limes - npm Package Compare versions

Comparing version 0.4.0 to 0.5.0

lib/Limes.js

@@ -28,3 +28,3 @@ 'use strict';
 Limes.prototype.issueTokenFor = function (subject, payload) {
-  if (!subject && subject !== '') {
+  if (!subject) {
     throw new Error('Subject is missing.');
@@ -37,3 +37,3 @@ }
     algorithm: 'RS256',
-    expiresInMinutes: this.expiresInMinutes,
+    expiresIn: this.expiresInMinutes * 60,
     subject: subject,
@@ -45,3 +45,3 @@ issuer: this.identityProviderName
 Limes.prototype.issueTokenForAnonymous = function (payload) {
-  return this.issueTokenFor('', payload);
+  return this.issueTokenFor('anonymous', payload);
 };
@@ -62,3 +62,3 @@
   token.iss = this.identityProviderName;
-  token.sub = undefined;
+  token.sub = 'anonymous';
 
@@ -65,0 +65,0 @@ return token;

package.json

 {
   "name": "limes",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "limes authenticates users.",
@@ -17,4 +17,4 @@ "contributors": [
   "dependencies": {
-    "express-jwt": "3.0.1",
-    "jsonwebtoken": "5.0.4",
+    "express-jwt": "3.1.0",
+    "jsonwebtoken": "5.4.1",
     "middleware-flow": "0.8.0"
@@ -24,8 +24,8 @@ },
     "assertthat": "0.6.0",
-    "express": "4.13.1",
+    "express": "4.13.3",
     "grunt": "0.4.5",
-    "socket.io": "1.3.6",
-    "socket.io-client": "1.3.6",
-    "supertest": "1.0.1",
-    "tourism": "0.20.2"
+    "socket.io": "1.3.7",
+    "socket.io-client": "1.3.7",
+    "supertest": "1.1.0",
+    "tourism": "0.21.0"
   },
@@ -32,0 +32,0 @@ "repository": {

README.md

@@ -75,3 +75,3 @@ # limes
 
-Alternatively, you may transfer the token using the query string parameter `token`:
+Alternatively, you may transfer the token using the query string parameter `token`.
 
@@ -78,0 +78,0 @@ GET /foo/bar?token=<token>

test/LimesTests.js

@@ -122,3 +122,3 @@ 'use strict';
         assert.that(decodedToken.iss).is.equalTo('auth.example.com');
-        assert.that(decodedToken.sub).is.undefined();
+        assert.that(decodedToken.sub).is.equalTo('anonymous');
         assert.that(decodedToken.foo).is.equalTo('bar');
@@ -174,2 +174,15 @@ done();
     });
+
+    test('returns an error if the token contains invalid characters.', function (done) {
+      var limes = new Limes({
+        identityProviderName: 'auth.example.com',
+        privateKey: privateKey,
+        certificate: certificate
+      });
+
+      limes.verifyToken('invalid token', function (err) {
+        assert.that(err).is.not.null();
+        done();
+      });
+    });
   });
@@ -251,3 +264,3 @@
               assert.that(res.body.iss).is.equalTo('auth.example.com');
-              assert.that(res.body.sub).is.undefined();
+              assert.that(res.body.sub).is.equalTo('anonymous');
               assert.that(res.body.foo).is.equalTo('anonymous-bar');
@@ -264,3 +277,3 @@ done();
             end(function (err, res) {
-              assert.that(err).is.not.null();
+              assert.that(err).is.null();
               assert.that(res.statusCode).is.equalTo(401);
@@ -271,2 +284,14 @@ done();
 
+        test('returns 401 for tokens with invalid characters.', function (done) {
+          request(app).
+            get('/').
+            set('accept', 'application/json').
+            set('authorization', 'Bearer invalid token').
+            end(function (err, res) {
+              assert.that(err).is.null();
+              assert.that(res.statusCode).is.equalTo(401);
+              done();
+            });
+        });
+
         test('returns 401 for expired requests.', function (done) {
@@ -282,3 +307,3 @@ var expiredToken = limesInThePast.issueTokenFor('test.domain.com', {
             end(function (err, res) {
-              assert.that(err).is.not.null();
+              assert.that(err).is.null();
               assert.that(res.statusCode).is.equalTo(401);
@@ -299,3 +324,3 @@ done();
             end(function (err, res) {
-              assert.that(err).is.not.null();
+              assert.that(err).is.null();
               assert.that(res.statusCode).is.equalTo(401);
@@ -406,3 +431,3 @@ done();
               assert.that(token.iss).is.equalTo('auth.example.com');
-              assert.that(token.sub).is.undefined();
+              assert.that(token.sub).is.equalTo('anonymous');
               assert.that(token.foo).is.equalTo('anonymous-bar');
@@ -409,0 +434,0 @@ socket.disconnect();

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

33090

increased by2.5%

Lines of code

542

increased by4.23%

Worsened metrics

Number of medium supply chain risk alerts

2

increased by100%

Dependency changes

• + Addedexpress-jwt@3.1.0(transitive)

• + Addedexpress-unless@0.3.1(transitive)

• + Addedjsonwebtoken@5.4.1(transitive)

• + Addedms@0.7.3(transitive)

• - Removedexpress-jwt@3.0.1(transitive)

• - Removedexpress-unless@0.0.0(transitive)

• - Removedjsonwebtoken@5.0.4(transitive)

• Updatedexpress-jwt@3.1.0

• Updatedjsonwebtoken@5.4.1