@maximemrf/adonisjs-jwt 0.9.0 → 1.0.0-rc.1

package/README.md

@@ -15,10 +15,25 @@
 
 ## Compatibility & Versions
 
-| Package Version | AdonisJS Version | Node.js Required |
-| --- | --- | --- |
-| `v0.7.x` | `AdonisJS v6` | `>= 20.6.0` |
-| **`v0.8.x`** | **`AdonisJS v7`** | **`>= 24.0.0`** |
+| Package Version | AdonisJS Version  | Node.js Required |
+| --------------- | ----------------- | ---------------- |
+| `v0.7.x`        | `AdonisJS v6`     | `>= 20.6.0`      |
+| **`>= v0.8.x`**    | **`AdonisJS v7`** | **`>= 24.0.0`**  |
+
+## Upgrading to 1.0
+
+Version 1.0 contains breaking changes. Check this list before upgrading from `0.9.x`:
+
+- **Signing key**: without a `secret`, tokens are now signed with a key derived from the application key instead of the raw application key, and the application key must be at least 32 characters. Access tokens issued by `0.9.x` are rejected, so users have to log in again or use their refresh token, which stays valid. See [Security](#security).
+- **Default expiration**: `tokenExpiresIn` defaults to `1h`. A `content` function that sets `exp` itself now fails, use `tokenExpiresIn` instead.
+- **JWKS**: `issuer` is required, along with `audience` or `verifyPayload`. The guard throws at startup if they are missing. See [JWKS](#jwks).
+- **Refresh token in the query string**: it is ignored, send it in the body, a cookie or the `Authorization` header.
+- **Refresh token body field**: the field follows `refreshTokenName`. If you set a custom `refreshTokenName` and your clients send the token in a `refreshToken` body field, rename that field to match `refreshTokenName`.
+- **Refresh token lookup order**: when `useCookiesForRefreshToken` is enabled, the cookie is now read before the request body. See [Refresh token transport](#refresh-token-transport).
+- **Access token lookup order**: the `Authorization` header is now read before the cookie, and the cookie is only read when `useCookies` is enabled. If you set the `token` cookie yourself without `useCookies`, enable `useCookies`.
+- **`JwtGuardOptions.expiresIn`** is renamed to `tokenExpiresIn`, like the `jwtGuard()` option. This only affects code that instantiates `JwtGuard` directly.
+
+Imports can now come from the main entrypoint: `import { jwtGuard } from '@maximemrf/adonisjs-jwt'`. The `@maximemrf/adonisjs-jwt/jwt_config` path still works. `@adonisjs/auth` is now a peer dependency.
 
 ## Prerequisites
 
@@ -53,15 +68,9 @@ import { defineConfig } from '@adonisjs/auth'
 import { InferAuthEvents, Authenticators } from '@adonisjs/auth/types'
 import { sessionGuard, sessionUserProvider } from '@adonisjs/auth/session'
 import { tokensUserProvider } from '@adonisjs/auth/access_tokens'
-import { jwtGuard } from '@maximemrf/adonisjs-jwt/jwt_config'
-import { JwtGuardUser, BaseJwtContent } from '@maximemrf/adonisjs-jwt/types'
-import User from '#models/user'
+import { jwtGuard } from '@maximemrf/adonisjs-jwt'
 import env from '#start/env'
 
-interface JwtContent extends BaseJwtContent {
-  email: string
-}
-
 const authConfig = defineConfig({
   // define the default authenticator to jwt
   default: 'jwt',
@@ -76,11 +85,11 @@ const authConfig = defineConfig({
     jwt: jwtGuard({
       // tokenName is the name of the token passed as cookie, it can be optional, by default it is 'token'
       tokenName: 'custom-name',
-      // tokenExpiresIn can be a string or a number, it can be optional
+      // tokenExpiresIn can be a string or a number, it can be optional, by default it is '1h'
       tokenExpiresIn: '1h',
       // if you want to use cookies for the authentication instead of the bearer token (optional)
       useCookies: true,
-      // secret is the secret used to sign the token, it can be optional, by default it uses the application key
+      // secret is the secret used to sign the token, it can be optional, by default a key derived from the application key is used
       // you can use a env variable like JWT_SECRET or set it directly with a string
       // if you don't have specific needs, please discard this option
       secret: env.get('JWT_SECRET'),
@@ -101,13 +110,17 @@ const authConfig = defineConfig({
         httpOnly: true,
         secure: true,
       },
-      // limit the abilities of the refresh token
+      // abilities given to refresh tokens, generateWithRefreshToken rejects tokens that don't have all of them
       refreshTokenAbilities: ['refresh_token'],
+      // optional issuer (iss) and audience (aud) claims for token verification
+      issuer: 'my-app',
+      audience: 'my-api',
       // content is a function that takes the user and returns the content of the token, it can be optional, by default it returns only the user id
-      content: <T>(user: JwtGuardUser<T>): JwtContent => {
+      // user.getOriginal() is typed after the provider's model, no cast needed
+      content: (user) => {
         return {
           userId: user.getId(),
-          email: (user.getOriginal() as User).email,
+          email: user.getOriginal().email,
         }
       },
     }),
@@ -116,12 +129,14 @@ const authConfig = defineConfig({
 ```
 
 `tokenName` is the name of the jwt token passed as a cookie, it can be optional, by default it is `token`.
+`refreshTokenName` is the name of the refresh token cookie and of the request body field the guard reads it from, by default it is `refreshToken`.
+`issuer` and `audience` allow validating the `iss` and `aud` claims on incoming tokens to prevent cross-service token misuse in multi-service architecture.
 
 ```typescript
 tokenName: 'custom-name'
 ```
 
-`tokenExpiresIn` is the time before the jwt token expires it can be a string or a number and it can be optional.
+`tokenExpiresIn` is the time before the jwt token expires, it can be a string or a number (in seconds) and it can be optional. It defaults to `1h`, so access tokens always expire. A number must be positive, otherwise the guard throws at startup.
 
 ```typescript
 // string
@@ -138,6 +153,8 @@ useCookies: true
 
 If you just want to use jwt with the bearer token no need to set `useCookies` to `false` you can just remove it.
 
+The guard reads the access token from the `Authorization: Bearer <token>` header first, then from the cookie when `useCookies` is enabled. A stale cookie therefore never shadows a valid bearer token, and the cookie is ignored when `useCookies` is disabled.
+
 You can also pass options to the cookies. Note that `maxAge` and `expires` are omitted from the options because they are automatically handled by the package based on the token validity (`tokenExpiresIn` and `refreshTokenExpiresIn`).
 By default, `httpOnly: true` and `secure: true` are enforced for better security, but you can override them using the `cookie` object configuration.
 
@@ -185,16 +202,140 @@ jwt: jwtGuard({
   jwks: {
     jwksUri: 'https://your-auth-server/.well-known/jwks.json',
     // you can pass any options accepted by jwks-rsa package
-    cache: true,
-    rateLimit: true,
   },
+  // required in JWKS mode
+  issuer: 'https://your-auth-server',
+  audience: 'my-api',
 }),
 // ...
 ```
 
+`issuer` is required in JWKS mode, along with `audience` or `verifyPayload` (see [Checking other claims](#check-other-claims)): the guard throws at startup if they are missing.
+
+Tokens with an unknown `kid` trigger a JWKS fetch, so the guard applies these jwks-rsa defaults, which you can override in the `jwks` option: `cache: true`, `rateLimit: true`, `jwksRequestsPerMinute: 10` and `timeout: 5000` (ms).
+
 > [!WARNING]
 > If you enable JWKS, you cannot use the `auth.use('jwt').generate(user)` and `auth.use('jwt').generateWithRefreshToken()` method because the token is signed by an external provider. You can only use the `authenticate` (or `check` / `getUserOrFail`) method to verify the token.
 
+Tokens issued by an external provider usually don't carry a `userId` claim. Use `getUserId` to tell the guard where to find the user id, and `algorithms` to restrict the accepted signing algorithms (default: every asymmetric algorithm supported in JWKS mode; symmetric `HS*` algorithms are never accepted):
+
+```typescript
+jwt: jwtGuard({
+  // ...
+  jwks: {
+    jwksUri: 'https://your-auth-server/.well-known/jwks.json',
+  },
+  issuer: 'https://your-auth-server',
+  audience: 'my-api',
+  algorithms: ['RS256'],
+  // seconds of clock skew tolerated on `exp` / `nbf` (optional, works in every mode)
+  clockTolerance: 30,
+  // default: (payload) => payload.userId
+  getUserId: (payload) => payload.sub,
+}),
+```
+
+> [!WARNING]
+> `issuer` and `audience` (or `verifyPayload`) are required in JWKS mode. Without them, **any** token signed by the identity provider would be accepted, including tokens issued for other applications. With Kubernetes, that means every pod's default ServiceAccount token.
+
+### Check other claims
+
+Some providers don't put your application in the `aud` claim. Amazon Cognito access tokens, for example, carry the app client in `client_id` and have no `aud`. Use `verifyPayload` to check those claims: it receives the verified payload before the user lookup, and the request is rejected when it returns `false`. In JWKS mode, it can replace `audience`:
+
+```typescript
+jwt: jwtGuard({
+  // ...
+  jwks: {
+    jwksUri: 'https://cognito-idp.<region>.amazonaws.com/<userPoolId>/.well-known/jwks.json',
+  },
+  issuer: 'https://cognito-idp.<region>.amazonaws.com/<userPoolId>',
+  verifyPayload: (payload) => payload.client_id === '<appClientId>' && payload.token_use === 'access',
+  getUserId: (payload) => payload.sub,
+}),
+```
+
+`verifyPayload` works in every mode and can be async.
+
+### Example: Kubernetes ServiceAccount tokens
+
+The Kubernetes API server exposes its signing keys at `https://kubernetes.default.svc/openid/v1/jwks`. From inside the cluster, fetching them requires the cluster CA and a ServiceAccount token, which you can provide with a custom jwks-rsa `fetcher` (the token is re-read on each fetch because projected tokens are rotated):
+
+```typescript
+import { readFileSync } from 'node:fs'
+import https from 'node:https'
+
+const SA_DIR = '/var/run/secrets/kubernetes.io/serviceaccount'
+
+jwt: jwtGuard({
+  // findById receives the token `sub`, e.g. "system:serviceaccount:my-namespace:my-sa"
+  provider: new ServiceAccountUserProvider(),
+  jwks: {
+    jwksUri: 'https://kubernetes.default.svc/openid/v1/jwks',
+    cache: true,
+    fetcher: (uri) =>
+      new Promise((resolve, reject) => {
+        https
+          .get(
+            uri,
+            {
+              ca: readFileSync(`${SA_DIR}/ca.crt`),
+              headers: { Authorization: `Bearer ${readFileSync(`${SA_DIR}/token`, 'utf8')}` },
+            },
+            (res) => {
+              let body = ''
+              res.on('data', (chunk) => (body += chunk))
+              res.on('end', () => {
+                if (res.statusCode !== 200) {
+                  return reject(new Error(`JWKS fetch failed with status ${res.statusCode}`))
+                }
+                resolve(JSON.parse(body))
+              })
+            }
+          )
+          .on('error', reject)
+      }),
+  },
+  // must match the `audiences` of the projected token mounted in the calling pods
+  audience: 'my-api',
+  // default issuer on kubeadm-based clusters; managed clusters use their own URL (see below)
+  issuer: 'https://kubernetes.default.svc.cluster.local',
+  getUserId: (payload) => payload.sub,
+}),
+```
+
+The issuer depends on your cluster: `https://kubernetes.default.svc.cluster.local` is the kubeadm default, while managed clusters use their own URL (e.g. `https://oidc.eks.<region>.amazonaws.com/id/<id>` on EKS, `https://container.googleapis.com/v1/projects/<project>/locations/<location>/clusters/<cluster>` on GKE). Check yours with:
+
+```bash
+kubectl get --raw /.well-known/openid-configuration
+```
+
+Legacy Secret-based ServiceAccount tokens (issuer `kubernetes/serviceaccount`, no expiration) are rejected by the `issuer` check.
+
+The calling pod mounts a projected token with that audience and sends it as a Bearer token:
+
+```yaml
+spec:
+  containers:
+    - name: my-client
+      volumeMounts:
+        - name: api-token
+          mountPath: /var/run/secrets/my-api
+          readOnly: true
+  volumes:
+    - name: api-token
+      projected:
+        sources:
+          - serviceAccountToken:
+              path: token
+              audience: my-api
+              expirationSeconds: 3600
+```
+
+The kubelet rotates this token before it expires, so the client must re-read `/var/run/secrets/my-api/token` on each request (or at least regularly) instead of caching it at startup.
+
+> [!NOTE]
+> Tokens are verified offline against the JWKS, not through the Kubernetes `TokenReview` API. A token stays valid until its `exp` even if the pod it was issued for has been deleted (up to `expirationSeconds`, minimum 600). Keep `expirationSeconds` short, or call `TokenReview` from your user provider if you need immediate revocation.
+
 ## Refresh Tokens
 
 To use refresh tokens, you have to set the `refreshTokenUserProvider` in the guard configuration, see the example above.
@@ -296,19 +437,74 @@ router.post('jwt/refresh', async ({ auth }) => {
   // this will authenticate the user using the refresh token
   // it will delete the old refresh token and generate a new one
   // it accepts an optional refresh token, otherwise it looks in:
-  // 1. request body 'refreshToken'
-  // 2. cookies (if enabled)
+  // 1. cookies (if useCookiesForRefreshToken is enabled)
+  // 2. request body, field named after refreshTokenName (never the query string)
   // 3. Authorization header
   return await auth.use('jwt').generateWithRefreshToken()
 })
 
-// to logout (revoke refresh token)
+// to logout (revoke refresh token and clear the guard cookies)
 router.post('logout', async ({ auth }) => {
   await auth.use('jwt').revoke()
   return { message: 'Logged out' }
 })
 ```
 
+After `authenticate()` or `generateWithRefreshToken()`, the access token of the request is available as `user.currentToken`, like `user.currentAccessToken` with the AdonisJS access tokens guard. After a refresh, it holds the new access token.
+
 ## Security
 
-We use natively the AdonisJS application key to sign the token, so you don't have to worry about it and [avoid this](https://trufflesecurity.com/blog/stop-recommending-jwts).
+When no `secret` is configured, the guard signs tokens with a key derived from the AdonisJS application key (HKDF-SHA256, salted with the guard name), so you don't have to manage a secret and [avoid this](https://trufflesecurity.com/blog/stop-recommending-jwts). The raw application key is never used to sign JWTs, so tokens signed elsewhere with the application key (e.g. password reset links) are not accepted as access tokens, and two JWT guards never accept each other's tokens. The application key must be at least 32 characters.
+
+> [!NOTE]
+> Tokens issued before this key derivation was introduced (signed with the raw application key) are no longer accepted: users have to log in again, or use their refresh token, which is stored in the database and stays valid.
+
+### Refresh token transport
+
+The guard reads the refresh token from these sources, in order:
+
+1. An `HttpOnly` cookie named after `refreshTokenName`, when `useCookiesForRefreshToken` is enabled.
+2. The request body, in a field named after `refreshTokenName` (`refreshToken` by default). This is how OAuth 2.0 transmits refresh tokens ([RFC 6749 §6](https://datatracker.ietf.org/doc/html/rfc6749#section-6)).
+3. The `Authorization: Bearer <token>` header.
+
+A refresh token passed in the query string is ignored, since URLs end up in access logs, browser history and `Referer` headers.
+
+> [!IMPORTANT]
+> **Breaking change in 1.0**: the body field used to be `refreshToken` whatever `refreshTokenName` was set to, and the body was read before the cookie. If you set a custom `refreshTokenName`, your clients must now send the token in a body field with that name.
+
+Which transport to pick:
+
+- **Browsers**: use cookies (`useCookiesForRefreshToken: true`). The token is stored in an `HttpOnly` + `Secure` cookie, out of reach of JavaScript and scoped by the `SameSite` policy.
+- **Mobile apps, CLIs and other API clients**: send the token in the request body or the `Authorization` header.
+
+> [!WARNING]
+> Make sure your logging middleware does not record request bodies or `Authorization` headers on authentication routes, otherwise refresh tokens end up in plain text in your logs.
+
+### Symmetric secret strength
+
+When using symmetric signing (HMAC), the `secret` must be **at least 32 characters** long. A shorter secret can be brute-forced offline once an attacker obtains a signed token.
+
+```
+// Too short — will throw at startup
+secret: 'mysecret'
+
+// Sufficient entropy
+secret: env.get('JWT_SECRET') // generate with: openssl rand -hex 32
+```
+
+Generate a strong secret with:
+
+```bash
+openssl rand -hex 32
+```
+
+### Access token revocation & Statelessness
+
+JWT access tokens are **stateless** — once issued, they are cryptographically validated without querying the database until their expiration time (`tokenExpiresIn`).
+
+Calling `auth.use('jwt').revoke()` invalidates the **refresh token** stored in the database, preventing attackers from generating *new* access tokens, and clears the access and refresh token cookies set by the guard (when `useCookies` / `useCookiesForRefreshToken` are enabled). However, any existing, unexpired access token will remain valid until `tokenExpiresIn` elapses.
+
+> [!TIP]
+> Keep `tokenExpiresIn` short (e.g. `15m` or `1h`) to limit the lifetime of issued access tokens, and rely on `generateWithRefreshToken()` to silently rotate tokens.
+
+

package/build/configure.d.ts

@@ -0,0 +1,2 @@
+import type ConfigureCommand from '@adonisjs/core/commands/configure';
+export declare function configure(command: ConfigureCommand): Promise<void>;

package/build/configure.js

@@ -0,0 +1,240 @@
+/*
+|--------------------------------------------------------------------------
+| Configure hook
+|--------------------------------------------------------------------------
+|
+| Called by "node ace configure @maximemrf/adonisjs-jwt" (and "node ace add").
+| Adds the jwt guard to config/auth.ts and, with refresh tokens, the
+| refreshTokens provider to the User model and the migration.
+|
+| Flags: --refresh-tokens / --no-refresh-tokens to skip the question.
+|
+*/
+import { existsSync, readdirSync } from 'node:fs';
+import { stubsRoot } from './stubs/main.js';
+const DOCS_URL = 'https://maximemrf.github.io/adonisjs-jwt';
+const MIGRATION_SUFFIX = '_create_jwt_refresh_tokens_table.ts';
+const GUARD = `jwtGuard({
+  provider: sessionUserProvider({
+    model: () => import('#models/user'),
+  }),
+})`;
+const GUARD_WITH_REFRESH_TOKENS = `jwtGuard({
+  provider: sessionUserProvider({
+    model: () => import('#models/user'),
+  }),
+  refreshTokenUserProvider: tokensUserProvider({
+    tokens: 'refreshTokens',
+    model: () => import('#models/user'),
+  }),
+  refreshTokenExpiresIn: '7d',
+})`;
+const refreshTokensProvider = (modelName) => `DbAccessTokensProvider.forModel(${modelName}, {
+  prefix: 'rt_',
+  table: 'jwt_refresh_tokens',
+  type: 'jwt_refresh_token',
+  tokenSecretLength: 40,
+})`;
+export async function configure(command) {
+    const authConfigPath = command.app.configPath('auth.ts');
+    if (!existsSync(authConfigPath)) {
+        command.logger.error('Cannot find "config/auth.ts". Run "node ace add @adonisjs/auth" first, then run this command again');
+        command.exitCode = 1;
+        return;
+    }
+    const refreshTokens = await useRefreshTokens(command);
+    const codemods = await command.createCodemods();
+    const project = await codemods.getTsMorphProject();
+    await addGuard(command, project, authConfigPath, refreshTokens);
+    if (refreshTokens) {
+        await addRefreshTokensToModel(command, project);
+        await createMigration(command, codemods);
+    }
+    command.logger.info('Next steps:');
+    if (refreshTokens) {
+        command.logger.log('  - Run "node ace migration:run" to create the jwt_refresh_tokens table');
+    }
+    command.logger.log(`  - Set default: 'jwt' in config/auth.ts, or use auth.use('jwt') in your routes`);
+    command.logger.log(`  - Add the login, refresh and logout routes: ${DOCS_URL}/guide/authentication`);
+}
+/**
+ * Read the --refresh-tokens / --no-refresh-tokens flag, or ask
+ */
+async function useRefreshTokens(command) {
+    const flag = command.parsedFlags['refresh-tokens'];
+    if (flag !== undefined) {
+        return flag === true || flag === 'true';
+    }
+    return command.prompt.confirm('Do you want to use refresh tokens?', { default: true });
+}
+/**
+ * Add the "jwt" guard to the guards of config/auth.ts
+ */
+async function addGuard(command, project, authConfigPath, refreshTokens) {
+    const action = command.logger.action('update config/auth.ts');
+    const guard = refreshTokens ? GUARD_WITH_REFRESH_TOKENS : GUARD;
+    const file = project ? getSourceFile(project, authConfigPath) : undefined;
+    const guards = file ? findGuardsObject(file) : undefined;
+    if (!file || !guards) {
+        action.skipped(`add this guard to config/auth.ts manually: jwt: ${guard}`);
+        return;
+    }
+    if (guards.getProperty('jwt')) {
+        action.skipped('a "jwt" guard already exists');
+        return;
+    }
+    addProperty(guards, `jwt: ${guard}`);
+    ensureNamedImport(file, '@maximemrf/adonisjs-jwt', 'jwtGuard');
+    ensureNamedImport(file, '@adonisjs/auth/session', 'sessionUserProvider');
+    if (refreshTokens) {
+        ensureNamedImport(file, '@adonisjs/auth/access_tokens', 'tokensUserProvider');
+    }
+    await file.save();
+    action.succeeded();
+}
+/**
+ * Add the static refreshTokens property to the User model
+ */
+async function addRefreshTokensToModel(command, project) {
+    const modelPath = command.app.modelsPath('user.ts');
+    const action = command.logger.action('update app/models/user.ts');
+    const file = project && existsSync(modelPath) ? getSourceFile(project, modelPath) : undefined;
+    const model = file ? findModel(file) : undefined;
+    if (!file || !model) {
+        action.skipped(`add this property to your User model manually: static refreshTokens = ${refreshTokensProvider('User')}`);
+        return;
+    }
+    if (model.getStaticProperty('refreshTokens')) {
+        action.skipped('the model already has a "refreshTokens" property');
+        return;
+    }
+    addClassMember(model, `static refreshTokens = ${refreshTokensProvider(model.getName() ?? 'User')}${semicolon(file)}`);
+    ensureNamedImport(file, '@adonisjs/auth/access_tokens', 'DbAccessTokensProvider');
+    await file.save();
+    action.succeeded();
+}
+/**
+ * Create the migration of the jwt_refresh_tokens table, unless it exists
+ */
+async function createMigration(command, codemods) {
+    const migrationsPath = command.app.migrationsPath();
+    const existing = existsSync(migrationsPath)
+        ? readdirSync(migrationsPath).find((file) => file.endsWith(MIGRATION_SUFFIX))
+        : undefined;
+    if (existing) {
+        command.logger
+            .action(`create database/migrations/${existing}`)
+            .skipped('the migration already exists');
+        return;
+    }
+    await codemods.makeUsingStub(stubsRoot, 'migration.stub', {
+        entity: {
+            filename: `${Date.now()}${MIGRATION_SUFFIX}`,
+        },
+    });
+}
+function getSourceFile(project, path) {
+    return project.getSourceFile(path) ?? project.addSourceFileAtPath(path);
+}
+/**
+ * Find the object literal of `defineConfig({ guards: { ... } })`
+ */
+function findGuardsObject(file) {
+    const call = file
+        .getDescendants()
+        .find((node) => node.getKindName() === 'CallExpression' &&
+        node.getExpression().getText() === 'defineConfig');
+    const config = call?.getArguments()[0];
+    if (config?.getKindName() !== 'ObjectLiteralExpression') {
+        return;
+    }
+    const guards = config.getProperty('guards');
+    if (guards?.getKindName() !== 'PropertyAssignment') {
+        return;
+    }
+    const initializer = guards.getInitializer();
+    if (initializer?.getKindName() !== 'ObjectLiteralExpression') {
+        return;
+    }
+    return initializer;
+}
+/**
+ * The default exported class of the file, or the class named User
+ */
+function findModel(file) {
+    const classes = file.getClasses();
+    return (classes.find((cls) => cls.isDefaultExport()) ?? classes.find((cls) => cls.getName() === 'User'));
+}
+/**
+ * The edits below insert text rather than ts-morph structures, to keep the
+ * indentation, trailing commas and semicolons style of the user's files
+ */
+function semicolon(file) {
+    return file.getStatements()[0]?.getText().trimEnd().endsWith(';') ? ';' : '';
+}
+/**
+ * Leading whitespace of the line containing the given position
+ */
+function lineIndentation(file, position) {
+    const text = file.getFullText();
+    const lineStart = text.lastIndexOf('\n', position - 1) + 1;
+    return text.slice(lineStart).match(/^[ \t]*/)[0];
+}
+/**
+ * Indent every line but the first one
+ */
+function indent(code, indentation) {
+    return code.replaceAll('\n', `\n${indentation}`);
+}
+/**
+ * Add a property after the last property of an object literal
+ */
+function addProperty(object, property) {
+    const file = object.getSourceFile();
+    const last = object.getProperties().at(-1);
+    if (!last) {
+        const baseIndentation = lineIndentation(file, object.getStart());
+        const indentation = `${baseIndentation}  `;
+        file.replaceText([object.getStart(), object.getEnd()], `{\n${indentation}${indent(property, indentation)},\n${baseIndentation}}`);
+        return;
+    }
+    const indentation = lineIndentation(file, last.getStart());
+    const text = file.getFullText();
+    const hasTrailingComma = text.slice(last.getEnd()).trimStart().startsWith(',');
+    const position = hasTrailingComma ? text.indexOf(',', last.getEnd()) + 1 : last.getEnd();
+    file.insertText(position, `${hasTrailingComma ? '' : ','}\n${indentation}${indent(property, indentation)},`);
+}
+/**
+ * Add a member at the end of a class body
+ */
+function addClassMember(cls, member) {
+    const file = cls.getSourceFile();
+    const last = cls.getMembers().at(-1);
+    if (!last) {
+        const closingBrace = cls.getEnd() - 1;
+        const openingBrace = file.getFullText().lastIndexOf('{', closingBrace);
+        const baseIndentation = lineIndentation(file, cls.getStart());
+        const indentation = `${baseIndentation}  `;
+        file.replaceText([openingBrace, closingBrace + 1], `{\n${indentation}${indent(member, indentation)}\n${baseIndentation}}`);
+        return;
+    }
+    const indentation = lineIndentation(file, last.getStart());
+    file.insertText(last.getEnd(), `\n\n${indentation}${indent(member, indentation)}`);
+}
+function ensureNamedImport(file, moduleSpecifier, name) {
+    const declaration = file.getImportDeclaration((node) => node.getModuleSpecifierValue() === moduleSpecifier && !node.isTypeOnly());
+    if (declaration) {
+        if (!declaration.getNamedImports().some((namedImport) => namedImport.getName() === name)) {
+            declaration.addNamedImport(name);
+        }
+        return;
+    }
+    const statement = `import { ${name} } from '${moduleSpecifier}'${semicolon(file)}`;
+    const lastImport = file.getImportDeclarations().at(-1);
+    if (lastImport) {
+        file.insertText(lastImport.getEnd(), `\n${statement}`);
+    }
+    else {
+        file.insertText(0, `${statement}\n\n`);
+    }
+}

package/build/index.d.ts

@@ -1 +1,4 @@
 export { configure } from './configure.js';
+export { jwtGuard } from './src/define_config.js';
+export { JwtGuard } from './src/guard.js';
+export { DEFAULT_TOKEN_EXPIRES_IN } from './src/types.js';

package/build/index.js

@@ -7,3 +7,6 @@
 |
 */
 export { configure } from './configure.js';
+export { jwtGuard } from './src/define_config.js';
+export { JwtGuard } from './src/guard.js';
+export { DEFAULT_TOKEN_EXPIRES_IN } from './src/types.js';

package/build/src/define_config.d.ts

@@ -1,7 +1,8 @@
+import type { symbols } from '@adonisjs/auth';
 import type { GuardConfigProvider } from '@adonisjs/auth/types';
 import type { HttpContext } from '@adonisjs/core/http';
-import type { JwtAsymmetricAlgorithm, JwtGuardUser, JwtUserProviderContract, JwtCookieOptions } from './types.js';
-import { JwtGuard } from './jwt.js';
+import type { JwtAsymmetricAlgorithm, JwtGuardUser, JwtUserProviderContract, JwtCookieOptions, BaseJwtContent, JwtJwksAlgorithm, JwtGetUserId, JwtVerifyPayload } from './types.js';
+import { JwtGuard } from './guard.js';
 import type { StringValue } from 'ms';
 import type { AccessTokensUserProviderContract } from '@adonisjs/auth/types/access_tokens';
 import type { Options } from 'jwks-rsa';
@@ -9,6 +10,7 @@ export declare function jwtGuard<UserProvider extends JwtUserProviderContract<un
     provider: UserProvider;
     refreshTokenUserProvider?: AccessTokensUserProviderContract<unknown>;
     tokenName?: string;
+    refreshTokenName?: string;
     tokenExpiresIn?: number | StringValue;
     refreshTokenExpiresIn?: number | StringValue;
     useCookies?: boolean;
@@ -18,7 +20,13 @@ export declare function jwtGuard<UserProvider extends JwtUserProviderContract<un
     privateKey?: string;
     publicKey?: string;
     algorithm?: JwtAsymmetricAlgorithm;
-    content: <T>(user: JwtGuardUser<T>) => Record<string | number, any>;
+    content?: (user: JwtGuardUser<UserProvider[typeof symbols.PROVIDER_REAL_USER]>) => Record<string, any> & BaseJwtContent;
     jwks?: Options;
     cookie?: JwtCookieOptions;
+    issuer?: string;
+    audience?: string | string[];
+    algorithms?: JwtJwksAlgorithm[];
+    clockTolerance?: number;
+    getUserId?: JwtGetUserId;
+    verifyPayload?: JwtVerifyPayload;
 }): GuardConfigProvider<(ctx: HttpContext) => JwtGuard<UserProvider>>;