@uphold/fastify-openapi-router-plugin 1.1.0 → 1.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uphold/fastify-openapi-router-plugin",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "A plugin for Fastify to connect routes with a OpenAPI 3.x specification",
   "main": "./src/index.js",
   "types": "./types/index.d.ts",
@@ -49,7 +49,7 @@
   },
   "dependencies": {
     "@readme/openapi-parser": "^6.0.0",
-    "fastify-plugin": "^4.5.1",
+    "fastify-plugin": "^5.1.0",
     "lodash-es": "^4.17.23",
     "openapi-types": "^12.1.3",
     "p-props": "^6.1.0"

package/src/utils/security.js

@@ -61,9 +61,7 @@ export const verifyScopes = (providedScopes, requiredScopes) => {
   const missingScopes = requiredScopes.filter(requiredScope => {
     const hasMatchingScope = providedScopes.some(providedScope => {
       if (providedScope.endsWith('*')) {
-        const prefixScope = providedScope.match(/(.*)\*$/)[1];
-
-        return requiredScope.startsWith(prefixScope);
+        return requiredScope.startsWith(providedScope.slice(0, -1));
       }
 
       return providedScope === requiredScope;

package/src/utils/security.test.js

@@ -69,6 +69,14 @@ describe('verifyScopes()', () => {
     runTest({ missing: ['transaction:foz'], provided, required: ['transaction:foz'] });
     runTest({ missing: [''], provided, required: [''] });
   });
+
+  it('should verify regular scopes correctly against * suffix with a newline', async () => {
+    const provided = ['user:\n*'];
+
+    runTest({ missing: [], provided, required: ['user:\nfoo'] });
+    runTest({ missing: ['user:foo'], provided, required: ['user:foo'] });
+    runTest({ missing: ['admin:write'], provided, required: ['admin:write'] });
+  });
 });
 
 describe('extractSecuritySchemeValueFromRequest()', () => {