@maximemrf/adonisjs-jwt 0.7.0-alpha.2 → 0.7.0

package/README.md

@@ -116,6 +116,27 @@ useCookies: true
 
 If you just want to use jwt with the bearer token no need to set `useCookies` to `false` you can just remove it.
 
+## JWKS
+
+You can use JWKS to verify the token by setting the `jwks` option in the guard configuration.
+
+```typescript
+// ...
+jwt: jwtGuard({
+  // ...
+  jwks: {
+    jwksUri: 'https://your-auth-server/.well-known/jwks.json',
+    // you can pass any options accepted by jwks-rsa package
+    cache: true,
+    rateLimit: true,
+  },
+}),
+// ...
+```
+
+> [!WARNING]
+> If you enable JWKS, you cannot use the `auth.use('jwt').generate(user)` and `auth.use('jwt').generateWithRefreshToken()` method because the token is signed by an external provider. You can only use the `authenticate` (or `check` / `getUserOrFail`) method to verify the token.
+
 ## Refresh Tokens
 
 To use refresh tokens, you have to set the `refreshTokenUserProvider` in the guard configuration, see the example above.

package/build/src/define_config.js

@@ -1,5 +1,4 @@
 import { JwtGuard } from './jwt.js';
-import { JwksManager } from './jwks.js';
 export function jwtGuard(config) {
     return {
         async resolver(_, app) {
@@ -15,7 +14,6 @@ export function jwtGuard(config) {
                 refreshTokenAbilities: config.refreshTokenAbilities,
                 content: config.content,
                 jwks: config.jwks,
-                jwksClient: config.jwks ? new JwksManager(config.jwks).getClient() : undefined,
             };
             return (ctx) => new JwtGuard(ctx, config.provider, options);
         },

package/build/src/jwt.js

@@ -1,6 +1,7 @@
 import { errors } from '@adonisjs/auth';
 import jwt from 'jsonwebtoken';
 import { Secret } from '@adonisjs/core/helpers';
+import { JwksManager } from './jwks.js';
 export class JwtGuard {
     #ctx;
     #userProvider;
@@ -17,7 +18,7 @@ export class JwtGuard {
         if (!this.#options.content)
             this.#options.content = (user) => ({ userId: user.getId() });
         this.#tokenName = this.#options.tokenName ?? 'token';
-        this.#jwksManager = this.#options.jwksManager;
+        this.#jwksManager = this.#options.jwks ? new JwksManager(this.#options.jwks) : undefined;
     }
     /**
      * A unique name for the guard driver
@@ -41,6 +42,11 @@ export class JwtGuard {
      * Generate a JWT token for a given user.
      */
     async generate(user) {
+        if (this.#options.jwks) {
+            throw new errors.E_UNAUTHORIZED_ACCESS("You can't use the auth.generate method with jwks", {
+                guardDriverName: this.driverName,
+            });
+        }
         const providerUser = await this.#userProvider.createUserForGuard(user);
         const token = jwt.sign(this.#options.content(providerUser), this.#options.secret, this.#options.expiresIn
             ? {
@@ -142,7 +148,7 @@ export class JwtGuard {
                 payload = jwt.verify(token, this.#options.secret);
             }
         }
-        catch (error) {
+        catch {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });
@@ -168,6 +174,11 @@ export class JwtGuard {
     }
     async generateWithRefreshToken(refreshToken) {
         this.authenticationAttempted = true;
+        if (this.#options.jwks) {
+            throw new errors.E_UNAUTHORIZED_ACCESS('JWKS is not supported for refresh token', {
+                guardDriverName: this.driverName,
+            });
+        }
         if (!this.#refreshTokenUserProvider) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
@@ -278,7 +289,7 @@ export class JwtGuard {
         const token = await this.generate(user);
         return {
             headers: {
-                authorization: `Bearer ${this.#options.useCookies ? token : token.token}`,
+                authorization: `Bearer ${token.token}`,
             },
         };
     }

package/build/src/types.d.ts

@@ -2,7 +2,6 @@ import { symbols } from '@adonisjs/auth';
 import type { StringValue } from 'ms';
 import { AccessTokensUserProviderContract } from '@adonisjs/auth/types/access_tokens';
 import { Options } from 'jwks-rsa';
-import { JwksManager } from './jwks.js';
 /**
  * The bridge between the User provider and the
  * Guard
@@ -43,7 +42,6 @@ export type BaseJwtContent = {
 export type JwtGuardOptions<RealUser extends any = unknown> = {
     secret: string;
     jwks?: Options;
-    jwksManager?: JwksManager;
     refreshTokenUserProvider?: AccessTokensUserProviderContract<RealUser>;
     tokenName?: string;
     expiresIn?: number | StringValue;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
   "description": "Adonisjs v6 package for authentication with jwt token",
-  "version": "0.7.0-alpha.2",
+  "version": "0.7.0",
   "engines": {
     "node": ">=20.6.0"
   },
@@ -44,15 +44,17 @@
     "@japa/assert": "^4.2.0",
     "@japa/file-system": "^3.0.0",
     "@japa/runner": "^5.3.0",
-    "@swc/core": "^1.15.8",
+    "@types/nock": "^10.0.3",
+    "@swc/core": "^1.15.10",
     "@types/node": "^22.15.18",
     "c8": "^10.1.3",
     "copyfiles": "^2.4.1",
     "del-cli": "^7.0.0",
     "eslint": "^9.39.2",
     "luxon": "^3.7.2",
-    "np": "^10.3.0",
-    "prettier": "^3.8.0",
+    "nock": "^14.0.10",
+    "np": "^11.0.1",
+    "prettier": "^3.8.1",
     "sqlite3": "^5.1.7",
     "timekeeper": "^2.3.1",
     "ts-node-maintained": "^10.9.6",
@@ -98,4 +100,4 @@
       "tests/**"
     ]
   }
-}
+}