@maximemrf/adonisjs-jwt 1.0.0-rc.6 → 1.0.0-rc.7

package/build/src/define_config.js

@@ -43,6 +43,7 @@ export function jwtGuard(config) {
      * the first request, when the app would already be serving traffic.
      */
     validateLifetimes(options, PREFIX);
+    validateSigningMethod(options, PREFIX, { usesAppKey });
     let driver;
     if (usesAppKey) {
         /**
@@ -53,7 +54,6 @@ export function jwtGuard(config) {
             assertAppKey(process.env.APP_KEY);
     }
     else {
-        validateSigningMethod(options, PREFIX);
         driver = resolveDriver(options, PREFIX);
     }
     return {

package/build/src/guard.js

@@ -107,6 +107,7 @@ export class JwtGuard {
         }
         const providerUser = await this.#userProvider.createUserForGuard(user);
         const signPayload = this.#options.content(providerUser);
+        assertNoGuardClaims(signPayload, this.#options);
         const token = this.#signAccessToken(signPayload);
         let refreshToken;
         if (this.#refreshTokenUserProvider) {
@@ -407,6 +408,23 @@ export class JwtGuard {
     }
 }
 const REFRESH_TOKENS_NOT_CONFIGURED = 'JWT guard refresh tokens are not configured: set `refreshTokenUserProvider` in the guard config';
+/**
+ * The guard sets `exp`, and `iss` / `aud` when `issuer` / `audience` are
+ * configured. jsonwebtoken refuses a payload that sets them too, with a
+ * message about its own options (`options.expiresIn`) that the app never set.
+ */
+function assertNoGuardClaims(payload, options) {
+    const conflicts = [['exp', 'tokenExpiresIn']];
+    if (options.issuer)
+        conflicts.push(['iss', 'issuer']);
+    if (options.audience)
+        conflicts.push(['aud', 'audience']);
+    for (const [claim, option] of conflicts) {
+        if (payload[claim] !== undefined) {
+            throw new RuntimeException(`JWT guard \`content\` must not set \`${claim}\`: the guard sets it from \`${option}\``);
+        }
+    }
+}
 function isUserId(value) {
     return ((typeof value === 'string' && value !== '') ||
         (typeof value === 'number' && Number.isFinite(value)) ||

package/build/src/types.d.ts

@@ -135,6 +135,13 @@ type JwtSharedOptions = {
      */
     verifyPayload?: JwtVerifyPayload;
 };
+/**
+ * Claims set by the guard: `exp` comes from `tokenExpiresIn`, so `content`
+ * must not set it
+ */
+type GuardClaims = {
+    exp?: never;
+};
 /**
  * `content` builds the payload of the access tokens. Without `getUserId`,
  * the guard reads the user id from the `userId` claim, so `content` must
@@ -146,14 +153,14 @@ export type JwtContentOptions<RealUser> = {
      * Defaults to `payload.userId`. Use e.g. `(payload) => payload.sub` for external providers.
      */
     getUserId?: undefined;
-    content?: (user: JwtGuardUser<RealUser>) => Record<string, any> & BaseJwtContent;
+    content?: (user: JwtGuardUser<RealUser>) => Record<string, any> & BaseJwtContent & GuardClaims;
 } | {
     /**
      * Extract the user id from a verified token payload.
      * Defaults to `payload.userId`. Use e.g. `(payload) => payload.sub` for external providers.
      */
     getUserId: JwtGetUserId;
-    content?: (user: JwtGuardUser<RealUser>) => Record<string, any>;
+    content?: (user: JwtGuardUser<RealUser>) => Record<string, any> & GuardClaims;
 };
 /**
  * Options of the `JwtGuard` constructor

package/build/src/validation.d.ts

@@ -10,7 +10,9 @@ export declare function validateLifetimes(options: Pick<JwtGuardOptions, 'tokenE
 /**
  * Exactly one signing method: a secret, an asymmetric key pair, or a JWKS endpoint
  */
-export declare function validateSigningMethod(options: ReleasedSecrets<JwtGuardOptions>, prefix: string): void;
+export declare function validateSigningMethod(options: ReleasedSecrets<JwtGuardOptions>, prefix: string, { usesAppKey }?: {
+    usesAppKey?: boolean;
+}): void;
 /**
  * Accept `Secret` values (`Env.schema.secret()` in AdonisJS v7) for the
  * signing keys, and work with their string value

package/build/src/validation.js

@@ -44,7 +44,7 @@ function assertDuration(value, name, prefix) {
 /**
  * Exactly one signing method: a secret, an asymmetric key pair, or a JWKS endpoint
  */
-export function validateSigningMethod(options, prefix) {
+export function validateSigningMethod(options, prefix, { usesAppKey = false } = {}) {
     const asymmetricPartial = options.privateKey !== undefined ||
         options.publicKey !== undefined ||
         options.algorithm !== undefined;
@@ -89,7 +89,11 @@ export function validateSigningMethod(options, prefix) {
         !(typeof options.jwks.jwksUri === 'string' && options.jwks.jwksUri.trim() !== '')) {
         throw new Error(`${prefix} \`jwks.jwksUri\` is required to fetch the identity provider keys`);
     }
-    if (!options.jwks && !usesAsymmetric && !options.secret) {
+    /**
+     * Without a signing method, `jwtGuard()` derives the secret from the app
+     * key in the resolver
+     */
+    if (!usesAppKey && !options.jwks && !usesAsymmetric && !options.secret) {
         throw new Error(`${prefix} requires \`secret\` (symmetric), or \`privateKey\` + \`publicKey\` + \`algorithm\` (asymmetric), or \`jwks\``);
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
   "description": "AdonisJS package for authentication with JWT tokens",
-  "version": "1.0.0-rc.6",
+  "version": "1.0.0-rc.7",
   "engines": {
     "node": ">=24.0.0"
   },