nucleus-core-ts 0.9.730 → 0.9.732

package/dist/src/Client/Proxy/httpProxy.d.ts

@@ -8,6 +8,12 @@ export declare function deduplicatedRefresh(refreshConfig: TokenRefreshConfig, r
     warn: (...args: unknown[]) => void;
     error: (...args: unknown[]) => void;
 }, originalCookieHeader?: string | null): Promise<RefreshResult | null>;
+/**
+ * Resolve the user id to inject as x-user-id from a bearer token, or null if it can't be
+ * TRUSTED. Fail-closed: returns null unless BOTH a secret and a token are present AND the token
+ * passes HS256 signature + expiry verification. Never trusts a bare/forged/unsigned token.
+ */
+export declare function resolveInjectedUserId(token: string | undefined, secret: string | undefined): string | null;
 export declare function createHttpProxyHandler(config: HttpProxyConfig): {
     handle(req: Request, clientIp?: string): Promise<Response | null>;
 };

package/dist/src/Client/Proxy/httpProxy.js

@@ -147,15 +147,14 @@ function appendSetCookieHeaders(responseHeaders, setCookieHeaders) {
         }
     }
 }
-function extractSubFromJwt(token) {
-    try {
-        const parts = token.split('.');
-        if (parts.length !== 3 || !parts[1]) return null;
-        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-        return typeof payload.sub === 'string' ? payload.sub : null;
-    } catch  {
-        return null;
-    }
+/**
+ * Resolve the user id to inject as x-user-id from a bearer token, or null if it can't be
+ * TRUSTED. Fail-closed: returns null unless BOTH a secret and a token are present AND the token
+ * passes HS256 signature + expiry verification. Never trusts a bare/forged/unsigned token.
+ */ export function resolveInjectedUserId(token, secret) {
+    if (!secret || !token) return null;
+    const payload = verifyJwtHS256(token, secret);
+    return payload && typeof payload.sub === 'string' ? payload.sub : null;
 }
 export function createHttpProxyHandler(config) {
     const logger = createProxyLogger('HTTP Proxy', config.debug ?? false);
@@ -343,13 +342,24 @@ export function createHttpProxyHandler(config) {
             }
         }
         if (target.injectUserIdFromJwt) {
-            const cookies = parseCookies(req.headers.get('cookie'));
-            const token = cookies[target.injectUserIdFromJwt.cookieName];
-            if (token) {
-                const userId = extractSubFromJwt(token);
-                if (userId) {
-                    headers.set(target.injectUserIdFromJwt.headerName ?? 'x-user-id', userId);
-                }
+            // x-user-id here is authoritative-from-the-VERIFIED-JWT. Two rules make that hold:
+            //  1. ALWAYS strip any inbound client-supplied value FIRST, so a caller can never spoof
+            //     it (closes the fail-open when the cookie is absent or the token is malformed).
+            //  2. Re-set it ONLY from a cryptographically verified token (HMAC + exp via
+            //     verifyJwtHS256). A bare base64 decode of `sub` is attacker-forgeable (alg:none),
+            //     so trusting it would let anyone impersonate any user id.
+            const headerName = target.injectUserIdFromJwt.headerName ?? 'x-user-id';
+            headers.delete(headerName);
+            const verifySecret = target.injectUserIdFromJwt.secret ?? target.authorize?.jwt?.secret;
+            if (!verifySecret) {
+                // No secret to verify with → the token's sub cannot be trusted. Fail closed: inject
+                // nothing (the header was already stripped above).
+                logger.warn('[Proxy] injectUserIdFromJwt has no `secret` (and no authorize.jwt.secret) to verify the token; x-user-id NOT injected (fail-closed).');
+            } else {
+                const cookies = parseCookies(req.headers.get('cookie'));
+                const token = cookies[target.injectUserIdFromJwt.cookieName];
+                const sub = resolveInjectedUserId(token, verifySecret);
+                if (sub) headers.set(headerName, sub);
             }
         }
         return headers;

package/dist/src/Client/Proxy/httpProxy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/Client/Proxy/httpProxy.test.js

@@ -0,0 +1,73 @@
+import { describe, expect, it } from 'bun:test';
+import { createHmac } from 'node:crypto';
+import { resolveInjectedUserId } from './httpProxy';
+const b64 = (o)=>Buffer.from(JSON.stringify(o)).toString('base64url');
+function signHS256(payload, secret) {
+    const header = b64({
+        alg: 'HS256',
+        typ: 'JWT'
+    });
+    const body = b64(payload);
+    const sig = createHmac('sha256', secret).update(`${header}.${body}`).digest('base64url');
+    return `${header}.${body}.${sig}`;
+}
+const SECRET = 'inject-secret';
+describe('resolveInjectedUserId (x-user-id injection is verified, not decoded)', ()=>{
+    it('returns the sub of a correctly signed, unexpired token', ()=>{
+        const t = signHS256({
+            sub: 'user-123'
+        }, SECRET);
+        expect(resolveInjectedUserId(t, SECRET)).toBe('user-123');
+    });
+    it('returns null for a FORGED unsigned token (alg:none-style, arbitrary sig)', ()=>{
+        // The pre-fix code base64-decoded this and returned "victim" — an impersonation vector.
+        const forged = `${b64({
+            alg: 'none'
+        })}.${b64({
+            sub: 'victim'
+        })}.garbage`;
+        expect(resolveInjectedUserId(forged, SECRET)).toBeNull();
+    });
+    it('returns null for a token signed with a different secret', ()=>{
+        const t = signHS256({
+            sub: 'user-123'
+        }, 'other-secret');
+        expect(resolveInjectedUserId(t, SECRET)).toBeNull();
+    });
+    it('returns null for a tampered sub (re-encoded payload, original signature)', ()=>{
+        const t = signHS256({
+            sub: 'user-123'
+        }, SECRET);
+        const [h, , s] = t.split('.');
+        const tampered = `${h}.${b64({
+            sub: 'victim'
+        })}.${s}`;
+        expect(resolveInjectedUserId(tampered, SECRET)).toBeNull();
+    });
+    it('returns null for an expired token', ()=>{
+        const t = signHS256({
+            sub: 'user-123',
+            exp: Math.floor(Date.now() / 1000) - 60
+        }, SECRET);
+        expect(resolveInjectedUserId(t, SECRET)).toBeNull();
+    });
+    it('fails CLOSED when no secret is available (cannot verify → do not trust)', ()=>{
+        const t = signHS256({
+            sub: 'user-123'
+        }, SECRET);
+        expect(resolveInjectedUserId(t, undefined)).toBeNull();
+        expect(resolveInjectedUserId(t, '')).toBeNull();
+    });
+    it('returns null when there is no token', ()=>{
+        expect(resolveInjectedUserId(undefined, SECRET)).toBeNull();
+        expect(resolveInjectedUserId('', SECRET)).toBeNull();
+    });
+    it('returns null when the token has no string sub', ()=>{
+        expect(resolveInjectedUserId(signHS256({
+            foo: 'bar'
+        }, SECRET), SECRET)).toBeNull();
+        expect(resolveInjectedUserId(signHS256({
+            sub: 123
+        }, SECRET), SECRET)).toBeNull();
+    });
+});

package/dist/src/Client/Proxy/types.d.ts

@@ -110,6 +110,13 @@ export interface HttpProxyTarget {
     injectUserIdFromJwt?: {
         cookieName: string;
         headerName?: string;
+        /**
+         * HS256 secret used to VERIFY the token before trusting its `sub`. Without a secret (here
+         * or on `authorize.jwt.secret`) the sub can't be trusted, so x-user-id is NOT injected
+         * (fail-closed) — otherwise a forged/unsigned token could impersonate any user on a bare
+         * backend that trusts x-user-id. May be an env var name resolved by the caller.
+         */
+        secret?: string;
     };
     /** Enforce discovered endpoint claims for this target at the proxy. */
     authorize?: ProxyAuthorizeConfig;

package/dist/src/ElysiaPlugin/routes/auth/accountState.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Shared, fail-closed account-state kill-switch for EVERY token-minting auth path
+ * (password login, OAuth callback, magic-link verify, WebAuthn, refresh). A locked or
+ * deactivated account must not be able to obtain a fresh access/refresh token or session
+ * through ANY path — otherwise an admin's lock/deactivation is trivially bypassed by simply
+ * logging in again via a different mechanism. Centralized here so the invariant can't drift
+ * out of sync between handlers again.
+ *
+ * Semantics mirror the canonical refresh check (routes/auth/refresh):
+ *  - `isActive === false` → denied (admin deactivation). Absent/undefined isActive is NOT a
+ *    denial, so deployments without the column keep working (fail-open only on absence).
+ *  - `isLocked === true` AND the lock has NOT expired (`lockedUntil` null or in the future)
+ *    → denied. A past `lockedUntil` means the lock lapsed and no longer blocks.
+ *
+ * Cohort-expiry is intentionally NOT handled here: it needs a separate table lookup and is
+ * enforced per-path where cohorts apply (login/refresh).
+ */
+export interface AccountStateFields {
+    isActive?: unknown;
+    isLocked?: unknown;
+    lockedUntil?: unknown;
+}
+export type AccountStateResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: 'inactive' | 'locked';
+    message: string;
+};
+export declare function evaluateAccountState(user: AccountStateFields, now?: Date): AccountStateResult;

package/dist/src/ElysiaPlugin/routes/auth/accountState.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.730",
+	"version": "0.9.732",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",