protonfile-auth

library1.6.7jsnpmunverified

Authentication and authorization library with JWT access/refresh token model, token rotation, and instant session revocation. Current stable version 1.6.7. Released as needed. Key differentiators: in-memory cache for revocation, total data control via exported TypeORM entities, originally built as Auth0 replacement. However, not recommended for production; uses JWT with server-side session invalidation. Ships TypeScript types.

security

npm install protonfile-auth

package ↗

INSTALL

IMPORT

SIG · PROTONFILE-AUTH

protonfile-auth

securityjavascriptv1.6.7

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

AuthMiddleware

✓ import { AuthMiddleware } from 'protonfile-auth'

✗ import AuthMiddleware from 'protonfile-auth'

Named export, not default.

RefreshToken

✓ import { RefreshToken } from 'protonfile-auth'

TypeORM entity for refresh tokens, useful for direct database access.

revokeSession

✓ import { revokeSession } from 'protonfile-auth'

✗ const revokeSession = require('protonfile-auth').revokeSession

ESM-only; CJS require works but only with .default? Actually it's named export, so require works but may need destructuring.

Initialize auth, protect an Express route with AuthMiddleware, and revoke a session on logout.

import express from 'express'; import { AuthMiddleware, initAuth, revokeSession } from 'protonfile-auth'; const app = express(); // Initialize with your config (e.g., database connection, JWT secret) await initAuth({ jwtSecret: process.env.JWT_SECRET ?? '', database: { type: 'postgres', url: process.env.DATABASE_URL ?? '' }, }); // Protect routes app.get('/protected', AuthMiddleware, (req, res) => { res.json({ message: 'Authenticated', user: req.user }); }); // Revoke a session (e.g., on logout) app.post('/logout', async (req, res) => { if (req.headers.authorization) { const token = req.headers.authorization.replace('Bearer ', ''); await revokeSession(token); } res.sendStatus(200); }); app.listen(3000);

Debug

Known issues

gotchaAuthMiddleware uses an in-memory cache for revoked sessions. If the server restarts, the cache is empty and may allow recently revoked tokens until the cache repopulates from the database.

fix

After server restart, consider waiting for cache warm-up or manually loading revoked tokens from the database before accepting requests.

affects: *

breakingIn v1.6.0, the initAuth function signature changed from accepting two arguments (config, dbConnection) to a single config object with a database property.

fix

Use initAuth({ jwtSecret, database: { type, url } }) instead of initAuth({ jwtSecret }, dbConnection).

affects: >=1.6.0 <1.6.7

deprecatedThe library uses JWT as session tokens, which cannot be invalidated centrally. It mitigates by storing session state in DB, but this is not recommended for production applications.

fix

Consider using OAuth2 or a session-based solution like express-session with a secure store.

affects: *

gotchaThe refresh token is hard-coded to 7 days lifetime. There is no configuration option to change this.

fix

If you need different expiration, fork the library or modify the source code.

affects: *

Errors

Common errors & fixes

TypeError: Cannot read properties of undefined (reading 'user')

Trying to access req.user without applying AuthMiddleware.

fix

Ensure AuthMiddleware is used on the route: app.get('/protected', AuthMiddleware, handler);

Error: jwtSecret is required

Missing or undefined JWT_SECRET environment variable.

fix

Set JWT_SECRET in environment or pass it to initAuth: await initAuth({ jwtSecret: 'your-secret' });

EntityMetadataNotFoundError: No metadata for "RefreshToken"

TypeORM entities not registered. Forgot to call initAuth or export entities properly.

fix

Add RefreshToken entity to your TypeORM connection configuration if using a custom connection.

The module is ESM-only and cannot be imported with require() without .default

CommonJS require does not work for named exports directly.

fix

Use import statements or if using require, do: const { AuthMiddleware } = require('protonfile-auth'); (but ensure your project supports ESM).

Upgrade

Version history

1.6.7latest on npm

Audit

Dependencies

expressrequiredProvides Express middleware for token verification

typeormrequiredUsed for database entities and session storage

Agent activity

14 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

packageprotonfile-auth ↗