@platform-modules/civil-aviation-authority 2.3.302 → 2.3.303

package/dist/auth/authenticate-jwt-session.d.ts

@@ -0,0 +1,19 @@
+import type { UserSessionReader } from './user-session-validation';
+export type JwtAuthFailure = {
+    ok: false;
+    statusCode: 401;
+    message: string;
+};
+export type JwtAuthSuccess = {
+    ok: true;
+    claims: Record<string, unknown>;
+    userId: number;
+    sessionId: number | null;
+};
+export type JwtAuthResult = JwtAuthSuccess | JwtAuthFailure;
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+export declare function authorizeVerifiedJwtSession(verified: Record<string, unknown>, sessionReader: UserSessionReader, options?: {
+    requireActiveSession?: boolean;
+}): Promise<JwtAuthResult>;

package/dist/auth/authenticate-jwt-session.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeVerifiedJwtSession = authorizeVerifiedJwtSession;
+const jwt_token_helper_1 = require("./jwt-token.helper");
+const user_session_validation_1 = require("./user-session-validation");
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+async function authorizeVerifiedJwtSession(verified, sessionReader, options) {
+    const parsed = (0, jwt_token_helper_1.parseVerifiedJwtClaims)(verified);
+    if (!parsed) {
+        return { ok: false, statusCode: 401, message: 'Invalid Token' };
+    }
+    const requireActiveSession = options?.requireActiveSession !== false;
+    if (requireActiveSession) {
+        const sessionValid = await (0, user_session_validation_1.validateUserSessionBinding)(parsed.userId, parsed.sessionId, sessionReader);
+        if (!sessionValid) {
+            return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+        }
+    }
+    return {
+        ok: true,
+        claims: parsed.raw,
+        userId: parsed.userId,
+        sessionId: parsed.sessionId,
+    };
+}

package/dist/auth/jwt-token.helper.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Extract CAA API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+export declare function extractJwtToken(headers: Record<string, string | string[] | undefined> | undefined): string | null;
+export type JwtTokenRequest = {
+    headers: Record<string, string | string[] | undefined>;
+    body?: unknown;
+};
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+export declare function extractJwtTokenFromRequest(request: JwtTokenRequest): string | null;
+export type VerifiedJwtClaims = {
+    userId: number;
+    sessionId: number | null;
+    raw: Record<string, unknown>;
+};
+/** Parse verified JWT payload into userId + sessionId. */
+export declare function parseVerifiedJwtClaims(verified: Record<string, unknown>): VerifiedJwtClaims | null;

package/dist/auth/jwt-token.helper.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractJwtToken = extractJwtToken;
+exports.extractJwtTokenFromRequest = extractJwtTokenFromRequest;
+exports.parseVerifiedJwtClaims = parseVerifiedJwtClaims;
+/**
+ * Extract CAA API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+function extractJwtToken(headers) {
+    if (!headers)
+        return null;
+    const pick = (value) => {
+        const raw = Array.isArray(value) ? value[0] : value;
+        const trimmed = raw?.trim();
+        return trimmed ? trimmed : null;
+    };
+    const fromJwtHeader = pick(headers.jwt ?? headers.JWT);
+    if (fromJwtHeader)
+        return fromJwtHeader;
+    const authorization = pick(headers.authorization ?? headers.Authorization);
+    if (!authorization)
+        return null;
+    const bearerMatch = /^Bearer\s+(.+)$/i.exec(authorization);
+    if (bearerMatch?.[1]?.trim())
+        return bearerMatch[1].trim();
+    return authorization;
+}
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+function extractJwtTokenFromRequest(request) {
+    const fromHeaders = extractJwtToken(request.headers);
+    if (fromHeaders)
+        return fromHeaders;
+    const body = request.body;
+    if (!body || typeof body !== 'object')
+        return null;
+    for (const key of ['token', 'jwt', 'access_token']) {
+        const value = body[key];
+        if (typeof value === 'string' && value.trim())
+            return value.trim();
+    }
+    return null;
+}
+/** Parse verified JWT payload into userId + sessionId. */
+function parseVerifiedJwtClaims(verified) {
+    const userId = Number(verified.userId);
+    if (!Number.isFinite(userId) || userId <= 0)
+        return null;
+    const sessionIdRaw = verified.sessionId;
+    const parsedSessionId = sessionIdRaw == null || sessionIdRaw === '' ? null : Number(sessionIdRaw);
+    return {
+        userId,
+        sessionId: parsedSessionId != null && Number.isFinite(parsedSessionId) && parsedSessionId > 0
+            ? parsedSessionId
+            : null,
+        raw: verified,
+    };
+}

package/dist/auth/user-session-validation.d.ts

@@ -16,6 +16,10 @@ export declare function resolveJwtSessionId(sessionId: unknown): number | null;
  */
 export declare function validateUserSessionBinding(userId: number, sessionId: number | null | undefined, reader: UserSessionReader): Promise<boolean>;
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
+export declare function applyActiveUserSessionFilters(qb: {
+    andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+}, alias?: string): void;
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 export declare function activeUserSessionSql(alias?: string): {
     clause: string;
     params: Record<string, unknown>;

package/dist/auth/user-session-validation.js

@@ -8,6 +8,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isRequireJwtSessionId = isRequireJwtSessionId;
 exports.resolveJwtSessionId = resolveJwtSessionId;
 exports.validateUserSessionBinding = validateUserSessionBinding;
+exports.applyActiveUserSessionFilters = applyActiveUserSessionFilters;
 exports.activeUserSessionSql = activeUserSessionSql;
 /** When true (default), JWT must include sessionId and that session must be active. */
 function isRequireJwtSessionId() {
@@ -41,6 +42,12 @@ async function validateUserSessionBinding(userId, sessionId, reader) {
     return !!legacy;
 }
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
+function applyActiveUserSessionFilters(qb, alias = 'user_sessions') {
+    qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
+    qb.andWhere(`${alias}.is_deleted = :is_deleted`, { is_deleted: false });
+    qb.andWhere(`(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`, { session_now: new Date() });
+}
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 function activeUserSessionSql(alias = 'user_sessions') {
     return {
         clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,

package/dist/index.d.ts

@@ -2,6 +2,8 @@ export * from './models/user';
 export * from './models/role';
 export * from './models/user-sessions';
 export * from './auth/user-session-validation';
+export * from './auth/jwt-token.helper';
+export * from './auth/authenticate-jwt-session';
 export * from './models/ITHelpDeskModel';
 export * from './models/ServiceTypeModel';
 export * from './models/CAAServices';

package/dist/index.js

@@ -21,6 +21,8 @@ __exportStar(require("./models/user"), exports);
 __exportStar(require("./models/role"), exports);
 __exportStar(require("./models/user-sessions"), exports);
 __exportStar(require("./auth/user-session-validation"), exports);
+__exportStar(require("./auth/jwt-token.helper"), exports);
+__exportStar(require("./auth/authenticate-jwt-session"), exports);
 __exportStar(require("./models/ITHelpDeskModel"), exports);
 // export * from './models/ITServicesTypesSalalahModel'; // REMOVED - table no longer used
 // export * from './models/ITServicesTypesMuscatModel'; // REMOVED - table no longer used

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "@platform-modules/civil-aviation-authority",
-  "version": "2.3.302",
+  "version": "2.3.303",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
   "scripts": {

package/src/auth/authenticate-jwt-session.ts

@@ -0,0 +1,51 @@
+import { parseVerifiedJwtClaims } from './jwt-token.helper';
+import { validateUserSessionBinding } from './user-session-validation';
+import type { UserSessionReader } from './user-session-validation';
+
+export type JwtAuthFailure = {
+  ok: false;
+  statusCode: 401;
+  message: string;
+};
+
+export type JwtAuthSuccess = {
+  ok: true;
+  claims: Record<string, unknown>;
+  userId: number;
+  sessionId: number | null;
+};
+
+export type JwtAuthResult = JwtAuthSuccess | JwtAuthFailure;
+
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+export async function authorizeVerifiedJwtSession(
+  verified: Record<string, unknown>,
+  sessionReader: UserSessionReader,
+  options?: { requireActiveSession?: boolean },
+): Promise<JwtAuthResult> {
+  const parsed = parseVerifiedJwtClaims(verified);
+  if (!parsed) {
+    return { ok: false, statusCode: 401, message: 'Invalid Token' };
+  }
+
+  const requireActiveSession = options?.requireActiveSession !== false;
+  if (requireActiveSession) {
+    const sessionValid = await validateUserSessionBinding(
+      parsed.userId,
+      parsed.sessionId,
+      sessionReader,
+    );
+    if (!sessionValid) {
+      return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+    }
+  }
+
+  return {
+    ok: true,
+    claims: parsed.raw,
+    userId: parsed.userId,
+    sessionId: parsed.sessionId,
+  };
+}

package/src/auth/jwt-token.helper.ts

@@ -0,0 +1,71 @@
+/**
+ * Extract CAA API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+export function extractJwtToken(
+  headers: Record<string, string | string[] | undefined> | undefined,
+): string | null {
+  if (!headers) return null;
+
+  const pick = (value: string | string[] | undefined): string | null => {
+    const raw = Array.isArray(value) ? value[0] : value;
+    const trimmed = raw?.trim();
+    return trimmed ? trimmed : null;
+  };
+
+  const fromJwtHeader = pick(headers.jwt ?? headers.JWT);
+  if (fromJwtHeader) return fromJwtHeader;
+
+  const authorization = pick(headers.authorization ?? headers.Authorization);
+  if (!authorization) return null;
+
+  const bearerMatch = /^Bearer\s+(.+)$/i.exec(authorization);
+  if (bearerMatch?.[1]?.trim()) return bearerMatch[1].trim();
+
+  return authorization;
+}
+
+export type JwtTokenRequest = {
+  headers: Record<string, string | string[] | undefined>;
+  body?: unknown;
+};
+
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+export function extractJwtTokenFromRequest(request: JwtTokenRequest): string | null {
+  const fromHeaders = extractJwtToken(request.headers);
+  if (fromHeaders) return fromHeaders;
+
+  const body = request.body as Record<string, unknown> | undefined;
+  if (!body || typeof body !== 'object') return null;
+
+  for (const key of ['token', 'jwt', 'access_token'] as const) {
+    const value = body[key];
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return null;
+}
+
+export type VerifiedJwtClaims = {
+  userId: number;
+  sessionId: number | null;
+  raw: Record<string, unknown>;
+};
+
+/** Parse verified JWT payload into userId + sessionId. */
+export function parseVerifiedJwtClaims(verified: Record<string, unknown>): VerifiedJwtClaims | null {
+  const userId = Number(verified.userId);
+  if (!Number.isFinite(userId) || userId <= 0) return null;
+
+  const sessionIdRaw = verified.sessionId;
+  const parsedSessionId =
+    sessionIdRaw == null || sessionIdRaw === '' ? null : Number(sessionIdRaw);
+
+  return {
+    userId,
+    sessionId:
+      parsedSessionId != null && Number.isFinite(parsedSessionId) && parsedSessionId > 0
+        ? parsedSessionId
+        : null,
+    raw: verified,
+  };
+}

package/src/auth/user-session-validation.ts

@@ -48,6 +48,21 @@ export async function validateUserSessionBinding(
 }
 
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
+export function applyActiveUserSessionFilters(
+  qb: {
+    andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+  },
+  alias = 'user_sessions',
+): void {
+  qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
+  qb.andWhere(`${alias}.is_deleted = :is_deleted`, { is_deleted: false });
+  qb.andWhere(
+    `(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+    { session_now: new Date() },
+  );
+}
+
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 export function activeUserSessionSql(alias = 'user_sessions'): {
   clause: string;
   params: Record<string, unknown>;

package/src/index.ts

@@ -4,6 +4,8 @@ export * from './models/user';
 export * from './models/role';
 export * from './models/user-sessions';
 export * from './auth/user-session-validation';
+export * from './auth/jwt-token.helper';
+export * from './auth/authenticate-jwt-session';
 export * from './models/ITHelpDeskModel';
 // export * from './models/ITServicesTypesSalalahModel'; // REMOVED - table no longer used
 // export * from './models/ITServicesTypesMuscatModel'; // REMOVED - table no longer used