dms-middleware-auth 1.1.2 → 1.1.3

package/dist/auth.middleware.js

@@ -232,8 +232,8 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         try {
             const token = await this.verifyJwt(lic_data, publicKey);
             const licEndMs = this.normalizeEpochMs(token?.lic_end);
-            // Reject when licence end (epoch) is missing or already in the past (with tolerance).
             const now = this.getUtcNowMs();
+            // Reject when licence end (epoch) is missing or already in the past (with tolerance).
             if (!licEndMs || (licEndMs + AuthMiddleware_1.CLOCK_TOLERANCE_MS) <= now) {
                 this.logger.error(`Licence expired. Expiry: ${new Date(licEndMs || 0).toISOString()}, Server Time: ${new Date(now).toISOString()}`);
                 this.markLicenceExpired();
@@ -243,7 +243,10 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             AuthMiddleware_1.licenceValidatedUntilMs = licEndMs;
             this.scheduleLicenceShutdown(licEndMs);
             if (updateCache) {
-                const ttl = (licEndMs - this.getUtcNowMs()) > 0 ? (licEndMs - this.getUtcNowMs()) : null;
+                // Cap TTL to avoid timeout overflow in cache managers (32-bit signed int max is ~24.8 days)
+                const MAX_TTL = 2147483647;
+                const calculatedTtl = licEndMs - now;
+                const ttl = Math.min(Math.max(0, calculatedTtl), MAX_TTL);
                 await this.cacheManager.set('client_Licence_token', lic_data, ttl);
             }
             return {
@@ -251,7 +254,13 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             };
         }
         catch (error) {
-            this.markLicenceExpired();
+            if (error.name === 'JsonWebTokenError' || error.name === 'TokenExpiredError') {
+                this.logger.error(`Invalid Licence Token: ${error.message}`);
+                this.markLicenceExpired();
+            }
+            else {
+                this.logger.warn(`Transient error during licence validation: ${error.message}`);
+            }
             return { status: false };
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dms-middleware-auth",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Reusable middleware for authentication and authorization in NestJS applications.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -25,8 +25,9 @@
     "@types/express": "^5.0.0",
     "@types/jest": "^29.5.14",
     "@types/jsonwebtoken": "^9.0.7",
+    "@types/node-forge": "^1.3.14",
     "jest": "^29.7.0",
     "ts-jest": "^29.3.4",
     "typescript": "^5.7.2"
   }
-}
+}

package/src/auth.middleware.ts

@@ -229,9 +229,9 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     try {
       const token: any = await this.verifyJwt(lic_data, publicKey);
       const licEndMs = this.normalizeEpochMs(token?.lic_end);
+      const now = this.getUtcNowMs();
 
       // Reject when licence end (epoch) is missing or already in the past (with tolerance).
-      const now = this.getUtcNowMs();
       if (!licEndMs || (licEndMs + AuthMiddleware.CLOCK_TOLERANCE_MS) <= now) {
         this.logger.error(`Licence expired. Expiry: ${new Date(licEndMs || 0).toISOString()}, Server Time: ${new Date(now).toISOString()}`);
         this.markLicenceExpired();
@@ -243,16 +243,23 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       this.scheduleLicenceShutdown(licEndMs);
 
       if (updateCache) {
-        const ttl: any = (licEndMs - this.getUtcNowMs()) > 0 ? (licEndMs - this.getUtcNowMs()) : null
+        // Cap TTL to avoid timeout overflow in cache managers (32-bit signed int max is ~24.8 days)
+        const MAX_TTL = 2147483647;
+        const calculatedTtl = licEndMs - now;
+        const ttl = Math.min(Math.max(0, calculatedTtl), MAX_TTL);
         await this.cacheManager.set('client_Licence_token', lic_data, ttl);
       }
 
       return {
         status: true,
-
       };
     } catch (error: any) {
-      this.markLicenceExpired();
+      if (error.name === 'JsonWebTokenError' || error.name === 'TokenExpiredError') {
+        this.logger.error(`Invalid Licence Token: ${error.message}`);
+        this.markLicenceExpired();
+      } else {
+        this.logger.warn(`Transient error during licence validation: ${error.message}`);
+      }
       return { status: false };
     }
   }

package/test_specific_date.ts

@@ -0,0 +1,76 @@
+
+import { AuthMiddleware } from './src/auth.middleware';
+import * as jwt from 'jsonwebtoken';
+import * as crypto from 'crypto';
+
+async function runTest() {
+    console.log("--- Starting Thorough Test for Date 1774981740000 ---");
+
+    // 1. Setup Mocks
+    const mockCache = {
+        get: async (key: string) => undefined,
+        set: async (key: string, val: any, ttl: any) => {
+            console.log(`[MockCache] set key=${key}, ttl=${ttl}`);
+        },
+    } as any;
+
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+    });
+
+    let publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }) as string;
+    // Strip headers as AuthMiddleware adds them
+    const publicKeyBody = publicKeyPem
+        .replace('-----BEGIN PUBLIC KEY-----\n', '')
+        .replace('\n-----END PUBLIC KEY-----\n', '');
+
+    const mockOptions = {
+        publicKey: publicKeyBody,
+        keycloakUrl: 'http://localhost:8080',
+        realm: 'test-realm',
+        clientId: 'test-client',
+        clientSecret: 'secret',
+        clientUuid: 'uuid',
+        bypassURL: '/health',
+    };
+
+    const authMiddleware = new AuthMiddleware(mockCache, mockOptions);
+
+    // 2. Create Token with specific date
+    const licEnd = 1774981740000;
+    const payload = {
+        lic_end: licEnd
+    };
+
+    const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+    const token = jwt.sign(payload, privateKeyPem, { algorithm: 'RS256', noTimestamp: true });
+
+    console.log(`Test Token: ${token}`);
+    console.log(`Current Time (Date.now()): ${Date.now()}`);
+    console.log(`User's Date to test: ${licEnd}`);
+
+    // 3. Run Validation
+    console.log("\n--- Calling validateLicence ---");
+    // We can access private methods using any cast for testing
+    const result = await (authMiddleware as any).validateLicence(token, publicKeyBody, true);
+
+    console.log(`\nResult Status: ${result.status}`);
+
+    if (result.status) {
+        console.log("SUCCESS: Middleware accepted the future date.");
+    } else {
+        console.error("FAILURE: Middleware rejected the future date.");
+    }
+
+    // 4. Check if expired flag was set
+    const isExpired = (AuthMiddleware as any).licenceExpired;
+    console.log(`AuthMiddleware.licenceExpired: ${isExpired}`);
+
+    // 5. Cleanup Timer
+    if ((AuthMiddleware as any).licenceExpiryTimer) {
+        console.log("Clearing expiry timer...");
+        clearTimeout((AuthMiddleware as any).licenceExpiryTimer);
+    }
+}
+
+runTest().catch(console.error);

package/test_ttl_overflow.ts

@@ -0,0 +1,31 @@
+
+import { caching } from 'cache-manager';
+
+async function testTTL() {
+    console.log("--- Testing Cache TTL Overflow ---");
+    const cache = await caching('memory');
+
+    const largeTTL = 4351255821; // ~50 days in ms
+    console.log(`Setting key with TTL: ${largeTTL}ms`);
+
+    await cache.set('test_key', 'test_value', largeTTL);
+
+    const val = await cache.get('test_key');
+    console.log(`Immediate get: ${val}`);
+
+    if (!val) {
+        console.error("FAIL: Value expired immediately!");
+    } else {
+        console.log("Value still present. Waiting 2s to check again...");
+        await new Promise(resolve => setTimeout(resolve, 2000));
+        const val2 = await cache.get('test_key');
+        console.log(`After 2s get: ${val2}`);
+        if (!val2) {
+            console.error("FAIL: Value expired after 2s (likely overflow)!");
+        } else {
+            console.log("SUCCESS: Cache handles large TTL.");
+        }
+    }
+}
+
+testTTL().catch(console.error);