propro-utils 1.7.32 → 1.7.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "propro-utils",
-  "version": "1.7.32",
+  "version": "1.7.38",
   "description": "Auth middleware for propro-auth",
   "main": "src/index.js",
   "private": false,

package/src/index.js

@@ -118,12 +118,14 @@ class ProProAuthMiddleware {
 
   middleware() {
     return (req, res, next) => {
+      console.log("MIDDLEWARE: Entered")
       try {
         if (this.options.useServerAuth) {
           return this.initializeServerAuth()(req, res, next);
         } else if (this.options.useClientAuth) {
           return this.initializeClientAuth()(req, res, next);
         } else {
+          console.log("MIDDLEWARE: next()")
           next();
         }
       } catch (error) {

package/src/server/middleware/verifyToken.js

@@ -1,5 +1,5 @@
-const axios = require('axios');
-const jwt = require('jsonwebtoken');
+const axios = require("axios");
+const jwt = require("jsonwebtoken");
 const tokenCache = new Map();
 
 /**
@@ -8,18 +8,26 @@ const tokenCache = new Map();
  * @param {string} secret - The secret used to sign the JWT.
  * @returns {promise<object|null>} - The decoded payload of the JWT if it is valid, or null if it is not valid.
  */
-async function verifyJWT(token, secret = 'thisisasamplesecret') {
+async function verifyJWT(token, secret = "thisisasamplesecret") {
+  if (!secret) {
+    // Require JWT_SECRET from environment variables
+    if (!process.env.JWT_SECRET) {
+      throw new Error("JWT_SECRET environment variable is required");
+    }
+    secret = process.env.JWT_SECRET;
+  }
+
   try {
     return jwt.verify(token, secret);
   } catch (err) {
-    try{
-        if (err.name === 'TokenExpiredError') {
-          const newTokenData = await callTokenEndpoint(token);
-          return newTokenData ? jwt?.verify?.(newTokenData, secret) : null;
-        }
-      }catch(e){
-        return null
+    try {
+      if (err.name === "TokenExpiredError") {
+        const newTokenData = await callTokenEndpoint(token);
+        return newTokenData ? jwt?.verify?.(newTokenData, secret) : null;
       }
+    } catch (e) {
+      return null;
+    }
     return null;
   }
 }
@@ -59,22 +67,22 @@ async function exchangeToken(
   try {
     const formattedRedirectUri = formatRedirectUrl(authUrl);
     const response = await axios.post(
-      formattedRedirectUri + '/api/v1/auth/authorize',
+      formattedRedirectUri + "/api/v1/auth/authorize",
       {
-        grantType: 'authorization_code',
+        grantType: "authorization_code",
         code: code,
         redirectUri: redirectUri,
         clientId: clientId,
         clientSecret: clientSecret,
       },
       {
-        headers: { 'Content-Type': 'application/json' },
+        headers: { "Content-Type": "application/json" },
       }
     );
 
     return response.data;
   } catch (error) {
-    console.error('Error exchanging token:', error);
+    console.error("Error exchanging token:", error);
     return null;
   }
 }
@@ -84,11 +92,11 @@ async function exchangeToken(
  * @param {Array} requiredPermissions - Array of required permissions for the user
  * @returns {Function} - Express middleware function
  */
-const VerifyAccount = requiredPermissions => {
+const VerifyAccount = (requiredPermissions) => {
   return async (req, res, next) => {
-    const accessToken = req.headers.authorization?.split(' ')[1];
+    const accessToken = req.headers.authorization?.split(" ")[1];
     if (!accessToken) {
-      return res.status(401).json({ error: 'Access token is required' });
+      return res.status(401).json({ error: "Access token is required" });
     }
 
     // Check if token is in cache
@@ -100,7 +108,7 @@ const VerifyAccount = requiredPermissions => {
     try {
       const decoded = jwt.verify(accessToken, process.env.JWT_SECRET);
       if (!isValid(decoded, requiredPermissions)) {
-        return res.status(403).json({ error: 'Invalid permissions' });
+        return res.status(403).json({ error: "Invalid permissions" });
       }
       tokenCache.set(accessToken, decoded);
       req.user = decoded;
@@ -117,14 +125,14 @@ const VerifyAccount = requiredPermissions => {
         );
 
         if (!isValid(userResponse.data, requiredPermissions)) {
-        return res.status(403).json({ error: 'Invalid permissions' });
+          return res.status(403).json({ error: "Invalid permissions" });
         }
 
         tokenCache.set(accessToken, userResponse.data);
         req.user = userResponse.data;
         return next();
       } catch (networkError) {
-        return res.status(401).json({ error: 'Error validating token' });
+        return res.status(401).json({ error: "Error validating token" });
       }
     }
   };
@@ -137,7 +145,7 @@ const VerifyAccount = requiredPermissions => {
  * @returns {boolean} - Returns true if the decoded token has all the required permissions, false otherwise.
  */
 function isValid(decodedToken, requiredPermissions) {
-  return requiredPermissions.every(permission =>
+  return requiredPermissions.every((permission) =>
     decodedToken.permissions.includes(permission)
   );
 }
@@ -152,12 +160,12 @@ function formatRedirectUrl(redirectUrl) {
   let urlToRedirect;
 
   if (
-    !redirectUrl.startsWith('http://') &&
-    !redirectUrl.startsWith('https://')
+    !redirectUrl.startsWith("http://") &&
+    !redirectUrl.startsWith("https://")
   ) {
     if (
-      redirectUrl.includes('localhost') |
-      redirectUrl.includes('host.docker.internal')
+      redirectUrl.includes("localhost") |
+      redirectUrl.includes("host.docker.internal")
     ) {
       urlToRedirect = `http://${redirectUrl}`;
     } else {