atlassian-jwt - npm Package Compare versions

Comparing version 0.1.5 to 1.0.1

package.json

 {
   "name": "atlassian-jwt",
   "description": "JWT (JSON Web Token) implementation with custom Atlassian QSH claim verification",
-  "version": "0.1.5",
+  "version": "1.0.1",
   "author": "Seb Ruiz <[e-mail]>",
@@ -15,8 +15,20 @@ "repository": {
   "devDependencies": {
+    "@types/express": "^4.16.0",
+    "@types/jsuri": "^1.3.30",
+    "@types/lodash": "^4.14.116",
+    "@types/mocha": "^5.2.5",
+    "@types/node": "^10.7.1",
+    "@types/qs": "^6.5.1",
     "mocha": "^3.0.2",
     "moment": "^2.14.1",
-    "qs": "^6.2.1"
+    "qs": "^6.2.1",
+    "ts-node": "^7.0.1",
+    "tslint": "^5.11.0",
+    "typescript": "^3.0.1"
   },
   "scripts": {
-    "test": "mocha test/*.js"
+    "tsc": "tsc",
+    "lint": "tslint --project .",
+    "test": "mocha -r ts-node/register test/*.ts",
+    "build-and-publish": "npm run tsc && npm publish"
   },
@@ -31,3 +43,7 @@ "license": "MIT",
   ],
-  "main": "./index"
+  "main": "./dist/index",
+  "typings": "./dist/index",
+  "files": [
+    "dist/*"
+  ]
 }

README.md

 # atlassian-jwt
 
-![build-status](https://bitbucket-badges.atlassian.io/badge/atlassian/atlassian-jwt-js.svg)
+![build-status](https://bitbucket-badges.atlassian.io/badge/atlassian/atlassian-jwt-js.svg) 
+[![TypeScript](https://badges.frapsoft.com/typescript/code/typescript.svg?v=101)](https://github.com/ellerbrock/typescript-badges/)
 
-[JWT (JSON Web Token)](http://self-issued.info/docs/draft-jones-json-web-token.html) encoding & decoding library for node.js. Built of [jwt-simple](https://raw.githubusercontent.com/hokaccha/node-jwt-simple) and adds Atlassian's custom QSH (query string hash) claim.
+[JWT (JSON Web Token)](http://self-issued.info/docs/draft-jones-json-web-token.html) encoding & decoding 
+library for node.js. Built on [jwt-simple](https://github.com/hokaccha/node-jwt-simple) and adds support 
+for Atlassian's custom QSH (query string hash) claim.
 
-For more information on using JWT tokens with Atlassian add-ons, please read: [Understanding JWT](https://developer.atlassian.com/static/connect/docs/latest/concepts/understanding-jwt.html).
+For more information on using JWT tokens with Atlassian add-ons, please read: 
+[Understanding JWT](https://developer.atlassian.com/cloud/jira/platform/understanding-jwt/).
 
@@ -17,24 +21,21 @@ ## Install
 
-```javascript
-var jwt = require('atlassian-jwt');
-var moment = require('moment'); // time library for convenience
+```typescript
+import * as jwt from 'atlassian-jwt';
+import moment from 'moment';
 
-var now = moment().utc();
+const now = moment().utc();
 
 // Simple form of [request](https://npmjs.com/package/request) object
-var req = {
-    method: 'GET',
-    originalUrl: '/rest/resource/you/want'
-};
+const req: jwt.Request = jwt.fromMethodAndUrl('GET', '/rest/resource/you/want');
 
-var token = {
+const tokenData = {
     "iss": 'issuer-val',
     "iat": now.unix(),                      // the time the token is generated
     "exp": now.add(3, 'minutes').unix(),    // token expiry time (recommend 3 minutes after issuing)
-    "qsh": jwt.createQueryStringHash(req)   // [Query String Hash](https://developer.atlassian.com/static/connect/docs/latest/concepts/understanding-jwt.html#qsh)
+    "qsh": jwt.createQueryStringHash(req)   // [Query String Hash](https://developer.atlassian.com/cloud/jira/platform/understanding-jwt/#a-name-qsh-a-creating-a-query-string-hash)
 };
 
-var secret = 'xxx';
+const secret = 'xxx';
 
-var token = jwt.encode(token, secret);
+const token = jwt.encode(tokenData, secret);
 console.log(token);
@@ -64,4 +65,12 @@ ```
 
-`jwt.createQueryStringHash(req, checkBodyForParams, baseUrl)` - Create a QSH using the algorithm defined by [the algorithm](https://developer.atlassian.com/static/connect/docs/latest/concepts/understanding-jwt.html#qsh) 
-`jwt.createCanonicalRequest(req, checkBodyForParams, baseUrl)` - Creates a canonical request which is used to calculate the QSH for the JWT token. Prefer using #createQueryStringHash() directly
+ - `jwt.createQueryStringHash(req, checkBodyForParams, baseUrl)`  
+   Create a QSH using the algorithm defined by [the algorithm](https://developer.atlassian.com/static/connect/docs/latest/concepts/understanding-jwt.html#qsh) .
+ - `jwt.createCanonicalRequest(req, checkBodyForParams, baseUrl)`  
+   Creates a canonical request which is used to calculate the QSH for the JWT token. Prefer using `#createQueryStringHash()` directly.
+ - `jwt.fromExpressRequest(expressRequest: ExpressRequest)`  
+   Converts an Express.js Request into a `Request` object that can be used with other methods in this library.
+ - `jwt.fromMethodAndUrl(method: string, url: string)`  
+   This takes in a method and url, both as plain strings, and turns them into a `Request` object that can be used with other methods in this library.
+ - `jwt.fromMethodAndPathAndBody`  
+   This takes in a method, a url, and some form params from a request body and turns them into a `Request` object that can be used with other methods in this library.
 
@@ -77,2 +86,35 @@ ### Algorithms
 jwt.encode(payload, secret, 'HS512')
-```
+```
+
+### Migrating from 0.1.x to 1.x.x
+
+The `1.x.x` release brings some breaking changes, probably the most important change is that our methods no longer
+accept the Express.js request object as an argument but instead use our own intermediate `Request` object.
+
+A convenience method called `fromExpressRequest` has been written to ease the transition. You can use it like so:
+
+```typescript
+import * as jwt from 'atlassian-jwt';
+import { Request as ExpressRequest } from 'express';
+
+const eReq: ExpressRequest = ...;
+const qsh = jwt.createQueryStringHash(jwt.fromExpressRequest(eReq));
+```
+
+Other methods, like `fromMethodAndUrl` and `fromMethodAndPathAndBody` were written to allow easier generation of
+`Request` objects from other libraries.
+
+## Guides for developers
+
+### Publishing this library
+
+To publish this library:
+
+    npm run tsc
+    npm publish
+
+This has been combined into a single command with:
+
+    npm run build-and-publish
+
+Only the built typescript files will be published with this library.

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Number of low quality alerts

1

decreased by-50%

Number of lines in readme file

117

increased by56%

Number of low supply chain risk alerts

0

decreased by-100%

Worsened metrics

Total package byte prevSize

18313

decreased by-80.37%

Dev dependency count

12

increased by300%

Number of package files

8

decreased by-52.94%

Lines of code

338

decreased by-60.28%

Number of medium supply chain risk alerts

2

increased by100%

No dependency changes