@flink-app/jwt-auth-plugin 1.0.0 → 2.0.0-alpha.100

package/src/FlinkJwtAuthPlugin.ts

@@ -34,10 +34,29 @@ export type PermissionChecker = (
     routePermissions: string[]
 ) => Promise<boolean> | boolean;
 
+/**
+ * Custom token TTL resolver callback.
+ *
+ * Called during token creation to determine expiration dynamically based on roles.
+ *
+ * Return values:
+ * - `number`: TTL in milliseconds to use for this token
+ * - `undefined`: Fall back to static `tokenTTL` option (or default ~100 years)
+ */
+export type TokenTTLResolver = (roles: string[], payload: any) => number | undefined;
+
 export interface JwtAuthPluginOptions {
     secret: string;
     algo?: jwtSimple.TAlgorithm;
-    getUser: (tokenData: any, req: FlinkRequest) => Promise<FlinkAuthUser | null | undefined>;
+    /**
+     * @param ctx The host application's context, supplied by Flink core on
+     * each authenticated request. Lets the callback access repos/services
+     * that don't exist when the plugin is constructed (e.g. before
+     * `FlinkApp.start()` resolves) without forcing the consumer to keep a
+     * module-level mutable reference. Undefined only when invoked outside
+     * the normal request pipeline (e.g. unit tests).
+     */
+    getUser: (tokenData: any, req: FlinkRequest, ctx?: any) => Promise<FlinkAuthUser | null | undefined>;
     passwordPolicy?: RegExp;
     tokenTTL?: number;
     rolePermissions: {
@@ -87,17 +106,26 @@ export interface JwtAuthPluginOptions {
      * ```
      */
     useDynamicRoles?: boolean;
-}
-
-export interface JwtAuthPlugin extends FlinkAuthPlugin {
     /**
-     * Encodes and returns JWT token that includes provided payload.
+     * Optional dynamic token TTL resolver.
      *
-     * The payload can by anything but should in most cases be and object that
-     * holds user information including an identifier such as the username or id.
+     * When provided, called during token creation with the user's roles and payload.
+     * Return a TTL in milliseconds to override the static `tokenTTL`, or `undefined`
+     * to fall back to `tokenTTL` (or the default).
+     *
+     * Example:
+     * ```typescript
+     * resolveTokenTTL: (roles) => {
+     *   if (roles.includes("service-account")) return 1000 * 60 * 60 * 24 * 365; // 1 year
+     *   if (roles.includes("admin")) return 1000 * 60 * 60 * 8; // 8 hours
+     *   return 1000 * 60 * 60; // 1 hour default
+     * }
+     * ```
      */
-    createToken: (payload: any, roles: string[]) => Promise<string>;
+    resolveTokenTTL?: TokenTTLResolver;
+}
 
+export interface JwtAuthPlugin extends FlinkAuthPlugin {
     /**
      * Generates new password hash and salt for provided password.
      *
@@ -123,14 +151,15 @@ export function jwtAuthPlugin({
     rolePermissions,
     algo = "HS256",
     passwordPolicy = defaultPasswordPolicy,
-    tokenTTL = 1000 * 60 * 60 * 24 * 365 * 100, //Defaults to hundred year
+    tokenTTL,
     tokenExtractor,
     checkPermissions,
     useDynamicRoles = false,
+    resolveTokenTTL,
 }: JwtAuthPluginOptions): JwtAuthPlugin {
     return {
-        authenticateRequest: async (req, permissions) =>
-            authenticateRequest(req, permissions, rolePermissions, {
+        authenticateRequest: async (req, permissions, ctx) =>
+            authenticateRequest(req, permissions, rolePermissions, ctx, {
                 algo,
                 secret,
                 getUser,
@@ -138,7 +167,7 @@ export function jwtAuthPlugin({
                 checkPermissions,
                 useDynamicRoles,
             }),
-        createToken: (payload, roles) => createToken({ ...payload, roles }, { algo, secret, tokenTTL }),
+        createToken: (payload, roles) => createToken({ ...payload, roles }, { algo, secret, tokenTTL, resolveTokenTTL }, roles),
         createPasswordHashAndSalt: (password: string) => createPasswordHashAndSalt(password, passwordPolicy),
         validatePassword,
     };
@@ -148,6 +177,7 @@ async function authenticateRequest(
     req: FlinkRequest,
     routePermissions: string | string[],
     rolePermissions: { [x: string]: string[] },
+    ctx: any,
     { secret, algo, getUser, tokenExtractor, checkPermissions, useDynamicRoles }: Pick<
         JwtAuthPluginOptions,
         "algo" | "secret" | "getUser" | "tokenExtractor" | "checkPermissions" | "useDynamicRoles"
@@ -191,7 +221,7 @@ async function authenticateRequest(
                 }
             }
 
-            const user = await getUser(decodedToken, req);
+            const user = await getUser(decodedToken, req, ctx);
 
             if (!user) {
                 log.debug("[JWT AUTH PLUGIN] User not returned from getUser callback");
@@ -219,6 +249,19 @@ async function authenticateRequest(
             }
 
             req.user = user;
+
+            // Expose the verified token so handlers can read claims (e.g. jti)
+            // without re-extracting and re-decoding (and without an unverified decode).
+            req.token = decodedToken;
+            req.rawToken = token;
+
+            // Populate userPermissions from resolved permissions
+            req.userPermissions = computeUserPermissions(user, decodedToken, {
+                useDynamicRoles,
+                rolePermissions,
+                checkPermissions,
+            });
+
             return true;
         }
     }
@@ -234,12 +277,20 @@ function getTokenFromReq(req: FlinkRequest) {
     return;
 }
 
-async function createToken(payload: any, { secret, algo, tokenTTL }: Pick<JwtAuthPluginOptions, "algo" | "secret" | "tokenTTL">) {
+async function createToken(
+    payload: any,
+    { secret, algo, tokenTTL, resolveTokenTTL }: Pick<JwtAuthPluginOptions, "algo" | "secret" | "tokenTTL" | "resolveTokenTTL">,
+    roles: string[]
+) {
     if (!payload) {
         throw new Error("Cannot create token - payload is missing");
     }
 
-    return jwtSimple.encode({ exp: _calculateExpiration(tokenTTL || 1000 * 60 * 60 * 24 * 365 * 100), ...payload }, secret, algo);
+    const resolvedTTL = resolveTokenTTL?.(roles, payload);
+    const effectiveTTL = resolvedTTL ?? tokenTTL ?? 1000 * 60 * 60 * 24 * 365 * 100;
+    const iat = Math.floor(Date.now() / 1000);
+
+    return jwtSimple.encode({ iat, exp: _calculateExpiration(effectiveTTL), ...payload }, secret, algo);
 }
 
 function _calculateExpiration(expiresInMs: number) {
@@ -261,3 +312,52 @@ async function validatePassword(password: string, passwordHash: string, salt: st
     const hashCandidate = await encrypt(password, salt);
     return hashCandidate === passwordHash;
 }
+
+/**
+ * Compute user permissions based on auth plugin configuration
+ *
+ * Strategies (in order):
+ * 1. User object has permissions directly (from getUser callback)
+ * 2. Dynamic roles - map user.roles to permissions
+ * 3. Static roles from token - map token.roles to permissions
+ * 4. No permissions available - return empty array
+ */
+function computeUserPermissions(
+    user: any,
+    decodedToken: any,
+    config: {
+        useDynamicRoles?: boolean;
+        rolePermissions: { [x: string]: string[] };
+        checkPermissions?: PermissionChecker;
+    }
+): string[] {
+    // Strategy 1: User object has permissions directly (from getUser callback)
+    if (user.permissions && Array.isArray(user.permissions)) {
+        return user.permissions;
+    }
+
+    // Strategy 2: Dynamic roles - map user.roles to permissions
+    if (config.useDynamicRoles && user.roles && Array.isArray(user.roles)) {
+        return flattenRolesToPermissions(user.roles, config.rolePermissions);
+    }
+
+    // Strategy 3: Static roles from token - map token.roles to permissions
+    if (decodedToken.roles && Array.isArray(decodedToken.roles)) {
+        return flattenRolesToPermissions(decodedToken.roles, config.rolePermissions);
+    }
+
+    // Strategy 4: No permissions available
+    return [];
+}
+
+/**
+ * Convert roles to permissions using rolePermissions mapping
+ */
+function flattenRolesToPermissions(roles: string[], roleMap: Record<string, string[]>): string[] {
+    const perms = new Set<string>();
+    for (const role of roles) {
+        const rolePerms = roleMap[role] || [];
+        rolePerms.forEach((p) => perms.add(p));
+    }
+    return Array.from(perms);
+}

package/src/PermissionValidator.ts

@@ -1,5 +1,22 @@
 import { log } from "@flink-app/flink";
 
+/**
+ * Checks whether a single role scope entry matches a required route
+ * permission. Supports exact match and trailing-segment wildcards of the
+ * form `"foo.bar.*"`, which match any route permission that starts with
+ * `"foo.bar."` (segment-scoped — does NOT match `"foo.bar"` itself, and
+ * does NOT match `"foo.barbaz.x"`).
+ */
+function scopeMatches(scope: string, routePerm: string): boolean {
+  if (scope === routePerm) return true;
+  if (scope.endsWith(".*")) {
+    // Keep the trailing "." so "a.*" does not match "a" or "ab.c".
+    const prefix = scope.slice(0, -1);
+    return routePerm.startsWith(prefix);
+  }
+  return false;
+}
+
 /**
  * Checks if provided role has permission to access route
  * based on its permissions.
@@ -36,7 +53,7 @@ export function hasValidPermissions(
 
     if (
       routePermissions.every((routePerm) =>
-        thisRolesPermissions.includes(routePerm)
+        thisRolesPermissions.some((scope) => scopeMatches(scope, routePerm))
       )
     ) {
       return true;