@flink-app/jwt-auth-plugin 1.0.0 → 2.0.0-alpha.101

package/CHANGELOG.md

@@ -1,5 +1,436 @@
 # @flink-app/jwt-auth-plugin
 
+## 2.0.0-alpha.101
+
+### Patch Changes
+
+-   Updated dependencies [b11f2f8]
+    -   @flink-app/flink@2.0.0-alpha.101
+
+## 2.0.0-alpha.100
+
+### Patch Changes
+
+-   Updated dependencies [6e8166a]
+    -   @flink-app/flink@2.0.0-alpha.100
+
+## 2.0.0-alpha.99
+
+### Patch Changes
+
+-   Updated dependencies [ed9cd2c]
+    -   @flink-app/flink@2.0.0-alpha.99
+
+## 2.0.0-alpha.98
+
+### Minor Changes
+
+-   2f4a132: feat: expose verified token on the request
+
+    The JWT auth plugin now populates `req.token` (the decoded, signature-verified
+    payload) and `req.rawToken` (the original token string) after successful
+    authentication. Handlers can read token claims such as `jti` directly instead of
+    re-extracting and re-decoding the bearer token with an unverified decode.
+
+    ```ts
+    // Before
+    const authHeader = req.headers.authorization;
+    const bearer = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+    const decoded = bearer ? (jsonwebtoken.decode(bearer) as { jti?: string }) : null;
+    const sessionId = decoded?.jti ?? legacySessionId(req.user._id);
+
+    // After
+    const { jti } = (req.token as { jti?: string }) ?? {};
+    const sessionId = jti ?? legacySessionId(req.user._id);
+    ```
+
+    `token` / `rawToken` are added as optional fields on the core `FlinkRequest`
+    type, populated by auth plugins that have a token concept.
+
+### Patch Changes
+
+-   Updated dependencies [2f4a132]
+    -   @flink-app/flink@2.0.0-alpha.98
+
+## 2.0.0-alpha.97
+
+### Minor Changes
+
+-   eed6bc1: Pass host application context to auth plugins.
+
+    `FlinkAuthPlugin.authenticateRequest` now receives the host app's context as an optional third argument. Flink core supplies it on every authenticated request, so auth plugins can access repos/services without the caller wiring up a lazy accessor or maintaining a module-level mutable reference.
+
+    For `@flink-app/jwt-auth-plugin`, this means `getUser` receives the context directly:
+
+    ```typescript
+    jwtAuthPlugin({
+        getUser: async (tokenData, req, ctx) => {
+            const user = await ctx?.repos.userRepo.getById(tokenData._id);
+            return user ? { username: user.username, _id: user._id } : null;
+        },
+    });
+    ```
+
+    The `getContext` option previously added in alpha.96 is no longer needed and has been removed — remove it from your `jwtAuthPlugin({ … })` call. The third `ctx` parameter on `getUser` is optional, so callbacks that ignore it are unaffected.
+
+### Patch Changes
+
+-   Updated dependencies [eed6bc1]
+    -   @flink-app/flink@2.0.0-alpha.97
+
+## 2.0.0-alpha.96
+
+### Patch Changes
+
+-   e431237: Add `iat` (issued-at) claim to generated JWTs.
+
+    `iat` is a standard JWT claim that records when the token was issued (Unix seconds). Adding it enables consumers to implement stateless force-logout / token-revocation patterns by storing a per-user "tokens-valid-from" timestamp and rejecting any token whose `iat` is older.
+
+    Backwards compatible — the claim is informational and does not affect verification of existing tokens. If a caller's payload already contains an `iat` field it takes precedence (useful for tests).
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.96
+
+## 2.0.0-alpha.95
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.95
+
+## 2.0.0-alpha.94
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.94
+
+## 2.0.0-alpha.93
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.93
+
+## 2.0.0-alpha.92
+
+### Patch Changes
+
+-   Updated dependencies [8d23d56]
+    -   @flink-app/flink@2.0.0-alpha.92
+
+## 2.0.0-alpha.91
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.91
+
+## 2.0.0-alpha.90
+
+### Patch Changes
+
+-   Updated dependencies [0d84b5f]
+    -   @flink-app/flink@2.0.0-alpha.90
+
+## 2.0.0-alpha.89
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.89
+
+## 2.0.0-alpha.88
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.88
+
+## 2.0.0-alpha.87
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.87
+
+## 2.0.0-alpha.86
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.86
+
+## 2.0.0-alpha.85
+
+### Minor Changes
+
+-   179c085: Add support for trailing-segment wildcard scopes in `rolePermissions`. A role scope ending in `.*` (e.g. `"license.subscription.*"`) now matches any required route permission that starts with that prefix including the trailing dot — `"license.subscription.get"` and `"license.subscription.cancel"` match, while `"license.subscription"` and `"license.subscriptions.get"` do not. Wildcards are segment-scoped to prevent accidental privilege escalation, and only trailing `.*` is special. Existing behavior (route `"*"`, role `"*"`, exact-match scopes, empty permission arrays) is unchanged.
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.85
+
+## 2.0.0-alpha.84
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.84
+
+## 2.0.0-alpha.83
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.83
+
+## 2.0.0-alpha.82
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.82
+
+## 2.0.0-alpha.81
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.81
+
+## 2.0.0-alpha.80
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.80
+
+## 2.0.0-alpha.79
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.79
+
+## 2.0.0-alpha.78
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.78
+
+## 2.0.0-alpha.77
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.77
+
+## 2.0.0-alpha.76
+
+### Minor Changes
+
+-   Add resolveTokenTTL callback to jwt-auth-plugin for dynamic token TTL based on role. Fix renames in email-plugin and inbound-email-plugin. Fix tsconfig in generic-auth-plugin.
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.76
+
+## 2.0.0-alpha.75
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.75
+
+## 2.0.0-alpha.74
+
+### Patch Changes
+
+-   Updated dependencies
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.74
+
+## 2.0.0-alpha.73
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.73
+
+## 2.0.0-alpha.72
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.72
+
+## 2.0.0-alpha.71
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.71
+
+## 2.0.0-alpha.70
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.70
+
+## 2.0.0-alpha.69
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.69
+
+## 2.0.0-alpha.68
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.68
+
+## 2.0.0-alpha.67
+
+### Patch Changes
+
+-   Updated dependencies [418cb54]
+-   Updated dependencies [70d574c]
+    -   @flink-app/flink@2.0.0-alpha.67
+
+## 2.0.0-alpha.66
+
+### Patch Changes
+
+-   Updated dependencies [5593d26]
+    -   @flink-app/flink@2.0.0-alpha.66
+
+## 2.0.0-alpha.65
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.65
+
+## 2.0.0-alpha.64
+
+### Patch Changes
+
+-   Updated dependencies [95b99ee]
+    -   @flink-app/flink@2.0.0-alpha.64
+
+## 2.0.0-alpha.63
+
+### Patch Changes
+
+-   Updated dependencies [810df2c]
+-   Updated dependencies [8dd0752]
+    -   @flink-app/flink@2.0.0-alpha.63
+
+## 2.0.0-alpha.62
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.62
+
+## 2.0.0-alpha.61
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.61
+
+## 2.0.0-alpha.60
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.60
+
+## 2.0.0-alpha.59
+
+### Patch Changes
+
+-   Updated dependencies [dbc2119]
+    -   @flink-app/flink@2.0.0-alpha.59
+
+## 2.0.0-alpha.58
+
+### Patch Changes
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.58
+
+## 2.0.0-alpha.57
+
+### Patch Changes
+
+-   Updated dependencies [ef7f495]
+-   Updated dependencies [2d53aa4]
+-   Updated dependencies [b3cc5d1]
+-   Updated dependencies [d377fac]
+-   Updated dependencies [4ad44c0]
+-   Updated dependencies [90f80c7]
+-   Updated dependencies [f0887e7]
+-   Updated dependencies [68c46d3]
+-   Updated dependencies [4ad44c0]
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.57
+
+## 2.0.0-alpha.56
+
+### Patch Changes
+
+-   Zod 3.x compat
+-   Updated dependencies
+-   Updated dependencies [0203256]
+    -   @flink-app/flink@2.0.0-alpha.56
+
+## 2.0.0-alpha.55
+
+### Patch Changes
+
+-   Updated dependencies [3267206]
+-   Updated dependencies [497b7c2]
+-   Updated dependencies [3267206]
+    -   @flink-app/flink@2.0.0-alpha.55
+
+## 2.0.0-alpha.53
+
+### Patch Changes
+
+-   Updated dependencies [669c806]
+    -   @flink-app/flink@2.0.0-alpha.53
+
+## 2.0.0-alpha.52
+
+### Patch Changes
+
+-   Updated dependencies [fe9f8f2]
+    -   @flink-app/flink@2.0.0-alpha.52
+
+## 2.0.0-alpha.51
+
+### Patch Changes
+
+-   fix: add peerDependencies to all plugins and adapters
+
+    **Breaking Change Prevention:**
+
+    -   Added "@flink-app/flink": ">=2.0.0-alpha.0" as peerDependency to all plugins
+    -   Fixed oidc-plugin peerDependencies from "workspace:\*" to proper version ranges
+    -   Fixed oauth-plugin to include @flink-app/flink peerDependency
+
+    **JWT Auth Plugin Interface Fix:**
+
+    -   Removed redundant createToken declaration from JwtAuthPlugin interface
+    -   The method is already inherited from FlinkAuthPlugin, this fixes TypeScript type checking issues
+
+    **Why this matters:**
+
+    -   Ensures only one version of @flink-app/flink exists in node_modules
+    -   Prevents type conflicts when TypeScript resolves interfaces across packages
+    -   Follows standard plugin architecture best practices (same pattern as React, Webpack, etc.)
+    -   Package managers now warn if incompatible versions are installed
+    -   @flink-app/flink@2.0.0-alpha.51
+
+## 2.0.0-alpha.50
+
+## 2.0.0-alpha.49
+
+### Patch Changes
+
+-   Typescript include fix
+
+## 2.0.0-alpha.48
+
+### Minor Changes
+
+-   AI features
+
 ## 1.0.0
 
 ### Minor Changes

package/dist/FlinkJwtAuthPlugin.d.ts

@@ -20,10 +20,28 @@ export type TokenExtractor = (req: FlinkRequest) => string | null | undefined;
  * @returns true if user has required permissions, false otherwise
  */
 export type PermissionChecker = (user: FlinkAuthUser, routePermissions: string[]) => Promise<boolean> | boolean;
+/**
+ * Custom token TTL resolver callback.
+ *
+ * Called during token creation to determine expiration dynamically based on roles.
+ *
+ * Return values:
+ * - `number`: TTL in milliseconds to use for this token
+ * - `undefined`: Fall back to static `tokenTTL` option (or default ~100 years)
+ */
+export type TokenTTLResolver = (roles: string[], payload: any) => number | undefined;
 export interface JwtAuthPluginOptions {
     secret: string;
     algo?: jwtSimple.TAlgorithm;
-    getUser: (tokenData: any, req: FlinkRequest) => Promise<FlinkAuthUser | null | undefined>;
+    /**
+     * @param ctx The host application's context, supplied by Flink core on
+     * each authenticated request. Lets the callback access repos/services
+     * that don't exist when the plugin is constructed (e.g. before
+     * `FlinkApp.start()` resolves) without forcing the consumer to keep a
+     * module-level mutable reference. Undefined only when invoked outside
+     * the normal request pipeline (e.g. unit tests).
+     */
+    getUser: (tokenData: any, req: FlinkRequest, ctx?: any) => Promise<FlinkAuthUser | null | undefined>;
     passwordPolicy?: RegExp;
     tokenTTL?: number;
     rolePermissions: {
@@ -73,15 +91,25 @@ export interface JwtAuthPluginOptions {
      * ```
      */
     useDynamicRoles?: boolean;
-}
-export interface JwtAuthPlugin extends FlinkAuthPlugin {
     /**
-     * Encodes and returns JWT token that includes provided payload.
+     * Optional dynamic token TTL resolver.
+     *
+     * When provided, called during token creation with the user's roles and payload.
+     * Return a TTL in milliseconds to override the static `tokenTTL`, or `undefined`
+     * to fall back to `tokenTTL` (or the default).
      *
-     * The payload can by anything but should in most cases be and object that
-     * holds user information including an identifier such as the username or id.
+     * Example:
+     * ```typescript
+     * resolveTokenTTL: (roles) => {
+     *   if (roles.includes("service-account")) return 1000 * 60 * 60 * 24 * 365; // 1 year
+     *   if (roles.includes("admin")) return 1000 * 60 * 60 * 8; // 8 hours
+     *   return 1000 * 60 * 60; // 1 hour default
+     * }
+     * ```
      */
-    createToken: (payload: any, roles: string[]) => Promise<string>;
+    resolveTokenTTL?: TokenTTLResolver;
+}
+export interface JwtAuthPlugin extends FlinkAuthPlugin {
     /**
      * Generates new password hash and salt for provided password.
      *
@@ -102,5 +130,4 @@ export interface JwtAuthPlugin extends FlinkAuthPlugin {
 /**
  * Configures and creates authentication plugin.
  */
-export declare function jwtAuthPlugin({ secret, getUser, rolePermissions, algo, passwordPolicy, tokenTTL, //Defaults to hundred year
-tokenExtractor, checkPermissions, useDynamicRoles, }: JwtAuthPluginOptions): JwtAuthPlugin;
+export declare function jwtAuthPlugin({ secret, getUser, rolePermissions, algo, passwordPolicy, tokenTTL, tokenExtractor, checkPermissions, useDynamicRoles, resolveTokenTTL, }: JwtAuthPluginOptions): JwtAuthPlugin;

package/dist/FlinkJwtAuthPlugin.js

@@ -65,12 +65,11 @@ var defaultPasswordPolicy = /^(?=.*[A-Za-z])(?=.*\d)[A-Za-z\d]{8,}$/;
  */
 function jwtAuthPlugin(_a) {
     var _this = this;
-    var secret = _a.secret, getUser = _a.getUser, rolePermissions = _a.rolePermissions, _b = _a.algo, algo = _b === void 0 ? "HS256" : _b, _c = _a.passwordPolicy, passwordPolicy = _c === void 0 ? defaultPasswordPolicy : _c, _d = _a.tokenTTL, tokenTTL = _d === void 0 ? 1000 * 60 * 60 * 24 * 365 * 100 : _d, //Defaults to hundred year
-    tokenExtractor = _a.tokenExtractor, checkPermissions = _a.checkPermissions, _e = _a.useDynamicRoles, useDynamicRoles = _e === void 0 ? false : _e;
+    var secret = _a.secret, getUser = _a.getUser, rolePermissions = _a.rolePermissions, _b = _a.algo, algo = _b === void 0 ? "HS256" : _b, _c = _a.passwordPolicy, passwordPolicy = _c === void 0 ? defaultPasswordPolicy : _c, tokenTTL = _a.tokenTTL, tokenExtractor = _a.tokenExtractor, checkPermissions = _a.checkPermissions, _d = _a.useDynamicRoles, useDynamicRoles = _d === void 0 ? false : _d, resolveTokenTTL = _a.resolveTokenTTL;
     return {
-        authenticateRequest: function (req, permissions) { return __awaiter(_this, void 0, void 0, function () {
+        authenticateRequest: function (req, permissions, ctx) { return __awaiter(_this, void 0, void 0, function () {
             return __generator(this, function (_a) {
-                return [2 /*return*/, authenticateRequest(req, permissions, rolePermissions, {
+                return [2 /*return*/, authenticateRequest(req, permissions, rolePermissions, ctx, {
                         algo: algo,
                         secret: secret,
                         getUser: getUser,
@@ -80,13 +79,13 @@ function jwtAuthPlugin(_a) {
                     })];
             });
         }); },
-        createToken: function (payload, roles) { return createToken(__assign(__assign({}, payload), { roles: roles }), { algo: algo, secret: secret, tokenTTL: tokenTTL }); },
+        createToken: function (payload, roles) { return createToken(__assign(__assign({}, payload), { roles: roles }), { algo: algo, secret: secret, tokenTTL: tokenTTL, resolveTokenTTL: resolveTokenTTL }, roles); },
         createPasswordHashAndSalt: function (password) { return createPasswordHashAndSalt(password, passwordPolicy); },
         validatePassword: validatePassword,
     };
 }
-function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, _a) {
-    return __awaiter(this, arguments, void 0, function (req, routePermissions, rolePermissions, _b) {
+function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, ctx_1, _a) {
+    return __awaiter(this, arguments, void 0, function (req, routePermissions, rolePermissions, ctx, _b) {
         var token, decodedToken, permissionsArr, validPerms, user, validPerms, hasPermission;
         var secret = _b.secret, algo = _b.algo, getUser = _b.getUser, tokenExtractor = _b.tokenExtractor, checkPermissions = _b.checkPermissions, useDynamicRoles = _b.useDynamicRoles;
         return __generator(this, function (_c) {
@@ -123,7 +122,7 @@ function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, _a) {
                             return [2 /*return*/, false];
                         }
                     }
-                    return [4 /*yield*/, getUser(decodedToken, req)];
+                    return [4 /*yield*/, getUser(decodedToken, req, ctx)];
                 case 1:
                     user = _c.sent();
                     if (!user) {
@@ -149,6 +148,16 @@ function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, _a) {
                     _c.label = 3;
                 case 3:
                     req.user = user;
+                    // Expose the verified token so handlers can read claims (e.g. jti)
+                    // without re-extracting and re-decoding (and without an unverified decode).
+                    req.token = decodedToken;
+                    req.rawToken = token;
+                    // Populate userPermissions from resolved permissions
+                    req.userPermissions = computeUserPermissions(user, decodedToken, {
+                        useDynamicRoles: useDynamicRoles,
+                        rolePermissions: rolePermissions,
+                        checkPermissions: checkPermissions,
+                    });
                     return [2 /*return*/, true];
                 case 4: return [2 /*return*/, false];
             }
@@ -163,14 +172,19 @@ function getTokenFromReq(req) {
     }
     return;
 }
-function createToken(payload_1, _a) {
-    return __awaiter(this, arguments, void 0, function (payload, _b) {
-        var secret = _b.secret, algo = _b.algo, tokenTTL = _b.tokenTTL;
-        return __generator(this, function (_c) {
+function createToken(payload_1, _a, roles_1) {
+    return __awaiter(this, arguments, void 0, function (payload, _b, roles) {
+        var resolvedTTL, effectiveTTL, iat;
+        var _c;
+        var secret = _b.secret, algo = _b.algo, tokenTTL = _b.tokenTTL, resolveTokenTTL = _b.resolveTokenTTL;
+        return __generator(this, function (_d) {
             if (!payload) {
                 throw new Error("Cannot create token - payload is missing");
             }
-            return [2 /*return*/, jwt_simple_1.default.encode(__assign({ exp: _calculateExpiration(tokenTTL || 1000 * 60 * 60 * 24 * 365 * 100) }, payload), secret, algo)];
+            resolvedTTL = resolveTokenTTL === null || resolveTokenTTL === void 0 ? void 0 : resolveTokenTTL(roles, payload);
+            effectiveTTL = (_c = resolvedTTL !== null && resolvedTTL !== void 0 ? resolvedTTL : tokenTTL) !== null && _c !== void 0 ? _c : 1000 * 60 * 60 * 24 * 365 * 100;
+            iat = Math.floor(Date.now() / 1000);
+            return [2 /*return*/, jwt_simple_1.default.encode(__assign({ iat: iat, exp: _calculateExpiration(effectiveTTL) }, payload), secret, algo)];
         });
     });
 }
@@ -211,3 +225,40 @@ function validatePassword(password, passwordHash, salt) {
         });
     });
 }
+/**
+ * Compute user permissions based on auth plugin configuration
+ *
+ * Strategies (in order):
+ * 1. User object has permissions directly (from getUser callback)
+ * 2. Dynamic roles - map user.roles to permissions
+ * 3. Static roles from token - map token.roles to permissions
+ * 4. No permissions available - return empty array
+ */
+function computeUserPermissions(user, decodedToken, config) {
+    // Strategy 1: User object has permissions directly (from getUser callback)
+    if (user.permissions && Array.isArray(user.permissions)) {
+        return user.permissions;
+    }
+    // Strategy 2: Dynamic roles - map user.roles to permissions
+    if (config.useDynamicRoles && user.roles && Array.isArray(user.roles)) {
+        return flattenRolesToPermissions(user.roles, config.rolePermissions);
+    }
+    // Strategy 3: Static roles from token - map token.roles to permissions
+    if (decodedToken.roles && Array.isArray(decodedToken.roles)) {
+        return flattenRolesToPermissions(decodedToken.roles, config.rolePermissions);
+    }
+    // Strategy 4: No permissions available
+    return [];
+}
+/**
+ * Convert roles to permissions using rolePermissions mapping
+ */
+function flattenRolesToPermissions(roles, roleMap) {
+    var perms = new Set();
+    for (var _i = 0, roles_1 = roles; _i < roles_1.length; _i++) {
+        var role = roles_1[_i];
+        var rolePerms = roleMap[role] || [];
+        rolePerms.forEach(function (p) { return perms.add(p); });
+    }
+    return Array.from(perms);
+}

package/dist/PermissionValidator.js

@@ -2,6 +2,23 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasValidPermissions = hasValidPermissions;
 var flink_1 = require("@flink-app/flink");
+/**
+ * Checks whether a single role scope entry matches a required route
+ * permission. Supports exact match and trailing-segment wildcards of the
+ * form `"foo.bar.*"`, which match any route permission that starts with
+ * `"foo.bar."` (segment-scoped — does NOT match `"foo.bar"` itself, and
+ * does NOT match `"foo.barbaz.x"`).
+ */
+function scopeMatches(scope, routePerm) {
+    if (scope === routePerm)
+        return true;
+    if (scope.endsWith(".*")) {
+        // Keep the trailing "." so "a.*" does not match "a" or "ab.c".
+        var prefix = scope.slice(0, -1);
+        return routePerm.startsWith(prefix);
+    }
+    return false;
+}
 /**
  * Checks if provided role has permission to access route
  * based on its permissions.
@@ -28,7 +45,7 @@ function hasValidPermissions(roles, rolePermissions, routePermissions) {
             return { value: true };
         }
         if (routePermissions.every(function (routePerm) {
-            return thisRolesPermissions.includes(routePerm);
+            return thisRolesPermissions.some(function (scope) { return scopeMatches(scope, routePerm); });
         })) {
             return { value: true };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/jwt-auth-plugin",
-  "version": "1.0.0",
+  "version": "2.0.0-alpha.101",
   "description": "Flink plugin for JWT auth",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -19,7 +19,10 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/flink": "1.0.0"
+    "@flink-app/flink": "2.0.0-alpha.101"
+  },
+  "peerDependencies": {
+    "@flink-app/flink": ">=2.0.0-alpha.101"
   },
   "gitHead": "4243e3b3cd6d4e1ca001a61baa8436bf2bbe4113",
   "scripts": {