@maximemrf/adonisjs-jwt 0.0.20 → 0.2.0

package/README.md

@@ -26,6 +26,7 @@ import { defineConfig } from '@adonisjs/auth'
 import { InferAuthEvents, Authenticators } from '@adonisjs/auth/types'
 import { sessionGuard, sessionUserProvider } from '@adonisjs/auth/session'
 import { jwtGuard } from '@maximemrf/adonisjs-jwt/jwt_config'
+import { JwtGuardUser } from '@maximemrf/adonisjs-jwt/types'
 
 const authConfig = defineConfig({
   // define the default authenticator to jwt
@@ -46,6 +47,11 @@ const authConfig = defineConfig({
       provider: sessionUserProvider({
         model: () => import('#models/user'),
       }),
+      // content is a function that takes the user and returns the content of the token, it can be optional, by default it returns only the user id
+      content: (user: JwtGuardUser<User>) => ({
+        id: user.getId(),
+        email: user.getOriginal().email,
+      }),
     }),
   },
 })
@@ -93,3 +99,7 @@ router.get('/', async ({ auth }) => {
 })
 .use(middleware.auth({ guards: ['jwt'] }))
 ```
+
+## Security
+
+We use natively the AdonisJS application key to sign the token, so you don't have to worry about it and [avoid this](https://trufflesecurity.com/blog/stop-recommending-jwts).

package/build/src/define_config.d.ts

@@ -1,8 +1,9 @@
 import { GuardConfigProvider } from '@adonisjs/auth/types';
 import type { HttpContext } from '@adonisjs/core/http';
-import { JwtGuard, JwtUserProviderContract } from './jwt.js';
+import { JwtGuard, JwtGuardUser, JwtUserProviderContract } from './jwt.js';
 export declare function jwtGuard<UserProvider extends JwtUserProviderContract<unknown>>(config: {
     provider: UserProvider;
-    tokenExpiresIn: number | string;
+    tokenExpiresIn?: number | string;
     useCookies?: boolean;
+    content: <T>(user: JwtGuardUser<T>) => Record<string, any>;
 }): GuardConfigProvider<(ctx: HttpContext) => JwtGuard<UserProvider>>;

package/build/src/define_config.js

@@ -7,6 +7,7 @@ export function jwtGuard(config) {
                 secret: appKey,
                 expiresIn: config.tokenExpiresIn,
                 useCookies: config.useCookies,
+                content: config.content,
             };
             return (ctx) => new JwtGuard(ctx, config.provider, options);
         },

package/build/src/jwt.d.ts

@@ -35,14 +35,15 @@ export interface JwtUserProviderContract<RealUser> {
      */
     findById(identifier: string | number | BigInt): Promise<JwtGuardUser<RealUser> | null>;
 }
-export type JwtGuardOptions = {
+export type JwtGuardOptions<RealUser extends any = unknown> = {
     secret: string;
     expiresIn?: number | string;
     useCookies?: boolean;
+    content?: (user: JwtGuardUser<RealUser>) => Record<string, any>;
 };
 export declare class JwtGuard<UserProvider extends JwtUserProviderContract<unknown>> implements GuardContract<UserProvider[typeof symbols.PROVIDER_REAL_USER]> {
     #private;
-    constructor(ctx: HttpContext, userProvider: UserProvider, option: JwtGuardOptions);
+    constructor(ctx: HttpContext, userProvider: UserProvider, option: JwtGuardOptions<UserProvider[typeof symbols.PROVIDER_REAL_USER]>);
     /**
      * A list of events and their types emitted by
      * the guard.

package/build/src/jwt.js

@@ -8,6 +8,8 @@ export class JwtGuard {
         this.#ctx = ctx;
         this.#userProvider = userProvider;
         this.#options = option;
+        if (!this.#options.content)
+            this.#options.content = (user) => ({ userId: user.getId() });
     }
     /**
      * A unique name for the guard driver
@@ -32,7 +34,7 @@ export class JwtGuard {
      */
     async generate(user) {
         const providerUser = await this.#userProvider.createUserForGuard(user);
-        const token = jwt.sign({ userId: providerUser.getId() }, this.#options.secret, this.#options.expiresIn
+        const token = jwt.sign(this.#options.content(providerUser), this.#options.secret, this.#options.expiresIn
             ? {
                 expiresIn: this.#options.expiresIn,
             }
@@ -68,9 +70,9 @@ export class JwtGuard {
          * If cookies are enabled, then read the token from the cookies
          */
         if (cookieHeader) {
-            token = this.#ctx.request.cookie('token')
-                ? this.#ctx.request.cookie('token')
-                : (this.#ctx.request.request.headers.cookie.match(/token=(.*?)(;|$)/) || [])[1];
+            token =
+                this.#ctx.request.cookie('token') ??
+                    (this.#ctx.request.request.headers.cookie.match(/token=(.*?)(;|$)/) || [])[1];
         }
         /**
          * If token is missing on cookies, then try to read it from the header authorization

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
-  "description": "",
-  "version": "0.0.20",
+  "description": "Adonisjs v6 package for authentication with jwt token",
+  "version": "0.2.0",
   "engines": {
     "node": ">=20.6.0"
   },
@@ -33,9 +33,6 @@
     "version": "npm run build",
     "prepublishOnly": "npm run build"
   },
-  "keywords": [],
-  "author": "",
-  "license": "MIT",
   "devDependencies": {
     "@adonisjs/assembler": "^7.2.3",
     "@adonisjs/auth": "^9.1.1",
@@ -62,6 +59,14 @@
   "peerDependencies": {
     "@adonisjs/core": "^6.2.0"
   },
+  "author": "MaximeMRF",
+  "license": "MIT",
+  "keywords": [
+    "adonisjs",
+    "adonis",
+    "jwt",
+    "authentication"
+  ],
   "publishConfig": {
     "access": "public",
     "tag": "latest"

package/build/stubs/main.d.ts

@@ -1,5 +0,0 @@
-/**
- * Path to the root directory where the stubs are stored. We use
- * this path within commands and the configure hook
- */
-export declare const stubsRoot: string;

package/build/stubs/main.js

@@ -1,7 +0,0 @@
-import { dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-/**
- * Path to the root directory where the stubs are stored. We use
- * this path within commands and the configure hook
- */
-export const stubsRoot = dirname(fileURLToPath(import.meta.url));