@adonis-agora/authkit-server 1.0.0-rc.2 → 1.0.0-rc.3

package/build/src/service_tenants/tenant_verifier.js

@@ -0,0 +1,104 @@
+import { createLocalJWKSet, errors as joseErrors, jwtVerify } from 'jose';
+import { getBootedApp } from '../../services/booted_app.js';
+/** Asymmetric JWS algorithms only: never `none`, never `HS*`. */
+const ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+    'Ed25519',
+];
+const defaultIssuer = async () => (await getBootedApp().container.make('authkit.server'));
+function audienceFor(issuer, explicit) {
+    if (explicit)
+        return explicit;
+    const resources = Object.values(issuer.config.serviceTenants?.resources ?? {});
+    if (resources.length === 1)
+        return resources[0].audience;
+    throw new Error(resources.length === 0
+        ? 'authkitTenantVerifier: no serviceTenants.resources declared in config/authkit.ts'
+        : 'authkitTenantVerifier: several serviceTenants.resources are declared; pass { audience }');
+}
+/**
+ * Verifies service-tenant tokens against the local authkit issuer and its JWKS (no
+ * network call), and returns the tenant they authenticate as, or `null`.
+ *
+ * Satisfies durable's `TenantVerifierContract` (`verify(input)`); usable as a class in
+ * `verifyTenant` (built by the container with the default options) or through
+ * {@link authkitTenantVerifier}.
+ */
+export class AuthkitTenantVerifier {
+    #options;
+    #jwks;
+    #keySet;
+    constructor(options = {}) {
+        this.#options = options;
+    }
+    #keySetFor(jwks) {
+        // `publicJwks` is a new object whenever the keys change (rotation/reload).
+        if (jwks !== this.#jwks || !this.#keySet) {
+            this.#jwks = jwks;
+            this.#keySet = createLocalJWKSet(jwks);
+        }
+        return this.#keySet;
+    }
+    async verify(input) {
+        const token = input?.token;
+        if (typeof token !== 'string' || !token)
+            return null;
+        const issuer = await (this.#options.issuer ?? defaultIssuer)();
+        const audience = audienceFor(issuer, this.#options.audience);
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, this.#keySetFor(issuer.publicJwks), {
+                issuer: issuer.config.issuer,
+                audience,
+                algorithms: ALGORITHMS,
+                typ: 'at+jwt',
+                clockTolerance: this.#options.clockToleranceSec ?? 30,
+                requiredClaims: ['exp', 'sub'],
+            }));
+        }
+        catch (error) {
+            if (error instanceof joseErrors.JOSEError)
+                return null;
+            throw error;
+        }
+        // A client_credentials token: no user behind it, `sub` is the client.
+        const clientId = payload.client_id;
+        if (typeof clientId !== 'string' || payload.sub !== clientId)
+            return null;
+        const partition = payload[this.#options.partitionClaim ?? 'partition'];
+        if (typeof partition !== 'string' || !partition)
+            return null;
+        const rawCapabilities = payload[this.#options.capabilitiesClaim ?? 'capabilities'];
+        if (rawCapabilities === undefined)
+            return { tenant: partition };
+        if (!Array.isArray(rawCapabilities) || rawCapabilities.some((c) => typeof c !== 'string')) {
+            return null;
+        }
+        return { tenant: partition, capabilities: rawCapabilities };
+    }
+}
+/**
+ * Tenant verifier for a durable control plane hosted by the authkit app:
+ *
+ * ```ts
+ * // config/durable.ts
+ * verifyTenant: authkitTenantVerifier()
+ * ```
+ *
+ * The result is a function (durable's `TenantVerifier`) that also has `verify`
+ * (durable's `TenantVerifierContract`).
+ */
+export function authkitTenantVerifier(options = {}) {
+    const verifier = new AuthkitTenantVerifier(options);
+    const verify = (input) => verifier.verify(input);
+    return Object.assign(verify, { verify });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.3",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -117,7 +117,7 @@
     "qrcode": "1.5.4"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-react": "1.0.0-rc.1",
+    "@adonis-agora/authkit-react": "1.0.0-rc.2",
     "@adonis-agora/durable": "0.59.0",
     "@adonis-agora/telescope": "0.27.1",
     "@adonisjs/ally": "6.3.2",