@stonecrop/casl-middleware 0.13.3 → 0.13.5

package/dist/src/middleware/graphql.js

@@ -75,7 +75,7 @@ export const createCaslMiddleware = (options = {}) => {
         const subjectType = info.parentType.name;
         const subjectName = subjectMap[subjectType] || subjectType;
         if (debug) {
-            console.log(`Checking permission: ${action} on ${subjectName} at ${fieldPath}`);
+            console.debug(`Checking permission: ${action} on ${subjectName} at ${fieldPath}`);
         }
         // Check field-level permissions if defined
         if (fieldPermissions[fieldPath]) {

package/dist/src/middleware/jwt.d.ts

@@ -57,7 +57,7 @@ export declare const createJWTMiddleware: (config?: JWTConfig) => (context: Cont
  */
 export declare const createJWT: (user: User, config: {
     secret: string;
-    expiresIn?: string | number;
+    expiresIn?: jwt.SignOptions["expiresIn"];
     issuer?: string;
     audience?: string;
     additionalClaims?: Record<string, any>;
@@ -92,8 +92,8 @@ export declare const refreshTokenUtils: {
     createTokenPair: (user: User, config: {
         accessSecret: string;
         refreshSecret: string;
-        accessExpiresIn?: string;
-        refreshExpiresIn?: string;
+        accessExpiresIn?: jwt.SignOptions["expiresIn"];
+        refreshExpiresIn?: jwt.SignOptions["expiresIn"];
     }) => {
         accessToken: string;
         refreshToken: string;
@@ -105,7 +105,7 @@ export declare const refreshTokenUtils: {
         accessSecret: string;
         refreshSecret: string;
         getUserById: (id: string) => Promise<User | null>;
-        accessExpiresIn?: string;
+        accessExpiresIn?: jwt.SignOptions["expiresIn"];
     }) => Promise<{
         accessToken: string;
         user: User;

package/dist/src/middleware/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/middleware/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAG7C,MAAM,WAAW,SAAS;IACzB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,GAAG,SAAS,CAAA;IAChD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,UAAW,SAAQ,GAAG,CAAC,UAAU;IACjD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,WAAW,CAAC,EAAE,KAAK,CAAC;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,GAAG,CAAA;KAChB,CAAC,CAAA;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAQ,SAAc,MAoB3C,SAAS,OAAO,EAAE,MAAM,MAAM,OAAO,CAAC,GAAG,CAAC,iBAoExD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,GACrB,MAAM,IAAI,EACV,QAAQ;IACP,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CACtC,KACC,MAiBF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAS,SAAc,MAChD,OAAO,IAAI,4CAsBzB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,QAAQ,SAAS;;;;;yBAQtC,GAAG,UAAU,GAAG;;;CAwBtC,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,SAAS,MAI1C,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,MAAM,GAAG,kBA4B3C,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB;IAC7B;;OAEG;4BAEI,IAAI,UACF;QACP,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;QACrB,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;KACzB;;;;IAkCF;;OAEG;uCAEY,MAAM,UACZ;QACP,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;QACjD,eAAe,CAAC,EAAE,MAAM,CAAA;KACxB;;;;CAyCF,CAAA"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/middleware/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAG7C,MAAM,WAAW,SAAS;IACzB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,GAAG,SAAS,CAAA;IAChD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,UAAW,SAAQ,GAAG,CAAC,UAAU;IACjD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,WAAW,CAAC,EAAE,KAAK,CAAC;QACnB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,GAAG,CAAA;KAChB,CAAC,CAAA;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAQ,SAAc,MAoB3C,SAAS,OAAO,EAAE,MAAM,MAAM,OAAO,CAAC,GAAG,CAAC,iBAwExD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,GACrB,MAAM,IAAI,EACV,QAAQ;IACP,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IACxC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CACtC,KACC,MAiBF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAS,SAAc,MAChD,OAAO,IAAI,4CAsBzB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,QAAQ,SAAS;;;;;yBAQtC,GAAG,UAAU,GAAG;;;CAwBtC,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,SAAS,MAI1C,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,MAAM,GAAG,kBA4B3C,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB;IAC7B;;OAEG;4BAEI,IAAI,UACF;QACP,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;QACrB,eAAe,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAC9C,gBAAgB,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;KAC/C;;;;IAkCF;;OAEG;uCAEY,MAAM,UACZ;QACP,YAAY,EAAE,MAAM,CAAA;QACpB,aAAa,EAAE,MAAM,CAAA;QACrB,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;QACjD,eAAe,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;KAC9C;;;;CAgDF,CAAA"}

package/dist/src/middleware/jwt.js

@@ -74,7 +74,11 @@ export const createJWTMiddleware = (config = {}) => {
             };
             // Verify and decode token
             const secretOrPublicKey = publicKey || secret;
-            const payload = jwt.verify(token, secretOrPublicKey, verifyOptions);
+            const decoded = jwt.verify(token, secretOrPublicKey, verifyOptions);
+            if (typeof decoded === 'string' || decoded == null) {
+                throw new Error('Invalid JWT payload: expected object');
+            }
+            const payload = decoded;
             // Extract user from payload
             const user = extractUser(payload);
             if (user) {
@@ -125,7 +129,7 @@ export const createJWT = (user, config) => {
     if (audience !== undefined)
         signOptions.audience = audience;
     if (expiresIn !== undefined)
-        signOptions.expiresIn = expiresIn; // Type cast to avoid TS issues
+        signOptions.expiresIn = expiresIn;
     return jwt.sign(payload, secret, signOptions);
 };
 /**
@@ -240,13 +244,13 @@ export const refreshTokenUtils = {
         // Create access token with proper options
         const accessOptions = {};
         if (accessExpiresIn) {
-            accessOptions.expiresIn = accessExpiresIn; // Type cast to avoid TS issues
+            accessOptions.expiresIn = accessExpiresIn;
         }
         const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions);
         // Create refresh token with proper options
         const refreshOptions = {};
         if (refreshExpiresIn) {
-            refreshOptions.expiresIn = refreshExpiresIn; // Type cast to avoid TS issues
+            refreshOptions.expiresIn = refreshExpiresIn;
         }
         const refreshToken = jwt.sign(refreshPayload, refreshSecret, refreshOptions);
         return { accessToken, refreshToken };
@@ -258,11 +262,18 @@ export const refreshTokenUtils = {
         const { accessSecret, refreshSecret, getUserById, accessExpiresIn = '15m' } = config;
         try {
             // Verify refresh token
-            const payload = jwt.verify(refreshToken, refreshSecret);
+            const decoded = jwt.verify(refreshToken, refreshSecret);
+            if (typeof decoded === 'string' || decoded == null) {
+                throw new Error('Invalid refresh token payload: expected object');
+            }
+            const payload = decoded;
             if (payload.type !== 'refresh') {
                 throw new Error('Invalid token type');
             }
             // Get fresh user data
+            if (!payload.sub) {
+                throw new Error('Invalid refresh token payload: missing subject');
+            }
             const user = await getUserById(payload.sub);
             if (!user) {
                 throw new Error('User not found');
@@ -276,7 +287,7 @@ export const refreshTokenUtils = {
             // Create access token with proper options
             const accessOptions = {};
             if (accessExpiresIn) {
-                accessOptions.expiresIn = accessExpiresIn; // Type cast to avoid TS issues
+                accessOptions.expiresIn = accessExpiresIn;
             }
             const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions);
             return { accessToken, user };

package/dist/src/middleware/postgraphile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgraphile.d.ts","sourceRoot":"","sources":["../../../src/middleware/postgraphile.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAI5D;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,cAAc,CAAC,MAkFzC,CAAA"}
+{"version":3,"file":"postgraphile.d.ts","sourceRoot":"","sources":["../../../src/middleware/postgraphile.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAI5D;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,cAAc,CAAC,MA8EzC,CAAA"}

package/dist/src/middleware/postgraphile.js

@@ -51,9 +51,8 @@ export const pglCaslPlugin = extendSchema(build => {
             Mutation: {
                 plans: {
                     async createAbility(_plan, fieldArgs) {
-                        const $input = fieldArgs.getRaw().input;
-                        const $userId = $input.userId;
-                        const $roles = $input.roles;
+                        const $userId = fieldArgs.getRaw().input.userId;
+                        const $roles = fieldArgs.getRaw().input.roles;
                         return sideEffect([$userId, $roles], async ([userId, roles]) => {
                             // Make this async
                             try {

package/dist/src/middleware/yoga.d.ts

@@ -9,7 +9,7 @@ export declare const yogaCaslPlugin: Plugin<Context>;
  * @returns Yoga plugin
  * @public
  */
-export declare const createYogaPlugin: (options?: MiddlewareOptions) => {
+export declare const createYogaPlugin: (_options?: MiddlewareOptions) => {
     onExecute: (_: any) => Promise<void>;
 };
 //# sourceMappingURL=yoga.d.ts.map

package/dist/src/middleware/yoga.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yoga.d.ts","sourceRoot":"","sources":["../../../src/middleware/yoga.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAI1C,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAO1D,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,OAAO,CAO1C,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,UAAS,iBAAsB;mBAIzC,GAAG;CAMzB,CAAA"}
+{"version":3,"file":"yoga.d.ts","sourceRoot":"","sources":["../../../src/middleware/yoga.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAG1C,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAO1D,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,OAAO,CAO1C,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAU,iBAAsB;mBAE1C,GAAG;CAMzB,CAAA"}

package/dist/src/middleware/yoga.js

@@ -1,5 +1,4 @@
 import { createAbility } from './ability';
-import { createCaslMiddleware } from './graphql';
 const getLoggedInUser = () => {
     // Mock user for demonstration purposes
     return { id: '1', roles: ['editor'] };
@@ -20,13 +19,12 @@ export const yogaCaslPlugin = {
  * @returns Yoga plugin
  * @public
  */
-export const createYogaPlugin = (options = {}) => {
-    const _middleware = createCaslMiddleware(options);
+export const createYogaPlugin = (_options = {}) => {
     return {
         onExecute: async (_) => {
-            // TODO: Implement Yoga plugin
-            // This would integrate with GraphQL Yoga's plugin system
-            console.log('Yoga plugin not yet implemented');
+            // TODO: Implement Yoga plugin via createCaslMiddleware(_options).
+            // This would integrate with GraphQL Yoga's plugin system.
+            console.warn('Yoga plugin not yet implemented');
         },
     };
 };

package/dist/src/types/index.d.ts

@@ -58,12 +58,12 @@ export interface FieldPermission {
  * GraphQL resolver function type
  * @public
  */
-export type ResolverFn = (root: any, args: any, context: Context, info: GraphQLResolveInfo) => Promise<any> | any;
+export type ResolverFn = (root: any, args: any, context: Context, info: GraphQLResolveInfo) => any;
 /**
  * Middleware function that wraps a GraphQL resolver with authorization logic
  * @public
  */
-export type MiddlewareFn = (resolve: ResolverFn, root: any, args: any, context: Context, info: GraphQLResolveInfo) => Promise<any> | any;
+export type MiddlewareFn = (resolve: ResolverFn, root: any, args: any, context: Context, info: GraphQLResolveInfo) => any;
 /**
  * Plugin configuration options for framework integrations
  * @public

package/dist/src/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAE/E;;;GAGG;AACH,MAAM,WAAW,IAAI;IACpB,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACvB,qDAAqD;IACrD,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,iCAAiC;IACjC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,oCAAoC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAID;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACpD,8CAA8C;IAC9C,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,UAAU,CAAC,EAAE,GAAG,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;AAEjH;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAC1B,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,GAAG,EACT,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,kBAAkB,KACpB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;AAEvB;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACvD,8CAA8C;IAC9C,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,oCAAoC;IACpC,YAAY,CAAC,EAAE;QACd,mCAAmC;QACnC,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,+CAA+C;QAC/C,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,CAAA;KAC7B,CAAA;CACD;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,mDAAmD;IACnD,OAAO,EAAE,OAAO,CAAA;IAChB,gCAAgC;IAChC,OAAO,EAAE,GAAG,CAAA;IACZ,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;CACf;AAGD,MAAM,WAAW,WAAW;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,UAAU,CAAC,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;CAClB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAE/E;;;GAGG;AACH,MAAM,WAAW,IAAI;IACpB,qCAAqC;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,iCAAiC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACvB,qDAAqD;IACrD,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,iCAAiC;IACjC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,oCAAoC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAID;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IACjC,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,mCAAmC;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACpD,8CAA8C;IAC9C,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,UAAU,CAAC,EAAE,GAAG,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,KAAK,GAAG,CAAA;AAElG;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAC1B,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,GAAG,EACT,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,kBAAkB,KACpB,GAAG,CAAA;AAER;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACvD,8CAA8C;IAC9C,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,oCAAoC;IACpC,YAAY,CAAC,EAAE;QACd,mCAAmC;QACnC,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,+CAA+C;QAC/C,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,CAAA;KAC7B,CAAA;CACD;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,mDAAmD;IACnD,OAAO,EAAE,OAAO,CAAA;IAChB,gCAAgC;IAChC,OAAO,EAAE,GAAG,CAAA;IACZ,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;CACf;AAGD,MAAM,WAAW,WAAW;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,UAAU,CAAC,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;CAClB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stonecrop/casl-middleware",
-  "version": "0.13.3",
+  "version": "0.13.5",
   "license": "MIT",
   "type": "module",
   "author": {
@@ -42,14 +42,11 @@
     "@rushstack/heft": "^1.2.17",
     "@types/node": "^24.12.4",
     "@vitest/coverage-istanbul": "^4.1.5",
-    "@eslint/js": "^10.0.1",
-    "eslint": "^10.3.0",
-    "eslint-config-prettier": "^10.1.8",
-    "globals": "^17.6.0",
-    "typescript-eslint": "^8.59.1",
     "graphql-middleware": "^6.1.35",
     "graphql-yoga": "^5.18.0",
     "jsdom": "^29.1.1",
+    "oxlint": "1.67.0",
+    "oxlint-tsgolint": "0.23.0",
     "postgraphile": "^5.0.3",
     "typescript": "^6.0.3",
     "vite": "^7.3.2",
@@ -80,7 +77,8 @@
     "build": "heft build && vite build && rushx docs",
     "dev": "vite",
     "docs": "bash ../common/scripts/run-docs.sh casl_middleware",
-    "lint": "eslint .",
+    "lint": "oxlint",
+    "lint:fix": "oxlint --fix",
     "preview": "vite preview",
     "test": "vitest run --coverage.enabled false",
     "test:watch": "vitest watch",

package/src/middleware/graphql.ts

@@ -98,7 +98,7 @@ export const createCaslMiddleware = (options: MiddlewareOptions = {}) => {
 		const subjectName = subjectMap[subjectType] || subjectType
 
 		if (debug) {
-			console.log(`Checking permission: ${action} on ${subjectName} at ${fieldPath}`)
+			console.debug(`Checking permission: ${action} on ${subjectName} at ${fieldPath}`)
 		}
 
 		// Check field-level permissions if defined

package/src/middleware/jwt.ts

@@ -122,7 +122,11 @@ export const createJWTMiddleware = (config: JWTConfig = {}) => {
 
 			// Verify and decode token
 			const secretOrPublicKey = publicKey || secret!
-			const payload = jwt.verify(token, secretOrPublicKey, verifyOptions) as JWTPayload
+			const decoded = jwt.verify(token, secretOrPublicKey, verifyOptions)
+			if (typeof decoded === 'string' || decoded == null) {
+				throw new Error('Invalid JWT payload: expected object')
+			}
+			const payload: JWTPayload = decoded
 
 			// Extract user from payload
 			const user = extractUser(payload)
@@ -166,7 +170,7 @@ export const createJWT = (
 	user: User,
 	config: {
 		secret: string
-		expiresIn?: string | number
+		expiresIn?: jwt.SignOptions['expiresIn']
 		issuer?: string
 		audience?: string
 		additionalClaims?: Record<string, any>
@@ -185,7 +189,7 @@ export const createJWT = (
 	// Add optional fields only if they exist
 	if (issuer !== undefined) signOptions.issuer = issuer
 	if (audience !== undefined) signOptions.audience = audience
-	if (expiresIn !== undefined) signOptions.expiresIn = expiresIn as any // Type cast to avoid TS issues
+	if (expiresIn !== undefined) signOptions.expiresIn = expiresIn
 
 	return jwt.sign(payload, secret, signOptions)
 }
@@ -196,11 +200,11 @@ export const createJWT = (
 export const createJWTAbilityBuilder = (_config: JWTConfig = {}) => {
 	return async (user?: User) => {
 		// If user has direct permissions in JWT, use those
-		const jwtPermissions = (user as any)?.permissions
+		const jwtPermissions: unknown = user?.permissions
 
 		if (jwtPermissions && Array.isArray(jwtPermissions)) {
 			// Build ability from JWT permissions
-			const { can, cannot, build } = new AbilityBuilder<PureAbility>(PureAbility as any)
+			const { can, cannot, build } = new AbilityBuilder<PureAbility>(PureAbility)
 
 			jwtPermissions.forEach((permission: any) => {
 				if (permission.inverted) {
@@ -304,8 +308,8 @@ export const refreshTokenUtils = {
 		config: {
 			accessSecret: string
 			refreshSecret: string
-			accessExpiresIn?: string
-			refreshExpiresIn?: string
+			accessExpiresIn?: jwt.SignOptions['expiresIn']
+			refreshExpiresIn?: jwt.SignOptions['expiresIn']
 		}
 	) => {
 		const { accessSecret, refreshSecret, accessExpiresIn = '15m', refreshExpiresIn = '7d' } = config
@@ -324,7 +328,7 @@ export const refreshTokenUtils = {
 		// Create access token with proper options
 		const accessOptions: jwt.SignOptions = {}
 		if (accessExpiresIn) {
-			accessOptions.expiresIn = accessExpiresIn as any // Type cast to avoid TS issues
+			accessOptions.expiresIn = accessExpiresIn
 		}
 
 		const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions)
@@ -332,7 +336,7 @@ export const refreshTokenUtils = {
 		// Create refresh token with proper options
 		const refreshOptions: jwt.SignOptions = {}
 		if (refreshExpiresIn) {
-			refreshOptions.expiresIn = refreshExpiresIn as any // Type cast to avoid TS issues
+			refreshOptions.expiresIn = refreshExpiresIn
 		}
 
 		const refreshToken = jwt.sign(refreshPayload, refreshSecret, refreshOptions)
@@ -349,20 +353,27 @@ export const refreshTokenUtils = {
 			accessSecret: string
 			refreshSecret: string
 			getUserById: (id: string) => Promise<User | null>
-			accessExpiresIn?: string
+			accessExpiresIn?: jwt.SignOptions['expiresIn']
 		}
 	) => {
 		const { accessSecret, refreshSecret, getUserById, accessExpiresIn = '15m' } = config
 
 		try {
 			// Verify refresh token
-			const payload = jwt.verify(refreshToken, refreshSecret) as any
+			const decoded = jwt.verify(refreshToken, refreshSecret)
+			if (typeof decoded === 'string' || decoded == null) {
+				throw new Error('Invalid refresh token payload: expected object')
+			}
+			const payload = decoded as jwt.JwtPayload & { type?: string; sub?: string }
 
 			if (payload.type !== 'refresh') {
 				throw new Error('Invalid token type')
 			}
 
 			// Get fresh user data
+			if (!payload.sub) {
+				throw new Error('Invalid refresh token payload: missing subject')
+			}
 			const user = await getUserById(payload.sub)
 			if (!user) {
 				throw new Error('User not found')
@@ -378,7 +389,7 @@ export const refreshTokenUtils = {
 			// Create access token with proper options
 			const accessOptions: jwt.SignOptions = {}
 			if (accessExpiresIn) {
-				accessOptions.expiresIn = accessExpiresIn as any // Type cast to avoid TS issues
+				accessOptions.expiresIn = accessExpiresIn
 			}
 
 			const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions)

package/src/middleware/postgraphile.ts

@@ -61,30 +61,26 @@ export const pglCaslPlugin: GraphileConfig.Plugin = extendSchema(build => {
 			Mutation: {
 				plans: {
 					async createAbility(_plan: any, fieldArgs: any) {
-						const $input = fieldArgs.getRaw().input
-						const $userId = $input.userId
-						const $roles = $input.roles
+						const $userId: ExecutableStep = fieldArgs.getRaw().input.userId
+						const $roles: ExecutableStep = fieldArgs.getRaw().input.roles
 
-						return sideEffect(
-							[$userId as ExecutableStep, $roles as ExecutableStep],
-							async ([userId, roles]: readonly [string, string[]]) => {
-								// Make this async
-								try {
-									const ability = await createAbility({ id: userId, roles }) // Await here
-									return {
-										success: true,
-										ability: ability.rules,
-										message: 'Ability created successfully',
-									}
-								} catch (error) {
-									return {
-										success: false,
-										ability: null,
-										message: error instanceof Error ? error.message : 'Unknown error occurred',
-									}
+						return sideEffect([$userId, $roles], async ([userId, roles]: readonly [string, string[]]) => {
+							// Make this async
+							try {
+								const ability = await createAbility({ id: userId, roles }) // Await here
+								return {
+									success: true,
+									ability: ability.rules,
+									message: 'Ability created successfully',
+								}
+							} catch (error) {
+								return {
+									success: false,
+									ability: null,
+									message: error instanceof Error ? error.message : 'Unknown error occurred',
 								}
 							}
-						)
+						})
 					},
 				},
 			},

package/src/middleware/yoga.ts

@@ -1,7 +1,6 @@
 import type { Plugin } from 'graphql-yoga'
 
 import { createAbility } from './ability'
-import { createCaslMiddleware } from './graphql'
 import type { Context, MiddlewareOptions } from '../types'
 
 const getLoggedInUser = () => {
@@ -26,14 +25,12 @@ export const yogaCaslPlugin: Plugin<Context> = {
  * @returns Yoga plugin
  * @public
  */
-export const createYogaPlugin = (options: MiddlewareOptions = {}) => {
-	const _middleware = createCaslMiddleware(options)
-
+export const createYogaPlugin = (_options: MiddlewareOptions = {}) => {
 	return {
 		onExecute: async (_: any) => {
-			// TODO: Implement Yoga plugin
-			// This would integrate with GraphQL Yoga's plugin system
-			console.log('Yoga plugin not yet implemented')
+			// TODO: Implement Yoga plugin via createCaslMiddleware(_options).
+			// This would integrate with GraphQL Yoga's plugin system.
+			console.warn('Yoga plugin not yet implemented')
 		},
 	}
 }

package/src/types/index.ts

@@ -66,7 +66,7 @@ export interface FieldPermission {
  * GraphQL resolver function type
  * @public
  */
-export type ResolverFn = (root: any, args: any, context: Context, info: GraphQLResolveInfo) => Promise<any> | any
+export type ResolverFn = (root: any, args: any, context: Context, info: GraphQLResolveInfo) => any
 
 /**
  * Middleware function that wraps a GraphQL resolver with authorization logic
@@ -78,7 +78,7 @@ export type MiddlewareFn = (
 	args: any,
 	context: Context,
 	info: GraphQLResolveInfo
-) => Promise<any> | any
+) => any
 
 /**
  * Plugin configuration options for framework integrations