@flink-app/jwt-auth-plugin 0.12.1-alpha.9 → 0.13.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @flink-app/jwt-auth-plugin
+
+## 0.13.0
+
+### Minor Changes
+
+-   Migrate to pnpm and streamlines build process.

package/dist/BcryptUtils.js

@@ -3,7 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.genSalt = exports.encrypt = void 0;
+exports.encrypt = encrypt;
+exports.genSalt = genSalt;
 var bcrypt_1 = __importDefault(require("bcrypt"));
 function encrypt(password, salt) {
     return new Promise(function (resolve, reject) {
@@ -14,7 +15,6 @@ function encrypt(password, salt) {
         });
     });
 }
-exports.encrypt = encrypt;
 function genSalt(rounds) {
     if (rounds === void 0) { rounds = 10; }
     return new Promise(function (resolve, reject) {
@@ -25,4 +25,3 @@ function genSalt(rounds) {
         });
     });
 }
-exports.genSalt = genSalt;

package/dist/FlinkJwtAuthPlugin.d.ts

@@ -1,14 +1,78 @@
-import { FlinkAuthPlugin, FlinkAuthUser } from "@flink-app/flink";
+import { FlinkAuthPlugin, FlinkAuthUser, FlinkRequest } from "@flink-app/flink";
 import jwtSimple from "jwt-simple";
+/**
+ * Custom token extraction callback.
+ *
+ * Return values:
+ * - `string`: Token found, use this token
+ * - `null`: No token found, authentication should fail
+ * - `undefined`: Skip custom extraction, use default Bearer token extraction
+ */
+export type TokenExtractor = (req: FlinkRequest) => string | null | undefined;
+/**
+ * Custom permission validation callback.
+ *
+ * Called after getUser to validate if the user has required permissions.
+ * Useful for dynamic permissions stored in database.
+ *
+ * @param user - The authenticated user object returned from getUser
+ * @param routePermissions - Array of permissions required by the route
+ * @returns true if user has required permissions, false otherwise
+ */
+export type PermissionChecker = (user: FlinkAuthUser, routePermissions: string[]) => Promise<boolean> | boolean;
 export interface JwtAuthPluginOptions {
     secret: string;
     algo?: jwtSimple.TAlgorithm;
-    getUser: (tokenData: any) => Promise<FlinkAuthUser>;
+    getUser: (tokenData: any, req: FlinkRequest) => Promise<FlinkAuthUser | null | undefined>;
     passwordPolicy?: RegExp;
     tokenTTL?: number;
     rolePermissions: {
         [role: string]: string[];
     };
+    /**
+     * Optional custom token extraction callback.
+     *
+     * Allows conditional token extraction based on request properties (path, method, headers, etc.).
+     * Return `undefined` to fall back to default Bearer token extraction.
+     */
+    tokenExtractor?: TokenExtractor;
+    /**
+     * Optional custom permission checker for dynamic permissions.
+     *
+     * When provided, replaces static rolePermissions checking.
+     * Called after getUser with the full user object.
+     *
+     * Example:
+     * ```typescript
+     * checkPermissions: async (user, routePermissions) => {
+     *   return routePermissions.every(perm =>
+     *     user.permissions?.includes(perm)
+     *   );
+     * }
+     * ```
+     */
+    checkPermissions?: PermissionChecker;
+    /**
+     * When true, uses roles from the user object returned by getUser
+     * instead of roles from the decoded token for static permission checking.
+     *
+     * Useful for multi-tenant scenarios where user roles vary by organization context.
+     * The organization context can be determined from request headers, subdomain, path, etc.
+     *
+     * Example:
+     * ```typescript
+     * useDynamicRoles: true,
+     * getUser: async (tokenData, req) => {
+     *   const orgId = req.headers['x-organization-id'];
+     *   const membership = await getOrgMembership(tokenData.userId, orgId);
+     *   return {
+     *     id: tokenData.userId,
+     *     roles: [membership.role], // Org-specific role
+     *   };
+     * }
+     * ```
+     */
+    useDynamicRoles?: boolean;
 }
 export interface JwtAuthPlugin extends FlinkAuthPlugin {
     /**
@@ -38,4 +102,5 @@ export interface JwtAuthPlugin extends FlinkAuthPlugin {
 /**
  * Configures and creates authentication plugin.
  */
-export declare function jwtAuthPlugin({ secret, getUser, rolePermissions, algo, passwordPolicy, tokenTTL, }: JwtAuthPluginOptions): JwtAuthPlugin;
+export declare function jwtAuthPlugin({ secret, getUser, rolePermissions, algo, passwordPolicy, tokenTTL, //Defaults to hundred year
+tokenExtractor, checkPermissions, useDynamicRoles, }: JwtAuthPluginOptions): JwtAuthPlugin;

package/dist/FlinkJwtAuthPlugin.js

@@ -20,8 +20,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 var __generator = (this && this.__generator) || function (thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
-    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
     function verb(n) { return function (v) { return step([n, v]); }; }
     function step(op) {
         if (f) throw new TypeError("Generator is already executing.");
@@ -50,7 +50,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.jwtAuthPlugin = void 0;
+exports.jwtAuthPlugin = jwtAuthPlugin;
 var flink_1 = require("@flink-app/flink");
 var jwt_simple_1 = __importDefault(require("jwt-simple"));
 var BcryptUtils_1 = require("./BcryptUtils");
@@ -65,7 +65,8 @@ var defaultPasswordPolicy = /^(?=.*[A-Za-z])(?=.*\d)[A-Za-z\d]{8,}$/;
  */
 function jwtAuthPlugin(_a) {
     var _this = this;
-    var secret = _a.secret, getUser = _a.getUser, rolePermissions = _a.rolePermissions, _b = _a.algo, algo = _b === void 0 ? "HS256" : _b, _c = _a.passwordPolicy, passwordPolicy = _c === void 0 ? defaultPasswordPolicy : _c, _d = _a.tokenTTL, tokenTTL = _d === void 0 ? 1000 * 60 * 60 * 24 * 365 * 100 : _d;
+    var secret = _a.secret, getUser = _a.getUser, rolePermissions = _a.rolePermissions, _b = _a.algo, algo = _b === void 0 ? "HS256" : _b, _c = _a.passwordPolicy, passwordPolicy = _c === void 0 ? defaultPasswordPolicy : _c, _d = _a.tokenTTL, tokenTTL = _d === void 0 ? 1000 * 60 * 60 * 24 * 365 * 100 : _d, //Defaults to hundred year
+    tokenExtractor = _a.tokenExtractor, checkPermissions = _a.checkPermissions, _e = _a.useDynamicRoles, useDynamicRoles = _e === void 0 ? false : _e;
     return {
         authenticateRequest: function (req, permissions) { return __awaiter(_this, void 0, void 0, function () {
             return __generator(this, function (_a) {
@@ -73,52 +74,83 @@ function jwtAuthPlugin(_a) {
                         algo: algo,
                         secret: secret,
                         getUser: getUser,
+                        tokenExtractor: tokenExtractor,
+                        checkPermissions: checkPermissions,
+                        useDynamicRoles: useDynamicRoles,
                     })];
             });
         }); },
-        createToken: function (payload, roles) {
-            return createToken(__assign(__assign({}, payload), { roles: roles }), { algo: algo, secret: secret, tokenTTL: tokenTTL });
-        },
-        createPasswordHashAndSalt: function (password) {
-            return createPasswordHashAndSalt(password, passwordPolicy);
-        },
+        createToken: function (payload, roles) { return createToken(__assign(__assign({}, payload), { roles: roles }), { algo: algo, secret: secret, tokenTTL: tokenTTL }); },
+        createPasswordHashAndSalt: function (password) { return createPasswordHashAndSalt(password, passwordPolicy); },
         validatePassword: validatePassword,
     };
 }
-exports.jwtAuthPlugin = jwtAuthPlugin;
 function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, _a) {
     return __awaiter(this, arguments, void 0, function (req, routePermissions, rolePermissions, _b) {
-        var token, decodedToken, permissionsArr, validPerms, user;
-        var secret = _b.secret, algo = _b.algo, getUser = _b.getUser;
+        var token, decodedToken, permissionsArr, validPerms, user, validPerms, hasPermission;
+        var secret = _b.secret, algo = _b.algo, getUser = _b.getUser, tokenExtractor = _b.tokenExtractor, checkPermissions = _b.checkPermissions, useDynamicRoles = _b.useDynamicRoles;
         return __generator(this, function (_c) {
             switch (_c.label) {
                 case 0:
-                    token = getTokenFromReq(req);
-                    if (!token) return [3 /*break*/, 2];
+                    if (tokenExtractor) {
+                        token = tokenExtractor(req);
+                        // If tokenExtractor returns undefined, fall back to default
+                        if (token === undefined) {
+                            token = getTokenFromReq(req);
+                        }
+                        // If it returns null, token stays null (no default fallback)
+                        // If it returns string, token is the string
+                    }
+                    else {
+                        // No custom extractor, use default
+                        token = getTokenFromReq(req);
+                    }
+                    if (!token) return [3 /*break*/, 4];
                     decodedToken = void 0;
                     try {
                         decodedToken = jwt_simple_1.default.decode(token, secret, false, algo);
                     }
                     catch (err) {
-                        flink_1.log.debug("Failed to decode token: ".concat(err));
+                        flink_1.log.debug("[JWT AUTH PLUGIN] Failed to decode token: ".concat(err));
                         decodedToken = null;
                     }
-                    if (!decodedToken) return [3 /*break*/, 2];
-                    permissionsArr = Array.isArray(routePermissions)
-                        ? routePermissions
-                        : [routePermissions];
-                    if (permissionsArr && permissionsArr.length > 0) {
+                    if (!decodedToken) return [3 /*break*/, 4];
+                    permissionsArr = Array.isArray(routePermissions) ? routePermissions : [routePermissions];
+                    // Static permission check - only if custom checker NOT provided AND not using dynamic roles
+                    if (!checkPermissions && !useDynamicRoles && permissionsArr && permissionsArr.length > 0) {
                         validPerms = (0, PermissionValidator_1.hasValidPermissions)(decodedToken.roles || [], rolePermissions, permissionsArr);
                         if (!validPerms) {
                             return [2 /*return*/, false];
                         }
                     }
-                    return [4 /*yield*/, getUser(decodedToken)];
+                    return [4 /*yield*/, getUser(decodedToken, req)];
                 case 1:
                     user = _c.sent();
+                    if (!user) {
+                        flink_1.log.debug("[JWT AUTH PLUGIN] User not returned from getUser callback");
+                        return [2 /*return*/, false];
+                    }
+                    // Dynamic roles: check permissions using roles from user object
+                    if (!checkPermissions && useDynamicRoles && permissionsArr && permissionsArr.length > 0) {
+                        validPerms = (0, PermissionValidator_1.hasValidPermissions)(user.roles || [], rolePermissions, permissionsArr);
+                        if (!validPerms) {
+                            flink_1.log.debug("[JWT AUTH PLUGIN] Dynamic role permission check failed");
+                            return [2 /*return*/, false];
+                        }
+                    }
+                    if (!(checkPermissions && permissionsArr && permissionsArr.length > 0)) return [3 /*break*/, 3];
+                    return [4 /*yield*/, checkPermissions(user, permissionsArr)];
+                case 2:
+                    hasPermission = _c.sent();
+                    if (!hasPermission) {
+                        flink_1.log.debug("[JWT AUTH PLUGIN] Custom permission check failed");
+                        return [2 /*return*/, false];
+                    }
+                    _c.label = 3;
+                case 3:
                     req.user = user;
                     return [2 /*return*/, true];
-                case 2: return [2 /*return*/, false];
+                case 4: return [2 /*return*/, false];
             }
         });
     });

package/dist/PermissionValidator.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasValidPermissions = void 0;
+exports.hasValidPermissions = hasValidPermissions;
 var flink_1 = require("@flink-app/flink");
 /**
  * Checks if provided role has permission to access route
@@ -41,4 +41,3 @@ function hasValidPermissions(roles, rolePermissions, routePermissions) {
     }
     return false;
 }
-exports.hasValidPermissions = hasValidPermissions;

package/package.json

@@ -1,35 +1,32 @@
 {
-    "name": "@flink-app/jwt-auth-plugin",
-    "version": "0.12.1-alpha.9",
-    "description": "Flink plugin for JWT auth",
-    "scripts": {
-        "test": "node --preserve-symlinks -r ts-node/register -- node_modules/jasmine/bin/jasmine --config=./spec/support/jasmine.json",
-        "test:watch": "nodemon --ext ts --exec 'jasmine-ts  --config=./spec/support/jasmine.json'",
-        "prepare": "tsc --project tsconfig.dist.json",
-        "watch": "tsc-watch --project tsconfig.dist.json"
-    },
-    "author": "joel@frost.se",
-    "license": "MIT",
-    "types": "dist/index.d.ts",
-    "main": "dist/index.js",
-    "publishConfig": {
-        "access": "public"
-    },
-    "dependencies": {
-        "bcrypt": "^5.0.1",
-        "jwt-simple": "^0.5.6"
-    },
-    "devDependencies": {
-        "@flink-app/flink": "^0.12.1-alpha.9",
-        "@types/bcrypt": "^5.0.0",
-        "@types/jasmine": "^3.7.1",
-        "@types/node": "22.13.10",
-        "jasmine": "^3.7.0",
-        "jasmine-spec-reporter": "^7.0.0",
-        "nodemon": "^2.0.7",
-        "ts-node": "^9.1.1",
-        "tsc-watch": "^4.2.9",
-        "typescript": "5.4.5"
-    },
-    "gitHead": "3007ad036607014176930446fde56203bde8d6f5"
-}
+  "name": "@flink-app/jwt-auth-plugin",
+  "version": "0.13.0",
+  "description": "Flink plugin for JWT auth",
+  "author": "joel@frost.se",
+  "license": "MIT",
+  "types": "dist/index.d.ts",
+  "main": "dist/index.js",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "bcrypt": "^5.0.1",
+    "jwt-simple": "^0.5.6"
+  },
+  "devDependencies": {
+    "@types/bcrypt": "^5.0.0",
+    "@types/jasmine": "^3.7.1",
+    "@types/node": "22.13.10",
+    "ts-node": "^10.9.2",
+    "tsc-watch": "^4.2.9",
+    "@flink-app/flink": "0.13.0"
+  },
+  "gitHead": "4243e3b3cd6d4e1ca001a61baa8436bf2bbe4113",
+  "scripts": {
+    "test": "jasmine-ts --config=./spec/support/jasmine.json",
+    "test:watch": "nodemon --ext ts --exec 'jasmine-ts  --config=./spec/support/jasmine.json'",
+    "watch": "tsc-watch --project tsconfig.dist.json",
+    "build": "tsc --project tsconfig.dist.json",
+    "clean": "rimraf dist .flink"
+  }
+}