hibna
d0d3a58907
eslint has been failing on 11 no-explicit-any errors, which kept the whole pipeline red — including the new publish job that waits on lint. The casts all worked around missing types rather than unknown shapes: - jwt: @fastify/jwt decorates the instance at runtime, so the namespace is not in FastifyInstance's type. Described the parts we call and cast through unknown once, in one place, instead of `as any` at five sites. - permissions: FastifyInstance.db is declared by the db plugin; the cast was stale and hid the real type. - paginate: the querystring schema already validates page/perPage, so the call sites now name that shape via PaginationQuery. Also dropped an unused import and an unused binding whose call is kept for its validation side effect. No behaviour change: eslint and tsc are both clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
67 lines
2.2 KiB
TypeScript
67 lines
2.2 KiB
TypeScript
import type { FastifyInstance } from 'fastify';
|
|
|
|
export interface AccessTokenPayload {
|
|
sub: string; // user id
|
|
email: string;
|
|
isSuperAdmin: boolean;
|
|
}
|
|
|
|
export interface RefreshTokenPayload {
|
|
sub: string; // user id
|
|
type: 'refresh';
|
|
}
|
|
|
|
const ACCESS_TOKEN_EXPIRY = '15m';
|
|
const REFRESH_TOKEN_EXPIRY = '7d';
|
|
|
|
type JwtSign = (payload: object, options?: { expiresIn?: string }) => string;
|
|
type JwtVerify = (token: string) => unknown;
|
|
|
|
/**
|
|
* The parts of the JWT decoration we actually call.
|
|
*
|
|
* @fastify/jwt decorates the instance at runtime and the refresh namespace is
|
|
* registered by our own auth plugin, so neither appears in FastifyInstance's
|
|
* type. Describing the shape here keeps the call sites type-checked instead of
|
|
* casting the instance to `any`, which switches checking off entirely.
|
|
*/
|
|
interface JwtDecoratedInstance {
|
|
jwt?: {
|
|
sign?: JwtSign;
|
|
verify?: JwtVerify;
|
|
refresh?: { sign?: JwtSign; verify?: JwtVerify };
|
|
jwtRefresh?: { sign?: JwtSign; verify?: JwtVerify };
|
|
};
|
|
}
|
|
|
|
/** The decorated JWT namespace, or undefined when the plugin is not loaded. */
|
|
export function getJwt(app: FastifyInstance): JwtDecoratedInstance['jwt'] {
|
|
return (app as unknown as JwtDecoratedInstance).jwt;
|
|
}
|
|
|
|
export function signAccessToken(app: FastifyInstance, payload: AccessTokenPayload): string {
|
|
const signer = getJwt(app)?.sign;
|
|
if (typeof signer !== 'function') {
|
|
throw new Error('JWT signer is not configured');
|
|
}
|
|
return signer(payload, { expiresIn: ACCESS_TOKEN_EXPIRY });
|
|
}
|
|
|
|
export function signRefreshToken(app: FastifyInstance, payload: RefreshTokenPayload): string {
|
|
const jwt = getJwt(app);
|
|
const signer = jwt?.refresh?.sign ?? jwt?.jwtRefresh?.sign;
|
|
if (typeof signer !== 'function') {
|
|
throw new Error('Refresh JWT signer is not configured');
|
|
}
|
|
return signer(payload, { expiresIn: REFRESH_TOKEN_EXPIRY });
|
|
}
|
|
|
|
export function verifyRefreshToken(app: FastifyInstance, token: string): RefreshTokenPayload {
|
|
const jwt = getJwt(app);
|
|
const verifier = jwt?.refresh?.verify ?? jwt?.jwtRefresh?.verify;
|
|
if (typeof verifier !== 'function') {
|
|
throw new Error('Refresh JWT verifier is not configured');
|
|
}
|
|
return verifier(token) as RefreshTokenPayload;
|
|
}
|