Convert the project to typescript and improve typescript

This changes convert the project to typescript to address several issues. It also simplify the interface a bit by conveying to a callback pattern of `request`, `token` and `callback` in the `isRevoked` and `secret` functions. Removes also the feature of changing the output for the decoded token, `userProperty`, `requestProperty` and `resultProperty`. The middleware puts the decoded token always on `req.auth`. Changes everything to use promises.
auth0 · Apr 20, 2022 · 2b43ccb · 2b43ccb
1 parent ba0c154
commit 2b43ccb
Show file tree

Hide file tree

Showing 19 changed files with 8,038 additions and 2,047 deletions.
diff --git a/.eslintrc b/.eslintrc
@@ -0,0 +1,17 @@
+
+{
+  "root": true,
+  "parser": "@typescript-eslint/parser",
+  "plugins": [
+    "@typescript-eslint"
+  ],
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/eslint-recommended",
+    "plugin:@typescript-eslint/recommended"
+  ],
+  "rules": {
+    "@typescript-eslint/no-namespace": "off"
+  },
+  "ignorePatterns": ["*.js"]
+}
diff --git a/.gitignore b/.gitignore
@@ -1,2 +1,3 @@
 .DS_Store
 node_modules/*
+dist/*
diff --git a/.prettierrc b/.prettierrc
@@ -0,0 +1,4 @@
+{
+  "tabWidth": 2,
+  "useTabs": false
+}
diff --git a/README.md b/README.md
@@ -15,31 +15,36 @@ $ npm install express-jwt
 Basic usage using an HS256 secret:
 
 ```javascript
-var jwt = require('express-jwt');
-
-app.get('/protected',
-  jwt({ secret: 'shhhhhhared-secret', algorithms: ['HS256'] }),
-  function(req, res) {
-    if (!req.user.admin) return res.sendStatus(401);
+var { expressjwt: jwt } = require("express-jwt");
+// or ES6
+// import { expressjwt, ExpressJwtRequest } from "express-jwt";
+
+app.get(
+  "/protected",
+  jwt({ secret: "shhhhhhared-secret", algorithms: ["HS256"] }),
+  function (req, res) {
+    if (!req.auth.admin) return res.sendStatus(401);
     res.sendStatus(200);
-  });
+  }
+);
 ```
 
-The decoded JWT payload is available on the request via the `user` property. This can be configured using the `requestProperty` option ([see below](#retrieving-the-decoded-payload)).
+The decoded JWT payload is available on the request via the `auth` property.
 
 > The default behavior of the module is to extract the JWT from the `Authorization` header as an [OAuth2 Bearer token](https://oauth.net/2/bearer-tokens/).
 
 ### Required Parameters
+
 The `algorithms` parameter is required to prevent potential downgrade attacks when providing third party libraries as **secrets**.
 
 :warning: **Do not mix symmetric and asymmetric (ie HS256/RS256) algorithms**: Mixing algorithms without further validation can potentially result in downgrade vulnerabilities.
 
 ```javascript
 jwt({
-  secret: 'shhhhhhared-secret',
-  algorithms: ['HS256']
+  secret: "shhhhhhared-secret",
+  algorithms: ["HS256"],
   //algorithms: ['RS256']
-})
+});
 ```
 
 ### Additional Options
@@ -48,26 +53,33 @@ You can specify audience and/or issuer as well, which is highly recommended for
 
 ```javascript
 jwt({
-  secret: 'shhhhhhared-secret',
-  audience: 'http://myapi/protected',
-  issuer: 'http://issuer',
-  algorithms: ['HS256']
-})
+  secret: "shhhhhhared-secret",
+  audience: "http://myapi/protected",
+  issuer: "http://issuer",
+  algorithms: ["HS256"],
+});
 ```
 
 > If the JWT has an expiration (`exp`), it will be checked.
 
 If you are using a base64 URL-encoded secret, pass a `Buffer` with `base64` encoding as the secret instead of a string:
 
 ```javascript
-jwt({ secret: Buffer.from('shhhhhhared-secret', 'base64'),
-      algorithms: ['RS256'] })
+jwt({
+  secret: Buffer.from("shhhhhhared-secret", "base64"),
+  algorithms: ["RS256"],
+});
 ```
 
 Optionally you can make some paths unprotected as follows:
 
 ```javascript
-app.use(jwt({ secret: 'shhhhhhared-secret', algorithms: ['HS256']}).unless({path: ['/token']}));
+app.use(
+  jwt({
+    secret: "shhhhhhared-secret",
+    algorithms: ["HS256"],
+  }).unless({ path: ["/token"] })
+);
 ```
 
 This is especially useful when applying to multiple routes. In the example above, `path` can be a string, a regexp, or an array of any of those.
@@ -77,27 +89,10 @@ This is especially useful when applying to multiple routes. In the example above
 This module also support tokens signed with public/private key pairs. Instead of a secret, you can specify a Buffer with the public key
 
 ```javascript
-var publicKey = fs.readFileSync('/path/to/public.pub');
-jwt({ secret: publicKey, algorithms: ['RS256'] });
+var publicKey = fs.readFileSync("/path/to/public.pub");
+jwt({ secret: publicKey, algorithms: ["RS256"] });
 ```
 
-### Retrieving the Decoded Payload
-
-By default, the decoded token is attached to `req.user` but can be configured with the `requestProperty` option.
-
-
-```javascript
-jwt({ secret: publicKey, algorithms: ['RS256'], requestProperty: 'auth' });
-```
-
-The token can also be attached to the `result` object with the `resultProperty` option. This option will override any `requestProperty`.
-
-```javascript
-jwt({ secret: publicKey, algorithms: ['RS256'], resultProperty: 'locals.user' });
-```
-
-Both `resultProperty` and `requestProperty` utilize [lodash.set](https://lodash.com/docs/4.17.15#set) and will accept nested property paths.
-
 ### Customizing Token Location
 
 A custom function for extracting the token from a request can be specified with
@@ -106,89 +101,94 @@ query parameter or a cookie. You can throw an error in this function and it will
 be handled by `express-jwt`.
 
 ```javascript
-app.use(jwt({
-  secret: 'hello world !',
-  algorithms: ['HS256'],
-  credentialsRequired: false,
-  getToken: function fromHeaderOrQuerystring (req) {
-    if (req.headers.authorization && req.headers.authorization.split(' ')[0] === 'Bearer') {
-        return req.headers.authorization.split(' ')[1];
-    } else if (req.query && req.query.token) {
-      return req.query.token;
-    }
-    return null;
-  }
-}));
+app.use(
+  jwt({
+    secret: "hello world !",
+    algorithms: ["HS256"],
+    credentialsRequired: false,
+    getToken: function fromHeaderOrQuerystring(req) {
+      if (
+        req.headers.authorization &&
+        req.headers.authorization.split(" ")[0] === "Bearer"
+      ) {
+        return req.headers.authorization.split(" ")[1];
+      } else if (req.query && req.query.token) {
+        return req.query.token;
+      }
+      return null;
+    },
+  })
+);
 ```
 
 ### Multi-tenancy
 
 If you are developing an application in which the secret used to sign tokens is not static, you can provide a callback function as the `secret` parameter. The function has the signature: `function(req, payload, done)`:
-* `req` (`Object`) - The express `request` object.
-* `payload` (`Object`) - An object with the JWT claims.
-* `done` (`Function`) - A function with signature `function(err, secret)` to be invoked when the secret is retrieved.
-  * `err` (`Any`) - The error that occurred.
-  * `secret` (`String`) - The secret to use to verify the JWT.
+
+- `req` (`Object`) - The express `request` object.
+- `payload` (`Object`) - An object with the JWT claims.
+- `done` (`Function`) - A function with signature `function(err, secret)` to be invoked when the secret is retrieved.
+  - `err` (`Any`) - The error that occurred.
+  - `secret` (`String`) - The secret to use to verify the JWT.
 
 For example, if the secret varies based on the [JWT issuer](http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html#issDef):
 
 ```javascript
-var jwt = require('express-jwt');
-var data = require('./data');
-var utilities = require('./utilities');
-
-var secretCallback = function(req, payload, done){
-  var issuer = payload.iss;
-
-  data.getTenantByIdentifier(issuer, function(err, tenant){
-    if (err) { return done(err); }
-    if (!tenant) { return done(new Error('missing_secret')); }
-
-    var secret = utilities.decrypt(tenant.secret);
-    done(null, secret);
-  });
+var jwt = require("express-jwt");
+var data = require("./data");
+var utilities = require("./utilities");
+
+var getSecret = async function (req, token) {
+  const issuer = token.payload.iss;
+  const tenant = await data.getTenantByIdentifier(issuer);
+  if (!tenant) {
+    throw new Error("missing_secret");
+  }
+  return utilities.decrypt(tenant.secret);
 };
 
-app.get('/protected',
-  jwt({ secret: secretCallback, algorithms: ['HS256'] }),
-  function(req, res) {
-    if (!req.user.admin) return res.sendStatus(401);
+app.get(
+  "/protected",
+  jwt({ secret: getSecret, algorithms: ["HS256"] }),
+  function (req, res) {
+    if (!req.auth.admin) return res.sendStatus(401);
     res.sendStatus(200);
-  });
+  }
+);
 ```
 
 ### Revoked tokens
+
 It is possible that some tokens will need to be revoked so they cannot be used any longer. You can provide a function as the `isRevoked` option. The signature of the function is `function(req, payload, done)`:
-* `req` (`Object`) - The express `request` object.
-* `payload` (`Object`) - An object with the JWT claims.
-* `done` (`Function`) - A function with signature `function(err, revoked)` to be invoked once the check to see if the token is revoked or not is complete.
-  * `err` (`Any`) - The error that occurred.
-  * `revoked` (`Boolean`) - `true` if the JWT is revoked, `false` otherwise.
+
+- `req` (`Object`) - The express `request` object.
+- `payload` (`Object`) - An object with the JWT claims.
+- `done` (`Function`) - A function with signature `function(err, revoked)` to be invoked once the check to see if the token is revoked or not is complete.
+  - `err` (`Any`) - The error that occurred.
+  - `revoked` (`Boolean`) - `true` if the JWT is revoked, `false` otherwise.
 
 For example, if the `(iss, jti)` claim pair is used to identify a JWT:
+
 ```javascript
-var jwt = require('express-jwt');
-var data = require('./data');
-var utilities = require('./utilities');
-
-var isRevokedCallback = function(req, payload, done){
-  var issuer = payload.iss;
-  var tokenId = payload.jti;
-
-  data.getRevokedToken(issuer, tokenId, function(err, token){
-    if (err) { return done(err); }
-    return done(null, !!token);
-  });
+const jwt = require("express-jwt");
+const data = require("./data");
+
+const isRevokedCallback = async (req, token) => {
+  const issuer = token.payload.iss;
+  const tokenId = token.payload.jti;
+  const token = await data.getRevokedToken(issuer, tokenId);
+  return token !== "undefined";
 };
 
-app.get('/protected',
+app.get(
+  "/protected",
   jwt({
-    secret: 'shhhhhhared-secret',
-    algorithms: ['HS256'],
-    isRevoked: isRevokedCallback
+    secret: "shhhhhhared-secret",
+    algorithms: ["HS256"],
+    isRevoked: isRevokedCallback,
   }),
-  function(req, res) {
-    if (!req.user.admin) return res.sendStatus(401);
+  function (req, res) {
+    if (!req.auth.admin) return res.sendStatus(401);
     res.sendStatus(200);
   }
 );
@@ -200,20 +200,39 @@ The default behavior is to throw an error when the token is invalid, so you can
 
 ```javascript
 app.use(function (err, req, res, next) {
-  if (err.name === 'UnauthorizedError') {
-    res.status(401).send('invalid token...');
+  if (err.name === "UnauthorizedError") {
+    res.status(401).send("invalid token...");
   }
 });
 ```
 
 You might want to use this module to identify registered users while still providing access to unregistered users. You can do this by using the option `credentialsRequired`:
 
 ```javascript
-app.use(jwt({
-  secret: 'hello world !',
-  algorithms: ['HS256'],
-  credentialsRequired: false
-}));
+app.use(
+  jwt({
+    secret: "hello world !",
+    algorithms: ["HS256"],
+    credentialsRequired: false,
+  })
+);
+```
+
+## Typescript
+
+An `ExpressJwtRequest` type is provided which extends `express.Request` with the `auth` property.
+
+```typescript
+import { expressjwt, ExpressJwtRequest } from "express-jwt";
+
+app.get(
+  "/protected",
+  expressjwt({ secret: "shhhhhhared-secret", algorithms: ["HS256"] }),
+  function (req: ExpressJwtRequest, res: express.Response) {
+    if (!req.auth.admin) return res.sendStatus(401);
+    res.sendStatus(200);
+  }
+);
 ```
 
 ## Related Modules
@@ -229,6 +248,7 @@ $ npm test
 ```
 
 ## Contributors
+
 Check them out [here](https://github.com/auth0/express-jwt/graphs/contributors)
 
 ## Issue Reporting

diff --git a/lib/errors/UnauthorizedError.js b/lib/errors/UnauthorizedError.js