@smart-auth/express

Express middleware for the Smart Auth SDK ecosystem.

What it does

@smart-auth/express provides everything you need for JWT authentication on your Express backend — verify tokens, issue token pairs, handle refresh rotation, and enforce role-based access control. One import, full auth backend.

Features

• 🔐 verifyAccessToken() — Middleware that validates JWTs and attaches user data to req.auth
• 🎫 createTokenIssuer() — Issue access + refresh token pairs with configurable expiry
• 🔄 createRefreshHandler() — Refresh token rotation with user data reload
• 🛡️ authorize() — Role-based access control (RBAC) with permissions support
• 🍪 Cookie helpers — setTokenCookies() / clearTokenCookies() with secure defaults
• 📦 Zero browser code — Server-only, no client bundle pollution

Installation

npm install @smart-auth/express

Quick Start

import express from 'express';
import {
  createTokenIssuer,
  verifyAccessToken,
  authorize,
  createRefreshHandler,
} from '@smart-auth/express';

const app = express();
app.use(express.json());

// Setup token issuer
const issuer = createTokenIssuer({
  accessTokenSecret: process.env.JWT_ACCESS_SECRET!,
  refreshTokenSecret: process.env.JWT_REFRESH_SECRET!,
  accessTokenExpiry: '15m',
  refreshTokenExpiry: '7d',
});

// Login
app.post('/auth/login', async (req, res) => {
  const user = await authenticate(req.body); // your logic
  const tokens = issuer.issueTokenPair({
    sub: user.id,
    email: user.email,
    roles: user.roles,
  });
  res.json({ ...tokens, user });
});

// Protected route
app.get(
  '/api/profile',
  verifyAccessToken({ secret: process.env.JWT_ACCESS_SECRET! }),
  (req, res) => {
    res.json({ userId: req.auth.userId });
  },
);

// Admin-only route (RBAC)
app.delete(
  '/api/users/:id',
  verifyAccessToken({ secret: process.env.JWT_ACCESS_SECRET! }),
  authorize(['admin']),
  (req, res) => {
    // Only admins reach here
  },
);

// Refresh endpoint
const refreshHandler = createRefreshHandler({ issuer });
app.post('/auth/refresh', refreshHandler.middleware);

Part of Smart Auth SDK

| Package | Description | | ---------------------------------------------------------------------- | --------------------------- | | @smart-auth/core | Core auth engine (frontend) | | @smart-auth/react | React Provider & hooks | | @smart-auth/axios | Axios interceptors | | @smart-auth/fetch | Fetch wrapper |

License

MIT © Durjoy Ghosh