@flink-app/jwt-auth-plugin 2.0.0-alpha.95 → 2.0.0-alpha.97

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @flink-app/jwt-auth-plugin
 
+## 2.0.0-alpha.97
+
+### Minor Changes
+
+-   eed6bc1: Pass host application context to auth plugins.
+
+    `FlinkAuthPlugin.authenticateRequest` now receives the host app's context as an optional third argument. Flink core supplies it on every authenticated request, so auth plugins can access repos/services without the caller wiring up a lazy accessor or maintaining a module-level mutable reference.
+
+    For `@flink-app/jwt-auth-plugin`, this means `getUser` receives the context directly:
+
+    ```typescript
+    jwtAuthPlugin({
+        getUser: async (tokenData, req, ctx) => {
+            const user = await ctx?.repos.userRepo.getById(tokenData._id);
+            return user ? { username: user.username, _id: user._id } : null;
+        },
+    });
+    ```
+
+    The `getContext` option previously added in alpha.96 is no longer needed and has been removed — remove it from your `jwtAuthPlugin({ … })` call. The third `ctx` parameter on `getUser` is optional, so callbacks that ignore it are unaffected.
+
+### Patch Changes
+
+-   Updated dependencies [eed6bc1]
+    -   @flink-app/flink@2.0.0-alpha.97
+
+## 2.0.0-alpha.96
+
+### Patch Changes
+
+-   e431237: Add `iat` (issued-at) claim to generated JWTs.
+
+    `iat` is a standard JWT claim that records when the token was issued (Unix seconds). Adding it enables consumers to implement stateless force-logout / token-revocation patterns by storing a per-user "tokens-valid-from" timestamp and rejecting any token whose `iat` is older.
+
+    Backwards compatible — the claim is informational and does not affect verification of existing tokens. If a caller's payload already contains an `iat` field it takes precedence (useful for tests).
+
+-   Updated dependencies
+    -   @flink-app/flink@2.0.0-alpha.96
+
 ## 2.0.0-alpha.95
 
 ### Patch Changes

package/dist/FlinkJwtAuthPlugin.d.ts

@@ -33,7 +33,15 @@ export type TokenTTLResolver = (roles: string[], payload: any) => number | undef
 export interface JwtAuthPluginOptions {
     secret: string;
     algo?: jwtSimple.TAlgorithm;
-    getUser: (tokenData: any, req: FlinkRequest) => Promise<FlinkAuthUser | null | undefined>;
+    /**
+     * @param ctx The host application's context, supplied by Flink core on
+     * each authenticated request. Lets the callback access repos/services
+     * that don't exist when the plugin is constructed (e.g. before
+     * `FlinkApp.start()` resolves) without forcing the consumer to keep a
+     * module-level mutable reference. Undefined only when invoked outside
+     * the normal request pipeline (e.g. unit tests).
+     */
+    getUser: (tokenData: any, req: FlinkRequest, ctx?: any) => Promise<FlinkAuthUser | null | undefined>;
     passwordPolicy?: RegExp;
     tokenTTL?: number;
     rolePermissions: {

package/dist/FlinkJwtAuthPlugin.js

@@ -67,9 +67,9 @@ function jwtAuthPlugin(_a) {
     var _this = this;
     var secret = _a.secret, getUser = _a.getUser, rolePermissions = _a.rolePermissions, _b = _a.algo, algo = _b === void 0 ? "HS256" : _b, _c = _a.passwordPolicy, passwordPolicy = _c === void 0 ? defaultPasswordPolicy : _c, tokenTTL = _a.tokenTTL, tokenExtractor = _a.tokenExtractor, checkPermissions = _a.checkPermissions, _d = _a.useDynamicRoles, useDynamicRoles = _d === void 0 ? false : _d, resolveTokenTTL = _a.resolveTokenTTL;
     return {
-        authenticateRequest: function (req, permissions) { return __awaiter(_this, void 0, void 0, function () {
+        authenticateRequest: function (req, permissions, ctx) { return __awaiter(_this, void 0, void 0, function () {
             return __generator(this, function (_a) {
-                return [2 /*return*/, authenticateRequest(req, permissions, rolePermissions, {
+                return [2 /*return*/, authenticateRequest(req, permissions, rolePermissions, ctx, {
                         algo: algo,
                         secret: secret,
                         getUser: getUser,
@@ -84,8 +84,8 @@ function jwtAuthPlugin(_a) {
         validatePassword: validatePassword,
     };
 }
-function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, _a) {
-    return __awaiter(this, arguments, void 0, function (req, routePermissions, rolePermissions, _b) {
+function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, ctx_1, _a) {
+    return __awaiter(this, arguments, void 0, function (req, routePermissions, rolePermissions, ctx, _b) {
         var token, decodedToken, permissionsArr, validPerms, user, validPerms, hasPermission;
         var secret = _b.secret, algo = _b.algo, getUser = _b.getUser, tokenExtractor = _b.tokenExtractor, checkPermissions = _b.checkPermissions, useDynamicRoles = _b.useDynamicRoles;
         return __generator(this, function (_c) {
@@ -122,7 +122,7 @@ function authenticateRequest(req_1, routePermissions_1, rolePermissions_1, _a) {
                             return [2 /*return*/, false];
                         }
                     }
-                    return [4 /*yield*/, getUser(decodedToken, req)];
+                    return [4 /*yield*/, getUser(decodedToken, req, ctx)];
                 case 1:
                     user = _c.sent();
                     if (!user) {
@@ -170,7 +170,7 @@ function getTokenFromReq(req) {
 }
 function createToken(payload_1, _a, roles_1) {
     return __awaiter(this, arguments, void 0, function (payload, _b, roles) {
-        var resolvedTTL, effectiveTTL;
+        var resolvedTTL, effectiveTTL, iat;
         var _c;
         var secret = _b.secret, algo = _b.algo, tokenTTL = _b.tokenTTL, resolveTokenTTL = _b.resolveTokenTTL;
         return __generator(this, function (_d) {
@@ -179,7 +179,8 @@ function createToken(payload_1, _a, roles_1) {
             }
             resolvedTTL = resolveTokenTTL === null || resolveTokenTTL === void 0 ? void 0 : resolveTokenTTL(roles, payload);
             effectiveTTL = (_c = resolvedTTL !== null && resolvedTTL !== void 0 ? resolvedTTL : tokenTTL) !== null && _c !== void 0 ? _c : 1000 * 60 * 60 * 24 * 365 * 100;
-            return [2 /*return*/, jwt_simple_1.default.encode(__assign({ exp: _calculateExpiration(effectiveTTL) }, payload), secret, algo)];
+            iat = Math.floor(Date.now() / 1000);
+            return [2 /*return*/, jwt_simple_1.default.encode(__assign({ iat: iat, exp: _calculateExpiration(effectiveTTL) }, payload), secret, algo)];
         });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/jwt-auth-plugin",
-  "version": "2.0.0-alpha.95",
+  "version": "2.0.0-alpha.97",
   "description": "Flink plugin for JWT auth",
   "author": "joel@frost.se",
   "license": "MIT",
@@ -19,10 +19,10 @@
     "@types/node": "22.13.10",
     "ts-node": "^10.9.2",
     "tsc-watch": "^4.2.9",
-    "@flink-app/flink": "2.0.0-alpha.95"
+    "@flink-app/flink": "2.0.0-alpha.97"
   },
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.95"
+    "@flink-app/flink": ">=2.0.0-alpha.97"
   },
   "gitHead": "4243e3b3cd6d4e1ca001a61baa8436bf2bbe4113",
   "scripts": {

package/src/FlinkJwtAuthPlugin.ts

@@ -48,7 +48,15 @@ export type TokenTTLResolver = (roles: string[], payload: any) => number | undef
 export interface JwtAuthPluginOptions {
     secret: string;
     algo?: jwtSimple.TAlgorithm;
-    getUser: (tokenData: any, req: FlinkRequest) => Promise<FlinkAuthUser | null | undefined>;
+    /**
+     * @param ctx The host application's context, supplied by Flink core on
+     * each authenticated request. Lets the callback access repos/services
+     * that don't exist when the plugin is constructed (e.g. before
+     * `FlinkApp.start()` resolves) without forcing the consumer to keep a
+     * module-level mutable reference. Undefined only when invoked outside
+     * the normal request pipeline (e.g. unit tests).
+     */
+    getUser: (tokenData: any, req: FlinkRequest, ctx?: any) => Promise<FlinkAuthUser | null | undefined>;
     passwordPolicy?: RegExp;
     tokenTTL?: number;
     rolePermissions: {
@@ -150,8 +158,8 @@ export function jwtAuthPlugin({
     resolveTokenTTL,
 }: JwtAuthPluginOptions): JwtAuthPlugin {
     return {
-        authenticateRequest: async (req, permissions) =>
-            authenticateRequest(req, permissions, rolePermissions, {
+        authenticateRequest: async (req, permissions, ctx) =>
+            authenticateRequest(req, permissions, rolePermissions, ctx, {
                 algo,
                 secret,
                 getUser,
@@ -169,6 +177,7 @@ async function authenticateRequest(
     req: FlinkRequest,
     routePermissions: string | string[],
     rolePermissions: { [x: string]: string[] },
+    ctx: any,
     { secret, algo, getUser, tokenExtractor, checkPermissions, useDynamicRoles }: Pick<
         JwtAuthPluginOptions,
         "algo" | "secret" | "getUser" | "tokenExtractor" | "checkPermissions" | "useDynamicRoles"
@@ -212,7 +221,7 @@ async function authenticateRequest(
                 }
             }
 
-            const user = await getUser(decodedToken, req);
+            const user = await getUser(decodedToken, req, ctx);
 
             if (!user) {
                 log.debug("[JWT AUTH PLUGIN] User not returned from getUser callback");
@@ -274,8 +283,9 @@ async function createToken(
 
     const resolvedTTL = resolveTokenTTL?.(roles, payload);
     const effectiveTTL = resolvedTTL ?? tokenTTL ?? 1000 * 60 * 60 * 24 * 365 * 100;
+    const iat = Math.floor(Date.now() / 1000);
 
-    return jwtSimple.encode({ exp: _calculateExpiration(effectiveTTL), ...payload }, secret, algo);
+    return jwtSimple.encode({ iat, exp: _calculateExpiration(effectiveTTL), ...payload }, secret, algo);
 }
 
 function _calculateExpiration(expiresInMs: number) {