ts-packages 1.0.0 → 2.0.0

package/packages/security/dist/cjs/core/jwt/jwtManager.d.ts

@@ -0,0 +1,67 @@
+import { type JwtPayload, type Secret } from 'jsonwebtoken';
+import type { AccessToken, ITokenManager, JWTConfig, RefreshToken, TokenPair, TokenValidationOptions } from '../../interfaces/jwt.interface';
+export declare class JWTManager implements ITokenManager {
+    private accessSecret;
+    private refreshSecret;
+    private accessExpiry;
+    private refreshExpiry;
+    private cache?;
+    private cacheTTL;
+    constructor(config: JWTConfig);
+    /**
+     * Generate both access and refresh tokens
+     */
+    generateTokens(payload: Record<string, unknown>): Promise<TokenPair>;
+    /**
+     * Generate access token
+     */
+    generateAccessToken(payload: Record<string, unknown>): Promise<AccessToken>;
+    /**
+     * Generate refresh token
+     */
+    generateRefreshToken(payload: Record<string, unknown>): Promise<RefreshToken>;
+    /**
+     * Verify access token
+     */
+    verifyAccessToken(token: string): Promise<JwtPayload | string>;
+    /**
+     * Verify refresh token
+     */
+    verifyRefreshToken(token: string): Promise<JwtPayload | string>;
+    /**
+     * Decode token without verification
+     */
+    decodeToken(token: string, complete?: boolean): JwtPayload | string | null;
+    /**
+     * Extract token from Authorization header
+     */
+    extractTokenFromHeader(authHeader: string): string | null;
+    /**
+     * Validate token without throwing exceptions
+     */
+    validateToken(token: string, secret: Secret, _options?: TokenValidationOptions): boolean;
+    /**
+     * Rotate refresh token
+     */
+    rotateRefreshToken(oldToken: string): Promise<RefreshToken>;
+    /**
+     * Check if token is expired
+     */
+    isTokenExpired(token: string): boolean;
+    /**
+     * Get token expiration date
+     */
+    getTokenExpiration(token: string): Date | null;
+    /**
+     * Clear token cache
+     */
+    clearCache(): void;
+    /**
+     * Get cache statistics
+     */
+    getCacheStats(): {
+        size: number;
+        maxSize: number;
+    } | null;
+    private validatePayload;
+}

package/packages/security/dist/cjs/core/jwt/jwtManager.js

@@ -0,0 +1,303 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JWTManager = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const signToken_1 = require("./signToken");
+const verify_1 = require("./verify");
+const errors_utils_1 = require("@naman_deep_singh/errors-utils");
+const js_extensions_1 = require("@naman_deep_singh/js-extensions");
+class JWTManager {
+    constructor(config) {
+        this.accessSecret = config.accessSecret;
+        this.refreshSecret = config.refreshSecret;
+        this.accessExpiry = config.accessExpiry || '15m';
+        this.refreshExpiry = config.refreshExpiry || '7d';
+        this.cacheTTL = 5 * 60 * 1000; // 5 minutes default TTL
+        if (config.enableCaching) {
+            this.cache = new js_extensions_1.LRUCache(config.maxCacheSize || 100);
+        }
+    }
+    /**
+     * Generate both access and refresh tokens
+     */
+    async generateTokens(payload) {
+        try {
+            this.validatePayload(payload);
+            const accessToken = await this.generateAccessToken(payload);
+            const refreshToken = await this.generateRefreshToken(payload);
+            return {
+                accessToken,
+                refreshToken,
+            };
+        }
+        catch (error) {
+            if (error instanceof errors_utils_1.BadRequestError ||
+                error instanceof errors_utils_1.ValidationError) {
+                throw error;
+            }
+            throw new errors_utils_1.BadRequestError('Failed to generate tokens');
+        }
+    }
+    /**
+     * Generate access token
+     */
+    async generateAccessToken(payload) {
+        try {
+            this.validatePayload(payload);
+            const token = (0, signToken_1.signToken)(payload, this.accessSecret, this.accessExpiry, {
+                algorithm: 'HS256',
+            });
+            return token;
+        }
+        catch (error) {
+            if (error instanceof errors_utils_1.BadRequestError ||
+                error instanceof errors_utils_1.ValidationError) {
+                throw error;
+            }
+            throw new errors_utils_1.BadRequestError('Failed to generate access token');
+        }
+    }
+    /**
+     * Generate refresh token
+     */
+    async generateRefreshToken(payload) {
+        try {
+            this.validatePayload(payload);
+            const token = (0, signToken_1.signToken)(payload, this.refreshSecret, this.refreshExpiry, {
+                algorithm: 'HS256',
+            });
+            return token;
+        }
+        catch (error) {
+            if (error instanceof errors_utils_1.BadRequestError ||
+                error instanceof errors_utils_1.ValidationError) {
+                throw error;
+            }
+            throw new errors_utils_1.BadRequestError('Failed to generate refresh token');
+        }
+    }
+    /**
+     * Verify access token
+     */
+    async verifyAccessToken(token) {
+        try {
+            if (!token || typeof token !== 'string') {
+                throw new errors_utils_1.ValidationError('Access token must be a non-empty string');
+            }
+            const cacheKey = `access_${token}`;
+            if (this.cache) {
+                const cached = this.cache.get(cacheKey);
+                if (cached && Date.now() - cached.timestamp <= this.cacheTTL) {
+                    if (!cached.valid) {
+                        throw new errors_utils_1.UnauthorizedError('Access token is invalid or expired');
+                    }
+                    return cached.payload;
+                }
+            }
+            const decoded = (0, verify_1.verifyToken)(token, this.accessSecret);
+            if (this.cache) {
+                this.cache.set(cacheKey, {
+                    valid: true,
+                    payload: decoded,
+                    timestamp: Date.now(),
+                });
+            }
+            return decoded;
+        }
+        catch (error) {
+            if (error instanceof errors_utils_1.ValidationError ||
+                error instanceof errors_utils_1.UnauthorizedError) {
+                throw error;
+            }
+            if (error instanceof Error && error.name === 'TokenExpiredError') {
+                throw new errors_utils_1.UnauthorizedError('Access token has expired');
+            }
+            if (error instanceof Error && error.name === 'JsonWebTokenError') {
+                throw new errors_utils_1.UnauthorizedError('Access token is invalid');
+            }
+            throw new errors_utils_1.UnauthorizedError('Failed to verify access token');
+        }
+    }
+    /**
+     * Verify refresh token
+     */
+    async verifyRefreshToken(token) {
+        try {
+            if (!token || typeof token !== 'string') {
+                throw new errors_utils_1.ValidationError('Refresh token must be a non-empty string');
+            }
+            const cacheKey = `refresh_${token}`;
+            if (this.cache) {
+                const cached = this.cache.get(cacheKey);
+                if (cached) {
+                    if (!cached.valid) {
+                        throw new errors_utils_1.UnauthorizedError('Refresh token is invalid or expired');
+                    }
+                    return cached.payload;
+                }
+            }
+            const decoded = (0, verify_1.verifyToken)(token, this.refreshSecret);
+            if (this.cache) {
+                this.cache.set(cacheKey, {
+                    valid: true,
+                    payload: decoded,
+                    timestamp: Date.now(),
+                });
+            }
+            return decoded;
+        }
+        catch (error) {
+            if (error instanceof errors_utils_1.ValidationError ||
+                error instanceof errors_utils_1.UnauthorizedError) {
+                throw error;
+            }
+            if (error instanceof Error && error.name === 'TokenExpiredError') {
+                throw new errors_utils_1.UnauthorizedError('Refresh token has expired');
+            }
+            if (error instanceof Error && error.name === 'JsonWebTokenError') {
+                throw new errors_utils_1.UnauthorizedError('Refresh token is invalid');
+            }
+            throw new errors_utils_1.UnauthorizedError('Failed to verify refresh token');
+        }
+    }
+    /**
+     * Decode token without verification
+     */
+    decodeToken(token, complete = false) {
+        try {
+            if (!token || typeof token !== 'string') {
+                throw new errors_utils_1.ValidationError('Token must be a non-empty string');
+            }
+            return jsonwebtoken_1.default.decode(token, { complete });
+        }
+        catch (error) {
+            if (error instanceof errors_utils_1.ValidationError) {
+                throw error;
+            }
+            return null;
+        }
+    }
+    /**
+     * Extract token from Authorization header
+     */
+    extractTokenFromHeader(authHeader) {
+        try {
+            if (!authHeader || typeof authHeader !== 'string') {
+                return null;
+            }
+            const parts = authHeader.split(' ');
+            if (parts.length !== 2 || parts[0] !== 'Bearer') {
+                return null;
+            }
+            return parts[1];
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Validate token without throwing exceptions
+     */
+    validateToken(token, secret, _options = {}) {
+        try {
+            if (!token || typeof token !== 'string') {
+                return false;
+            }
+            const result = (0, verify_1.safeVerifyToken)(token, secret);
+            return result.valid;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Rotate refresh token
+     */
+    async rotateRefreshToken(oldToken) {
+        try {
+            if (!oldToken || typeof oldToken !== 'string') {
+                throw new errors_utils_1.ValidationError('Old refresh token must be a non-empty string');
+            }
+            const decoded = await this.verifyRefreshToken(oldToken);
+            if (typeof decoded === 'string') {
+                throw new errors_utils_1.ValidationError('Invalid token payload — expected JWT payload object');
+            }
+            // Create new payload without issued/expired timestamps
+            const payload = { ...decoded };
+            delete payload.iat;
+            delete payload.exp;
+            // Generate new refresh token
+            const newToken = (0, signToken_1.signToken)(payload, this.refreshSecret, this.refreshExpiry);
+            return newToken;
+        }
+        catch (error) {
+            if (error instanceof errors_utils_1.ValidationError ||
+                error instanceof errors_utils_1.UnauthorizedError) {
+                throw error;
+            }
+            throw new errors_utils_1.BadRequestError('Failed to rotate refresh token');
+        }
+    }
+    /**
+     * Check if token is expired
+     */
+    isTokenExpired(token) {
+        try {
+            const decoded = this.decodeToken(token);
+            if (!decoded || !decoded.exp) {
+                return true;
+            }
+            const currentTime = Math.floor(Date.now() / 1000);
+            return decoded.exp < currentTime;
+        }
+        catch {
+            return true;
+        }
+    }
+    /**
+     * Get token expiration date
+     */
+    getTokenExpiration(token) {
+        try {
+            const decoded = this.decodeToken(token);
+            if (!decoded || !decoded.exp) {
+                return null;
+            }
+            return new Date(decoded.exp * 1000);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Clear token cache
+     */
+    clearCache() {
+        this.cache?.clear();
+    }
+    /**
+     * Get cache statistics
+     */
+    getCacheStats() {
+        if (!this.cache)
+            return null;
+        // Note: LRUCache doesn't expose internal size, so we return maxSize only
+        return {
+            size: -1, // Size not available from LRUCache
+            maxSize: this.cache.maxSize,
+        };
+    }
+    // Private helper methods
+    validatePayload(payload) {
+        if (!payload || typeof payload !== 'object') {
+            throw new errors_utils_1.ValidationError('Payload must be a non-null object');
+        }
+        if (Object.keys(payload).length === 0) {
+            throw new errors_utils_1.ValidationError('Payload cannot be empty');
+        }
+    }
+}
+exports.JWTManager = JWTManager;

package/packages/security/dist/cjs/core/jwt/parseDuration.d.ts

@@ -0,0 +1 @@
+export declare function parseDuration(input: string | number): number;

package/packages/security/dist/cjs/core/jwt/parseDuration.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDuration = parseDuration;
+const TIME_UNITS = {
+    s: 1,
+    m: 60,
+    h: 3600,
+    d: 86400,
+    w: 604800,
+};
+function parseDuration(input) {
+    if (typeof input === 'number')
+        return input;
+    const regex = /(\d+)\s*(s|m|h|d|w)/gi;
+    let totalSeconds = 0;
+    let match;
+    while ((match = regex.exec(input)) !== null) {
+        const value = Number.parseInt(match[1], 10);
+        const unit = match[2].toLowerCase();
+        if (!TIME_UNITS[unit]) {
+            throw new Error(`Invalid time unit: ${unit}`);
+        }
+        totalSeconds += value * TIME_UNITS[unit];
+    }
+    if (totalSeconds === 0) {
+        throw new Error(`Invalid expiry format: "${input}"`);
+    }
+    return totalSeconds;
+}

package/packages/security/dist/cjs/core/jwt/signToken.d.ts

@@ -0,0 +1,2 @@
+import { type Secret, type SignOptions } from 'jsonwebtoken';
+export declare const signToken: (payload: Record<string, unknown>, secret: Secret, expiresIn?: string | number, options?: SignOptions) => string;

package/packages/security/dist/cjs/core/jwt/signToken.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signToken = void 0;
+const jsonwebtoken_1 = require("jsonwebtoken");
+const parseDuration_1 = require("./parseDuration");
+function getExpiryTimestamp(seconds) {
+    return Math.floor(Date.now() / 1000) + seconds;
+}
+const signToken = (payload, secret, expiresIn = '1h', options = {}) => {
+    const seconds = (0, parseDuration_1.parseDuration)(expiresIn);
+    if (!seconds || seconds < 10) {
+        throw new Error('Token expiry too small');
+    }
+    const tokenPayload = {
+        ...payload,
+    };
+    if (!('exp' in payload))
+        tokenPayload.exp = getExpiryTimestamp(seconds);
+    if (!('iat' in payload))
+        tokenPayload.iat = Math.floor(Date.now() / 1000);
+    return (0, jsonwebtoken_1.sign)(tokenPayload, secret, {
+        algorithm: 'HS256',
+        ...options,
+    });
+};
+exports.signToken = signToken;

package/packages/security/dist/cjs/core/jwt/types.d.ts

@@ -0,0 +1,22 @@
+import type { JwtPayload } from 'jsonwebtoken';
+export interface AccessTokenBrand {
+    readonly access: unique symbol;
+}
+export interface RefreshTokenBrand {
+    readonly refresh: unique symbol;
+}
+export type AccessToken = string & AccessTokenBrand;
+export type RefreshToken = string & RefreshTokenBrand;
+export interface TokenPair {
+    accessToken: AccessToken;
+    refreshToken: RefreshToken;
+}
+export interface VerificationResult<T = JwtPayload> {
+    valid: boolean;
+    payload?: T | string;
+    error?: Error;
+}
+export interface TokenValidationOptions {
+    ignoreExpiration?: boolean;
+    ignoreIssuedAt?: boolean;
+}

package/packages/security/dist/cjs/core/jwt/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/packages/security/dist/cjs/core/jwt/validateToken.d.ts

@@ -0,0 +1,13 @@
+import type { JwtPayload } from 'node_modules/@types/jsonwebtoken';
+export interface TokenRequirements {
+    requiredFields?: string[];
+    forbiddenFields?: string[];
+    validateTypes?: Record<string, 'string' | 'number' | 'boolean'>;
+}
+export declare function validateTokenPayload(payload: Record<string, unknown>, rules?: TokenRequirements): {
+    valid: true;
+} | {
+    valid: false;
+    error: string;
+};
+export declare function isTokenExpired(payload: JwtPayload): boolean;

package/packages/security/dist/cjs/core/jwt/validateToken.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateTokenPayload = validateTokenPayload;
+exports.isTokenExpired = isTokenExpired;
+function validateTokenPayload(payload, rules = {
+    requiredFields: ['exp', 'iat'],
+}) {
+    const { requiredFields = [], forbiddenFields = [], validateTypes = {}, } = rules;
+    // 1. Required fields
+    for (const field of requiredFields) {
+        if (!(field in payload)) {
+            return { valid: false, error: `Missing required field: ${field}` };
+        }
+    }
+    // 2. Forbidden fields
+    for (const field of forbiddenFields) {
+        if (field in payload) {
+            return { valid: false, error: `Forbidden field in token: ${field}` };
+        }
+    }
+    // 3. Type validation
+    for (const key in validateTypes) {
+        const expectedType = validateTypes[key];
+        if (key in payload && typeof payload[key] !== expectedType) {
+            return {
+                valid: false,
+                error: `Invalid type for ${key}. Expected ${expectedType}.`,
+            };
+        }
+    }
+    return { valid: true };
+}
+function isTokenExpired(payload) {
+    if (!payload.exp)
+        return true;
+    return Date.now() >= payload.exp * 1000;
+}

package/packages/security/dist/cjs/core/jwt/verify.d.ts

@@ -0,0 +1,19 @@
+import type jwt from 'jsonwebtoken';
+import { type JwtPayload, type Secret } from 'jsonwebtoken';
+import type { VerificationResult } from './types';
+/**
+ * Verify token (throws if invalid or expired)
+ */
+export declare const verifyToken: (token: string, secret: Secret) => string | JwtPayload;
+/**
+ * Safe verify — never throws, returns structured result
+ */
+export declare const safeVerifyToken: (token: string, secret: Secret) => VerificationResult;
+/**
+ * Verify token with validation options
+ */
+export declare const verifyTokenWithOptions: (token: string, secret: Secret, options?: jwt.VerifyOptions) => string | JwtPayload;
+/**
+ * Safe verify with validation options
+ */
+export declare const safeVerifyTokenWithOptions: (token: string, secret: Secret, options?: jwt.VerifyOptions) => VerificationResult;

package/packages/security/dist/cjs/core/jwt/verify.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeVerifyTokenWithOptions = exports.verifyTokenWithOptions = exports.safeVerifyToken = exports.verifyToken = void 0;
+const jsonwebtoken_1 = require("jsonwebtoken");
+/**
+ * Verify token (throws if invalid or expired)
+ */
+const verifyToken = (token, secret) => {
+    return (0, jsonwebtoken_1.verify)(token, secret);
+};
+exports.verifyToken = verifyToken;
+/**
+ * Safe verify — never throws, returns structured result
+ */
+const safeVerifyToken = (token, secret) => {
+    try {
+        const decoded = (0, jsonwebtoken_1.verify)(token, secret);
+        return { valid: true, payload: decoded };
+    }
+    catch (error) {
+        return { valid: false, error: error };
+    }
+};
+exports.safeVerifyToken = safeVerifyToken;
+/**
+ * Verify token with validation options
+ */
+const verifyTokenWithOptions = (token, secret, options = {}) => {
+    return (0, jsonwebtoken_1.verify)(token, secret, options);
+};
+exports.verifyTokenWithOptions = verifyTokenWithOptions;
+/**
+ * Safe verify with validation options
+ */
+const safeVerifyTokenWithOptions = (token, secret, options = {}) => {
+    try {
+        const decoded = (0, jsonwebtoken_1.verify)(token, secret, options);
+        return { valid: true, payload: decoded };
+    }
+    catch (error) {
+        return { valid: false, error: error };
+    }
+};
+exports.safeVerifyTokenWithOptions = safeVerifyTokenWithOptions;

package/packages/security/dist/cjs/core/password/hash.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Hash a password asynchronously using bcrypt.
+ */
+export declare const hashPassword: (password: string, saltRounds?: number) => Promise<string>;
+export declare function hashPasswordWithPepper(password: string, pepper: string): Promise<string>;
+/**
+ * Hash a password synchronously using bcrypt.
+ */
+export declare const hashPasswordSync: (password: string, saltRounds?: number) => string;
+export declare function hashPasswordWithPepperSync(password: string, pepper: string): string;

package/packages/security/dist/cjs/core/password/hash.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashPasswordSync = exports.hashPassword = void 0;
+exports.hashPasswordWithPepper = hashPasswordWithPepper;
+exports.hashPasswordWithPepperSync = hashPasswordWithPepperSync;
+const errors_utils_1 = require("@naman_deep_singh/errors-utils");
+const bcryptjs_1 = __importDefault(require("bcryptjs"));
+const utils_1 = require("./utils");
+/**
+ * Hash a password asynchronously using bcrypt.
+ */
+const hashPassword = async (password, saltRounds = 10) => {
+    try {
+        (0, utils_1.ensureValidPassword)(password);
+        const salt = await bcryptjs_1.default.genSalt(saltRounds);
+        return bcryptjs_1.default.hash(password, salt);
+    }
+    catch (_err) {
+        throw new errors_utils_1.InternalServerError('Password hashing failed');
+    }
+};
+exports.hashPassword = hashPassword;
+function hashPasswordWithPepper(password, pepper) {
+    return (0, exports.hashPassword)(password + pepper);
+}
+/**
+ * Hash a password synchronously using bcrypt.
+ */
+const hashPasswordSync = (password, saltRounds = 10) => {
+    try {
+        (0, utils_1.ensureValidPassword)(password);
+        const salt = bcryptjs_1.default.genSaltSync(saltRounds);
+        return bcryptjs_1.default.hashSync(password, salt);
+    }
+    catch (_error) {
+        throw new errors_utils_1.InternalServerError('Password hashing failed');
+    }
+};
+exports.hashPasswordSync = hashPasswordSync;
+function hashPasswordWithPepperSync(password, pepper) {
+    return (0, exports.hashPasswordSync)(password + pepper);
+}

package/packages/security/dist/cjs/core/password/index.d.ts

@@ -0,0 +1,3 @@
+export * from './hash';
+export * from './strength';
+export * from './verify';

package/packages/security/dist/cjs/core/password/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./hash"), exports);
+__exportStar(require("./strength"), exports);
+__exportStar(require("./verify"), exports);