@argos-js/auth 0.0.0-stage → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +13 -2
- package/dist/certificates/cert-parser.d.ts +19 -0
- package/dist/certificates/cert-parser.d.ts.map +1 -0
- package/dist/certificates/cert-parser.js +192 -0
- package/dist/certificates/cert-parser.js.map +1 -0
- package/dist/certificates/cert.types.d.ts +60 -0
- package/dist/certificates/cert.types.d.ts.map +1 -0
- package/dist/certificates/cert.types.js +3 -0
- package/dist/certificates/cert.types.js.map +1 -0
- package/dist/certificates/index.d.ts +5 -0
- package/dist/certificates/index.d.ts.map +1 -0
- package/dist/certificates/index.js +21 -0
- package/dist/certificates/index.js.map +1 -0
- package/dist/certificates/jwks.d.ts +90 -0
- package/dist/certificates/jwks.d.ts.map +1 -0
- package/dist/certificates/jwks.js +180 -0
- package/dist/certificates/jwks.js.map +1 -0
- package/dist/certificates/mtls.guard.d.ts +10 -0
- package/dist/certificates/mtls.guard.d.ts.map +1 -0
- package/dist/certificates/mtls.guard.js +156 -0
- package/dist/certificates/mtls.guard.js.map +1 -0
- package/dist/config.d.ts +33 -0
- package/dist/config.d.ts.map +1 -0
- package/dist/config.js +10 -0
- package/dist/config.js.map +1 -0
- package/dist/guards/api-key.guard.d.ts +21 -0
- package/dist/guards/api-key.guard.d.ts.map +1 -0
- package/dist/guards/api-key.guard.js +106 -0
- package/dist/guards/api-key.guard.js.map +1 -0
- package/dist/guards/basic.d.ts +6 -0
- package/dist/guards/basic.d.ts.map +1 -0
- package/dist/guards/basic.guard.d.ts +26 -0
- package/dist/guards/basic.guard.d.ts.map +1 -0
- package/dist/guards/basic.guard.js +123 -0
- package/dist/guards/basic.guard.js.map +1 -0
- package/dist/guards/basic.js +42 -0
- package/dist/guards/basic.js.map +1 -0
- package/dist/guards/guard.interface.d.ts +21 -0
- package/dist/guards/guard.interface.d.ts.map +1 -0
- package/dist/guards/guard.interface.js +3 -0
- package/dist/guards/guard.interface.js.map +1 -0
- package/dist/guards/hmac.guard.d.ts +18 -0
- package/dist/guards/hmac.guard.d.ts.map +1 -0
- package/dist/guards/hmac.guard.js +111 -0
- package/dist/guards/hmac.guard.js.map +1 -0
- package/dist/guards/index.d.ts +8 -0
- package/dist/guards/index.d.ts.map +1 -0
- package/dist/guards/index.js +24 -0
- package/dist/guards/index.js.map +1 -0
- package/dist/guards/jwt.guard.d.ts +17 -0
- package/dist/guards/jwt.guard.d.ts.map +1 -0
- package/dist/guards/jwt.guard.js +92 -0
- package/dist/guards/jwt.guard.js.map +1 -0
- package/dist/hasher/argon2-hasher.d.ts +31 -0
- package/dist/hasher/argon2-hasher.d.ts.map +1 -0
- package/dist/hasher/argon2-hasher.js +114 -0
- package/dist/hasher/argon2-hasher.js.map +1 -0
- package/dist/hasher/hasher.interface.d.ts +22 -0
- package/dist/hasher/hasher.interface.d.ts.map +1 -0
- package/dist/hasher/hasher.interface.js +3 -0
- package/dist/hasher/hasher.interface.js.map +1 -0
- package/dist/hasher/index.d.ts +5 -0
- package/dist/hasher/index.d.ts.map +1 -0
- package/dist/hasher/index.js +21 -0
- package/dist/hasher/index.js.map +1 -0
- package/dist/hasher/password-manager.d.ts +52 -0
- package/dist/hasher/password-manager.d.ts.map +1 -0
- package/dist/hasher/password-manager.js +126 -0
- package/dist/hasher/password-manager.js.map +1 -0
- package/dist/hasher/scrypt-hasher.d.ts +30 -0
- package/dist/hasher/scrypt-hasher.d.ts.map +1 -0
- package/dist/hasher/scrypt-hasher.js +158 -0
- package/dist/hasher/scrypt-hasher.js.map +1 -0
- package/dist/index.d.ts +9 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +32 -0
- package/dist/index.js.map +1 -0
- package/dist/middleware/auth.middleware.d.ts +42 -0
- package/dist/middleware/auth.middleware.d.ts.map +1 -0
- package/dist/middleware/auth.middleware.js +142 -0
- package/dist/middleware/auth.middleware.js.map +1 -0
- package/dist/middleware/index.d.ts +2 -0
- package/dist/middleware/index.d.ts.map +1 -0
- package/dist/middleware/index.js +18 -0
- package/dist/middleware/index.js.map +1 -0
- package/dist/oauth/base.provider.d.ts +27 -0
- package/dist/oauth/base.provider.d.ts.map +1 -0
- package/dist/oauth/base.provider.js +139 -0
- package/dist/oauth/base.provider.js.map +1 -0
- package/dist/oauth/index.d.ts +6 -0
- package/dist/oauth/index.d.ts.map +1 -0
- package/dist/oauth/index.js +22 -0
- package/dist/oauth/index.js.map +1 -0
- package/dist/oauth/oauth-manager.d.ts +41 -0
- package/dist/oauth/oauth-manager.d.ts.map +1 -0
- package/dist/oauth/oauth-manager.js +58 -0
- package/dist/oauth/oauth-manager.js.map +1 -0
- package/dist/oauth/oauth.types.d.ts +55 -0
- package/dist/oauth/oauth.types.d.ts.map +1 -0
- package/dist/oauth/oauth.types.js +3 -0
- package/dist/oauth/oauth.types.js.map +1 -0
- package/dist/oauth/pkce.d.ts +26 -0
- package/dist/oauth/pkce.d.ts.map +1 -0
- package/dist/oauth/pkce.js +136 -0
- package/dist/oauth/pkce.js.map +1 -0
- package/dist/oauth/providers/generic-oidc.provider.d.ts +25 -0
- package/dist/oauth/providers/generic-oidc.provider.d.ts.map +1 -0
- package/dist/oauth/providers/generic-oidc.provider.js +43 -0
- package/dist/oauth/providers/generic-oidc.provider.js.map +1 -0
- package/dist/oauth/providers/github.provider.d.ts +15 -0
- package/dist/oauth/providers/github.provider.d.ts.map +1 -0
- package/dist/oauth/providers/github.provider.js +70 -0
- package/dist/oauth/providers/github.provider.js.map +1 -0
- package/dist/oauth/providers/google.provider.d.ts +12 -0
- package/dist/oauth/providers/google.provider.d.ts.map +1 -0
- package/dist/oauth/providers/google.provider.js +27 -0
- package/dist/oauth/providers/google.provider.js.map +1 -0
- package/dist/oauth/providers/index.d.ts +5 -0
- package/dist/oauth/providers/index.d.ts.map +1 -0
- package/dist/oauth/providers/index.js +21 -0
- package/dist/oauth/providers/index.js.map +1 -0
- package/dist/oauth/providers/microsoft.provider.d.ts +13 -0
- package/dist/oauth/providers/microsoft.provider.d.ts.map +1 -0
- package/dist/oauth/providers/microsoft.provider.js +28 -0
- package/dist/oauth/providers/microsoft.provider.js.map +1 -0
- package/dist/oauth2/client.d.ts +63 -0
- package/dist/oauth2/client.d.ts.map +1 -0
- package/dist/oauth2/client.js +150 -0
- package/dist/oauth2/client.js.map +1 -0
- package/dist/oauth2/index.d.ts +2 -0
- package/dist/oauth2/index.d.ts.map +1 -0
- package/dist/oauth2/index.js +18 -0
- package/dist/oauth2/index.js.map +1 -0
- package/dist/tokens/api-key.d.ts +26 -0
- package/dist/tokens/api-key.d.ts.map +1 -0
- package/dist/tokens/api-key.js +84 -0
- package/dist/tokens/api-key.js.map +1 -0
- package/dist/tokens/index.d.ts +3 -0
- package/dist/tokens/index.d.ts.map +1 -0
- package/dist/tokens/index.js +19 -0
- package/dist/tokens/index.js.map +1 -0
- package/dist/tokens/jwt.d.ts +93 -0
- package/dist/tokens/jwt.d.ts.map +1 -0
- package/dist/tokens/jwt.js +327 -0
- package/dist/tokens/jwt.js.map +1 -0
- package/package.json +38 -3
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
import * as crypto from 'node:crypto';
|
|
2
|
+
export interface JwtHeader {
|
|
3
|
+
alg: 'HS256' | 'HS512' | 'RS256' | 'EdDSA' | 'Ed25519' | string;
|
|
4
|
+
typ?: 'JWT';
|
|
5
|
+
kid?: string;
|
|
6
|
+
[key: string]: unknown;
|
|
7
|
+
}
|
|
8
|
+
export interface JwtPayload {
|
|
9
|
+
iss?: string;
|
|
10
|
+
sub?: string;
|
|
11
|
+
aud?: string | string[];
|
|
12
|
+
exp?: number;
|
|
13
|
+
nbf?: number;
|
|
14
|
+
iat?: number;
|
|
15
|
+
jti?: string;
|
|
16
|
+
roles?: string[];
|
|
17
|
+
scopes?: string[];
|
|
18
|
+
permissions?: string[];
|
|
19
|
+
[key: string]: unknown;
|
|
20
|
+
}
|
|
21
|
+
export interface JwtSignOptions {
|
|
22
|
+
algorithm?: 'HS256' | 'HS512' | 'RS256' | 'EdDSA' | 'Ed25519' | string;
|
|
23
|
+
expiresIn?: number | string;
|
|
24
|
+
notBefore?: number | string;
|
|
25
|
+
issuer?: string;
|
|
26
|
+
audience?: string | string[];
|
|
27
|
+
subject?: string;
|
|
28
|
+
jwtid?: string;
|
|
29
|
+
jti?: string;
|
|
30
|
+
keyId?: string;
|
|
31
|
+
header?: Record<string, unknown>;
|
|
32
|
+
}
|
|
33
|
+
export interface JwtVerifyOptions {
|
|
34
|
+
algorithms?: Array<'HS256' | 'HS512' | 'RS256' | 'EdDSA' | 'Ed25519' | string>;
|
|
35
|
+
issuer?: string | string[];
|
|
36
|
+
audience?: string | string[];
|
|
37
|
+
clockTolerance?: number;
|
|
38
|
+
ignoreExpiration?: boolean;
|
|
39
|
+
}
|
|
40
|
+
export interface TokenPair {
|
|
41
|
+
accessToken: string;
|
|
42
|
+
refreshToken: string;
|
|
43
|
+
tokenType: string;
|
|
44
|
+
expiresIn: number;
|
|
45
|
+
}
|
|
46
|
+
/**
|
|
47
|
+
* Parses duration strings like "15m", "1h", "7d", "30s" to seconds.
|
|
48
|
+
*/
|
|
49
|
+
export declare function parseDuration(duration: number | string | undefined): number | undefined;
|
|
50
|
+
/**
|
|
51
|
+
* Signs a JWT token supporting HS256, RS256, and EdDSA.
|
|
52
|
+
*/
|
|
53
|
+
export declare function signToken(payload: Record<string, unknown>, secretOrPrivateKey: string | Buffer | crypto.KeyObject, options?: JwtSignOptions): Promise<string>;
|
|
54
|
+
/**
|
|
55
|
+
* Verifies and decodes a JWT token with strict signature and claim validation.
|
|
56
|
+
* Protects against algorithm tampering attacks (e.g. `alg: none` or algorithm confusion).
|
|
57
|
+
*/
|
|
58
|
+
export declare function verifyToken<T = JwtPayload>(token: string, secretOrPublicKey: string | Buffer | crypto.KeyObject, options?: JwtVerifyOptions): Promise<T>;
|
|
59
|
+
/**
|
|
60
|
+
* Decodes header and payload without verifying signature (useful for inspection).
|
|
61
|
+
*/
|
|
62
|
+
export declare function decodeToken<T = JwtPayload>(token: string): {
|
|
63
|
+
header: JwtHeader;
|
|
64
|
+
payload: T;
|
|
65
|
+
} | null;
|
|
66
|
+
export interface CreateTokenPairOptions {
|
|
67
|
+
accessExpiresIn?: string | number;
|
|
68
|
+
accessTokenExpiresIn?: string | number;
|
|
69
|
+
refreshExpiresIn?: string | number;
|
|
70
|
+
refreshTokenExpiresIn?: string | number;
|
|
71
|
+
algorithm?: 'HS256' | 'RS256' | 'EdDSA';
|
|
72
|
+
issuer?: string;
|
|
73
|
+
audience?: string | string[];
|
|
74
|
+
subject?: string;
|
|
75
|
+
familyId?: string;
|
|
76
|
+
family_id?: string;
|
|
77
|
+
}
|
|
78
|
+
/**
|
|
79
|
+
* Creates an Access Token with mandatory jti claim (RFC 7519).
|
|
80
|
+
*/
|
|
81
|
+
export declare function createAccessToken(payload: Record<string, unknown>, secretOrPrivateKey: string | Buffer | crypto.KeyObject, options?: JwtSignOptions): Promise<string>;
|
|
82
|
+
/**
|
|
83
|
+
* Creates a Refresh Token with mandatory jti claim (RFC 7519).
|
|
84
|
+
*/
|
|
85
|
+
export declare function createRefreshToken(payload: Record<string, unknown>, secretOrPrivateKey: string | Buffer | crypto.KeyObject, options?: JwtSignOptions & {
|
|
86
|
+
familyId?: string;
|
|
87
|
+
family_id?: string;
|
|
88
|
+
}): Promise<string>;
|
|
89
|
+
/**
|
|
90
|
+
* Creates an Access Token and Refresh Token pair for OAuth2 / session flows.
|
|
91
|
+
*/
|
|
92
|
+
export declare function createTokenPair(payload: Record<string, unknown>, secretOrPrivateKey: string | Buffer | crypto.KeyObject, options?: CreateTokenPairOptions): Promise<TokenPair>;
|
|
93
|
+
//# sourceMappingURL=jwt.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/tokens/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IAChE,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;IAC/E,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CA6BvF;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,SAAS,EACtD,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAgEjB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,CAAC,GAAG,UAAU,EAC9C,KAAK,EAAE,MAAM,EACb,iBAAiB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,SAAS,EACrD,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,CAAC,CAAC,CAyHZ;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GAAG,IAAI,CAUnG;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,SAAS,EACtD,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,SAAS,EACtD,OAAO,GAAE,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,SAAS,EACtD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,SAAS,CAAC,CAoBpB"}
|
|
@@ -0,0 +1,327 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
19
|
+
var ownKeys = function(o) {
|
|
20
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
21
|
+
var ar = [];
|
|
22
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
23
|
+
return ar;
|
|
24
|
+
};
|
|
25
|
+
return ownKeys(o);
|
|
26
|
+
};
|
|
27
|
+
return function (mod) {
|
|
28
|
+
if (mod && mod.__esModule) return mod;
|
|
29
|
+
var result = {};
|
|
30
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
31
|
+
__setModuleDefault(result, mod);
|
|
32
|
+
return result;
|
|
33
|
+
};
|
|
34
|
+
})();
|
|
35
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
36
|
+
exports.parseDuration = parseDuration;
|
|
37
|
+
exports.signToken = signToken;
|
|
38
|
+
exports.verifyToken = verifyToken;
|
|
39
|
+
exports.decodeToken = decodeToken;
|
|
40
|
+
exports.createAccessToken = createAccessToken;
|
|
41
|
+
exports.createRefreshToken = createRefreshToken;
|
|
42
|
+
exports.createTokenPair = createTokenPair;
|
|
43
|
+
const crypto = __importStar(require("node:crypto"));
|
|
44
|
+
/**
|
|
45
|
+
* Parses duration strings like "15m", "1h", "7d", "30s" to seconds.
|
|
46
|
+
*/
|
|
47
|
+
function parseDuration(duration) {
|
|
48
|
+
if (duration === undefined)
|
|
49
|
+
return undefined;
|
|
50
|
+
if (typeof duration === 'number')
|
|
51
|
+
return duration;
|
|
52
|
+
const match = duration.trim().match(/^(\d+)\s*(s|m|h|d|w|y)?$/i);
|
|
53
|
+
if (!match) {
|
|
54
|
+
const parsed = parseInt(duration, 10);
|
|
55
|
+
return isNaN(parsed) ? undefined : parsed;
|
|
56
|
+
}
|
|
57
|
+
const value = parseInt(match[1], 10);
|
|
58
|
+
const unit = (match[2] || 's').toLowerCase();
|
|
59
|
+
switch (unit) {
|
|
60
|
+
case 's':
|
|
61
|
+
return value;
|
|
62
|
+
case 'm':
|
|
63
|
+
return value * 60;
|
|
64
|
+
case 'h':
|
|
65
|
+
return value * 3600;
|
|
66
|
+
case 'd':
|
|
67
|
+
return value * 86400;
|
|
68
|
+
case 'w':
|
|
69
|
+
return value * 604800;
|
|
70
|
+
case 'y':
|
|
71
|
+
return value * 31536000;
|
|
72
|
+
default:
|
|
73
|
+
return value;
|
|
74
|
+
}
|
|
75
|
+
}
|
|
76
|
+
/**
|
|
77
|
+
* Signs a JWT token supporting HS256, RS256, and EdDSA.
|
|
78
|
+
*/
|
|
79
|
+
async function signToken(payload, secretOrPrivateKey, options = {}) {
|
|
80
|
+
const alg = options.algorithm ?? 'HS256';
|
|
81
|
+
const header = {
|
|
82
|
+
alg,
|
|
83
|
+
typ: 'JWT',
|
|
84
|
+
...(options.keyId ? { kid: options.keyId } : {}),
|
|
85
|
+
...(options.header ?? {}),
|
|
86
|
+
};
|
|
87
|
+
const now = Math.floor(Date.now() / 1000);
|
|
88
|
+
const jti = payload.jti ?? options.jwtid ?? options.jti ?? crypto.randomUUID();
|
|
89
|
+
const claims = {
|
|
90
|
+
jti,
|
|
91
|
+
iat: now,
|
|
92
|
+
...payload,
|
|
93
|
+
};
|
|
94
|
+
claims.jti = payload.jti ?? options.jwtid ?? options.jti ?? jti;
|
|
95
|
+
if (options.issuer)
|
|
96
|
+
claims.iss = options.issuer;
|
|
97
|
+
if (options.subject)
|
|
98
|
+
claims.sub = options.subject;
|
|
99
|
+
if (options.audience)
|
|
100
|
+
claims.aud = options.audience;
|
|
101
|
+
if (options.expiresIn !== undefined) {
|
|
102
|
+
const ttl = parseDuration(options.expiresIn);
|
|
103
|
+
if (ttl !== undefined) {
|
|
104
|
+
claims.exp = now + ttl;
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
if (options.notBefore !== undefined) {
|
|
108
|
+
const nbfTtl = parseDuration(options.notBefore);
|
|
109
|
+
if (nbfTtl !== undefined) {
|
|
110
|
+
claims.nbf = now + nbfTtl;
|
|
111
|
+
}
|
|
112
|
+
}
|
|
113
|
+
const headerB64 = Buffer.from(JSON.stringify(header), 'utf-8').toString('base64url');
|
|
114
|
+
const payloadB64 = Buffer.from(JSON.stringify(claims), 'utf-8').toString('base64url');
|
|
115
|
+
const signingInput = `${headerB64}.${payloadB64}`;
|
|
116
|
+
let signatureB64;
|
|
117
|
+
if (alg === 'HS256') {
|
|
118
|
+
const hmac = crypto.createHmac('sha256', secretOrPrivateKey);
|
|
119
|
+
hmac.update(signingInput);
|
|
120
|
+
signatureB64 = hmac.digest('base64url');
|
|
121
|
+
}
|
|
122
|
+
else if (alg === 'HS512') {
|
|
123
|
+
const hmac = crypto.createHmac('sha512', secretOrPrivateKey);
|
|
124
|
+
hmac.update(signingInput);
|
|
125
|
+
signatureB64 = hmac.digest('base64url');
|
|
126
|
+
}
|
|
127
|
+
else if (alg === 'RS256') {
|
|
128
|
+
const signer = crypto.createSign('RSA-SHA256');
|
|
129
|
+
signer.update(signingInput);
|
|
130
|
+
signatureB64 = signer.sign(secretOrPrivateKey, 'base64url');
|
|
131
|
+
}
|
|
132
|
+
else if (alg === 'EdDSA' || alg === 'Ed25519') {
|
|
133
|
+
const sig = crypto.sign(null, Buffer.from(signingInput, 'utf-8'), secretOrPrivateKey);
|
|
134
|
+
signatureB64 = sig.toString('base64url');
|
|
135
|
+
}
|
|
136
|
+
else {
|
|
137
|
+
throw new Error(`Unsupported JWT signing algorithm: ${alg}`);
|
|
138
|
+
}
|
|
139
|
+
return `${signingInput}.${signatureB64}`;
|
|
140
|
+
}
|
|
141
|
+
/**
|
|
142
|
+
* Verifies and decodes a JWT token with strict signature and claim validation.
|
|
143
|
+
* Protects against algorithm tampering attacks (e.g. `alg: none` or algorithm confusion).
|
|
144
|
+
*/
|
|
145
|
+
async function verifyToken(token, secretOrPublicKey, options = {}) {
|
|
146
|
+
if (!token || typeof token !== 'string') {
|
|
147
|
+
throw new Error('Invalid JWT: Token must be a non-empty string');
|
|
148
|
+
}
|
|
149
|
+
const parts = token.trim().split('.');
|
|
150
|
+
if (parts.length !== 3) {
|
|
151
|
+
throw new Error('Invalid JWT: Malformed token structure (must contain 3 parts)');
|
|
152
|
+
}
|
|
153
|
+
const [headerB64, payloadB64, signatureB64] = parts;
|
|
154
|
+
let header;
|
|
155
|
+
try {
|
|
156
|
+
header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf-8'));
|
|
157
|
+
}
|
|
158
|
+
catch {
|
|
159
|
+
throw new Error('Invalid JWT: Malformed header JSON');
|
|
160
|
+
}
|
|
161
|
+
// Strict algorithm validation: Reject 'none' and unapproved algorithms
|
|
162
|
+
const alg = header.alg;
|
|
163
|
+
if (!alg || alg.toLowerCase() === 'none') {
|
|
164
|
+
throw new Error('Invalid JWT: Insecure algorithm "none" is strictly forbidden');
|
|
165
|
+
}
|
|
166
|
+
const allowedAlgs = options.algorithms ?? ['HS256', 'HS512', 'RS256', 'EdDSA', 'Ed25519'];
|
|
167
|
+
if (!allowedAlgs.includes(alg)) {
|
|
168
|
+
throw new Error(`Invalid JWT: Algorithm "${alg}" is not permitted by verification policy`);
|
|
169
|
+
}
|
|
170
|
+
const signingInput = `${headerB64}.${payloadB64}`;
|
|
171
|
+
// Signature verification
|
|
172
|
+
if (alg === 'HS256') {
|
|
173
|
+
const hmac = crypto.createHmac('sha256', secretOrPublicKey);
|
|
174
|
+
hmac.update(signingInput);
|
|
175
|
+
const expectedSig = hmac.digest();
|
|
176
|
+
const actualSig = Buffer.from(signatureB64, 'base64url');
|
|
177
|
+
if (expectedSig.length !== actualSig.length || !crypto.timingSafeEqual(expectedSig, actualSig)) {
|
|
178
|
+
throw new Error('Invalid JWT signature');
|
|
179
|
+
}
|
|
180
|
+
}
|
|
181
|
+
else if (alg === 'HS512') {
|
|
182
|
+
const hmac = crypto.createHmac('sha512', secretOrPublicKey);
|
|
183
|
+
hmac.update(signingInput);
|
|
184
|
+
const expectedSig = hmac.digest();
|
|
185
|
+
const actualSig = Buffer.from(signatureB64, 'base64url');
|
|
186
|
+
if (expectedSig.length !== actualSig.length || !crypto.timingSafeEqual(expectedSig, actualSig)) {
|
|
187
|
+
throw new Error('Invalid JWT signature');
|
|
188
|
+
}
|
|
189
|
+
}
|
|
190
|
+
else if (alg === 'RS256') {
|
|
191
|
+
const verifier = crypto.createVerify('RSA-SHA256');
|
|
192
|
+
verifier.update(signingInput);
|
|
193
|
+
const actualSig = Buffer.from(signatureB64, 'base64url');
|
|
194
|
+
const isValid = verifier.verify(secretOrPublicKey, actualSig);
|
|
195
|
+
if (!isValid) {
|
|
196
|
+
throw new Error('Invalid JWT signature');
|
|
197
|
+
}
|
|
198
|
+
}
|
|
199
|
+
else if (alg === 'EdDSA' || alg === 'Ed25519') {
|
|
200
|
+
const actualSig = Buffer.from(signatureB64, 'base64url');
|
|
201
|
+
const isValid = crypto.verify(null, Buffer.from(signingInput, 'utf-8'), secretOrPublicKey, actualSig);
|
|
202
|
+
if (!isValid) {
|
|
203
|
+
throw new Error('Invalid JWT signature');
|
|
204
|
+
}
|
|
205
|
+
}
|
|
206
|
+
else {
|
|
207
|
+
throw new Error(`Unsupported JWT verification algorithm: ${alg}`);
|
|
208
|
+
}
|
|
209
|
+
// Decode payload
|
|
210
|
+
let payload;
|
|
211
|
+
try {
|
|
212
|
+
payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf-8'));
|
|
213
|
+
}
|
|
214
|
+
catch {
|
|
215
|
+
throw new Error('Invalid JWT: Malformed payload JSON');
|
|
216
|
+
}
|
|
217
|
+
const claims = payload;
|
|
218
|
+
const now = Math.floor(Date.now() / 1000);
|
|
219
|
+
const tolerance = options.clockTolerance ?? 0;
|
|
220
|
+
// Verify expiration (exp)
|
|
221
|
+
if (!options.ignoreExpiration && typeof claims.exp === 'number') {
|
|
222
|
+
if (now > claims.exp + tolerance) {
|
|
223
|
+
throw new Error('JWT token has expired');
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
// Verify not before (nbf)
|
|
227
|
+
if (typeof claims.nbf === 'number') {
|
|
228
|
+
if (now < claims.nbf - tolerance) {
|
|
229
|
+
throw new Error('JWT token is not active yet');
|
|
230
|
+
}
|
|
231
|
+
}
|
|
232
|
+
// Verify issuer (iss)
|
|
233
|
+
if (options.issuer !== undefined) {
|
|
234
|
+
const expectedIssuers = Array.isArray(options.issuer) ? options.issuer : [options.issuer];
|
|
235
|
+
if (!claims.iss || !expectedIssuers.includes(claims.iss)) {
|
|
236
|
+
throw new Error(`JWT issuer mismatch: expected "${expectedIssuers.join(', ')}", got "${claims.iss}"`);
|
|
237
|
+
}
|
|
238
|
+
}
|
|
239
|
+
// Verify audience (aud)
|
|
240
|
+
if (options.audience !== undefined) {
|
|
241
|
+
const expectedAudiences = Array.isArray(options.audience) ? options.audience : [options.audience];
|
|
242
|
+
const tokenAudiences = Array.isArray(claims.aud) ? claims.aud : claims.aud ? [claims.aud] : [];
|
|
243
|
+
const hasAud = expectedAudiences.some((aud) => tokenAudiences.includes(aud));
|
|
244
|
+
if (!hasAud) {
|
|
245
|
+
throw new Error(`JWT audience mismatch: expected "${expectedAudiences.join(', ')}"`);
|
|
246
|
+
}
|
|
247
|
+
}
|
|
248
|
+
return payload;
|
|
249
|
+
}
|
|
250
|
+
/**
|
|
251
|
+
* Decodes header and payload without verifying signature (useful for inspection).
|
|
252
|
+
*/
|
|
253
|
+
function decodeToken(token) {
|
|
254
|
+
try {
|
|
255
|
+
const parts = token.trim().split('.');
|
|
256
|
+
if (parts.length !== 3)
|
|
257
|
+
return null;
|
|
258
|
+
const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf-8'));
|
|
259
|
+
const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));
|
|
260
|
+
return { header, payload };
|
|
261
|
+
}
|
|
262
|
+
catch {
|
|
263
|
+
return null;
|
|
264
|
+
}
|
|
265
|
+
}
|
|
266
|
+
/**
|
|
267
|
+
* Creates an Access Token with mandatory jti claim (RFC 7519).
|
|
268
|
+
*/
|
|
269
|
+
async function createAccessToken(payload, secretOrPrivateKey, options = {}) {
|
|
270
|
+
const accessJti = payload.jti || options.jwtid || crypto.randomUUID();
|
|
271
|
+
const accessClaims = {
|
|
272
|
+
jti: accessJti,
|
|
273
|
+
...payload,
|
|
274
|
+
tokenType: 'access',
|
|
275
|
+
token_type: 'access',
|
|
276
|
+
};
|
|
277
|
+
return signToken(accessClaims, secretOrPrivateKey, {
|
|
278
|
+
...options,
|
|
279
|
+
jwtid: accessJti,
|
|
280
|
+
});
|
|
281
|
+
}
|
|
282
|
+
/**
|
|
283
|
+
* Creates a Refresh Token with mandatory jti claim (RFC 7519).
|
|
284
|
+
*/
|
|
285
|
+
async function createRefreshToken(payload, secretOrPrivateKey, options = {}) {
|
|
286
|
+
const refreshJti = payload.jti || options.jwtid || crypto.randomUUID();
|
|
287
|
+
const sub = options.subject ?? payload.sub ?? payload.id;
|
|
288
|
+
const familyId = options.familyId ?? options.family_id ?? payload.familyId ?? payload.family_id;
|
|
289
|
+
const refreshClaims = {
|
|
290
|
+
jti: refreshJti,
|
|
291
|
+
sub,
|
|
292
|
+
tokenType: 'refresh',
|
|
293
|
+
token_type: 'refresh',
|
|
294
|
+
};
|
|
295
|
+
if (payload.id)
|
|
296
|
+
refreshClaims.id = payload.id;
|
|
297
|
+
if (familyId) {
|
|
298
|
+
refreshClaims.familyId = familyId;
|
|
299
|
+
refreshClaims.family_id = familyId;
|
|
300
|
+
}
|
|
301
|
+
return signToken(refreshClaims, secretOrPrivateKey, {
|
|
302
|
+
...options,
|
|
303
|
+
jwtid: refreshJti,
|
|
304
|
+
});
|
|
305
|
+
}
|
|
306
|
+
/**
|
|
307
|
+
* Creates an Access Token and Refresh Token pair for OAuth2 / session flows.
|
|
308
|
+
*/
|
|
309
|
+
async function createTokenPair(payload, secretOrPrivateKey, options = {}) {
|
|
310
|
+
const accessTtl = parseDuration(options.accessExpiresIn ?? options.accessTokenExpiresIn ?? '15m') ?? 900;
|
|
311
|
+
const refreshTtl = parseDuration(options.refreshExpiresIn ?? options.refreshTokenExpiresIn ?? '7d') ?? 604800;
|
|
312
|
+
const accessToken = await createAccessToken(payload, secretOrPrivateKey, {
|
|
313
|
+
...options,
|
|
314
|
+
expiresIn: accessTtl,
|
|
315
|
+
});
|
|
316
|
+
const refreshToken = await createRefreshToken(payload, secretOrPrivateKey, {
|
|
317
|
+
...options,
|
|
318
|
+
expiresIn: refreshTtl,
|
|
319
|
+
});
|
|
320
|
+
return {
|
|
321
|
+
accessToken,
|
|
322
|
+
refreshToken,
|
|
323
|
+
tokenType: 'Bearer',
|
|
324
|
+
expiresIn: accessTtl,
|
|
325
|
+
};
|
|
326
|
+
}
|
|
327
|
+
//# sourceMappingURL=jwt.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/tokens/jwt.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,sCA6BC;AAKD,8BAoEC;AAMD,kCA6HC;AAKD,kCAUC;AAkBD,8CAiBC;AAKD,gDA0BC;AAKD,0CAwBC;AA7YD,oDAAsC;AAmDtC;;GAEG;AACH,SAAgB,aAAa,CAAC,QAAqC;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAElD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAE7C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,KAAK,CAAC;QACf,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,IAAI,CAAC;QACtB,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,KAAK,CAAC;QACvB,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,MAAM,CAAC;QACxB,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,QAAQ,CAAC;QAC1B;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAC7B,OAAgC,EAChC,kBAAsD,EACtD,UAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;IAEzC,MAAM,MAAM,GAAc;QACxB,GAAG;QACH,GAAG,EAAE,KAAK;QACV,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;KAC1B,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAI,OAAO,CAAC,GAAc,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC3F,MAAM,MAAM,GAA4B;QACtC,GAAG;QACH,GAAG,EAAE,GAAG;QACR,GAAG,OAAO;KACX,CAAC;IAEF,MAAM,CAAC,GAAG,GAAI,OAAO,CAAC,GAAc,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;IAE5E,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAChD,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;IAEpD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAElD,IAAI,YAAoB,CAAC;IAEzB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5B,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,kBAAoC,CAAC,CAAC;QACxG,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,GAAG,YAAY,IAAI,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,iBAAqD,EACrD,UAA4B,EAAE;IAE9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;IAEpD,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,uEAAuE;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,2CAA2C,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAElD,yBAAyB;IACzB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEzD,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEzD,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACnD,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAClC,iBAAmC,EACnC,SAAS,CACV,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,iBAAiB;IACjB,IAAI,OAAU,CAAC;IACf,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,OAAgC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;IAE9C,0BAA0B;IAC1B,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAChE,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,kCAAkC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClG,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oCAAoC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAiB,KAAa;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAeD;;GAEG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAAgC,EAChC,kBAAsD,EACtD,UAA0B,EAAE;IAE5B,MAAM,SAAS,GAAI,OAAO,CAAC,GAAc,IAAI,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAClF,MAAM,YAAY,GAA4B;QAC5C,GAAG,EAAE,SAAS;QACd,GAAG,OAAO;QACV,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,QAAQ;KACrB,CAAC;IAEF,OAAO,SAAS,CAAC,YAAY,EAAE,kBAAkB,EAAE;QACjD,GAAG,OAAO;QACV,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAgC,EAChC,kBAAsD,EACtD,UAAsE,EAAE;IAExE,MAAM,UAAU,GAAI,OAAO,CAAC,GAAc,IAAI,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IACnF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,IAAK,OAAO,CAAC,GAAc,IAAK,OAAO,CAAC,EAAa,CAAC;IACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAK,OAAO,CAAC,QAAmB,IAAK,OAAO,CAAC,SAAoB,CAAC;IAExH,MAAM,aAAa,GAA4B;QAC7C,GAAG,EAAE,UAAU;QACf,GAAG;QACH,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,SAAS;KACtB,CAAC;IAEF,IAAI,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;IAC9C,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAClC,aAAa,CAAC,SAAS,GAAG,QAAQ,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC,aAAa,EAAE,kBAAkB,EAAE;QAClD,GAAG,OAAO;QACV,KAAK,EAAE,UAAU;KAClB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,eAAe,CACnC,OAAgC,EAChC,kBAAsD,EACtD,UAAkC,EAAE;IAEpC,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,oBAAoB,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;IACzG,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC;IAE9G,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,EAAE;QACvE,GAAG,OAAO;QACV,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,EAAE;QACzE,GAAG,OAAO;QACV,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,SAAS;KACrB,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,41 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@argos-js/auth",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"
|
|
5
|
-
"
|
|
3
|
+
"version": "0.1.0",
|
|
4
|
+
"description": "Enterprise Authentication and Authorization Suite (JWT, API Keys, Argon2/Scrypt, Multi-Guards) for Argos-JS",
|
|
5
|
+
"main": "./dist/index.js",
|
|
6
|
+
"types": "./dist/index.d.ts",
|
|
7
|
+
"exports": {
|
|
8
|
+
".": {
|
|
9
|
+
"import": "./dist/index.js",
|
|
10
|
+
"require": "./dist/index.js",
|
|
11
|
+
"types": "./dist/index.d.ts"
|
|
12
|
+
}
|
|
13
|
+
},
|
|
14
|
+
"publishConfig": {
|
|
15
|
+
"access": "public"
|
|
16
|
+
},
|
|
17
|
+
"dependencies": {
|
|
18
|
+
"@argos-js/core": "0.1.0",
|
|
19
|
+
"@argos-js/net": "0.1.0"
|
|
20
|
+
},
|
|
21
|
+
"optionalDependencies": {
|
|
22
|
+
"@node-rs/argon2": "^2.0.0"
|
|
23
|
+
},
|
|
24
|
+
"devDependencies": {
|
|
25
|
+
"@node-rs/argon2": "^2.0.0",
|
|
26
|
+
"@types/node": "^20.11.0",
|
|
27
|
+
"tsx": "^4.7.0",
|
|
28
|
+
"typescript": "^5.4.0"
|
|
29
|
+
},
|
|
30
|
+
"license": "MIT",
|
|
31
|
+
"files": [
|
|
32
|
+
"dist",
|
|
33
|
+
"README.md",
|
|
34
|
+
"LICENSE"
|
|
35
|
+
],
|
|
36
|
+
"scripts": {
|
|
37
|
+
"build": "tsc",
|
|
38
|
+
"dev": "tsc --watch",
|
|
39
|
+
"test": "tsx test/hasher.spec.ts && tsx test/jwt.spec.ts && tsx test/api-key.spec.ts && tsx test/guards.spec.ts && tsx test/basic-auth.spec.ts && tsx test/mtls.spec.ts && tsx test/jwks.spec.ts && tsx test/pkce.spec.ts && tsx test/oauth.spec.ts && tsx test/oauth2.spec.ts"
|
|
40
|
+
}
|
|
6
41
|
}
|