@connectedcars/jwtutils - npm Package Compare versions

Comparing version 1.0.5 to 1.0.6

package.json

 {
   "name": "@connectedcars/jwtutils",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "Zero dependency JWT encoding/decoding for Node",
   "main": "src/index.js",
+  "bin": {
+    "jwtencode": "./bin/jwtencode.js",
+    "jwtdecode": "./bin/jwtdecode.js"
+  },
   "scripts": {
-    "test": "nyc --reporter=lcov --reporter=text mocha \"src/**/*.test.js\"",
+    "test": "nyc --reporter=lcov --reporter=text mocha \"src/**/*.test.js\" \"bin/*.test.js\"",
     "coveralls": "nyc report --reporter=text-lcov | coveralls"
@@ -9,0 +13,0 @@ },

README.md

@@ -42,2 +42,4 @@ # node-jwtutils
 
+const unixNow = Math.floor(Date.now() / 1000)
+
 let jwtHeader = {
@@ -51,3 +53,3 @@ typ: 'JWT',
   aud: 'https://api.domain.tld',
-  iss: 'https://auth.domain.tld',
+  iss: 'https://jwt.io/',
   sub: '[e-mail]',
@@ -92,3 +94,3 @@ iat: unixNow,
 const pubKeys = {
-  'https://auth.domain.tld': {
+  'https://jwt.io/': {
     '1@RS256': publicKey,
@@ -120,3 +122,3 @@ 'default@RS256': publicKey // Will default to this key if the header does not have a kid
 const pubKeys = {
-  'https://auth.domain.tld': {
+  'https://jwt.io/': {
     '1@RS256': publicKey // Fx. use key from before
@@ -129,3 +131,9 @@ }
 // Register the middleware
-app.use(JwtAuthMiddleware(pubKeys, audiences))
+app.use(JwtAuthMiddleware(pubKeys, audiences, user => {
+  if (user.issuer === 'https://jwt.io/') {
+    if (!user.subject.match(/^[^@]+@domain\.tld$/)) {
+      throw new JwtVerifyError('Issuer https://jwt.io/ only allowed to have subject ending in @domain.tld')
+    }
+  }
+}))
 
@@ -166,1 +174,41 @@ // Register an error handler to return 401 errors
 ```
+
+## Command line helper utils
+
+*NOTE: Does not support nested JSON*
+
+Load private key:
+
+``` bash
+jwtencode private.pem
+```
+
+Copy/paste to stdin (Ctrl-D to end), the password line is only needed if the private key is encrypted:
+
+```
+password password-for-private-key
+{
+  "alg": "RS256",
+  "typ": "JWT",
+  "kid": "1"
+}
+{
+  "iss": "jwt.io",
+  "aud": "https://api.domain.tld",
+  "sub": "[e-mail]",
+  "iat": 1504292127,
+  "nbf": 1504292127,
+  "exp": 1598986470
+}
+````
+
+``` bash
+jwtdecode public.pem 1 RS256 https://jwt.io localhost
+```
+
+Copy/paste to stdin (Ctrl-D to end):
+
+```
+eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEifQ.eyJpc3MiOiJodHRwczovL2p3dC5pbyIsImF1ZCI6ImxvY2FsaG9zdCIsInN1YiI6InN1YmplY3RAZG9tYWluLnRsZCIsImlhdCI6MTUwNDI5MjEyNywibmJmIjoxNTA0MjkyMTI3LCJleHAiOjE1OTg5ODY0NzB9.0L5AWwUF3EleBqnQ6V0Lqa36jCccP4A7cAFHHIY1b-oE7pxCoFr8gnAOrlc16N0WUPI6O17JT79kQIPR-LjFm-BgBycBw4eEFYb8z7iXA-zqgQz4ajZXlIljJtJUBbTupbnzEiBKjEFnTxYqb-vUm-TDwTMPaYzBxqqfOrrvKlw
+````
+

src/jwtauthmiddleware.test.js

@@ -34,3 +34,4 @@ const express = require('express')
   scope: ['http://stuff', 'http://stuff2'],
-  sub: '[e-mail]'
+  sub: '[e-mail]',
+  email: '[e-mail]'
 }
@@ -44,2 +45,4 @@
 
+const audiences = ['http://localhost/']
+
 describe('jwtMiddleware', () => {
@@ -54,8 +57,10 @@ let port = 0
         '/mapped',
-        JwtAuthMiddleware(pubKeys, ['http://localhost/'], user => {
-          // Add test e-mail
-          user.eMail = '[e-mail]'
+        JwtAuthMiddleware(pubKeys, audiences, user => {
+          if (user.issuer === 'http://localhost/oauth/token') {
+            // Map claims
+            user.eMail = user.body.email
+          }
         })
       )
-      app.use('/', JwtAuthMiddleware(pubKeys, ['http://localhost/']))
+      app.use('/', JwtAuthMiddleware(pubKeys, audiences))
       app.use((err, req, res, next) => {
@@ -62,0 +67,0 @@ if (err instanceof JwtVerifyError) {

src/jwtverifyerror.js

 'use strict'
 
-function JwtVerifyError(message, innerError = null) {
+function JwtVerifyError(message, innerError) {
   this.name = 'JwtVerifyError'
   this.message = message
   this.stack = new Error().stack
-  this.innerError = innerError
+  this.innerError = innerError || null
 }
@@ -9,0 +9,0 @@ JwtVerifyError.prototype = Object.create(Error.prototype)

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

54949

increased by14.63%

Number of package files

27

increased by22.73%

Lines of code

1232

increased by19.26%

Number of lines in readme file

209

increased by29.81%

Worsened metrics

Number of low supply chain risk alerts

4

increased byInfinity%

Number of medium supply chain risk alerts

3

increased by200%

No dependency changes