@meridianjs/auth 0.1.3 → 0.1.4

package/dist/index.d.mts

@@ -28,6 +28,7 @@ interface JwtPayload {
     workspaceId: string | null;
     roles: string[];
     permissions: string[];
+    jti?: string;
     iat?: number;
     exp?: number;
 }
@@ -49,11 +50,9 @@ declare class AuthModuleService extends AuthModuleService_base {
 /**
  * Express middleware that validates a Bearer JWT on every request.
  *
- * On success, populates req.user = { id, workspaceId, roles } and calls next().
+ * On success, populates req.user = { id, workspaceId, roles, permissions, jti } and calls next().
+ * Also validates the session against the DB (stateful revocation support).
  * On failure, responds 401 Unauthorized.
- *
- * Reads jwtSecret from req.scope (the request-scoped DI container that is
- * attached by the framework before any middleware runs).
  */
 declare function authenticateJWT(req: any, res: Response, next: NextFunction): void;
 

package/dist/index.d.ts

@@ -28,6 +28,7 @@ interface JwtPayload {
     workspaceId: string | null;
     roles: string[];
     permissions: string[];
+    jti?: string;
     iat?: number;
     exp?: number;
 }
@@ -49,11 +50,9 @@ declare class AuthModuleService extends AuthModuleService_base {
 /**
  * Express middleware that validates a Bearer JWT on every request.
  *
- * On success, populates req.user = { id, workspaceId, roles } and calls next().
+ * On success, populates req.user = { id, workspaceId, roles, permissions, jti } and calls next().
+ * Also validates the session against the DB (stateful revocation support).
  * On failure, responds 401 Unauthorized.
- *
- * Reads jwtSecret from req.scope (the request-scoped DI container that is
- * attached by the framework before any middleware runs).
  */
 declare function authenticateJWT(req: any, res: Response, next: NextFunction): void;
 

package/dist/index.js

@@ -45,8 +45,10 @@ var import_framework_utils2 = require("@meridianjs/framework-utils");
 var import_framework_utils = require("@meridianjs/framework-utils");
 var import_bcrypt = __toESM(require("bcrypt"));
 var import_jsonwebtoken = __toESM(require("jsonwebtoken"));
+var import_crypto = require("crypto");
 var BCRYPT_ROUNDS = 12;
 var JWT_EXPIRES_IN = "7d";
+var JWT_EXPIRES_MS = 7 * 24 * 60 * 60 * 1e3;
 var AuthModuleService = class extends (0, import_framework_utils.MeridianService)({}) {
   container;
   constructor(container) {
@@ -76,7 +78,9 @@ var AuthModuleService = class extends (0, import_framework_utils.MeridianService
       is_active: true
     });
     const permissions = await this.resolvePermissions(user.app_role_id);
-    const token = this.signToken(user.id, null, [user.role], permissions, config.projectConfig.jwtSecret);
+    const { token, jti, expiresAt } = this.signToken(user.id, null, [user.role], permissions, config.projectConfig.jwtSecret);
+    await userService.createSession(jti, user.id, expiresAt).catch(() => {
+    });
     return {
       user: {
         id: user.id,
@@ -105,7 +109,9 @@ var AuthModuleService = class extends (0, import_framework_utils.MeridianService
     await userService.recordLogin(user.id).catch(() => {
     });
     const permissions = await this.resolvePermissions(user.app_role_id);
-    const token = this.signToken(user.id, null, [user.role ?? "member"], permissions, config.projectConfig.jwtSecret);
+    const { token, jti, expiresAt } = this.signToken(user.id, null, [user.role ?? "member"], permissions, config.projectConfig.jwtSecret);
+    await userService.createSession(jti, user.id, expiresAt).catch(() => {
+    });
     return {
       user: {
         id: user.id,
@@ -131,9 +137,12 @@ var AuthModuleService = class extends (0, import_framework_utils.MeridianService
     }
   }
   signToken(userId, workspaceId, roles, permissions, secret) {
-    return import_jsonwebtoken.default.sign({ sub: userId, workspaceId, roles, permissions }, secret, {
+    const jti = (0, import_crypto.randomUUID)();
+    const expiresAt = new Date(Date.now() + JWT_EXPIRES_MS);
+    const token = import_jsonwebtoken.default.sign({ sub: userId, workspaceId, roles, permissions, jti }, secret, {
       expiresIn: JWT_EXPIRES_IN
     });
+    return { token, jti, expiresAt };
   }
 };
 
@@ -146,26 +155,42 @@ function authenticateJWT(req, res, next) {
     res.status(401).json({ error: { message: "Unauthorized \u2014 Bearer token required" } });
     return;
   }
-  let config;
-  try {
-    const scope = req.scope;
-    config = scope.resolve("config");
-  } catch {
-    res.status(500).json({ error: { message: "Server misconfiguration" } });
-    return;
-  }
-  try {
-    const payload = import_jsonwebtoken2.default.verify(token, config.projectConfig.jwtSecret);
-    req.user = {
-      id: payload.sub,
-      workspaceId: payload.workspaceId ?? null,
-      roles: Array.isArray(payload.roles) ? payload.roles : [],
-      permissions: Array.isArray(payload.permissions) ? payload.permissions : []
-    };
-    next();
-  } catch {
-    res.status(401).json({ error: { message: "Invalid or expired token" } });
-  }
+  ;
+  (async () => {
+    let config;
+    try {
+      const scope = req.scope;
+      config = scope.resolve("config");
+    } catch {
+      res.status(500).json({ error: { message: "Server misconfiguration" } });
+      return;
+    }
+    try {
+      const payload = import_jsonwebtoken2.default.verify(token, config.projectConfig.jwtSecret);
+      if (payload.jti) {
+        try {
+          const scope = req.scope;
+          const userService = scope.resolve("userModuleService");
+          const valid = await userService.isSessionValid(payload.jti);
+          if (!valid) {
+            res.status(401).json({ error: { message: "Session revoked or expired" } });
+            return;
+          }
+        } catch {
+        }
+      }
+      req.user = {
+        id: payload.sub,
+        workspaceId: payload.workspaceId ?? null,
+        roles: Array.isArray(payload.roles) ? payload.roles : [],
+        permissions: Array.isArray(payload.permissions) ? payload.permissions : [],
+        jti: payload.jti ?? null
+      };
+      next();
+    } catch {
+      res.status(401).json({ error: { message: "Invalid or expired token" } });
+    }
+  })();
 }
 
 // src/guards.ts

package/dist/index.mjs

@@ -5,8 +5,10 @@ import { Module } from "@meridianjs/framework-utils";
 import { MeridianService } from "@meridianjs/framework-utils";
 import bcrypt from "bcrypt";
 import jwt from "jsonwebtoken";
+import { randomUUID } from "crypto";
 var BCRYPT_ROUNDS = 12;
 var JWT_EXPIRES_IN = "7d";
+var JWT_EXPIRES_MS = 7 * 24 * 60 * 60 * 1e3;
 var AuthModuleService = class extends MeridianService({}) {
   container;
   constructor(container) {
@@ -36,7 +38,9 @@ var AuthModuleService = class extends MeridianService({}) {
       is_active: true
     });
     const permissions = await this.resolvePermissions(user.app_role_id);
-    const token = this.signToken(user.id, null, [user.role], permissions, config.projectConfig.jwtSecret);
+    const { token, jti, expiresAt } = this.signToken(user.id, null, [user.role], permissions, config.projectConfig.jwtSecret);
+    await userService.createSession(jti, user.id, expiresAt).catch(() => {
+    });
     return {
       user: {
         id: user.id,
@@ -65,7 +69,9 @@ var AuthModuleService = class extends MeridianService({}) {
     await userService.recordLogin(user.id).catch(() => {
     });
     const permissions = await this.resolvePermissions(user.app_role_id);
-    const token = this.signToken(user.id, null, [user.role ?? "member"], permissions, config.projectConfig.jwtSecret);
+    const { token, jti, expiresAt } = this.signToken(user.id, null, [user.role ?? "member"], permissions, config.projectConfig.jwtSecret);
+    await userService.createSession(jti, user.id, expiresAt).catch(() => {
+    });
     return {
       user: {
         id: user.id,
@@ -91,9 +97,12 @@ var AuthModuleService = class extends MeridianService({}) {
     }
   }
   signToken(userId, workspaceId, roles, permissions, secret) {
-    return jwt.sign({ sub: userId, workspaceId, roles, permissions }, secret, {
+    const jti = randomUUID();
+    const expiresAt = new Date(Date.now() + JWT_EXPIRES_MS);
+    const token = jwt.sign({ sub: userId, workspaceId, roles, permissions, jti }, secret, {
       expiresIn: JWT_EXPIRES_IN
     });
+    return { token, jti, expiresAt };
   }
 };
 
@@ -106,26 +115,42 @@ function authenticateJWT(req, res, next) {
     res.status(401).json({ error: { message: "Unauthorized \u2014 Bearer token required" } });
     return;
   }
-  let config;
-  try {
-    const scope = req.scope;
-    config = scope.resolve("config");
-  } catch {
-    res.status(500).json({ error: { message: "Server misconfiguration" } });
-    return;
-  }
-  try {
-    const payload = jwt2.verify(token, config.projectConfig.jwtSecret);
-    req.user = {
-      id: payload.sub,
-      workspaceId: payload.workspaceId ?? null,
-      roles: Array.isArray(payload.roles) ? payload.roles : [],
-      permissions: Array.isArray(payload.permissions) ? payload.permissions : []
-    };
-    next();
-  } catch {
-    res.status(401).json({ error: { message: "Invalid or expired token" } });
-  }
+  ;
+  (async () => {
+    let config;
+    try {
+      const scope = req.scope;
+      config = scope.resolve("config");
+    } catch {
+      res.status(500).json({ error: { message: "Server misconfiguration" } });
+      return;
+    }
+    try {
+      const payload = jwt2.verify(token, config.projectConfig.jwtSecret);
+      if (payload.jti) {
+        try {
+          const scope = req.scope;
+          const userService = scope.resolve("userModuleService");
+          const valid = await userService.isSessionValid(payload.jti);
+          if (!valid) {
+            res.status(401).json({ error: { message: "Session revoked or expired" } });
+            return;
+          }
+        } catch {
+        }
+      }
+      req.user = {
+        id: payload.sub,
+        workspaceId: payload.workspaceId ?? null,
+        roles: Array.isArray(payload.roles) ? payload.roles : [],
+        permissions: Array.isArray(payload.permissions) ? payload.permissions : [],
+        jti: payload.jti ?? null
+      };
+      next();
+    } catch {
+      res.status(401).json({ error: { message: "Invalid or expired token" } });
+    }
+  })();
 }
 
 // src/guards.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meridianjs/auth",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Meridian auth module — JWT authentication and middleware",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",