@stonecrop/casl-middleware 0.12.7 → 0.13.0

package/dist/middleware/jwt.js

@@ -0,0 +1,291 @@
+import jwt from 'jsonwebtoken';
+import { AbilityBuilder, PureAbility } from '@casl/ability';
+import { defaultAbilityBuilder } from './ability';
+/**
+ * Default user extractor from JWT payload
+ */
+const defaultUserExtractor = (payload) => {
+    if (!payload.sub)
+        return undefined;
+    return {
+        id: payload.sub,
+        roles: payload.roles || [],
+        ...payload, // Include any additional claims
+    };
+};
+/**
+ * JWT middleware factory for GraphQL servers
+ *
+ * @example
+ * ```typescript
+ * // In Nuxt Yoga
+ * export default defineNuxtConfig({
+ *   yoga: {
+ *     middleware: [
+ *       createJWTMiddleware({
+ *         enabled: true,
+ *         secret: process.env.JWT_SECRET,
+ *         optional: true // Don't fail if no token
+ *       })
+ *     ]
+ *   }
+ * })
+ *
+ * // In Postgraphile
+ * const jwtPlugin = createPostgraphileJWTPlugin({
+ *   secret: process.env.JWT_SECRET,
+ *   extractUser: (payload) => ({
+ *     id: payload.user_id,
+ *     roles: payload.user_roles
+ *   })
+ * })
+ * ```
+ */
+export const createJWTMiddleware = (config = {}) => {
+    const { enabled = true, secret, publicKey, algorithms = ['HS256'], issuer, audience, headerName = 'authorization', tokenPrefix = 'Bearer ', optional = false, extractUser = defaultUserExtractor, maxAge, } = config;
+    // Validate configuration
+    if (enabled && !secret && !publicKey) {
+        throw new Error('JWT middleware requires either secret or publicKey');
+    }
+    return async (context, next) => {
+        // Skip if JWT is disabled
+        if (!enabled) {
+            return next();
+        }
+        try {
+            // Extract token from request headers
+            const authHeader = context.req?.headers?.get?.(headerName) ||
+                context.request?.headers?.get?.(headerName) ||
+                context.headers?.[headerName];
+            if (!authHeader) {
+                if (optional) {
+                    return next();
+                }
+                throw new Error('No authorization header found');
+            }
+            // Remove token prefix
+            const token = authHeader.startsWith(tokenPrefix) ? authHeader.slice(tokenPrefix.length) : authHeader;
+            // Prepare verification options
+            const verifyOptions = {
+                algorithms,
+                ...(issuer && { issuer }),
+                ...(audience && { audience }),
+                ...(maxAge && { maxAge }),
+            };
+            // Verify and decode token
+            const secretOrPublicKey = publicKey || secret;
+            const payload = jwt.verify(token, secretOrPublicKey, verifyOptions);
+            // Extract user from payload
+            const user = extractUser(payload);
+            if (user) {
+                context.user = user;
+                // Store the raw payload for potential use
+                context.jwtPayload = payload;
+            }
+            // Continue to next middleware
+            return next();
+        }
+        catch (error) {
+            if (optional) {
+                // Log error in development
+                if (process.env.NODE_ENV === 'development') {
+                    console.warn('JWT verification failed (optional):', error.message);
+                }
+                // Continue without user if optional
+                return next();
+            }
+            // Re-throw with more specific error messages
+            if (error.name === 'TokenExpiredError') {
+                throw new Error('Token has expired');
+            }
+            else if (error.name === 'JsonWebTokenError') {
+                throw new Error('Invalid token');
+            }
+            else if (error.name === 'NotBeforeError') {
+                throw new Error('Token not active yet');
+            }
+            throw error;
+        }
+    };
+};
+/**
+ * Create a JWT token with user data
+ */
+export const createJWT = (user, config) => {
+    const { secret, expiresIn = '1h', issuer, audience, additionalClaims = {} } = config;
+    const payload = {
+        sub: user.id,
+        roles: user.roles || [],
+        ...additionalClaims,
+    };
+    const signOptions = {};
+    // Add optional fields only if they exist
+    if (issuer !== undefined)
+        signOptions.issuer = issuer;
+    if (audience !== undefined)
+        signOptions.audience = audience;
+    if (expiresIn !== undefined)
+        signOptions.expiresIn = expiresIn; // Type cast to avoid TS issues
+    return jwt.sign(payload, secret, signOptions);
+};
+/**
+ * Integration with CASL ability builder
+ */
+export const createJWTAbilityBuilder = (config = {}) => {
+    return async (user) => {
+        // If user has direct permissions in JWT, use those
+        const jwtPermissions = user?.permissions;
+        if (jwtPermissions && Array.isArray(jwtPermissions)) {
+            // Build ability from JWT permissions
+            const { can, cannot, build } = new AbilityBuilder(PureAbility);
+            jwtPermissions.forEach((permission) => {
+                if (permission.inverted) {
+                    cannot(permission.action, permission.subject, permission.conditions);
+                }
+                else {
+                    can(permission.action, permission.subject, permission.conditions);
+                }
+            });
+            return build();
+        }
+        // Fall back to role-based abilities
+        return defaultAbilityBuilder(user);
+    };
+};
+/**
+ * Postgraphile-specific JWT plugin
+ */
+export const createPostgraphileJWTPlugin = (config) => {
+    return {
+        name: 'JWTAuthPlugin',
+        version: '1.0.0',
+        // Hook into Postgraphile's context building
+        grafast: {
+            hooks: {
+                async context(ctx, build) {
+                    const middleware = createJWTMiddleware(config);
+                    // Create a simple context object that the middleware can work with
+                    const context = {
+                        req: ctx.req,
+                        headers: ctx.req?.headers,
+                        user: undefined,
+                        jwtPayload: undefined,
+                    };
+                    // Run the JWT middleware
+                    await middleware(context, async () => { });
+                    // Add user to Postgraphile context
+                    if (context.user) {
+                        return { ...ctx, user: context.user, jwtPayload: context.jwtPayload };
+                    }
+                    return ctx;
+                },
+            },
+        },
+    };
+};
+/**
+ * Express/Koa middleware for REST endpoints
+ */
+export const createHTTPJWTMiddleware = (config) => {
+    const jwtMiddleware = createJWTMiddleware(config);
+    // Express middleware
+    return async (req, res, next) => {
+        const context = {
+            req: {
+                headers: {
+                    get: (name) => req.headers[name],
+                },
+            },
+            headers: req.headers,
+            user: undefined,
+            jwtPayload: undefined,
+        };
+        try {
+            await jwtMiddleware(context, async () => { });
+            req.user = context.user;
+            req.jwtPayload = context.jwtPayload;
+            next();
+        }
+        catch (error) {
+            if (config.optional) {
+                next();
+            }
+            else {
+                res.status(401).json({
+                    error: error.message,
+                    code: 'UNAUTHORIZED',
+                });
+            }
+        }
+    };
+};
+/**
+ * Refresh token utilities
+ */
+export const refreshTokenUtils = {
+    /**
+     * Create access and refresh tokens
+     */
+    createTokenPair: (user, config) => {
+        const { accessSecret, refreshSecret, accessExpiresIn = '15m', refreshExpiresIn = '7d' } = config;
+        const accessPayload = {
+            sub: user.id,
+            roles: user.roles,
+            type: 'access',
+        };
+        const refreshPayload = {
+            sub: user.id,
+            type: 'refresh',
+        };
+        // Create access token with proper options
+        const accessOptions = {};
+        if (accessExpiresIn) {
+            accessOptions.expiresIn = accessExpiresIn; // Type cast to avoid TS issues
+        }
+        const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions);
+        // Create refresh token with proper options
+        const refreshOptions = {};
+        if (refreshExpiresIn) {
+            refreshOptions.expiresIn = refreshExpiresIn; // Type cast to avoid TS issues
+        }
+        const refreshToken = jwt.sign(refreshPayload, refreshSecret, refreshOptions);
+        return { accessToken, refreshToken };
+    },
+    /**
+     * Verify refresh token and create new access token
+     */
+    refreshAccessToken: async (refreshToken, config) => {
+        const { accessSecret, refreshSecret, getUserById, accessExpiresIn = '15m' } = config;
+        try {
+            // Verify refresh token
+            const payload = jwt.verify(refreshToken, refreshSecret);
+            if (payload.type !== 'refresh') {
+                throw new Error('Invalid token type');
+            }
+            // Get fresh user data
+            const user = await getUserById(payload.sub);
+            if (!user) {
+                throw new Error('User not found');
+            }
+            // Create new access token
+            const accessPayload = {
+                sub: user.id,
+                roles: user.roles,
+                type: 'access',
+            };
+            // Create access token with proper options
+            const accessOptions = {};
+            if (accessExpiresIn) {
+                accessOptions.expiresIn = accessExpiresIn; // Type cast to avoid TS issues
+            }
+            const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions);
+            return { accessToken, user };
+        }
+        catch (error) {
+            if (error.name === 'TokenExpiredError') {
+                throw new Error('Refresh token expired');
+            }
+            throw error;
+        }
+    },
+};

package/dist/middleware/postgraphile.js

@@ -0,0 +1,80 @@
+import { extendSchema, gql } from 'postgraphile/utils';
+import { createAbility } from './ability';
+/**
+ * PostGraphile plugin for CASL authorization
+ * @public
+ */
+export const pglCaslPlugin = extendSchema(build => {
+    const { grafast: { constant, object, sideEffect }, } = build;
+    return {
+        typeDefs: gql `
+			input CreateAbilityInput {
+				userId: String!
+				roles: [String!]
+			}
+
+			type AbilityResponse {
+				success: Boolean!
+				ability: JSON
+				message: String
+			}
+
+			type SecretData {
+				id: String!
+				content: String!
+			}
+
+			extend type Query {
+				getSecretData: SecretData
+			}
+
+			extend type Mutation {
+				createAbility(input: CreateAbilityInput!): AbilityResponse!
+			}
+		`,
+        objects: {
+            Query: {
+                plans: {
+                    async getSecretData() {
+                        // TODO: This should be protected by CASL
+                        // const $ability = context<Context>().get('ability')
+                        // if (!$ability.can('read', 'SecretData')) {
+                        // 	throw new Error('Access denied')
+                        // }
+                        return object({
+                            id: constant('123'),
+                            content: constant('This is protected content'),
+                        });
+                    },
+                },
+            },
+            Mutation: {
+                plans: {
+                    async createAbility(_plan, fieldArgs) {
+                        const $input = fieldArgs.getRaw().input;
+                        const $userId = $input.userId;
+                        const $roles = $input.roles;
+                        return sideEffect([$userId, $roles], async ([userId, roles]) => {
+                            // Make this async
+                            try {
+                                const ability = await createAbility({ id: userId, roles }); // Await here
+                                return {
+                                    success: true,
+                                    ability: ability.rules,
+                                    message: 'Ability created successfully',
+                                };
+                            }
+                            catch (error) {
+                                return {
+                                    success: false,
+                                    ability: null,
+                                    message: error instanceof Error ? error.message : 'Unknown error occurred',
+                                };
+                            }
+                        });
+                    },
+                },
+            },
+        },
+    };
+});

package/dist/middleware/yoga.js

@@ -0,0 +1,32 @@
+import { createAbility } from './ability';
+import { createCaslMiddleware } from './graphql';
+const getLoggedInUser = () => {
+    // Mock user for demonstration purposes
+    return { id: '1', roles: ['editor'] };
+};
+export const yogaCaslPlugin = {
+    onContextBuilding: async ({ context, extendContext }) => {
+        // Make this async
+        const user = getLoggedInUser();
+        const ability = await createAbility(user); // Await here
+        extendContext({ ability, user });
+    },
+};
+/**
+ * Create a GraphQL Yoga plugin for CASL authorization
+ * Note: This is a placeholder for future implementation
+ *
+ * @param options - CASL middleware configuration options
+ * @returns Yoga plugin
+ * @public
+ */
+export const createYogaPlugin = (options = {}) => {
+    const middleware = createCaslMiddleware(options);
+    return {
+        onExecute: async ({ args }) => {
+            // TODO: Implement Yoga plugin
+            // This would integrate with GraphQL Yoga's plugin system
+            console.log('Yoga plugin not yet implemented');
+        },
+    };
+};

package/dist/src/tsdoc-metadata.json

@@ -0,0 +1,11 @@
+// This file is read by tools that parse documentation comments conforming to the TSDoc standard.
+// It should be published with your NPM package.  It should not be tracked by Git.
+{
+  "tsdocVersion": "0.12",
+  "toolPackages": [
+    {
+      "packageName": "@microsoft/api-extractor",
+      "packageVersion": "7.57.0"
+    }
+  ]
+}

package/dist/tests/ability.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ability.test.d.ts.map

package/dist/tests/ability.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability.test.d.ts","sourceRoot":"","sources":["../../tests/ability.test.ts"],"names":[],"mappings":""}