@maximemrf/adonisjs-jwt 0.1.0 → 0.2.1

package/README.md

@@ -26,6 +26,8 @@ import { defineConfig } from '@adonisjs/auth'
 import { InferAuthEvents, Authenticators } from '@adonisjs/auth/types'
 import { sessionGuard, sessionUserProvider } from '@adonisjs/auth/session'
 import { jwtGuard } from '@maximemrf/adonisjs-jwt/jwt_config'
+import { JwtGuardUser } from '@maximemrf/adonisjs-jwt/types'
+import User from '#models/user'
 
 const authConfig = defineConfig({
   // define the default authenticator to jwt
@@ -46,6 +48,11 @@ const authConfig = defineConfig({
       provider: sessionUserProvider({
         model: () => import('#models/user'),
       }),
+      // content is a function that takes the user and returns the content of the token, it can be optional, by default it returns only the user id
+      content: (user: JwtGuardUser<User>) => ({
+        id: user.getId(),
+        email: user.getOriginal().email,
+      }),
     }),
   },
 })
@@ -93,3 +100,7 @@ router.get('/', async ({ auth }) => {
 })
 .use(middleware.auth({ guards: ['jwt'] }))
 ```
+
+## Security
+
+We use natively the AdonisJS application key to sign the token, so you don't have to worry about it and [avoid this](https://trufflesecurity.com/blog/stop-recommending-jwts).

package/build/src/define_config.d.ts

@@ -1,8 +1,10 @@
 import { GuardConfigProvider } from '@adonisjs/auth/types';
 import type { HttpContext } from '@adonisjs/core/http';
-import { JwtGuard, JwtUserProviderContract } from './jwt.js';
+import { JwtGuardUser, JwtUserProviderContract } from './types.js';
+import { JwtGuard } from './jwt.js';
 export declare function jwtGuard<UserProvider extends JwtUserProviderContract<unknown>>(config: {
     provider: UserProvider;
-    tokenExpiresIn: number | string;
+    tokenExpiresIn?: number | string;
     useCookies?: boolean;
+    content: <T>(user: JwtGuardUser<T>) => Record<string, any>;
 }): GuardConfigProvider<(ctx: HttpContext) => JwtGuard<UserProvider>>;

package/build/src/define_config.js

@@ -7,6 +7,7 @@ export function jwtGuard(config) {
                 secret: appKey,
                 expiresIn: config.tokenExpiresIn,
                 useCookies: config.useCookies,
+                content: config.content,
             };
             return (ctx) => new JwtGuard(ctx, config.provider, options);
         },

package/build/src/jwt.d.ts

@@ -1,48 +1,10 @@
 import { symbols } from '@adonisjs/auth';
 import { AuthClientResponse, GuardContract } from '@adonisjs/auth/types';
 import type { HttpContext } from '@adonisjs/core/http';
-/**
- * The bridge between the User provider and the
- * Guard
- */
-export type JwtGuardUser<RealUser> = {
-    /**
-     * Returns the unique ID of the user
-     */
-    getId(): string | number | BigInt;
-    /**
-     * Returns the original user object
-     */
-    getOriginal(): RealUser;
-};
-/**
- * The interface for the UserProvider accepted by the
- * JWT guard.
- */
-export interface JwtUserProviderContract<RealUser> {
-    /**
-     * A property the guard implementation can use to infer
-     * the data type of the actual user (aka RealUser)
-     */
-    [symbols.PROVIDER_REAL_USER]: RealUser;
-    /**
-     * Create a user object that acts as an adapter between
-     * the guard and real user value.
-     */
-    createUserForGuard(user: RealUser): Promise<JwtGuardUser<RealUser>>;
-    /**
-     * Find a user by their id.
-     */
-    findById(identifier: string | number | BigInt): Promise<JwtGuardUser<RealUser> | null>;
-}
-export type JwtGuardOptions = {
-    secret: string;
-    expiresIn?: number | string;
-    useCookies?: boolean;
-};
+import { JwtUserProviderContract, JwtGuardOptions } from './types.js';
 export declare class JwtGuard<UserProvider extends JwtUserProviderContract<unknown>> implements GuardContract<UserProvider[typeof symbols.PROVIDER_REAL_USER]> {
     #private;
-    constructor(ctx: HttpContext, userProvider: UserProvider, option: JwtGuardOptions);
+    constructor(ctx: HttpContext, userProvider: UserProvider, option: JwtGuardOptions<UserProvider[typeof symbols.PROVIDER_REAL_USER]>);
     /**
      * A list of events and their types emitted by
      * the guard.

package/build/src/jwt.js

@@ -8,6 +8,8 @@ export class JwtGuard {
         this.#ctx = ctx;
         this.#userProvider = userProvider;
         this.#options = option;
+        if (!this.#options.content)
+            this.#options.content = (user) => ({ userId: user.getId() });
     }
     /**
      * A unique name for the guard driver
@@ -32,7 +34,7 @@ export class JwtGuard {
      */
     async generate(user) {
         const providerUser = await this.#userProvider.createUserForGuard(user);
-        const token = jwt.sign({ userId: providerUser.getId() }, this.#options.secret, this.#options.expiresIn
+        const token = jwt.sign(this.#options.content(providerUser), this.#options.secret, this.#options.expiresIn
             ? {
                 expiresIn: this.#options.expiresIn,
             }
@@ -68,9 +70,9 @@ export class JwtGuard {
          * If cookies are enabled, then read the token from the cookies
          */
         if (cookieHeader) {
-            token = this.#ctx.request.cookie('token')
-                ? this.#ctx.request.cookie('token')
-                : (this.#ctx.request.request.headers.cookie.match(/token=(.*?)(;|$)/) || [])[1];
+            token =
+                this.#ctx.request.cookie('token') ??
+                    (this.#ctx.request.request.headers.cookie.match(/token=(.*?)(;|$)/) || [])[1];
         }
         /**
          * If token is missing on cookies, then try to read it from the header authorization

package/build/src/types.d.ts

@@ -0,0 +1,41 @@
+import { symbols } from '@adonisjs/auth';
+/**
+ * The bridge between the User provider and the
+ * Guard
+ */
+export type JwtGuardUser<RealUser> = {
+    /**
+     * Returns the unique ID of the user
+     */
+    getId(): string | number | BigInt;
+    /**
+     * Returns the original user object
+     */
+    getOriginal(): RealUser;
+};
+/**
+ * The interface for the UserProvider accepted by the
+ * JWT guard.
+ */
+export interface JwtUserProviderContract<RealUser> {
+    /**
+     * A property the guard implementation can use to infer
+     * the data type of the actual user (aka RealUser)
+     */
+    [symbols.PROVIDER_REAL_USER]: RealUser;
+    /**
+     * Create a user object that acts as an adapter between
+     * the guard and real user value.
+     */
+    createUserForGuard(user: RealUser): Promise<JwtGuardUser<RealUser>>;
+    /**
+     * Find a user by their id.
+     */
+    findById(identifier: string | number | BigInt): Promise<JwtGuardUser<RealUser> | null>;
+}
+export type JwtGuardOptions<RealUser extends any = unknown> = {
+    secret: string;
+    expiresIn?: number | string;
+    useCookies?: boolean;
+    content?: (user: JwtGuardUser<RealUser>) => Record<string, any>;
+};

package/build/src/types.js

@@ -0,0 +1 @@
+import { symbols } from '@adonisjs/auth';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
-  "description": "",
-  "version": "0.1.0",
+  "description": "Adonisjs v6 package for authentication with jwt token",
+  "version": "0.2.1",
   "engines": {
     "node": ">=20.6.0"
   },
@@ -33,9 +33,6 @@
     "version": "npm run build",
     "prepublishOnly": "npm run build"
   },
-  "keywords": [],
-  "author": "",
-  "license": "MIT",
   "devDependencies": {
     "@adonisjs/assembler": "^7.2.3",
     "@adonisjs/auth": "^9.1.1",
@@ -59,9 +56,25 @@
     "ts-node": "^10.9.2",
     "typescript": "^5.4.2"
   },
+  "dependencies": {
+    "@types/jsonwebtoken": "^9.0.6",
+    "jsonwebtoken": "^9.0.2"
+  },
   "peerDependencies": {
     "@adonisjs/core": "^6.2.0"
   },
+  "author": "MaximeMRF",
+  "license": "MIT",
+  "keywords": [
+    "adonisjs",
+    "adonis",
+    "jwt",
+    "authentication"
+  ],
+  "eslintConfig": {
+    "extends": "@adonisjs/eslint-config/package"
+  },
+  "prettier": "@adonisjs/prettier-config",
   "publishConfig": {
     "access": "public",
     "tag": "latest"
@@ -80,13 +93,5 @@
     "exclude": [
       "tests/**"
     ]
-  },
-  "eslintConfig": {
-    "extends": "@adonisjs/eslint-config/package"
-  },
-  "prettier": "@adonisjs/prettier-config",
-  "dependencies": {
-    "@types/jsonwebtoken": "^9.0.6",
-    "jsonwebtoken": "^9.0.2"
   }
 }

package/build/stubs/main.d.ts

@@ -1,5 +0,0 @@
-/**
- * Path to the root directory where the stubs are stored. We use
- * this path within commands and the configure hook
- */
-export declare const stubsRoot: string;

package/build/stubs/main.js

@@ -1,7 +0,0 @@
-import { dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-/**
- * Path to the root directory where the stubs are stored. We use
- * this path within commands and the configure hook
- */
-export const stubsRoot = dirname(fileURLToPath(import.meta.url));