joye-backend-utility 7.4.1 → 8.0.1

package/dist/jwt.js

@@ -7,6 +7,7 @@ const path = require('path');
 const folderPath = path.resolve(`${__dirname}`);
 const JWT_PRIVATE_KEY = fs.readFileSync(`${folderPath}/jwtKeys/jwtRS256.key`, 'utf8');
 const JWT_PUBLIC_KEY = fs.readFileSync(`${folderPath}/jwtKeys/jwtRS256.key.pub`, 'utf8');
+const ALLOWED_JWT_ALGORITHMS = ['RS256'];
 const createToken = async (payload, expiresIn) => {
     const token = jwt.sign(payload, { key: JWT_PRIVATE_KEY.replace(/\\n/gm, '\n'), passphrase: process.env.JWT_SECRET }, {
         expiresIn,
@@ -16,7 +17,12 @@ const createToken = async (payload, expiresIn) => {
 };
 exports.createToken = createToken;
 const jwtVerify = async (token) => new Promise(resolve => {
-    jwt.verify(token, JWT_PUBLIC_KEY.replace(/\\n/gm, '\n'), async (err, decoded) => {
+    var _a;
+    const decodedHeader = jwt.decode(token, { complete: true });
+    if (!((_a = decodedHeader === null || decodedHeader === void 0 ? void 0 : decodedHeader.header) === null || _a === void 0 ? void 0 : _a.alg) || decodedHeader.header.alg === 'none') {
+        return resolve(new Error('Invalid token algorithm'));
+    }
+    jwt.verify(token, JWT_PUBLIC_KEY.replace(/\\n/gm, '\n'), { algorithms: ALLOWED_JWT_ALGORITHMS, ignoreExpiration: false }, async (err, decoded) => {
         if (err) {
             return resolve(err);
         }

package/dist/tests/jwtAlgorithmValidation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/jwtAlgorithmValidation.test.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = require("assert");
+const jwt = require('jsonwebtoken');
+const jwt_1 = require("../jwt");
+const run = async () => {
+    const payload = {
+        userId: 'security-test-user',
+        email: 'security-test@example.com',
+    };
+    const noneToken = jwt.sign(payload, null, { algorithm: 'none' });
+    const noneResult = await (0, jwt_1.jwtVerify)(noneToken);
+    assert.ok(noneResult instanceof Error, 'Expected alg=none token to be rejected');
+    const hsToken = jwt.sign(payload, 'not-rs256-key', { algorithm: 'HS256' });
+    const hsResult = await (0, jwt_1.jwtVerify)(hsToken);
+    assert.ok(hsResult instanceof Error, 'Expected HS256 token to be rejected');
+    // Expiration-focused checks (mock verify/decode to isolate jwtVerify behavior)
+    const originalVerify = jwt.verify;
+    const originalDecode = jwt.decode;
+    try {
+        jwt.decode = () => ({ header: { alg: 'RS256' } });
+        // Valid token path
+        let capturedOptions = null;
+        jwt.verify = (_token, _key, options, callback) => {
+            capturedOptions = options;
+            callback(null, { userId: payload.userId });
+        };
+        const validResult = await (0, jwt_1.jwtVerify)('valid-rs256-token');
+        assert.ok(!(validResult instanceof Error), 'Expected valid token to be accepted');
+        assert.deepStrictEqual(capturedOptions.algorithms, ['RS256'], 'Expected RS256 algorithm allowlist');
+        assert.strictEqual(capturedOptions.ignoreExpiration, false, 'Expected ignoreExpiration to be false');
+        // Near-expiry token path (still valid)
+        jwt.verify = (_token, _key, _options, callback) => {
+            callback(null, { userId: payload.userId, exp: Math.floor(Date.now() / 1000) + 2 });
+        };
+        const nearExpiryResult = await (0, jwt_1.jwtVerify)('near-expiry-rs256-token');
+        assert.ok(!(nearExpiryResult instanceof Error), 'Expected near-expiry token to be accepted');
+        // Expired token path
+        jwt.verify = (_token, _key, _options, callback) => {
+            const expiredError = new Error('jwt expired');
+            expiredError.name = 'TokenExpiredError';
+            callback(expiredError, null);
+        };
+        const expiredResult = await (0, jwt_1.jwtVerify)('expired-rs256-token');
+        assert.ok(expiredResult instanceof Error, 'Expected expired token to be rejected');
+        assert.strictEqual(expiredResult.name, 'TokenExpiredError', 'Expected TokenExpiredError for expired token');
+    }
+    finally {
+        jwt.verify = originalVerify;
+        jwt.decode = originalDecode;
+    }
+    console.log('JWT algorithm validation tests passed.');
+};
+run().catch(error => {
+    console.error('JWT algorithm validation tests failed:', error);
+    process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "joye-backend-utility",
-  "version": "7.4.1",
+  "version": "8.0.1",
   "description": "Joye backend utility for db functions and common functions",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,6 +13,7 @@
   "scripts": {
     "build": "tsc && yarn copy-files",
     "test": "echo \"Error: no test specified\"",
+    "test:jwt-algorithm": "ts-node lib/tests/jwtAlgorithmValidation.test.ts",
     "postinstall": "npm run build",
     "lint": "eslint --ignore-path .gitignore --ext .ts .",
     "lint:fix": "npm run lint -- --fix",