@geekmidas/auth 0.0.1

package/src/__tests__/tokenManager.spec.ts

@@ -0,0 +1,259 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { TokenManager, type TokenPayload } from '../tokenManager.ts';
+
+describe('TokenManager', () => {
+  let tokenManager: TokenManager;
+  let userPayload: TokenPayload;
+
+  beforeEach(() => {
+    tokenManager = new TokenManager({
+      accessTokenSecret: 'test-access-secret',
+      refreshTokenSecret: 'test-refresh-secret',
+      accessTokenExpiresIn: '15m',
+      refreshTokenExpiresIn: '7d',
+    });
+
+    userPayload = {
+      userId: 'user123',
+      email: 'test@example.com',
+      role: 'admin',
+    };
+  });
+
+  describe('token generation and verification workflow', () => {
+    it('should generate and verify complete token pair', () => {
+      const { accessToken, refreshToken } =
+        tokenManager.generateTokenPair(userPayload);
+
+      const accessDecoded = tokenManager.verifyAccessToken(accessToken);
+      const refreshDecoded = tokenManager.verifyRefreshToken(refreshToken);
+
+      expect(accessDecoded.userId).toBe(userPayload.userId);
+      expect(accessDecoded.email).toBe(userPayload.email);
+      expect(accessDecoded.role).toBe(userPayload.role);
+      expect(refreshDecoded.userId).toBe(userPayload.userId);
+      expect(refreshDecoded.email).toBe(userPayload.email);
+      expect(refreshDecoded.role).toBe(userPayload.role);
+    });
+
+    it('should handle complete token refresh workflow', () => {
+      const { refreshToken } = tokenManager.generateTokenPair(userPayload);
+
+      const newAccessToken = tokenManager.refreshAccessToken(refreshToken);
+      const newDecoded = tokenManager.verifyAccessToken(newAccessToken);
+
+      expect(newDecoded.userId).toBe(userPayload.userId);
+      expect(newDecoded.email).toBe(userPayload.email);
+      expect(newDecoded.role).toBe(userPayload.role);
+      expect(newDecoded.iat).toBeDefined();
+      expect(newDecoded.exp).toBeDefined();
+    });
+
+    it('should maintain payload integrity through refresh cycle', () => {
+      const originalPayload = {
+        userId: 'user456',
+        email: 'user@example.com',
+        permissions: ['read', 'write'],
+        metadata: { department: 'engineering' },
+      };
+
+      const { refreshToken } = tokenManager.generateTokenPair(originalPayload);
+      const newAccessToken = tokenManager.refreshAccessToken(refreshToken);
+      const decoded = tokenManager.verifyAccessToken(newAccessToken);
+
+      expect(decoded.userId).toBe(originalPayload.userId);
+      expect(decoded.email).toBe(originalPayload.email);
+      expect(decoded.permissions).toEqual(originalPayload.permissions);
+      expect(decoded.metadata).toEqual(originalPayload.metadata);
+    });
+  });
+
+  describe('token expiration handling', () => {
+    it('should correctly identify token expiration status', () => {
+      const { accessToken } = tokenManager.generateTokenPair(userPayload);
+
+      expect(tokenManager.isTokenExpired(accessToken)).toBe(false);
+
+      const expiration = tokenManager.getTokenExpiration(accessToken);
+      expect(expiration).toBeInstanceOf(Date);
+      expect(expiration!.getTime()).toBeGreaterThan(Date.now());
+    });
+
+    it('should handle expired tokens correctly', async () => {
+      vi.useFakeTimers();
+      const shortLivedManager = new TokenManager({
+        accessTokenSecret: 'test-access-secret',
+        refreshTokenSecret: 'test-refresh-secret',
+        accessTokenExpiresIn: '10m',
+      });
+
+      const { accessToken } = shortLivedManager.generateTokenPair(userPayload);
+
+      vi.advanceTimersByTime(1000 * 60 * 16); // Fast-forward time to expire access token
+
+      expect(tokenManager.isTokenExpired(accessToken)).toBe(true);
+
+      vi.useRealTimers();
+    });
+
+    it('should decode tokens without verification', () => {
+      const { accessToken } = tokenManager.generateTokenPair(userPayload);
+
+      const decoded = tokenManager.decodeToken(accessToken);
+
+      expect(decoded).not.toBeNull();
+      expect(decoded!.userId).toBe(userPayload.userId);
+      expect(decoded!.email).toBe(userPayload.email);
+    });
+  });
+
+  describe('security validation', () => {
+    it('should reject tokens with invalid signatures', () => {
+      const wrongSecretManager = new TokenManager({
+        accessTokenSecret: 'wrong-secret',
+        refreshTokenSecret: 'test-refresh-secret',
+      });
+
+      const { accessToken } = wrongSecretManager.generateTokenPair(userPayload);
+
+      expect(() => {
+        tokenManager.verifyAccessToken(accessToken);
+      }).toThrow('Invalid access token');
+    });
+
+    it('should reject malformed tokens', () => {
+      expect(() => {
+        tokenManager.verifyAccessToken('invalid-token');
+      }).toThrow('Invalid access token');
+
+      expect(() => {
+        tokenManager.verifyRefreshToken('invalid-token');
+      }).toThrow('Invalid refresh token');
+
+      expect(() => {
+        tokenManager.refreshAccessToken('invalid-token');
+      }).toThrow('Invalid refresh token');
+    });
+
+    it('should handle cross-secret validation correctly', () => {
+      const { accessToken, refreshToken } =
+        tokenManager.generateTokenPair(userPayload);
+
+      // Access token should not verify with refresh secret
+      expect(() => {
+        tokenManager.verifyRefreshToken(accessToken);
+      }).toThrow('Invalid refresh token');
+
+      // Refresh token should not verify with access secret
+      expect(() => {
+        tokenManager.verifyAccessToken(refreshToken);
+      }).toThrow('Invalid access token');
+    });
+  });
+
+  describe('configuration flexibility', () => {
+    it('should support custom expiration times', () => {
+      const customManager = new TokenManager({
+        accessTokenSecret: 'test-access-secret',
+        refreshTokenSecret: 'test-refresh-secret',
+        accessTokenExpiresIn: '1h',
+        refreshTokenExpiresIn: '30d',
+      });
+
+      const { accessToken, refreshToken } =
+        customManager.generateTokenPair(userPayload);
+
+      const accessDecoded = customManager.verifyAccessToken(accessToken);
+      const refreshDecoded = customManager.verifyRefreshToken(refreshToken);
+
+      const accessExpTime = (accessDecoded.exp - accessDecoded.iat) * 1000;
+      const refreshExpTime = (refreshDecoded.exp - refreshDecoded.iat) * 1000;
+
+      // Access token should be ~1 hour
+      expect(accessExpTime).toBeGreaterThan(55 * 60 * 1000);
+      expect(accessExpTime).toBeLessThan(65 * 60 * 1000);
+
+      // Refresh token should be ~30 days
+      expect(refreshExpTime).toBeGreaterThan(29 * 24 * 60 * 60 * 1000);
+      expect(refreshExpTime).toBeLessThan(31 * 24 * 60 * 60 * 1000);
+    });
+
+    it('should use default expiration times', () => {
+      const defaultManager = new TokenManager({
+        accessTokenSecret: 'test-access-secret',
+        refreshTokenSecret: 'test-refresh-secret',
+      });
+
+      const { accessToken, refreshToken } =
+        defaultManager.generateTokenPair(userPayload);
+
+      const accessDecoded = defaultManager.verifyAccessToken(accessToken);
+      const refreshDecoded = defaultManager.verifyRefreshToken(refreshToken);
+
+      const accessExpTime = (accessDecoded.exp - accessDecoded.iat) * 1000;
+      const refreshExpTime = (refreshDecoded.exp - refreshDecoded.iat) * 1000;
+
+      // Default access token should be ~15 minutes
+      expect(accessExpTime).toBeGreaterThan(14 * 60 * 1000);
+      expect(accessExpTime).toBeLessThan(16 * 60 * 1000);
+
+      // Default refresh token should be ~7 days
+      expect(refreshExpTime).toBeGreaterThan(6 * 24 * 60 * 60 * 1000);
+      expect(refreshExpTime).toBeLessThan(8 * 24 * 60 * 60 * 1000);
+    });
+  });
+
+  describe('edge cases and error handling', () => {
+    it('should handle empty payload gracefully', () => {
+      const emptyPayload = { userId: '' };
+
+      const { accessToken, refreshToken } =
+        tokenManager.generateTokenPair(emptyPayload);
+
+      const accessDecoded = tokenManager.verifyAccessToken(accessToken);
+      const refreshDecoded = tokenManager.verifyRefreshToken(refreshToken);
+
+      expect(accessDecoded.userId).toBe('');
+      expect(refreshDecoded.userId).toBe('');
+    });
+
+    it('should handle large payloads correctly', () => {
+      const largePayload = {
+        userId: 'user123',
+        permissions: Array.from({ length: 100 }, (_, i) => `permission_${i}`),
+        metadata: {
+          department: 'engineering',
+          team: 'platform',
+          projects: Array.from({ length: 50 }, (_, i) => `project_${i}`),
+        },
+      };
+
+      const { accessToken, refreshToken } =
+        tokenManager.generateTokenPair(largePayload);
+
+      const accessDecoded = tokenManager.verifyAccessToken(accessToken);
+      const refreshDecoded = tokenManager.verifyRefreshToken(refreshToken);
+
+      expect(accessDecoded.userId).toBe(largePayload.userId);
+      expect(accessDecoded.permissions).toEqual(largePayload.permissions);
+      expect(accessDecoded.metadata).toEqual(largePayload.metadata);
+      expect(refreshDecoded.userId).toBe(largePayload.userId);
+      expect(refreshDecoded.permissions).toEqual(largePayload.permissions);
+      expect(refreshDecoded.metadata).toEqual(largePayload.metadata);
+    });
+
+    it('should return null for completely invalid tokens', () => {
+      expect(tokenManager.decodeToken('')).toBeNull();
+      expect(tokenManager.decodeToken('not.a.token')).toBeNull();
+      expect(tokenManager.decodeToken('invalid-token')).toBeNull();
+
+      expect(tokenManager.getTokenExpiration('')).toBeNull();
+      expect(tokenManager.getTokenExpiration('not.a.token')).toBeNull();
+      expect(tokenManager.getTokenExpiration('invalid-token')).toBeNull();
+
+      expect(tokenManager.isTokenExpired('')).toBe(true);
+      expect(tokenManager.isTokenExpired('not.a.token')).toBe(true);
+      expect(tokenManager.isTokenExpired('invalid-token')).toBe(true);
+    });
+  });
+});

package/src/cacheTokenStorage.ts

@@ -0,0 +1,43 @@
+import type { Cache } from '@geekmidas/cache';
+import type { TokenStorage } from './client.js';
+
+export class CacheTokenStorage implements TokenStorage {
+  private cache: Cache<string>;
+  private accessTokenKey: string;
+  private refreshTokenKey: string;
+
+  constructor(
+    cache: Cache<string>,
+    accessTokenKey: string = 'access_token',
+    refreshTokenKey: string = 'refresh_token',
+  ) {
+    this.cache = cache;
+    this.accessTokenKey = accessTokenKey;
+    this.refreshTokenKey = refreshTokenKey;
+  }
+
+  async getAccessToken(): Promise<string | null> {
+    const token = await this.cache.get(this.accessTokenKey);
+    return token || null;
+  }
+
+  async setAccessToken(token: string, ttl?: number): Promise<void> {
+    await this.cache.set(this.accessTokenKey, token, ttl);
+  }
+
+  async getRefreshToken(): Promise<string | null> {
+    const token = await this.cache.get(this.refreshTokenKey);
+    return token || null;
+  }
+
+  async setRefreshToken(token: string, ttl?: number): Promise<void> {
+    await this.cache.set(this.refreshTokenKey, token, ttl);
+  }
+
+  async clearTokens(): Promise<void> {
+    await Promise.all([
+      this.cache.delete(this.accessTokenKey),
+      this.cache.delete(this.refreshTokenKey),
+    ]);
+  }
+}

package/src/client.ts

@@ -0,0 +1,211 @@
+export interface TokenStorage {
+  getAccessToken(): Promise<string | null> | string | null;
+  setAccessToken(token: string, ttl?: number): Promise<void> | void;
+  getRefreshToken(): Promise<string | null> | string | null;
+  setRefreshToken(token: string, ttl?: number): Promise<void> | void;
+  clearTokens(): Promise<void> | void;
+}
+
+export class LocalStorageTokenStorage implements TokenStorage {
+  private accessTokenKey: string;
+  private refreshTokenKey: string;
+
+  constructor(
+    accessTokenKey: string = 'access_token',
+    refreshTokenKey: string = 'refresh_token',
+  ) {
+    this.accessTokenKey = accessTokenKey;
+    this.refreshTokenKey = refreshTokenKey;
+  }
+
+  getAccessToken(): string | null {
+    if (typeof window === 'undefined') return null;
+    return localStorage.getItem(this.accessTokenKey);
+  }
+
+  setAccessToken(token: string, ttl?: number): void {
+    if (typeof window === 'undefined') return;
+    localStorage.setItem(this.accessTokenKey, token);
+  }
+
+  getRefreshToken(): string | null {
+    if (typeof window === 'undefined') return null;
+    return localStorage.getItem(this.refreshTokenKey);
+  }
+
+  setRefreshToken(token: string, ttl?: number): void {
+    if (typeof window === 'undefined') return;
+    localStorage.setItem(this.refreshTokenKey, token);
+  }
+
+  clearTokens(): void {
+    if (typeof window === 'undefined') return;
+    localStorage.removeItem(this.accessTokenKey);
+    localStorage.removeItem(this.refreshTokenKey);
+  }
+}
+
+export class MemoryTokenStorage implements TokenStorage {
+  private accessToken: string | null = null;
+  private refreshToken: string | null = null;
+
+  getAccessToken(): string | null {
+    return this.accessToken;
+  }
+
+  setAccessToken(token: string, ttl?: number): void {
+    this.accessToken = token;
+  }
+
+  getRefreshToken(): string | null {
+    return this.refreshToken;
+  }
+
+  setRefreshToken(token: string, ttl?: number): void {
+    this.refreshToken = token;
+  }
+
+  clearTokens(): void {
+    this.accessToken = null;
+    this.refreshToken = null;
+  }
+}
+
+export interface TokenClientOptions {
+  storage?: TokenStorage;
+  refreshEndpoint?: string;
+  onTokenRefresh?: (tokens: {
+    accessToken: string;
+    refreshToken?: string;
+  }) => void;
+  onTokenExpired?: () => void;
+}
+
+export class TokenClient {
+  private storage: TokenStorage;
+  private refreshEndpoint?: string;
+  private onTokenRefresh?: (tokens: {
+    accessToken: string;
+    refreshToken?: string;
+  }) => void;
+  private onTokenExpired?: () => void;
+
+  constructor(options: TokenClientOptions = {}) {
+    this.storage = options.storage || new LocalStorageTokenStorage();
+    this.refreshEndpoint = options.refreshEndpoint;
+    this.onTokenRefresh = options.onTokenRefresh;
+    this.onTokenExpired = options.onTokenExpired;
+  }
+
+  async getAccessToken(): Promise<string | null> {
+    return await this.storage.getAccessToken();
+  }
+
+  async getRefreshToken(): Promise<string | null> {
+    return await this.storage.getRefreshToken();
+  }
+
+  async setTokens(
+    accessToken: string,
+    refreshToken?: string,
+    accessTtl?: number,
+    refreshTtl?: number,
+  ): Promise<void> {
+    await this.storage.setAccessToken(accessToken, accessTtl);
+    if (refreshToken) {
+      await this.storage.setRefreshToken(refreshToken, refreshTtl);
+    }
+  }
+
+  async clearTokens(): Promise<void> {
+    await this.storage.clearTokens();
+  }
+
+  isTokenExpired(token: string): boolean {
+    try {
+      const payload = JSON.parse(atob(token.split('.')[1]));
+      const now = Math.floor(Date.now() / 1000);
+      return payload.exp < now;
+    } catch {
+      return true;
+    }
+  }
+
+  getTokenExpiration(token: string): Date | null {
+    try {
+      const payload = JSON.parse(atob(token.split('.')[1]));
+      return new Date(payload.exp * 1000);
+    } catch {
+      return null;
+    }
+  }
+
+  async refreshTokens(): Promise<boolean> {
+    const refreshToken = await this.getRefreshToken();
+
+    if (!refreshToken || !this.refreshEndpoint) {
+      return false;
+    }
+
+    try {
+      const response = await fetch(this.refreshEndpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ refreshToken }),
+      });
+
+      if (!response.ok) {
+        throw new Error('Failed to refresh token');
+      }
+
+      const data = await response.json();
+      const { accessToken, refreshToken: newRefreshToken } = data;
+
+      await this.setTokens(accessToken, newRefreshToken);
+
+      if (this.onTokenRefresh) {
+        this.onTokenRefresh({ accessToken, refreshToken: newRefreshToken });
+      }
+
+      return true;
+    } catch (error) {
+      await this.clearTokens();
+      if (this.onTokenExpired) {
+        this.onTokenExpired();
+      }
+      return false;
+    }
+  }
+
+  async getValidAccessToken(): Promise<string | null> {
+    const accessToken = await this.getAccessToken();
+
+    if (!accessToken) {
+      return null;
+    }
+
+    if (this.isTokenExpired(accessToken)) {
+      const refreshed = await this.refreshTokens();
+      if (!refreshed) {
+        return null;
+      }
+      return await this.getAccessToken();
+    }
+
+    return accessToken;
+  }
+
+  async createAuthHeaders(): Promise<Record<string, string>> {
+    const token = await this.getAccessToken();
+    return token ? { Authorization: `Bearer ${token}` } : {};
+  }
+
+  async createValidAuthHeaders(): Promise<Record<string, string>> {
+    const token = await this.getValidAccessToken();
+    return token ? { Authorization: `Bearer ${token}` } : {};
+  }
+}
+
+export { CacheTokenStorage } from './cacheTokenStorage.js';

package/src/index.ts

@@ -0,0 +1,3 @@
+export * from './tokenManager.js';
+export * from './client.js';
+export * from './cacheTokenStorage.js';

package/src/server.ts

@@ -0,0 +1,11 @@
+export {
+  TokenManager,
+  type TokenPayload,
+  type TokenPair,
+  type TokenManagerOptions,
+  type DecodedToken,
+} from './tokenManager.js';
+
+export {
+  CacheTokenStorage,
+} from './cacheTokenStorage.js';

package/src/tokenManager.ts

@@ -0,0 +1,104 @@
+import jwt from 'jsonwebtoken';
+import type ms from 'ms';
+
+export interface TokenPayload {
+  userId: string;
+  email?: string;
+  [key: string]: any;
+}
+
+export interface TokenPair {
+  accessToken: string;
+  refreshToken: string;
+}
+
+export interface TokenManagerOptions {
+  accessTokenSecret: string;
+  refreshTokenSecret: string;
+  accessTokenExpiresIn?: ms.StringValue;
+  refreshTokenExpiresIn?: ms.StringValue;
+}
+
+export interface DecodedToken extends TokenPayload {
+  iat: number;
+  exp: number;
+}
+
+export class TokenManager {
+  private accessTokenSecret: string;
+  private refreshTokenSecret: string;
+  private accessTokenExpiresIn: ms.StringValue;
+  private refreshTokenExpiresIn: ms.StringValue;
+
+  constructor(options: TokenManagerOptions) {
+    this.accessTokenSecret = options.accessTokenSecret;
+    this.refreshTokenSecret = options.refreshTokenSecret;
+    this.accessTokenExpiresIn = options.accessTokenExpiresIn || '15m';
+    this.refreshTokenExpiresIn = options.refreshTokenExpiresIn || '7d';
+  }
+
+  generateTokenPair(payload: TokenPayload): TokenPair {
+    const accessToken = jwt.sign(payload, this.accessTokenSecret, {
+      expiresIn: this.accessTokenExpiresIn,
+    });
+
+    const refreshToken = jwt.sign(payload, this.refreshTokenSecret, {
+      expiresIn: this.refreshTokenExpiresIn,
+    });
+
+    return {
+      accessToken,
+      refreshToken,
+    };
+  }
+
+  verifyAccessToken(token: string): DecodedToken {
+    try {
+      return jwt.verify(token, this.accessTokenSecret) as DecodedToken;
+    } catch (error) {
+      throw new Error(`Invalid access token: ${error.message}`);
+    }
+  }
+
+  verifyRefreshToken(token: string): DecodedToken {
+    try {
+      return jwt.verify(token, this.refreshTokenSecret) as DecodedToken;
+    } catch (error) {
+      throw new Error(`Invalid refresh token: ${error.message}`);
+    }
+  }
+
+  refreshAccessToken(refreshToken: string): string {
+    const decoded = this.verifyRefreshToken(refreshToken);
+
+    // Remove JWT specific fields before creating new token
+    const { iat, exp, ...payload } = decoded;
+
+    return jwt.sign(payload, this.accessTokenSecret, {
+      expiresIn: this.accessTokenExpiresIn,
+    });
+  }
+
+  decodeToken(token: string): DecodedToken | null {
+    try {
+      return jwt.decode(token) as DecodedToken;
+    } catch {
+      return null;
+    }
+  }
+
+  isTokenExpired(token: string): boolean {
+    const decoded = this.decodeToken(token);
+    if (!decoded) return true;
+
+    const now = Math.floor(Date.now() / 1000);
+    return decoded.exp < now;
+  }
+
+  getTokenExpiration(token: string): Date | null {
+    const decoded = this.decodeToken(token);
+    if (!decoded) return null;
+
+    return new Date(decoded.exp * 1000);
+  }
+}

package/tsdown.config.ts

@@ -0,0 +1,3 @@
+import { defineConfig } from 'tsdown';
+
+export default defineConfig({});