@maximemrf/adonisjs-jwt 0.6.1 → 0.7.0-alpha.1

package/README.md

@@ -75,6 +75,12 @@ const authConfig = defineConfig({
         tokens: 'refreshTokens',
         model: () => import('#models/user'),
       }),
+      // optionally set the expiry for the refresh token
+      refreshTokenExpiresIn: '7d',
+      // ability to separate cookie usage for refresh token
+      useCookiesForRefreshToken: true,
+      // limit the abilities of the refresh token
+      refreshTokenAbilities: ['refresh_token'],
       // content is a function that takes the user and returns the content of the token, it can be optional, by default it returns only the user id
       content: <T>(user: JwtGuardUser<T>): JwtContent => {
         return {
@@ -125,7 +131,13 @@ export default class extends BaseSchema {
   async up() {
     this.schema.createTable(this.tableName, (table) => {
       table.increments()
-      table.integer('tokenable_id').notNullable().unsigned()
+      table
+        .integer('tokenable_id')
+        .notNullable()
+        .unsigned()
+        .references('id')
+        .inTable('users')
+        .onDelete('CASCADE')
       table.string('type').notNullable()
       table.string('name').nullable()
       table.string('hash', 80).notNullable()
@@ -180,7 +192,9 @@ router.post('login', async ({ request, auth }) => {
   const { email, password } = request.all()
   const user = await User.verifyCredentials(email, password)
 
-  // to generate a token
+  // to generate a token (and refresh token if configured)
+  // this returns { type, token, expiresIn, refreshToken, refreshTokenExpiresIn }
+  // if useCookies is true, it sets cookies on the response instead
   return await auth.use('jwt').generate(user)
 })
 
@@ -196,25 +210,21 @@ router.get('/', async ({ auth }) => {
 })
 .use(middleware.auth({ guards: ['jwt'] }))
 
-// to create a refresh token to a given user
-import User from '#models/user'
-const user  = auth.getUserOrFail()
-const refreshToken = await User.refreshTokens.create(user)
-
 // if you use the refresh token
 router.post('jwt/refresh', async ({ auth }) => {
   // this will authenticate the user using the refresh token
-  // it will delete the old refresh token and generate a new one with the same abilities
-  // You could pass a name for the new token as well
-  const user = await auth.use('jwt').authenticateWithRefreshToken('optional_name')
-  const newRefreshToken = user.currentToken
-  const newToken = await auth.use('jwt').generate(user)
-
-  return response.ok({
-    token: newToken,
-    refreshToken: newRefreshToken,
-    ...user.serialize(),
-  })
+  // it will delete the old refresh token and generate a new one
+  // it accepts an optional refresh token, otherwise it looks in:
+  // 1. request body 'refreshToken'
+  // 2. cookies (if enabled)
+  // 3. Authorization header
+  return await auth.use('jwt').generateWithRefreshToken()
+})
+
+// to logout (revoke refresh token)
+router.post('logout', async ({ auth }) => {
+  await auth.use('jwt').revoke()
+  return { message: 'Logged out' }
 })
 ```
 

package/build/src/define_config.d.ts

@@ -9,7 +9,10 @@ export declare function jwtGuard<UserProvider extends JwtUserProviderContract<un
     refreshTokenUserProvider?: AccessTokensUserProviderContract<unknown>;
     tokenName?: string;
     tokenExpiresIn?: number | StringValue;
+    refreshTokenExpiresIn?: number | StringValue;
     useCookies?: boolean;
+    useCookiesForRefreshToken?: boolean;
+    refreshTokenAbilities?: string[];
     secret?: string;
     content: <T>(user: JwtGuardUser<T>) => Record<string | number, any>;
 }): GuardConfigProvider<(ctx: HttpContext) => JwtGuard<UserProvider>>;

package/build/src/define_config.js

@@ -8,7 +8,10 @@ export function jwtGuard(config) {
                 refreshTokenUserProvider: config.refreshTokenUserProvider,
                 tokenName: config.tokenName,
                 expiresIn: config.tokenExpiresIn,
+                refreshTokenExpiresIn: config.refreshTokenExpiresIn,
                 useCookies: config.useCookies,
+                useCookiesForRefreshToken: config.useCookiesForRefreshToken,
+                refreshTokenAbilities: config.refreshTokenAbilities,
                 content: config.content,
             };
             return (ctx) => new JwtGuard(ctx, config.provider, options);

package/build/src/jwt.d.ts

@@ -1,6 +1,7 @@
 import { symbols } from '@adonisjs/auth';
 import { AuthClientResponse, GuardContract } from '@adonisjs/auth/types';
 import type { HttpContext } from '@adonisjs/core/http';
+import type { StringValue } from 'ms';
 import { JwtUserProviderContract, JwtGuardOptions } from './types.js';
 export declare class JwtGuard<UserProvider extends JwtUserProviderContract<unknown>> implements GuardContract<UserProvider[typeof symbols.PROVIDER_REAL_USER]> {
     #private;
@@ -33,10 +34,12 @@ export declare class JwtGuard<UserProvider extends JwtUserProviderContract<unkno
     /**
      * Generate a JWT token for a given user.
      */
-    generate(user: UserProvider[typeof symbols.PROVIDER_REAL_USER]): Promise<import("@adonisjs/core/http").Response | {
+    generate(user: UserProvider[typeof symbols.PROVIDER_REAL_USER]): Promise<{
         type: string;
         token: string;
-        expiresIn: number | import("ms").StringValue | undefined;
+        expiresIn: number | StringValue | undefined;
+        refreshToken: string | undefined;
+        refreshTokenExpiresIn: number | StringValue | undefined;
     }>;
     /**
      * Authenticate the current HTTP request and return
@@ -46,9 +49,17 @@ export declare class JwtGuard<UserProvider extends JwtUserProviderContract<unkno
     authenticate(): Promise<UserProvider[typeof symbols.PROVIDER_REAL_USER] & {
         currentToken: string;
     }>;
-    authenticateWithRefreshToken(name?: string): Promise<UserProvider[typeof symbols.PROVIDER_REAL_USER] & {
-        currentToken: string;
-    }>;
+    generateWithRefreshToken(refreshToken?: string): Promise<{
+        type: string;
+        token: string;
+        expiresIn: number | StringValue | undefined;
+        refreshToken: string | undefined;
+        refreshTokenExpiresIn: number | StringValue | undefined;
+    } | undefined>;
+    /**
+     * Revoke the refresh token
+     */
+    revoke(refreshToken?: string): Promise<void>;
     /**
      * Same as authenticate, but does not throw an exception
      */

package/build/src/jwt.js

@@ -7,6 +7,7 @@ export class JwtGuard {
     #refreshTokenUserProvider;
     #options;
     #tokenName;
+    #refreshTokenName = 'refreshToken';
     constructor(ctx, userProvider, option) {
         this.#ctx = ctx;
         this.#userProvider = userProvider;
@@ -44,8 +45,22 @@ export class JwtGuard {
                 expiresIn: this.#options.expiresIn,
             }
             : {});
+        let refreshToken;
+        if (this.#refreshTokenUserProvider) {
+            const generatedRefreshToken = await this.#refreshTokenUserProvider.createToken(user, this.#options.refreshTokenAbilities ?? [], this.#options.refreshTokenExpiresIn
+                ? {
+                    expiresIn: this.#options.refreshTokenExpiresIn,
+                }
+                : undefined);
+            refreshToken = generatedRefreshToken.value.release();
+        }
         if (this.#options.useCookies) {
-            return this.#ctx.response.cookie(`${this.#tokenName}`, token, {
+            this.#ctx.response.cookie(`${this.#tokenName}`, token, {
+                httpOnly: true,
+            });
+        }
+        if (this.#options.useCookiesForRefreshToken && refreshToken) {
+            this.#ctx.response.cookie(`${this.#refreshTokenName}`, refreshToken, {
                 httpOnly: true,
             });
         }
@@ -53,6 +68,8 @@ export class JwtGuard {
             type: 'bearer',
             token: token,
             expiresIn: this.#options.expiresIn,
+            refreshToken: refreshToken,
+            refreshTokenExpiresIn: this.#options.refreshTokenExpiresIn,
         };
     }
     /**
@@ -135,40 +152,15 @@ export class JwtGuard {
         this.user.currentToken = token;
         return this.getUserOrFail();
     }
-    async authenticateWithRefreshToken(name) {
-        /**
-         * Avoid re-authentication when it has been done already
-         * for the given request
-         */
-        if (this.authenticationAttempted) {
-            return this.getUserOrFail();
-        }
+    async generateWithRefreshToken(refreshToken) {
         this.authenticationAttempted = true;
-        /**
-         * Ensure the refresh token user provider is defined
-         */
         if (!this.#refreshTokenUserProvider) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });
         }
-        /**
-         * Ensure the auth header exists
-         */
-        const authHeader = this.#ctx.request.header('authorization');
-        if (!authHeader) {
-            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
-                guardDriverName: this.driverName,
-            });
-        }
-        /**
-         * Split the header value and read the token from it
-         */
-        const [, refreshToken] = authHeader.split('Bearer ');
         if (!refreshToken) {
-            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
-                guardDriverName: this.driverName,
-            });
+            refreshToken = await this.#findRefreshToken();
         }
         const accessToken = await this.#refreshTokenUserProvider.verifyToken(new Secret(refreshToken));
         if (!accessToken) {
@@ -187,10 +179,6 @@ export class JwtGuard {
         }
         this.isAuthenticated = true;
         this.user = providerUser.getOriginal();
-        /**
-         * Get the same abilities for the new refresh token
-         */
-        const abilities = accessToken.abilities;
         /**
          * Delete the refresh token from the database
          */
@@ -200,16 +188,50 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
-        const newRefreshToken = await this.#refreshTokenUserProvider.createToken(this.user, abilities, {
-            name,
+        return this.generate(this.user);
+    }
+    async #findRefreshToken() {
+        const bodyToken = this.#ctx.request.input('refreshToken');
+        if (bodyToken) {
+            return bodyToken;
+        }
+        if (this.#options.useCookiesForRefreshToken) {
+            const cookieToken = this.#ctx.request.cookie(this.#refreshTokenName);
+            if (cookieToken) {
+                return cookieToken;
+            }
+        }
+        const authHeader = this.#ctx.request.header('authorization');
+        if (authHeader) {
+            if (authHeader.toLowerCase().startsWith('bearer ')) {
+                const token = authHeader.slice(7).trim();
+                if (token) {
+                    return token;
+                }
+            }
+        }
+        throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+            guardDriverName: this.driverName,
         });
-        if (!newRefreshToken.value) {
+    }
+    /**
+     * Revoke the refresh token
+     */
+    async revoke(refreshToken) {
+        if (!this.#refreshTokenUserProvider) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });
         }
-        this.user.currentToken = newRefreshToken.value?.release();
-        return this.getUserOrFail();
+        if (!refreshToken) {
+            try {
+                refreshToken = await this.#findRefreshToken();
+            }
+            catch {
+                return;
+            }
+        }
+        await this.#refreshTokenUserProvider.invalidateToken(new Secret(refreshToken));
     }
     /**
      * Same as authenticate, but does not throw an exception

package/build/src/types.d.ts

@@ -43,6 +43,9 @@ export type JwtGuardOptions<RealUser extends any = unknown> = {
     refreshTokenUserProvider?: AccessTokensUserProviderContract<RealUser>;
     tokenName?: string;
     expiresIn?: number | StringValue;
+    refreshTokenExpiresIn?: number | StringValue;
     useCookies?: boolean;
+    useCookiesForRefreshToken?: boolean;
+    refreshTokenAbilities?: string[];
     content?: (user: JwtGuardUser<RealUser>) => Record<string, any>;
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
   "description": "Adonisjs v6 package for authentication with jwt token",
-  "version": "0.6.1",
+  "version": "0.7.0-alpha.1",
   "engines": {
     "node": ">=20.6.0"
   },
@@ -35,32 +35,32 @@
   },
   "devDependencies": {
     "@adonisjs/assembler": "^7.8.2",
-    "@adonisjs/auth": "^9.4.0",
-    "@adonisjs/core": "^6.17.2",
-    "@adonisjs/eslint-config": "^2.0.0",
-    "@adonisjs/lucid": "^21.0.0",
-    "@adonisjs/prettier-config": "^1.4.4",
-    "@adonisjs/tsconfig": "^1.4.0",
-    "@japa/assert": "^4.0.1",
-    "@japa/file-system": "^2.3.2",
-    "@japa/runner": "^4.2.0",
-    "@swc/core": "^1.12.5",
+    "@adonisjs/auth": "^9.5.1",
+    "@adonisjs/core": "^6.19.3",
+    "@adonisjs/eslint-config": "^2.1.2",
+    "@adonisjs/lucid": "^21.8.2",
+    "@adonisjs/prettier-config": "^1.4.5",
+    "@adonisjs/tsconfig": "^1.4.1",
+    "@japa/assert": "^4.2.0",
+    "@japa/file-system": "^3.0.0",
+    "@japa/runner": "^5.3.0",
+    "@swc/core": "^1.15.8",
     "@types/node": "^22.15.18",
-    "c8": "^9.1.0",
+    "c8": "^10.1.3",
     "copyfiles": "^2.4.1",
-    "del-cli": "^5.1.0",
-    "eslint": "^9.26.0",
-    "luxon": "^3.4.4",
-    "np": "^10.0.0",
-    "prettier": "^3.5.3",
+    "del-cli": "^7.0.0",
+    "eslint": "^9.39.2",
+    "luxon": "^3.7.2",
+    "np": "^10.3.0",
+    "prettier": "^3.8.0",
     "sqlite3": "^5.1.7",
     "timekeeper": "^2.3.1",
-    "ts-node-maintained": "^10.9.5",
-    "typescript": "~5.8"
+    "ts-node-maintained": "^10.9.6",
+    "typescript": "~5.9.3"
   },
   "dependencies": {
-    "@types/jsonwebtoken": "^9.0.6",
-    "jsonwebtoken": "^9.0.2",
+    "@types/jsonwebtoken": "^9.0.10",
+    "jsonwebtoken": "^9.0.3",
     "ms": "^2.1.3"
   },
   "peerDependencies": {