@flink-app/jwt-auth-plugin 2.0.0-alpha.94 → 2.0.0-alpha.96

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @flink-app/jwt-auth-plugin
 
+## 2.0.0-alpha.96
+
+### Patch Changes
+
+-   e431237: Add `iat` (issued-at) claim to generated JWTs.
+
+    `iat` is a standard JWT claim that records when the token was issued (Unix seconds). Adding it enables consumers to implement stateless force-logout / token-revocation patterns by storing a per-user "tokens-valid-from" timestamp and rejecting any token whose `iat` is older.
+
+    Backwards compatible — the claim is informational and does not affect verification of existing tokens. If a caller's payload already contains an `iat` field it takes precedence (useful for tests).
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.96
+
+## 2.0.0-alpha.95
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.95
+
 ## 2.0.0-alpha.94
 
 ### Patch Changes

package/dist/FlinkJwtAuthPlugin.js

@@ -170,7 +170,7 @@ function getTokenFromReq(req) {
 }
 function createToken(payload_1, _a, roles_1) {
     return __awaiter(this, arguments, void 0, function (payload, _b, roles) {
-        var resolvedTTL, effectiveTTL;
+        var resolvedTTL, effectiveTTL, iat;
         var _c;
         var secret = _b.secret, algo = _b.algo, tokenTTL = _b.tokenTTL, resolveTokenTTL = _b.resolveTokenTTL;
         return __generator(this, function (_d) {
@@ -179,7 +179,8 @@ function createToken(payload_1, _a, roles_1) {
             }
             resolvedTTL = resolveTokenTTL === null || resolveTokenTTL === void 0 ? void 0 : resolveTokenTTL(roles, payload);
             effectiveTTL = (_c = resolvedTTL !== null && resolvedTTL !== void 0 ? resolvedTTL : tokenTTL) !== null && _c !== void 0 ? _c : 1000 * 60 * 60 * 24 * 365 * 100;
-            return [2 /*return*/, jwt_simple_1.default.encode(__assign({ exp: _calculateExpiration(effectiveTTL) }, payload), secret, algo)];
+            iat = Math.floor(Date.now() / 1000);
+            return [2 /*return*/, jwt_simple_1.default.encode(__assign({ iat: iat, exp: _calculateExpiration(effectiveTTL) }, payload), secret, algo)];
         });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/jwt-auth-plugin",
-  "version": "2.0.0-alpha.94",
+  "version": "2.0.0-alpha.96",
   "description": "Flink plugin for JWT auth",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -19,10 +19,10 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/flink": "2.0.0-alpha.94"
+    "@flink-app/flink": "2.0.0-alpha.96"
   },
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.94"
+    "@flink-app/flink": ">=2.0.0-alpha.96"
   },
   "gitHead": "4243e3b3cd6d4e1ca001a61baa8436bf2bbe4113",
   "scripts": {

package/src/FlinkJwtAuthPlugin.ts

@@ -274,8 +274,9 @@ async function createToken(
 
     const resolvedTTL = resolveTokenTTL?.(roles, payload);
     const effectiveTTL = resolvedTTL ?? tokenTTL ?? 1000 * 60 * 60 * 24 * 365 * 100;
+    const iat = Math.floor(Date.now() / 1000);
 
-    return jwtSimple.encode({ exp: _calculateExpiration(effectiveTTL), ...payload }, secret, algo);
+    return jwtSimple.encode({ iat, exp: _calculateExpiration(effectiveTTL), ...payload }, secret, algo);
 }
 
 function _calculateExpiration(expiresInMs: number) {