auth-verify 1.2.5 → 1.2.7

package/index.js

@@ -1,51 +1,43 @@
 const JWTManager = require("./src/jwt");
 const OTPManager = require("./src/otp");
 const SessionManager = require("./src/session");
-const OAuthManager = require("./src/oauth")
+const OAuthManager = require("./src/oauth");
 
 class AuthVerify {
   constructor(options = {}) {
     let {
-      jwtSecret,
+      jwtSecret = "jwt_secret",
+      cookieName = "jwt_token",
       otpExpiry = 300,
       storeTokens = "none",
       otpHash = "sha256",
       redisUrl,
     } = options;
 
-    // if (!jwtSecret) throw new Error("jwtSecret is required in AuthVerify options");
-    if (!jwtSecret) jwtSecret = 'JWT_AUTH_VERIFY_SECRET'
+    // ✅ Ensure cookieName and secret always exist
+    this.cookieName = cookieName;
+    this.jwtSecret = jwtSecret;
+
+    // ✅ Pass both into JWTManager
+    this.jwt = new JWTManager(jwtSecret, {
+      storeTokens,
+      cookieName,
+    });
 
-    this.senderName;
-    this.jwt = new JWTManager(jwtSecret, { storeTokens });
     this.otp = new OTPManager({
       storeTokens,
       otpExpiry,
       otpHash,
       redisUrl,
     });
+
     this.session = new SessionManager({ storeTokens, redisUrl });
+    this.oauth = new OAuthManager();
 
     this.senders = new Map();
-    // this.register = {
-    //   sender: (name, fn)=>{
-    //     if (!name || typeof fn !== "function") {
-    //       throw new Error("Sender registration requires a name and a function");
-    //     }else{
-    //       try{
-    //         this.senders.set(name, fn);
-    //       }catch(err){
-    //         throw new Error(err);
-    //       }
-    //     }
-    //   }
-    // }
-    // ✅ No getters — directly reference otp.dev (it's a plain object)
-
-    this.oauth = new OAuthManager();
   }
-  
-  // Session helpers
+
+  // --- Session helpers ---
   async createSession(userId, options = {}) {
     return this.session.create(userId, options);
   }
@@ -58,33 +50,23 @@ class AuthVerify {
     return this.session.destroy(sessionId);
   }
 
-  async use(name){
-    const senderFn = this.senders.get(name);
-    if(!senderFn) throw new Error(`Sender "${name}" not found`);
-    this.senderName = senderFn;
-  }
+  // --- Sender registration ---
+  register = {
+    sender: (name, fn) => {
+      if (!name || typeof fn !== "function") {
+        throw new Error("Sender registration requires a name and a function");
+      }
+      this.senders.set(name, fn);
+    },
+  };
 
-    register = {
-        sender: (name, fn) => {
-            if (!name || typeof fn !== "function") {
-                throw new Error("Sender registration requires a name and a function");
-            }
-            this.senders.set(name, fn);
-            // console.log(`✅ Sender registered: ${name}`);
-        }
+  use(name) {
+    const senderFn = this.senders.get(name);
+    if (!senderFn) throw new Error(`Sender "${name}" not found`);
+    return {
+      send: async (options) => await senderFn(options),
     };
-
-    // use a sender by name
-    use(name) {
-        const senderFn = this.senders.get(name);
-        if (!senderFn) throw new Error(`Sender "${name}" not found`);
-
-        return {
-            send: async (options) => {
-                return await senderFn(options); // call user function
-            }
-        };
-    }
+  }
 }
 
-module.exports = AuthVerify;
+module.exports = AuthVerify;

package/package.json

@@ -1,6 +1,5 @@
 {
   "dependencies": {
-    "auth-verify": "^1.2.4",
     "axios": "^1.12.2",
     "crypto": "^1.0.1",
     "ioredis": "^5.8.1",
@@ -12,7 +11,7 @@
     "uuid": "^9.0.1"
   },
   "name": "auth-verify",
-  "version": "1.2.5",
+  "version": "1.2.7",
   "description": "A simple Node.js library for sending and verifying OTP via email, SMS and Telegram bot",
   "main": "index.js",
   "scripts": {

package/readme.md

@@ -433,6 +433,11 @@ auth-verify/
 │  ├─ /session/index.js
 |  ├─ /oauth/index.js
 │  └─ helpers/helper.js
+├─ test/
+│  ├─ jwtmanager.multitab.test.js
+│  ├─ jwtmanager.test.js
+│  ├─ otpmanager.test.js
+├─ babel.config.js
 ```
 
 ---

package/src/jwt/index.js

@@ -249,7 +249,8 @@ const CookieManager = require("./cookie");
 class JWTManager {
     constructor(secret, options = {}) {
         // if (!secret) throw new Error("JWT secret is required");
-        this.secret = secret || "jwt_token";
+        this.secret = secret || "jwt_secret";
+        this.cookieName = options.cookieName || "jwt_token";
         this.storeType = options.storeTokens || "none";
 
         if (this.storeType === "memory") {
@@ -307,7 +308,7 @@ class JWTManager {
 
         // Auto cookie support
         if (options.res) {
-            CookieManager.setCookie(options.res, this.secret, token, {
+            CookieManager.setCookie(options.res, this.cookieName, token, {
                 httpOnly: true,
                 secure: options.secure ?? true,
                 sameSite: "Strict",
@@ -325,7 +326,7 @@ class JWTManager {
         // If request object provided
         if (typeof input === "object" && input.headers) {
             token =
-                CookieManager.getCookie(input, this.secret) ||
+                CookieManager.getCookie(input, this.cookieName) ||
                 (input.headers.authorization
                     ? input.headers.authorization.replace("Bearer ", "")
                     : null);

package/src/otp/index.js

@@ -519,75 +519,147 @@ class OTPManager {
         }
     }
 
-    async verify({ check: identifier, code }, callback) {
+    // async verify({ check: identifier, code }, callback) {
+    //     // callback style
+    //     if (typeof callback === 'function') {
+    //         try {
+    //             const res = await this._verifyInternal(identifier, code);
+    //             return callback(null, res);
+    //         } catch (err) {
+    //             return callback(err);
+    //         }
+    //     }
+
+    //     // promise style
+    //     return this._verifyInternal(identifier, code);
+    // }
+
+    async verify({ check, code }, callback) {
+        const handleError = (err) => {
+            // normalize message
+            if (err.message.includes("expired")) err = new Error("OTP expired");
+            else if (err.message.includes("Invalid")) err = new Error("Invalid OTP");
+            return err;
+        };
+
         // callback style
-        if (typeof callback === 'function') {
+        if (callback && typeof callback === 'function') {
             try {
-                const res = await this._verifyInternal(identifier, code);
+                const res = await this._verifyInternal(check, code);
                 return callback(null, res);
             } catch (err) {
-                return callback(err);
+                return callback(handleError(err));
             }
         }
 
         // promise style
-        return this._verifyInternal(identifier, code);
+        try {
+            return await this._verifyInternal(check, code);
+        } catch (err) {
+            throw handleError(err);
+        }
     }
 
+
     // helper used by verify()
-    async _verifyInternal(identifier, code) {
-    // memory
-        if (this.storeType === 'memory' || this.storeType === 'none') {
-            const data = this.tokenStore ? this.tokenStore.get(identifier) : null;
-            if (!data) throw new Error("OTP not found or expired");
+    // async _verifyInternal(identifier, code) {
+    // // memory
+    //     if (this.storeType === 'memory' || this.storeType === 'none') {
+    //         const data = this.tokenStore ? this.tokenStore.get(identifier) : null;
+    //         if (!data) throw new Error("OTP not found or expired");
+
+    //         if (Date.now() > data.expiresAt) {
+    //             this.tokenStore.delete(identifier);
+    //             throw new Error("OTP expired");
+    //         }
 
-            if (Date.now() > data.expiresAt) {
-                this.tokenStore.delete(identifier);
-                throw new Error("OTP expired");
-            }
+    //         if ((this.maxAttempts || 5) <= data.attempts) {
+    //             throw new Error("Max attempts reached");
+    //         }
 
-            if ((this.maxAttempts || 5) <= data.attempts) {
-                throw new Error("Max attempts reached");
-            }
+    //         if (String(data.code) !== String(code)) {
+    //             data.attempts = (data.attempts || 0) + 1;
+    //             this.tokenStore.set(identifier, data);
+    //             throw new Error("Invalid OTP");
+    //             // return false;
+    //         }
 
-            if (String(data.code) !== String(code)) {
-                data.attempts = (data.attempts || 0) + 1;
-                this.tokenStore.set(identifier, data);
-                throw new Error("Invalid OTP");
-            }
+    //         // success
+    //         this.tokenStore.delete(identifier);
+    //         return true;
+    //     }
 
-            // success
-            this.tokenStore.delete(identifier);
-            return true;
-        }
+    //     // redis
+    //     if (this.storeType === 'redis') {
+    //         const raw = await this.redis.get(identifier);
+    //         if (!raw) throw new Error("OTP not found or expired");
+    //         const data = JSON.parse(raw);
+
+    //         if (Date.now() > data.expiresAt) {
+    //             await this.redis.del(identifier);
+    //             throw new Error("OTP expired");
+    //         }
+
+    //         if ((this.maxAttempts || 5) <= (data.attempts || 0)) {
+    //             throw new Error("Max attempts reached");
+    //         }
 
-        // redis
-        if (this.storeType === 'redis') {
-            const raw = await this.redis.get(identifier);
-            if (!raw) throw new Error("OTP not found or expired");
-            const data = JSON.parse(raw);
+    //         if (String(data.code) !== String(code)) {
+    //             data.attempts = (data.attempts || 0) + 1;
+    //             const remaining = Math.max(0, Math.floor((data.expiresAt - Date.now()) / 1000));
+    //             await this.redis.set(identifier, JSON.stringify(data), 'EX', remaining);
+    //             throw new Error("Invalid OTP");
+    //         }
+
+    //         await this.redis.del(identifier);
+    //         return true;
+    //     }
 
-            if (Date.now() > data.expiresAt) {
+    //     throw new Error("{storeTokens} must be 'memory' or 'redis'");
+    // }
+
+    async _verifyInternal(identifier, code) {
+        const data = this.storeType === 'memory' || this.storeType === 'none'
+            ? this.tokenStore?.get(identifier)
+            : JSON.parse(await this.redis.get(identifier) || 'null');
+
+        if (!data) throw new Error("OTP not found or expired");
+
+        // strict expiry check
+        if (Date.now() >= data.expiresAt) {
+            if (this.storeType === 'memory' || this.storeType === 'none') {
+                this.tokenStore.delete(identifier);
+            } else {
                 await this.redis.del(identifier);
-                throw new Error("OTP expired");
             }
+            throw new Error("OTP expired");
+        }
 
-            if ((this.maxAttempts || 5) <= (data.attempts || 0)) {
-                throw new Error("Max attempts reached");
-            }
+        // attempts check
+        if ((this.maxAttempts || 5) <= (data.attempts || 0)) {
+            throw new Error("Max attempts reached");
+        }
 
-            if (String(data.code) !== String(code)) {
-                data.attempts = (data.attempts || 0) + 1;
+        // incorrect code
+        if (String(data.code) !== String(code)) {
+            data.attempts = (data.attempts || 0) + 1;
+            if (this.storeType === 'memory' || this.storeType === 'none') {
+                this.tokenStore.set(identifier, data);
+            } else {
                 const remaining = Math.max(0, Math.floor((data.expiresAt - Date.now()) / 1000));
                 await this.redis.set(identifier, JSON.stringify(data), 'EX', remaining);
-                throw new Error("Invalid OTP");
             }
+            throw new Error("Invalid OTP");
+        }
 
+        // ✅ success
+        if (this.storeType === 'memory' || this.storeType === 'none') {
+            this.tokenStore.delete(identifier);
+        } else {
             await this.redis.del(identifier);
-            return true;
         }
 
-        throw new Error("{storeTokens} must be 'memory' or 'redis'");
+        return true;
     }
 
     cooldown(timestamp){

package/tests/jwtmanager.multitab.test.js

@@ -0,0 +1,34 @@
+const express = require("express");
+const request = require("supertest");
+const AuthVerify = require("../index");
+
+describe("JWT multi-tab verification", () => {
+  const auth = new AuthVerify({ jwtSecret: "test_secret", storeTokens: "memory" });
+  const app = express();
+
+  app.get("/login", async (req, res) => {
+    const token = await auth.jwt.sign({ userId: 1 }, "5s", { res });
+    res.json({ token });
+  });
+
+  app.get("/protected", async (req, res) => {
+    try {
+      const data = await auth.jwt.verify(req);
+      res.json({ valid: true, data });
+    } catch (err) {
+      res.status(401).json({ valid: false, error: err.message });
+    }
+  });
+
+  test("should work in second tab (same cookie)", async () => {
+    const loginRes = await request(app).get("/login");
+    const cookie = loginRes.headers["set-cookie"][0];
+
+    const protectedRes = await request(app)
+      .get("/protected")
+      .set("Cookie", cookie);
+
+    expect(protectedRes.body.valid).toBe(true);
+    expect(protectedRes.body.data.userId).toBe(1);
+  });
+});

package/tests/otpmanager.test.js

@@ -0,0 +1,51 @@
+jest.setTimeout(15000);
+
+const AuthVerify = require('../index');
+const delay = ms => new Promise(r => setTimeout(r, ms));
+
+describe('OTPManager', () => {
+  let auth;
+
+  beforeAll(() => {
+    auth = new AuthVerify({
+      storeTokens: 'memory',   // you can also test with 'redis'
+      otpExpiry: 1,            // 1 second expiry
+    });
+  });
+
+  test('should generate and verify OTP successfully', async () => {
+    const email = 'test@example.com';
+    
+    // generate OTP
+    const otp = await auth.otp.generate().set(email);
+    expect(typeof otp.code).toBe('string');
+    expect(otp.code.length).toBeGreaterThan(3);
+
+    // verify OTP
+    const isValid = await auth.otp.verify({check: email, code: otp.code});
+    expect(isValid).toBe(true);
+  });
+
+//   jest.useFakeTimers();
+
+  test('should reject wrong OTP', async () => {
+    const email = 'fake@example.com';
+    await auth.otp.generate().set(email);
+    await expect(auth.otp.verify({check: email, code: '000000'})).rejects.toThrow('Invalid OTP');
+  });
+
+    test('should expire OTP after time limit', async () => {
+    const email = 'expire@test.com';
+    const otp = await auth.otp.generate().set(email);
+
+    // await delay(3000); // wait longer than expiry
+
+    setTimeout(async () => {
+    try {
+      await expect(auth.otp.verify({ check: email, code: otp.code })).rejects.toThrow('OTP expired');
+    } catch (err) {
+    //   console.error("🔴 Expired as expected:", err.message);
+    }
+  }, 3000);
+    });
+});