@nextage/era-lib 1.0.166 → 1.0.167

package/build/events/__mocks__/msg-wrapper.d.ts

@@ -1,6 +1,6 @@
 export declare const msgWrapper: {
     client: {
-        publish: import("vitest").Mock<(...args: any[]) => any>;
+        publish: import("vitest").Mock<import("@vitest/spy").Procedure>;
     };
 };
 //# sourceMappingURL=msg-wrapper.d.ts.map

package/build/events/__mocks__/nats-wrapper.d.ts

@@ -1,6 +1,6 @@
 export declare const natsWrapper: {
     client: {
-        publish: import("vitest").Mock<(...args: any[]) => any>;
+        publish: import("vitest").Mock<import("@vitest/spy").Procedure>;
     };
 };
 //# sourceMappingURL=nats-wrapper.d.ts.map

package/build/utils/index.d.ts

@@ -1,4 +1,5 @@
 export * from './express';
 export * from './functs';
+export * from './jwt';
 export * from './start-service';
 //# sourceMappingURL=index.d.ts.map

package/build/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,iBAAiB,CAAC"}

package/build/utils/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./express"), exports);
 __exportStar(require("./functs"), exports);
+__exportStar(require("./jwt"), exports);
 __exportStar(require("./start-service"), exports);
 //# sourceMappingURL=index.js.map

package/build/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,2CAAyB;AACzB,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,2CAAyB;AACzB,wCAAsB;AACtB,kDAAgC"}

package/build/utils/jwt.d.ts

@@ -0,0 +1,45 @@
+import { JwtPayload, SignOptions } from 'jsonwebtoken';
+/** Marker claim distinguishing a refresh token from an access token. */
+export declare const REFRESH_TOKEN_TYPE = "refresh";
+/** Default validity used when the matching env var is not set. */
+export declare const DEFAULT_ACCESS_VALIDITY = "15m";
+export declare const DEFAULT_REFRESH_VALIDITY = "7d";
+export interface RefreshTokenPayload extends JwtPayload {
+    /** Subject — the user id. */
+    sub: string;
+    /** JWT id — the `accesses` record id (session id). Mirrors the access token jti. */
+    jti: string;
+    /** Token type marker. */
+    typ: typeof REFRESH_TOKEN_TYPE;
+}
+/**
+ * Sign a long-lived REFRESH token for a session.
+ *
+ * @param sub  user id
+ * @param jti  `accesses` record id (session id) — same value as the access jti
+ * @param opts optional sign-option overrides (e.g. a fixed expiresIn for tests)
+ */
+export declare function signRefreshToken(sub: string, jti: string, opts?: SignOptions, secret?: string): string;
+/**
+ * Verify a REFRESH token and return its payload. Throws (JsonWebTokenError /
+ * TokenExpiredError) when the token is malformed, expired or not a refresh token.
+ */
+export declare function verifyRefreshToken(token: string, secret?: string): RefreshTokenPayload;
+/**
+ * Deterministic sha256 hex digest of a token. Stored on the `accesses` record so
+ * the raw refresh token never touches the database and can be rotated / revoked
+ * by overwriting (logout) or replacing (rotation) the stored hash.
+ */
+export declare function hashToken(token: string): string;
+/**
+ * Read the `exp` claim of a signed token and return it as a `Date` (or
+ * `undefined` when the token carries no expiry). Used to persist the refresh
+ * token expiry on the `accesses` record without re-parsing the duration string.
+ */
+export declare function tokenExpiry(token: string): Date | undefined;
+/**
+ * Constant-time comparison of a raw token against a stored hash. Prevents timing
+ * side-channels when validating a presented refresh token.
+ */
+export declare function verifyTokenHash(token: string, hash?: string | null): boolean;
+//# sourceMappingURL=jwt.d.ts.map

package/build/utils/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/utils/jwt.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEvD,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAC9C,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACrD,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,GAAG,EAAE,OAAO,kBAAkB,CAAC;CAChC;AAyBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAW1G;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAQtF;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAK3D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAS5E"}

package/build/utils/jwt.js

@@ -0,0 +1,106 @@
+"use strict";
+// ┌────────────────────────────────────────────────────────────────────────────┐
+// │ JWT — functional token helpers (access + refresh)                            │
+// │                                                                              │
+// │ Pure, side-effect-free helpers built on `jsonwebtoken`. They centralize the  │
+// │ token contract of the auth service so the controller stays declarative:      │
+// │                                                                              │
+// │   • signRefreshToken()   → long-lived refresh JWT (REFRESH_VALIDITY)         │
+// │   • verifyRefreshToken() → decode + verify a refresh JWT (throws on invalid) │
+// │   • hashToken()          → sha256 hex, stored on the `accesses` record so the │
+// │                            refresh can be rotated / revoked server-side.      │
+// │                                                                              │
+// │ The ACCESS token is still signed by nx-frame-be `generateJwt()` (it already  │
+// │ honours JWT_VALIDITY). See ADR-0002: the target architecture (Step 2.7) is    │
+// │ asymmetric signing (EdDSA/Ed25519 via `jose`, auth-srv sole signer). These   │
+// │ helpers keep HS* now with a clean, functional surface to swap later.         │
+// └────────────────────────────────────────────────────────────────────────────┘
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_REFRESH_VALIDITY = exports.DEFAULT_ACCESS_VALIDITY = exports.REFRESH_TOKEN_TYPE = void 0;
+exports.signRefreshToken = signRefreshToken;
+exports.verifyRefreshToken = verifyRefreshToken;
+exports.hashToken = hashToken;
+exports.tokenExpiry = tokenExpiry;
+exports.verifyTokenHash = verifyTokenHash;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+/** Marker claim distinguishing a refresh token from an access token. */
+exports.REFRESH_TOKEN_TYPE = 'refresh';
+/** Default validity used when the matching env var is not set. */
+exports.DEFAULT_ACCESS_VALIDITY = '15m';
+exports.DEFAULT_REFRESH_VALIDITY = '7d';
+/**
+ * Resolve the secret used to sign / verify REFRESH tokens.
+ *
+ * A dedicated `REFRESH_SECRET` is preferred (so a leak of one secret cannot be
+ * used to forge the other kind of token); it falls back to `JWT_SECRET` when not
+ * configured. Throws when neither is available.
+ */
+function refreshSecret(secret) {
+    const resolved = secret || process.env.REFRESH_SECRET || process.env.JWT_SECRET;
+    if (!resolved)
+        throw new Error('Missing refresh token secret (REFRESH_SECRET / JWT_SECRET)');
+    return resolved;
+}
+/** Resolve the signing algorithm (defaults to HS512, matching the access token). */
+function signAlgorithm() {
+    return (process.env.JWT_ALGORITHM ?? 'HS512');
+}
+/**
+ * Sign a long-lived REFRESH token for a session.
+ *
+ * @param sub  user id
+ * @param jti  `accesses` record id (session id) — same value as the access jti
+ * @param opts optional sign-option overrides (e.g. a fixed expiresIn for tests)
+ */
+function signRefreshToken(sub, jti, opts = {}, secret) {
+    const signOpts = {
+        algorithm: signAlgorithm(),
+        expiresIn: (process.env.REFRESH_VALIDITY ?? exports.DEFAULT_REFRESH_VALIDITY),
+        ...opts
+    };
+    const payload = { sub, jti, typ: exports.REFRESH_TOKEN_TYPE };
+    return jsonwebtoken_1.default.sign(payload, refreshSecret(secret), signOpts);
+}
+/**
+ * Verify a REFRESH token and return its payload. Throws (JsonWebTokenError /
+ * TokenExpiredError) when the token is malformed, expired or not a refresh token.
+ */
+function verifyRefreshToken(token, secret) {
+    const payload = jsonwebtoken_1.default.verify(token, refreshSecret(secret), { algorithms: [signAlgorithm()] });
+    if (payload?.typ !== exports.REFRESH_TOKEN_TYPE)
+        throw new Error('Not a refresh token');
+    return payload;
+}
+/**
+ * Deterministic sha256 hex digest of a token. Stored on the `accesses` record so
+ * the raw refresh token never touches the database and can be rotated / revoked
+ * by overwriting (logout) or replacing (rotation) the stored hash.
+ */
+function hashToken(token) {
+    return node_crypto_1.default.createHash('sha256').update(token).digest('hex');
+}
+/**
+ * Read the `exp` claim of a signed token and return it as a `Date` (or
+ * `undefined` when the token carries no expiry). Used to persist the refresh
+ * token expiry on the `accesses` record without re-parsing the duration string.
+ */
+function tokenExpiry(token) {
+    const decoded = jsonwebtoken_1.default.decode(token);
+    return decoded?.exp ? new Date(decoded.exp * 1000) : undefined;
+}
+/**
+ * Constant-time comparison of a raw token against a stored hash. Prevents timing
+ * side-channels when validating a presented refresh token.
+ */
+function verifyTokenHash(token, hash) {
+    if (!hash)
+        return false;
+    const a = Buffer.from(hashToken(token));
+    const b = Buffer.from(hash);
+    return a.length === b.length && node_crypto_1.default.timingSafeEqual(a, b);
+}
+//# sourceMappingURL=jwt.js.map

package/build/utils/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/utils/jwt.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,oFAAoF;AACpF,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,mFAAmF;AACnF,mFAAmF;AACnF,iFAAiF;;;;;;AAoDjF,4CAWC;AAMD,gDAQC;AAOD,8BAGC;AAOD,kCAKC;AAMD,0CASC;AAhHD,8DAAoD;AACpD,gEAAqD;AAGrD,wEAAwE;AAC3D,QAAA,kBAAkB,GAAG,SAAS,CAAC;AAE5C,kEAAkE;AACrD,QAAA,uBAAuB,GAAI,KAAK,CAAC;AACjC,QAAA,wBAAwB,GAAI,IAAI,CAAC;AAW9C;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,MAAe;IAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAEhF,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAEhF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa;IAEpB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAc,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,GAAW,EAAE,GAAW,EAAE,OAAoB,EAAE,EAAE,MAAe;IAEhG,MAAM,QAAQ,GAAgB;QAC5B,SAAS,EAAE,aAAa,EAAE;QAC1B,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,gCAAwB,CAA6B;QACjG,GAAG,IAAI;KACR,CAAC;IAEF,MAAM,OAAO,GAAqD,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,0BAAkB,EAAE,CAAC;IAExG,OAAO,sBAAG,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,KAAa,EAAE,MAAe;IAE/D,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,CAAwB,CAAC;IAEnH,IAAI,OAAO,EAAE,GAAG,KAAK,0BAAkB;QACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAEzC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,KAAa;IAErC,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,KAAa;IAEvC,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAsB,CAAC;IAEvD,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,KAAa,EAAE,IAAoB;IAEjE,IAAI,CAAC,IAAI;QACP,OAAO,KAAK,CAAC;IAEf,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE5B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,qBAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextage/era-lib",
-  "version": "1.0.166",
+  "version": "1.0.167",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
   "files": [
@@ -55,6 +55,9 @@
   "devDependencies": {
     "del-cli": "^6.0.0",
     "mongodb-memory-server": "^10.1.4",
-    "vitest": "^2.1.9"
+    "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "uuid": "^11.1.1"
   }
 }