@maximemrf/adonisjs-jwt 1.0.0-rc.7 → 1.0.0-rc.8

package/build/src/drivers/asymmetric.js

@@ -27,8 +27,8 @@ export class AsymmetricDriver {
         if (!expectedKeyType) {
             throw new Error(`Unsupported asymmetric algorithm "${algorithm}"`);
         }
-        const privateKey = createPrivateKey(this.#privateKey);
-        const publicKey = createPublicKey(this.#publicKey);
+        const privateKey = parseKey(createPrivateKey, this.#privateKey, 'privateKey');
+        const publicKey = parseKey(createPublicKey, this.#publicKey, 'publicKey');
         if (privateKey.asymmetricKeyType !== expectedKeyType) {
             throw new Error(`privateKey type "${privateKey.asymmetricKeyType}" does not match algorithm "${algorithm}"`);
         }
@@ -42,6 +42,12 @@ export class AsymmetricDriver {
         if (!createPublicKey(privateKey).equals(publicKey)) {
             throw new Error('publicKey does not belong to the same key pair as privateKey');
         }
+        /**
+         * The checks above do not cover everything jsonwebtoken requires (the
+         * curve of ES256/384/512, RSA keys of at least 2048 bits). Sign a token
+         * now, so a bad key fails at boot instead of every login.
+         */
+        jwt.sign({}, this.#privateKey, { algorithm, expiresIn: 60 });
     }
     sign(payload, options) {
         const signOptions = {
@@ -62,3 +68,11 @@ export class AsymmetricDriver {
         return jwt.verify(token, this.#publicKey, verifyOptions);
     }
 }
+function parseKey(parse, key, name) {
+    try {
+        return parse(key);
+    }
+    catch (error) {
+        throw new Error(`${name} is not a valid PEM key (${error.message}). If it comes from an env variable, replace the literal "\\n" with line breaks`);
+    }
+}

package/build/src/guard.d.ts

@@ -49,10 +49,12 @@ export declare class JwtGuard<UserProvider extends JwtUserProviderContract<unkno
      * during this request, or else the one sent by the client (cookie, body
      * or Authorization header).
      *
-     * The cookies are always cleared. When no valid refresh token is found,
-     * nothing is revoked and `E_UNAUTHORIZED_ACCESS` is raised, so a client
-     * that sends the wrong token (e.g. its access token) does not believe it
-     * has logged out while its refresh token stays valid.
+     * The cookies are cleared when the refresh token is revoked, and when
+     * there is no valid refresh token to revoke. In that case nothing is
+     * revoked and `E_UNAUTHORIZED_ACCESS` is raised, so a client that sends
+     * the wrong token (e.g. its access token) does not believe it has logged
+     * out while its refresh token stays valid. On any other error (e.g. the
+     * database is down), the cookies are kept so the client can retry.
      */
     revoke(refreshToken?: string): Promise<void>;
     /**

package/build/src/guard.js

@@ -108,6 +108,13 @@ export class JwtGuard {
         const providerUser = await this.#userProvider.createUserForGuard(user);
         const signPayload = this.#options.content(providerUser);
         assertNoGuardClaims(signPayload, this.#options);
+        /**
+         * Without `userId`, the login succeeds but every request then gets a 401
+         * with no log: fail when issuing the token instead
+         */
+        if (!this.#options.getUserId && !isUserId(signPayload.userId)) {
+            throw new RuntimeException('JWT guard `content` must return `userId`, or set `getUserId` to read the user id from the payload');
+        }
         const token = this.#signAccessToken(signPayload);
         let refreshToken;
         if (this.#refreshTokenUserProvider) {
@@ -328,25 +335,44 @@ export class JwtGuard {
      * during this request, or else the one sent by the client (cookie, body
      * or Authorization header).
      *
-     * The cookies are always cleared. When no valid refresh token is found,
-     * nothing is revoked and `E_UNAUTHORIZED_ACCESS` is raised, so a client
-     * that sends the wrong token (e.g. its access token) does not believe it
-     * has logged out while its refresh token stays valid.
+     * The cookies are cleared when the refresh token is revoked, and when
+     * there is no valid refresh token to revoke. In that case nothing is
+     * revoked and `E_UNAUTHORIZED_ACCESS` is raised, so a client that sends
+     * the wrong token (e.g. its access token) does not believe it has logged
+     * out while its refresh token stays valid. On any other error (e.g. the
+     * database is down), the cookies are kept so the client can retry.
      */
     async revoke(refreshToken) {
         if (!this.#refreshTokenUserProvider) {
             throw new RuntimeException(REFRESH_TOKENS_NOT_CONFIGURED);
         }
+        try {
+            await this.#revokeRefreshToken(this.#refreshTokenUserProvider, refreshToken);
+        }
+        catch (error) {
+            if (error instanceof errors.E_UNAUTHORIZED_ACCESS)
+                this.#clearCookies();
+            throw error;
+        }
         this.#clearCookies();
+    }
+    async #revokeRefreshToken(provider, refreshToken) {
         refreshToken = refreshToken ?? this.#issuedRefreshToken ?? (await this.#findRefreshToken());
         /**
          * Only delete a refresh token whose secret is valid. The tokens
          * provider deletes by id alone, so a forged token with a guessed
          * id would otherwise revoke another user's refresh token.
+         *
+         * Like the refresh, require the configured abilities: with two guards
+         * that share a tokens provider, the logout of one guard must not
+         * revoke the refresh tokens of the other.
          */
         const secret = new Secret(refreshToken);
-        if (!(await this.#refreshTokenUserProvider.verifyToken(secret)) ||
-            !(await this.#refreshTokenUserProvider.invalidateToken(secret))) {
+        const token = await provider.verifyToken(secret);
+        const requiredAbilities = this.#options.refreshTokenAbilities ?? [];
+        if (!token ||
+            !requiredAbilities.every((ability) => token.allows(ability)) ||
+            !(await provider.invalidateToken(secret))) {
             throw new errors.E_UNAUTHORIZED_ACCESS('Unauthorized access', {
                 guardDriverName: this.driverName,
             });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@maximemrf/adonisjs-jwt",
   "description": "AdonisJS package for authentication with JWT tokens",
-  "version": "1.0.0-rc.7",
+  "version": "1.0.0-rc.8",
   "engines": {
     "node": ">=24.0.0"
   },