@jmlq/auth-plugin-jose 0.0.1-alpha.8 → 0.0.1-alpha.9

package/dist/infrastructure/services/internal/index.d.ts

@@ -2,3 +2,4 @@ export * from "./normalize-key-material";
 export * from "./jwt-expiration-reader";
 export * from "./get-alg-from-key-material";
 export * from "./build-jose-ctx";
+export * from "./strip-sensitive-custom-claims";

package/dist/infrastructure/services/internal/index.js

@@ -18,3 +18,4 @@ __exportStar(require("./normalize-key-material"), exports);
 __exportStar(require("./jwt-expiration-reader"), exports);
 __exportStar(require("./get-alg-from-key-material"), exports);
 __exportStar(require("./build-jose-ctx"), exports);
+__exportStar(require("./strip-sensitive-custom-claims"), exports);

package/dist/infrastructure/services/internal/strip-sensitive-custom-claims.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Elimina claims sensibles que NO deben viajar en JWT.
+ * - permissions: deben resolverse en BDD en cada request.
+ */
+export declare function stripSensitiveCustomClaims(input: Record<string, unknown>): Record<string, unknown>;

package/dist/infrastructure/services/internal/strip-sensitive-custom-claims.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripSensitiveCustomClaims = stripSensitiveCustomClaims;
+/**
+ * Elimina claims sensibles que NO deben viajar en JWT.
+ * - permissions: deben resolverse en BDD en cada request.
+ */
+function stripSensitiveCustomClaims(input) {
+    const out = {};
+    for (const [k, v] of Object.entries(input)) {
+        if (k === "permissions")
+            continue;
+        out[k] = v;
+    }
+    return out;
+}

package/dist/infrastructure/services/jose-token.service.js

@@ -134,12 +134,13 @@ class JoseTokenService {
                 operation,
             });
             // 2) Claims estándar
-            const roles = props.user.roles ?? [];
-            const customClaims = (0, auth_1.readCustomClaims)(props.customClaims) ?? {};
-            // 3) Session Id (sid) debe ser un string válido.
+            // - NO emitimos `roles` en el JWT.
+            // - Mantenemos customClaims, pero filtramos `permissions`.
+            const customClaimsInput = (0, auth_1.readCustomClaims)(props.customClaims) ?? {};
+            const customClaims = (0, internal_2.stripSensitiveCustomClaims)(customClaimsInput);
+            // 3) Session Id (sid)
             const sid = (0, auth_1.readSessionId)(props.sessionId);
             if (!sid) {
-                // Nota: aquí usamos createAuthError para mantener consistencia del core.
                 throw this.createAuthError({
                     code: "JWT_PAYLOAD_INVALID",
                     message: "sessionId is required",
@@ -148,7 +149,11 @@ class JoseTokenService {
             }
             // 4) Firmar
             const keys = await this.getNormalizedKeys();
-            const jwt = new jose_1.SignJWT({ roles, customClaims, sid })
+            const body = { sid };
+            if (Object.keys(customClaims).length > 0) {
+                body.customClaims = customClaims;
+            }
+            const jwt = new jose_1.SignJWT(body)
                 .setProtectedHeader({ alg: keys.alg })
                 .setSubject(props.user.id)
                 .setJti((0, auth_1.createJwtId)())

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jmlq/auth-plugin-jose",
   "description": "Infrastructure plugin that integrates the jose library with @jmlq/auth, providing JWT token generation and verification following Clean Architecture principles.",
-  "version": "0.0.1-alpha.8",
+  "version": "0.0.1-alpha.9",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
@@ -29,7 +29,7 @@
   "author": "MLahuasi",
   "license": "MIT",
   "dependencies": {
-    "@jmlq/auth": "^0.0.1-alpha.28",
+    "@jmlq/auth": "^0.0.1-alpha.30",
     "jose": "^6.1.3"
   },
   "devDependencies": {