dms-middleware-auth 1.1.2 → 1.1.4

package/dist/auth.middleware.d.ts

@@ -21,6 +21,7 @@ export declare class AuthMiddleware implements NestMiddleware, OnModuleInit {
     private static shutdownInitiated;
     private static readonly licenceExpiredMessage;
     private static readonly CLOCK_TOLERANCE_MS;
+    private static readonly MAX_INT32;
     private readonly logger;
     constructor(cacheManager: Cache, options: AuthMiddlewareOptions);
     onModuleInit(): Promise<void>;

package/dist/auth.middleware.js

@@ -90,7 +90,9 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             if (!clientToken) {
                 clientToken = await this.clientLogin();
                 const decodedToken = jwt.decode(clientToken);
-                const ttl = (decodedToken.exp - Math.floor(Date.now() / 1000)) * 1000;
+                const ttlRaw = (decodedToken.exp - Math.floor(Date.now() / 1000)) * 1000;
+                const ttl = Math.min(Math.max(0, ttlRaw), AuthMiddleware_1.MAX_INT32);
+                console.error(`[AuthMiddleware] Client Token TTL: ${ttl}ms (Capped from ${ttlRaw})`);
                 await this.cacheManager.set('client_access_token', clientToken, ttl);
             }
             // Cache client role attributes
@@ -232,10 +234,10 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         try {
             const token = await this.verifyJwt(lic_data, publicKey);
             const licEndMs = this.normalizeEpochMs(token?.lic_end);
-            // Reject when licence end (epoch) is missing or already in the past (with tolerance).
             const now = this.getUtcNowMs();
+            // Reject when licence end (epoch) is missing or already in the past (with tolerance).
             if (!licEndMs || (licEndMs + AuthMiddleware_1.CLOCK_TOLERANCE_MS) <= now) {
-                this.logger.error(`Licence expired. Expiry: ${new Date(licEndMs || 0).toISOString()}, Server Time: ${new Date(now).toISOString()}`);
+                console.error(`[AUTH-ERROR] Licence expired. Expiry: ${new Date(licEndMs || 0).toISOString()}, Now: ${new Date(now).toISOString()}`);
                 this.markLicenceExpired();
                 return { status: false };
             }
@@ -243,7 +245,9 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             AuthMiddleware_1.licenceValidatedUntilMs = licEndMs;
             this.scheduleLicenceShutdown(licEndMs);
             if (updateCache) {
-                const ttl = (licEndMs - this.getUtcNowMs()) > 0 ? (licEndMs - this.getUtcNowMs()) : null;
+                const calculatedTtl = licEndMs - now;
+                const ttl = Math.min(Math.max(0, calculatedTtl), AuthMiddleware_1.MAX_INT32);
+                console.error(`[AuthMiddleware] Licence Cache TTL: ${ttl}ms (Capped from ${calculatedTtl})`);
                 await this.cacheManager.set('client_Licence_token', lic_data, ttl);
             }
             return {
@@ -251,7 +255,13 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             };
         }
         catch (error) {
-            this.markLicenceExpired();
+            if (error.name === 'JsonWebTokenError' || error.name === 'TokenExpiredError') {
+                this.logger.error(`Invalid Licence Token: ${error.message}`);
+                this.markLicenceExpired();
+            }
+            else {
+                this.logger.warn(`Transient error during licence validation: ${error.message}`);
+            }
             return { status: false };
         }
     }
@@ -267,25 +277,21 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
         const now = this.getUtcNowMs();
         const delay = (licEndMs + AuthMiddleware_1.CLOCK_TOLERANCE_MS) - now;
         if (delay <= 0) {
-            this.logger.warn('Licence expired immediately (including tolerance).');
+            console.error('[AUTH-WARN] Licence expired immediately (including tolerance).');
             this.markLicenceExpired();
             return;
         }
         if (AuthMiddleware_1.licenceExpiryTimer) {
             clearTimeout(AuthMiddleware_1.licenceExpiryTimer);
         }
-        // setTimeout uses a 32-bit signed integer. Max value is 2147483647 ms (approx 24.8 days).
-        // If the delay is larger than this, setTimeout will fire immediately (overflow).
-        // so we cap the delay and re-check when it fires.
-        const MAX_TIMEOUT_VAL = 2147483647;
-        const safeDelay = Math.min(delay, MAX_TIMEOUT_VAL);
+        const safeDelay = Math.min(delay, AuthMiddleware_1.MAX_INT32);
+        console.error(`[AuthMiddleware] Expiry timer set: ${safeDelay}ms (Full delay: ${delay}ms)`);
         AuthMiddleware_1.licenceExpiryTimer = setTimeout(() => {
             const remaining = (licEndMs + AuthMiddleware_1.CLOCK_TOLERANCE_MS) - this.getUtcNowMs();
             if (remaining <= 0) {
                 this.markLicenceExpired();
             }
             else {
-                // Reschedule if we still have time left
                 this.scheduleLicenceShutdown(licEndMs);
             }
         }, safeDelay);
@@ -295,6 +301,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
             return;
         }
         AuthMiddleware_1.shutdownInitiated = true;
+        console.error(`[AUTH-DEBUG] setTimeout(stopServer) delay: 0`);
         setTimeout(() => {
             try {
                 process.kill(process.pid, 'SIGTERM');
@@ -303,6 +310,7 @@ let AuthMiddleware = AuthMiddleware_1 = class AuthMiddleware {
                 process.exit(1);
             }
             if (!AuthMiddleware_1.shutdownTimer) {
+                console.error(`[AUTH-DEBUG] setTimeout(shutdownTimer) delay: 5000`);
                 AuthMiddleware_1.shutdownTimer = setTimeout(() => {
                     process.exit(1);
                 }, 5000);
@@ -349,6 +357,7 @@ AuthMiddleware.licenceValidationPromise = null;
 AuthMiddleware.shutdownInitiated = false;
 AuthMiddleware.licenceExpiredMessage = "server Licence is expired!. please renew";
 AuthMiddleware.CLOCK_TOLERANCE_MS = 60000; // 1 minute grace period
+AuthMiddleware.MAX_INT32 = 2147483647;
 exports.AuthMiddleware = AuthMiddleware = AuthMiddleware_1 = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(cache_manager_1.CACHE_MANAGER)),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dms-middleware-auth",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Reusable middleware for authentication and authorization in NestJS applications.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -25,8 +25,9 @@
     "@types/express": "^5.0.0",
     "@types/jest": "^29.5.14",
     "@types/jsonwebtoken": "^9.0.7",
+    "@types/node-forge": "^1.3.14",
     "jest": "^29.7.0",
     "ts-jest": "^29.3.4",
     "typescript": "^5.7.2"
   }
-}
+}

package/src/auth.middleware.ts

@@ -26,6 +26,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
   private static shutdownInitiated = false;
   private static readonly licenceExpiredMessage = "server Licence is expired!. please renew";
   private static readonly CLOCK_TOLERANCE_MS = 60000; // 1 minute grace period
+  private static readonly MAX_INT32 = 2147483647;
   private readonly logger = new Logger('AuthMiddleware');
 
   constructor(
@@ -72,7 +73,9 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       if (!clientToken) {
         clientToken = await this.clientLogin();
         const decodedToken: any = jwt.decode(clientToken);
-        const ttl = (decodedToken.exp - Math.floor(Date.now() / 1000)) * 1000;
+        const ttlRaw = (decodedToken.exp - Math.floor(Date.now() / 1000)) * 1000;
+        const ttl = Math.min(Math.max(0, ttlRaw), AuthMiddleware.MAX_INT32);
+        console.error(`[AuthMiddleware] Client Token TTL: ${ttl}ms (Capped from ${ttlRaw})`);
         await this.cacheManager.set('client_access_token', clientToken, ttl);
       }
 
@@ -229,11 +232,11 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     try {
       const token: any = await this.verifyJwt(lic_data, publicKey);
       const licEndMs = this.normalizeEpochMs(token?.lic_end);
+      const now = this.getUtcNowMs();
 
       // Reject when licence end (epoch) is missing or already in the past (with tolerance).
-      const now = this.getUtcNowMs();
       if (!licEndMs || (licEndMs + AuthMiddleware.CLOCK_TOLERANCE_MS) <= now) {
-        this.logger.error(`Licence expired. Expiry: ${new Date(licEndMs || 0).toISOString()}, Server Time: ${new Date(now).toISOString()}`);
+        console.error(`[AUTH-ERROR] Licence expired. Expiry: ${new Date(licEndMs || 0).toISOString()}, Now: ${new Date(now).toISOString()}`);
         this.markLicenceExpired();
         return { status: false };
       }
@@ -243,16 +246,22 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       this.scheduleLicenceShutdown(licEndMs);
 
       if (updateCache) {
-        const ttl: any = (licEndMs - this.getUtcNowMs()) > 0 ? (licEndMs - this.getUtcNowMs()) : null
+        const calculatedTtl = licEndMs - now;
+        const ttl = Math.min(Math.max(0, calculatedTtl), AuthMiddleware.MAX_INT32);
+        console.error(`[AuthMiddleware] Licence Cache TTL: ${ttl}ms (Capped from ${calculatedTtl})`);
         await this.cacheManager.set('client_Licence_token', lic_data, ttl);
       }
 
       return {
         status: true,
-
       };
     } catch (error: any) {
-      this.markLicenceExpired();
+      if (error.name === 'JsonWebTokenError' || error.name === 'TokenExpiredError') {
+        this.logger.error(`Invalid Licence Token: ${error.message}`);
+        this.markLicenceExpired();
+      } else {
+        this.logger.warn(`Transient error during licence validation: ${error.message}`);
+      }
       return { status: false };
     }
   }
@@ -271,7 +280,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
     const delay = (licEndMs + AuthMiddleware.CLOCK_TOLERANCE_MS) - now;
 
     if (delay <= 0) {
-      this.logger.warn('Licence expired immediately (including tolerance).');
+      console.error('[AUTH-WARN] Licence expired immediately (including tolerance).');
       this.markLicenceExpired();
       return;
     }
@@ -280,18 +289,14 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       clearTimeout(AuthMiddleware.licenceExpiryTimer);
     }
 
-    // setTimeout uses a 32-bit signed integer. Max value is 2147483647 ms (approx 24.8 days).
-    // If the delay is larger than this, setTimeout will fire immediately (overflow).
-    // so we cap the delay and re-check when it fires.
-    const MAX_TIMEOUT_VAL = 2147483647;
-    const safeDelay = Math.min(delay, MAX_TIMEOUT_VAL);
+    const safeDelay = Math.min(delay, AuthMiddleware.MAX_INT32);
+    console.error(`[AuthMiddleware] Expiry timer set: ${safeDelay}ms (Full delay: ${delay}ms)`);
 
     AuthMiddleware.licenceExpiryTimer = setTimeout(() => {
       const remaining = (licEndMs + AuthMiddleware.CLOCK_TOLERANCE_MS) - this.getUtcNowMs();
       if (remaining <= 0) {
         this.markLicenceExpired();
       } else {
-        // Reschedule if we still have time left
         this.scheduleLicenceShutdown(licEndMs);
       }
     }, safeDelay);
@@ -302,6 +307,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
       return;
     }
     AuthMiddleware.shutdownInitiated = true;
+    console.error(`[AUTH-DEBUG] setTimeout(stopServer) delay: 0`);
     setTimeout(() => {
       try {
         process.kill(process.pid, 'SIGTERM');
@@ -309,6 +315,7 @@ export class AuthMiddleware implements NestMiddleware, OnModuleInit {
         process.exit(1);
       }
       if (!AuthMiddleware.shutdownTimer) {
+        console.error(`[AUTH-DEBUG] setTimeout(shutdownTimer) delay: 5000`);
         AuthMiddleware.shutdownTimer = setTimeout(() => {
           process.exit(1);
         }, 5000);

package/test_specific_date.ts

@@ -0,0 +1,76 @@
+
+import { AuthMiddleware } from './src/auth.middleware';
+import * as jwt from 'jsonwebtoken';
+import * as crypto from 'crypto';
+
+async function runTest() {
+    console.log("--- Starting Thorough Test for Date 1774981740000 ---");
+
+    // 1. Setup Mocks
+    const mockCache = {
+        get: async (key: string) => undefined,
+        set: async (key: string, val: any, ttl: any) => {
+            console.log(`[MockCache] set key=${key}, ttl=${ttl}`);
+        },
+    } as any;
+
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+    });
+
+    let publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }) as string;
+    // Strip headers as AuthMiddleware adds them
+    const publicKeyBody = publicKeyPem
+        .replace('-----BEGIN PUBLIC KEY-----\n', '')
+        .replace('\n-----END PUBLIC KEY-----\n', '');
+
+    const mockOptions = {
+        publicKey: publicKeyBody,
+        keycloakUrl: 'http://localhost:8080',
+        realm: 'test-realm',
+        clientId: 'test-client',
+        clientSecret: 'secret',
+        clientUuid: 'uuid',
+        bypassURL: '/health',
+    };
+
+    const authMiddleware = new AuthMiddleware(mockCache, mockOptions);
+
+    // 2. Create Token with specific date
+    const licEnd = 1774981740000;
+    const payload = {
+        lic_end: licEnd
+    };
+
+    const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' }) as string;
+    const token = jwt.sign(payload, privateKeyPem, { algorithm: 'RS256', noTimestamp: true });
+
+    console.log(`Test Token: ${token}`);
+    console.log(`Current Time (Date.now()): ${Date.now()}`);
+    console.log(`User's Date to test: ${licEnd}`);
+
+    // 3. Run Validation
+    console.log("\n--- Calling validateLicence ---");
+    // We can access private methods using any cast for testing
+    const result = await (authMiddleware as any).validateLicence(token, publicKeyBody, true);
+
+    console.log(`\nResult Status: ${result.status}`);
+
+    if (result.status) {
+        console.log("SUCCESS: Middleware accepted the future date.");
+    } else {
+        console.error("FAILURE: Middleware rejected the future date.");
+    }
+
+    // 4. Check if expired flag was set
+    const isExpired = (AuthMiddleware as any).licenceExpired;
+    console.log(`AuthMiddleware.licenceExpired: ${isExpired}`);
+
+    // 5. Cleanup Timer
+    if ((AuthMiddleware as any).licenceExpiryTimer) {
+        console.log("Clearing expiry timer...");
+        clearTimeout((AuthMiddleware as any).licenceExpiryTimer);
+    }
+}
+
+runTest().catch(console.error);

package/test_ttl_overflow.ts

@@ -0,0 +1,31 @@
+
+import { caching } from 'cache-manager';
+
+async function testTTL() {
+    console.log("--- Testing Cache TTL Overflow ---");
+    const cache = await caching('memory');
+
+    const largeTTL = 4351255821; // ~50 days in ms
+    console.log(`Setting key with TTL: ${largeTTL}ms`);
+
+    await cache.set('test_key', 'test_value', largeTTL);
+
+    const val = await cache.get('test_key');
+    console.log(`Immediate get: ${val}`);
+
+    if (!val) {
+        console.error("FAIL: Value expired immediately!");
+    } else {
+        console.log("Value still present. Waiting 2s to check again...");
+        await new Promise(resolve => setTimeout(resolve, 2000));
+        const val2 = await cache.get('test_key');
+        console.log(`After 2s get: ${val2}`);
+        if (!val2) {
+            console.error("FAIL: Value expired after 2s (likely overflow)!");
+        } else {
+            console.log("SUCCESS: Cache handles large TTL.");
+        }
+    }
+}
+
+testTTL().catch(console.error);