From b27648194ea1ab121eb4486cf082131cecf80dea Mon Sep 17 00:00:00 2001
From: Manuel Spigolon <behemoth89@gmail.com>
Date: Sun, 5 Mar 2023 18:48:59 +0100
Subject: [PATCH] fix: propagate user result (#278)

---
 jwt.js           | 2 +-
 test/jwt.test.js | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/jwt.js b/jwt.js
index 90c3c0b..d60120c 100644
--- a/jwt.js
+++ b/jwt.js
@@ -511,7 +511,7 @@ function fastifyJwt (fastify, options, next) {
             maybePromise
               .then(trusted => trusted ? callback(null, result) : callback(new AuthorizationTokenUntrustedError()))
           } else if (maybePromise) {
-            callback(null, maybePromise)
+            callback(null, result)
           } else {
             callback(new AuthorizationTokenUntrustedError())
           }
diff --git a/test/jwt.test.js b/test/jwt.test.js
index 16d9ff4..a1ae869 100644
--- a/test/jwt.test.js
+++ b/test/jwt.test.js
@@ -1357,13 +1357,15 @@ test('sign and verify with RSA/ECDSA certificates and global options', function
 test('sign and verify with trusted token', function (t) {
   t.plan(2)
   t.test('Trusted token verification', function (t) {
-    t.plan(1)
+    t.plan(2)
 
     const f = Fastify()
     f.register(jwt, { secret: 'test', trusted: (request, { jti }) => jti !== 'untrusted' })
     f.get('/', (request, reply) => {
       request.jwtVerify()
         .then(function (decodedToken) {
+          delete decodedToken?.iat
+          t.same(decodedToken, { foo: 'bar', jti: 'trusted' })
           return reply.send(decodedToken)
         })
         .catch(function (error) {
@@ -1385,13 +1387,15 @@ test('sign and verify with trusted token', function (t) {
   })
 
   t.test('Trusted token - async verification', function (t) {
-    t.plan(1)
+    t.plan(2)
 
     const f = Fastify()
     f.register(jwt, { secret: 'test', trusted: (request, { jti }) => Promise.resolve(jti !== 'untrusted') })
     f.get('/', (request, reply) => {
       request.jwtVerify()
         .then(function (decodedToken) {
+          delete decodedToken?.iat
+          t.same(decodedToken, { foo: 'bar', jti: 'trusted' })
           return reply.send(decodedToken)
         })
         .catch(function (error) {