@atlasauth/backend 0.1.2 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +2 -0
- package/dist/index.js +6 -1
- package/dist/index.js.map +1 -1
- package/dist/jwks-cache.d.ts +9 -1
- package/dist/jwks-cache.js +18 -1
- package/dist/jwks-cache.js.map +1 -1
- package/dist/testing.d.ts +62 -0
- package/dist/testing.js +51 -0
- package/dist/testing.js.map +1 -0
- package/dist/verify.d.ts +35 -2
- package/dist/verify.js +71 -0
- package/dist/verify.js.map +1 -1
- package/package.json +9 -9
package/dist/index.d.ts
CHANGED
package/dist/index.js
CHANGED
|
@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
|
14
14
|
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
15
|
};
|
|
16
16
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
exports.createAtlasClient = void 0;
|
|
17
|
+
exports.createTestIssuer = exports.createAtlasClient = void 0;
|
|
18
18
|
// §7.3 token verification — the original surface, unchanged.
|
|
19
19
|
__exportStar(require("./jwks-cache"), exports);
|
|
20
20
|
__exportStar(require("./verify"), exports);
|
|
@@ -25,4 +25,9 @@ __exportStar(require("./webhooks"), exports);
|
|
|
25
25
|
var client_1 = require("./client");
|
|
26
26
|
Object.defineProperty(exports, "createAtlasClient", { enumerable: true, get: function () { return client_1.createAtlasClient; } });
|
|
27
27
|
__exportStar(require("./client"), exports);
|
|
28
|
+
// §1.3(c) dev/test tooling — offline fixtures for verifying Atlas-minted
|
|
29
|
+
// session JWTs with no network call (Clerk's `@clerk/testing` equivalent).
|
|
30
|
+
// Its own module, so it never sits on the hot verification path.
|
|
31
|
+
var testing_1 = require("./testing");
|
|
32
|
+
Object.defineProperty(exports, "createTestIssuer", { enumerable: true, get: function () { return testing_1.createTestIssuer; } });
|
|
28
33
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,2CAAyB;AACzB,8CAA4B;AAE5B,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,2CAAyB;AACzB,8CAA4B;AAE5B,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA"}
|
package/dist/jwks-cache.d.ts
CHANGED
|
@@ -25,7 +25,15 @@ export interface Jwks {
|
|
|
25
25
|
}>;
|
|
26
26
|
}
|
|
27
27
|
export interface JwksCacheDeps {
|
|
28
|
-
|
|
28
|
+
/** The instance's JWKS URL. Optional only when `staticJwks` is supplied. */
|
|
29
|
+
url?: string;
|
|
30
|
+
/**
|
|
31
|
+
* A fixed, in-memory key set. When present the cache serves it directly and
|
|
32
|
+
* NEVER calls `fetch` — the offline path a customer's CI uses to verify
|
|
33
|
+
* Atlas-minted test tokens (§1.3c). Mutually exclusive with `url` in practice;
|
|
34
|
+
* when both are given the static set wins and no network call is ever made.
|
|
35
|
+
*/
|
|
36
|
+
staticJwks?: Jwks;
|
|
29
37
|
fetchImpl?: typeof fetch;
|
|
30
38
|
now?: () => number;
|
|
31
39
|
ttlMs?: number;
|
package/dist/jwks-cache.js
CHANGED
|
@@ -52,6 +52,23 @@ class JwksCache {
|
|
|
52
52
|
* brand-new key fail, and those are a minute old at most.
|
|
53
53
|
*/
|
|
54
54
|
async get(kid) {
|
|
55
|
+
/**
|
|
56
|
+
* The static path. When a fixed key set was supplied there is nothing to
|
|
57
|
+
* fetch, refetch or throttle: the keys never rotate for the life of the
|
|
58
|
+
* process, so every `get` — hit or `kid` miss — is answered from the set
|
|
59
|
+
* with no outbound request. This is what makes verification hermetic.
|
|
60
|
+
*/
|
|
61
|
+
if (this.deps.staticJwks) {
|
|
62
|
+
this.lastOutcome = 'cached';
|
|
63
|
+
return this.deps.staticJwks;
|
|
64
|
+
}
|
|
65
|
+
if (this.deps.url === undefined) {
|
|
66
|
+
// Neither a URL nor a static set: nothing to verify against. Report
|
|
67
|
+
// "no keys" rather than attempting `fetch(undefined)`.
|
|
68
|
+
this.lastOutcome = 'failed';
|
|
69
|
+
return null;
|
|
70
|
+
}
|
|
71
|
+
const url = this.deps.url;
|
|
55
72
|
const now = this.now;
|
|
56
73
|
const ttl = this.deps.ttlMs ?? exports.DEFAULT_TTL_MS;
|
|
57
74
|
const interval = this.deps.refetchIntervalMs ?? exports.REFETCH_INTERVAL_MS;
|
|
@@ -72,7 +89,7 @@ class JwksCache {
|
|
|
72
89
|
}
|
|
73
90
|
this.lastAttemptAt = now;
|
|
74
91
|
try {
|
|
75
|
-
const response = await (this.deps.fetchImpl ?? fetch)(
|
|
92
|
+
const response = await (this.deps.fetchImpl ?? fetch)(url, {
|
|
76
93
|
headers: { accept: 'application/json' },
|
|
77
94
|
});
|
|
78
95
|
if (!response.ok)
|
package/dist/jwks-cache.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks-cache.js","sourceRoot":"","sources":["../src/jwks-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;
|
|
1
|
+
{"version":3,"file":"jwks-cache.js","sourceRoot":"","sources":["../src/jwks-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAkIH,0BAWC;AA3ID,wEAAwE;AAC3D,QAAA,mBAAmB,GAAG,MAAM,CAAC;AAE1C,+EAA+E;AAClE,QAAA,cAAc,GAAG,SAAS,CAAC;AAwBxC,MAAa,SAAS;IAOS;IANrB,MAAM,GAAgB,IAAI,CAAC;IAC3B,SAAS,GAAG,CAAC,CAAC;IACd,aAAa,GAAG,CAAC,CAAC;IAC1B,kEAAkE;IAClE,WAAW,GAAiB,OAAO,CAAC;IAEpC,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;IAAG,CAAC;IAEpD,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAEO,GAAG,CAAC,GAAuB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,GAAY;QACpB;;;;;WAKG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9B,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAChC,oEAAoE;YACpE,uDAAuD;YACvD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,sBAAc,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,2BAAmB,CAAC;QAEpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED;;;;WAIG;QACH,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;gBACzD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAE5E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAS,CAAC;YAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAE7E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;YACrB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,mDAAmD;YACnD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;CACF;AAjGD,8BAiGC;AAED,mEAAmE;AACnE,SAAgB,OAAO,CAAC,GAAW;IACjC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjE,CAAC;QACtB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
import { type KeyLike } from 'jose';
|
|
2
|
+
import type { Jwks } from './jwks-cache';
|
|
3
|
+
import type { SessionClaims } from './verify';
|
|
4
|
+
/**
|
|
5
|
+
* §1.3(c) hermetic test fixtures.
|
|
6
|
+
*
|
|
7
|
+
* A customer's CI must be able to prove its `@atlasauth/backend` verification
|
|
8
|
+
* works — accepts a good session token, rejects a bad one — WITHOUT reaching a
|
|
9
|
+
* live Atlas instance or its JWKS URL. So this module mints tokens with an
|
|
10
|
+
* ephemeral RS256 keypair it generates on the spot and hands back that key's
|
|
11
|
+
* public JWKS. Feed the JWKS to `new AtlasBackend({ jwks, issuer })` and the
|
|
12
|
+
* whole round trip — mint, sign, verify — happens in-process, offline.
|
|
13
|
+
*
|
|
14
|
+
* This is dev/test tooling shaped like Clerk's `@clerk/testing`: it lives in
|
|
15
|
+
* its own module (imported only by tests that want it, never by the hot
|
|
16
|
+
* verification path) and leans on `jose`, which the package already ships.
|
|
17
|
+
*/
|
|
18
|
+
/** Options for {@link createTestIssuer}. All optional — the defaults are usable as-is. */
|
|
19
|
+
export interface CreateTestIssuerOptions {
|
|
20
|
+
/** The `iss` the fixture stamps on every token. Defaults to a local test URL. */
|
|
21
|
+
issuer?: string;
|
|
22
|
+
/** The `kid` on the signing key and in the published JWKS. */
|
|
23
|
+
kid?: string;
|
|
24
|
+
/**
|
|
25
|
+
* A clock, in epoch milliseconds, for `iat`/`exp`. Pass the SAME `now` you
|
|
26
|
+
* give `AtlasBackend` to make time deterministic across mint and verify.
|
|
27
|
+
*/
|
|
28
|
+
now?: () => number;
|
|
29
|
+
/** Default token lifetime in seconds, matching Atlas's 60 s default. */
|
|
30
|
+
ttlSeconds?: number;
|
|
31
|
+
}
|
|
32
|
+
/** A fixture issuer: an in-memory keypair, its public JWKS, and a token minter. */
|
|
33
|
+
export interface TestIssuer {
|
|
34
|
+
/** The `iss` this fixture stamps — pass it straight to `AtlasBackend({ issuer })`. */
|
|
35
|
+
issuer: string;
|
|
36
|
+
/** The public JSON Web Key Set — pass it to `AtlasBackend({ jwks })` for offline verify. */
|
|
37
|
+
jwks: Jwks;
|
|
38
|
+
/** The `kid` shared by the signing key and the JWKS entry. */
|
|
39
|
+
kid: string;
|
|
40
|
+
/** The private signing key, for tests that need to sign something by hand. */
|
|
41
|
+
privateKey: KeyLike;
|
|
42
|
+
/**
|
|
43
|
+
* Mint a signed session JWT. Defaults produce a token this fixture's JWKS
|
|
44
|
+
* verifies as a first-party session (`token_use:'session'`, valid `iss`,
|
|
45
|
+
* `sub`, `sid`, `azp`, `iat`/`exp`). Any field in `claims` overrides a
|
|
46
|
+
* default — set `iss` to forge a wrong-issuer token, `exp` to forge an
|
|
47
|
+
* expired one, add `org_id`/`org_permissions` to exercise authorization.
|
|
48
|
+
*/
|
|
49
|
+
mintSession(claims?: Partial<SessionClaims>): Promise<string>;
|
|
50
|
+
}
|
|
51
|
+
/**
|
|
52
|
+
* Build an offline test issuer. Generates an RS256 keypair, exposes its public
|
|
53
|
+
* JWKS, and returns a `mintSession` that signs tokens with the private half.
|
|
54
|
+
*
|
|
55
|
+
* ```ts
|
|
56
|
+
* const fx = await createTestIssuer();
|
|
57
|
+
* const atlas = new AtlasBackend({ jwks: fx.jwks, issuer: fx.issuer });
|
|
58
|
+
* const r = await atlas.verify(await fx.mintSession({ sub: 'user_x' }));
|
|
59
|
+
* // r.ok === true — no network call was made.
|
|
60
|
+
* ```
|
|
61
|
+
*/
|
|
62
|
+
export declare function createTestIssuer(options?: CreateTestIssuerOptions): Promise<TestIssuer>;
|
package/dist/testing.js
ADDED
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.createTestIssuer = createTestIssuer;
|
|
4
|
+
const jose_1 = require("jose");
|
|
5
|
+
const DEFAULT_ISSUER = 'https://test-instance.fapi.atlas.local';
|
|
6
|
+
const DEFAULT_KID = 'atlas-test-key-1';
|
|
7
|
+
const DEFAULT_TTL_SECONDS = 60;
|
|
8
|
+
/**
|
|
9
|
+
* Build an offline test issuer. Generates an RS256 keypair, exposes its public
|
|
10
|
+
* JWKS, and returns a `mintSession` that signs tokens with the private half.
|
|
11
|
+
*
|
|
12
|
+
* ```ts
|
|
13
|
+
* const fx = await createTestIssuer();
|
|
14
|
+
* const atlas = new AtlasBackend({ jwks: fx.jwks, issuer: fx.issuer });
|
|
15
|
+
* const r = await atlas.verify(await fx.mintSession({ sub: 'user_x' }));
|
|
16
|
+
* // r.ok === true — no network call was made.
|
|
17
|
+
* ```
|
|
18
|
+
*/
|
|
19
|
+
async function createTestIssuer(options = {}) {
|
|
20
|
+
const issuer = options.issuer ?? DEFAULT_ISSUER;
|
|
21
|
+
const kid = options.kid ?? DEFAULT_KID;
|
|
22
|
+
const ttlSeconds = options.ttlSeconds ?? DEFAULT_TTL_SECONDS;
|
|
23
|
+
const clock = options.now ?? Date.now;
|
|
24
|
+
const { privateKey, publicKey } = await (0, jose_1.generateKeyPair)('RS256');
|
|
25
|
+
// The published key: the public half plus the `kid`/`alg`/`use` a JWKS
|
|
26
|
+
// consumer keys on — the same shape Atlas serves at `/.well-known/jwks.json`.
|
|
27
|
+
const publicJwk = { ...(await (0, jose_1.exportJWK)(publicKey)), kid, alg: 'RS256', use: 'sig' };
|
|
28
|
+
const jwks = { keys: [publicJwk] };
|
|
29
|
+
async function mintSession(claims = {}) {
|
|
30
|
+
const nowSeconds = Math.floor(clock() / 1000);
|
|
31
|
+
// System defaults first, caller overrides last — so `mintSession({ iss })`
|
|
32
|
+
// or `mintSession({ exp })` forges exactly the token a rejection test needs.
|
|
33
|
+
const payload = {
|
|
34
|
+
iss: issuer,
|
|
35
|
+
sub: 'user_test',
|
|
36
|
+
sid: 'sess_test',
|
|
37
|
+
azp: issuer,
|
|
38
|
+
sv: 1,
|
|
39
|
+
mfa: false,
|
|
40
|
+
// The §13.1 marker the SDK's requireSessionToken path accepts. A fixture
|
|
41
|
+
// token is a session token, never an OP access/id token.
|
|
42
|
+
token_use: 'session',
|
|
43
|
+
iat: nowSeconds,
|
|
44
|
+
exp: nowSeconds + ttlSeconds,
|
|
45
|
+
...claims,
|
|
46
|
+
};
|
|
47
|
+
return new jose_1.SignJWT(payload).setProtectedHeader({ alg: 'RS256', kid }).sign(privateKey);
|
|
48
|
+
}
|
|
49
|
+
return { issuer, jwks, kid, privateKey, mintSession };
|
|
50
|
+
}
|
|
51
|
+
//# sourceMappingURL=testing.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":";;AAqEA,4CAqCC;AA1GD,+BAAyE;AAsDzE,MAAM,cAAc,GAAG,wCAAwC,CAAC;AAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;;;;;GAUG;AACI,KAAK,UAAU,gBAAgB,CACpC,UAAmC,EAAE;IAErC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEtC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,sBAAe,EAAC,OAAO,CAAC,CAAC;IACjE,uEAAuE;IACvE,8EAA8E;IAC9E,MAAM,SAAS,GAAG,EAAE,GAAG,CAAC,MAAM,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACrF,MAAM,IAAI,GAAS,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IAEzC,KAAK,UAAU,WAAW,CAAC,SAAiC,EAAE;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9C,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,WAAW;YAChB,GAAG,EAAE,WAAW;YAChB,GAAG,EAAE,MAAM;YACX,EAAE,EAAE,CAAC;YACL,GAAG,EAAE,KAAK;YACV,yEAAyE;YACzE,yDAAyD;YACzD,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,UAAU,GAAG,UAAU;YAC5B,GAAG,MAAM;SACV,CAAC;QAEF,OAAO,IAAI,cAAO,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AACxD,CAAC"}
|
package/dist/verify.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { type ProtectCondition } from '@atlasauth/authz';
|
|
2
|
+
import { type Jwks } from './jwks-cache';
|
|
2
3
|
export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, isRoleKey, isPermissionKey, } from '@atlasauth/authz';
|
|
3
4
|
/**
|
|
4
5
|
* §7.3 verification by customer backends.
|
|
@@ -93,8 +94,21 @@ export type VerifyResult = AuthorizedSession | {
|
|
|
93
94
|
reason: 'malformed' | 'invalid' | 'no_keys' | 'unauthorized_party';
|
|
94
95
|
};
|
|
95
96
|
export interface AtlasBackendOptions {
|
|
96
|
-
/**
|
|
97
|
-
|
|
97
|
+
/**
|
|
98
|
+
* The instance's JWKS URL. Provide exactly one of `jwksUrl` or `jwks`: with a
|
|
99
|
+
* URL, keys are fetched and cached (the production default); with a static
|
|
100
|
+
* `jwks`, verification is fully offline.
|
|
101
|
+
*/
|
|
102
|
+
jwksUrl?: string;
|
|
103
|
+
/**
|
|
104
|
+
* A static JSON Web Key Set to verify against, INSTEAD of fetching from a URL.
|
|
105
|
+
* When set, verification makes NO network call — the hermetic path a
|
|
106
|
+
* customer's CI uses to validate Atlas-minted test session JWTs (§1.3c). The
|
|
107
|
+
* `@atlasauth/backend/testing` `createTestIssuer()` helper produces a matching
|
|
108
|
+
* `{ jwks }`. Signature, issuer, `token_use` and `azp` checks are unchanged;
|
|
109
|
+
* only where the keys come from differs. Mutually exclusive with `jwksUrl`.
|
|
110
|
+
*/
|
|
111
|
+
jwks?: Jwks;
|
|
98
112
|
/** Expected `iss`. Required — an unchecked issuer accepts any Atlas instance. */
|
|
99
113
|
issuer: string;
|
|
100
114
|
/**
|
|
@@ -139,6 +153,25 @@ export declare class AtlasBackend {
|
|
|
139
153
|
get(name: string): string | null;
|
|
140
154
|
} | Record<string, string | undefined>;
|
|
141
155
|
}): Promise<VerifyResult>;
|
|
156
|
+
/**
|
|
157
|
+
* §migration — redirect forwarding.
|
|
158
|
+
*
|
|
159
|
+
* Build the URL your provider callback should 302 to when you KEPT your own,
|
|
160
|
+
* already-registered provider callback (a connection's `custom_redirect_uri`)
|
|
161
|
+
* instead of registering Atlas's `<fapi>/v1/oauth/callback/<provider>`. The
|
|
162
|
+
* provider redirects to your callback with `?code&state`; you forward those to
|
|
163
|
+
* Atlas, which holds the `client_secret`, completes the exchange and issues the
|
|
164
|
+
* session. Your handler is then a one-liner:
|
|
165
|
+
*
|
|
166
|
+
* res.redirect(302, atlas.oauthCallbackForwardUrl('github', req.url));
|
|
167
|
+
*
|
|
168
|
+
* The target is derived from the configured `issuer` (your instance's FAPI
|
|
169
|
+
* host), so it's correct on the shared host and on a custom domain alike. Only
|
|
170
|
+
* the OAuth callback params are carried across — there is no open-ended
|
|
171
|
+
* passthrough of caller-controlled query into Atlas's callback — and `state`
|
|
172
|
+
* (which Atlas minted and validates) rides along so the forward can't strip it.
|
|
173
|
+
*/
|
|
174
|
+
oauthCallbackForwardUrl(provider: string, incoming: string | URLSearchParams | Record<string, string | string[] | undefined>): string;
|
|
142
175
|
}
|
|
143
176
|
/**
|
|
144
177
|
* §8.2 permission check, for gating a customer's own routes.
|
package/dist/verify.js
CHANGED
|
@@ -60,8 +60,17 @@ class AtlasBackend {
|
|
|
60
60
|
jwks;
|
|
61
61
|
constructor(options) {
|
|
62
62
|
this.options = options;
|
|
63
|
+
// Exactly one key source. Two would be ambiguous (which wins?), and zero
|
|
64
|
+
// leaves nothing to verify against — either is a configuration error worth
|
|
65
|
+
// failing loudly on rather than silently accepting or rejecting every token.
|
|
66
|
+
const hasUrl = typeof options.jwksUrl === 'string' && options.jwksUrl.length > 0;
|
|
67
|
+
const hasStatic = options.jwks !== undefined;
|
|
68
|
+
if (hasUrl === hasStatic) {
|
|
69
|
+
throw new Error('AtlasBackend needs exactly one key source: pass `jwksUrl` (fetch from the instance) OR `jwks` (a static key set for offline verification), not both and not neither.');
|
|
70
|
+
}
|
|
63
71
|
this.jwks = new jwks_cache_1.JwksCache({
|
|
64
72
|
url: options.jwksUrl,
|
|
73
|
+
staticJwks: options.jwks,
|
|
65
74
|
fetchImpl: options.fetchImpl,
|
|
66
75
|
now: options.now,
|
|
67
76
|
});
|
|
@@ -175,8 +184,70 @@ class AtlasBackend {
|
|
|
175
184
|
return { ok: false, reason: 'malformed' };
|
|
176
185
|
return this.verify(token);
|
|
177
186
|
}
|
|
187
|
+
/**
|
|
188
|
+
* §migration — redirect forwarding.
|
|
189
|
+
*
|
|
190
|
+
* Build the URL your provider callback should 302 to when you KEPT your own,
|
|
191
|
+
* already-registered provider callback (a connection's `custom_redirect_uri`)
|
|
192
|
+
* instead of registering Atlas's `<fapi>/v1/oauth/callback/<provider>`. The
|
|
193
|
+
* provider redirects to your callback with `?code&state`; you forward those to
|
|
194
|
+
* Atlas, which holds the `client_secret`, completes the exchange and issues the
|
|
195
|
+
* session. Your handler is then a one-liner:
|
|
196
|
+
*
|
|
197
|
+
* res.redirect(302, atlas.oauthCallbackForwardUrl('github', req.url));
|
|
198
|
+
*
|
|
199
|
+
* The target is derived from the configured `issuer` (your instance's FAPI
|
|
200
|
+
* host), so it's correct on the shared host and on a custom domain alike. Only
|
|
201
|
+
* the OAuth callback params are carried across — there is no open-ended
|
|
202
|
+
* passthrough of caller-controlled query into Atlas's callback — and `state`
|
|
203
|
+
* (which Atlas minted and validates) rides along so the forward can't strip it.
|
|
204
|
+
*/
|
|
205
|
+
oauthCallbackForwardUrl(provider, incoming) {
|
|
206
|
+
if (!/^[a-z0-9_]+$/i.test(provider)) {
|
|
207
|
+
throw new Error(`Invalid provider key: ${JSON.stringify(provider)}`);
|
|
208
|
+
}
|
|
209
|
+
const src = toForwardParams(incoming);
|
|
210
|
+
const out = new URLSearchParams();
|
|
211
|
+
for (const key of ['code', 'state', 'error', 'error_description', 'error_uri', 'iss']) {
|
|
212
|
+
const v = src.get(key);
|
|
213
|
+
if (v != null && v !== '')
|
|
214
|
+
out.set(key, v);
|
|
215
|
+
}
|
|
216
|
+
const base = this.options.issuer.replace(/\/+$/, '');
|
|
217
|
+
const qs = out.toString();
|
|
218
|
+
return `${base}/v1/oauth/callback/${provider}${qs ? `?${qs}` : ''}`;
|
|
219
|
+
}
|
|
178
220
|
}
|
|
179
221
|
exports.AtlasBackend = AtlasBackend;
|
|
222
|
+
/**
|
|
223
|
+
* Normalise whatever a framework hands a callback handler — Node's `req.url`
|
|
224
|
+
* (path+query), a full URL, a bare query string, Express's `req.query` object, or
|
|
225
|
+
* a `URLSearchParams` — into query params, so `oauthCallbackForwardUrl` accepts
|
|
226
|
+
* them all.
|
|
227
|
+
*/
|
|
228
|
+
function toForwardParams(incoming) {
|
|
229
|
+
if (incoming instanceof URLSearchParams)
|
|
230
|
+
return incoming;
|
|
231
|
+
if (typeof incoming === 'object' && incoming !== null) {
|
|
232
|
+
const p = new URLSearchParams();
|
|
233
|
+
for (const [k, v] of Object.entries(incoming)) {
|
|
234
|
+
if (Array.isArray(v)) {
|
|
235
|
+
if (v[0] != null)
|
|
236
|
+
p.set(k, String(v[0]));
|
|
237
|
+
}
|
|
238
|
+
else if (v != null) {
|
|
239
|
+
p.set(k, String(v));
|
|
240
|
+
}
|
|
241
|
+
}
|
|
242
|
+
return p;
|
|
243
|
+
}
|
|
244
|
+
const s = String(incoming);
|
|
245
|
+
const qIdx = s.indexOf('?');
|
|
246
|
+
if (qIdx >= 0)
|
|
247
|
+
return new URLSearchParams(s.slice(qIdx + 1));
|
|
248
|
+
// No '?': a bare query string ("code=…&state=…") vs a bare path ("/cb").
|
|
249
|
+
return s.includes('=') ? new URLSearchParams(s) : new URLSearchParams();
|
|
250
|
+
}
|
|
180
251
|
function readHeader(headers, name) {
|
|
181
252
|
if (typeof headers.get === 'function') {
|
|
182
253
|
return headers.get(name) ?? undefined;
|
package/dist/verify.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";;;AAoZA,sCAEC;AAED,0BAEC;AAOD,kBAEC;AAMD,0BAIC;AA7aD,+BAAoD;AACpD,4CAK0B;AAC1B,6CAA6D;AAE7D,6EAA6E;AAC7E,kFAAkF;AAClF,yEAAyE;AACzE,0CAW0B;AANxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAGjB;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAClE,QAAA,kBAAkB,GAAG,CAAC,CAAC;AA0EpC,kFAAkF;AAClF,SAAS,UAAU,CAAC,MAAqB;IACvC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,wEAAwE;QACxE,oEAAoE;QACpE,KAAK,EACH,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG;YAChE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACzB,CAAC,CAAC,IAAI;QACV,GAAG,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC;QACzD,OAAO,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAgCD,MAAa,YAAY;IAGM;IAFZ,IAAI,CAAY;IAEjC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,sKAAsK,CACvK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,sBAAS,CAAC;YACxB,GAAG,EAAE,OAAO,CAAC,OAAO;YACpB,UAAU,EAAE,OAAO,CAAC,IAAI;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEvF,MAAM,IAAI,GAAgB,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBAC3E,uEAAuE;gBACvE,6DAA6D;gBAC7D,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,cAAc,EAAE,0BAAkB;gBAClC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACzE,CAAC,CAAC;YACH,MAAM,GAAG,OAAmC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED;;;;;;;;WAQG;QACH,MAAM,QAAQ,GAAI,MAAkC,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACrD,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,4EAA4E;QAC5E,sCAAsC;QACtC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAE5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,mKAAmK,CACpK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACtD,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,mBAAmB,EAC9C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;oBACjD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;YAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAEzB;QACC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAEtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,uBAAuB,CACrB,QAAgB,EAChB,QAAkF;QAElF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;YACtF,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,sBAAsB,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC;CACF;AArLD,oCAqLC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,QAAkF;IAElF,IAAI,QAAQ,YAAY,eAAe;QAAE,OAAO,QAAQ,CAAC;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI;oBAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,yEAAyE;IACzE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CACjB,OAAkF,EAClF,IAAY;IAEZ,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAA6C,CAAC;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,IAAY;IAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,MAAqB,EAAE,UAAkB;IACrE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,OAAO,CAAC,MAAqB,EAAE,IAAY;IACzD,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,GAAG,CAAC,MAAqB,EAAE,YAA8B,EAAE;IACzE,OAAO,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,MAAqB,EAAE,YAA8B,EAAE;IAC7E,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,11 +1,16 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atlasauth/backend",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.4",
|
|
4
4
|
"main": "./dist/index.js",
|
|
5
5
|
"types": "./dist/index.d.ts",
|
|
6
|
+
"scripts": {
|
|
7
|
+
"build": "tsc -p tsconfig.build.json",
|
|
8
|
+
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
9
|
+
"test": "vitest run"
|
|
10
|
+
},
|
|
6
11
|
"dependencies": {
|
|
7
12
|
"jose": "^5.9.6",
|
|
8
|
-
"@atlasauth/authz": "
|
|
13
|
+
"@atlasauth/authz": "workspace:*"
|
|
9
14
|
},
|
|
10
15
|
"devDependencies": {
|
|
11
16
|
"typescript": "^5.6.3",
|
|
@@ -17,10 +22,5 @@
|
|
|
17
22
|
"files": [
|
|
18
23
|
"dist",
|
|
19
24
|
"README.md"
|
|
20
|
-
]
|
|
21
|
-
|
|
22
|
-
"build": "tsc -p tsconfig.build.json",
|
|
23
|
-
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
24
|
-
"test": "vitest run"
|
|
25
|
-
}
|
|
26
|
-
}
|
|
25
|
+
]
|
|
26
|
+
}
|