@onlineapps/infrastructure-tools 1.1.4 → 1.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onlineapps/infrastructure-tools",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Infrastructure orchestration utilities for OA Drive infrastructure services (health tracking, queue initialization, service discovery)",
   "main": "src/index.js",
   "scripts": {
@@ -19,7 +19,7 @@
   "license": "MIT",
   "dependencies": {
     "@onlineapps/infra-logger": "1.0.0",
-    "@onlineapps/mq-client-core": "1.0.82",
+    "@onlineapps/mq-client-core": "1.0.83",
     "@onlineapps/service-common": "1.0.18",
     "@onlineapps/storage-core": "1.0.12",
     "jsonwebtoken": "^9.0.3",

package/src/jwt/createJwtValidator.js

@@ -2,6 +2,9 @@
 
 const { verifyAccessToken } = require('./verifyAccessToken');
 
+// See: docs/standards/JWT_AUTH.md §9.1 — forced refresh on role change
+const ROLES_VERSION_PREFIX = 'person:roles_version:';
+
 /**
  * Create Express middleware that validates JWT Bearer tokens on incoming requests.
  *
@@ -12,16 +15,17 @@ const { verifyAccessToken } = require('./verifyAccessToken');
  * @param {object} options
  * @param {object} options.logger - Logger with .warn() method (required)
  * @param {string[]} [options.excludePaths] - Paths to skip JWT validation
+ * @param {object} [options.redisClient] - Redis client for role version check (optional)
  * @returns {Function} Express middleware (req, res, next)
  */
-function createJwtValidator({ logger, excludePaths }) {
+function createJwtValidator({ logger, excludePaths, redisClient }) {
   if (!logger || typeof logger.warn !== 'function') {
     throw new Error('[JWT] Logger is required - Expected object with warn() method');
   }
 
   const excluded = new Set(excludePaths || []);
 
-  return function jwtValidator(req, res, next) {
+  return async function jwtValidator(req, res, next) {
     if (excluded.has(req.path)) {
       return next();
     }
@@ -38,6 +42,29 @@ function createJwtValidator({ logger, excludePaths }) {
     try {
       const decoded = verifyAccessToken(token);
 
+      if (redisClient && redisClient.isOpen && decoded.person_id) {
+        try {
+          const rolesVersion = await redisClient.get(`${ROLES_VERSION_PREFIX}${decoded.person_id}`);
+          if (rolesVersion) {
+            const versionTs = parseInt(rolesVersion, 10);
+            const tokenIat = decoded.iat * 1000;
+            if (!isNaN(versionTs) && tokenIat < versionTs) {
+              logger.warn('[JWT] Token stale — role changed after issuance', {
+                person_id: decoded.person_id,
+                token_iat: new Date(tokenIat).toISOString(),
+                roles_changed: new Date(versionTs).toISOString()
+              });
+              return res.status(401).json({
+                error: 'Token stale — your roles have changed, please refresh your access token',
+                code: 'TOKEN_STALE'
+              });
+            }
+          }
+        } catch (redisErr) {
+          logger.warn('[JWT] Redis role version check failed (non-blocking)', { error: redisErr.message });
+        }
+      }
+
       req.auth = {
         person_uuid: decoded.sub,
         person_id: decoded.person_id,
@@ -59,4 +86,4 @@ function createJwtValidator({ logger, excludePaths }) {
   };
 }
 
-module.exports = { createJwtValidator };
+module.exports = { createJwtValidator, ROLES_VERSION_PREFIX };

package/src/jwt/extractTenantContext.js

@@ -9,15 +9,19 @@
  * Rules (per JWT_AUTH.md section 7):
  *  - Single tenant: auto-pick, x-tenant-uuid header optional
  *  - Multiple tenants: x-tenant-uuid header required
- *  - workspace_id is required (no fallback) — see docs/standards/tenant-context-contract.md
+ *  - workspace_id: required for direct API calls (x-workspace-id header),
+ *    optional for workflow submission (workspace is per-step in cookbook)
  *
  * @param {object} auth - req.auth from createJwtValidator: { person_uuid, person_id, email, tenants }
  * @param {object} headers - HTTP request headers (lowercase keys)
+ * @param {object} [options] - { requireWorkspace: true } — set false for workflow submission
  * @returns {object} { tenant_id, tenant_uuid, workspace_id, person_id, person_uuid, role }
  * @throws {Error} with .statusCode = 400, 401, or 403
  */
 // See: docs/standards/tenant-context-contract.md
-function extractTenantContext(auth, headers) {
+function extractTenantContext(auth, headers, options) {
+  const { requireWorkspace = true } = options || {};
+
   if (!auth || !Array.isArray(auth.tenants)) {
     const err = new Error('[TenantContext] Missing auth data - Expected auth object with tenants array');
     err.statusCode = 401;
@@ -27,14 +31,16 @@ function extractTenantContext(auth, headers) {
   const tenantUuid = headers['x-tenant-uuid'];
   const rawWorkspaceId = headers['x-workspace-id'];
 
-  if (!rawWorkspaceId) {
-    const err = new Error('[TenantContext] Missing x-workspace-id header - workspace is required for business operations');
-    err.statusCode = 400;
-    throw err;
-  }
-  const workspaceId = parseInt(rawWorkspaceId, 10);
-  if (isNaN(workspaceId) || workspaceId < 1) {
-    const err = new Error(`[TenantContext] Invalid x-workspace-id '${rawWorkspaceId}' - must be a positive integer`);
+  let workspaceId = null;
+  if (rawWorkspaceId) {
+    workspaceId = parseInt(rawWorkspaceId, 10);
+    if (isNaN(workspaceId) || workspaceId < 1) {
+      const err = new Error(`[TenantContext] Invalid x-workspace-id '${rawWorkspaceId}' - must be a positive integer`);
+      err.statusCode = 400;
+      throw err;
+    }
+  } else if (requireWorkspace) {
+    const err = new Error('[TenantContext] Missing x-workspace-id header - workspace is required for direct API calls');
     err.statusCode = 400;
     throw err;
   }

package/src/jwt/index.js

@@ -1,11 +1,12 @@
 'use strict';
 
 const { verifyAccessToken } = require('./verifyAccessToken');
-const { createJwtValidator } = require('./createJwtValidator');
+const { createJwtValidator, ROLES_VERSION_PREFIX } = require('./createJwtValidator');
 const { extractTenantContext } = require('./extractTenantContext');
 
 module.exports = {
   verifyAccessToken,
   createJwtValidator,
-  extractTenantContext
+  extractTenantContext,
+  ROLES_VERSION_PREFIX
 };