@sebastienrousseau/crypto-middleware 0.0.7 → 0.0.9

package/README.md

@@ -142,16 +142,23 @@ lets you scope protection to specific endpoints.
 
 ### Configuration
 
-| Option       | Type       | Required | Description                                       |
-| :----------- | :--------- | :------- | :------------------------------------------------ |
-| `key`        | `string`   | \*       | Hex-encoded 256-bit key for encryption/decryption |
-| `routes`     | `string[]` | No       | Glob patterns for routes to apply middleware to   |
-| `operations` | `string[]` | No       | Operations to perform (see below)                 |
-| `hmacKey`    | `string`   | \*       | Hex-encoded HMAC key for signature verification   |
-| `jwtSecret`  | `string`   | \*       | Secret for HS256 JWT verification                 |
+| Option        | Type       | Required | Description                                       |
+| :------------ | :--------- | :------- | :------------------------------------------------ |
+| `key`         | `string`   | \*       | Hex-encoded 256-bit key for encryption/decryption |
+| `routes`      | `string[]` | No       | Glob patterns for routes to apply middleware to   |
+| `operations`  | `string[]` | No       | Operations to perform (see below)                 |
+| `hmacKey`     | `string`   | \*       | Hex-encoded HMAC key for signature verification   |
+| `jwtSecret`   | `string`   | \*       | Secret for HS256 JWT verification                 |
+| `jwtIssuer`   | `string`   | No       | Required `iss` claim for `verify-jwt`             |
+| `jwtAudience` | `string`   | No       | Required `aud` value for `verify-jwt`             |
 
 \* Required when the corresponding operation is enabled.
 
+`verify-jwt` accepts only HS256 (any other `alg`, including `none`, is
+rejected), requires a numeric `exp` claim, checks `nbf` when present, and
+checks `iss` and `aud` when `jwtIssuer` / `jwtAudience` are set. Set both
+when the secret is shared with any other service.
+
 ### Operations
 
 | Operation          | Description                                            |
@@ -240,6 +247,8 @@ All 18 packages in the Crypto Service workspace maintain a **100% coverage floor
 
 Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/sebastienrousseau/crypto-service/security/advisories) or according to [`SECURITY.md`](../../SECURITY.md). Never report security issues publicly.
 
+The middleware verifies JWTs and HMAC signatures but does not rate-limit them. Register a rate limiter in the host application (for example [`@fastify/rate-limit`](https://github.com/fastify/fastify-rate-limit) or [`express-rate-limit`](https://github.com/express-rate-limit/express-rate-limit)) in front of the routes it protects, as `crypto-server` does.
+
 Cryptographic operations use the `@noble/*` libraries, Node.js `crypto` and OpenPGP.js. `@noble/post-quantum` has not been independently audited and does not guarantee constant-time execution, and no module in this suite is FIPS 140-3 validated. Key zeroization is limited: JavaScript strings and garbage-collected buffers cannot be reliably wiped. See [`SECURITY.md`](../../SECURITY.md).
 
 <p align="right"><a href="#contents">Back to Top</a></p>

package/dist/common.d.ts

@@ -1,7 +1,13 @@
-import { JwtPayload } from "./types";
+import { JwtPayload, MiddlewareConfig } from "./types";
 export declare function encryptPayload(key: string, data: unknown): string;
 export declare function decryptPayload(key: string, sealed: string): unknown;
 export declare function verifyHmacSignature(hmacKey: string, body: string, signature: string): boolean;
-export declare function verifyJwt(jwtSecret: string, token: string): JwtPayload;
+export interface JwtVerifyOptions {
+    issuer?: string | undefined;
+    audience?: string | undefined;
+}
+export declare function verifyJwt(jwtSecret: string, token: string, options?: JwtVerifyOptions): JwtPayload;
+export declare function verifyBearerJwt(config: MiddlewareConfig, authorization: string | undefined): JwtPayload;
+export declare function verifyRequestSignature(config: MiddlewareConfig, headers: Record<string, string | string[] | undefined>, body: unknown): void;
 export declare function matchRoute(path: string, routes: string[]): boolean;
 //# sourceMappingURL=common.d.ts.map

package/dist/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAyB,UAAU,EAAE,MAAM,SAAS,CAAC;AAgB5D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAIjE;AAgBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAYnE;AAsBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CA4BT;AA6BD,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAqGtE;AAoBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAYlE"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAyB,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAgB9E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,CAIjE;AAgBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAYnE;AAsBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CA4BT;AAWD,MAAM,WAAW,gBAAgB;IAK/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAM5B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAiHD,wBAAgB,SAAS,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CAcZ;AAUD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,EACxB,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,UAAU,CAcZ;AAUD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,IAAI,EAAE,OAAO,GACZ,IAAI,CAcN;AAoBD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAYlE"}

package/dist/common.js

@@ -4,6 +4,8 @@ exports.encryptPayload = encryptPayload;
 exports.decryptPayload = decryptPayload;
 exports.verifyHmacSignature = verifyHmacSignature;
 exports.verifyJwt = verifyJwt;
+exports.verifyBearerJwt = verifyBearerJwt;
+exports.verifyRequestSignature = verifyRequestSignature;
 exports.matchRoute = matchRoute;
 const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const types_1 = require("./types");
@@ -42,26 +44,32 @@ function base64urlDecode(input) {
     const padded = input + "=".repeat((4 - (input.length % 4)) % 4);
     return Buffer.from(padded, "base64").toString("utf8");
 }
-function verifyJwt(jwtSecret, token) {
-    if (!token) {
-        throw new types_1.CryptoMiddlewareError("Missing JWT token", 401, "MISSING_TOKEN");
-    }
+function reject(message, code) {
+    throw new types_1.CryptoMiddlewareError(message, 401, code);
+}
+function splitToken(token) {
+    if (!token)
+        reject("Missing JWT token", "MISSING_TOKEN");
     const parts = token.split(".");
     if (parts.length !== 3) {
-        throw new types_1.CryptoMiddlewareError("Malformed JWT: expected 3 parts", 401, "MALFORMED_TOKEN");
+        reject("Malformed JWT: expected 3 parts", "MALFORMED_TOKEN");
     }
-    const [headerB64, payloadB64, signatureB64] = parts;
-    let header;
+    return parts;
+}
+function decodeObject(segment, name) {
+    let value;
     try {
-        header = JSON.parse(base64urlDecode(headerB64));
+        value = JSON.parse(base64urlDecode(segment));
     }
     catch {
-        throw new types_1.CryptoMiddlewareError("Malformed JWT header", 401, "MALFORMED_TOKEN");
+        value = undefined;
     }
-    if (header.alg !== "HS256") {
-        throw new types_1.CryptoMiddlewareError(`Unsupported JWT algorithm: ${header.alg}. Only HS256 is supported.`, 401, "UNSUPPORTED_ALGORITHM");
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        reject(`Malformed JWT ${name}`, "MALFORMED_TOKEN");
     }
-    const signingInput = `${headerB64}.${payloadB64}`;
+    return value;
+}
+function checkSignature(jwtSecret, signingInput, signatureB64) {
     const keyHex = Buffer.from(jwtSecret, "utf8").toString("hex");
     const computed = (0, crypto_lib_1.computeHmac)({
         algorithm: "sha256",
@@ -69,33 +77,71 @@ function verifyJwt(jwtSecret, token) {
         data: signingInput,
     });
     const sigPadded = signatureB64 + "=".repeat((4 - (signatureB64.length % 4)) % 4);
-    const sigHex = Buffer.from(sigPadded, "base64").toString("hex");
+    const signatureBytes = Buffer.from(sigPadded, "base64");
     const computedBytes = Buffer.from(computed.mac, "hex");
-    const signatureBytes = Buffer.from(sigHex, "hex");
     if (!(0, crypto_lib_1.timingSafeEqual)(computedBytes, signatureBytes)) {
-        throw new types_1.CryptoMiddlewareError("Invalid JWT signature", 401, "INVALID_TOKEN");
+        reject("Invalid JWT signature", "INVALID_TOKEN");
     }
-    let payload;
-    try {
-        payload = JSON.parse(base64urlDecode(payloadB64));
+}
+function checkTimes(payload) {
+    const now = Math.floor(Date.now() / 1000);
+    if (typeof payload.exp !== "number") {
+        reject("JWT has no numeric exp claim", "MISSING_EXPIRATION");
     }
-    catch {
-        throw new types_1.CryptoMiddlewareError("Malformed JWT payload", 401, "MALFORMED_TOKEN");
+    if (now >= payload.exp)
+        reject("JWT has expired", "TOKEN_EXPIRED");
+    if (payload.nbf === undefined)
+        return;
+    if (typeof payload.nbf !== "number") {
+        reject("JWT nbf claim is not a number", "MALFORMED_TOKEN");
     }
-    if (payload.exp !== undefined) {
-        const now = Math.floor(Date.now() / 1000);
-        if (now >= payload.exp) {
-            throw new types_1.CryptoMiddlewareError("JWT has expired", 401, "TOKEN_EXPIRED");
-        }
+    if (now < payload.nbf)
+        reject("JWT is not yet valid", "TOKEN_NOT_YET_VALID");
+}
+function checkIssuerAudience(payload, options) {
+    if (options.issuer !== undefined && payload.iss !== options.issuer) {
+        reject("JWT issuer is not accepted", "INVALID_ISSUER");
     }
-    if (payload.nbf !== undefined) {
-        const now = Math.floor(Date.now() / 1000);
-        if (now < payload.nbf) {
-            throw new types_1.CryptoMiddlewareError("JWT is not yet valid", 401, "TOKEN_NOT_YET_VALID");
-        }
+    if (options.audience === undefined)
+        return;
+    const aud = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    if (!aud.includes(options.audience)) {
+        reject("JWT audience is not accepted", "INVALID_AUDIENCE");
     }
+}
+function verifyJwt(jwtSecret, token, options = {}) {
+    const [headerB64, payloadB64, signatureB64] = splitToken(token);
+    const header = decodeObject(headerB64, "header");
+    if (header["alg"] !== "HS256") {
+        reject(`Unsupported JWT algorithm: ${String(header["alg"])}. Only HS256 is supported.`, "UNSUPPORTED_ALGORITHM");
+    }
+    checkSignature(jwtSecret, `${headerB64}.${payloadB64}`, signatureB64);
+    const payload = decodeObject(payloadB64, "payload");
+    checkTimes(payload);
+    checkIssuerAudience(payload, options);
     return payload;
 }
+function verifyBearerJwt(config, authorization) {
+    if (!config.jwtSecret) {
+        throw new types_1.CryptoMiddlewareError("jwtSecret is required for verify-jwt operation", 500, "MISSING_CONFIG");
+    }
+    const header = authorization ?? "";
+    const token = header.startsWith("Bearer ") ? header.slice(7) : "";
+    return verifyJwt(config.jwtSecret, token, {
+        issuer: config.jwtIssuer,
+        audience: config.jwtAudience,
+    });
+}
+function verifyRequestSignature(config, headers, body) {
+    if (!config.hmacKey) {
+        throw new types_1.CryptoMiddlewareError("hmacKey is required for verify-signature operation", 500, "MISSING_CONFIG");
+    }
+    const signature = headers["x-signature"] ??
+        headers["x-hub-signature-256"] ??
+        "";
+    const rawBody = typeof body === "string" ? body : JSON.stringify(body);
+    verifyHmacSignature(config.hmacKey, rawBody, signature);
+}
 function matchRoute(path, routes) {
     if (routes.length === 0)
         return true;

package/dist/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,SAAS,CAAC;AA6BlE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,IAK3D,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,MAAM,YAAY,KACjB,IAAI,CA0FR"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,SAAS,CAAC;AAwFlE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,IAK3D,KAAK,OAAO,EACZ,KAAK,QAAQ,EACb,MAAM,YAAY,KACjB,IAAI,CAqBR"}

package/dist/express.js

@@ -3,6 +3,39 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createCryptoMiddleware = createCryptoMiddleware;
 const types_1 = require("./types");
 const common_1 = require("./common");
+function requireKey(config, operation) {
+    if (!config.key) {
+        throw new types_1.CryptoMiddlewareError(`key is required for ${operation} operation`, 500, "MISSING_CONFIG");
+    }
+    return config.key;
+}
+function decryptBody(config, req) {
+    const key = requireKey(config, "decrypt-request");
+    if (req.body && typeof req.body === "object" && "encrypted" in req.body) {
+        req.body = (0, common_1.decryptPayload)(key, req.body.encrypted);
+    }
+}
+function encryptJsonResponses(config, res) {
+    const key = requireKey(config, "encrypt-response");
+    const originalJson = res.json.bind(res);
+    res.json = function encryptedJson(body) {
+        const sealed = (0, common_1.encryptPayload)(key, body);
+        return originalJson({ encrypted: sealed });
+    };
+}
+function applyOperations(config, operations, req, res) {
+    if (operations.includes("verify-jwt")) {
+        req.jwtPayload = (0, common_1.verifyBearerJwt)(config, req.headers.authorization);
+    }
+    if (operations.includes("verify-signature")) {
+        (0, common_1.verifyRequestSignature)(config, req.headers, req.body);
+    }
+    if (operations.includes("decrypt-request"))
+        decryptBody(config, req);
+    if (operations.includes("encrypt-response")) {
+        encryptJsonResponses(config, res);
+    }
+}
 function createCryptoMiddleware(config) {
     const operations = config.operations ?? [];
     const routes = config.routes ?? [];
@@ -12,47 +45,7 @@ function createCryptoMiddleware(config) {
             return;
         }
         try {
-            if (operations.includes("verify-jwt")) {
-                if (!config.jwtSecret) {
-                    throw new types_1.CryptoMiddlewareError("jwtSecret is required for verify-jwt operation", 500, "MISSING_CONFIG");
-                }
-                const authHeader = req.headers.authorization ?? "";
-                const token = authHeader.startsWith("Bearer ")
-                    ? authHeader.slice(7)
-                    : "";
-                const payload = (0, common_1.verifyJwt)(config.jwtSecret, token);
-                req.jwtPayload = payload;
-            }
-            if (operations.includes("verify-signature")) {
-                if (!config.hmacKey) {
-                    throw new types_1.CryptoMiddlewareError("hmacKey is required for verify-signature operation", 500, "MISSING_CONFIG");
-                }
-                const signature = req.headers["x-signature"] ??
-                    req.headers["x-hub-signature-256"] ??
-                    "";
-                const rawBody = typeof req.body === "string" ? req.body : JSON.stringify(req.body);
-                (0, common_1.verifyHmacSignature)(config.hmacKey, rawBody, signature);
-            }
-            if (operations.includes("decrypt-request")) {
-                if (!config.key) {
-                    throw new types_1.CryptoMiddlewareError("key is required for decrypt-request operation", 500, "MISSING_CONFIG");
-                }
-                if (req.body &&
-                    typeof req.body === "object" &&
-                    "encrypted" in req.body) {
-                    req.body = (0, common_1.decryptPayload)(config.key, req.body.encrypted);
-                }
-            }
-            if (operations.includes("encrypt-response")) {
-                if (!config.key) {
-                    throw new types_1.CryptoMiddlewareError("key is required for encrypt-response operation", 500, "MISSING_CONFIG");
-                }
-                const originalJson = res.json.bind(res);
-                res.json = function encryptedJson(body) {
-                    const sealed = (0, common_1.encryptPayload)(config.key, body);
-                    return originalJson({ encrypted: sealed });
-                };
-            }
+            applyOperations(config, operations, req, res);
             next();
         }
         catch (err) {

package/dist/fastify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,SAAS,CAAC;AAyBlE,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAiHf;AAGD,eAAO,MAAM,YAAY,yBAGvB,CAAC"}
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAyB,MAAM,SAAS,CAAC;AA8HlE,iBAAe,gBAAgB,CAC7B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAGD,eAAO,MAAM,YAAY,yBAGvB,CAAC"}

package/dist/fastify.js

@@ -7,94 +7,82 @@ exports.cryptoPlugin = void 0;
 const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
 const types_1 = require("./types");
 const common_1 = require("./common");
-async function cryptoPluginImpl(fastify, opts) {
-    const operations = opts.operations ?? [];
-    const routes = opts.routes ?? [];
+function sendMiddlewareError(reply, err) {
+    if (err instanceof types_1.CryptoMiddlewareError) {
+        reply.code(err.statusCode).send({
+            error: err.message,
+            code: err.code,
+        });
+        return;
+    }
+    throw err;
+}
+function registerVerification(fastify, opts, operations, routes) {
     fastify.addHook("onRequest", async (request, reply) => {
         if (!(0, common_1.matchRoute)(request.url, routes))
             return;
         try {
             if (operations.includes("verify-jwt")) {
-                if (!opts.jwtSecret) {
-                    throw new types_1.CryptoMiddlewareError("jwtSecret is required for verify-jwt operation", 500, "MISSING_CONFIG");
-                }
-                const authHeader = request.headers.authorization ?? "";
-                const token = authHeader.startsWith("Bearer ")
-                    ? authHeader.slice(7)
-                    : "";
-                const payload = (0, common_1.verifyJwt)(opts.jwtSecret, token);
+                const payload = (0, common_1.verifyBearerJwt)(opts, request.headers.authorization);
                 request.jwtPayload = payload;
             }
             if (operations.includes("verify-signature")) {
-                if (!opts.hmacKey) {
-                    throw new types_1.CryptoMiddlewareError("hmacKey is required for verify-signature operation", 500, "MISSING_CONFIG");
-                }
-                const signature = request.headers["x-signature"] ??
-                    request.headers["x-hub-signature-256"] ??
-                    "";
-                const rawBody = typeof request.body === "string"
-                    ? request.body
-                    : JSON.stringify(request.body);
-                (0, common_1.verifyHmacSignature)(opts.hmacKey, rawBody, signature);
+                (0, common_1.verifyRequestSignature)(opts, request.headers, request.body);
             }
         }
         catch (err) {
-            if (err instanceof types_1.CryptoMiddlewareError) {
-                reply.code(err.statusCode).send({
-                    error: err.message,
-                    code: err.code,
-                });
-                return;
+            sendMiddlewareError(reply, err);
+        }
+    });
+}
+function registerDecryption(fastify, opts, routes) {
+    fastify.addHook("preHandler", async (request, reply) => {
+        if (!(0, common_1.matchRoute)(request.url, routes))
+            return;
+        if (!opts.key) {
+            reply.code(500).send({
+                error: "key is required for decrypt-request operation",
+                code: "MISSING_CONFIG",
+            });
+            return;
+        }
+        try {
+            const body = request.body;
+            if (body && typeof body === "object" && "encrypted" in body) {
+                request.body = (0, common_1.decryptPayload)(opts.key, body.encrypted);
             }
-            throw err;
+        }
+        catch (err) {
+            sendMiddlewareError(reply, err);
         }
     });
+}
+function registerEncryption(fastify, opts, routes) {
+    fastify.addHook("preSerialization", async (request, _reply, payload) => {
+        if (!(0, common_1.matchRoute)(request.url, routes))
+            return payload;
+        if (!opts.key)
+            return payload;
+        if (payload !== null && typeof payload === "object") {
+            const sealed = (0, common_1.encryptPayload)(opts.key, payload);
+            return { encrypted: sealed };
+        }
+        return payload;
+    });
+}
+async function cryptoPluginImpl(fastify, opts) {
+    const operations = opts.operations ?? [];
+    const routes = opts.routes ?? [];
+    registerVerification(fastify, opts, operations, routes);
     if (operations.includes("decrypt-request")) {
-        fastify.addHook("preHandler", async (request, reply) => {
-            if (!(0, common_1.matchRoute)(request.url, routes))
-                return;
-            if (!opts.key) {
-                reply.code(500).send({
-                    error: "key is required for decrypt-request operation",
-                    code: "MISSING_CONFIG",
-                });
-                return;
-            }
-            try {
-                const body = request.body;
-                if (body && typeof body === "object" && "encrypted" in body) {
-                    request.body =
-                        (0, common_1.decryptPayload)(opts.key, body.encrypted);
-                }
-            }
-            catch (err) {
-                if (err instanceof types_1.CryptoMiddlewareError) {
-                    reply.code(err.statusCode).send({
-                        error: err.message,
-                        code: err.code,
-                    });
-                    return;
-                }
-                throw err;
-            }
-        });
+        registerDecryption(fastify, opts, routes);
     }
     if (operations.includes("encrypt-response")) {
-        fastify.addHook("preSerialization", async (request, _reply, payload) => {
-            if (!(0, common_1.matchRoute)(request.url, routes))
-                return payload;
-            if (!opts.key)
-                return payload;
-            if (payload !== null && typeof payload === "object") {
-                const sealed = (0, common_1.encryptPayload)(opts.key, payload);
-                return { encrypted: sealed };
-            }
-            return payload;
-        });
+        registerEncryption(fastify, opts, routes);
     }
 }
 exports.cryptoPlugin = (0, fastify_plugin_1.default)(cryptoPluginImpl, {
     name: "crypto-middleware",
-    fastify: "4.x",
+    fastify: "4.x || 5.x",
 });
 //# sourceMappingURL=fastify.js.map

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export type { MiddlewareConfig, JwtPayload } from "./types";
 export { CryptoMiddlewareError } from "./types";
+export type { JwtVerifyOptions } from "./common";
 export { encryptPayload, decryptPayload, verifyHmacSignature, verifyJwt, matchRoute, } from "./common";
 export { createCryptoMiddleware } from "./express";
 export { cryptoPlugin } from "./fastify";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAGhD,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,UAAU,GACX,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAChD,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjD,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,SAAS,EACT,UAAU,GACX,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}

package/dist/types.d.ts

@@ -4,6 +4,8 @@ export interface MiddlewareConfig {
     operations?: Array<"decrypt-request" | "encrypt-response" | "verify-signature" | "verify-jwt">;
     hmacKey?: string;
     jwtSecret?: string;
+    jwtIssuer?: string;
+    jwtAudience?: string;
 }
 export interface JwtPayload {
     sub?: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,gBAAgB;IAE/B,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,UAAU,CAAC,EAAE,KAAK,CAChB,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,YAAY,CAC3E,CAAC;IAEF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAcD,MAAM,WAAW,UAAU;IAEzB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAUD,qBAAa,qBAAsB,SAAQ,KAAK;IAE9C,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAGjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM9D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,gBAAgB;IAE/B,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,UAAU,CAAC,EAAE,KAAK,CAChB,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,YAAY,CAC3E,CAAC;IAEF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAcD,MAAM,WAAW,UAAU;IAEzB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAKxB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAUD,qBAAa,qBAAsB,SAAQ,KAAK;IAE9C,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAGjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM9D"}

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@sebastienrousseau/crypto-middleware",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "Plug-and-play cryptographic middleware for Express and Fastify -- auto-decrypt requests, verify signatures, and encrypt responses.",
   "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
   "license": "MIT OR Apache-2.0",
   "homepage": "https://crypto-service.co",
   "repository": {
-    "directory": "packages/crypto-middleware",
     "type": "git",
-    "url": "git@github.com:sebastienrousseau/crypto-service.git"
+    "url": "git+https://github.com/sebastienrousseau/crypto-service.git",
+    "directory": "packages/crypto-middleware"
   },
   "bugs": {
     "url": "https://github.com/sebastienrousseau/crypto-service/issues"
@@ -16,28 +16,30 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "type": "commonjs",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "sideEffects": false,
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "require": "./dist/index.js",
-      "import": "./dist/index.js"
-    }
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
   },
+  "sideEffects": false,
   "files": [
     "dist/**/*.js",
     "dist/**/*.d.ts",
     "dist/**/*.d.ts.map"
   ],
   "dependencies": {
-    "@sebastienrousseau/crypto-lib": "0.0.7"
+    "fastify-plugin": "^6.0.0",
+    "@sebastienrousseau/crypto-lib": "0.0.9"
   },
   "peerDependencies": {
-    "express": "^4.0.0",
-    "fastify": "^4.0.0",
-    "fastify-plugin": "^4.0.0"
+    "express": "^5.2.1",
+    "fastify": "^4.0.0 || ^5.0.0"
   },
   "peerDependenciesMeta": {
     "express": {
@@ -45,25 +47,21 @@
     },
     "fastify": {
       "optional": true
-    },
-    "fastify-plugin": {
-      "optional": true
     }
   },
   "devDependencies": {
     "@sebastienrousseau/mocha-config": "^0.0.5",
-    "@types/chai": "^4.3.7",
+    "@types/chai": "^5.2.3",
     "@types/chai-as-promised": "^8.0.2",
-    "@types/express": "^4.17.21",
-    "@types/mocha": "^10.0.2",
-    "@types/node": "^26.4.1",
+    "@types/express": "^5.0.6",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^26.6.3",
     "c8": "^12.0.0",
-    "chai": "^4.5.0",
-    "chai-as-promised": "^7.1.2",
-    "express": "^4.21.0",
+    "chai": "^6.3.0",
+    "chai-as-promised": "^8.0.2",
+    "express": "^5.2.1",
     "fastify": "^5.12.5",
-    "fastify-plugin": "^6.0.0",
-    "mocha": "^10.8.2",
+    "mocha": "^12.0.3",
     "rimraf": "^6.1.3",
     "ts-node": "^10.9.2",
     "typedoc": "^0.28.20",
@@ -88,8 +86,8 @@
     "clean": "rimraf ./coverage ./dist ./docs",
     "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
     "docs": "typedoc",
-    "lint": "eslint --ext .ts src __tests__",
-    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "lint": "eslint src __tests__",
+    "lint:fix": "eslint --cache --fix src __tests__",
     "format": "prettier --write src/**/*.ts",
     "format:check": "prettier --check \"src/**/*.ts\""
   }