@epztickets/common 1.64.0 → 1.65.0

package/build/events/subjects.d.ts

@@ -28,6 +28,7 @@ export declare enum Subjects {
     UserDeleted = "events.user.deleted",
     UserDeletionRequested = "events.user.deletion-requested",
     UserDeletionRejected = "events.user.deletion-rejected",
+    UserEmailVerificationRequested = "events.user.email-verification-requested",
     ConnectDisconnectRequested = "events.user.connect-disconnect-requested",
     ConnectDisconnectApproved = "events.user.connect-disconnect-approved",
     ConnectDisconnectRejected = "events.user.connect-disconnect-rejected"

package/build/events/subjects.js

@@ -45,6 +45,12 @@ var Subjects;
     Subjects["UserDeleted"] = "events.user.deleted";
     Subjects["UserDeletionRequested"] = "events.user.deletion-requested";
     Subjects["UserDeletionRejected"] = "events.user.deletion-rejected";
+    // Auth publishes at signup (and on resend-verification) with the
+    // plaintext one-shot token + expiry. notifications-srv consumes
+    // and dispatches the verification email. The plaintext is in the
+    // event payload because the email is the ONE place it surfaces
+    // — auth's User row only has the SHA-256 hash.
+    Subjects["UserEmailVerificationRequested"] = "events.user.email-verification-requested";
     // Owner-initiated "stop hosting" lifecycle. Mirrors the deletion
     // request triplet — auth publishes Requested at submission, then
     // either Approved (which IS the disconnect) or Rejected after admin

package/build/events/user-email-verification-requested-event.d.ts

@@ -0,0 +1,12 @@
+import { Subjects } from "./subjects";
+export interface UserEmailVerificationRequestedEvent {
+    subject: Subjects.UserEmailVerificationRequested;
+    data: {
+        userId: string;
+        email: string;
+        /** Plaintext verification token to embed in the email link. */
+        token: string;
+        /** ISO timestamp of when the token expires (24h after issue). */
+        expiresAt: string;
+    };
+}

package/build/events/user-email-verification-requested-event.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/build/index.d.ts

@@ -45,6 +45,7 @@ export * from "./events/user-updated-event";
 export * from "./events/user-deleted-event";
 export * from "./events/user-deletion-requested-event";
 export * from "./events/user-deletion-rejected-event";
+export * from "./events/user-email-verification-requested-event";
 export * from "./events/connect-disconnect-requested-event";
 export * from "./events/connect-disconnect-approved-event";
 export * from "./events/connect-disconnect-rejected-event";

package/build/index.js

@@ -64,6 +64,7 @@ __exportStar(require("./events/user-updated-event"), exports);
 __exportStar(require("./events/user-deleted-event"), exports);
 __exportStar(require("./events/user-deletion-requested-event"), exports);
 __exportStar(require("./events/user-deletion-rejected-event"), exports);
+__exportStar(require("./events/user-email-verification-requested-event"), exports);
 __exportStar(require("./events/connect-disconnect-requested-event"), exports);
 __exportStar(require("./events/connect-disconnect-approved-event"), exports);
 __exportStar(require("./events/connect-disconnect-rejected-event"), exports);

package/build/middlewares/current-user.js

@@ -5,15 +5,66 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.currentUser = void 0;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+// Look up the public key for a given `kid` (key id, from the JWT
+// header). Falls through to single-key JWT_PUBLIC_KEY if either no
+// kid is present (legacy token issued before rotation was wired)
+// or the keyed env var isn't set (still operating in single-key
+// mode pre-rotation).
+//
+// Two supported env layouts:
+//
+//   Single-key (legacy, default):
+//     JWT_PUBLIC_KEY=<pem>
+//
+//   Multi-key (during/after rotation):
+//     JWT_PUBLIC_KEYS={"kid-1":"<pem>","kid-2":"<pem>"}
+//     JWT_PUBLIC_KEY=<pem>                    (still accepted as fallback)
+//
+// JWT_PUBLIC_KEYS holds a JSON object mapping kid → PEM. The PEMs
+// have embedded newlines which is awkward in shell env vars; the
+// production convention is to base64-encode each PEM in the JSON
+// value and decode here. To keep this middleware compatible with
+// plain-text PEMs too (the common case in tests + dev), we accept
+// both: if a value contains "-----BEGIN" it's used as-is; otherwise
+// we base64-decode it.
+//
+// The JSON parse + decode runs ON EACH REQUEST today. That's fine
+// for current traffic; if it ever becomes hot, memoize at first use.
+function lookupPublicKey(kid) {
+    var _a;
+    const mapJson = process.env.JWT_PUBLIC_KEYS;
+    if (kid && mapJson) {
+        try {
+            const map = JSON.parse(mapJson);
+            const value = map[kid];
+            if (value) {
+                return value.includes("-----BEGIN")
+                    ? value
+                    : Buffer.from(value, "base64").toString("utf8");
+            }
+        }
+        catch (err) {
+            console.error("JWT_PUBLIC_KEYS is set but not valid JSON; falling back to JWT_PUBLIC_KEY", err);
+        }
+    }
+    return (_a = process.env.JWT_PUBLIC_KEY) !== null && _a !== void 0 ? _a : null;
+}
 const currentUser = (req, res, next) => {
     var _a;
     if (!((_a = req.session) === null || _a === void 0 ? void 0 : _a.jwt)) {
         return next();
     }
     try {
-        const publicKey = process.env.JWT_PUBLIC_KEY;
+        // Decode without verifying to read the `kid` header so we can
+        // pick the right public key. The actual signature check happens
+        // in the verify() call below — decode is just for routing.
+        const decoded = jsonwebtoken_1.default.decode(req.session.jwt, { complete: true });
+        const headerKid = decoded && typeof decoded !== "string"
+            ? decoded.header.kid
+            : undefined;
+        const publicKey = lookupPublicKey(headerKid);
         if (!publicKey) {
-            console.error("JWT_PUBLIC_KEY is not set");
+            console.error(`JWT verify: no public key configured (kid="${headerKid !== null && headerKid !== void 0 ? headerKid : "none"}")`);
             return next();
         }
         const payload = jsonwebtoken_1.default.verify(req.session.jwt, publicKey, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epztickets/common",
-  "version": "1.64.0",
+  "version": "1.65.0",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
   "files": [