mosquito-transport 1.4.7 → 1.4.8

package/README.md

@@ -591,6 +591,10 @@ serverApp.listenDeletedUser(uid => {
 });
 ```
 
+### parseToken
+
+parse jwt token
+
 ### verifyToken
 
 verify token to check if it was trully created using signerKey without checking against the expiry or local token reference

package/lib/helpers/utils.js

@@ -1,5 +1,6 @@
 import naclPkg from 'tweetnacl';
 import { Scoped } from './variables';
+import { Buffer } from 'buffer';
 
 const { box, randomBytes } = naclPkg;
 

package/lib/index.d.ts

@@ -453,13 +453,29 @@ interface UserProfile {
 interface AuthData {
     email?: string;
     metadata: Object;
-    signupMethod: 'google' | 'apple' | 'custom' | 'twitter' | 'facebook' | 'github' | string;
+    signupMethod: 'google' | 'apple' | 'custom' | 'github' | 'twitter' | 'facebook' | string;
+    currentAuthMethod: 'google' | 'apple' | 'custom' | 'github' | 'twitter' | 'facebook' | string;
     joinedOn: number;
     uid: string;
     claims: Object;
     emailVerified: boolean;
-    profile: UserProfile;
+    tokenID: string;
     disabled: boolean;
+    entityOf: string;
+    profile: {
+        photo: string;
+        name: string;
+    },
+    exp: number;
+    aud: string;
+    iss: string;
+    sub: string;
+}
+
+interface RefreshTokenData {
+    uid: string;
+    tokenID: string;
+    isRefreshToken: true;
 }
 
 interface UserData extends AuthData {
@@ -557,6 +573,11 @@ export default class MosquitoTransportServer {
      * @param uid uid of the user you are signing out
      */
     signOutUser(uid: string): Promise<void>;
+    
+    /**
+     * parse jwt token
+     */
+    parseToken(token: string): AuthData;
 
     /**
      * verify token to check if it was trully created using signerKey without checking against the expiry or local token reference
@@ -572,7 +593,7 @@ export default class MosquitoTransportServer {
      * @param token - the token to be validated
      * @param isRefreshToken - set this to true if token is a refresh token
      */
-    validateToken(token: string, isRefreshToken?: boolean): Promise<AuthData>;
+    validateToken(token: string, isRefreshToken?: boolean): Promise<AuthData | RefreshTokenData>;
 
     /**
      * remove local reference of a token

package/lib/index.js

@@ -4,7 +4,7 @@ import { databaseLivePath, databaseLiveRoutes, databaseRoutes, emitDatabase, rea
 import { authLivePath, authLiveRoutes, authRoutes } from "./products/auth/index.js";
 import { removeVideoFreezer, storageRoutes } from "./products/storage/index.js";
 import { Scoped } from "./helpers/variables.js";
-import { IS_JSON_OBJECT, IS_RAW_OBJECT, IS_WHOLE_NUMBER, deserializeE2E, getStringExtension, interpolate, niceTry, requestURL, serializeE2E, simplifyCaughtError, simplifyError } from "./helpers/utils.js";
+import { IS_JSON_OBJECT, IS_RAW_OBJECT, IS_WHOLE_NUMBER, decodeBinary, deserializeE2E, getStringExtension, interpolate, niceTry, requestURL, serializeE2E, simplifyCaughtError, simplifyError } from "./helpers/utils.js";
 import { getDB } from "./products/database/base.js";
 import { releaseTokenSelfDestruction, validateJWT, verifyJWT } from "./products/auth/tokenizer.js";
 import { ADMIN_DB_NAME, ADMIN_DB_URL, EngineRoutes, STORAGE_FREEZER_DIR, STORAGE_PATH, STORAGE_PREFIX_PATH, STORAGE_ROUTE, STORAGE_URL_TO_FILE, one_hour, one_mb, one_minute } from "./helpers/values.js";
@@ -605,7 +605,8 @@ export default class MosquitoTransportServer {
         ]);
         SignoutUserSignal.dispatch('d', uid);
     }
-
+    
+    parseToken = (token) => JSON.parse(decodeBinary(token.split('.')[1]));
     verifyToken = (token, isRefreshToken) => verifyJWT(token, this.projectName, isRefreshToken);
     validateToken = (token, isRefreshToken) => validateJWT(token, this.projectName, isRefreshToken);
     invalidateToken = (token, isRefreshToken) => invalidateToken(token, this.projectName, isRefreshToken);

package/lib/products/auth/customAuth.js

@@ -47,6 +47,7 @@ export const signupCustom = async (email = '', password = '', signupMethod = 'cu
         const [token, refreshToken, acctRes] = await Promise.all([
             signJWT({
                 ...tokenData,
+                entityOf: refreshTokenID,
                 uid: newUid,
                 tokenID,
                 lastLoginAt: Date.now()
@@ -138,7 +139,8 @@ export const signinCustom = async (email = '', password = '', signinMethod = 'cu
             profile,
             disabled: !!disabled,
             tokenID,
-            lastLoginAt: Date.now()
+            lastLoginAt: Date.now(),
+            entityOf: refreshTokenID
         };
 
     if (disabled) throw simplifyError('account_disable', 'You cannot sign into this account because it has been disabled');
@@ -171,7 +173,7 @@ export const signinCustom = async (email = '', password = '', signinMethod = 'cu
 }
 
 export const refreshToken = async ({ token, refToken }, projectName) => {
-    const [{ uid, currentAuthMethod, lastLoginAt }, refAuth] = await Promise.all([
+    const [{ uid, currentAuthMethod, lastLoginAt, entityOf }, refAuth] = await Promise.all([
         verifyJWT(token, projectName),
         validateRefreshToken(refToken, projectName)
     ]);
@@ -179,6 +181,9 @@ export const refreshToken = async ({ token, refToken }, projectName) => {
     if (uid !== refAuth.uid)
         throw simplifyError('token_mismatch', 'The accessToken and refreshToken are not meant for eachother');
 
+    if (entityOf !== refAuth.tokenID)
+        throw simplifyError('entity_mismatch', 'This accessToken doesn\'t belong to the provided refreshToken');
+
     const userData = await readDocument({
         path: EnginePath.userAcct,
         find: { _id: uid }
@@ -200,7 +205,8 @@ export const refreshToken = async ({ token, refToken }, projectName) => {
             profile,
             disabled,
             lastLoginAt,
-            tokenID: newTokenID
+            tokenID: newTokenID,
+            entityOf: refAuth.tokenID
         };
 
     if (disabled)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mosquito-transport",
-  "version": "1.4.7",
+  "version": "1.4.8",
   "description": "MosquitoTransport is a powerful tool that helps persist and synchronize data between your MongoDB database and frontend applications",
   "main": "lib/index.js",
   "type": "module",
@@ -32,6 +32,7 @@
   },
   "homepage": "https://github.com/deflexable/mosquito-transport#readme",
   "dependencies": {
+    "buffer": "^6.0.3",
     "compression": "^1.7.4",
     "cors": "^2.8.5",
     "express": "^4.18.2",
@@ -50,4 +51,4 @@
     "@types/mongodb": "^4.0.7",
     "eslint": "^8.23.1"
   }
-}
+}