@ntalmagor/3drise-common 1.0.16 → 1.0.19

package/build/auth/tokens.d.ts

@@ -0,0 +1,12 @@
+export interface TokenClaims {
+    id: string;
+    email: string;
+    userName?: string;
+    role?: 'user' | 'admin';
+}
+export interface VerifiedClaims extends TokenClaims {
+    iat: number;
+    exp: number;
+}
+export declare function signAccessToken(claims: TokenClaims): string;
+export declare function verifyAccessToken(token: string): VerifiedClaims;

package/build/auth/tokens.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signAccessToken = signAccessToken;
+exports.verifyAccessToken = verifyAccessToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+// Access-token TTL stays at 7d during 2B (no behavior change vs current).
+// 2C will shorten this to '15m' once refresh-token rotation is wired up.
+const ACCESS_TTL = '7d';
+function signAccessToken(claims) {
+    if (process.env.JWT_PRIVATE_KEY) {
+        return jsonwebtoken_1.default.sign(claims, process.env.JWT_PRIVATE_KEY, {
+            algorithm: 'RS256',
+            expiresIn: ACCESS_TTL,
+        });
+    }
+    return jsonwebtoken_1.default.sign(claims, process.env.JWT_KEY, { expiresIn: ACCESS_TTL });
+}
+function verifyAccessToken(token) {
+    if (process.env.JWT_PUBLIC_KEY) {
+        try {
+            return jsonwebtoken_1.default.verify(token, process.env.JWT_PUBLIC_KEY, {
+                algorithms: ['RS256'],
+            });
+        }
+        catch (_a) {
+            // Fall through to HS256 — supports old cookies issued before the RS256 rollout.
+        }
+    }
+    return jsonwebtoken_1.default.verify(token, process.env.JWT_KEY, {
+        algorithms: ['HS256'],
+    });
+}

package/build/database.js

@@ -13,7 +13,8 @@ function getSequelize() {
             password: process.env.RISE_MYSQL_PASSWORD,
             port: parseInt(process.env.MYSQL_PORT || '3306'),
             models: [],
-            logging: console.log, // Set to false in production
+            logging: false,
+            // logging: process.env.NODE_ENV === 'production' ? false : console.log,
             pool: {
                 max: 10,
                 min: 0,

package/build/index.d.ts

@@ -30,6 +30,7 @@ export * from './middlewares/error-handler';
 export * from './middlewares/require-auth';
 export * from './middlewares/require-admin';
 export * from './middlewares/validate-request';
+export * from './auth/tokens';
 export * from './events/base-listener';
 export * from './events/base-publisher';
 export * from './events/subjects';

package/build/index.js

@@ -70,6 +70,7 @@ __exportStar(require("./middlewares/error-handler"), exports);
 __exportStar(require("./middlewares/require-auth"), exports);
 __exportStar(require("./middlewares/require-admin"), exports);
 __exportStar(require("./middlewares/validate-request"), exports);
+__exportStar(require("./auth/tokens"), exports);
 __exportStar(require("./events/base-listener"), exports);
 __exportStar(require("./events/base-publisher"), exports);
 __exportStar(require("./events/subjects"), exports);

package/build/middlewares/current-user.d.ts

@@ -1,12 +1,6 @@
 import { Request, Response, NextFunction } from 'express';
-export interface UserPayload {
-    id: string;
-    email: string;
-    userName?: string;
-    role?: 'user' | 'admin';
-    iat: number;
-    exp: number;
-}
+import { VerifiedClaims } from '../auth/tokens';
+export type UserPayload = VerifiedClaims;
 declare module 'express-serve-static-core' {
     interface Request {
         currentUser?: UserPayload;

package/build/middlewares/current-user.js

@@ -1,18 +1,14 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.currentUser = void 0;
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const tokens_1 = require("../auth/tokens");
 const currentUser = (req, res, next) => {
     var _a;
     if (!((_a = req.session) === null || _a === void 0 ? void 0 : _a.jwt)) {
         return next();
     }
     try {
-        const payload = jsonwebtoken_1.default.verify(req.session.jwt, process.env.JWT_KEY);
-        req.currentUser = payload;
+        req.currentUser = (0, tokens_1.verifyAccessToken)(req.session.jwt);
     }
     catch (err) {
         // Invalid or expired token — continue unauthenticated

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ntalmagor/3drise-common",
-  "version": "1.0.16",
+  "version": "1.0.19",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",