@flink-app/jwt-auth-plugin 0.11.0 → 0.11.4-next.0

package/dist/BcryptUtils.js

@@ -3,7 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.genSalt = exports.encrypt = void 0;
+exports.encrypt = encrypt;
+exports.genSalt = genSalt;
 var bcrypt_1 = __importDefault(require("bcrypt"));
 function encrypt(password, salt) {
     return new Promise(function (resolve, reject) {
@@ -14,7 +15,6 @@ function encrypt(password, salt) {
         });
     });
 }
-exports.encrypt = encrypt;
 function genSalt(rounds) {
     if (rounds === void 0) { rounds = 10; }
     return new Promise(function (resolve, reject) {
@@ -25,4 +25,3 @@ function genSalt(rounds) {
         });
     });
 }
-exports.genSalt = genSalt;

package/dist/FlinkJwtAuthPlugin.js

@@ -20,12 +20,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 var __generator = (this && this.__generator) || function (thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
-    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
     function verb(n) { return function (v) { return step([n, v]); }; }
     function step(op) {
         if (f) throw new TypeError("Generator is already executing.");
-        while (_) try {
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
             if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
             if (y = 0, t) op = [op[0] & 2, t.value];
             switch (op[0]) {
@@ -50,7 +50,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.jwtAuthPlugin = void 0;
+exports.jwtAuthPlugin = jwtAuthPlugin;
 var flink_1 = require("@flink-app/flink");
 var jwt_simple_1 = __importDefault(require("jwt-simple"));
 var BcryptUtils_1 = require("./BcryptUtils");
@@ -85,13 +85,12 @@ function jwtAuthPlugin(_a) {
         validatePassword: validatePassword,
     };
 }
-exports.jwtAuthPlugin = jwtAuthPlugin;
-function authenticateRequest(req, routePermissions, rolePermissions, _a) {
-    var secret = _a.secret, algo = _a.algo, getUser = _a.getUser;
-    return __awaiter(this, void 0, void 0, function () {
+function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, _a) {
+    return __awaiter(this, arguments, void 0, function (req, routePermissions, rolePermissions, _b) {
         var token, decodedToken, permissionsArr, validPerms, user;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
+        var secret = _b.secret, algo = _b.algo, getUser = _b.getUser;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
                 case 0:
                     token = getTokenFromReq(req);
                     if (!token) return [3 /*break*/, 2];
@@ -100,7 +99,7 @@ function authenticateRequest(req, routePermissions, rolePermissions, _a) {
                         decodedToken = jwt_simple_1.default.decode(token, secret, false, algo);
                     }
                     catch (err) {
-                        flink_1.log.debug("Failed to decode token: " + err);
+                        flink_1.log.debug("Failed to decode token: ".concat(err));
                         decodedToken = null;
                     }
                     if (!decodedToken) return [3 /*break*/, 2];
@@ -108,14 +107,14 @@ function authenticateRequest(req, routePermissions, rolePermissions, _a) {
                         ? routePermissions
                         : [routePermissions];
                     if (permissionsArr && permissionsArr.length > 0) {
-                        validPerms = PermissionValidator_1.hasValidPermissions(decodedToken.roles || [], rolePermissions, permissionsArr);
+                        validPerms = (0, PermissionValidator_1.hasValidPermissions)(decodedToken.roles || [], rolePermissions, permissionsArr);
                         if (!validPerms) {
                             return [2 /*return*/, false];
                         }
                     }
                     return [4 /*yield*/, getUser(decodedToken)];
                 case 1:
-                    user = _b.sent();
+                    user = _c.sent();
                     req.user = user;
                     return [2 /*return*/, true];
                 case 2: return [2 /*return*/, false];
@@ -131,10 +130,10 @@ function getTokenFromReq(req) {
     }
     return;
 }
-function createToken(payload, _a) {
-    var secret = _a.secret, algo = _a.algo, tokenTTL = _a.tokenTTL;
-    return __awaiter(this, void 0, void 0, function () {
-        return __generator(this, function (_b) {
+function createToken(payload_1, _a) {
+    return __awaiter(this, arguments, void 0, function (payload, _b) {
+        var secret = _b.secret, algo = _b.algo, tokenTTL = _b.tokenTTL;
+        return __generator(this, function (_c) {
             if (!payload) {
                 throw new Error("Cannot create token - payload is missing");
             }
@@ -152,13 +151,13 @@ function createPasswordHashAndSalt(password, passwordPolicy) {
             switch (_a.label) {
                 case 0:
                     if (!passwordPolicy.test(password)) {
-                        flink_1.log.debug("Password does not match password policy '" + passwordPolicy + "'");
+                        flink_1.log.debug("Password does not match password policy '".concat(passwordPolicy, "'"));
                         return [2 /*return*/, null];
                     }
-                    return [4 /*yield*/, BcryptUtils_1.genSalt(10)];
+                    return [4 /*yield*/, (0, BcryptUtils_1.genSalt)(10)];
                 case 1:
                     salt = _a.sent();
-                    return [4 /*yield*/, BcryptUtils_1.encrypt(password, salt)];
+                    return [4 /*yield*/, (0, BcryptUtils_1.encrypt)(password, salt)];
                 case 2:
                     hash = _a.sent();
                     return [2 /*return*/, { salt: salt, hash: hash }];
@@ -171,7 +170,7 @@ function validatePassword(password, passwordHash, salt) {
         var hashCandidate;
         return __generator(this, function (_a) {
             switch (_a.label) {
-                case 0: return [4 /*yield*/, BcryptUtils_1.encrypt(password, salt)];
+                case 0: return [4 /*yield*/, (0, BcryptUtils_1.encrypt)(password, salt)];
                 case 1:
                     hashCandidate = _a.sent();
                     return [2 /*return*/, hashCandidate === passwordHash];

package/dist/PermissionValidator.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasValidPermissions = void 0;
+exports.hasValidPermissions = hasValidPermissions;
 var flink_1 = require("@flink-app/flink");
 /**
  * Checks if provided role has permission to access route
@@ -21,7 +21,7 @@ function hasValidPermissions(roles, rolePermissions, routePermissions) {
     var _loop_1 = function (role) {
         var thisRolesPermissions = rolePermissions[role];
         if (!thisRolesPermissions) {
-            flink_1.log.warn("Role '" + role + "' does not have any permissions defined");
+            flink_1.log.warn("Role '".concat(role, "' does not have any permissions defined"));
             return "continue";
         }
         if (thisRolesPermissions.includes("*")) {
@@ -41,4 +41,3 @@ function hasValidPermissions(roles, rolePermissions, routePermissions) {
     }
     return false;
 }
-exports.hasValidPermissions = hasValidPermissions;

package/dist/index.js

@@ -1,7 +1,11 @@
 "use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];

package/dist/spec/FlinkJwtAuthPlugin.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/spec/FlinkJwtAuthPlugin.spec.js

@@ -0,0 +1,193 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var jwt_simple_1 = __importDefault(require("jwt-simple"));
+var FlinkJwtAuthPlugin_1 = require("../src/FlinkJwtAuthPlugin");
+describe("FlinkJwtAuthPlugin", function () {
+    it("should create and configure plugin", function () {
+        var plugin = (0, FlinkJwtAuthPlugin_1.jwtAuthPlugin)({
+            secret: "secret",
+            getUser: function (id) { return __awaiter(void 0, void 0, void 0, function () {
+                return __generator(this, function (_a) {
+                    return [2 /*return*/, {
+                            id: id,
+                            username: "username",
+                        }];
+                });
+            }); },
+            rolePermissions: {},
+        });
+        expect(plugin).toBeDefined();
+    });
+    it("should fail auth if no token was provided", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var plugin, mockRequest, authenticated;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    plugin = (0, FlinkJwtAuthPlugin_1.jwtAuthPlugin)({
+                        secret: "secret",
+                        getUser: function (id) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                return [2 /*return*/, {
+                                        id: id,
+                                        username: "username",
+                                    }];
+                            });
+                        }); },
+                        rolePermissions: {
+                            user: ["*"],
+                        },
+                    });
+                    mockRequest = {
+                        headers: {
+                            authorization: "",
+                        },
+                    };
+                    return [4 /*yield*/, plugin.authenticateRequest(mockRequest, "foo")];
+                case 1:
+                    authenticated = _a.sent();
+                    expect(authenticated).toBeFalse();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("should fail auth if token is invalid provided", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var plugin, mockRequest, authenticated;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    plugin = (0, FlinkJwtAuthPlugin_1.jwtAuthPlugin)({
+                        secret: "secret",
+                        getUser: function (id) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                fail(); // Should not invoke this
+                                return [2 /*return*/, {
+                                        id: id,
+                                        username: "username",
+                                    }];
+                            });
+                        }); },
+                        rolePermissions: {
+                            user: ["*"],
+                        },
+                    });
+                    mockRequest = {
+                        headers: {
+                            authorization: "Bearer 890suf089sudf0usdf0uf9s",
+                        },
+                    };
+                    return [4 /*yield*/, plugin.authenticateRequest(mockRequest, "foo")];
+                case 1:
+                    authenticated = _a.sent();
+                    expect(authenticated).toBeFalse();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("should decode token and authenticate", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var secret, userId, encodedToken, plugin, mockRequest, authenticated;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    secret = "secret";
+                    userId = "123";
+                    encodedToken = jwt_simple_1.default.encode({ id: userId, roles: ["user"] }, secret);
+                    plugin = (0, FlinkJwtAuthPlugin_1.jwtAuthPlugin)({
+                        secret: secret,
+                        getUser: function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {
+                            var id = _b.id;
+                            return __generator(this, function (_c) {
+                                expect(id).toBe(userId);
+                                return [2 /*return*/, {
+                                        id: id,
+                                        username: "username",
+                                    }];
+                            });
+                        }); },
+                        rolePermissions: {
+                            user: ["*"],
+                        },
+                    });
+                    mockRequest = {
+                        headers: {
+                            authorization: "Bearer " + encodedToken,
+                        },
+                    };
+                    return [4 /*yield*/, plugin.authenticateRequest(mockRequest, "foo")];
+                case 1:
+                    authenticated = _a.sent();
+                    expect(authenticated).toBeTruthy();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it("should generate token", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var secret, plugin, token, decoded;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    secret = "secret";
+                    plugin = (0, FlinkJwtAuthPlugin_1.jwtAuthPlugin)({
+                        secret: secret,
+                        getUser: function (id) { return __awaiter(void 0, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                fail(); // Should not invoke this
+                                return [2 /*return*/, {
+                                        id: id,
+                                        username: "username",
+                                    }];
+                            });
+                        }); },
+                        rolePermissions: {
+                            user: ["*"],
+                        },
+                    });
+                    return [4 /*yield*/, plugin.createToken({ id: "123" }, ["user"])];
+                case 1:
+                    token = _a.sent();
+                    expect(token).toBeDefined();
+                    decoded = jwt_simple_1.default.decode(token, secret);
+                    expect(decoded.id).toBe("123");
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/dist/spec/PermissionValidator.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/spec/PermissionValidator.spec.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+var PermissionValidator_1 = require("../src/PermissionValidator");
+describe("PermissionValidator", function () {
+    it("should validate permissions if *", function () {
+        var valid = (0, PermissionValidator_1.hasValidPermissions)(["user"], {
+            user: ["foo", "*"],
+        }, ["bar"]);
+        expect(valid).toBe(true);
+    });
+    it("should validate permissions if match", function () {
+        var valid = (0, PermissionValidator_1.hasValidPermissions)(["user"], {
+            user: ["foo"],
+        }, ["foo"]);
+        expect(valid).toBe(true);
+    });
+    it("should not validate permissions if no match", function () {
+        var valid = (0, PermissionValidator_1.hasValidPermissions)(["user"], {
+            user: ["foo"],
+        }, ["bar"]);
+        expect(valid).toBe(false);
+    });
+    it("should not validate permissions if role permissions are missing", function () {
+        var valid = (0, PermissionValidator_1.hasValidPermissions)(["user"], {}, ["bar"]);
+        expect(valid).toBe(false);
+    });
+    it("should not validate permissions if only partial permission is matching", function () {
+        var valid = (0, PermissionValidator_1.hasValidPermissions)(["user"], {
+            user: ["foo"],
+        }, ["foo", "bar"]);
+        expect(valid).toBe(false);
+    });
+    it("should validate if public route", function () {
+        var valid = (0, PermissionValidator_1.hasValidPermissions)([], {}, []);
+        expect(valid).toBe(true);
+    });
+    it("should validate if any authenticated user is allowed", function () {
+        var valid = (0, PermissionValidator_1.hasValidPermissions)(["user"], {}, ["*"]);
+        expect(valid).toBe(true);
+    });
+    it("should not validate if any authenticated user is allowed but user not logged in", function () {
+        var valid = (0, PermissionValidator_1.hasValidPermissions)([], {}, ["*"]);
+        expect(valid).toBe(false);
+    });
+});

package/dist/src/BcryptUtils.d.ts

@@ -0,0 +1,2 @@
+export declare function encrypt(password: string, salt: string): Promise<string>;
+export declare function genSalt(rounds?: number): Promise<string>;

package/dist/src/BcryptUtils.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encrypt = encrypt;
+exports.genSalt = genSalt;
+var bcrypt_1 = __importDefault(require("bcrypt"));
+function encrypt(password, salt) {
+    return new Promise(function (resolve, reject) {
+        bcrypt_1.default.hash(password, salt, function (err, hash) {
+            if (err)
+                reject(err);
+            resolve(hash);
+        });
+    });
+}
+function genSalt(rounds) {
+    if (rounds === void 0) { rounds = 10; }
+    return new Promise(function (resolve, reject) {
+        bcrypt_1.default.genSalt(rounds, function (err, salt) {
+            if (err)
+                reject(err);
+            resolve(salt);
+        });
+    });
+}

package/dist/src/FlinkJwtAuthPlugin.d.ts

@@ -0,0 +1,41 @@
+import { FlinkAuthPlugin, FlinkAuthUser } from "@flink-app/flink";
+import jwtSimple from "jwt-simple";
+export interface JwtAuthPluginOptions {
+    secret: string;
+    algo?: jwtSimple.TAlgorithm;
+    getUser: (tokenData: any) => Promise<FlinkAuthUser>;
+    passwordPolicy?: RegExp;
+    tokenTTL?: number;
+    rolePermissions: {
+        [role: string]: string[];
+    };
+}
+export interface JwtAuthPlugin extends FlinkAuthPlugin {
+    /**
+     * Encodes and returns JWT token that includes provided payload.
+     *
+     * The payload can by anything but should in most cases be and object that
+     * holds user information including an identifier such as the username or id.
+     */
+    createToken: (payload: any, roles: string[]) => Promise<string>;
+    /**
+     * Generates new password hash and salt for provided password.
+     *
+     * This method should be used when setting a new password. Both hash and salt needs
+     * to be saved in database as both are needed to validate the password.
+     *
+     * Returns null if password does not match configured `passwordPolicy`.
+     */
+    createPasswordHashAndSalt: (password: string) => Promise<{
+        hash: string;
+        salt: string;
+    } | null>;
+    /**
+     * Validates that provided `password` is same as provided `hash`.
+     */
+    validatePassword: (password: string, passwordHash: string, salt: string) => Promise<boolean>;
+}
+/**
+ * Configures and creates authentication plugin.
+ */
+export declare function jwtAuthPlugin({ secret, getUser, rolePermissions, algo, passwordPolicy, tokenTTL, }: JwtAuthPluginOptions): JwtAuthPlugin;

package/dist/src/FlinkJwtAuthPlugin.js

@@ -0,0 +1,180 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtAuthPlugin = jwtAuthPlugin;
+var flink_1 = require("@flink-app/flink");
+var jwt_simple_1 = __importDefault(require("jwt-simple"));
+var BcryptUtils_1 = require("./BcryptUtils");
+var PermissionValidator_1 = require("./PermissionValidator");
+/**
+ * Minimum eight characters, at least one letter and one number
+ * https://stackoverflow.com/a/21456918
+ */
+var defaultPasswordPolicy = /^(?=.*[A-Za-z])(?=.*\d)[A-Za-z\d]{8,}$/;
+/**
+ * Configures and creates authentication plugin.
+ */
+function jwtAuthPlugin(_a) {
+    var _this = this;
+    var secret = _a.secret, getUser = _a.getUser, rolePermissions = _a.rolePermissions, _b = _a.algo, algo = _b === void 0 ? "HS256" : _b, _c = _a.passwordPolicy, passwordPolicy = _c === void 0 ? defaultPasswordPolicy : _c, _d = _a.tokenTTL, tokenTTL = _d === void 0 ? 1000 * 60 * 60 * 24 * 365 * 100 : _d;
+    return {
+        authenticateRequest: function (req, permissions) { return __awaiter(_this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                return [2 /*return*/, authenticateRequest(req, permissions, rolePermissions, {
+                        algo: algo,
+                        secret: secret,
+                        getUser: getUser,
+                    })];
+            });
+        }); },
+        createToken: function (payload, roles) {
+            return createToken(__assign(__assign({}, payload), { roles: roles }), { algo: algo, secret: secret, tokenTTL: tokenTTL });
+        },
+        createPasswordHashAndSalt: function (password) {
+            return createPasswordHashAndSalt(password, passwordPolicy);
+        },
+        validatePassword: validatePassword,
+    };
+}
+function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, _a) {
+    return __awaiter(this, arguments, void 0, function (req, routePermissions, rolePermissions, _b) {
+        var token, decodedToken, permissionsArr, validPerms, user;
+        var secret = _b.secret, algo = _b.algo, getUser = _b.getUser;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    token = getTokenFromReq(req);
+                    if (!token) return [3 /*break*/, 2];
+                    decodedToken = void 0;
+                    try {
+                        decodedToken = jwt_simple_1.default.decode(token, secret, false, algo);
+                    }
+                    catch (err) {
+                        flink_1.log.debug("Failed to decode token: ".concat(err));
+                        decodedToken = null;
+                    }
+                    if (!decodedToken) return [3 /*break*/, 2];
+                    permissionsArr = Array.isArray(routePermissions)
+                        ? routePermissions
+                        : [routePermissions];
+                    if (permissionsArr && permissionsArr.length > 0) {
+                        validPerms = (0, PermissionValidator_1.hasValidPermissions)(decodedToken.roles || [], rolePermissions, permissionsArr);
+                        if (!validPerms) {
+                            return [2 /*return*/, false];
+                        }
+                    }
+                    return [4 /*yield*/, getUser(decodedToken)];
+                case 1:
+                    user = _c.sent();
+                    req.user = user;
+                    return [2 /*return*/, true];
+                case 2: return [2 /*return*/, false];
+            }
+        });
+    });
+}
+function getTokenFromReq(req) {
+    var authHeader = req.headers.authorization;
+    if (authHeader) {
+        var _a = authHeader.split("Bearer "), token = _a[1];
+        return token;
+    }
+    return;
+}
+function createToken(payload_1, _a) {
+    return __awaiter(this, arguments, void 0, function (payload, _b) {
+        var secret = _b.secret, algo = _b.algo, tokenTTL = _b.tokenTTL;
+        return __generator(this, function (_c) {
+            if (!payload) {
+                throw new Error("Cannot create token - payload is missing");
+            }
+            return [2 /*return*/, jwt_simple_1.default.encode(__assign({ exp: _calculateExpiration(tokenTTL || 1000 * 60 * 60 * 24 * 365 * 100) }, payload), secret, algo)];
+        });
+    });
+}
+function _calculateExpiration(expiresInMs) {
+    return Math.floor((Date.now() + expiresInMs) / 1000);
+}
+function createPasswordHashAndSalt(password, passwordPolicy) {
+    return __awaiter(this, void 0, void 0, function () {
+        var salt, hash;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    if (!passwordPolicy.test(password)) {
+                        flink_1.log.debug("Password does not match password policy '".concat(passwordPolicy, "'"));
+                        return [2 /*return*/, null];
+                    }
+                    return [4 /*yield*/, (0, BcryptUtils_1.genSalt)(10)];
+                case 1:
+                    salt = _a.sent();
+                    return [4 /*yield*/, (0, BcryptUtils_1.encrypt)(password, salt)];
+                case 2:
+                    hash = _a.sent();
+                    return [2 /*return*/, { salt: salt, hash: hash }];
+            }
+        });
+    });
+}
+function validatePassword(password, passwordHash, salt) {
+    return __awaiter(this, void 0, void 0, function () {
+        var hashCandidate;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, BcryptUtils_1.encrypt)(password, salt)];
+                case 1:
+                    hashCandidate = _a.sent();
+                    return [2 /*return*/, hashCandidate === passwordHash];
+            }
+        });
+    });
+}

package/dist/src/PermissionValidator.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Checks if provided role has permission to access route
+ * based on its permissions.
+ *
+ * @param roles logged in user role(s)
+ * @param rolePermissions map containing permissions by role
+ * @param routePermissions permission(s) required by route
+ * @returns
+ */
+export declare function hasValidPermissions(roles: string[], rolePermissions: {
+    [x: string]: string[];
+}, routePermissions: string[]): boolean;

package/dist/src/PermissionValidator.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasValidPermissions = hasValidPermissions;
+var flink_1 = require("@flink-app/flink");
+/**
+ * Checks if provided role has permission to access route
+ * based on its permissions.
+ *
+ * @param roles logged in user role(s)
+ * @param rolePermissions map containing permissions by role
+ * @param routePermissions permission(s) required by route
+ * @returns
+ */
+function hasValidPermissions(roles, rolePermissions, routePermissions) {
+    if (routePermissions.includes("*")) {
+        return roles.length > 0;
+    }
+    if (routePermissions.length === 0) {
+        return true;
+    }
+    var _loop_1 = function (role) {
+        var thisRolesPermissions = rolePermissions[role];
+        if (!thisRolesPermissions) {
+            flink_1.log.warn("Role '".concat(role, "' does not have any permissions defined"));
+            return "continue";
+        }
+        if (thisRolesPermissions.includes("*")) {
+            return { value: true };
+        }
+        if (routePermissions.every(function (routePerm) {
+            return thisRolesPermissions.includes(routePerm);
+        })) {
+            return { value: true };
+        }
+    };
+    for (var _i = 0, roles_1 = roles; _i < roles_1.length; _i++) {
+        var role = roles_1[_i];
+        var state_1 = _loop_1(role);
+        if (typeof state_1 === "object")
+            return state_1.value;
+    }
+    return false;
+}

package/dist/src/index.d.ts

@@ -0,0 +1 @@
+export * from "./FlinkJwtAuthPlugin";

package/dist/src/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./FlinkJwtAuthPlugin"), exports);

package/package.json

@@ -1,35 +1,32 @@
 {
-  "name": "@flink-app/jwt-auth-plugin",
-  "version": "0.11.0",
-  "description": "Flink plugin for JWT auth",
-  "scripts": {
-    "test": "node --preserve-symlinks -r ts-node/register -- node_modules/jasmine/bin/jasmine --config=./spec/support/jasmine.json",
-    "test:watch": "nodemon --ext ts --exec 'jasmine-ts  --config=./spec/support/jasmine.json'",
-    "prepublish": "tsc --project tsconfig.dist.json",
-    "watch": "tsc-watch --project tsconfig.dist.json"
-  },
-  "author": "joel@frost.se",
-  "license": "MIT",
-  "types": "dist/index.d.ts",
-  "main": "dist/index.js",
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "bcrypt": "^5.0.1",
-    "jwt-simple": "^0.5.6"
-  },
-  "devDependencies": {
-    "@flink-app/flink": "^0.11.0",
-    "@types/bcrypt": "^5.0.0",
-    "@types/jasmine": "^3.7.1",
-    "@types/node": "^15.6.2",
-    "jasmine": "^3.7.0",
-    "jasmine-spec-reporter": "^7.0.0",
-    "nodemon": "^2.0.7",
-    "ts-node": "^9.1.1",
-    "tsc-watch": "^4.2.9",
-    "typescript": "^4.2.4"
-  },
-  "gitHead": "3869def3e7e7e7105373ad31bc23a8ed68108015"
+    "name": "@flink-app/jwt-auth-plugin",
+    "version": "0.11.4-next.0",
+    "description": "Flink plugin for JWT auth",
+    "author": "joel@frost.se",
+    "license": "MIT",
+    "types": "dist/index.d.ts",
+    "main": "dist/index.js",
+    "scripts": {
+        "build": "tsc"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "dependencies": {
+        "bcrypt": "^5.0.1",
+        "jwt-simple": "^0.5.6"
+    },
+    "devDependencies": {
+        "@flink-app/flink": "^0.11.4-next.0",
+        "@types/bcrypt": "^5.0.0",
+        "@types/jasmine": "^3.7.1",
+        "@types/node": "^22.10.1",
+        "jasmine": "^3.7.0",
+        "jasmine-spec-reporter": "^7.0.0",
+        "nodemon": "^2.0.7",
+        "ts-node": "^10.9.2",
+        "tsc-watch": "^6.2.1",
+        "typescript": "5.6.2"
+    },
+    "gitHead": "6a44df1b6601c86ea3402750b939784d003202c3"
 }