@open-mercato/shared 0.4.11-develop.1530.964c5df5df → 0.4.11-develop.1532.54adc3ccbf

package/dist/lib/auth/jwt.js

@@ -21,8 +21,16 @@ function verifyJwt(token, secret = process.env.JWT_SECRET) {
   const [h, p, s] = parts;
   const data = `${h}.${p}`;
   const expected = base64url(crypto.createHmac("sha256", secret).update(data).digest());
-  if (!crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected))) return null;
-  const payload = JSON.parse(Buffer.from(p, "base64").toString("utf8"));
+  const providedSignature = Buffer.from(s);
+  const expectedSignature = Buffer.from(expected);
+  if (providedSignature.length !== expectedSignature.length) return null;
+  if (!crypto.timingSafeEqual(providedSignature, expectedSignature)) return null;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(p, "base64").toString("utf8"));
+  } catch {
+    return null;
+  }
   const now = Math.floor(Date.now() / 1e3);
   if (payload.exp && now > payload.exp) return null;
   return payload;

package/dist/lib/auth/jwt.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/auth/jwt.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\n\nfunction base64url(input: Buffer | string) {\n  return (typeof input === 'string' ? Buffer.from(input) : input)\n    .toString('base64')\n    .replace(/=/g, '')\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n}\n\nexport type JwtPayload = Record<string, any>\n\nexport function signJwt(payload: JwtPayload, secret = process.env.JWT_SECRET!, expiresInSec = 60 * 60 * 8) {\n  if (!secret) throw new Error('JWT_SECRET is not set')\n  const header = { alg: 'HS256', typ: 'JWT' }\n  const now = Math.floor(Date.now() / 1000)\n  const body = { iat: now, exp: now + expiresInSec, ...payload }\n  const encHeader = base64url(JSON.stringify(header))\n  const encBody = base64url(JSON.stringify(body))\n  const data = `${encHeader}.${encBody}`\n  const sig = crypto.createHmac('sha256', secret).update(data).digest()\n  const encSig = base64url(sig)\n  return `${data}.${encSig}`\n}\n\nexport function verifyJwt(token: string, secret = process.env.JWT_SECRET!) {\n  if (!secret) throw new Error('JWT_SECRET is not set')\n  const parts = token.split('.')\n  if (parts.length !== 3) return null\n  const [h, p, s] = parts\n  const data = `${h}.${p}`\n  const expected = base64url(crypto.createHmac('sha256', secret).update(data).digest())\n  if (!crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected))) return null\n  const payload = JSON.parse(Buffer.from(p, 'base64').toString('utf8'))\n  const now = Math.floor(Date.now() / 1000)\n  if (payload.exp && now > payload.exp) return null\n  return payload\n}\n\n"],
-  "mappings": "AAAA,OAAO,YAAY;AAEnB,SAAS,UAAU,OAAwB;AACzC,UAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,OACtD,SAAS,QAAQ,EACjB,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAIO,SAAS,QAAQ,SAAqB,SAAS,QAAQ,IAAI,YAAa,eAAe,KAAK,KAAK,GAAG;AACzG,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,uBAAuB;AACpD,QAAM,SAAS,EAAE,KAAK,SAAS,KAAK,MAAM;AAC1C,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,OAAO,EAAE,KAAK,KAAK,KAAK,MAAM,cAAc,GAAG,QAAQ;AAC7D,QAAM,YAAY,UAAU,KAAK,UAAU,MAAM,CAAC;AAClD,QAAM,UAAU,UAAU,KAAK,UAAU,IAAI,CAAC;AAC9C,QAAM,OAAO,GAAG,SAAS,IAAI,OAAO;AACpC,QAAM,MAAM,OAAO,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO;AACpE,QAAM,SAAS,UAAU,GAAG;AAC5B,SAAO,GAAG,IAAI,IAAI,MAAM;AAC1B;AAEO,SAAS,UAAU,OAAe,SAAS,QAAQ,IAAI,YAAa;AACzE,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,uBAAuB;AACpD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,GAAG,GAAG,CAAC,IAAI;AAClB,QAAM,OAAO,GAAG,CAAC,IAAI,CAAC;AACtB,QAAM,WAAW,UAAU,OAAO,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,CAAC;AACpF,MAAI,CAAC,OAAO,gBAAgB,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,QAAQ,CAAC,EAAG,QAAO;AAC3E,QAAM,UAAU,KAAK,MAAM,OAAO,KAAK,GAAG,QAAQ,EAAE,SAAS,MAAM,CAAC;AACpE,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,MAAI,QAAQ,OAAO,MAAM,QAAQ,IAAK,QAAO;AAC7C,SAAO;AACT;",
+  "sourcesContent": ["import crypto from 'node:crypto'\n\nfunction base64url(input: Buffer | string) {\n  return (typeof input === 'string' ? Buffer.from(input) : input)\n    .toString('base64')\n    .replace(/=/g, '')\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n}\n\nexport type JwtPayload = Record<string, any>\n\nexport function signJwt(payload: JwtPayload, secret = process.env.JWT_SECRET!, expiresInSec = 60 * 60 * 8) {\n  if (!secret) throw new Error('JWT_SECRET is not set')\n  const header = { alg: 'HS256', typ: 'JWT' }\n  const now = Math.floor(Date.now() / 1000)\n  const body = { iat: now, exp: now + expiresInSec, ...payload }\n  const encHeader = base64url(JSON.stringify(header))\n  const encBody = base64url(JSON.stringify(body))\n  const data = `${encHeader}.${encBody}`\n  const sig = crypto.createHmac('sha256', secret).update(data).digest()\n  const encSig = base64url(sig)\n  return `${data}.${encSig}`\n}\n\nexport function verifyJwt(token: string, secret = process.env.JWT_SECRET!) {\n  if (!secret) throw new Error('JWT_SECRET is not set')\n  const parts = token.split('.')\n  if (parts.length !== 3) return null\n  const [h, p, s] = parts\n  const data = `${h}.${p}`\n  const expected = base64url(crypto.createHmac('sha256', secret).update(data).digest())\n  const providedSignature = Buffer.from(s)\n  const expectedSignature = Buffer.from(expected)\n  if (providedSignature.length !== expectedSignature.length) return null\n  if (!crypto.timingSafeEqual(providedSignature, expectedSignature)) return null\n  let payload: JwtPayload\n  try {\n    payload = JSON.parse(Buffer.from(p, 'base64').toString('utf8'))\n  } catch {\n    return null\n  }\n  const now = Math.floor(Date.now() / 1000)\n  if (payload.exp && now > payload.exp) return null\n  return payload\n}\n"],
+  "mappings": "AAAA,OAAO,YAAY;AAEnB,SAAS,UAAU,OAAwB;AACzC,UAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,OACtD,SAAS,QAAQ,EACjB,QAAQ,MAAM,EAAE,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG;AACvB;AAIO,SAAS,QAAQ,SAAqB,SAAS,QAAQ,IAAI,YAAa,eAAe,KAAK,KAAK,GAAG;AACzG,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,uBAAuB;AACpD,QAAM,SAAS,EAAE,KAAK,SAAS,KAAK,MAAM;AAC1C,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,OAAO,EAAE,KAAK,KAAK,KAAK,MAAM,cAAc,GAAG,QAAQ;AAC7D,QAAM,YAAY,UAAU,KAAK,UAAU,MAAM,CAAC;AAClD,QAAM,UAAU,UAAU,KAAK,UAAU,IAAI,CAAC;AAC9C,QAAM,OAAO,GAAG,SAAS,IAAI,OAAO;AACpC,QAAM,MAAM,OAAO,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO;AACpE,QAAM,SAAS,UAAU,GAAG;AAC5B,SAAO,GAAG,IAAI,IAAI,MAAM;AAC1B;AAEO,SAAS,UAAU,OAAe,SAAS,QAAQ,IAAI,YAAa;AACzE,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,uBAAuB;AACpD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,GAAG,GAAG,CAAC,IAAI;AAClB,QAAM,OAAO,GAAG,CAAC,IAAI,CAAC;AACtB,QAAM,WAAW,UAAU,OAAO,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,CAAC;AACpF,QAAM,oBAAoB,OAAO,KAAK,CAAC;AACvC,QAAM,oBAAoB,OAAO,KAAK,QAAQ;AAC9C,MAAI,kBAAkB,WAAW,kBAAkB,OAAQ,QAAO;AAClE,MAAI,CAAC,OAAO,gBAAgB,mBAAmB,iBAAiB,EAAG,QAAO;AAC1E,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,GAAG,QAAQ,EAAE,SAAS,MAAM,CAAC;AAAA,EAChE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,MAAI,QAAQ,OAAO,MAAM,QAAQ,IAAK,QAAO;AAC7C,SAAO;AACT;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.4.11-develop.1530.964c5df5df";
+const APP_VERSION = "0.4.11-develop.1532.54adc3ccbf";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.4.11-develop.1530.964c5df5df'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.4.11-develop.1532.54adc3ccbf'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.4.11-develop.1530.964c5df5df",
+  "version": "0.4.11-develop.1532.54adc3ccbf",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {

package/src/lib/auth/__tests__/jwt.test.ts

@@ -0,0 +1,81 @@
+import crypto from 'node:crypto'
+
+import { signJwt, verifyJwt } from '../jwt'
+
+function base64url(input: Buffer | string): string {
+  return (typeof input === 'string' ? Buffer.from(input) : input)
+    .toString('base64')
+    .replace(/=/g, '')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+}
+
+function signTokenParts(header: string, payload: string, secret: string): string {
+  return base64url(crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest())
+}
+
+describe('jwt helpers', () => {
+  const secret = 'test-secret'
+  const now = new Date('2026-04-11T12:00:00.000Z')
+
+  beforeEach(() => {
+    jest.spyOn(Date, 'now').mockReturnValue(now.getTime())
+  })
+
+  afterEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  it('signs and verifies payloads with issued and expiry timestamps', () => {
+    const token = signJwt({ sub: 'user-1', roles: ['admin'] }, secret, 300)
+
+    expect(verifyJwt(token, secret)).toEqual({
+      sub: 'user-1',
+      roles: ['admin'],
+      iat: Math.floor(now.getTime() / 1000),
+      exp: Math.floor(now.getTime() / 1000) + 300,
+    })
+  })
+
+  it('rejects tokens with tampered payloads', () => {
+    const token = signJwt({ sub: 'user-1' }, secret, 300)
+    const [header, , signature] = token.split('.')
+    const tamperedPayload = base64url(
+      JSON.stringify({
+        sub: 'user-2',
+        iat: Math.floor(now.getTime() / 1000),
+        exp: Math.floor(now.getTime() / 1000) + 300,
+      })
+    )
+
+    expect(verifyJwt(`${header}.${tamperedPayload}.${signature}`, secret)).toBeNull()
+  })
+
+  it('rejects expired tokens', () => {
+    const token = signJwt({ sub: 'user-1' }, secret, 1)
+
+    jest.spyOn(Date, 'now').mockReturnValue(now.getTime() + 3_000)
+
+    expect(verifyJwt(token, secret)).toBeNull()
+  })
+
+  it('returns null for malformed signatures', () => {
+    const token = signJwt({ sub: 'user-1' }, secret, 300)
+    const [header, payload] = token.split('.')
+
+    expect(verifyJwt(`${header}.${payload}.x`, secret)).toBeNull()
+  })
+
+  it('returns null for signed payloads that are not valid JSON', () => {
+    const header = base64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))
+    const payload = base64url('not-json')
+    const signature = signTokenParts(header, payload, secret)
+
+    expect(verifyJwt(`${header}.${payload}.${signature}`, secret)).toBeNull()
+  })
+
+  it('throws when the JWT secret is missing', () => {
+    expect(() => signJwt({ sub: 'user-1' }, '')).toThrow('JWT_SECRET is not set')
+    expect(() => verifyJwt('header.payload.signature', '')).toThrow('JWT_SECRET is not set')
+  })
+})

package/src/lib/auth/jwt.ts

@@ -30,10 +30,17 @@ export function verifyJwt(token: string, secret = process.env.JWT_SECRET!) {
   const [h, p, s] = parts
   const data = `${h}.${p}`
   const expected = base64url(crypto.createHmac('sha256', secret).update(data).digest())
-  if (!crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected))) return null
-  const payload = JSON.parse(Buffer.from(p, 'base64').toString('utf8'))
+  const providedSignature = Buffer.from(s)
+  const expectedSignature = Buffer.from(expected)
+  if (providedSignature.length !== expectedSignature.length) return null
+  if (!crypto.timingSafeEqual(providedSignature, expectedSignature)) return null
+  let payload: JwtPayload
+  try {
+    payload = JSON.parse(Buffer.from(p, 'base64').toString('utf8'))
+  } catch {
+    return null
+  }
   const now = Math.floor(Date.now() / 1000)
   if (payload.exp && now > payload.exp) return null
   return payload
 }
-