@stonecrop/casl-middleware 0.14.0 → 0.15.0

package/dist/middleware/jwt.js

@@ -1,291 +0,0 @@
-import jwt from 'jsonwebtoken';
-import { AbilityBuilder, PureAbility } from '@casl/ability';
-import { defaultAbilityBuilder } from './ability';
-/**
- * Default user extractor from JWT payload
- */
-const defaultUserExtractor = (payload) => {
-    if (!payload.sub)
-        return undefined;
-    return {
-        id: payload.sub,
-        roles: payload.roles || [],
-        ...payload, // Include any additional claims
-    };
-};
-/**
- * JWT middleware factory for GraphQL servers
- *
- * @example
- * ```typescript
- * // In Nuxt Yoga
- * export default defineNuxtConfig({
- *   yoga: {
- *     middleware: [
- *       createJWTMiddleware({
- *         enabled: true,
- *         secret: process.env.JWT_SECRET,
- *         optional: true // Don't fail if no token
- *       })
- *     ]
- *   }
- * })
- *
- * // In Postgraphile
- * const jwtPlugin = createPostgraphileJWTPlugin({
- *   secret: process.env.JWT_SECRET,
- *   extractUser: (payload) => ({
- *     id: payload.user_id,
- *     roles: payload.user_roles
- *   })
- * })
- * ```
- */
-export const createJWTMiddleware = (config = {}) => {
-    const { enabled = true, secret, publicKey, algorithms = ['HS256'], issuer, audience, headerName = 'authorization', tokenPrefix = 'Bearer ', optional = false, extractUser = defaultUserExtractor, maxAge, } = config;
-    // Validate configuration
-    if (enabled && !secret && !publicKey) {
-        throw new Error('JWT middleware requires either secret or publicKey');
-    }
-    return async (context, next) => {
-        // Skip if JWT is disabled
-        if (!enabled) {
-            return next();
-        }
-        try {
-            // Extract token from request headers
-            const authHeader = context.req?.headers?.get?.(headerName) ||
-                context.request?.headers?.get?.(headerName) ||
-                context.headers?.[headerName];
-            if (!authHeader) {
-                if (optional) {
-                    return next();
-                }
-                throw new Error('No authorization header found');
-            }
-            // Remove token prefix
-            const token = authHeader.startsWith(tokenPrefix) ? authHeader.slice(tokenPrefix.length) : authHeader;
-            // Prepare verification options
-            const verifyOptions = {
-                algorithms,
-                ...(issuer && { issuer }),
-                ...(audience && { audience }),
-                ...(maxAge && { maxAge }),
-            };
-            // Verify and decode token
-            const secretOrPublicKey = publicKey || secret;
-            const payload = jwt.verify(token, secretOrPublicKey, verifyOptions);
-            // Extract user from payload
-            const user = extractUser(payload);
-            if (user) {
-                context.user = user;
-                // Store the raw payload for potential use
-                context.jwtPayload = payload;
-            }
-            // Continue to next middleware
-            return next();
-        }
-        catch (error) {
-            if (optional) {
-                // Log error in development
-                if (process.env.NODE_ENV === 'development') {
-                    console.warn('JWT verification failed (optional):', error.message);
-                }
-                // Continue without user if optional
-                return next();
-            }
-            // Re-throw with more specific error messages
-            if (error.name === 'TokenExpiredError') {
-                throw new Error('Token has expired');
-            }
-            else if (error.name === 'JsonWebTokenError') {
-                throw new Error('Invalid token');
-            }
-            else if (error.name === 'NotBeforeError') {
-                throw new Error('Token not active yet');
-            }
-            throw error;
-        }
-    };
-};
-/**
- * Create a JWT token with user data
- */
-export const createJWT = (user, config) => {
-    const { secret, expiresIn = '1h', issuer, audience, additionalClaims = {} } = config;
-    const payload = {
-        sub: user.id,
-        roles: user.roles || [],
-        ...additionalClaims,
-    };
-    const signOptions = {};
-    // Add optional fields only if they exist
-    if (issuer !== undefined)
-        signOptions.issuer = issuer;
-    if (audience !== undefined)
-        signOptions.audience = audience;
-    if (expiresIn !== undefined)
-        signOptions.expiresIn = expiresIn; // Type cast to avoid TS issues
-    return jwt.sign(payload, secret, signOptions);
-};
-/**
- * Integration with CASL ability builder
- */
-export const createJWTAbilityBuilder = (config = {}) => {
-    return async (user) => {
-        // If user has direct permissions in JWT, use those
-        const jwtPermissions = user?.permissions;
-        if (jwtPermissions && Array.isArray(jwtPermissions)) {
-            // Build ability from JWT permissions
-            const { can, cannot, build } = new AbilityBuilder(PureAbility);
-            jwtPermissions.forEach((permission) => {
-                if (permission.inverted) {
-                    cannot(permission.action, permission.subject, permission.conditions);
-                }
-                else {
-                    can(permission.action, permission.subject, permission.conditions);
-                }
-            });
-            return build();
-        }
-        // Fall back to role-based abilities
-        return defaultAbilityBuilder(user);
-    };
-};
-/**
- * Postgraphile-specific JWT plugin
- */
-export const createPostgraphileJWTPlugin = (config) => {
-    return {
-        name: 'JWTAuthPlugin',
-        version: '1.0.0',
-        // Hook into Postgraphile's context building
-        grafast: {
-            hooks: {
-                async context(ctx, build) {
-                    const middleware = createJWTMiddleware(config);
-                    // Create a simple context object that the middleware can work with
-                    const context = {
-                        req: ctx.req,
-                        headers: ctx.req?.headers,
-                        user: undefined,
-                        jwtPayload: undefined,
-                    };
-                    // Run the JWT middleware
-                    await middleware(context, async () => { });
-                    // Add user to Postgraphile context
-                    if (context.user) {
-                        return { ...ctx, user: context.user, jwtPayload: context.jwtPayload };
-                    }
-                    return ctx;
-                },
-            },
-        },
-    };
-};
-/**
- * Express/Koa middleware for REST endpoints
- */
-export const createHTTPJWTMiddleware = (config) => {
-    const jwtMiddleware = createJWTMiddleware(config);
-    // Express middleware
-    return async (req, res, next) => {
-        const context = {
-            req: {
-                headers: {
-                    get: (name) => req.headers[name],
-                },
-            },
-            headers: req.headers,
-            user: undefined,
-            jwtPayload: undefined,
-        };
-        try {
-            await jwtMiddleware(context, async () => { });
-            req.user = context.user;
-            req.jwtPayload = context.jwtPayload;
-            next();
-        }
-        catch (error) {
-            if (config.optional) {
-                next();
-            }
-            else {
-                res.status(401).json({
-                    error: error.message,
-                    code: 'UNAUTHORIZED',
-                });
-            }
-        }
-    };
-};
-/**
- * Refresh token utilities
- */
-export const refreshTokenUtils = {
-    /**
-     * Create access and refresh tokens
-     */
-    createTokenPair: (user, config) => {
-        const { accessSecret, refreshSecret, accessExpiresIn = '15m', refreshExpiresIn = '7d' } = config;
-        const accessPayload = {
-            sub: user.id,
-            roles: user.roles,
-            type: 'access',
-        };
-        const refreshPayload = {
-            sub: user.id,
-            type: 'refresh',
-        };
-        // Create access token with proper options
-        const accessOptions = {};
-        if (accessExpiresIn) {
-            accessOptions.expiresIn = accessExpiresIn; // Type cast to avoid TS issues
-        }
-        const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions);
-        // Create refresh token with proper options
-        const refreshOptions = {};
-        if (refreshExpiresIn) {
-            refreshOptions.expiresIn = refreshExpiresIn; // Type cast to avoid TS issues
-        }
-        const refreshToken = jwt.sign(refreshPayload, refreshSecret, refreshOptions);
-        return { accessToken, refreshToken };
-    },
-    /**
-     * Verify refresh token and create new access token
-     */
-    refreshAccessToken: async (refreshToken, config) => {
-        const { accessSecret, refreshSecret, getUserById, accessExpiresIn = '15m' } = config;
-        try {
-            // Verify refresh token
-            const payload = jwt.verify(refreshToken, refreshSecret);
-            if (payload.type !== 'refresh') {
-                throw new Error('Invalid token type');
-            }
-            // Get fresh user data
-            const user = await getUserById(payload.sub);
-            if (!user) {
-                throw new Error('User not found');
-            }
-            // Create new access token
-            const accessPayload = {
-                sub: user.id,
-                roles: user.roles,
-                type: 'access',
-            };
-            // Create access token with proper options
-            const accessOptions = {};
-            if (accessExpiresIn) {
-                accessOptions.expiresIn = accessExpiresIn; // Type cast to avoid TS issues
-            }
-            const accessToken = jwt.sign(accessPayload, accessSecret, accessOptions);
-            return { accessToken, user };
-        }
-        catch (error) {
-            if (error.name === 'TokenExpiredError') {
-                throw new Error('Refresh token expired');
-            }
-            throw error;
-        }
-    },
-};

package/dist/middleware/postgraphile.js

@@ -1,80 +0,0 @@
-import { extendSchema, gql } from 'postgraphile/utils';
-import { createAbility } from './ability';
-/**
- * PostGraphile plugin for CASL authorization
- * @public
- */
-export const pglCaslPlugin = extendSchema(build => {
-    const { grafast: { constant, object, sideEffect }, } = build;
-    return {
-        typeDefs: gql `
-			input CreateAbilityInput {
-				userId: String!
-				roles: [String!]
-			}
-
-			type AbilityResponse {
-				success: Boolean!
-				ability: JSON
-				message: String
-			}
-
-			type SecretData {
-				id: String!
-				content: String!
-			}
-
-			extend type Query {
-				getSecretData: SecretData
-			}
-
-			extend type Mutation {
-				createAbility(input: CreateAbilityInput!): AbilityResponse!
-			}
-		`,
-        objects: {
-            Query: {
-                plans: {
-                    async getSecretData() {
-                        // TODO: This should be protected by CASL
-                        // const $ability = context<Context>().get('ability')
-                        // if (!$ability.can('read', 'SecretData')) {
-                        // 	throw new Error('Access denied')
-                        // }
-                        return object({
-                            id: constant('123'),
-                            content: constant('This is protected content'),
-                        });
-                    },
-                },
-            },
-            Mutation: {
-                plans: {
-                    async createAbility(_plan, fieldArgs) {
-                        const $input = fieldArgs.getRaw().input;
-                        const $userId = $input.userId;
-                        const $roles = $input.roles;
-                        return sideEffect([$userId, $roles], async ([userId, roles]) => {
-                            // Make this async
-                            try {
-                                const ability = await createAbility({ id: userId, roles }); // Await here
-                                return {
-                                    success: true,
-                                    ability: ability.rules,
-                                    message: 'Ability created successfully',
-                                };
-                            }
-                            catch (error) {
-                                return {
-                                    success: false,
-                                    ability: null,
-                                    message: error instanceof Error ? error.message : 'Unknown error occurred',
-                                };
-                            }
-                        });
-                    },
-                },
-            },
-        },
-    };
-});

package/dist/middleware/yoga.js

@@ -1,32 +0,0 @@
-import { createAbility } from './ability';
-import { createCaslMiddleware } from './graphql';
-const getLoggedInUser = () => {
-    // Mock user for demonstration purposes
-    return { id: '1', roles: ['editor'] };
-};
-export const yogaCaslPlugin = {
-    onContextBuilding: async ({ context, extendContext }) => {
-        // Make this async
-        const user = getLoggedInUser();
-        const ability = await createAbility(user); // Await here
-        extendContext({ ability, user });
-    },
-};
-/**
- * Create a GraphQL Yoga plugin for CASL authorization
- * Note: This is a placeholder for future implementation
- *
- * @param options - CASL middleware configuration options
- * @returns Yoga plugin
- * @public
- */
-export const createYogaPlugin = (options = {}) => {
-    const middleware = createCaslMiddleware(options);
-    return {
-        onExecute: async ({ args }) => {
-            // TODO: Implement Yoga plugin
-            // This would integrate with GraphQL Yoga's plugin system
-            console.log('Yoga plugin not yet implemented');
-        },
-    };
-};

package/dist/src/tsdoc-metadata.json

@@ -1,11 +0,0 @@
-// This file is read by tools that parse documentation comments conforming to the TSDoc standard.
-// It should be published with your NPM package.  It should not be tracked by Git.
-{
-  "tsdocVersion": "0.12",
-  "toolPackages": [
-    {
-      "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.57.0"
-    }
-  ]
-}

package/dist/tests/ability.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ability.test.d.ts.map

package/dist/tests/ability.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ability.test.d.ts","sourceRoot":"","sources":["../../tests/ability.test.ts"],"names":[],"mappings":""}