@maximemrf/adonisjs-jwt 0.8.0 → 1.0.0-rc.1

package/build/src/{jwt.js → guard.js}

@@ -1,7 +1,8 @@
 import { errors } from '@adonisjs/auth';
-import jwt from 'jsonwebtoken';
+import { DEFAULT_TOKEN_EXPIRES_IN, } from './types.js';
 import { Secret } from '@adonisjs/core/helpers';
-import { JwksManager } from './jwks.js';
+import { validateGuardOptions } from './validation.js';
+import { resolveDriver } from './driver_resolver.js';
 export class JwtGuard {
     #ctx;
     #userProvider;
@@ -9,7 +10,7 @@ export class JwtGuard {
     #options;
     #tokenName;
     #refreshTokenName = 'refreshToken';
-    #jwksManager;
+    #driver;
     #cookieOptions;
     constructor(ctx, userProvider, option) {
         this.#ctx = ctx;
@@ -19,12 +20,45 @@ export class JwtGuard {
         if (!this.#options.content)
             this.#options.content = (user) => ({ userId: user.getId() });
         this.#tokenName = this.#options.tokenName ?? 'token';
-        this.#jwksManager = this.#options.jwks ? new JwksManager(this.#options.jwks) : undefined;
+        this.#refreshTokenName = this.#options.refreshTokenName ?? 'refreshToken';
+        /**
+         * Never issue access tokens without an expiration
+         */
+        this.#options.tokenExpiresIn = this.#options.tokenExpiresIn ?? DEFAULT_TOKEN_EXPIRES_IN;
         this.#cookieOptions = {
             httpOnly: true,
             secure: true,
             ...this.#options.cookie,
         };
+        validateGuardOptions(this.#options, 'JwtGuard');
+        this.#driver = resolveDriver(this.#options, 'JwtGuard');
+    }
+    #signAccessToken(payload) {
+        return this.#driver.sign(payload, { expiresIn: this.#options.tokenExpiresIn });
+    }
+    async #verifyAccessToken(token) {
+        return this.#driver.verify(token);
+    }
+    #extractToken() {
+        /**
+         * The header is set explicitly by the client, so it takes precedence
+         * over the cookie, which the browser sends on every request (a stale
+         * cookie must not shadow a valid bearer token)
+         */
+        const authHeader = this.#ctx.request.header('authorization');
+        if (authHeader && authHeader.toLowerCase().startsWith('bearer ')) {
+            const headerToken = authHeader.slice(7).trim();
+            if (headerToken) {
+                return headerToken;
+            }
+        }
+        if (this.#options.useCookies) {
+            const cookieToken = this.#ctx.request.cookie(this.#tokenName);
+            if (cookieToken) {
+                return cookieToken;
+            }
+        }
+        return undefined;
     }
     /**
      * A unique name for the guard driver
@@ -48,17 +82,14 @@ export class JwtGuard {
      * Generate a JWT token for a given user.
      */
     async generate(user) {
-        if (this.#options.jwks) {
+        if (!this.#driver.canSign) {
             throw new errors.E_UNAUTHORIZED_ACCESS("You can't use the auth.generate method with jwks", {
                 guardDriverName: this.driverName,
             });
         }
         const providerUser = await this.#userProvider.createUserForGuard(user);
-        const token = jwt.sign(this.#options.content(providerUser), this.#options.secret, this.#options.expiresIn
-            ? {
-                expiresIn: this.#options.expiresIn,
-            }
-            : {});
+        const signPayload = this.#options.content(providerUser);
+        const token = this.#signAccessToken(signPayload);
         let refreshToken;
         if (this.#refreshTokenUserProvider) {
             const generatedRefreshToken = await this.#refreshTokenUserProvider.createToken(user, this.#options.refreshTokenAbilities ?? [], this.#options.refreshTokenExpiresIn
@@ -71,7 +102,7 @@ export class JwtGuard {
         if (this.#options.useCookies) {
             this.#ctx.response.cookie(`${this.#tokenName}`, token, {
                 ...this.#cookieOptions,
-                maxAge: this.#options.expiresIn,
+                maxAge: this.#options.tokenExpiresIn,
             });
         }
         if (this.#options.useCookiesForRefreshToken && refreshToken) {
@@ -83,7 +114,7 @@ export class JwtGuard {
         return {
             type: 'bearer',
             token: token,
-            expiresIn: this.#options.expiresIn,
+            expiresIn: this.#options.tokenExpiresIn,
             refreshToken: refreshToken,
             refreshTokenExpiresIn: this.#options.refreshTokenExpiresIn,
         };
@@ -103,58 +134,39 @@ export class JwtGuard {
         }
         this.authenticationAttempted = true;
         /**
-         * Try to read the token from the cookies.
-         */
-        let token = this.#ctx.request.cookie(`${this.#tokenName}`);
-        /**
-         * If token is missing on cookies, then try to read it from the header authorization
+         * Read the token from the Authorization header or the cookie
          */
+        const token = this.#extractToken();
         if (!token) {
-            /**
-             * Ensure the auth header exists
-             */
-            const authHeader = this.#ctx.request.header('authorization');
-            if (!authHeader) {
-                throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
-                    guardDriverName: this.driverName,
-                });
-            }
-            /**
-             * Split the header value and read the token from it
-             */
-            ;
-            [, token] = authHeader.split('Bearer ');
-            if (!token) {
-                throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
-                    guardDriverName: this.driverName,
-                });
-            }
+            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                guardDriverName: this.driverName,
+            });
         }
         /**
          * Verify token
          */
         let payload;
         try {
-            if (this.#jwksManager) {
-                const decoded = jwt.decode(token, { complete: true });
-                if (!decoded || !decoded.header || !decoded.header.kid) {
-                    throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
-                        guardDriverName: this.driverName,
-                    });
-                }
-                const key = await this.#jwksManager.getSigningKey(decoded.header.kid);
-                payload = jwt.verify(token, key);
-            }
-            else {
-                payload = jwt.verify(token, this.#options.secret);
-            }
+            payload = await this.#verifyAccessToken(token);
         }
         catch {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });
         }
-        if (!payload || typeof payload !== 'object' || !('userId' in payload)) {
+        if (!payload || typeof payload !== 'object') {
+            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                guardDriverName: this.driverName,
+            });
+        }
+        if (this.#options.verifyPayload && !(await this.#options.verifyPayload(payload))) {
+            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                guardDriverName: this.driverName,
+            });
+        }
+        const getUserId = this.#options.getUserId ?? ((claims) => claims.userId);
+        const userId = getUserId(payload);
+        if (userId === undefined || userId === null) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });
@@ -162,7 +174,7 @@ export class JwtGuard {
         /**
          * Fetch the user by user ID and save a reference to it
          */
-        const providerUser = await this.#userProvider.findById(payload.userId);
+        const providerUser = await this.#userProvider.findById(userId);
         if (!providerUser) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
@@ -175,7 +187,7 @@ export class JwtGuard {
     }
     async generateWithRefreshToken(refreshToken) {
         this.authenticationAttempted = true;
-        if (this.#options.jwks) {
+        if (!this.#driver.canSign) {
             throw new errors.E_UNAUTHORIZED_ACCESS('JWKS is not supported for refresh token', {
                 guardDriverName: this.driverName,
             });
@@ -194,6 +206,16 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
+        /**
+         * When refresh token abilities are configured, reject tokens that
+         * don't have all of them (e.g. an API token from another provider)
+         */
+        const requiredAbilities = this.#options.refreshTokenAbilities ?? [];
+        if (!requiredAbilities.every((ability) => accessToken.allows(ability))) {
+            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                guardDriverName: this.driverName,
+            });
+        }
         /**
          * Fetch the user by user ID
          */
@@ -203,10 +225,9 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
-        this.isAuthenticated = true;
-        this.user = providerUser.getOriginal();
         /**
-         * Delete the refresh token from the database
+         * Delete the refresh token from the database. Only one of two concurrent
+         * requests using the same refresh token can delete it
          */
         const isDeleted = await this.#refreshTokenUserProvider.invalidateToken(new Secret(refreshToken));
         if (!isDeleted) {
@@ -214,19 +235,35 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
-        return this.generate(this.user);
+        const user = providerUser.getOriginal();
+        const result = await this.generate(user);
+        /**
+         * Like after `authenticate()`, `currentToken` holds the access token
+         * of the request, here the one that has just been issued
+         */
+        this.isAuthenticated = true;
+        this.user = user;
+        this.user.currentToken = result.token;
+        return result;
     }
     async #findRefreshToken() {
-        const bodyToken = this.#ctx.request.input('refreshToken');
-        if (bodyToken) {
-            return bodyToken;
-        }
+        /**
+         * The cookie is the configured transport, so it takes precedence
+         */
         if (this.#options.useCookiesForRefreshToken) {
             const cookieToken = this.#ctx.request.cookie(this.#refreshTokenName);
             if (cookieToken) {
                 return cookieToken;
             }
         }
+        /**
+         * Only read the request body: a refresh token passed in the
+         * query string would end up in access logs and Referer headers
+         */
+        const bodyToken = this.#ctx.request.body()[this.#refreshTokenName];
+        if (typeof bodyToken === 'string' && bodyToken) {
+            return bodyToken;
+        }
         const authHeader = this.#ctx.request.header('authorization');
         if (authHeader) {
             if (authHeader.toLowerCase().startsWith('bearer ')) {
@@ -249,6 +286,7 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
+        this.#clearCookies();
         if (!refreshToken) {
             try {
                 refreshToken = await this.#findRefreshToken();
@@ -259,6 +297,17 @@ export class JwtGuard {
         }
         await this.#refreshTokenUserProvider.invalidateToken(new Secret(refreshToken));
     }
+    /**
+     * Remove the access and refresh token cookies set by the guard
+     */
+    #clearCookies() {
+        if (this.#options.useCookies) {
+            this.#ctx.response.clearCookie(this.#tokenName, this.#cookieOptions);
+        }
+        if (this.#options.useCookiesForRefreshToken) {
+            this.#ctx.response.clearCookie(this.#refreshTokenName, this.#cookieOptions);
+        }
+    }
     /**
      * Same as authenticate, but does not throw an exception
      */

package/build/src/types.d.ts

@@ -1,8 +1,9 @@
-import type { symbols } from '@adonisjs/auth';
+import { type symbols } from '@adonisjs/auth';
 import type { StringValue } from 'ms';
 import type { AccessTokensUserProviderContract } from '@adonisjs/auth/types/access_tokens';
 import type { Options } from 'jwks-rsa';
 import type { CookieOptions } from '@adonisjs/core/types/http';
+import type { JwtDriver } from './drivers/types.js';
 export type JwtCookieOptions = Omit<Partial<CookieOptions>, 'maxAge' | 'expires'>;
 /**
  * The bridge between the User provider and the
@@ -41,16 +42,101 @@ export interface JwtUserProviderContract<RealUser> {
 export type BaseJwtContent = {
     userId: string | number | BigInt;
 };
+/**
+ * Lifetime of access tokens when `tokenExpiresIn` is not configured
+ */
+export declare const DEFAULT_TOKEN_EXPIRES_IN = "1h";
+export declare const ALLOWED_SYMMETRIC_ALGORITHMS: readonly ["HS256", "HS384", "HS512"];
+export type JwtSymmetricAlgorithm = (typeof ALLOWED_SYMMETRIC_ALGORITHMS)[number];
+export declare const ALLOWED_ASYMMETRIC_ALGORITHMS: readonly ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512"];
+/**
+ * Algorithms supported for asymmetric (RSA / ECDSA) JWT signing and verification.
+ * Use with `privateKey` + `publicKey` so access tokens can be verified elsewhere with only the public key.
+ */
+export type JwtAsymmetricAlgorithm = (typeof ALLOWED_ASYMMETRIC_ALGORITHMS)[number];
+export declare const ALLOWED_JWKS_ALGORITHMS: readonly ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"];
+export type JwtJwksAlgorithm = (typeof ALLOWED_JWKS_ALGORITHMS)[number];
+export type JwtGenerateResult = {
+    type: string;
+    token: string;
+    expiresIn?: number | StringValue;
+    refreshToken?: string;
+    refreshTokenExpiresIn?: number | StringValue;
+};
 export type JwtGuardOptions<RealUser extends any = unknown> = {
-    secret: string;
+    /**
+     * Driver resolved by `jwtGuard()`. Not part of the public API: custom
+     * drivers are not supported and the `JwtDriver` interface may change.
+     */
+    driver?: JwtDriver;
+    /**
+     * Symmetric signing secret (HMAC). Used when asymmetric keys are not set.
+     */
+    secret?: string;
+    /**
+     * PEM-encoded private key for signing access tokens (asymmetric mode).
+     */
+    privateKey?: string;
+    /**
+     * PEM-encoded public key for verifying access tokens (asymmetric mode).
+     */
+    publicKey?: string;
+    /**
+     * Required with `privateKey` and `publicKey`.
+     */
+    algorithm?: JwtAsymmetricAlgorithm;
     jwks?: Options;
     refreshTokenUserProvider?: AccessTokensUserProviderContract<RealUser>;
     tokenName?: string;
-    expiresIn?: number | StringValue;
+    /**
+     * Name of the refresh token cookie and request body field.
+     * Defaults to `refreshToken`.
+     */
+    refreshTokenName?: string;
+    /**
+     * Lifetime of access tokens. Defaults to `DEFAULT_TOKEN_EXPIRES_IN`.
+     */
+    tokenExpiresIn?: number | StringValue;
     refreshTokenExpiresIn?: number | StringValue;
     useCookies?: boolean;
     useCookiesForRefreshToken?: boolean;
+    /**
+     * Abilities given to refresh tokens. When set, `generateWithRefreshToken`
+     * rejects refresh tokens that don't have all of them.
+     */
     refreshTokenAbilities?: string[];
     cookie?: JwtCookieOptions;
-    content?: (user: JwtGuardUser<RealUser>) => Record<string, any>;
+    content?: (user: JwtGuardUser<RealUser>) => Record<string, any> & BaseJwtContent;
+    /**
+     * Expected JWT issuer (iss). Validated during token verification.
+     * Required in JWKS mode.
+     */
+    issuer?: string;
+    /**
+     * Expected JWT audience (aud). Validated during token verification.
+     * Required in JWKS mode, unless `verifyPayload` is set.
+     */
+    audience?: string | string[];
+    /**
+     * Algorithms accepted when verifying tokens in JWKS mode.
+     * Must be a non-empty subset of `ALLOWED_JWKS_ALGORITHMS` (default: all of them).
+     */
+    algorithms?: JwtJwksAlgorithm[];
+    /**
+     * Number of seconds of clock skew tolerated when checking `exp` / `nbf`.
+     */
+    clockTolerance?: number;
+    /**
+     * Extract the user id from a verified token payload.
+     * Defaults to `payload.userId`. Use e.g. `(payload) => payload.sub` for external providers.
+     */
+    getUserId?: JwtGetUserId;
+    /**
+     * Extra check on a verified token payload, run before looking up the user.
+     * Return `false` to reject the token. Use it to check claims other than
+     * `iss` and `aud`, e.g. `client_id` and `token_use` for Amazon Cognito.
+     */
+    verifyPayload?: JwtVerifyPayload;
 };
+export type JwtVerifyPayload = (payload: Record<string, any>) => boolean | Promise<boolean>;
+export type JwtGetUserId = (payload: Record<string, any>) => string | number | BigInt | undefined | null;

package/build/src/types.js

@@ -1 +1,19 @@
-export {};
+/**
+ * Lifetime of access tokens when `tokenExpiresIn` is not configured
+ */
+export const DEFAULT_TOKEN_EXPIRES_IN = '1h';
+export const ALLOWED_SYMMETRIC_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
+export const ALLOWED_ASYMMETRIC_ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'ES256',
+    'ES384',
+    'ES512',
+];
+export const ALLOWED_JWKS_ALGORITHMS = [
+    ...ALLOWED_ASYMMETRIC_ALGORITHMS,
+    'PS256',
+    'PS384',
+    'PS512',
+];

package/build/src/validation.d.ts

@@ -0,0 +1,2 @@
+import type { JwtGuardOptions } from './types.js';
+export declare function validateGuardOptions(options: JwtGuardOptions, prefix?: string): void;

package/build/src/validation.js

@@ -0,0 +1,24 @@
+export function validateGuardOptions(options, prefix = 'JwtGuard') {
+    if (typeof options.tokenExpiresIn === 'number' &&
+        !(Number.isFinite(options.tokenExpiresIn) && options.tokenExpiresIn > 0)) {
+        throw new Error(`${prefix} \`tokenExpiresIn\` must be a positive number of seconds`);
+    }
+    if (options.driver) {
+        return;
+    }
+    const asymmetricPartial = options.privateKey !== undefined ||
+        options.publicKey !== undefined ||
+        options.algorithm !== undefined;
+    const usesAsymmetric = options.privateKey !== undefined &&
+        options.publicKey !== undefined &&
+        options.algorithm !== undefined;
+    if (asymmetricPartial && !usesAsymmetric) {
+        throw new Error(`${prefix} asymmetric mode requires \`privateKey\`, \`publicKey\`, and \`algorithm\` to be set together`);
+    }
+    if (options.jwks && usesAsymmetric) {
+        throw new Error(`${prefix} cannot use \`jwks\` together with asymmetric \`privateKey\` / \`publicKey\``);
+    }
+    if (!options.jwks && !usesAsymmetric && !options.secret) {
+        throw new Error(`${prefix} requires \`secret\` (symmetric), or \`privateKey\` + \`publicKey\` + \`algorithm\` (asymmetric), or \`jwks\``);
+    }
+}

package/build/stubs/main.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Path to the root directory where stubs are stored.
+ */
+export declare const stubsRoot: string;

package/build/stubs/main.js

@@ -0,0 +1,5 @@
+import { fileURLToPath } from 'node:url';
+/**
+ * Path to the root directory where stubs are stored.
+ */
+export const stubsRoot = fileURLToPath(new URL('./', import.meta.url));

package/build/stubs/migration.stub

@@ -0,0 +1,35 @@
+{{{
+  exports({
+    to: app.makePath('database/migrations', entity.filename)
+  })
+}}}
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'jwt_refresh_tokens'
+
+  async up() {
+    this.schema.createTable(this.tableName, (table) => {
+      table.increments()
+      table
+        .integer('tokenable_id')
+        .notNullable()
+        .unsigned()
+        .references('id')
+        .inTable('users')
+        .onDelete('CASCADE')
+      table.string('type').notNullable()
+      table.string('name').nullable()
+      table.string('hash', 80).notNullable()
+      table.text('abilities').notNullable()
+      table.timestamp('created_at', { precision: 6, useTz: true }).notNullable()
+      table.timestamp('updated_at', { precision: 6, useTz: true }).notNullable()
+      table.timestamp('expires_at', { precision: 6, useTz: true }).nullable()
+      table.timestamp('last_used_at', { precision: 6, useTz: true }).nullable()
+    })
+  }
+
+  async down() {
+    this.schema.dropTable(this.tableName)
+  }
+}

package/package.json

@@ -1,28 +1,29 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
-  "description": "Adonisjs v6 package for authentication with jwt token",
-  "version": "0.8.0",
+  "description": "AdonisJS package for authentication with JWT tokens",
+  "version": "1.0.0-rc.1",
   "engines": {
-    "node": ">=20.6.0"
+    "node": ">=24.0.0"
   },
   "type": "module",
+  "main": "./build/index.js",
+  "types": "./build/index.d.ts",
   "files": [
     "build/src",
     "build/stubs",
     "build/index.d.ts",
-    "build/index.js"
+    "build/index.js",
+    "build/configure.d.ts",
+    "build/configure.js"
   ],
   "exports": {
     ".": "./build/index.js",
     "./types": "./build/src/types.js",
-    "./jwt_config": "./build/src/define_config.js"
-  },
-  "imports": {
-    "#generated/*": "./.adonisjs/server/*.js",
-    "#transformers/*": "./app/transformers/*.js",
-    "#database/*": "./database/*.js"
+    "./jwt_config": "./build/src/define_config.js",
+    "./stubs": "./build/stubs/main.js"
   },
   "scripts": {
+    "prepare": "tsc && npm run copy:templates",
     "clean": "del-cli build",
     "copy:templates": "copyfiles \"stubs/**/*.stub\" build",
     "typecheck": "tsc --noEmit",
@@ -39,43 +40,51 @@
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {
-    "@adonisjs/assembler": "^8.0.0",
-    "@adonisjs/auth": "^10.0.0",
-    "@adonisjs/core": "^7.0.1",
-    "@adonisjs/eslint-config": "^3.0.0",
-    "@adonisjs/lucid": "^22.0.0",
-    "@adonisjs/prettier-config": "^1.4.5",
+    "@adonisjs/assembler": "^8.4.0",
+    "@adonisjs/auth": "^10.1.0",
+    "@adonisjs/core": "^7.3.5",
+    "@adonisjs/eslint-config": "^3.1.0",
+    "@adonisjs/lucid": "^22.4.2",
+    "@adonisjs/prettier-config": "^1.5.0",
     "@adonisjs/tsconfig": "^2.0.0",
     "@japa/assert": "^4.2.0",
     "@japa/file-system": "^3.0.0",
     "@japa/runner": "^5.3.0",
     "@poppinss/ts-exec": "^1.4.4",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/nock": "^11.1.0",
-    "@types/node": "^22.15.18",
-    "c8": "^10.1.3",
+    "@types/node": "^24.19.2",
+    "c8": "^11.0.0",
     "copyfiles": "^2.4.1",
     "del-cli": "^7.0.0",
-    "eslint": "^9.39.3",
+    "eslint": "^9.39.5",
     "luxon": "^3.7.2",
-    "nock": "^14.0.11",
-    "np": "^11.0.2",
-    "prettier": "^3.8.1",
-    "sqlite3": "^5.1.7",
+    "nock": "^14.0.16",
+    "np": "^11.2.2",
+    "prettier": "^3.9.6",
+    "sqlite3": "^6.0.1",
     "timekeeper": "^2.3.1",
-    "typescript": "~5.9.3",
-    "youch": "^4.1.0"
+    "typescript": "~6.0.3",
+    "youch": "^4.1.1"
   },
   "dependencies": {
-    "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
-    "jwks-rsa": "^3.2.2",
+    "jwks-rsa": "^4.1.0",
     "ms": "^2.1.3"
   },
   "peerDependencies": {
+    "@adonisjs/auth": "^10.1.0",
     "@adonisjs/core": "^7.0.1"
   },
   "author": "MaximeMRF",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MaximeMRF/adonisjs-jwt.git"
+  },
+  "bugs": {
+    "url": "https://github.com/MaximeMRF/adonisjs-jwt/issues"
+  },
   "keywords": [
     "adonisjs",
     "adonis",
@@ -108,4 +117,4 @@
       "tests/**"
     ]
   }
-}
+}