Merge branch 'dsbert-master'

README.md

@@ -71,6 +71,14 @@ By default, the decoded token is attached to `req.user` but can be configured wi
 jwt({ secret: publicKey, requestProperty: 'auth' });
 ```
 
+The token can also be attached to the `result` object with the `resultProperty` option. This option will override any `requestProperty`.
+
+```javascript
+jwt({ secret: publicKey, resultProperty: 'locals.user' });
+```
+
+Both `resultProperty` and `requestProperty` utilize [lodash.set](https://lodash.com/docs/4.17.2#set) and will accept nested property paths.
+
 A custom function for extracting the token from a request can be specified with
 the `getToken` option. This is useful if you need to pass the token through a
 query parameter or a cookie. You can throw an error in this function and it will

lib/index.js

@@ -28,6 +28,7 @@ module.exports = function(options) {
   var isRevokedCallback = options.isRevoked || DEFAULT_REVOKED_FUNCTION;
 
   var _requestProperty = options.userProperty || options.requestProperty || 'user';
+  var _resultProperty = options.resultProperty;
   var credentialsRequired = typeof options.credentialsRequired === 'undefined' ? true : options.credentialsRequired;
 
   var middleware = function(req, res, next) {
@@ -119,7 +120,11 @@ module.exports = function(options) {
 
     ], function (err, result){
       if (err) { return next(err); }
-      set(req, _requestProperty, result);
+      if (_resultProperty) {
+        set(res, _resultProperty, result);
+      } else {
+        set(req, _requestProperty, result);
+      }
       next();
     });
   };

test/jwt.test.js

@@ -253,6 +253,34 @@ describe('work tests', function () {
     });
   });
 
+  it('should set resultProperty if option provided', function() {
+    var secret = 'shhhhhh';
+    var token = jwt.sign({foo: 'bar'}, secret);
+
+    req = { };
+    res = { };
+    req.headers = {};
+    req.headers.authorization = 'Bearer ' + token;
+    expressjwt({secret: secret, resultProperty: 'locals.user'})(req, res, function() {
+      assert.equal('bar', res.locals.user.foo);
+      assert.ok(typeof req.user === 'undefined');
+    });
+  });
+
+  it('should ignore userProperty if resultProperty option provided', function() {
+    var secret = 'shhhhhh';
+    var token = jwt.sign({foo: 'bar'}, secret);
+
+    req = { };
+    res = { };
+    req.headers = {};
+    req.headers.authorization = 'Bearer ' + token;
+    expressjwt({secret: secret, userProperty: 'auth', resultProperty: 'locals.user'})(req, res, function() {
+      assert.equal('bar', res.locals.user.foo);
+      assert.ok(typeof req.auth === 'undefined');
+    });
+  });
+
   it('should work if no authorization header and credentials are not required', function() {
     req = {};
     expressjwt({ secret: 'shhhh', credentialsRequired: false })(req, res, function(err) {