joye-backend-utility 7.3.6 → 8.0.0

package/dist/jwt.js

@@ -7,6 +7,7 @@ const path = require('path');
 const folderPath = path.resolve(`${__dirname}`);
 const JWT_PRIVATE_KEY = fs.readFileSync(`${folderPath}/jwtKeys/jwtRS256.key`, 'utf8');
 const JWT_PUBLIC_KEY = fs.readFileSync(`${folderPath}/jwtKeys/jwtRS256.key.pub`, 'utf8');
+const ALLOWED_JWT_ALGORITHMS = ['RS256'];
 const createToken = async (payload, expiresIn) => {
     const token = jwt.sign(payload, { key: JWT_PRIVATE_KEY.replace(/\\n/gm, '\n'), passphrase: process.env.JWT_SECRET }, {
         expiresIn,
@@ -16,7 +17,12 @@ const createToken = async (payload, expiresIn) => {
 };
 exports.createToken = createToken;
 const jwtVerify = async (token) => new Promise(resolve => {
-    jwt.verify(token, JWT_PUBLIC_KEY.replace(/\\n/gm, '\n'), async (err, decoded) => {
+    var _a;
+    const decodedHeader = jwt.decode(token, { complete: true });
+    if (!((_a = decodedHeader === null || decodedHeader === void 0 ? void 0 : decodedHeader.header) === null || _a === void 0 ? void 0 : _a.alg) || decodedHeader.header.alg === 'none') {
+        return resolve(new Error('Invalid token algorithm'));
+    }
+    jwt.verify(token, JWT_PUBLIC_KEY.replace(/\\n/gm, '\n'), { algorithms: ALLOWED_JWT_ALGORITHMS }, async (err, decoded) => {
         if (err) {
             return resolve(err);
         }

package/dist/redisClient.d.ts

@@ -1,6 +1,15 @@
-import { createClient } from 'redis';
+import { createClient, createCluster } from 'redis';
+/**
+ * Standalone or `node-redis` cluster client. Cluster mode uses `createCluster` + `nodeAddressMap` so slot
+ * topology (internal IPs from MOVED / CLUSTER SLOTS) maps to the Azure TLS hostname — avoids ioredis
+ * MOVED + `natMap` slot-key mismatch that caused “Too many Cluster redirections”.
+ */
+export declare type RedisConnection = Awaited<ReturnType<ReturnType<typeof createClient>['connect']>> | ReturnType<typeof createCluster>;
 declare class RedisClient {
     private static instance;
-    static getInstance(): Promise<ReturnType<typeof createClient>>;
+    /** Ensures concurrent `getInstance()` share one in-flight connect (avoids duplicate clients / flaky MOVED). */
+    private static initPromise;
+    private static createConnection;
+    static getInstance(): Promise<RedisConnection>;
 }
 export { RedisClient };

package/dist/redisClient.js

@@ -2,17 +2,72 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RedisClient = void 0;
 const redis_1 = require("redis");
+function trimEnv(value) {
+    if (value === undefined)
+        return undefined;
+    let t = value.trim();
+    if ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))) {
+        t = t.slice(1, -1).trim();
+    }
+    return t;
+}
+function envBool(value, defaultValue) {
+    var _a;
+    const v = (_a = trimEnv(value)) === null || _a === void 0 ? void 0 : _a.toLowerCase();
+    if (v === undefined || v === '')
+        return defaultValue;
+    if (v === 'true' || v === '1' || v === 'yes')
+        return true;
+    if (v === 'false' || v === '0' || v === 'no')
+        return false;
+    return defaultValue;
+}
+/**
+ * Azure Managed Redis (ACL): default user is `default`.
+ * Set `REDIS_CACHE_USERNAME=none` (or empty after trim) to omit username for legacy password-only caches.
+ */
+function redisUsername() {
+    const raw = process.env.REDIS_CACHE_USERNAME;
+    if (raw === undefined)
+        return 'default';
+    const t = trimEnv(raw);
+    if (t === '' || t.toLowerCase() === 'none')
+        return undefined;
+    return t;
+}
+function mapClusterAddressToPublicEndpoint(address, publicHost, fallbackPort) {
+    const idx = address.lastIndexOf(':');
+    if (idx === -1)
+        return { host: publicHost, port: fallbackPort };
+    const p = Number.parseInt(address.slice(idx + 1), 10);
+    return Number.isNaN(p) ? { host: publicHost, port: fallbackPort } : { host: publicHost, port: p };
+}
 class RedisClient {
-    static async getInstance() {
-        if (!RedisClient.instance) {
-            const cachePort = process.env.REDIS_CACHE_PORT;
-            const cacheHostName = process.env.REDIS_CACHE_HOST;
-            const cachePassword = process.env.REDIS_CACHE_PASSWORD;
-            RedisClient.instance = await (0, redis_1.createClient)({
-                // redis for TLS
-                url: `rediss://${cacheHostName}:${cachePort}`,
-                password: cachePassword,
-            })
+    static async createConnection() {
+        const cachePortRaw = trimEnv(process.env.REDIS_CACHE_PORT);
+        const cacheHostName = trimEnv(process.env.REDIS_CACHE_HOST);
+        const cachePassword = trimEnv(process.env.REDIS_CACHE_PASSWORD);
+        const cachePort = cachePortRaw ? Number.parseInt(cachePortRaw, 10) : Number.NaN;
+        const username = redisUsername();
+        const useCluster = envBool(process.env.REDIS_CACHE_CLUSTER, false);
+        const unifiedClusterEndpoint = useCluster && envBool(process.env.REDIS_CACHE_CLUSTER_UNIFIED_ENDPOINT, true);
+        if (!cacheHostName || Number.isNaN(cachePort)) {
+            throw new Error('RedisClient: REDIS_CACHE_HOST and a numeric REDIS_CACHE_PORT are required');
+        }
+        const tlsSocket = {
+            tls: true,
+            servername: cacheHostName,
+        };
+        const standaloneSocket = Object.assign({ host: cacheHostName, port: cachePort }, tlsSocket);
+        const authOptions = Object.assign(Object.assign({}, (username !== undefined ? { username } : {})), (cachePassword !== undefined ? { password: cachePassword } : {}));
+        if (useCluster) {
+            console.log('RedisClient: CLUSTER mode (node-redis createCluster), unifiedEndpoint=%s, maxCommandRedirections=64', String(unifiedClusterEndpoint));
+            const clusterRoot = Object.assign({ socket: standaloneSocket }, authOptions);
+            const cluster = (0, redis_1.createCluster)(Object.assign({ rootNodes: [clusterRoot], defaults: Object.assign(Object.assign({}, authOptions), { socket: tlsSocket }), maxCommandRedirections: 64 }, (unifiedClusterEndpoint
+                ? {
+                    nodeAddressMap: (address) => mapClusterAddressToPublicEndpoint(address, cacheHostName, cachePort),
+                }
+                : {})))
                 .on('error', err => {
                 console.log('Redis Client Error', err);
             })
@@ -21,14 +76,42 @@ class RedisClient {
             })
                 .on('end', () => {
                 console.log('Connection to Redis end');
-            })
-                .connect();
+            });
+            await cluster.connect();
+            return cluster;
+        }
+        console.log('RedisClient: STANDALONE mode (node-redis createClient) — not for OSS cluster endpoints (MOVED).');
+        const client = (0, redis_1.createClient)(Object.assign({ socket: standaloneSocket }, authOptions))
+            .on('error', err => {
+            console.log('Redis Client Error', err);
+        })
+            .on('connect', () => {
+            console.log('Connected to Redis');
+        })
+            .on('end', () => {
+            console.log('Connection to Redis end');
+        });
+        return await client.connect();
+    }
+    static async getInstance() {
+        if (!RedisClient.instance) {
+            if (!RedisClient.initPromise) {
+                RedisClient.initPromise = RedisClient.createConnection();
+            }
+            try {
+                RedisClient.instance = await RedisClient.initPromise;
+            }
+            finally {
+                RedisClient.initPromise = null;
+            }
         }
         if (!RedisClient.instance.isOpen) {
-            return await RedisClient.instance.connect();
+            await RedisClient.instance.connect();
         }
         return RedisClient.instance;
     }
 }
 exports.RedisClient = RedisClient;
 RedisClient.instance = null;
+/** Ensures concurrent `getInstance()` share one in-flight connect (avoids duplicate clients / flaky MOVED). */
+RedisClient.initPromise = null;

package/dist/tests/jwtAlgorithmValidation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/jwtAlgorithmValidation.test.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = require("assert");
+const jwt = require('jsonwebtoken');
+const jwt_1 = require("../jwt");
+const run = async () => {
+    const payload = {
+        userId: 'security-test-user',
+        email: 'security-test@example.com',
+    };
+    const noneToken = jwt.sign(payload, null, { algorithm: 'none' });
+    const noneResult = await (0, jwt_1.jwtVerify)(noneToken);
+    assert.ok(noneResult instanceof Error, 'Expected alg=none token to be rejected');
+    const hsToken = jwt.sign(payload, 'not-rs256-key', { algorithm: 'HS256' });
+    const hsResult = await (0, jwt_1.jwtVerify)(hsToken);
+    assert.ok(hsResult instanceof Error, 'Expected HS256 token to be rejected');
+    console.log('JWT algorithm validation tests passed.');
+};
+run().catch(error => {
+    console.error('JWT algorithm validation tests failed:', error);
+    process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "joye-backend-utility",
-  "version": "7.3.6",
+  "version": "8.0.0",
   "description": "Joye backend utility for db functions and common functions",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,6 +13,7 @@
   "scripts": {
     "build": "tsc && yarn copy-files",
     "test": "echo \"Error: no test specified\"",
+    "test:jwt-algorithm": "ts-node lib/tests/jwtAlgorithmValidation.test.ts",
     "postinstall": "npm run build",
     "lint": "eslint --ignore-path .gitignore --ext .ts .",
     "lint:fix": "npm run lint -- --fix",