1import jwt from 'jsonwebtoken';
2 
3function generateTokenPair(userId: string, roles: string[]) {
4  const accessToken = jwt.sign(
5    { sub: userId, roles, type: 'access' },
6    process.env.JWT_SECRET!,
7    {
8      algorithm: 'HS256',        // Explicitly set — never allow 'none'
ALWAYS explicitly set algorithm — never let the token specify its own
9      expiresIn: '15m',          // Short-lived access token
10      issuer: 'api.example.com', // Prevents reuse from other services
11      audience: 'app.example.com',
12    }
13  );
14 
15  // Refresh token: opaque random string stored in DB (revocable)
16  const refreshToken = crypto.randomBytes(32).toString('hex');
17  return { accessToken, refreshToken };
18}
19 
20async function verifyAccessToken(token: string) {
Explicit algorithm whitelist prevents algorithm confusion attacks
21  const payload = jwt.verify(token, process.env.JWT_SECRET!, {
22    algorithms: ['HS256'], // ← Explicit whitelist — critical
23    issuer: 'api.example.com',
24    audience: 'app.example.com',
25  });
26 
27  // Optional: check revocation list for compromised tokens
28  const jti = (payload as jwt.JwtPayload).jti;
29  if (jti && await redis.exists(`revoked:${jti}`)) {
30    throw new Error('Token revoked');
31  }
32 
33  return payload as jwt.JwtPayload;
localStorage is readable by XSS; HttpOnly cookies are not
34}
35 
36// Store access token: memory/session storage (not localStorage — XSS risk)
37// Store refresh token: HttpOnly cookie (inaccessible from JS)

1// RBAC + Row-Level Security (covers 90% of use cases)
2 
3type Role = 'admin' | 'editor' | 'viewer';
4type Permission = 'read' | 'write' | 'delete' | 'manage_users';
5 
6const ROLE_PERMISSIONS: Record<Role, Permission[]> = {
7  admin: ['read', 'write', 'delete', 'manage_users'],
8  editor: ['read', 'write'],
9  viewer: ['read'],
10};
11 
12// RBAC: coarse-grained role check
RBAC check is O(1) — fast enough to run on every request
13function can(user: User, permission: Permission): boolean {
14  return ROLE_PERMISSIONS[user.role]?.includes(permission) ?? false;
15}
16 
17// Row-level: verify resource ownership (ALWAYS required alongside RBAC)
Row-level security: NEVER skip ownership verification
18async function canEditDocument(userId: string, documentId: string) {
19  const doc = await db.query.documents.findFirst({
20    where: eq(documents.id, documentId),
21    columns: { ownerId: true, orgId: true },
22  });
23  if (doc?.ownerId === userId) return true;  // Owner can always edit
24 
25  const user = await db.query.users.findFirst({ where: eq(users.id, userId) });
26  // Admin in same org can edit
27  if (user?.role === 'admin' && user?.orgId === doc?.orgId) return true;
28  return false;
29}
30 
31// Authorization middleware
32function requirePermission(permission: Permission) {
33  return async (req: Request, res: Response, next: NextFunction) => {
34    if (!req.user) return res.status(401).json({ error: 'Unauthorized' });
35    if (!can(req.user, permission)) {
36      return res.status(403).json({ error: 'Forbidden' });
37    }
38    next();
39  };
40}