@flink-app/jwt-auth-plugin 0.12.1-alpha.9 → 0.13.0

package/src/FlinkJwtAuthPlugin.ts

@@ -1,9 +1,4 @@
-import {
-  FlinkAuthPlugin,
-  FlinkAuthUser,
-  FlinkRequest,
-  log,
-} from "@flink-app/flink";
+import { FlinkAuthPlugin, FlinkAuthUser, FlinkRequest, log } from "@flink-app/flink";
 import jwtSimple from "jwt-simple";
 import { encrypt, genSalt } from "./BcryptUtils";
 import { hasValidPermissions } from "./PermissionValidator";
@@ -14,167 +9,255 @@ import { hasValidPermissions } from "./PermissionValidator";
  */
 const defaultPasswordPolicy = /^(?=.*[A-Za-z])(?=.*\d)[A-Za-z\d]{8,}$/;
 
+/**
+ * Custom token extraction callback.
+ *
+ * Return values:
+ * - `string`: Token found, use this token
+ * - `null`: No token found, authentication should fail
+ * - `undefined`: Skip custom extraction, use default Bearer token extraction
+ */
+export type TokenExtractor = (req: FlinkRequest) => string | null | undefined;
+
+/**
+ * Custom permission validation callback.
+ *
+ * Called after getUser to validate if the user has required permissions.
+ * Useful for dynamic permissions stored in database.
+ *
+ * @param user - The authenticated user object returned from getUser
+ * @param routePermissions - Array of permissions required by the route
+ * @returns true if user has required permissions, false otherwise
+ */
+export type PermissionChecker = (
+    user: FlinkAuthUser,
+    routePermissions: string[]
+) => Promise<boolean> | boolean;
+
 export interface JwtAuthPluginOptions {
-  secret: string;
-  algo?: jwtSimple.TAlgorithm;
-  getUser: (tokenData: any) => Promise<FlinkAuthUser>;
-  passwordPolicy?: RegExp;
-  tokenTTL? : number;
-  rolePermissions: {
-    [role: string]: string[];
-  };
+    secret: string;
+    algo?: jwtSimple.TAlgorithm;
+    getUser: (tokenData: any, req: FlinkRequest) => Promise<FlinkAuthUser | null | undefined>;
+    passwordPolicy?: RegExp;
+    tokenTTL?: number;
+    rolePermissions: {
+        [role: string]: string[];
+    };
+    /**
+     * Optional custom token extraction callback.
+     *
+     * Allows conditional token extraction based on request properties (path, method, headers, etc.).
+     * Return `undefined` to fall back to default Bearer token extraction.
+     */
+    tokenExtractor?: TokenExtractor;
+    /**
+     * Optional custom permission checker for dynamic permissions.
+     *
+     * When provided, replaces static rolePermissions checking.
+     * Called after getUser with the full user object.
+     *
+     * Example:
+     * ```typescript
+     * checkPermissions: async (user, routePermissions) => {
+     *   return routePermissions.every(perm =>
+     *     user.permissions?.includes(perm)
+     *   );
+     * }
+     * ```
+     */
+    checkPermissions?: PermissionChecker;
+    /**
+     * When true, uses roles from the user object returned by getUser
+     * instead of roles from the decoded token for static permission checking.
+     *
+     * Useful for multi-tenant scenarios where user roles vary by organization context.
+     * The organization context can be determined from request headers, subdomain, path, etc.
+     *
+     * Example:
+     * ```typescript
+     * useDynamicRoles: true,
+     * getUser: async (tokenData, req) => {
+     *   const orgId = req.headers['x-organization-id'];
+     *   const membership = await getOrgMembership(tokenData.userId, orgId);
+     *   return {
+     *     id: tokenData.userId,
+     *     roles: [membership.role], // Org-specific role
+     *   };
+     * }
+     * ```
+     */
+    useDynamicRoles?: boolean;
 }
 
 export interface JwtAuthPlugin extends FlinkAuthPlugin {
-  /**
-   * Encodes and returns JWT token that includes provided payload.
-   *
-   * The payload can by anything but should in most cases be and object that
-   * holds user information including an identifier such as the username or id.
-   */
-  createToken: (payload: any, roles: string[]) => Promise<string>;
-
-  /**
-   * Generates new password hash and salt for provided password.
-   *
-   * This method should be used when setting a new password. Both hash and salt needs
-   * to be saved in database as both are needed to validate the password.
-   *
-   * Returns null if password does not match configured `passwordPolicy`.
-   */
-  createPasswordHashAndSalt: (
-    password: string
-  ) => Promise<{ hash: string; salt: string } | null>;
-
-  /**
-   * Validates that provided `password` is same as provided `hash`.
-   */
-  validatePassword: (
-    password: string,
-    passwordHash: string,
-    salt: string
-  ) => Promise<boolean>;
+    /**
+     * Encodes and returns JWT token that includes provided payload.
+     *
+     * The payload can by anything but should in most cases be and object that
+     * holds user information including an identifier such as the username or id.
+     */
+    createToken: (payload: any, roles: string[]) => Promise<string>;
+
+    /**
+     * Generates new password hash and salt for provided password.
+     *
+     * This method should be used when setting a new password. Both hash and salt needs
+     * to be saved in database as both are needed to validate the password.
+     *
+     * Returns null if password does not match configured `passwordPolicy`.
+     */
+    createPasswordHashAndSalt: (password: string) => Promise<{ hash: string; salt: string } | null>;
+
+    /**
+     * Validates that provided `password` is same as provided `hash`.
+     */
+    validatePassword: (password: string, passwordHash: string, salt: string) => Promise<boolean>;
 }
 
 /**
  * Configures and creates authentication plugin.
  */
 export function jwtAuthPlugin({
-  secret,
-  getUser,
-  rolePermissions,
-  algo = "HS256",
-  passwordPolicy = defaultPasswordPolicy,
-  tokenTTL = 1000 * 60 * 60 * 24 * 365 * 100, //Defaults to hundred year
+    secret,
+    getUser,
+    rolePermissions,
+    algo = "HS256",
+    passwordPolicy = defaultPasswordPolicy,
+    tokenTTL = 1000 * 60 * 60 * 24 * 365 * 100, //Defaults to hundred year
+    tokenExtractor,
+    checkPermissions,
+    useDynamicRoles = false,
 }: JwtAuthPluginOptions): JwtAuthPlugin {
-  return {
-    authenticateRequest: async (req, permissions) =>
-      authenticateRequest(req, permissions, rolePermissions, {
-        algo,
-        secret,
-        getUser,
-      }),
-    createToken: (payload, roles) =>
-      createToken({ ...payload, roles }, { algo, secret, tokenTTL }),
-    createPasswordHashAndSalt: (password: string) =>
-      createPasswordHashAndSalt(password, passwordPolicy),
-    validatePassword,
-  };
+    return {
+        authenticateRequest: async (req, permissions) =>
+            authenticateRequest(req, permissions, rolePermissions, {
+                algo,
+                secret,
+                getUser,
+                tokenExtractor,
+                checkPermissions,
+                useDynamicRoles,
+            }),
+        createToken: (payload, roles) => createToken({ ...payload, roles }, { algo, secret, tokenTTL }),
+        createPasswordHashAndSalt: (password: string) => createPasswordHashAndSalt(password, passwordPolicy),
+        validatePassword,
+    };
 }
 
 async function authenticateRequest(
-  req: FlinkRequest,
-  routePermissions: string | string[],
-  rolePermissions: { [x: string]: string[] },
-  {
-    secret,
-    algo,
-    getUser,
-  }: Pick<JwtAuthPluginOptions, "algo" | "secret" | "getUser">
+    req: FlinkRequest,
+    routePermissions: string | string[],
+    rolePermissions: { [x: string]: string[] },
+    { secret, algo, getUser, tokenExtractor, checkPermissions, useDynamicRoles }: Pick<
+        JwtAuthPluginOptions,
+        "algo" | "secret" | "getUser" | "tokenExtractor" | "checkPermissions" | "useDynamicRoles"
+    >
 ) {
-  const token = getTokenFromReq(req);
+    let token: string | null | undefined;
 
-  if (token) {
-    let decodedToken;
+    if (tokenExtractor) {
+        token = tokenExtractor(req);
 
-    try {
-      decodedToken = jwtSimple.decode(token, secret, false, algo);
-    } catch (err) {
-      log.debug(`Failed to decode token: ${err}`);
-      decodedToken = null;
+        // If tokenExtractor returns undefined, fall back to default
+        if (token === undefined) {
+            token = getTokenFromReq(req);
+        }
+        // If it returns null, token stays null (no default fallback)
+        // If it returns string, token is the string
+    } else {
+        // No custom extractor, use default
+        token = getTokenFromReq(req);
     }
 
-    if (decodedToken) {
-      const permissionsArr = Array.isArray(routePermissions)
-        ? routePermissions
-        : [routePermissions];
-
-      if (permissionsArr && permissionsArr.length > 0) {
-        const validPerms = hasValidPermissions(
-          decodedToken.roles || [],
-          rolePermissions,
-          permissionsArr
-        );
+    if (token) {
+        let decodedToken;
 
-        if (!validPerms) {
-          return false;
+        try {
+            decodedToken = jwtSimple.decode(token, secret, false, algo);
+        } catch (err) {
+            log.debug(`[JWT AUTH PLUGIN] Failed to decode token: ${err}`);
+            decodedToken = null;
         }
-      }
 
-      const user = await getUser(decodedToken);
+        if (decodedToken) {
+            const permissionsArr = Array.isArray(routePermissions) ? routePermissions : [routePermissions];
 
+            // Static permission check - only if custom checker NOT provided AND not using dynamic roles
+            if (!checkPermissions && !useDynamicRoles && permissionsArr && permissionsArr.length > 0) {
+                const validPerms = hasValidPermissions(decodedToken.roles || [], rolePermissions, permissionsArr);
 
-      req.user = user;
-      return true;
+                if (!validPerms) {
+                    return false;
+                }
+            }
+
+            const user = await getUser(decodedToken, req);
+
+            if (!user) {
+                log.debug("[JWT AUTH PLUGIN] User not returned from getUser callback");
+                return false;
+            }
+
+            // Dynamic roles: check permissions using roles from user object
+            if (!checkPermissions && useDynamicRoles && permissionsArr && permissionsArr.length > 0) {
+                const validPerms = hasValidPermissions(user.roles || [], rolePermissions, permissionsArr);
+
+                if (!validPerms) {
+                    log.debug("[JWT AUTH PLUGIN] Dynamic role permission check failed");
+                    return false;
+                }
+            }
+
+            // Custom permission check - only if provided
+            if (checkPermissions && permissionsArr && permissionsArr.length > 0) {
+                const hasPermission = await checkPermissions(user, permissionsArr);
+
+                if (!hasPermission) {
+                    log.debug("[JWT AUTH PLUGIN] Custom permission check failed");
+                    return false;
+                }
+            }
+
+            req.user = user;
+            return true;
+        }
     }
-  }
-  return false;
+    return false;
 }
 
 function getTokenFromReq(req: FlinkRequest) {
-  const authHeader = req.headers.authorization;
-  if (authHeader) {
-    const [, token] = authHeader.split("Bearer ");
-    return token;
-  }
-  return;
+    const authHeader = req.headers.authorization;
+    if (authHeader) {
+        const [, token] = authHeader.split("Bearer ");
+        return token;
+    }
+    return;
 }
 
-async function createToken(
-  payload: any,
-  { secret, algo, tokenTTL }: Pick<JwtAuthPluginOptions, "algo" | "secret" | "tokenTTL" >
-) {
-  if (!payload) {
-    throw new Error("Cannot create token - payload is missing");
-  }
+async function createToken(payload: any, { secret, algo, tokenTTL }: Pick<JwtAuthPluginOptions, "algo" | "secret" | "tokenTTL">) {
+    if (!payload) {
+        throw new Error("Cannot create token - payload is missing");
+    }
 
-  return jwtSimple.encode({exp : _calculateExpiration(tokenTTL || 1000 * 60 * 60 * 24 * 365 * 100),  ...payload}, secret, algo);
+    return jwtSimple.encode({ exp: _calculateExpiration(tokenTTL || 1000 * 60 * 60 * 24 * 365 * 100), ...payload }, secret, algo);
 }
 
-function _calculateExpiration(expiresInMs : number) {
+function _calculateExpiration(expiresInMs: number) {
     return Math.floor((Date.now() + expiresInMs) / 1000);
 }
 
+async function createPasswordHashAndSalt(password: string, passwordPolicy: RegExp) {
+    if (!passwordPolicy.test(password)) {
+        log.debug(`Password does not match password policy '${passwordPolicy}'`);
+        return null;
+    }
 
-async function createPasswordHashAndSalt(
-  password: string,
-  passwordPolicy: RegExp
-) {
-  if (!passwordPolicy.test(password)) {
-    log.debug(`Password does not match password policy '${passwordPolicy}'`);
-    return null;
-  }
-
-  const salt = await genSalt(10);
-  const hash = await encrypt(password, salt);
-  return { salt, hash };
+    const salt = await genSalt(10);
+    const hash = await encrypt(password, salt);
+    return { salt, hash };
 }
 
-async function validatePassword(
-  password: string,
-  passwordHash: string,
-  salt: string
-) {
-  const hashCandidate = await encrypt(password, salt);
-  return hashCandidate === passwordHash;
+async function validatePassword(password: string, passwordHash: string, salt: string) {
+    const hashCandidate = await encrypt(password, salt);
+    return hashCandidate === passwordHash;
 }

package/tsconfig.json

@@ -15,7 +15,7 @@
     "noEmit": false,
     "declaration": true,
     "experimentalDecorators": true,
-    "checkJs": true,
+    "checkJs": false,
     "outDir": "dist",
     "typeRoots": ["./node_modules/@types"]
   },