ts-packages 1.0.0 → 3.0.0

package/packages/security/dist/esm/core/jwt/jwtManager.js

@@ -0,0 +1,181 @@
+import jwt from 'jsonwebtoken';
+import { signToken } from './signToken';
+import { safeVerifyToken } from './verify';
+import { BadRequestError, UnauthorizedError, ValidationError, } from '@naman_deep_singh/errors-utils';
+import { LRUCache } from '@naman_deep_singh/js-extensions';
+export class JWTManager {
+    constructor(config) {
+        this.accessSecret = config.accessSecret;
+        this.refreshSecret = config.refreshSecret;
+        this.accessExpiry = config.accessExpiry || '15m';
+        this.refreshExpiry = config.refreshExpiry || '7d';
+        this.cacheTTL = 5 * 60 * 1000; // 5 minutes
+        if (config.enableCaching) {
+            this.cache = new LRUCache(config.maxCacheSize || 100);
+        }
+    }
+    /** Generate both access and refresh tokens */
+    async generateTokens(payload) {
+        try {
+            this.validatePayload(payload);
+            const accessToken = await this.generateAccessToken(payload);
+            const refreshToken = await this.generateRefreshToken(payload);
+            return { accessToken, refreshToken };
+        }
+        catch (error) {
+            if (error instanceof BadRequestError || error instanceof ValidationError)
+                throw error;
+            throw new BadRequestError({ reason: 'Failed to generate tokens' }, error instanceof Error ? error : undefined);
+        }
+    }
+    /** Generate access token */
+    async generateAccessToken(payload) {
+        try {
+            this.validatePayload(payload);
+            const token = signToken(payload, this.accessSecret, this.accessExpiry, {
+                algorithm: 'HS256',
+            });
+            return token;
+        }
+        catch (error) {
+            if (error instanceof BadRequestError || error instanceof ValidationError)
+                throw error;
+            throw new BadRequestError({ reason: 'Failed to generate access token' }, error instanceof Error ? error : undefined);
+        }
+    }
+    /** Generate refresh token */
+    async generateRefreshToken(payload) {
+        try {
+            this.validatePayload(payload);
+            const token = signToken(payload, this.refreshSecret, this.refreshExpiry, {
+                algorithm: 'HS256',
+            });
+            return token;
+        }
+        catch (error) {
+            if (error instanceof BadRequestError || error instanceof ValidationError)
+                throw error;
+            throw new BadRequestError({ reason: 'Failed to generate refresh token' }, error instanceof Error ? error : undefined);
+        }
+    }
+    /** Verify access token */
+    async verifyAccessToken(token) {
+        return this.verifyTokenWithCache(token, this.accessSecret, 'access');
+    }
+    /** Verify refresh token */
+    async verifyRefreshToken(token) {
+        return this.verifyTokenWithCache(token, this.refreshSecret, 'refresh');
+    }
+    /** Decode token without verification */
+    decodeToken(token, complete = false) {
+        if (!token || typeof token !== 'string')
+            return null;
+        return jwt.decode(token, { complete });
+    }
+    /** Extract token from Authorization header */
+    extractTokenFromHeader(authHeader) {
+        if (!authHeader || typeof authHeader !== 'string')
+            return null;
+        const parts = authHeader.split(' ');
+        if (parts.length !== 2 || parts[0] !== 'Bearer')
+            return null;
+        return parts[1];
+    }
+    /** Validate token without throwing exceptions */
+    validateToken(token, secret) {
+        if (!token || typeof token !== 'string')
+            return false;
+        return safeVerifyToken(token, secret).valid;
+    }
+    /** Rotate refresh token */
+    async rotateRefreshToken(oldToken) {
+        if (!oldToken || typeof oldToken !== 'string') {
+            throw new ValidationError({
+                reason: 'Old refresh token must be a non-empty string',
+            });
+        }
+        const decoded = await this.verifyRefreshToken(oldToken);
+        const payload = { ...decoded };
+        delete payload.iat;
+        delete payload.exp;
+        const newToken = signToken(payload, this.refreshSecret, this.refreshExpiry);
+        return newToken;
+    }
+    /** Check if token is expired */
+    isTokenExpired(token) {
+        try {
+            const decoded = this.decodeToken(token);
+            if (!decoded || !decoded.exp)
+                return true;
+            return decoded.exp < Math.floor(Date.now() / 1000);
+        }
+        catch {
+            return true;
+        }
+    }
+    /** Get token expiration date */
+    getTokenExpiration(token) {
+        try {
+            const decoded = this.decodeToken(token);
+            if (!decoded || !decoded.exp)
+                return null;
+            return new Date(decoded.exp * 1000);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Clear token cache */
+    clearCache() {
+        this.cache?.clear();
+    }
+    /** Get cache statistics */
+    getCacheStats() {
+        if (!this.cache)
+            return null;
+        return { size: -1, maxSize: this.cache.maxSize };
+    }
+    /** Private helper methods */
+    validatePayload(payload) {
+        if (!payload || typeof payload !== 'object') {
+            throw new ValidationError({
+                reason: 'Payload must be a non-null object',
+            });
+        }
+        if (Object.keys(payload).length === 0) {
+            throw new ValidationError({ reason: 'Payload cannot be empty' });
+        }
+    }
+    async verifyTokenWithCache(token, secret, type) {
+        if (!token || typeof token !== 'string') {
+            throw new ValidationError({
+                reason: `${type} token must be a non-empty string`,
+            });
+        }
+        const cacheKey = `${type}_${token}`;
+        if (this.cache) {
+            const cached = this.cache.get(cacheKey);
+            if (cached && Date.now() - cached.timestamp <= this.cacheTTL) {
+                if (!cached.valid)
+                    throw new UnauthorizedError({
+                        reason: `${type} token is invalid or expired`,
+                    });
+                return cached.payload;
+            }
+        }
+        const { valid, payload, error } = safeVerifyToken(token, secret);
+        if (!valid || !payload || typeof payload === 'string') {
+            this.cache?.set(cacheKey, {
+                valid: false,
+                payload: {},
+                timestamp: Date.now(),
+            });
+            throw new UnauthorizedError({
+                reason: `${type} token is invalid or expired`,
+                cause: error,
+            });
+        }
+        this.cache?.set(cacheKey, { valid: true, payload, timestamp: Date.now() });
+        return payload;
+    }
+}

package/packages/security/dist/esm/core/jwt/parseDuration.d.ts

@@ -0,0 +1 @@
+export declare function parseDuration(input: string | number): number;

package/packages/security/dist/esm/core/jwt/parseDuration.js

@@ -0,0 +1,27 @@
+import { ValidationError } from '@naman_deep_singh/errors-utils';
+const TIME_UNITS = {
+    s: 1,
+    m: 60,
+    h: 3600,
+    d: 86400,
+    w: 604800,
+};
+export function parseDuration(input) {
+    if (typeof input === 'number')
+        return input;
+    const regex = /(\d+)\s*(s|m|h|d|w)/gi;
+    let totalSeconds = 0;
+    let match;
+    while ((match = regex.exec(input)) !== null) {
+        const value = Number.parseInt(match[1], 10);
+        const unit = match[2].toLowerCase();
+        if (!TIME_UNITS[unit]) {
+            throw new ValidationError({ reason: `Invalid time unit: ${unit}` });
+        }
+        totalSeconds += value * TIME_UNITS[unit];
+    }
+    if (totalSeconds === 0) {
+        throw new ValidationError({ reason: `Invalid expiry format: "${input}"` });
+    }
+    return totalSeconds;
+}

package/packages/security/dist/esm/core/jwt/signToken.d.ts

@@ -0,0 +1,2 @@
+import { type Secret, type SignOptions } from 'jsonwebtoken';
+export declare const signToken: (payload: Record<string, unknown>, secret: Secret, expiresIn?: string | number, options?: SignOptions) => string;

package/packages/security/dist/esm/core/jwt/signToken.js

@@ -0,0 +1,23 @@
+import { ValidationError } from '@naman_deep_singh/errors-utils';
+import { sign } from 'jsonwebtoken';
+import { parseDuration } from './parseDuration';
+function getExpiryTimestamp(seconds) {
+    return Math.floor(Date.now() / 1000) + seconds;
+}
+export const signToken = (payload, secret, expiresIn = '1h', options = {}) => {
+    const seconds = parseDuration(expiresIn);
+    if (!seconds || seconds < 10) {
+        throw new ValidationError({ reason: 'Token expiry too small' });
+    }
+    const tokenPayload = {
+        ...payload,
+    };
+    if (!('exp' in payload))
+        tokenPayload.exp = getExpiryTimestamp(seconds);
+    if (!('iat' in payload))
+        tokenPayload.iat = Math.floor(Date.now() / 1000);
+    return sign(tokenPayload, secret, {
+        algorithm: 'HS256',
+        ...options,
+    });
+};

package/packages/security/dist/esm/core/jwt/types.d.ts

@@ -0,0 +1,22 @@
+import type { JwtPayload } from 'jsonwebtoken';
+export interface AccessTokenBrand {
+    readonly access: unique symbol;
+}
+export interface RefreshTokenBrand {
+    readonly refresh: unique symbol;
+}
+export type AccessToken = string & AccessTokenBrand;
+export type RefreshToken = string & RefreshTokenBrand;
+export interface TokenPair {
+    accessToken: AccessToken;
+    refreshToken: RefreshToken;
+}
+export interface VerificationResult<T = JwtPayload> {
+    valid: boolean;
+    payload?: T | string;
+    error?: Error;
+}
+export interface TokenValidationOptions {
+    ignoreExpiration?: boolean;
+    ignoreIssuedAt?: boolean;
+}

package/packages/security/dist/esm/core/jwt/types.js

@@ -0,0 +1 @@
+export {};

package/packages/security/dist/esm/core/jwt/validateToken.d.ts

@@ -0,0 +1,16 @@
+import type { JwtPayload } from 'jsonwebtoken';
+export interface TokenRequirements {
+    requiredFields?: string[];
+    forbiddenFields?: string[];
+    validateTypes?: Record<string, 'string' | 'number' | 'boolean'>;
+}
+/**
+ * Validates a JWT payload according to the provided rules.
+ * Throws ValidationError if validation fails.
+ */
+export declare function validateTokenPayload(payload: Record<string, unknown>, rules?: TokenRequirements): void;
+/**
+ * Checks if a JWT payload is expired.
+ * Returns true if expired or missing 'exp'.
+ */
+export declare function isTokenExpired(payload: JwtPayload): boolean;

package/packages/security/dist/esm/core/jwt/validateToken.js

@@ -0,0 +1,42 @@
+import { ValidationError } from '@naman_deep_singh/errors-utils';
+/**
+ * Validates a JWT payload according to the provided rules.
+ * Throws ValidationError if validation fails.
+ */
+export function validateTokenPayload(payload, rules = { requiredFields: ['exp', 'iat'] }) {
+    const { requiredFields = [], forbiddenFields = [], validateTypes = {}, } = rules;
+    // 1. Required fields
+    for (const field of requiredFields) {
+        if (!(field in payload)) {
+            throw new ValidationError({
+                reason: `Missing required field: ${field}`,
+            });
+        }
+    }
+    // 2. Forbidden fields
+    for (const field of forbiddenFields) {
+        if (field in payload) {
+            throw new ValidationError({
+                reason: `Forbidden field in token: ${field}`,
+            });
+        }
+    }
+    // 3. Type validation
+    for (const key in validateTypes) {
+        const expectedType = validateTypes[key];
+        if (key in payload && typeof payload[key] !== expectedType) {
+            throw new ValidationError({
+                reason: `Invalid type for ${key}. Expected ${expectedType}, got ${typeof payload[key]}`,
+            });
+        }
+    }
+}
+/**
+ * Checks if a JWT payload is expired.
+ * Returns true if expired or missing 'exp'.
+ */
+export function isTokenExpired(payload) {
+    if (!payload.exp)
+        return true;
+    return Date.now() >= payload.exp * 1000;
+}

package/packages/security/dist/esm/core/jwt/verify.d.ts

@@ -0,0 +1,18 @@
+import { type JwtPayload, type Secret, type VerifyOptions } from 'jsonwebtoken';
+import type { VerificationResult } from './types';
+/**
+ * Verify token (throws UnauthorizedError if invalid or expired)
+ */
+export declare const verifyToken: (token: string, secret: Secret) => string | JwtPayload;
+/**
+ * Verify token with options
+ */
+export declare const verifyTokenWithOptions: (token: string, secret: Secret, options?: VerifyOptions) => string | JwtPayload;
+/**
+ * Safe verify — never throws, returns structured result with UnauthorizedError on failure
+ */
+export declare const safeVerifyToken: (token: string, secret: Secret) => VerificationResult;
+/**
+ * Safe verify with options — never throws, returns structured result with UnauthorizedError on failure
+ */
+export declare const safeVerifyTokenWithOptions: (token: string, secret: Secret, options?: VerifyOptions) => VerificationResult;

package/packages/security/dist/esm/core/jwt/verify.js

@@ -0,0 +1,82 @@
+import { UnauthorizedError } from '@naman_deep_singh/errors-utils';
+import { verify, } from 'jsonwebtoken';
+/**
+ * Verify token (throws UnauthorizedError if invalid or expired)
+ */
+export const verifyToken = (token, secret) => {
+    try {
+        return verify(token, secret);
+    }
+    catch (error) {
+        if (error.name === 'TokenExpiredError') {
+            throw new UnauthorizedError({ reason: 'Token has expired' }, error);
+        }
+        if (error.name === 'JsonWebTokenError') {
+            throw new UnauthorizedError({ reason: 'Invalid token' }, error);
+        }
+        throw new UnauthorizedError({ reason: 'Failed to verify token' }, error);
+    }
+};
+/**
+ * Verify token with options
+ */
+export const verifyTokenWithOptions = (token, secret, options = {}) => {
+    try {
+        return verify(token, secret, options);
+    }
+    catch (error) {
+        if (error.name === 'TokenExpiredError') {
+            throw new UnauthorizedError({ reason: 'Token has expired' }, error);
+        }
+        if (error.name === 'JsonWebTokenError') {
+            throw new UnauthorizedError({ reason: 'Invalid token' }, error);
+        }
+        throw new UnauthorizedError({ reason: 'Failed to verify token' }, error);
+    }
+};
+/**
+ * Safe verify — never throws, returns structured result with UnauthorizedError on failure
+ */
+export const safeVerifyToken = (token, secret) => {
+    try {
+        const decoded = verify(token, secret);
+        return { valid: true, payload: decoded };
+    }
+    catch (error) {
+        let wrappedError;
+        if (error.name === 'TokenExpiredError') {
+            wrappedError = new UnauthorizedError({ reason: 'Token has expired' }, error);
+        }
+        else if (error.name === 'JsonWebTokenError') {
+            wrappedError = new UnauthorizedError({ reason: 'Invalid token' }, error);
+        }
+        else {
+            wrappedError = new UnauthorizedError({ reason: 'Failed to verify token' }, error);
+        }
+        return { valid: false, error: wrappedError };
+    }
+};
+/**
+ * Safe verify with options — never throws, returns structured result with UnauthorizedError on failure
+ */
+export const safeVerifyTokenWithOptions = (token, secret, options = {}) => {
+    try {
+        const decoded = verify(token, secret, options);
+        return { valid: true, payload: decoded };
+    }
+    catch (error) {
+        let wrappedError;
+        if (error.name === 'TokenExpiredError') {
+            wrappedError = new UnauthorizedError({ reason: 'Token has expired' }, error instanceof Error ? error : undefined);
+        }
+        else if (error.name === 'JsonWebTokenError') {
+            wrappedError = new UnauthorizedError({
+                reason: 'Invalid token',
+            }, error instanceof Error ? error : undefined);
+        }
+        else {
+            wrappedError = new UnauthorizedError({ reason: 'Failed to verify token' }, error instanceof Error ? error : undefined);
+        }
+        return { valid: false, error: wrappedError };
+    }
+};

package/packages/security/dist/esm/core/password/hash.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Hash a password asynchronously using bcrypt.
+ */
+export declare const hashPassword: (password: string, saltRounds?: number) => Promise<string>;
+export declare function hashPasswordWithPepper(password: string, pepper: string): Promise<string>;
+/**
+ * Hash a password synchronously using bcrypt.
+ */
+export declare const hashPasswordSync: (password: string, saltRounds?: number) => string;
+export declare function hashPasswordWithPepperSync(password: string, pepper: string): string;

package/packages/security/dist/esm/core/password/hash.js

@@ -0,0 +1,35 @@
+import { InternalServerError } from '@naman_deep_singh/errors-utils';
+import bcrypt from 'bcryptjs';
+import { ensureValidPassword } from './utils';
+/**
+ * Hash a password asynchronously using bcrypt.
+ */
+export const hashPassword = async (password, saltRounds = 10) => {
+    try {
+        ensureValidPassword(password);
+        const salt = await bcrypt.genSalt(saltRounds);
+        return bcrypt.hash(password, salt);
+    }
+    catch (error) {
+        throw new InternalServerError({ reason: 'Password hashing failed' }, error instanceof Error ? error : undefined);
+    }
+};
+export function hashPasswordWithPepper(password, pepper) {
+    return hashPassword(password + pepper);
+}
+/**
+ * Hash a password synchronously using bcrypt.
+ */
+export const hashPasswordSync = (password, saltRounds = 10) => {
+    try {
+        ensureValidPassword(password);
+        const salt = bcrypt.genSaltSync(saltRounds);
+        return bcrypt.hashSync(password, salt);
+    }
+    catch (error) {
+        throw new InternalServerError({ reason: 'Password hashing failed' }, error instanceof Error ? error : undefined);
+    }
+};
+export function hashPasswordWithPepperSync(password, pepper) {
+    return hashPasswordSync(password + pepper);
+}

package/packages/security/dist/esm/core/password/index.d.ts

@@ -0,0 +1,3 @@
+export * from './hash';
+export * from './strength';
+export * from './verify';

package/packages/security/dist/esm/core/password/index.js

@@ -0,0 +1,3 @@
+export * from './hash';
+export * from './strength';
+export * from './verify';

package/packages/security/dist/esm/core/password/passwordManager.d.ts

@@ -0,0 +1,29 @@
+import type { HashedPassword, IPasswordManager, PasswordConfig, PasswordStrength, PasswordValidationResult } from '../../interfaces/password.interface';
+export declare class PasswordManager implements IPasswordManager {
+    private defaultConfig;
+    constructor(config?: PasswordConfig);
+    /**
+     * Hash a password asynchronously using bcrypt
+     */
+    hash(password: string, salt?: string): Promise<HashedPassword>;
+    /**
+     * Verify password against hash and salt
+     */
+    verify(password: string, hash: string, salt: string): Promise<boolean>;
+    /**
+     * Generate a random password
+     */
+    generate(length?: number, options?: PasswordConfig): string;
+    /**
+     * Validate password against configuration
+     */
+    validate(password: string, config?: PasswordConfig): PasswordValidationResult;
+    /**
+     * Check password strength
+     */
+    checkStrength(password: string): PasswordStrength;
+    /**
+     * Check if password hash needs upgrade (saltRounds change)
+     */
+    needsUpgrade(_hash: string, _currentConfig: PasswordConfig): boolean;
+}