@maximemrf/adonisjs-jwt 1.0.0-rc.6 → 1.0.0-rc.8

package/build/src/define_config.js

@@ -43,6 +43,7 @@ export function jwtGuard(config) {
      * the first request, when the app would already be serving traffic.
      */
     validateLifetimes(options, PREFIX);
+    validateSigningMethod(options, PREFIX, { usesAppKey });
     let driver;
     if (usesAppKey) {
         /**
@@ -53,7 +54,6 @@ export function jwtGuard(config) {
             assertAppKey(process.env.APP_KEY);
     }
     else {
-        validateSigningMethod(options, PREFIX);
         driver = resolveDriver(options, PREFIX);
     }
     return {

package/build/src/drivers/asymmetric.js

@@ -27,8 +27,8 @@ export class AsymmetricDriver {
         if (!expectedKeyType) {
             throw new Error(`Unsupported asymmetric algorithm "${algorithm}"`);
         }
-        const privateKey = createPrivateKey(this.#privateKey);
-        const publicKey = createPublicKey(this.#publicKey);
+        const privateKey = parseKey(createPrivateKey, this.#privateKey, 'privateKey');
+        const publicKey = parseKey(createPublicKey, this.#publicKey, 'publicKey');
         if (privateKey.asymmetricKeyType !== expectedKeyType) {
             throw new Error(`privateKey type "${privateKey.asymmetricKeyType}" does not match algorithm "${algorithm}"`);
         }
@@ -42,6 +42,12 @@ export class AsymmetricDriver {
         if (!createPublicKey(privateKey).equals(publicKey)) {
             throw new Error('publicKey does not belong to the same key pair as privateKey');
         }
+        /**
+         * The checks above do not cover everything jsonwebtoken requires (the
+         * curve of ES256/384/512, RSA keys of at least 2048 bits). Sign a token
+         * now, so a bad key fails at boot instead of every login.
+         */
+        jwt.sign({}, this.#privateKey, { algorithm, expiresIn: 60 });
     }
     sign(payload, options) {
         const signOptions = {
@@ -62,3 +68,11 @@ export class AsymmetricDriver {
         return jwt.verify(token, this.#publicKey, verifyOptions);
     }
 }
+function parseKey(parse, key, name) {
+    try {
+        return parse(key);
+    }
+    catch (error) {
+        throw new Error(`${name} is not a valid PEM key (${error.message}). If it comes from an env variable, replace the literal "\\n" with line breaks`);
+    }
+}

package/build/src/guard.d.ts

@@ -49,10 +49,12 @@ export declare class JwtGuard<UserProvider extends JwtUserProviderContract<unkno
      * during this request, or else the one sent by the client (cookie, body
      * or Authorization header).
      *
-     * The cookies are always cleared. When no valid refresh token is found,
-     * nothing is revoked and `E_UNAUTHORIZED_ACCESS` is raised, so a client
-     * that sends the wrong token (e.g. its access token) does not believe it
-     * has logged out while its refresh token stays valid.
+     * The cookies are cleared when the refresh token is revoked, and when
+     * there is no valid refresh token to revoke. In that case nothing is
+     * revoked and `E_UNAUTHORIZED_ACCESS` is raised, so a client that sends
+     * the wrong token (e.g. its access token) does not believe it has logged
+     * out while its refresh token stays valid. On any other error (e.g. the
+     * database is down), the cookies are kept so the client can retry.
      */
     revoke(refreshToken?: string): Promise<void>;
     /**

package/build/src/guard.js

@@ -107,6 +107,14 @@ export class JwtGuard {
         }
         const providerUser = await this.#userProvider.createUserForGuard(user);
         const signPayload = this.#options.content(providerUser);
+        assertNoGuardClaims(signPayload, this.#options);
+        /**
+         * Without `userId`, the login succeeds but every request then gets a 401
+         * with no log: fail when issuing the token instead
+         */
+        if (!this.#options.getUserId && !isUserId(signPayload.userId)) {
+            throw new RuntimeException('JWT guard `content` must return `userId`, or set `getUserId` to read the user id from the payload');
+        }
         const token = this.#signAccessToken(signPayload);
         let refreshToken;
         if (this.#refreshTokenUserProvider) {
@@ -327,25 +335,44 @@ export class JwtGuard {
      * during this request, or else the one sent by the client (cookie, body
      * or Authorization header).
      *
-     * The cookies are always cleared. When no valid refresh token is found,
-     * nothing is revoked and `E_UNAUTHORIZED_ACCESS` is raised, so a client
-     * that sends the wrong token (e.g. its access token) does not believe it
-     * has logged out while its refresh token stays valid.
+     * The cookies are cleared when the refresh token is revoked, and when
+     * there is no valid refresh token to revoke. In that case nothing is
+     * revoked and `E_UNAUTHORIZED_ACCESS` is raised, so a client that sends
+     * the wrong token (e.g. its access token) does not believe it has logged
+     * out while its refresh token stays valid. On any other error (e.g. the
+     * database is down), the cookies are kept so the client can retry.
      */
     async revoke(refreshToken) {
         if (!this.#refreshTokenUserProvider) {
             throw new RuntimeException(REFRESH_TOKENS_NOT_CONFIGURED);
         }
+        try {
+            await this.#revokeRefreshToken(this.#refreshTokenUserProvider, refreshToken);
+        }
+        catch (error) {
+            if (error instanceof errors.E_UNAUTHORIZED_ACCESS)
+                this.#clearCookies();
+            throw error;
+        }
         this.#clearCookies();
+    }
+    async #revokeRefreshToken(provider, refreshToken) {
         refreshToken = refreshToken ?? this.#issuedRefreshToken ?? (await this.#findRefreshToken());
         /**
          * Only delete a refresh token whose secret is valid. The tokens
          * provider deletes by id alone, so a forged token with a guessed
          * id would otherwise revoke another user's refresh token.
+         *
+         * Like the refresh, require the configured abilities: with two guards
+         * that share a tokens provider, the logout of one guard must not
+         * revoke the refresh tokens of the other.
          */
         const secret = new Secret(refreshToken);
-        if (!(await this.#refreshTokenUserProvider.verifyToken(secret)) ||
-            !(await this.#refreshTokenUserProvider.invalidateToken(secret))) {
+        const token = await provider.verifyToken(secret);
+        const requiredAbilities = this.#options.refreshTokenAbilities ?? [];
+        if (!token ||
+            !requiredAbilities.every((ability) => token.allows(ability)) ||
+            !(await provider.invalidateToken(secret))) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });
@@ -407,6 +434,23 @@ export class JwtGuard {
     }
 }
 const REFRESH_TOKENS_NOT_CONFIGURED = 'JWT guard refresh tokens are not configured: set `refreshTokenUserProvider` in the guard config';
+/**
+ * The guard sets `exp`, and `iss` / `aud` when `issuer` / `audience` are
+ * configured. jsonwebtoken refuses a payload that sets them too, with a
+ * message about its own options (`options.expiresIn`) that the app never set.
+ */
+function assertNoGuardClaims(payload, options) {
+    const conflicts = [['exp', 'tokenExpiresIn']];
+    if (options.issuer)
+        conflicts.push(['iss', 'issuer']);
+    if (options.audience)
+        conflicts.push(['aud', 'audience']);
+    for (const [claim, option] of conflicts) {
+        if (payload[claim] !== undefined) {
+            throw new RuntimeException(`JWT guard \`content\` must not set \`${claim}\`: the guard sets it from \`${option}\``);
+        }
+    }
+}
 function isUserId(value) {
     return ((typeof value === 'string' && value !== '') ||
         (typeof value === 'number' && Number.isFinite(value)) ||

package/build/src/types.d.ts

@@ -135,6 +135,13 @@ type JwtSharedOptions = {
      */
     verifyPayload?: JwtVerifyPayload;
 };
+/**
+ * Claims set by the guard: `exp` comes from `tokenExpiresIn`, so `content`
+ * must not set it
+ */
+type GuardClaims = {
+    exp?: never;
+};
 /**
  * `content` builds the payload of the access tokens. Without `getUserId`,
  * the guard reads the user id from the `userId` claim, so `content` must
@@ -146,14 +153,14 @@ export type JwtContentOptions<RealUser> = {
      * Defaults to `payload.userId`. Use e.g. `(payload) => payload.sub` for external providers.
      */
     getUserId?: undefined;
-    content?: (user: JwtGuardUser<RealUser>) => Record<string, any> & BaseJwtContent;
+    content?: (user: JwtGuardUser<RealUser>) => Record<string, any> & BaseJwtContent & GuardClaims;
 } | {
     /**
      * Extract the user id from a verified token payload.
      * Defaults to `payload.userId`. Use e.g. `(payload) => payload.sub` for external providers.
      */
     getUserId: JwtGetUserId;
-    content?: (user: JwtGuardUser<RealUser>) => Record<string, any>;
+    content?: (user: JwtGuardUser<RealUser>) => Record<string, any> & GuardClaims;
 };
 /**
  * Options of the `JwtGuard` constructor

package/build/src/validation.d.ts

@@ -10,7 +10,9 @@ export declare function validateLifetimes(options: Pick<JwtGuardOptions, 'tokenE
 /**
  * Exactly one signing method: a secret, an asymmetric key pair, or a JWKS endpoint
  */
-export declare function validateSigningMethod(options: ReleasedSecrets<JwtGuardOptions>, prefix: string): void;
+export declare function validateSigningMethod(options: ReleasedSecrets<JwtGuardOptions>, prefix: string, { usesAppKey }?: {
+    usesAppKey?: boolean;
+}): void;
 /**
  * Accept `Secret` values (`Env.schema.secret()` in AdonisJS v7) for the
  * signing keys, and work with their string value

package/build/src/validation.js

@@ -44,7 +44,7 @@ function assertDuration(value, name, prefix) {
 /**
  * Exactly one signing method: a secret, an asymmetric key pair, or a JWKS endpoint
  */
-export function validateSigningMethod(options, prefix) {
+export function validateSigningMethod(options, prefix, { usesAppKey = false } = {}) {
     const asymmetricPartial = options.privateKey !== undefined ||
         options.publicKey !== undefined ||
         options.algorithm !== undefined;
@@ -89,7 +89,11 @@ export function validateSigningMethod(options, prefix) {
         !(typeof options.jwks.jwksUri === 'string' && options.jwks.jwksUri.trim() !== '')) {
         throw new Error(`${prefix} \`jwks.jwksUri\` is required to fetch the identity provider keys`);
     }
-    if (!options.jwks && !usesAsymmetric && !options.secret) {
+    /**
+     * Without a signing method, `jwtGuard()` derives the secret from the app
+     * key in the resolver
+     */
+    if (!usesAppKey && !options.jwks && !usesAsymmetric && !options.secret) {
         throw new Error(`${prefix} requires \`secret\` (symmetric), or \`privateKey\` + \`publicKey\` + \`algorithm\` (asymmetric), or \`jwks\``);
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
   "description": "AdonisJS package for authentication with JWT tokens",
-  "version": "1.0.0-rc.6",
+  "version": "1.0.0-rc.8",
   "engines": {
     "node": ">=24.0.0"
   },