@ttoss/http-server-auth 0.2.1 → 0.3.1

package/README.md

@@ -27,8 +27,10 @@ app.use(
     },
 
     apiToken: {
-      lookup: async (tokenHash) => {
-        const record = await ApiTokenModel.findOne({
+      // The second argument is the Koa `ctx`, so the lookup can do
+      // request-scoped work (read `ctx.db`, bump `lastUsedAt`, etc.).
+      lookup: async (tokenHash, ctx) => {
+        const record = await ctx.db.ApiToken.findOne({
           where: { tokenHash, revoked: false },
         });
         if (!record) return null;
@@ -115,7 +117,9 @@ type AuthenticatedUser = {
 1. Reads `Authorization: Bearer <token>`; missing header → 401 if `required`.
 2. If `allowedOrigins` is configured and the `Origin` header doesn't match → 403. Requests without an Origin header are never rejected.
 3. Tries each strategy in `strategies` order; first match wins.
-   - `jwt` — verifies HS256 JWT via `@ttoss/auth-core verifyJwt`; maps `sub`/`email` to user (override with `jwt.mapPayload`).
-   - `apiToken` — hashes the token (SHA-256) and calls `apiToken.lookup(hash)`.
+   - `jwt` — verifies HS256 JWT via `@ttoss/auth-core verifyJwt`; maps `sub`/`email` to user (override with `jwt.mapPayload(payload, ctx)`).
+   - `apiToken` — hashes the token (SHA-256) and calls `apiToken.lookup(hash, ctx)`.
    - `system` — constant-time comparison against `system.secret`.
 4. All strategies fail and `required` → 401. Failure reason is never leaked.
+
+Both `apiToken.lookup` and `jwt.mapPayload` receive the Koa `ctx` as a second argument, enabling request-scoped work (e.g. reading a per-request connection off `ctx.db` or updating `lastUsedAt`). The single-argument signatures keep working — `ctx` is purely additive.

package/dist/index.cjs

@@ -50,13 +50,13 @@ var isOriginAllowed = (origin, allowedOrigins) => {
 
 //#endregion
 //#region src/authMiddleware.ts
-var tryJwt = (token, opts) => {
+var tryJwt = (token, opts, ctx) => {
   const payload = (0, _ttoss_auth_core.verifyJwt)({
     token,
     secret: opts.secret
   });
   if (!payload) return null;
-  if (opts.mapPayload) return opts.mapPayload(payload);
+  if (opts.mapPayload) return opts.mapPayload(payload, ctx);
   return {
     id: String(payload.sub ?? ""),
     ...(payload.email !== void 0 && {
@@ -64,8 +64,8 @@ var tryJwt = (token, opts) => {
     })
   };
 };
-var tryApiToken = async (token, opts) => {
-  return opts.lookup((0, _ttoss_auth_core.hashApiToken)(token));
+var tryApiToken = async (token, opts, ctx) => {
+  return opts.lookup((0, _ttoss_auth_core.hashApiToken)(token), ctx);
 };
 var trySystem = (token, opts) => {
   const a = Buffer.from(token);
@@ -73,10 +73,10 @@ var trySystem = (token, opts) => {
   if (a.length !== b.length || !node_crypto.default.timingSafeEqual(a, b)) return null;
   return opts.user;
 };
-var resolveUser = async (token, options) => {
+var resolveUser = async (token, options, ctx) => {
   for (const strategy of options.strategies) {
     let user = null;
-    if (strategy === "jwt" && options.jwt) user = tryJwt(token, options.jwt);else if (strategy === "apiToken" && options.apiToken) user = await tryApiToken(token, options.apiToken);else if (strategy === "system" && options.system) user = trySystem(token, options.system);
+    if (strategy === "jwt" && options.jwt) user = tryJwt(token, options.jwt, ctx);else if (strategy === "apiToken" && options.apiToken) user = await tryApiToken(token, options.apiToken, ctx);else if (strategy === "system" && options.system) user = trySystem(token, options.system);
     if (user) return {
       user,
       strategy
@@ -102,7 +102,7 @@ var authMiddleware = options => {
       if (required) ctx.throw(401, "Unauthorized");
       return next();
     }
-    const result = await resolveUser(token, options);
+    const result = await resolveUser(token, options, ctx);
     if (!result) {
       if (required) ctx.throw(401, "Unauthorized");
       return next();

package/dist/index.d.cts

@@ -13,15 +13,21 @@ type JwtOptions = {
   /**
    * Override how the JWT payload maps to an AuthenticatedUser.
    * Defaults to `{ id: payload.sub, email: payload.email }`.
+   *
+   * Receives the Koa `ctx` as a second argument so the mapping can do
+   * request-scoped work (e.g. reading from `ctx.db`).
    */
-  mapPayload?: (payload: Record<string, unknown>) => AuthenticatedUser | null;
+  mapPayload?: (payload: Record<string, unknown>, ctx: Context) => AuthenticatedUser | null;
 };
 type ApiTokenOptions = {
   /**
    * Receives the SHA-256 hash of the presented token and returns the
    * authenticated user, or null if not found / revoked.
+   *
+   * Receives the Koa `ctx` as a second argument so the lookup can do
+   * request-scoped work (e.g. bumping `lastUsedAt` or reading `ctx.db`).
    */
-  lookup: (tokenHash: string) => Promise<AuthenticatedUser | null>;
+  lookup: (tokenHash: string, ctx: Context) => Promise<AuthenticatedUser | null>;
 };
 type SystemOptions = {
   secret: string; /** User attached to ctx.state.user for system calls. */

package/dist/index.d.mts

@@ -13,15 +13,21 @@ type JwtOptions = {
   /**
    * Override how the JWT payload maps to an AuthenticatedUser.
    * Defaults to `{ id: payload.sub, email: payload.email }`.
+   *
+   * Receives the Koa `ctx` as a second argument so the mapping can do
+   * request-scoped work (e.g. reading from `ctx.db`).
    */
-  mapPayload?: (payload: Record<string, unknown>) => AuthenticatedUser | null;
+  mapPayload?: (payload: Record<string, unknown>, ctx: Context) => AuthenticatedUser | null;
 };
 type ApiTokenOptions = {
   /**
    * Receives the SHA-256 hash of the presented token and returns the
    * authenticated user, or null if not found / revoked.
+   *
+   * Receives the Koa `ctx` as a second argument so the lookup can do
+   * request-scoped work (e.g. bumping `lastUsedAt` or reading `ctx.db`).
    */
-  lookup: (tokenHash: string) => Promise<AuthenticatedUser | null>;
+  lookup: (tokenHash: string, ctx: Context) => Promise<AuthenticatedUser | null>;
 };
 type SystemOptions = {
   secret: string; /** User attached to ctx.state.user for system calls. */

package/dist/index.mjs

@@ -19,13 +19,13 @@ var isOriginAllowed = (origin, allowedOrigins) => {
 
 //#endregion
 //#region src/authMiddleware.ts
-var tryJwt = (token, opts) => {
+var tryJwt = (token, opts, ctx) => {
   const payload = verifyJwt({
     token,
     secret: opts.secret
   });
   if (!payload) return null;
-  if (opts.mapPayload) return opts.mapPayload(payload);
+  if (opts.mapPayload) return opts.mapPayload(payload, ctx);
   return {
     id: String(payload.sub ?? ""),
     ...(payload.email !== void 0 && {
@@ -33,8 +33,8 @@ var tryJwt = (token, opts) => {
     })
   };
 };
-var tryApiToken = async (token, opts) => {
-  return opts.lookup(hashApiToken(token));
+var tryApiToken = async (token, opts, ctx) => {
+  return opts.lookup(hashApiToken(token), ctx);
 };
 var trySystem = (token, opts) => {
   const a = Buffer.from(token);
@@ -42,10 +42,10 @@ var trySystem = (token, opts) => {
   if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return null;
   return opts.user;
 };
-var resolveUser = async (token, options) => {
+var resolveUser = async (token, options, ctx) => {
   for (const strategy of options.strategies) {
     let user = null;
-    if (strategy === "jwt" && options.jwt) user = tryJwt(token, options.jwt);else if (strategy === "apiToken" && options.apiToken) user = await tryApiToken(token, options.apiToken);else if (strategy === "system" && options.system) user = trySystem(token, options.system);
+    if (strategy === "jwt" && options.jwt) user = tryJwt(token, options.jwt, ctx);else if (strategy === "apiToken" && options.apiToken) user = await tryApiToken(token, options.apiToken, ctx);else if (strategy === "system" && options.system) user = trySystem(token, options.system);
     if (user) return {
       user,
       strategy
@@ -71,7 +71,7 @@ var authMiddleware = options => {
       if (required) ctx.throw(401, "Unauthorized");
       return next();
     }
-    const result = await resolveUser(token, options);
+    const result = await resolveUser(token, options, ctx);
     if (!result) {
       if (required) ctx.throw(401, "Unauthorized");
       return next();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-auth",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Authentication middleware for @ttoss/http-server",
   "keywords": [
     "auth",
@@ -32,7 +32,7 @@
     "dist"
   ],
   "dependencies": {
-    "@ttoss/auth-core": "^0.6.0"
+    "@ttoss/auth-core": "^0.6.1"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",
@@ -40,10 +40,10 @@
     "supertest": "^7.2.2",
     "tsdown": "^0.22.2",
     "@ttoss/config": "^1.37.17",
-    "@ttoss/http-server": "^0.6.1"
+    "@ttoss/http-server": "^0.7.0"
   },
   "peerDependencies": {
-    "@ttoss/http-server": "^0.6.1"
+    "@ttoss/http-server": "^0.7.0"
   },
   "publishConfig": {
     "access": "public",