@flink-app/flink 2.0.0-alpha.96 → 2.0.0-alpha.98

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # @flink-app/flink
 
+## 2.0.0-alpha.98
+
+### Minor Changes
+
+-   2f4a132: feat: expose verified token on the request
+
+    The JWT auth plugin now populates `req.token` (the decoded, signature-verified
+    payload) and `req.rawToken` (the original token string) after successful
+    authentication. Handlers can read token claims such as `jti` directly instead of
+    re-extracting and re-decoding the bearer token with an unverified decode.
+
+    ```ts
+    // Before
+    const authHeader = req.headers.authorization;
+    const bearer = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+    const decoded = bearer ? (jsonwebtoken.decode(bearer) as { jti?: string }) : null;
+    const sessionId = decoded?.jti ?? legacySessionId(req.user._id);
+
+    // After
+    const { jti } = (req.token as { jti?: string }) ?? {};
+    const sessionId = jti ?? legacySessionId(req.user._id);
+    ```
+
+    `token` / `rawToken` are added as optional fields on the core `FlinkRequest`
+    type, populated by auth plugins that have a token concept.
+
+## 2.0.0-alpha.97
+
+### Minor Changes
+
+-   eed6bc1: Pass host application context to auth plugins.
+
+    `FlinkAuthPlugin.authenticateRequest` now receives the host app's context as an optional third argument. Flink core supplies it on every authenticated request, so auth plugins can access repos/services without the caller wiring up a lazy accessor or maintaining a module-level mutable reference.
+
+    For `@flink-app/jwt-auth-plugin`, this means `getUser` receives the context directly:
+
+    ```typescript
+    jwtAuthPlugin({
+        getUser: async (tokenData, req, ctx) => {
+            const user = await ctx?.repos.userRepo.getById(tokenData._id);
+            return user ? { username: user.username, _id: user._id } : null;
+        },
+    });
+    ```
+
+    The `getContext` option previously added in alpha.96 is no longer needed and has been removed — remove it from your `jwtAuthPlugin({ … })` call. The third `ctx` parameter on `getUser` is optional, so callbacks that ignore it are unaffected.
+
 ## 2.0.0-alpha.96
 
 ### Patch Changes

package/dist/src/FlinkApp.js

@@ -1300,7 +1300,7 @@ var FlinkApp = /** @class */ (function () {
                         if (!this.auth) {
                             throw new Error("Attempting to authenticate request (".concat(req.method, " ").concat(req.path, ") but no authPlugin is set"));
                         }
-                        return [4 /*yield*/, this.auth.authenticateRequest(req, permissions)];
+                        return [4 /*yield*/, this.auth.authenticateRequest(req, permissions, this._ctx)];
                     case 1: return [2 /*return*/, _a.sent()];
                 }
             });

package/dist/src/FlinkHttpHandler.d.ts

@@ -93,11 +93,18 @@ export interface StreamWriter<T = any> {
  * userPermissions is populated by auth plugins during authentication and contains
  * the resolved permissions array based on the plugin's configuration (roles, dynamic
  * roles, custom permissions, etc.)
+ *
+ * token / rawToken are populated by auth plugins that have a token concept (e.g. JWT).
+ * `token` is the decoded, signature-verified payload; `rawToken` is the original token
+ * string that authenticated the request (Bearer header or custom tokenExtractor output).
+ * Both are optional and only set once authentication succeeds.
  */
 export type FlinkRequest<T = any, P = Params, Q = Query> = Request<P, any, T, Q> & {
     reqId: string;
     user?: any;
     userPermissions?: string[];
+    token?: any;
+    rawToken?: string;
 };
 /**
  * Route props to control routing.

package/dist/src/auth/FlinkAuthPlugin.d.ts

@@ -1,5 +1,5 @@
 import { FlinkRequest } from "../FlinkHttpHandler";
 export interface FlinkAuthPlugin {
-    authenticateRequest: (req: FlinkRequest, permissions: string | string[]) => Promise<boolean>;
+    authenticateRequest: (req: FlinkRequest, permissions: string | string[], ctx?: any) => Promise<boolean>;
     createToken: (payload: any, roles: string[]) => Promise<string>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/flink",
-  "version": "2.0.0-alpha.96",
+  "version": "2.0.0-alpha.98",
   "description": "Typescript only framework for creating REST-like APIs on top of Express and mongodb",
   "types": "dist/src/index.d.ts",
   "main": "dist/src/index.js",

package/src/FlinkApp.ts

@@ -1580,7 +1580,7 @@ export class FlinkApp<C extends FlinkContext> {
         if (!this.auth) {
             throw new Error(`Attempting to authenticate request (${req.method} ${req.path}) but no authPlugin is set`);
         }
-        return await this.auth.authenticateRequest(req as FlinkRequest, permissions);
+        return await this.auth.authenticateRequest(req as FlinkRequest, permissions, this._ctx);
     }
 
     public getRegisteredRoutes() {

package/src/FlinkHttpHandler.ts

@@ -104,11 +104,18 @@ export interface StreamWriter<T = any> {
  * userPermissions is populated by auth plugins during authentication and contains
  * the resolved permissions array based on the plugin's configuration (roles, dynamic
  * roles, custom permissions, etc.)
+ *
+ * token / rawToken are populated by auth plugins that have a token concept (e.g. JWT).
+ * `token` is the decoded, signature-verified payload; `rawToken` is the original token
+ * string that authenticated the request (Bearer header or custom tokenExtractor output).
+ * Both are optional and only set once authentication succeeds.
  */
 export type FlinkRequest<T = any, P = Params, Q = Query> = Request<P, any, T, Q> & {
     reqId: string;
     user?: any;
     userPermissions?: string[]; // Resolved permissions from auth plugin
+    token?: any; // Decoded, verified token payload (set by auth plugin)
+    rawToken?: string; // Raw token string that authenticated the request
 };
 
 /**

package/src/auth/FlinkAuthPlugin.ts

@@ -3,7 +3,8 @@ import { FlinkRequest } from "../FlinkHttpHandler";
 export interface FlinkAuthPlugin {
   authenticateRequest: (
     req: FlinkRequest,
-    permissions: string | string[]
+    permissions: string | string[],
+    ctx?: any
   ) => Promise<boolean>;
   createToken: (payload: any, roles: string[]) => Promise<string>;
 }