if (!permittedResources.length) {
-        throw new HttpError(403, 'Forbidden', 'No resources are permitted for this application');
-      }
-
       const resource = { protocol: 'http', method: req.method, path: req.path } as Resource;
       const isAllowed = isResourceAllowed(resource, resources, permittedResources);
 
       if (!isAllowed) {
-        throw new HttpError(403, 'Forbidden', `You do not have permission to access ${req.method} ${req.path}`);
+        throw new HttpError(
+          403,
+          'Forbidden',
+          `${clientApplication.name} does not have permission to ${req.method} ${req.path} on ${serverApplication.name}`,
+          'MIAU_PERM_B'
+        );
       }
 
-      req.miauApplication = { id: application.id, name: application.name };
+      req.miauApplication = { id: clientApplication.id, name: clientApplication.name };
       const environment = miauClient.getEnvironment();
       req.miauMetadata = permission?.metadata?.[environment] || {};