@nitra/cf-security 4.0.0 → 4.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitra/cf-security",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "check header in serverless",
   "type": "module",
   "exports": {

package/src/jwt.js

@@ -5,7 +5,8 @@ import { isDev } from '@nitra/isenv'
  * Check request for Nitra security rules WI
  *
  * @param {object} req - Fastify  Request for check
- * @return {string} token if check passed
+ * @param {Array} allowedRoles - Allowed roles
+ * @return {Promise<string>} token if check passed
  */
 export default async (req, allowedRoles) => {
   // Для дева можна й не передавати токен
@@ -14,9 +15,19 @@ export default async (req, allowedRoles) => {
     if (req.headers?.authorization) {
       // ігноруючи expired
       const token = await verify(req.headers.authorization.split(' ')[1], { ignoreExpiration: true })
+
+      const intersectRoles = intersection(
+        token.body['https://hasura.io/jwt/claims']['x-hasura-allowed-roles'],
+        allowedRoles
+      )
+
+      if (intersectRoles.length === 0) {
+        throw new Error(`[verification] unallowed roles ${allowedRoles}`)
+      }
+
       return token.body
     } else {
-      return { name: 'dev', 'https://hasura.io/jwt/claims': { 'x-hasura-allowed-roles': allowedRoles } }
+      return JSON.stringify({ name: 'dev', 'https://hasura.io/jwt/claims': { 'x-hasura-allowed-roles': allowedRoles } })
     }
   }