@shamodha/jwt-security-kit 1.0.1

package/README.md

@@ -0,0 +1,127 @@
+# JWT Security Kit
+
+A lightweight, zero-boilerplate, type-safe JWT security and RBAC middleware toolkit designed specifically for Express applications.
+
+---
+
+## Features
+
+* **Type-Safe Roles**: Automatically infers strongly typed role maps from your configuration file.
+* **Flexible Extractors**: Extract tokens seamlessly from authorization headers, cookies, or request bodies[cite: 3].
+* **Zero Boilerplate**: Simple initialization using a centralized configuration file via CLI.
+* **Dual Format Support**: Full support for both CommonJS and ES Modules.
+
+---
+
+## Installation
+
+Install the package alongside its peer dependencies:
+
+```bash
+npm install jwt-security-kit express
+```
+
+
+## Quick Start
+
+### 1. Initialize Configuration
+
+Generate your security configuration file automatically using the built-in CLI:
+
+```bash
+npx jwt-security-kit init
+```
+
+This creates a jwt.security.config.ts (or .js with --js) file in your project root:
+
+```TypeScript
+import { defineConfig, Extractors } from 'jwt-security-kit';
+
+export default defineConfig({
+  // Secret configuration for access tokens (can be a raw string/buffer or an object with expiry)
+  secret: {
+    key: process.env.JWT_SECRET || 'your-super-secret-key',
+    exp: '15m' // Access token expiration (e.g., '15m', '1h', or seconds as a number)
+  },
+
+  // Optional: Separate secret configuration for refresh tokens
+  refreshSecret: {
+    key: process.env.JWT_REFRESH_SECRET || 'your-refresh-secret-key',
+    exp: '7d' // Refresh token expiration
+  },
+
+  // Define your application roles (fully type-safe)
+  roles: ['user', 'admin', 'manager'] as const,
+
+  // Custom request property name where decoded user payload will be attached (default: 'user')
+  userProperty: 'user',
+
+  // Custom property name inside the JWT payload used for RBAC checks (default: 'role')
+  roleProperty: 'role',
+
+  // Allowed cryptographic algorithms for token verification (default: ['HS256'])
+  algorithms: ['HS256'],
+
+  // Custom token extractors array (defaults to checking the Authorization header)[cite: 3]
+  extractors: [
+    Extractors.fromHeader('authorization'), // Checks 'Authorization: Bearer <token>'[cite: 3]
+    Extractors.fromCookie('access_token'),    // Checks cookies[cite: 3]
+    Extractors.fromBody('token')              // Checks request body[cite: 3]
+  ]
+});
+```
+
+## 2. Setup Express Server
+Integrate the security kit into your application server:
+
+```TypeScript
+import express, { type Response } from "express"
+import { createSecurityKit, type GuardedRequest } from "jwt-security-kit"
+import securityConfig from "./jwt.security.config"
+
+const app = express()
+app.use(express.json())
+
+const security = createSecurityKit(securityConfig)
+
+// Example login route generating a token
+app.post("/login", (req, res) => {
+  const token = security.generateToken({
+    sub: "123",
+    role: security.Role.ADMIN
+  })
+  res.json({ accessToken: token })
+})
+
+// Protected route utilizing guard and role-based access control
+app.get(
+  "/dashboard", 
+  security.guard(), 
+  security.requireRole([security.Role.ADMIN]), 
+  (req: GuardedRequest, res: Response) => {
+    res.json({ success: true, user: req.user })
+  }
+)
+
+app.listen(3000, () => console.log("Server running on port 3000"))
+```
+
+CLI CommandsInitialize a default configuration template interactively:  
+    TypeScript (Default): 
+    ```bash 
+    npx jwt-security-kit init
+    ``` 
+    JavaScript:   
+     ```bash 
+    npx jwt-security-kit init --js
+    ``` 
+
+# License
+This project is licensed under the MIT License.
+
+```bash
+MIT © Shamodha Sahan
+```
+
+
+<!--Sh208978$%dc  -->

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/cli.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+var args = process.argv.slice(2);
+var command = args[0];
+if (command === "init") {
+  const flags = args.slice(1);
+  const isJavaScript = flags.includes("--js") || flags.includes("-j");
+  const ext = isJavaScript ? "js" : "ts";
+  const fileName = `jwt.security.config.${ext}`;
+  const filePath = path.join(process.cwd(), fileName);
+  const template = isJavaScript ? `const { defineConfig } = require('jwt-security-kit');
+
+module.exports = defineConfig({
+  secret: {
+    key: process.env.JWT_SECRET || 'your-super-secret-key',
+    exp: '15m'
+  },
+  roles: ['user', 'admin']
+});
+` : `import { defineConfig } from 'jwt-security-kit';
+
+export default defineConfig({
+  secret: {
+    key: process.env.JWT_SECRET || 'your-super-secret-key',
+    exp: '15m'
+  },
+  roles: ['user', 'admin'] as const
+});
+`;
+  if (fs.existsSync(filePath)) {
+    console.log(`\u26A0\uFE0F Configuration file already exists at: ${fileName}`);
+    process.exit(1);
+  }
+  try {
+    fs.writeFileSync(filePath, template, "utf8");
+    console.log(`\u2728 Successfully created ${fileName} in your project root!`);
+  } catch (err) {
+    console.error("\u274C Failed to create configuration file:", err);
+    process.exit(1);
+  }
+} else {
+  console.log("Unknown command. Use: npx jwt-security-kit init [--js]");
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\r\nimport * as fs from \"fs\"\r\nimport * as path from \"path\"\r\n\r\nconst args = process.argv.slice(2)\r\nconst command = args[0]\r\n\r\nif (command === \"init\") {\r\n  const flags = args.slice(1)\r\n  const isJavaScript = flags.includes(\"--js\") || flags.includes(\"-j\")\r\n\r\n  const ext = isJavaScript ? \"js\" : \"ts\"\r\n  const fileName = `jwt.security.config.${ext}`\r\n  const filePath = path.join(process.cwd(), fileName)\r\n\r\n  const template = isJavaScript\r\n    ? `const { defineConfig } = require('jwt-security-kit');\r\n\r\nmodule.exports = defineConfig({\r\n  secret: {\r\n    key: process.env.JWT_SECRET || 'your-super-secret-key',\r\n    exp: '15m'\r\n  },\r\n  roles: ['user', 'admin']\r\n});\r\n`\r\n    : `import { defineConfig } from 'jwt-security-kit';\r\n\r\nexport default defineConfig({\r\n  secret: {\r\n    key: process.env.JWT_SECRET || 'your-super-secret-key',\r\n    exp: '15m'\r\n  },\r\n  roles: ['user', 'admin'] as const\r\n});\r\n`\r\n\r\n  if (fs.existsSync(filePath)) {\r\n    console.log(`⚠️ Configuration file already exists at: ${fileName}`)\r\n    process.exit(1)\r\n  }\r\n\r\n  try {\r\n    fs.writeFileSync(filePath, template, \"utf8\")\r\n    console.log(`✨ Successfully created ${fileName} in your project root!`)\r\n  } catch (err) {\r\n    console.error(\"❌ Failed to create configuration file:\", err)\r\n    process.exit(1)\r\n  }\r\n} else {\r\n  console.log(\"Unknown command. Use: npx jwt-security-kit init [--js]\")\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SAAoB;AACpB,WAAsB;AAEtB,IAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,IAAM,UAAU,KAAK,CAAC;AAEtB,IAAI,YAAY,QAAQ;AACtB,QAAM,QAAQ,KAAK,MAAM,CAAC;AAC1B,QAAM,eAAe,MAAM,SAAS,MAAM,KAAK,MAAM,SAAS,IAAI;AAElE,QAAM,MAAM,eAAe,OAAO;AAClC,QAAM,WAAW,uBAAuB,GAAG;AAC3C,QAAM,WAAgB,UAAK,QAAQ,IAAI,GAAG,QAAQ;AAElD,QAAM,WAAW,eACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWJ,MAAO,cAAW,QAAQ,GAAG;AAC3B,YAAQ,IAAI,sDAA4C,QAAQ,EAAE;AAClE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI;AACF,IAAG,iBAAc,UAAU,UAAU,MAAM;AAC3C,YAAQ,IAAI,+BAA0B,QAAQ,wBAAwB;AAAA,EACxE,SAAS,KAAK;AACZ,YAAQ,MAAM,+CAA0C,GAAG;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,OAAO;AACL,UAAQ,IAAI,wDAAwD;AACtE;","names":[]}

package/dist/cli.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import * as fs from "fs";
+import * as path from "path";
+var args = process.argv.slice(2);
+var command = args[0];
+if (command === "init") {
+  const flags = args.slice(1);
+  const isJavaScript = flags.includes("--js") || flags.includes("-j");
+  const ext = isJavaScript ? "js" : "ts";
+  const fileName = `jwt.security.config.${ext}`;
+  const filePath = path.join(process.cwd(), fileName);
+  const template = isJavaScript ? `const { defineConfig } = require('jwt-security-kit');
+
+module.exports = defineConfig({
+  secret: {
+    key: process.env.JWT_SECRET || 'your-super-secret-key',
+    exp: '15m'
+  },
+  roles: ['user', 'admin']
+});
+` : `import { defineConfig } from 'jwt-security-kit';
+
+export default defineConfig({
+  secret: {
+    key: process.env.JWT_SECRET || 'your-super-secret-key',
+    exp: '15m'
+  },
+  roles: ['user', 'admin'] as const
+});
+`;
+  if (fs.existsSync(filePath)) {
+    console.log(`\u26A0\uFE0F Configuration file already exists at: ${fileName}`);
+    process.exit(1);
+  }
+  try {
+    fs.writeFileSync(filePath, template, "utf8");
+    console.log(`\u2728 Successfully created ${fileName} in your project root!`);
+  } catch (err) {
+    console.error("\u274C Failed to create configuration file:", err);
+    process.exit(1);
+  }
+} else {
+  console.log("Unknown command. Use: npx jwt-security-kit init [--js]");
+}
+//# sourceMappingURL=cli.mjs.map

package/dist/cli.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\r\nimport * as fs from \"fs\"\r\nimport * as path from \"path\"\r\n\r\nconst args = process.argv.slice(2)\r\nconst command = args[0]\r\n\r\nif (command === \"init\") {\r\n  const flags = args.slice(1)\r\n  const isJavaScript = flags.includes(\"--js\") || flags.includes(\"-j\")\r\n\r\n  const ext = isJavaScript ? \"js\" : \"ts\"\r\n  const fileName = `jwt.security.config.${ext}`\r\n  const filePath = path.join(process.cwd(), fileName)\r\n\r\n  const template = isJavaScript\r\n    ? `const { defineConfig } = require('jwt-security-kit');\r\n\r\nmodule.exports = defineConfig({\r\n  secret: {\r\n    key: process.env.JWT_SECRET || 'your-super-secret-key',\r\n    exp: '15m'\r\n  },\r\n  roles: ['user', 'admin']\r\n});\r\n`\r\n    : `import { defineConfig } from 'jwt-security-kit';\r\n\r\nexport default defineConfig({\r\n  secret: {\r\n    key: process.env.JWT_SECRET || 'your-super-secret-key',\r\n    exp: '15m'\r\n  },\r\n  roles: ['user', 'admin'] as const\r\n});\r\n`\r\n\r\n  if (fs.existsSync(filePath)) {\r\n    console.log(`⚠️ Configuration file already exists at: ${fileName}`)\r\n    process.exit(1)\r\n  }\r\n\r\n  try {\r\n    fs.writeFileSync(filePath, template, \"utf8\")\r\n    console.log(`✨ Successfully created ${fileName} in your project root!`)\r\n  } catch (err) {\r\n    console.error(\"❌ Failed to create configuration file:\", err)\r\n    process.exit(1)\r\n  }\r\n} else {\r\n  console.log(\"Unknown command. Use: npx jwt-security-kit init [--js]\")\r\n}\r\n"],"mappings":";;;AACA,YAAY,QAAQ;AACpB,YAAY,UAAU;AAEtB,IAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,IAAM,UAAU,KAAK,CAAC;AAEtB,IAAI,YAAY,QAAQ;AACtB,QAAM,QAAQ,KAAK,MAAM,CAAC;AAC1B,QAAM,eAAe,MAAM,SAAS,MAAM,KAAK,MAAM,SAAS,IAAI;AAElE,QAAM,MAAM,eAAe,OAAO;AAClC,QAAM,WAAW,uBAAuB,GAAG;AAC3C,QAAM,WAAgB,UAAK,QAAQ,IAAI,GAAG,QAAQ;AAElD,QAAM,WAAW,eACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWJ,MAAO,cAAW,QAAQ,GAAG;AAC3B,YAAQ,IAAI,sDAA4C,QAAQ,EAAE;AAClE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI;AACF,IAAG,iBAAc,UAAU,UAAU,MAAM;AAC3C,YAAQ,IAAI,+BAA0B,QAAQ,wBAAwB;AAAA,EACxE,SAAS,KAAK;AACZ,YAAQ,MAAM,+CAA0C,GAAG;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF,OAAO;AACL,UAAQ,IAAI,wDAAwD;AACtE;","names":[]}

package/dist/extractors.d.ts

@@ -0,0 +1,6 @@
+import type { TokenExtractor } from "./types";
+export declare const Extractors: {
+    fromHeader: (headerName?: string) => TokenExtractor;
+    fromCookie: (cookieName: string) => TokenExtractor;
+    fromBody: (fieldName: string) => TokenExtractor;
+};

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+import type { Response, NextFunction } from "express";
+import jwt from "jsonwebtoken";
+import type { SecurityKitConfig, GuardedRequest, RoleMap } from "./types";
+export declare function createSecurityKit<const T extends readonly string[]>(config: SecurityKitConfig<T>): {
+    Role: Readonly<RoleMap<T>>;
+    generateToken: (payload: string | object | Buffer) => string;
+    generateRefreshToken: (payload: string | object | Buffer) => string;
+    verifyRefreshToken: (token: string) => string | jwt.JwtPayload;
+    guard: () => (req: GuardedRequest, res: Response, next: NextFunction) => void;
+    requireRole: (requiredRoles?: T[number][]) => (req: GuardedRequest, res: Response, next: NextFunction) => void;
+};
+export declare function defineConfig<const T extends readonly string[]>(config: SecurityKitConfig<T>): SecurityKitConfig<T>;
+export { Extractors } from "./extractors";
+export type { SecurityKitConfig, GuardedRequest, TokenExtractor, SecretConfig, RoleMap } from "./types";

package/dist/index.js

@@ -0,0 +1,143 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  Extractors: () => Extractors,
+  createSecurityKit: () => createSecurityKit,
+  defineConfig: () => defineConfig
+});
+module.exports = __toCommonJS(index_exports);
+var import_jsonwebtoken = __toESM(require("jsonwebtoken"));
+
+// src/extractors.ts
+var Extractors = {
+  fromHeader: (headerName = "authorization") => {
+    return (req) => {
+      const header = req.headers[headerName.toLowerCase()];
+      if (typeof header === "string" && header.startsWith("Bearer ")) {
+        return header.split(" ")[1];
+      }
+      return typeof header === "string" ? header : null;
+    };
+  },
+  fromCookie: (cookieName) => {
+    return (req) => req.cookies ? req.cookies[cookieName] || null : null;
+  },
+  fromBody: (fieldName) => {
+    return (req) => req.body ? req.body[fieldName] || null : null;
+  }
+};
+
+// src/index.ts
+function createSecurityKit(config) {
+  if (!config.secret) throw new Error("FATAL: SecurityKit requires a secret.");
+  const secretCfg = typeof config.secret === "object" && config.secret !== null && "key" in config.secret ? config.secret : { key: config.secret };
+  const secret = secretCfg.key;
+  const accessExp = secretCfg.exp || "15m";
+  let refreshSecret;
+  let refreshExp = "7d";
+  if (config.refreshSecret) {
+    const refreshCfg = typeof config.refreshSecret === "object" && config.refreshSecret !== null && "key" in config.refreshSecret ? config.refreshSecret : { key: config.refreshSecret };
+    refreshSecret = refreshCfg.key;
+    refreshExp = refreshCfg.exp || "7d";
+  }
+  const userProp = config.userProperty || "user";
+  const roleProp = config.roleProperty || "role";
+  const algorithms = config.algorithms || ["HS256"];
+  const extractors = config.extractors?.length ? config.extractors : [Extractors.fromHeader()];
+  const rolesArray = config.roles || ["user", "admin"];
+  const Role = Object.freeze(
+    rolesArray.reduce((acc, role) => {
+      ;
+      acc[role.toUpperCase()] = role;
+      return acc;
+    }, {})
+  );
+  const signOpts = { expiresIn: accessExp };
+  const refreshSignOpts = { expiresIn: refreshExp };
+  const verifyOpts = { algorithms };
+  return {
+    Role,
+    generateToken: (payload) => {
+      return import_jsonwebtoken.default.sign(payload, secret, signOpts);
+    },
+    generateRefreshToken: (payload) => {
+      if (!refreshSecret) throw new Error("Refresh secret is not configured.");
+      return import_jsonwebtoken.default.sign(payload, refreshSecret, refreshSignOpts);
+    },
+    verifyRefreshToken: (token) => {
+      if (!refreshSecret) throw new Error("Refresh secret is not configured.");
+      return import_jsonwebtoken.default.verify(token, refreshSecret, verifyOpts);
+    },
+    guard: () => (req, res, next) => {
+      let token = null;
+      for (const extractor of extractors) {
+        if (token = extractor(req)) break;
+      }
+      if (!token) {
+        res.status(401).json({ error: "Unauthorized: No token provided" });
+        return;
+      }
+      try {
+        req[userProp] = import_jsonwebtoken.default.verify(token, secret, verifyOpts);
+        next();
+      } catch (err) {
+        const msg = err instanceof import_jsonwebtoken.default.TokenExpiredError ? "Token expired" : "Invalid token";
+        res.status(401).json({ error: `Unauthorized: ${msg}` });
+      }
+    },
+    requireRole: (requiredRoles = Object.values(Role)) => {
+      return (req, res, next) => {
+        const user = req[userProp];
+        if (!user) {
+          res.status(401).json({ error: "Unauthorized: Authentication required" });
+          return;
+        }
+        const userRole = user[roleProp];
+        if (!userRole || !requiredRoles.includes(userRole)) {
+          res.status(403).json({ error: "Forbidden: Insufficient permissions" });
+          return;
+        }
+        next();
+      };
+    }
+  };
+}
+function defineConfig(config) {
+  return config;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Extractors,
+  createSecurityKit,
+  defineConfig
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/extractors.ts"],"sourcesContent":["import type { Response, NextFunction } from \"express\"\r\nimport jwt from \"jsonwebtoken\"\r\nimport type {\r\n  SecurityKitConfig,\r\n  GuardedRequest,\r\n  RoleMap,\r\n  SecretConfig\r\n} from \"./types\"\r\nimport { Extractors } from \"./extractors\"\r\n\r\nexport function createSecurityKit<const T extends readonly string[]>(\r\n  config: SecurityKitConfig<T>\r\n) {\r\n  if (!config.secret) throw new Error(\"FATAL: SecurityKit requires a secret.\")\r\n\r\n  const secretCfg: SecretConfig =\r\n    typeof config.secret === \"object\" &&\r\n    config.secret !== null &&\r\n    \"key\" in config.secret\r\n      ? config.secret\r\n      : { key: config.secret }\r\n\r\n  const secret = secretCfg.key\r\n  const accessExp: string | number = secretCfg.exp || \"15m\"\r\n\r\n  let refreshSecret: string | Buffer | undefined\r\n  let refreshExp: string | number = \"7d\"\r\n\r\n  if (config.refreshSecret) {\r\n    const refreshCfg: SecretConfig =\r\n      typeof config.refreshSecret === \"object\" &&\r\n      config.refreshSecret !== null &&\r\n      \"key\" in config.refreshSecret\r\n        ? config.refreshSecret\r\n        : { key: config.refreshSecret }\r\n\r\n    refreshSecret = refreshCfg.key\r\n    refreshExp = refreshCfg.exp || \"7d\"\r\n  }\r\n\r\n  const userProp = config.userProperty || \"user\"\r\n  const roleProp = config.roleProperty || \"role\"\r\n  const algorithms = config.algorithms || [\"HS256\"]\r\n  const extractors = config.extractors?.length\r\n    ? config.extractors\r\n    : [Extractors.fromHeader()]\r\n\r\n  const rolesArray = config.roles || ([\"user\", \"admin\"] as unknown as T)\r\n\r\n  const Role = Object.freeze(\r\n    rolesArray.reduce((acc, role) => {\r\n      ;(acc as any)[role.toUpperCase()] = role\r\n      return acc\r\n    }, {} as RoleMap<T>)\r\n  )\r\n\r\n  const signOpts: jwt.SignOptions = { expiresIn: accessExp as any }\r\n  const refreshSignOpts: jwt.SignOptions = { expiresIn: refreshExp as any }\r\n  const verifyOpts: jwt.VerifyOptions = { algorithms }\r\n\r\n  return {\r\n    Role,\r\n\r\n    generateToken: (payload: string | object | Buffer): string => {\r\n      return jwt.sign(payload, secret, signOpts)\r\n    },\r\n\r\n    generateRefreshToken: (payload: string | object | Buffer): string => {\r\n      if (!refreshSecret) throw new Error(\"Refresh secret is not configured.\")\r\n      return jwt.sign(payload, refreshSecret, refreshSignOpts)\r\n    },\r\n\r\n    verifyRefreshToken: (token: string): string | jwt.JwtPayload => {\r\n      if (!refreshSecret) throw new Error(\"Refresh secret is not configured.\")\r\n      return jwt.verify(token, refreshSecret, verifyOpts)\r\n    },\r\n\r\n    guard:\r\n      () =>\r\n      (req: GuardedRequest, res: Response, next: NextFunction): void => {\r\n        let token: string | null = null\r\n        for (const extractor of extractors) {\r\n          if ((token = extractor(req))) break\r\n        }\r\n\r\n        if (!token) {\r\n          res.status(401).json({ error: \"Unauthorized: No token provided\" })\r\n          return\r\n        }\r\n\r\n        try {\r\n          req[userProp] = jwt.verify(token, secret, verifyOpts)\r\n          next()\r\n        } catch (err) {\r\n          const msg =\r\n            err instanceof jwt.TokenExpiredError\r\n              ? \"Token expired\"\r\n              : \"Invalid token\"\r\n          res.status(401).json({ error: `Unauthorized: ${msg}` })\r\n        }\r\n      },\r\n\r\n    requireRole: (\r\n      requiredRoles: T[number][] = Object.values(Role) as T[number][]\r\n    ) => {\r\n      return (req: GuardedRequest, res: Response, next: NextFunction): void => {\r\n        const user = req[userProp]\r\n\r\n        if (!user) {\r\n          res\r\n            .status(401)\r\n            .json({ error: \"Unauthorized: Authentication required\" })\r\n          return\r\n        }\r\n\r\n        const userRole = user[roleProp]\r\n        if (!userRole || !requiredRoles.includes(userRole)) {\r\n          res.status(403).json({ error: \"Forbidden: Insufficient permissions\" })\r\n          return\r\n        }\r\n        next()\r\n      }\r\n    }\r\n  }\r\n}\r\n\r\nexport function defineConfig<const T extends readonly string[]>(\r\n  config: SecurityKitConfig<T>\r\n): SecurityKitConfig<T> {\r\n  return config\r\n}\r\n\r\nexport { Extractors } from \"./extractors\"\r\nexport type {\r\n  SecurityKitConfig,\r\n  GuardedRequest,\r\n  TokenExtractor,\r\n  SecretConfig,\r\n  RoleMap\r\n} from \"./types\"\r\n","import type { TokenExtractor } from \"./types\"\r\n\r\nexport const Extractors = {\r\n  fromHeader: (headerName = \"authorization\"): TokenExtractor => {\r\n    return (req) => {\r\n      const header = req.headers[headerName.toLowerCase()]\r\n      if (typeof header === \"string\" && header.startsWith(\"Bearer \")) {\r\n        return header.split(\" \")[1]\r\n      }\r\n      return typeof header === \"string\" ? header : null\r\n    }\r\n  },\r\n  fromCookie: (cookieName: string): TokenExtractor => {\r\n    return (req) => (req.cookies ? req.cookies[cookieName] || null : null)\r\n  },\r\n  fromBody: (fieldName: string): TokenExtractor => {\r\n    return (req) => (req.body ? req.body[fieldName] || null : null)\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,0BAAgB;;;ACCT,IAAM,aAAa;AAAA,EACxB,YAAY,CAAC,aAAa,oBAAoC;AAC5D,WAAO,CAAC,QAAQ;AACd,YAAM,SAAS,IAAI,QAAQ,WAAW,YAAY,CAAC;AACnD,UAAI,OAAO,WAAW,YAAY,OAAO,WAAW,SAAS,GAAG;AAC9D,eAAO,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,MAC5B;AACA,aAAO,OAAO,WAAW,WAAW,SAAS;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,YAAY,CAAC,eAAuC;AAClD,WAAO,CAAC,QAAS,IAAI,UAAU,IAAI,QAAQ,UAAU,KAAK,OAAO;AAAA,EACnE;AAAA,EACA,UAAU,CAAC,cAAsC;AAC/C,WAAO,CAAC,QAAS,IAAI,OAAO,IAAI,KAAK,SAAS,KAAK,OAAO;AAAA,EAC5D;AACF;;;ADRO,SAAS,kBACd,QACA;AACA,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,uCAAuC;AAE3E,QAAM,YACJ,OAAO,OAAO,WAAW,YACzB,OAAO,WAAW,QAClB,SAAS,OAAO,SACZ,OAAO,SACP,EAAE,KAAK,OAAO,OAAO;AAE3B,QAAM,SAAS,UAAU;AACzB,QAAM,YAA6B,UAAU,OAAO;AAEpD,MAAI;AACJ,MAAI,aAA8B;AAElC,MAAI,OAAO,eAAe;AACxB,UAAM,aACJ,OAAO,OAAO,kBAAkB,YAChC,OAAO,kBAAkB,QACzB,SAAS,OAAO,gBACZ,OAAO,gBACP,EAAE,KAAK,OAAO,cAAc;AAElC,oBAAgB,WAAW;AAC3B,iBAAa,WAAW,OAAO;AAAA,EACjC;AAEA,QAAM,WAAW,OAAO,gBAAgB;AACxC,QAAM,WAAW,OAAO,gBAAgB;AACxC,QAAM,aAAa,OAAO,cAAc,CAAC,OAAO;AAChD,QAAM,aAAa,OAAO,YAAY,SAClC,OAAO,aACP,CAAC,WAAW,WAAW,CAAC;AAE5B,QAAM,aAAa,OAAO,SAAU,CAAC,QAAQ,OAAO;AAEpD,QAAM,OAAO,OAAO;AAAA,IAClB,WAAW,OAAO,CAAC,KAAK,SAAS;AAC/B;AAAC,MAAC,IAAY,KAAK,YAAY,CAAC,IAAI;AACpC,aAAO;AAAA,IACT,GAAG,CAAC,CAAe;AAAA,EACrB;AAEA,QAAM,WAA4B,EAAE,WAAW,UAAiB;AAChE,QAAM,kBAAmC,EAAE,WAAW,WAAkB;AACxE,QAAM,aAAgC,EAAE,WAAW;AAEnD,SAAO;AAAA,IACL;AAAA,IAEA,eAAe,CAAC,YAA8C;AAC5D,aAAO,oBAAAA,QAAI,KAAK,SAAS,QAAQ,QAAQ;AAAA,IAC3C;AAAA,IAEA,sBAAsB,CAAC,YAA8C;AACnE,UAAI,CAAC,cAAe,OAAM,IAAI,MAAM,mCAAmC;AACvE,aAAO,oBAAAA,QAAI,KAAK,SAAS,eAAe,eAAe;AAAA,IACzD;AAAA,IAEA,oBAAoB,CAAC,UAA2C;AAC9D,UAAI,CAAC,cAAe,OAAM,IAAI,MAAM,mCAAmC;AACvE,aAAO,oBAAAA,QAAI,OAAO,OAAO,eAAe,UAAU;AAAA,IACpD;AAAA,IAEA,OACE,MACA,CAAC,KAAqB,KAAe,SAA6B;AAChE,UAAI,QAAuB;AAC3B,iBAAW,aAAa,YAAY;AAClC,YAAK,QAAQ,UAAU,GAAG,EAAI;AAAA,MAChC;AAEA,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kCAAkC,CAAC;AACjE;AAAA,MACF;AAEA,UAAI;AACF,YAAI,QAAQ,IAAI,oBAAAA,QAAI,OAAO,OAAO,QAAQ,UAAU;AACpD,aAAK;AAAA,MACP,SAAS,KAAK;AACZ,cAAM,MACJ,eAAe,oBAAAA,QAAI,oBACf,kBACA;AACN,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG,CAAC;AAAA,MACxD;AAAA,IACF;AAAA,IAEF,aAAa,CACX,gBAA6B,OAAO,OAAO,IAAI,MAC5C;AACH,aAAO,CAAC,KAAqB,KAAe,SAA6B;AACvE,cAAM,OAAO,IAAI,QAAQ;AAEzB,YAAI,CAAC,MAAM;AACT,cACG,OAAO,GAAG,EACV,KAAK,EAAE,OAAO,wCAAwC,CAAC;AAC1D;AAAA,QACF;AAEA,cAAM,WAAW,KAAK,QAAQ;AAC9B,YAAI,CAAC,YAAY,CAAC,cAAc,SAAS,QAAQ,GAAG;AAClD,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sCAAsC,CAAC;AACrE;AAAA,QACF;AACA,aAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,aACd,QACsB;AACtB,SAAO;AACT;","names":["jwt"]}

package/dist/index.mjs

@@ -0,0 +1,106 @@
+// src/index.ts
+import jwt from "jsonwebtoken";
+
+// src/extractors.ts
+var Extractors = {
+  fromHeader: (headerName = "authorization") => {
+    return (req) => {
+      const header = req.headers[headerName.toLowerCase()];
+      if (typeof header === "string" && header.startsWith("Bearer ")) {
+        return header.split(" ")[1];
+      }
+      return typeof header === "string" ? header : null;
+    };
+  },
+  fromCookie: (cookieName) => {
+    return (req) => req.cookies ? req.cookies[cookieName] || null : null;
+  },
+  fromBody: (fieldName) => {
+    return (req) => req.body ? req.body[fieldName] || null : null;
+  }
+};
+
+// src/index.ts
+function createSecurityKit(config) {
+  if (!config.secret) throw new Error("FATAL: SecurityKit requires a secret.");
+  const secretCfg = typeof config.secret === "object" && config.secret !== null && "key" in config.secret ? config.secret : { key: config.secret };
+  const secret = secretCfg.key;
+  const accessExp = secretCfg.exp || "15m";
+  let refreshSecret;
+  let refreshExp = "7d";
+  if (config.refreshSecret) {
+    const refreshCfg = typeof config.refreshSecret === "object" && config.refreshSecret !== null && "key" in config.refreshSecret ? config.refreshSecret : { key: config.refreshSecret };
+    refreshSecret = refreshCfg.key;
+    refreshExp = refreshCfg.exp || "7d";
+  }
+  const userProp = config.userProperty || "user";
+  const roleProp = config.roleProperty || "role";
+  const algorithms = config.algorithms || ["HS256"];
+  const extractors = config.extractors?.length ? config.extractors : [Extractors.fromHeader()];
+  const rolesArray = config.roles || ["user", "admin"];
+  const Role = Object.freeze(
+    rolesArray.reduce((acc, role) => {
+      ;
+      acc[role.toUpperCase()] = role;
+      return acc;
+    }, {})
+  );
+  const signOpts = { expiresIn: accessExp };
+  const refreshSignOpts = { expiresIn: refreshExp };
+  const verifyOpts = { algorithms };
+  return {
+    Role,
+    generateToken: (payload) => {
+      return jwt.sign(payload, secret, signOpts);
+    },
+    generateRefreshToken: (payload) => {
+      if (!refreshSecret) throw new Error("Refresh secret is not configured.");
+      return jwt.sign(payload, refreshSecret, refreshSignOpts);
+    },
+    verifyRefreshToken: (token) => {
+      if (!refreshSecret) throw new Error("Refresh secret is not configured.");
+      return jwt.verify(token, refreshSecret, verifyOpts);
+    },
+    guard: () => (req, res, next) => {
+      let token = null;
+      for (const extractor of extractors) {
+        if (token = extractor(req)) break;
+      }
+      if (!token) {
+        res.status(401).json({ error: "Unauthorized: No token provided" });
+        return;
+      }
+      try {
+        req[userProp] = jwt.verify(token, secret, verifyOpts);
+        next();
+      } catch (err) {
+        const msg = err instanceof jwt.TokenExpiredError ? "Token expired" : "Invalid token";
+        res.status(401).json({ error: `Unauthorized: ${msg}` });
+      }
+    },
+    requireRole: (requiredRoles = Object.values(Role)) => {
+      return (req, res, next) => {
+        const user = req[userProp];
+        if (!user) {
+          res.status(401).json({ error: "Unauthorized: Authentication required" });
+          return;
+        }
+        const userRole = user[roleProp];
+        if (!userRole || !requiredRoles.includes(userRole)) {
+          res.status(403).json({ error: "Forbidden: Insufficient permissions" });
+          return;
+        }
+        next();
+      };
+    }
+  };
+}
+function defineConfig(config) {
+  return config;
+}
+export {
+  Extractors,
+  createSecurityKit,
+  defineConfig
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/extractors.ts"],"sourcesContent":["import type { Response, NextFunction } from \"express\"\r\nimport jwt from \"jsonwebtoken\"\r\nimport type {\r\n  SecurityKitConfig,\r\n  GuardedRequest,\r\n  RoleMap,\r\n  SecretConfig\r\n} from \"./types\"\r\nimport { Extractors } from \"./extractors\"\r\n\r\nexport function createSecurityKit<const T extends readonly string[]>(\r\n  config: SecurityKitConfig<T>\r\n) {\r\n  if (!config.secret) throw new Error(\"FATAL: SecurityKit requires a secret.\")\r\n\r\n  const secretCfg: SecretConfig =\r\n    typeof config.secret === \"object\" &&\r\n    config.secret !== null &&\r\n    \"key\" in config.secret\r\n      ? config.secret\r\n      : { key: config.secret }\r\n\r\n  const secret = secretCfg.key\r\n  const accessExp: string | number = secretCfg.exp || \"15m\"\r\n\r\n  let refreshSecret: string | Buffer | undefined\r\n  let refreshExp: string | number = \"7d\"\r\n\r\n  if (config.refreshSecret) {\r\n    const refreshCfg: SecretConfig =\r\n      typeof config.refreshSecret === \"object\" &&\r\n      config.refreshSecret !== null &&\r\n      \"key\" in config.refreshSecret\r\n        ? config.refreshSecret\r\n        : { key: config.refreshSecret }\r\n\r\n    refreshSecret = refreshCfg.key\r\n    refreshExp = refreshCfg.exp || \"7d\"\r\n  }\r\n\r\n  const userProp = config.userProperty || \"user\"\r\n  const roleProp = config.roleProperty || \"role\"\r\n  const algorithms = config.algorithms || [\"HS256\"]\r\n  const extractors = config.extractors?.length\r\n    ? config.extractors\r\n    : [Extractors.fromHeader()]\r\n\r\n  const rolesArray = config.roles || ([\"user\", \"admin\"] as unknown as T)\r\n\r\n  const Role = Object.freeze(\r\n    rolesArray.reduce((acc, role) => {\r\n      ;(acc as any)[role.toUpperCase()] = role\r\n      return acc\r\n    }, {} as RoleMap<T>)\r\n  )\r\n\r\n  const signOpts: jwt.SignOptions = { expiresIn: accessExp as any }\r\n  const refreshSignOpts: jwt.SignOptions = { expiresIn: refreshExp as any }\r\n  const verifyOpts: jwt.VerifyOptions = { algorithms }\r\n\r\n  return {\r\n    Role,\r\n\r\n    generateToken: (payload: string | object | Buffer): string => {\r\n      return jwt.sign(payload, secret, signOpts)\r\n    },\r\n\r\n    generateRefreshToken: (payload: string | object | Buffer): string => {\r\n      if (!refreshSecret) throw new Error(\"Refresh secret is not configured.\")\r\n      return jwt.sign(payload, refreshSecret, refreshSignOpts)\r\n    },\r\n\r\n    verifyRefreshToken: (token: string): string | jwt.JwtPayload => {\r\n      if (!refreshSecret) throw new Error(\"Refresh secret is not configured.\")\r\n      return jwt.verify(token, refreshSecret, verifyOpts)\r\n    },\r\n\r\n    guard:\r\n      () =>\r\n      (req: GuardedRequest, res: Response, next: NextFunction): void => {\r\n        let token: string | null = null\r\n        for (const extractor of extractors) {\r\n          if ((token = extractor(req))) break\r\n        }\r\n\r\n        if (!token) {\r\n          res.status(401).json({ error: \"Unauthorized: No token provided\" })\r\n          return\r\n        }\r\n\r\n        try {\r\n          req[userProp] = jwt.verify(token, secret, verifyOpts)\r\n          next()\r\n        } catch (err) {\r\n          const msg =\r\n            err instanceof jwt.TokenExpiredError\r\n              ? \"Token expired\"\r\n              : \"Invalid token\"\r\n          res.status(401).json({ error: `Unauthorized: ${msg}` })\r\n        }\r\n      },\r\n\r\n    requireRole: (\r\n      requiredRoles: T[number][] = Object.values(Role) as T[number][]\r\n    ) => {\r\n      return (req: GuardedRequest, res: Response, next: NextFunction): void => {\r\n        const user = req[userProp]\r\n\r\n        if (!user) {\r\n          res\r\n            .status(401)\r\n            .json({ error: \"Unauthorized: Authentication required\" })\r\n          return\r\n        }\r\n\r\n        const userRole = user[roleProp]\r\n        if (!userRole || !requiredRoles.includes(userRole)) {\r\n          res.status(403).json({ error: \"Forbidden: Insufficient permissions\" })\r\n          return\r\n        }\r\n        next()\r\n      }\r\n    }\r\n  }\r\n}\r\n\r\nexport function defineConfig<const T extends readonly string[]>(\r\n  config: SecurityKitConfig<T>\r\n): SecurityKitConfig<T> {\r\n  return config\r\n}\r\n\r\nexport { Extractors } from \"./extractors\"\r\nexport type {\r\n  SecurityKitConfig,\r\n  GuardedRequest,\r\n  TokenExtractor,\r\n  SecretConfig,\r\n  RoleMap\r\n} from \"./types\"\r\n","import type { TokenExtractor } from \"./types\"\r\n\r\nexport const Extractors = {\r\n  fromHeader: (headerName = \"authorization\"): TokenExtractor => {\r\n    return (req) => {\r\n      const header = req.headers[headerName.toLowerCase()]\r\n      if (typeof header === \"string\" && header.startsWith(\"Bearer \")) {\r\n        return header.split(\" \")[1]\r\n      }\r\n      return typeof header === \"string\" ? header : null\r\n    }\r\n  },\r\n  fromCookie: (cookieName: string): TokenExtractor => {\r\n    return (req) => (req.cookies ? req.cookies[cookieName] || null : null)\r\n  },\r\n  fromBody: (fieldName: string): TokenExtractor => {\r\n    return (req) => (req.body ? req.body[fieldName] || null : null)\r\n  }\r\n}\r\n"],"mappings":";AACA,OAAO,SAAS;;;ACCT,IAAM,aAAa;AAAA,EACxB,YAAY,CAAC,aAAa,oBAAoC;AAC5D,WAAO,CAAC,QAAQ;AACd,YAAM,SAAS,IAAI,QAAQ,WAAW,YAAY,CAAC;AACnD,UAAI,OAAO,WAAW,YAAY,OAAO,WAAW,SAAS,GAAG;AAC9D,eAAO,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,MAC5B;AACA,aAAO,OAAO,WAAW,WAAW,SAAS;AAAA,IAC/C;AAAA,EACF;AAAA,EACA,YAAY,CAAC,eAAuC;AAClD,WAAO,CAAC,QAAS,IAAI,UAAU,IAAI,QAAQ,UAAU,KAAK,OAAO;AAAA,EACnE;AAAA,EACA,UAAU,CAAC,cAAsC;AAC/C,WAAO,CAAC,QAAS,IAAI,OAAO,IAAI,KAAK,SAAS,KAAK,OAAO;AAAA,EAC5D;AACF;;;ADRO,SAAS,kBACd,QACA;AACA,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,uCAAuC;AAE3E,QAAM,YACJ,OAAO,OAAO,WAAW,YACzB,OAAO,WAAW,QAClB,SAAS,OAAO,SACZ,OAAO,SACP,EAAE,KAAK,OAAO,OAAO;AAE3B,QAAM,SAAS,UAAU;AACzB,QAAM,YAA6B,UAAU,OAAO;AAEpD,MAAI;AACJ,MAAI,aAA8B;AAElC,MAAI,OAAO,eAAe;AACxB,UAAM,aACJ,OAAO,OAAO,kBAAkB,YAChC,OAAO,kBAAkB,QACzB,SAAS,OAAO,gBACZ,OAAO,gBACP,EAAE,KAAK,OAAO,cAAc;AAElC,oBAAgB,WAAW;AAC3B,iBAAa,WAAW,OAAO;AAAA,EACjC;AAEA,QAAM,WAAW,OAAO,gBAAgB;AACxC,QAAM,WAAW,OAAO,gBAAgB;AACxC,QAAM,aAAa,OAAO,cAAc,CAAC,OAAO;AAChD,QAAM,aAAa,OAAO,YAAY,SAClC,OAAO,aACP,CAAC,WAAW,WAAW,CAAC;AAE5B,QAAM,aAAa,OAAO,SAAU,CAAC,QAAQ,OAAO;AAEpD,QAAM,OAAO,OAAO;AAAA,IAClB,WAAW,OAAO,CAAC,KAAK,SAAS;AAC/B;AAAC,MAAC,IAAY,KAAK,YAAY,CAAC,IAAI;AACpC,aAAO;AAAA,IACT,GAAG,CAAC,CAAe;AAAA,EACrB;AAEA,QAAM,WAA4B,EAAE,WAAW,UAAiB;AAChE,QAAM,kBAAmC,EAAE,WAAW,WAAkB;AACxE,QAAM,aAAgC,EAAE,WAAW;AAEnD,SAAO;AAAA,IACL;AAAA,IAEA,eAAe,CAAC,YAA8C;AAC5D,aAAO,IAAI,KAAK,SAAS,QAAQ,QAAQ;AAAA,IAC3C;AAAA,IAEA,sBAAsB,CAAC,YAA8C;AACnE,UAAI,CAAC,cAAe,OAAM,IAAI,MAAM,mCAAmC;AACvE,aAAO,IAAI,KAAK,SAAS,eAAe,eAAe;AAAA,IACzD;AAAA,IAEA,oBAAoB,CAAC,UAA2C;AAC9D,UAAI,CAAC,cAAe,OAAM,IAAI,MAAM,mCAAmC;AACvE,aAAO,IAAI,OAAO,OAAO,eAAe,UAAU;AAAA,IACpD;AAAA,IAEA,OACE,MACA,CAAC,KAAqB,KAAe,SAA6B;AAChE,UAAI,QAAuB;AAC3B,iBAAW,aAAa,YAAY;AAClC,YAAK,QAAQ,UAAU,GAAG,EAAI;AAAA,MAChC;AAEA,UAAI,CAAC,OAAO;AACV,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kCAAkC,CAAC;AACjE;AAAA,MACF;AAEA,UAAI;AACF,YAAI,QAAQ,IAAI,IAAI,OAAO,OAAO,QAAQ,UAAU;AACpD,aAAK;AAAA,MACP,SAAS,KAAK;AACZ,cAAM,MACJ,eAAe,IAAI,oBACf,kBACA;AACN,YAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG,CAAC;AAAA,MACxD;AAAA,IACF;AAAA,IAEF,aAAa,CACX,gBAA6B,OAAO,OAAO,IAAI,MAC5C;AACH,aAAO,CAAC,KAAqB,KAAe,SAA6B;AACvE,cAAM,OAAO,IAAI,QAAQ;AAEzB,YAAI,CAAC,MAAM;AACT,cACG,OAAO,GAAG,EACV,KAAK,EAAE,OAAO,wCAAwC,CAAC;AAC1D;AAAA,QACF;AAEA,cAAM,WAAW,KAAK,QAAQ;AAC9B,YAAI,CAAC,YAAY,CAAC,cAAc,SAAS,QAAQ,GAAG;AAClD,cAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sCAAsC,CAAC;AACrE;AAAA,QACF;AACA,aAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,aACd,QACsB;AACtB,SAAO;AACT;","names":[]}

package/dist/types.d.ts

@@ -0,0 +1,22 @@
+import type { Request } from "express";
+import type { Algorithm } from "jsonwebtoken";
+export type TokenExtractor = (req: Request) => string | null;
+export type RoleMap<T extends readonly string[]> = {
+    [K in T[number] as Uppercase<K & string>]: K;
+};
+export interface SecretConfig {
+    key: string | Buffer;
+    exp?: string | number;
+}
+export interface SecurityKitConfig<T extends readonly string[]> {
+    secret: SecretConfig | string | Buffer;
+    refreshSecret?: SecretConfig | string | Buffer;
+    userProperty?: string;
+    roleProperty?: string;
+    algorithms?: Algorithm[];
+    extractors?: TokenExtractor[];
+    roles?: T;
+}
+export interface GuardedRequest extends Request {
+    [key: string]: any;
+}

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@shamodha/jwt-security-kit",
+  "version": "1.0.1",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "jwt-security-kit": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsup && tsc --emitDeclarationOnly --declaration --outDir dist"
+  },
+  "peerDependencies": {
+    "express": "^4.17.0 || ^5.0.0",
+    "jsonwebtoken": "^9.0.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.0",
+    "@types/jsonwebtoken": "^9.0.0",
+    "@types/node": "^20.0.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.0.0"
+  }
+}

package/src/cli.ts

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import * as fs from "fs"
+import * as path from "path"
+
+const args = process.argv.slice(2)
+const command = args[0]
+
+if (command === "init") {
+  const flags = args.slice(1)
+  const isJavaScript = flags.includes("--js") || flags.includes("-j")
+
+  const ext = isJavaScript ? "js" : "ts"
+  const fileName = `jwt.security.config.${ext}`
+  const filePath = path.join(process.cwd(), fileName)
+
+  const template = isJavaScript
+    ? `const { defineConfig } = require('jwt-security-kit');
+
+module.exports = defineConfig({
+  secret: {
+    key: process.env.JWT_SECRET || 'your-super-secret-key',
+    exp: '15m'
+  },
+  roles: ['user', 'admin']
+});
+`
+    : `import { defineConfig } from 'jwt-security-kit';
+
+export default defineConfig({
+  secret: {
+    key: process.env.JWT_SECRET || 'your-super-secret-key',
+    exp: '15m'
+  },
+  roles: ['user', 'admin'] as const
+});
+`
+
+  if (fs.existsSync(filePath)) {
+    console.log(`⚠️ Configuration file already exists at: ${fileName}`)
+    process.exit(1)
+  }
+
+  try {
+    fs.writeFileSync(filePath, template, "utf8")
+    console.log(`✨ Successfully created ${fileName} in your project root!`)
+  } catch (err) {
+    console.error("❌ Failed to create configuration file:", err)
+    process.exit(1)
+  }
+} else {
+  console.log("Unknown command. Use: npx jwt-security-kit init [--js]")
+}

package/src/extractors.ts

@@ -0,0 +1,19 @@
+import type { TokenExtractor } from "./types"
+
+export const Extractors = {
+  fromHeader: (headerName = "authorization"): TokenExtractor => {
+    return (req) => {
+      const header = req.headers[headerName.toLowerCase()]
+      if (typeof header === "string" && header.startsWith("Bearer ")) {
+        return header.split(" ")[1]
+      }
+      return typeof header === "string" ? header : null
+    }
+  },
+  fromCookie: (cookieName: string): TokenExtractor => {
+    return (req) => (req.cookies ? req.cookies[cookieName] || null : null)
+  },
+  fromBody: (fieldName: string): TokenExtractor => {
+    return (req) => (req.body ? req.body[fieldName] || null : null)
+  }
+}

package/src/index.ts

@@ -0,0 +1,140 @@
+import type { Response, NextFunction } from "express"
+import jwt from "jsonwebtoken"
+import type {
+  SecurityKitConfig,
+  GuardedRequest,
+  RoleMap,
+  SecretConfig
+} from "./types"
+import { Extractors } from "./extractors"
+
+export function createSecurityKit<const T extends readonly string[]>(
+  config: SecurityKitConfig<T>
+) {
+  if (!config.secret) throw new Error("FATAL: SecurityKit requires a secret.")
+
+  const secretCfg: SecretConfig =
+    typeof config.secret === "object" &&
+    config.secret !== null &&
+    "key" in config.secret
+      ? config.secret
+      : { key: config.secret }
+
+  const secret = secretCfg.key
+  const accessExp: string | number = secretCfg.exp || "15m"
+
+  let refreshSecret: string | Buffer | undefined
+  let refreshExp: string | number = "7d"
+
+  if (config.refreshSecret) {
+    const refreshCfg: SecretConfig =
+      typeof config.refreshSecret === "object" &&
+      config.refreshSecret !== null &&
+      "key" in config.refreshSecret
+        ? config.refreshSecret
+        : { key: config.refreshSecret }
+
+    refreshSecret = refreshCfg.key
+    refreshExp = refreshCfg.exp || "7d"
+  }
+
+  const userProp = config.userProperty || "user"
+  const roleProp = config.roleProperty || "role"
+  const algorithms = config.algorithms || ["HS256"]
+  const extractors = config.extractors?.length
+    ? config.extractors
+    : [Extractors.fromHeader()]
+
+  const rolesArray = config.roles || (["user", "admin"] as unknown as T)
+
+  const Role = Object.freeze(
+    rolesArray.reduce((acc, role) => {
+      ;(acc as any)[role.toUpperCase()] = role
+      return acc
+    }, {} as RoleMap<T>)
+  )
+
+  const signOpts: jwt.SignOptions = { expiresIn: accessExp as any }
+  const refreshSignOpts: jwt.SignOptions = { expiresIn: refreshExp as any }
+  const verifyOpts: jwt.VerifyOptions = { algorithms }
+
+  return {
+    Role,
+
+    generateToken: (payload: string | object | Buffer): string => {
+      return jwt.sign(payload, secret, signOpts)
+    },
+
+    generateRefreshToken: (payload: string | object | Buffer): string => {
+      if (!refreshSecret) throw new Error("Refresh secret is not configured.")
+      return jwt.sign(payload, refreshSecret, refreshSignOpts)
+    },
+
+    verifyRefreshToken: (token: string): string | jwt.JwtPayload => {
+      if (!refreshSecret) throw new Error("Refresh secret is not configured.")
+      return jwt.verify(token, refreshSecret, verifyOpts)
+    },
+
+    guard:
+      () =>
+      (req: GuardedRequest, res: Response, next: NextFunction): void => {
+        let token: string | null = null
+        for (const extractor of extractors) {
+          if ((token = extractor(req))) break
+        }
+
+        if (!token) {
+          res.status(401).json({ error: "Unauthorized: No token provided" })
+          return
+        }
+
+        try {
+          req[userProp] = jwt.verify(token, secret, verifyOpts)
+          next()
+        } catch (err) {
+          const msg =
+            err instanceof jwt.TokenExpiredError
+              ? "Token expired"
+              : "Invalid token"
+          res.status(401).json({ error: `Unauthorized: ${msg}` })
+        }
+      },
+
+    requireRole: (
+      requiredRoles: T[number][] = Object.values(Role) as T[number][]
+    ) => {
+      return (req: GuardedRequest, res: Response, next: NextFunction): void => {
+        const user = req[userProp]
+
+        if (!user) {
+          res
+            .status(401)
+            .json({ error: "Unauthorized: Authentication required" })
+          return
+        }
+
+        const userRole = user[roleProp]
+        if (!userRole || !requiredRoles.includes(userRole)) {
+          res.status(403).json({ error: "Forbidden: Insufficient permissions" })
+          return
+        }
+        next()
+      }
+    }
+  }
+}
+
+export function defineConfig<const T extends readonly string[]>(
+  config: SecurityKitConfig<T>
+): SecurityKitConfig<T> {
+  return config
+}
+
+export { Extractors } from "./extractors"
+export type {
+  SecurityKitConfig,
+  GuardedRequest,
+  TokenExtractor,
+  SecretConfig,
+  RoleMap
+} from "./types"

package/src/types.ts

@@ -0,0 +1,27 @@
+import type { Request } from "express"
+import type { Algorithm } from "jsonwebtoken"
+
+export type TokenExtractor = (req: Request) => string | null
+
+export type RoleMap<T extends readonly string[]> = {
+  [K in T[number] as Uppercase<K & string>]: K
+}
+
+export interface SecretConfig {
+  key: string | Buffer
+  exp?: string | number
+}
+
+export interface SecurityKitConfig<T extends readonly string[]> {
+  secret: SecretConfig | string | Buffer
+  refreshSecret?: SecretConfig | string | Buffer
+  userProperty?: string
+  roleProperty?: string
+  algorithms?: Algorithm[]
+  extractors?: TokenExtractor[]
+  roles?: T
+}
+
+export interface GuardedRequest extends Request {
+  [key: string]: any
+}

package/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "rootDir": "src",
+    "outDir": "dist"
+  },
+  "include": ["src"]
+}

package/tsup.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "tsup"
+
+export default defineConfig({
+  entry: ["src/index.ts", "src/cli.ts"],
+  format: ["cjs", "esm"],
+  dts: false,
+  splitting: false,
+  sourcemap: true,
+  clean: true
+})