bcryptjs password hashing + jose JWT sessions: working versions (tested 2026-10-15)

{
  "name": "bcryptjs-jose-sessions",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "bcryptjs": "3.0.3",
    "jose": "6.2.12"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2"
  }
}

import bcrypt from "bcryptjs";
import { SignJWT, jwtVerify } from "jose";

export const hashPassword = (pw: string) => bcrypt.hash(pw, 10);
export const checkPassword = (pw: string, hash: string) => bcrypt.compare(pw, hash);

export async function createSession(userId: string, secret: Uint8Array, ttl = "2h") {
  return new SignJWT({ role: "user" })
    .setProtectedHeader({ alg: "HS256" })
    .setSubject(userId)
    .setIssuedAt()
    .setIssuer("my-app")
    .setExpirationTime(ttl)
    .sign(secret);
}

export async function readSession(token: string, secret: Uint8Array) {
  const { payload } = await jwtVerify(token, secret, { issuer: "my-app", algorithms: ["HS256"] });
  return { userId: payload.sub!, role: payload.role as string };
}

import { test } from "node:test";
import assert from "node:assert/strict";
import { hashPassword, checkPassword, createSession, readSession } from "../src/auth.ts";

const secret = new TextEncoder().encode("a-32-byte-long-test-secret-value!");

test("hash and verify a password", async () => {
  const h = await hashPassword("hunter2");
  assert.notEqual(h, "hunter2");
  assert.equal(await checkPassword("hunter2", h), true);
  assert.equal(await checkPassword("wrong", h), false);
});

test("session round trip", async () => {
  const t = await createSession("u1", secret);
  assert.deepEqual(await readSession(t, secret), { userId: "u1", role: "user" });
});

test("rejects tampered and expired tokens", async () => {
  const t = await createSession("u1", secret);
  await assert.rejects(readSession(t, new TextEncoder().encode("another-32-byte-long-secret-val!!")));
  const old = await createSession("u1", secret, "-1s");
  await assert.rejects(readSession(old, secret));
});