@ntalmagor/3drise-common 1.0.17 → 1.0.21

package/build/auth/tokens.d.ts

@@ -0,0 +1,12 @@
+export interface TokenClaims {
+    id: string;
+    email: string;
+    userName?: string;
+    role?: 'user' | 'admin';
+}
+export interface VerifiedClaims extends TokenClaims {
+    iat: number;
+    exp: number;
+}
+export declare function signAccessToken(claims: TokenClaims): string;
+export declare function verifyAccessToken(token: string): VerifiedClaims;

package/build/auth/tokens.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signAccessToken = signAccessToken;
+exports.verifyAccessToken = verifyAccessToken;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+// Access-token TTL stays at 7d during 2B (no behavior change vs current).
+// 2C will shorten this to '15m' once refresh-token rotation is wired up.
+const ACCESS_TTL = '7d';
+function signAccessToken(claims) {
+    if (process.env.JWT_PRIVATE_KEY) {
+        return jsonwebtoken_1.default.sign(claims, process.env.JWT_PRIVATE_KEY, {
+            algorithm: 'RS256',
+            expiresIn: ACCESS_TTL,
+        });
+    }
+    return jsonwebtoken_1.default.sign(claims, process.env.JWT_KEY, { expiresIn: ACCESS_TTL });
+}
+function verifyAccessToken(token) {
+    if (process.env.JWT_PUBLIC_KEY) {
+        try {
+            return jsonwebtoken_1.default.verify(token, process.env.JWT_PUBLIC_KEY, {
+                algorithms: ['RS256'],
+            });
+        }
+        catch (_a) {
+            // Fall through to HS256 — supports old cookies issued before the RS256 rollout.
+        }
+    }
+    return jsonwebtoken_1.default.verify(token, process.env.JWT_KEY, {
+        algorithms: ['HS256'],
+    });
+}

package/build/database.js

@@ -6,27 +6,46 @@ let _sequelize = null;
 function getSequelize() {
     if (!_sequelize) {
         _sequelize = new sequelize_typescript_1.Sequelize({
-            database: process.env.RISE_MYSQL_DATABASE,
             dialect: 'mysql',
+            database: process.env.RISE_MYSQL_DATABASE,
             host: process.env.MYSQL_HOST,
             username: process.env.RISE_MYSQL_USER,
             password: process.env.RISE_MYSQL_PASSWORD,
             port: parseInt(process.env.MYSQL_PORT || '3306'),
             models: [],
             logging: false,
-            // logging: process.env.NODE_ENV === 'production' ? false : console.log,
-            pool: {
-                max: 10,
-                min: 0,
-                acquire: 30000,
-                idle: 10000,
+            define: {
+                timestamps: true,
+                underscored: false,
             },
             dialectOptions: {
-                connectTimeout: 60000
+                connectTimeout: 120000, // 2 min for the initial TCP connect
+            },
+            pool: {
+                max: 15,
+                min: 0,
+                acquire: 120000, // 2 min to acquire a connection from the pool
+                idle: 30000, // close idle conns after 30s
+                evict: 5000, // sweep the pool every 5s
             },
             retry: {
-                max: 3
-            }
+                max: 5,
+                backoffBase: 1000, // 1s, doubles each retry (effectively)
+                backoffExponent: 1.5,
+                match: [
+                    /ETIMEDOUT/,
+                    /ECONNREFUSED/,
+                    /ECONNRESET/,
+                    /EAI_AGAIN/,
+                    /PROTOCOL_CONNECTION_LOST/,
+                    /SequelizeConnectionError/,
+                    /SequelizeConnectionRefusedError/,
+                    /SequelizeHostNotFoundError/,
+                    /SequelizeHostNotReachableError/,
+                    /SequelizeConnectionTimedOutError/,
+                    /SequelizeConnectionAcquireTimeoutError/,
+                ],
+            },
         });
     }
     return _sequelize;

package/build/index.d.ts

@@ -30,6 +30,7 @@ export * from './middlewares/error-handler';
 export * from './middlewares/require-auth';
 export * from './middlewares/require-admin';
 export * from './middlewares/validate-request';
+export * from './auth/tokens';
 export * from './events/base-listener';
 export * from './events/base-publisher';
 export * from './events/subjects';

package/build/index.js

@@ -70,6 +70,7 @@ __exportStar(require("./middlewares/error-handler"), exports);
 __exportStar(require("./middlewares/require-auth"), exports);
 __exportStar(require("./middlewares/require-admin"), exports);
 __exportStar(require("./middlewares/validate-request"), exports);
+__exportStar(require("./auth/tokens"), exports);
 __exportStar(require("./events/base-listener"), exports);
 __exportStar(require("./events/base-publisher"), exports);
 __exportStar(require("./events/subjects"), exports);

package/build/middlewares/current-user.d.ts

@@ -1,12 +1,6 @@
 import { Request, Response, NextFunction } from 'express';
-export interface UserPayload {
-    id: string;
-    email: string;
-    userName?: string;
-    role?: 'user' | 'admin';
-    iat: number;
-    exp: number;
-}
+import { VerifiedClaims } from '../auth/tokens';
+export type UserPayload = VerifiedClaims;
 declare module 'express-serve-static-core' {
     interface Request {
         currentUser?: UserPayload;

package/build/middlewares/current-user.js

@@ -1,18 +1,14 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.currentUser = void 0;
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const tokens_1 = require("../auth/tokens");
 const currentUser = (req, res, next) => {
     var _a;
     if (!((_a = req.session) === null || _a === void 0 ? void 0 : _a.jwt)) {
         return next();
     }
     try {
-        const payload = jsonwebtoken_1.default.verify(req.session.jwt, process.env.JWT_KEY);
-        req.currentUser = payload;
+        req.currentUser = (0, tokens_1.verifyAccessToken)(req.session.jwt);
     }
     catch (err) {
         // Invalid or expired token — continue unauthenticated

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ntalmagor/3drise-common",
-  "version": "1.0.17",
+  "version": "1.0.21",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",