@maximemrf/adonisjs-jwt 0.7.0-alpha.0 → 0.7.0-alpha.2

package/README.md

@@ -131,7 +131,13 @@ export default class extends BaseSchema {
   async up() {
     this.schema.createTable(this.tableName, (table) => {
       table.increments()
-      table.integer('tokenable_id').notNullable().unsigned()
+      table
+        .integer('tokenable_id')
+        .notNullable()
+        .unsigned()
+        .references('id')
+        .inTable('users')
+        .onDelete('CASCADE')
       table.string('type').notNullable()
       table.string('name').nullable()
       table.string('hash', 80).notNullable()
@@ -193,16 +199,18 @@ router.post('login', async ({ request, auth }) => {
 })
 
 // if the jwt guard is the default guard
-router.get('/', async ({ auth }) => {
-  return auth.getUserOrFail()
-})
-.use(middleware.auth())
+router
+  .get('/', async ({ auth }) => {
+    return auth.getUserOrFail()
+  })
+  .use(middleware.auth())
 
 // if the jwt guard is not the default guard
-router.get('/', async ({ auth }) => {
-  return auth.use('jwt').getUserOrFail()
-})
-.use(middleware.auth({ guards: ['jwt'] }))
+router
+  .get('/', async ({ auth }) => {
+    return auth.use('jwt').getUserOrFail()
+  })
+  .use(middleware.auth({ guards: ['jwt'] }))
 
 // if you use the refresh token
 router.post('jwt/refresh', async ({ auth }) => {

package/build/src/define_config.d.ts

@@ -4,6 +4,7 @@ import { JwtGuardUser, JwtUserProviderContract } from './types.js';
 import { JwtGuard } from './jwt.js';
 import type { StringValue } from 'ms';
 import { AccessTokensUserProviderContract } from '@adonisjs/auth/types/access_tokens';
+import { Options } from 'jwks-rsa';
 export declare function jwtGuard<UserProvider extends JwtUserProviderContract<unknown>>(config: {
     provider: UserProvider;
     refreshTokenUserProvider?: AccessTokensUserProviderContract<unknown>;
@@ -15,4 +16,5 @@ export declare function jwtGuard<UserProvider extends JwtUserProviderContract<un
     refreshTokenAbilities?: string[];
     secret?: string;
     content: <T>(user: JwtGuardUser<T>) => Record<string | number, any>;
+    jwks?: Options;
 }): GuardConfigProvider<(ctx: HttpContext) => JwtGuard<UserProvider>>;

package/build/src/define_config.js

@@ -1,4 +1,5 @@
 import { JwtGuard } from './jwt.js';
+import { JwksManager } from './jwks.js';
 export function jwtGuard(config) {
     return {
         async resolver(_, app) {
@@ -13,6 +14,8 @@ export function jwtGuard(config) {
                 useCookiesForRefreshToken: config.useCookiesForRefreshToken,
                 refreshTokenAbilities: config.refreshTokenAbilities,
                 content: config.content,
+                jwks: config.jwks,
+                jwksClient: config.jwks ? new JwksManager(config.jwks).getClient() : undefined,
             };
             return (ctx) => new JwtGuard(ctx, config.provider, options);
         },

package/build/src/jwks.d.ts

@@ -0,0 +1,7 @@
+import { Options, JwksClient } from 'jwks-rsa';
+export declare class JwksManager {
+    private client;
+    constructor(options: Options);
+    getClient(): JwksClient;
+    getSigningKey(kid: string): Promise<string>;
+}

package/build/src/jwks.js

@@ -0,0 +1,14 @@
+import { JwksClient } from 'jwks-rsa';
+export class JwksManager {
+    client;
+    constructor(options) {
+        this.client = new JwksClient(options);
+    }
+    getClient() {
+        return this.client;
+    }
+    async getSigningKey(kid) {
+        const key = await this.client.getSigningKey(kid);
+        return key.getPublicKey();
+    }
+}

package/build/src/jwt.js

@@ -8,6 +8,7 @@ export class JwtGuard {
     #options;
     #tokenName;
     #refreshTokenName = 'refreshToken';
+    #jwksManager;
     constructor(ctx, userProvider, option) {
         this.#ctx = ctx;
         this.#userProvider = userProvider;
@@ -16,6 +17,7 @@ export class JwtGuard {
         if (!this.#options.content)
             this.#options.content = (user) => ({ userId: user.getId() });
         this.#tokenName = this.#options.tokenName ?? 'token';
+        this.#jwksManager = this.#options.jwksManager;
     }
     /**
      * A unique name for the guard driver
@@ -126,14 +128,26 @@ export class JwtGuard {
          */
         let payload;
         try {
-            payload = jwt.verify(token, this.#options.secret);
+            if (this.#jwksManager) {
+                const decoded = jwt.decode(token, { complete: true });
+                if (!decoded || !decoded.header || !decoded.header.kid) {
+                    throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                        guardDriverName: this.driverName,
+                    });
+                }
+                const key = await this.#jwksManager.getSigningKey(decoded.header.kid);
+                payload = jwt.verify(token, key);
+            }
+            else {
+                payload = jwt.verify(token, this.#options.secret);
+            }
         }
         catch (error) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });
         }
-        if (typeof payload !== 'object' || !('userId' in payload)) {
+        if (!payload || typeof payload !== 'object' || !('userId' in payload)) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });

package/build/src/types.d.ts

@@ -1,6 +1,8 @@
 import { symbols } from '@adonisjs/auth';
 import type { StringValue } from 'ms';
 import { AccessTokensUserProviderContract } from '@adonisjs/auth/types/access_tokens';
+import { Options } from 'jwks-rsa';
+import { JwksManager } from './jwks.js';
 /**
  * The bridge between the User provider and the
  * Guard
@@ -40,6 +42,8 @@ export type BaseJwtContent = {
 };
 export type JwtGuardOptions<RealUser extends any = unknown> = {
     secret: string;
+    jwks?: Options;
+    jwksManager?: JwksManager;
     refreshTokenUserProvider?: AccessTokensUserProviderContract<RealUser>;
     tokenName?: string;
     expiresIn?: number | StringValue;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
   "description": "Adonisjs v6 package for authentication with jwt token",
-  "version": "0.7.0-alpha.0",
+  "version": "0.7.0-alpha.2",
   "engines": {
     "node": ">=20.6.0"
   },
@@ -35,24 +35,24 @@
   },
   "devDependencies": {
     "@adonisjs/assembler": "^7.8.2",
-    "@adonisjs/auth": "^9.5.0",
-    "@adonisjs/core": "^6.19.0",
+    "@adonisjs/auth": "^9.5.1",
+    "@adonisjs/core": "^6.19.3",
     "@adonisjs/eslint-config": "^2.1.2",
-    "@adonisjs/lucid": "^21.8.0",
+    "@adonisjs/lucid": "^21.8.2",
     "@adonisjs/prettier-config": "^1.4.5",
     "@adonisjs/tsconfig": "^1.4.1",
-    "@japa/assert": "^4.1.1",
-    "@japa/file-system": "^2.3.2",
-    "@japa/runner": "^4.4.0",
-    "@swc/core": "^1.13.5",
+    "@japa/assert": "^4.2.0",
+    "@japa/file-system": "^3.0.0",
+    "@japa/runner": "^5.3.0",
+    "@swc/core": "^1.15.8",
     "@types/node": "^22.15.18",
     "c8": "^10.1.3",
     "copyfiles": "^2.4.1",
     "del-cli": "^7.0.0",
-    "eslint": "^9.37.0",
+    "eslint": "^9.39.2",
     "luxon": "^3.7.2",
-    "np": "^10.2.0",
-    "prettier": "^3.6.2",
+    "np": "^10.3.0",
+    "prettier": "^3.8.0",
     "sqlite3": "^5.1.7",
     "timekeeper": "^2.3.1",
     "ts-node-maintained": "^10.9.6",
@@ -60,7 +60,8 @@
   },
   "dependencies": {
     "@types/jsonwebtoken": "^9.0.10",
-    "jsonwebtoken": "^9.0.2",
+    "jsonwebtoken": "^9.0.3",
+    "jwks-rsa": "^3.2.2",
     "ms": "^2.1.3"
   },
   "peerDependencies": {
@@ -97,4 +98,4 @@
       "tests/**"
     ]
   }
-}
+}