tsndr / cloudflare-worker-jwt

A lightweight JWT implementation with ZERO dependencies for Cloudflare Workers.
MIT License
649 stars 51 forks source link

JwtPayload is too lax #61

Closed Le0Developer closed 7 months ago

Le0Developer commented 8 months ago

So basically, JwtPayload<T> is pretty lax because of the [key: string]: any that is always included (see line 62): https://github.com/tsndr/cloudflare-worker-jwt/blob/b0d4084a0f9ee21f2e3dac979a281764d7fecb41/src/index.ts#L40-L63

Currently the following will work just fine:

import type { JwtPayload } from "@tsndr/cloudflare-worker-jwt";

type StrictPayload = JwtPayload<{
  something: string;
}>

const payload = { ... } satisfies StrictPayload;
console.log(payload.this_does_not_exist); // fine because [key: string]: any

Instead, I'd like the [key: string]: any to be part of the default T, so that we can get strict type-checking for missing fields.

Proposed change:

- export type JwtPayload<T = {}> = {
+ export type JwtPayload<T = {[key: string]: any}> = {
  // ...
- [key: string]: any
} & T

The default behavior will remain the same but custom types will enjoy stricter type-checking.