@maximemrf/adonisjs-jwt 0.9.0 → 1.0.0-rc.2

package/build/src/{jwt.js → guard.js}

@@ -1,8 +1,8 @@
 import { errors } from '@adonisjs/auth';
-import jwt from 'jsonwebtoken';
+import { DEFAULT_TOKEN_EXPIRES_IN, } from './types.js';
 import { Secret } from '@adonisjs/core/helpers';
-import { JwksManager } from './jwks.js';
-import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { validateGuardOptions } from './validation.js';
+import { resolveDriver } from './driver_resolver.js';
 export class JwtGuard {
     #ctx;
     #userProvider;
@@ -10,7 +10,7 @@ export class JwtGuard {
     #options;
     #tokenName;
     #refreshTokenName = 'refreshToken';
-    #jwksManager;
+    #driver;
     #cookieOptions;
     constructor(ctx, userProvider, option) {
         this.#ctx = ctx;
@@ -20,85 +20,45 @@ export class JwtGuard {
         if (!this.#options.content)
             this.#options.content = (user) => ({ userId: user.getId() });
         this.#tokenName = this.#options.tokenName ?? 'token';
-        this.#jwksManager = this.#options.jwks ? new JwksManager(this.#options.jwks) : undefined;
+        this.#refreshTokenName = this.#options.refreshTokenName ?? 'refreshToken';
+        /**
+         * Never issue access tokens without an expiration
+         */
+        this.#options.tokenExpiresIn = this.#options.tokenExpiresIn ?? DEFAULT_TOKEN_EXPIRES_IN;
         this.#cookieOptions = {
             httpOnly: true,
             secure: true,
             ...this.#options.cookie,
         };
-        const asymmetricPartial = this.#options.privateKey !== undefined ||
-            this.#options.publicKey !== undefined ||
-            this.#options.algorithm !== undefined;
-        if (asymmetricPartial && !this.#usesAsymmetric()) {
-            throw new Error('JwtGuard asymmetric mode requires `privateKey`, `publicKey`, and `algorithm` to be set together');
-        }
-        if (this.#options.jwks && this.#usesAsymmetric()) {
-            throw new Error('JwtGuard cannot use `jwks` together with asymmetric `privateKey` / `publicKey`');
-        }
-        if (!this.#options.jwks && !this.#usesAsymmetric() && !this.#options.secret) {
-            throw new Error('JwtGuard requires `secret` (symmetric), or `privateKey` + `publicKey` + `algorithm` (asymmetric), or `jwks`');
-        }
-        if (this.#usesAsymmetric()) {
-            this.#assertAsymmetricKeyMatchesAlgorithm();
-        }
-    }
-    #usesAsymmetric() {
-        return (this.#options.privateKey !== undefined &&
-            this.#options.publicKey !== undefined &&
-            this.#options.algorithm !== undefined);
-    }
-    #assertAsymmetricKeyMatchesAlgorithm() {
-        const algorithm = this.#options.algorithm;
-        const expectedKeyType = algorithm.startsWith('RS')
-            ? 'rsa'
-            : algorithm.startsWith('ES')
-                ? 'ec'
-                : null;
-        if (!expectedKeyType) {
-            throw new Error(`Unsupported asymmetric algorithm "${algorithm}"`);
-        }
-        try {
-            const privateKey = createPrivateKey(this.#options.privateKey);
-            const publicKey = createPublicKey(this.#options.publicKey);
-            if (privateKey.asymmetricKeyType !== expectedKeyType) {
-                throw new Error(`privateKey type "${privateKey.asymmetricKeyType}" does not match algorithm "${algorithm}"`);
-            }
-            if (publicKey.asymmetricKeyType !== expectedKeyType) {
-                throw new Error(`publicKey type "${publicKey.asymmetricKeyType}" does not match algorithm "${algorithm}"`);
-            }
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : 'Invalid asymmetric key configuration';
-            throw new Error(`JwtGuard asymmetric key validation failed: ${message}`);
-        }
+        validateGuardOptions(this.#options, 'JwtGuard');
+        this.#driver = resolveDriver(this.#options, 'JwtGuard');
     }
     #signAccessToken(payload) {
-        const expires = this.#options.expiresIn ? { expiresIn: this.#options.expiresIn } : {};
-        if (this.#usesAsymmetric()) {
-            return jwt.sign(payload, this.#options.privateKey, {
-                ...expires,
-                algorithm: this.#options.algorithm,
-            });
-        }
-        return jwt.sign(payload, this.#options.secret, expires);
+        return this.#driver.sign(payload, { expiresIn: this.#options.tokenExpiresIn });
     }
     async #verifyAccessToken(token) {
-        if (this.#jwksManager) {
-            const decoded = jwt.decode(token, { complete: true });
-            if (!decoded || !decoded.header || !decoded.header.kid) {
-                throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
-                    guardDriverName: this.driverName,
-                });
+        return this.#driver.verify(token);
+    }
+    #extractToken() {
+        /**
+         * The header is set explicitly by the client, so it takes precedence
+         * over the cookie, which the browser sends on every request (a stale
+         * cookie must not shadow a valid bearer token)
+         */
+        const authHeader = this.#ctx.request.header('authorization');
+        if (authHeader && authHeader.toLowerCase().startsWith('bearer ')) {
+            const headerToken = authHeader.slice(7).trim();
+            if (headerToken) {
+                return headerToken;
             }
-            const key = await this.#jwksManager.getSigningKey(decoded.header.kid);
-            return jwt.verify(token, key);
         }
-        if (this.#usesAsymmetric()) {
-            return jwt.verify(token, this.#options.publicKey, {
-                algorithms: [this.#options.algorithm],
-            });
+        if (this.#options.useCookies) {
+            const cookieToken = this.#ctx.request.cookie(this.#tokenName);
+            if (cookieToken) {
+                return cookieToken;
+            }
         }
-        return jwt.verify(token, this.#options.secret);
+        return undefined;
     }
     /**
      * A unique name for the guard driver
@@ -122,7 +82,7 @@ export class JwtGuard {
      * Generate a JWT token for a given user.
      */
     async generate(user) {
-        if (this.#options.jwks) {
+        if (!this.#driver.canSign) {
             throw new errors.E_UNAUTHORIZED_ACCESS("You can't use the auth.generate method with jwks", {
                 guardDriverName: this.driverName,
             });
@@ -142,7 +102,7 @@ export class JwtGuard {
         if (this.#options.useCookies) {
             this.#ctx.response.cookie(`${this.#tokenName}`, token, {
                 ...this.#cookieOptions,
-                maxAge: this.#options.expiresIn,
+                maxAge: this.#options.tokenExpiresIn,
             });
         }
         if (this.#options.useCookiesForRefreshToken && refreshToken) {
@@ -154,7 +114,7 @@ export class JwtGuard {
         return {
             type: 'bearer',
             token: token,
-            expiresIn: this.#options.expiresIn,
+            expiresIn: this.#options.tokenExpiresIn,
             refreshToken: refreshToken,
             refreshTokenExpiresIn: this.#options.refreshTokenExpiresIn,
         };
@@ -174,32 +134,13 @@ export class JwtGuard {
         }
         this.authenticationAttempted = true;
         /**
-         * Try to read the token from the cookies.
-         */
-        let token = this.#ctx.request.cookie(`${this.#tokenName}`);
-        /**
-         * If token is missing on cookies, then try to read it from the header authorization
+         * Read the token from the Authorization header or the cookie
          */
+        const token = this.#extractToken();
         if (!token) {
-            /**
-             * Ensure the auth header exists
-             */
-            const authHeader = this.#ctx.request.header('authorization');
-            if (!authHeader) {
-                throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
-                    guardDriverName: this.driverName,
-                });
-            }
-            /**
-             * Split the header value and read the token from it
-             */
-            ;
-            [, token] = authHeader.split('Bearer ');
-            if (!token) {
-                throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
-                    guardDriverName: this.driverName,
-                });
-            }
+            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                guardDriverName: this.driverName,
+            });
         }
         /**
          * Verify token
@@ -213,7 +154,19 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
-        if (!payload || typeof payload !== 'object' || !('userId' in payload)) {
+        if (!payload || typeof payload !== 'object') {
+            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                guardDriverName: this.driverName,
+            });
+        }
+        if (this.#options.verifyPayload && !(await this.#options.verifyPayload(payload))) {
+            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                guardDriverName: this.driverName,
+            });
+        }
+        const getUserId = this.#options.getUserId ?? ((claims) => claims.userId);
+        const userId = getUserId(payload);
+        if (userId === undefined || userId === null) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });
@@ -221,7 +174,7 @@ export class JwtGuard {
         /**
          * Fetch the user by user ID and save a reference to it
          */
-        const providerUser = await this.#userProvider.findById(payload.userId);
+        const providerUser = await this.#userProvider.findById(userId);
         if (!providerUser) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
@@ -234,7 +187,7 @@ export class JwtGuard {
     }
     async generateWithRefreshToken(refreshToken) {
         this.authenticationAttempted = true;
-        if (this.#options.jwks) {
+        if (!this.#driver.canSign) {
             throw new errors.E_UNAUTHORIZED_ACCESS('JWKS is not supported for refresh token', {
                 guardDriverName: this.driverName,
             });
@@ -253,6 +206,16 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
+        /**
+         * When refresh token abilities are configured, reject tokens that
+         * don't have all of them (e.g. an API token from another provider)
+         */
+        const requiredAbilities = this.#options.refreshTokenAbilities ?? [];
+        if (!requiredAbilities.every((ability) => accessToken.allows(ability))) {
+            throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
+                guardDriverName: this.driverName,
+            });
+        }
         /**
          * Fetch the user by user ID
          */
@@ -262,10 +225,9 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
-        this.isAuthenticated = true;
-        this.user = providerUser.getOriginal();
         /**
-         * Delete the refresh token from the database
+         * Delete the refresh token from the database. Only one of two concurrent
+         * requests using the same refresh token can delete it
          */
         const isDeleted = await this.#refreshTokenUserProvider.invalidateToken(new Secret(refreshToken));
         if (!isDeleted) {
@@ -273,19 +235,38 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
-        return this.generate(this.user);
+        const user = providerUser.getOriginal();
+        const result = await this.generate(user);
+        /**
+         * Like after `authenticate()`, `currentToken` holds the access token
+         * of the request, here the one that has just been issued
+         */
+        this.isAuthenticated = true;
+        this.user = user;
+        this.user.currentToken = result.token;
+        /**
+         * The guard has a refresh token provider, so `generate()` issued a refresh token
+         */
+        return result;
     }
     async #findRefreshToken() {
-        const bodyToken = this.#ctx.request.input('refreshToken');
-        if (bodyToken) {
-            return bodyToken;
-        }
+        /**
+         * The cookie is the configured transport, so it takes precedence
+         */
         if (this.#options.useCookiesForRefreshToken) {
             const cookieToken = this.#ctx.request.cookie(this.#refreshTokenName);
             if (cookieToken) {
                 return cookieToken;
             }
         }
+        /**
+         * Only read the request body: a refresh token passed in the
+         * query string would end up in access logs and Referer headers
+         */
+        const bodyToken = this.#ctx.request.body()[this.#refreshTokenName];
+        if (typeof bodyToken === 'string' && bodyToken) {
+            return bodyToken;
+        }
         const authHeader = this.#ctx.request.header('authorization');
         if (authHeader) {
             if (authHeader.toLowerCase().startsWith('bearer ')) {
@@ -308,6 +289,7 @@ export class JwtGuard {
                 guardDriverName: this.driverName,
             });
         }
+        this.#clearCookies();
         if (!refreshToken) {
             try {
                 refreshToken = await this.#findRefreshToken();
@@ -318,6 +300,17 @@ export class JwtGuard {
         }
         await this.#refreshTokenUserProvider.invalidateToken(new Secret(refreshToken));
     }
+    /**
+     * Remove the access and refresh token cookies set by the guard
+     */
+    #clearCookies() {
+        if (this.#options.useCookies) {
+            this.#ctx.response.clearCookie(this.#tokenName, this.#cookieOptions);
+        }
+        if (this.#options.useCookiesForRefreshToken) {
+            this.#ctx.response.clearCookie(this.#refreshTokenName, this.#cookieOptions);
+        }
+    }
     /**
      * Same as authenticate, but does not throw an exception
      */

package/build/src/types.d.ts

@@ -3,6 +3,7 @@ import type { StringValue } from 'ms';
 import type { AccessTokensUserProviderContract } from '@adonisjs/auth/types/access_tokens';
 import type { Options } from 'jwks-rsa';
 import type { CookieOptions } from '@adonisjs/core/types/http';
+import type { JwtDriver } from './drivers/types.js';
 export type JwtCookieOptions = Omit<Partial<CookieOptions>, 'maxAge' | 'expires'>;
 /**
  * The bridge between the User provider and the
@@ -41,12 +42,39 @@ export interface JwtUserProviderContract<RealUser> {
 export type BaseJwtContent = {
     userId: string | number | BigInt;
 };
+/**
+ * Lifetime of access tokens when `tokenExpiresIn` is not configured
+ */
+export declare const DEFAULT_TOKEN_EXPIRES_IN = "1h";
+export declare const ALLOWED_SYMMETRIC_ALGORITHMS: readonly ["HS256", "HS384", "HS512"];
+export type JwtSymmetricAlgorithm = (typeof ALLOWED_SYMMETRIC_ALGORITHMS)[number];
+export declare const ALLOWED_ASYMMETRIC_ALGORITHMS: readonly ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512"];
 /**
  * Algorithms supported for asymmetric (RSA / ECDSA) JWT signing and verification.
  * Use with `privateKey` + `publicKey` so access tokens can be verified elsewhere with only the public key.
  */
-export type JwtAsymmetricAlgorithm = 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512';
+export type JwtAsymmetricAlgorithm = (typeof ALLOWED_ASYMMETRIC_ALGORITHMS)[number];
+export declare const ALLOWED_JWKS_ALGORITHMS: readonly ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256", "PS384", "PS512"];
+export type JwtJwksAlgorithm = (typeof ALLOWED_JWKS_ALGORITHMS)[number];
+/**
+ * `refreshToken` is a string when the guard has a `refreshTokenUserProvider`
+ */
+export type JwtGenerateResult<WithRefreshToken extends boolean = boolean> = {
+    type: string;
+    token: string;
+    expiresIn?: number | StringValue;
+    refreshTokenExpiresIn?: number | StringValue;
+} & ([WithRefreshToken] extends [true] ? {
+    refreshToken: string;
+} : {
+    refreshToken?: string;
+});
 export type JwtGuardOptions<RealUser extends any = unknown> = {
+    /**
+     * Driver resolved by `jwtGuard()`. Not part of the public API: custom
+     * drivers are not supported and the `JwtDriver` interface may change.
+     */
+    driver?: JwtDriver;
     /**
      * Symmetric signing secret (HMAC). Used when asymmetric keys are not set.
      */
@@ -66,11 +94,55 @@ export type JwtGuardOptions<RealUser extends any = unknown> = {
     jwks?: Options;
     refreshTokenUserProvider?: AccessTokensUserProviderContract<RealUser>;
     tokenName?: string;
-    expiresIn?: number | StringValue;
+    /**
+     * Name of the refresh token cookie and request body field.
+     * Defaults to `refreshToken`.
+     */
+    refreshTokenName?: string;
+    /**
+     * Lifetime of access tokens. Defaults to `DEFAULT_TOKEN_EXPIRES_IN`.
+     */
+    tokenExpiresIn?: number | StringValue;
     refreshTokenExpiresIn?: number | StringValue;
     useCookies?: boolean;
     useCookiesForRefreshToken?: boolean;
+    /**
+     * Abilities given to refresh tokens. When set, `generateWithRefreshToken`
+     * rejects refresh tokens that don't have all of them.
+     */
     refreshTokenAbilities?: string[];
     cookie?: JwtCookieOptions;
-    content?: (user: JwtGuardUser<RealUser>) => Record<string, any>;
+    content?: (user: JwtGuardUser<RealUser>) => Record<string, any> & BaseJwtContent;
+    /**
+     * Expected JWT issuer (iss). Validated during token verification.
+     * Required in JWKS mode.
+     */
+    issuer?: string;
+    /**
+     * Expected JWT audience (aud). Validated during token verification.
+     * Required in JWKS mode, unless `verifyPayload` is set.
+     */
+    audience?: string | string[];
+    /**
+     * Algorithms accepted when verifying tokens in JWKS mode.
+     * Must be a non-empty subset of `ALLOWED_JWKS_ALGORITHMS` (default: all of them).
+     */
+    algorithms?: JwtJwksAlgorithm[];
+    /**
+     * Number of seconds of clock skew tolerated when checking `exp` / `nbf`.
+     */
+    clockTolerance?: number;
+    /**
+     * Extract the user id from a verified token payload.
+     * Defaults to `payload.userId`. Use e.g. `(payload) => payload.sub` for external providers.
+     */
+    getUserId?: JwtGetUserId;
+    /**
+     * Extra check on a verified token payload, run before looking up the user.
+     * Return `false` to reject the token. Use it to check claims other than
+     * `iss` and `aud`, e.g. `client_id` and `token_use` for Amazon Cognito.
+     */
+    verifyPayload?: JwtVerifyPayload;
 };
+export type JwtVerifyPayload = (payload: Record<string, any>) => boolean | Promise<boolean>;
+export type JwtGetUserId = (payload: Record<string, any>) => string | number | BigInt | undefined | null;

package/build/src/types.js

@@ -1 +1,19 @@
-export {};
+/**
+ * Lifetime of access tokens when `tokenExpiresIn` is not configured
+ */
+export const DEFAULT_TOKEN_EXPIRES_IN = '1h';
+export const ALLOWED_SYMMETRIC_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
+export const ALLOWED_ASYMMETRIC_ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'ES256',
+    'ES384',
+    'ES512',
+];
+export const ALLOWED_JWKS_ALGORITHMS = [
+    ...ALLOWED_ASYMMETRIC_ALGORITHMS,
+    'PS256',
+    'PS384',
+    'PS512',
+];

package/build/src/validation.d.ts

@@ -0,0 +1,2 @@
+import type { JwtGuardOptions } from './types.js';
+export declare function validateGuardOptions(options: JwtGuardOptions, prefix?: string): void;

package/build/src/validation.js

@@ -0,0 +1,24 @@
+export function validateGuardOptions(options, prefix = 'JwtGuard') {
+    if (typeof options.tokenExpiresIn === 'number' &&
+        !(Number.isFinite(options.tokenExpiresIn) && options.tokenExpiresIn > 0)) {
+        throw new Error(`${prefix} \`tokenExpiresIn\` must be a positive number of seconds`);
+    }
+    if (options.driver) {
+        return;
+    }
+    const asymmetricPartial = options.privateKey !== undefined ||
+        options.publicKey !== undefined ||
+        options.algorithm !== undefined;
+    const usesAsymmetric = options.privateKey !== undefined &&
+        options.publicKey !== undefined &&
+        options.algorithm !== undefined;
+    if (asymmetricPartial && !usesAsymmetric) {
+        throw new Error(`${prefix} asymmetric mode requires \`privateKey\`, \`publicKey\`, and \`algorithm\` to be set together`);
+    }
+    if (options.jwks && usesAsymmetric) {
+        throw new Error(`${prefix} cannot use \`jwks\` together with asymmetric \`privateKey\` / \`publicKey\``);
+    }
+    if (!options.jwks && !usesAsymmetric && !options.secret) {
+        throw new Error(`${prefix} requires \`secret\` (symmetric), or \`privateKey\` + \`publicKey\` + \`algorithm\` (asymmetric), or \`jwks\``);
+    }
+}

package/build/stubs/main.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Path to the root directory where stubs are stored.
+ */
+export declare const stubsRoot: string;

package/build/stubs/main.js

@@ -0,0 +1,5 @@
+import { fileURLToPath } from 'node:url';
+/**
+ * Path to the root directory where stubs are stored.
+ */
+export const stubsRoot = fileURLToPath(new URL('./', import.meta.url));

package/build/stubs/migration.stub

@@ -0,0 +1,35 @@
+{{{
+  exports({
+    to: app.makePath('database/migrations', entity.filename)
+  })
+}}}
+import { BaseSchema } from '@adonisjs/lucid/schema'
+
+export default class extends BaseSchema {
+  protected tableName = 'jwt_refresh_tokens'
+
+  async up() {
+    this.schema.createTable(this.tableName, (table) => {
+      table.increments()
+      table
+        .integer('tokenable_id')
+        .notNullable()
+        .unsigned()
+        .references('id')
+        .inTable('users')
+        .onDelete('CASCADE')
+      table.string('type').notNullable()
+      table.string('name').nullable()
+      table.string('hash', 80).notNullable()
+      table.text('abilities').notNullable()
+      table.timestamp('created_at', { precision: 6, useTz: true }).notNullable()
+      table.timestamp('updated_at', { precision: 6, useTz: true }).notNullable()
+      table.timestamp('expires_at', { precision: 6, useTz: true }).nullable()
+      table.timestamp('last_used_at', { precision: 6, useTz: true }).nullable()
+    })
+  }
+
+  async down() {
+    this.schema.dropTable(this.tableName)
+  }
+}

package/package.json

@@ -1,26 +1,26 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
-  "description": "Adonisjs v6 package for authentication with jwt token",
-  "version": "0.9.0",
+  "description": "AdonisJS package for authentication with JWT tokens",
+  "version": "1.0.0-rc.2",
   "engines": {
-    "node": ">=20.6.0"
+    "node": ">=24.0.0"
   },
   "type": "module",
+  "main": "./build/index.js",
+  "types": "./build/index.d.ts",
   "files": [
     "build/src",
     "build/stubs",
     "build/index.d.ts",
-    "build/index.js"
+    "build/index.js",
+    "build/configure.d.ts",
+    "build/configure.js"
   ],
   "exports": {
     ".": "./build/index.js",
     "./types": "./build/src/types.js",
-    "./jwt_config": "./build/src/define_config.js"
-  },
-  "imports": {
-    "#generated/*": "./.adonisjs/server/*.js",
-    "#transformers/*": "./app/transformers/*.js",
-    "#database/*": "./database/*.js"
+    "./jwt_config": "./build/src/define_config.js",
+    "./stubs": "./build/stubs/main.js"
   },
   "scripts": {
     "prepare": "tsc && npm run copy:templates",
@@ -40,39 +40,40 @@
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {
-    "@adonisjs/assembler": "^8.2.0",
-    "@adonisjs/auth": "^10.0.0",
-    "@adonisjs/core": "^7.1.1",
-    "@adonisjs/eslint-config": "^3.0.0",
-    "@adonisjs/lucid": "^22.2.0",
-    "@adonisjs/prettier-config": "^1.4.5",
+    "@adonisjs/assembler": "^8.4.0",
+    "@adonisjs/auth": "^10.1.0",
+    "@adonisjs/core": "^7.3.5",
+    "@adonisjs/eslint-config": "^3.1.0",
+    "@adonisjs/lucid": "^22.4.2",
+    "@adonisjs/prettier-config": "^1.5.0",
     "@adonisjs/tsconfig": "^2.0.0",
     "@japa/assert": "^4.2.0",
     "@japa/file-system": "^3.0.0",
     "@japa/runner": "^5.3.0",
     "@poppinss/ts-exec": "^1.4.4",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/nock": "^11.1.0",
-    "@types/node": "^22.15.18",
+    "@types/node": "^24.19.2",
     "c8": "^11.0.0",
     "copyfiles": "^2.4.1",
     "del-cli": "^7.0.0",
-    "eslint": "^9.39.4",
+    "eslint": "^9.39.5",
     "luxon": "^3.7.2",
-    "nock": "^14.0.11",
-    "np": "^11.0.2",
-    "prettier": "^3.8.1",
+    "nock": "^14.0.16",
+    "np": "^11.2.2",
+    "prettier": "^3.9.6",
     "sqlite3": "^6.0.1",
     "timekeeper": "^2.3.1",
-    "typescript": "~5.9.3",
-    "youch": "^4.1.0"
+    "typescript": "~6.0.3",
+    "youch": "^4.1.1"
   },
   "dependencies": {
-    "@types/jsonwebtoken": "^9.0.10",
     "jsonwebtoken": "^9.0.3",
-    "jwks-rsa": "^4.0.1",
+    "jwks-rsa": "^4.1.0",
     "ms": "^2.1.3"
   },
   "peerDependencies": {
+    "@adonisjs/auth": "^10.1.0",
     "@adonisjs/core": "^7.0.1"
   },
   "author": "MaximeMRF",
@@ -116,4 +117,4 @@
       "tests/**"
     ]
   }
-}
+}