@axinom/mosaic-id-guard 0.34.0-rc.1 → 0.34.0-rc.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/common/get-authenticated-subject.d.ts.map +1 -1
- package/dist/common/get-authenticated-subject.js +6 -5
- package/dist/common/get-authenticated-subject.js.map +1 -1
- package/dist/common/parse-jwt-token.d.ts.map +1 -1
- package/dist/common/parse-jwt-token.js +15 -22
- package/dist/common/parse-jwt-token.js.map +1 -1
- package/package.json +7 -7
- package/src/common/get-authenticated-subject.ts +9 -9
- package/src/common/parse-jwt-token.spec.ts +2 -2
- package/src/common/parse-jwt-token.ts +19 -26
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-authenticated-subject.d.ts","sourceRoot":"","sources":["../../src/common/get-authenticated-subject.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"get-authenticated-subject.d.ts","sourceRoot":"","sources":["../../src/common/get-authenticated-subject.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,8BAA8B,EAC9B,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAEjB,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,UACrC,MAAM,cACD,MAAM,GAAG,oBAAoB,KACxC,QAAQ,8BAA8B,CAsDxC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,UAC3B,MAAM,cACD,MAAM,GAAG,oBAAoB,KACxC,QAAQ,oBAAoB,GAAG,+BAA+B,CAqEhE,CAAC"}
|
|
@@ -125,12 +125,13 @@ const verifyTokenAndGetAuthenticatedSubject = async (token, jwksUri, authType) =
|
|
|
125
125
|
const jwksClient = (0, jwks_client_1.getJwksClient)(jwksUri);
|
|
126
126
|
const getPublicKey = (header, callback) => {
|
|
127
127
|
var _a;
|
|
128
|
-
jwksClient
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
return;
|
|
132
|
-
}
|
|
128
|
+
jwksClient
|
|
129
|
+
.getSigningKey((_a = header.kid) !== null && _a !== void 0 ? _a : 'MISSING_KEY_ID_IN_JWT_HEADER')
|
|
130
|
+
.then((key) => {
|
|
133
131
|
callback(null, key.getPublicKey());
|
|
132
|
+
}, (error) => {
|
|
133
|
+
reject(error);
|
|
134
|
+
return;
|
|
134
135
|
});
|
|
135
136
|
};
|
|
136
137
|
jsonwebtoken_1.default.verify(token, getPublicKey, (0, jwt_verify_options_1.getJwtVerifyOptions)(), (error, decoded) => {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-authenticated-subject.js","sourceRoot":"","sources":["../../src/common/get-authenticated-subject.ts"],"names":[],"mappings":";;;;;;AAAA,yEAAmE;AACnE,gEAA+B;
|
|
1
|
+
{"version":3,"file":"get-authenticated-subject.js","sourceRoot":"","sources":["../../src/common/get-authenticated-subject.ts"],"names":[],"mappings":";;;;;;AAAA,yEAAmE;AACnE,gEAA+B;AAC/B,qDAAgD;AAChD,uDAAkD;AAClD,+CAA8C;AAC9C,6DAI8B;AAC9B,iDAA6C;AAQhC,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAEzE;;;;;;;GAOG;AACI,MAAM,iCAAiC,GAAG,KAAK,EACpD,KAAa,EACb,UAAyC,EACA,EAAE;IAC3C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAmC,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,gEAAgE;IAChE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5B,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACtC,uBAAuB;QACrB,OAAO,CAAC,WAAW,KAAK,0BAAW,CAAC,qBAAqB,CAAC;IAE5D,0GAA0G;IAC1G,IAAI,MAAM,KAAK,4CAAuB,EAAE;QACtC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,IAAI,uBAAuB,EAAE;gBAC3B,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;aAC9D;iBAAM;gBACL,OAAO,GAAG,IAAI,GAAG,CACf,IAAI,QAAQ,IAAI,aAAa,wBAAwB,EACrD,UAAU,CACX,CAAC,IAAI,CAAC;aACR;SACF;aAAM;YACL,6EAA6E;YAC7E,IACE,CAAC,IAAA,0CAAkB,EAAC,UAAU,CAAC,QAAQ,CAAC;gBACxC,CAAC,IAAA,0CAAkB,EAAC,UAAU,CAAC,aAAa,CAAC,EAC7C;gBACA,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAC/B,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;aAC1C;YAED,IAAI,uBAAuB,EAAE;gBAC3B,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,UAAU,CAAC,YAAY,CAAC;qBACjE,IAAI,CAAC;aACT;iBAAM;gBACL,OAAO,GAAG,IAAI,GAAG,CACf,IAAI,QAAQ,IAAI,aAAa,wBAAwB,EACrD,UAAU,CAAC,YAAY,CACxB,CAAC,IAAI,CAAC;aACR;SACF;KACF;IAED,iCAAiC;IACjC,OAAO,CAAC,MAAM,qCAAqC,CACjD,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAmC,CAAC;AACvC,CAAC,CAAC;AAzDW,QAAA,iCAAiC,qCAyD5C;AAEF;;;;;;;GAOG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,KAAa,EACb,UAAyC,EACwB,EAAE;IACnE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,YAAY,GAAG,EAAE,CAAC;IAEtB,MAAM,YAAY,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;IAElE,kCAAkC;IAClC,IAAI,YAAY,CAAC,mCAA2B,CAAC,KAAK,SAAS,EAAE;QAC3D,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,mCAA2B,CAAC,CAAC,CAAC;KAClE;SAAM;QACL,YAAY,GAAG,KAAK,CAAC;KACtB;IAED,MAAM,mBAAmB,GAAG,sBAAG,CAAC,MAAM,CACpC,YAAY,CACsB,CAAC;IAErC,0HAA0H;IAC1H,IAAI,IAAA,0CAAkB,EAAC,mBAAmB,CAAC,EAAE;QAC3C,MAAM,IAAI,6BAAY,CAAC,+BAAa,CAAC,0BAA0B,CAAC,CAAC;KAClE;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC;IACvC,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IACxC,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC;IAClD,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC;IAExD,4GAA4G;IAC5G,IAAI,MAAM,KAAK,8CAAyB,EAAE;QACxC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,OAAO,GAAG,IAAI,GAAG,CACf,IAAI,QAAQ,IAAI,aAAa,IAAI,aAAa,wBAAwB,EACtE,UAAU,CACX,CAAC,IAAI,CAAC;SACR;aAAM;YACL,6EAA6E;YAC7E,IACE,CAAC,IAAA,0CAAkB,EAAC,UAAU,CAAC,QAAQ,CAAC;gBACxC,CAAC,IAAA,0CAAkB,EAAC,UAAU,CAAC,aAAa,CAAC,EAC7C;gBACA,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAC/B,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;aAC1C;YAED,OAAO,GAAG,IAAI,GAAG,CACf,IAAI,QAAQ,IAAI,aAAa,IAAI,aAAa,wBAAwB,EACtE,UAAU,CAAC,YAAY,CACxB,CAAC,IAAI,CAAC;SACR;KACF;IAED,IAAI,mBAAmB,CAAC,WAAW,KAAK,0BAAW,CAAC,kBAAkB,EAAE;QACtE,iCAAiC;QACjC,OAAO,CAAC,MAAM,qCAAqC,CACjD,YAAY,EACZ,OAAO,EACP,sBAAsB,CACvB,CAAoC,CAAC;KACvC;SAAM,IAAI,mBAAmB,CAAC,WAAW,KAAK,0BAAW,CAAC,cAAc,EAAE;QACzE,iCAAiC;QACjC,OAAO,CAAC,MAAM,qCAAqC,CACjD,YAAY,EACZ,OAAO,EACP,UAAU,CACX,CAAyB,CAAC;KAC5B;SAAM;QACL,MAAM,IAAI,6BAAY,CAAC,+BAAa,CAAC,0BAA0B,CAAC,CAAC;KAClE;AACH,CAAC,CAAC;AAxEW,QAAA,uBAAuB,2BAwElC;AAEF,MAAM,qCAAqC,GAAG,KAAK,EACjD,KAAa,EACb,OAAe,EACf,QAA4D,EAK5D,EAAE;IACF,OAAO,IAAI,OAAO,CAIhB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpB,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,YAAY,GAA6B,CAC7C,MAAqB,EACrB,QAAgC,EAC1B,EAAE;;YACR,UAAU;iBACP,aAAa,CAAC,MAAA,MAAM,CAAC,GAAG,mCAAI,8BAA8B,CAAC;iBAC3D,IAAI,CACH,CAAC,GAAG,EAAE,EAAE;gBACN,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;YACrC,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;gBACR,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC,CACF,CAAC;QACN,CAAC,CAAC;QAEF,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,IAAA,wCAAmB,GAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACxE,IAAI,KAAK,EAAE;gBACT,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;aACR;YAED,IAAI,QAAQ,KAAK,YAAY,EAAE;gBAC7B,OAAO,CAAC,OAAyC,CAAC,CAAC;aACpD;iBAAM,IAAI,QAAQ,KAAK,UAAU,EAAE;gBAClC,OAAO,CAAC,OAA+B,CAAC,CAAC;aAC1C;iBAAM;gBACL,OAAO,CAAC,OAA0C,CAAC,CAAC;aACrD;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parse-jwt-token.d.ts","sourceRoot":"","sources":["../../src/common/parse-jwt-token.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"parse-jwt-token.d.ts","sourceRoot":"","sources":["../../src/common/parse-jwt-token.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,oBAAoB,EAEpB,8BAA8B,EAC9B,oBAAoB,EACpB,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,SAAS,CAAC;AAEjB;;;;;GAKG;AACH,eAAO,MAAM,aAAa,UACjB,MAAM,GAAG,SAAS,cACb,MAAM,GAAG,oBAAoB,aAC9B,YAAY,GAAG,UAAU,KACnC,QAAQ,+BAA+B,GAAG,4BAA4B,CAoFxE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,UAC/B,MAAM,KACZ,8BAEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,UAC5B,MAAM,KACZ,oBAEF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,UACzB,MAAM,wBACS,MAAM,KAC3B,QAAQ,OAAO,CAsBjB,CAAC"}
|
|
@@ -32,6 +32,7 @@ const fs = __importStar(require("fs"));
|
|
|
32
32
|
const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
|
|
33
33
|
const get_authenticated_subject_1 = require("./get-authenticated-subject");
|
|
34
34
|
const helpers_1 = require("./helpers");
|
|
35
|
+
const id_guard_error_1 = require("./id-guard-error");
|
|
35
36
|
const id_guard_errors_1 = require("./id-guard-errors");
|
|
36
37
|
const jwks_client_1 = require("./jwks-client");
|
|
37
38
|
const jwt_verify_options_1 = require("./jwt-verify-options");
|
|
@@ -148,29 +149,21 @@ exports.decodeEndUserAccessToken = decodeEndUserAccessToken;
|
|
|
148
149
|
* @returns
|
|
149
150
|
*/
|
|
150
151
|
const checkSigningKeyExists = async (token, idServiceAuthBaseUrl) => {
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
152
|
+
const decodedJwt = jsonwebtoken_1.default.decode(token, { complete: true });
|
|
153
|
+
if (decodedJwt === null) {
|
|
154
|
+
throw new id_guard_error_1.IdGuardError(id_guard_errors_1.IdGuardErrors.AccessTokenInvalid);
|
|
155
|
+
}
|
|
156
|
+
const subject = decodedJwt === null || decodedJwt === void 0 ? void 0 : decodedJwt.payload;
|
|
157
|
+
const jwksUri = new URL(`/${subject.tenantId}/${subject.environmentId}/.well-known/jwks.json`, idServiceAuthBaseUrl);
|
|
158
|
+
const jwksClient = (0, jwks_client_1.getJwksClient)(jwksUri.toString());
|
|
159
|
+
const keys = await jwksClient.getKeys();
|
|
160
|
+
const signingKeys = keys;
|
|
161
|
+
for (const idx in signingKeys) {
|
|
162
|
+
if (signingKeys[idx]['kid'] === (decodedJwt === null || decodedJwt === void 0 ? void 0 : decodedJwt.header.kid)) {
|
|
163
|
+
return true;
|
|
156
164
|
}
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
const jwksClient = (0, jwks_client_1.getJwksClient)(jwksUri.toString());
|
|
160
|
-
jwksClient.getKeys((error, keys) => {
|
|
161
|
-
if (error) {
|
|
162
|
-
reject(error);
|
|
163
|
-
return;
|
|
164
|
-
}
|
|
165
|
-
const signingKeys = keys;
|
|
166
|
-
for (const idx in signingKeys) {
|
|
167
|
-
if (signingKeys[idx]['kid'] === (decodedJwt === null || decodedJwt === void 0 ? void 0 : decodedJwt.header.kid)) {
|
|
168
|
-
return resolve(true);
|
|
169
|
-
}
|
|
170
|
-
}
|
|
171
|
-
return resolve(false);
|
|
172
|
-
});
|
|
173
|
-
});
|
|
165
|
+
}
|
|
166
|
+
return false;
|
|
174
167
|
};
|
|
175
168
|
exports.checkSigningKeyExists = checkSigningKeyExists;
|
|
176
169
|
//# sourceMappingURL=parse-jwt-token.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parse-jwt-token.js","sourceRoot":"","sources":["../../src/common/parse-jwt-token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yEAGuC;AACvC,uCAAyB;AACzB,gEAA+B;AAE/B,2EAGqC;AACrC,uCAAgD;AAChD,uDAAkD;AAClD,+CAA8C;AAC9C,6DAA2D;AAC3D,iDAA6C;AAU7C;;;;;GAKG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,KAAyB,EACzB,UAAyC,EACzC,QAAoC,EACqC,EAAE;IAC3E,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAgC,CAAC;IACrC,IAAI,OAAqD,CAAC;IAC1D,IAAI,OAIS,CAAC;IACd,IAAI,aAA0C,CAAC;IAE/C,IAAI,CAAC,IAAA,0CAAkB,EAAC,KAAK,CAAC,EAAE;QAC9B,IAAI;YACF,yIAAyI;YACzI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;gBAClC,IAAI,QAAQ,KAAK,SAAS,EAAE;oBAC1B,IAAI,GAAG,+BAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAC5C,OAAO;wBACL,wEAAwE,CAAC;oBAC3E,aAAa,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;iBACpC;qBAAM;oBACL,MAAM,aAAa,GAAG,UAAoB,CAAC;oBAC3C,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;oBACzD,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAA,wCAAmB,GAAE,CAAC,CAAC;oBACpE,OAAO,GAAG,OAAyC,CAAC;iBACrD;aACF;iBAAM;gBACL,IAAI,QAAQ,KAAK,SAAS,EAAE;oBAC1B,IAAI,GAAG,+BAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAC5C,OAAO,GAAG,oDAAoD,CAAC;oBAC/D,aAAa,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;iBACpC;qBAAM,IAAI,QAAQ,KAAK,YAAY,EAAE;oBACpC,OAAO,GAAG,MAAM,IAAA,6DAAiC,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC;iBACtE;qBAAM,IAAI,QAAQ,KAAK,UAAU,EAAE;oBAClC,OAAO,GAAG,MAAM,IAAA,mDAAuB,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC;iBAC5D;aACF;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,GAAG,IAAA,6BAAmB,EAC3D,GAAG,EACH,QAAQ,EACR,KAAK,EACL,UAAU,CACX,CAAC;SACH;KACF;SAAM;QACL,IAAI,GAAG,+BAAa,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC9C,OAAO,GAAG,+BAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC;QACpD,aAAa,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;KACpC;IAED,IACE,IAAI,KAAK,SAAS;QAClB,OAAO,KAAK,SAAS;QACrB,aAAa,KAAK,SAAS,EAC3B;QACA,aAAa,GAAG;YACd,IAAI;YACJ,OAAO;YACP,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC;KACH;IAED,gDAAgD;IAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE;QAC/D,OAAO;YACL,OAAO,EAAE,OAAyC;YAClD,aAAa;SACd,CAAC;KACH;SAAM;QACL,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,MAAK,0BAAW,CAAC,cAAc,EAAE;YACvD,OAAO;gBACL,OAAO,EAAE,OAA+B;gBACxC,aAAa;aACd,CAAC;SACH;aAAM;YACL,OAAO;gBACL,OAAO,EAAE,OAA0C;gBACnD,aAAa;aACd,CAAC;SACH;KACF;AACH,CAAC,CAAC;AAxFW,QAAA,aAAa,iBAwFxB;AAEF;;;;GAIG;AACI,MAAM,2BAA2B,GAAG,CACzC,KAAa,EACmB,EAAE;IAClC,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAmC,CAAC;AAC7D,CAAC,CAAC;AAJW,QAAA,2BAA2B,+BAItC;AAEF;;;;GAIG;AACI,MAAM,wBAAwB,GAAG,CACtC,KAAa,EACS,EAAE;IACxB,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAyB,CAAC;AACnD,CAAC,CAAC;AAJW,QAAA,wBAAwB,4BAInC;AAEF;;;;;;GAMG;AACI,MAAM,qBAAqB,GAAG,KAAK,EACxC,KAAa,EACb,oBAA4B,EACV,EAAE;IACpB,
|
|
1
|
+
{"version":3,"file":"parse-jwt-token.js","sourceRoot":"","sources":["../../src/common/parse-jwt-token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yEAGuC;AACvC,uCAAyB;AACzB,gEAA+B;AAE/B,2EAGqC;AACrC,uCAAgD;AAChD,qDAAgD;AAChD,uDAAkD;AAClD,+CAA8C;AAC9C,6DAA2D;AAC3D,iDAA6C;AAU7C;;;;;GAKG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,KAAyB,EACzB,UAAyC,EACzC,QAAoC,EACqC,EAAE;IAC3E,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAgC,CAAC;IACrC,IAAI,OAAqD,CAAC;IAC1D,IAAI,OAIS,CAAC;IACd,IAAI,aAA0C,CAAC;IAE/C,IAAI,CAAC,IAAA,0CAAkB,EAAC,KAAK,CAAC,EAAE;QAC9B,IAAI;YACF,yIAAyI;YACzI,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;gBAClC,IAAI,QAAQ,KAAK,SAAS,EAAE;oBAC1B,IAAI,GAAG,+BAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAC5C,OAAO;wBACL,wEAAwE,CAAC;oBAC3E,aAAa,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;iBACpC;qBAAM;oBACL,MAAM,aAAa,GAAG,UAAoB,CAAC;oBAC3C,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;oBACzD,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAA,wCAAmB,GAAE,CAAC,CAAC;oBACpE,OAAO,GAAG,OAAyC,CAAC;iBACrD;aACF;iBAAM;gBACL,IAAI,QAAQ,KAAK,SAAS,EAAE;oBAC1B,IAAI,GAAG,+BAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC;oBAC5C,OAAO,GAAG,oDAAoD,CAAC;oBAC/D,aAAa,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;iBACpC;qBAAM,IAAI,QAAQ,KAAK,YAAY,EAAE;oBACpC,OAAO,GAAG,MAAM,IAAA,6DAAiC,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC;iBACtE;qBAAM,IAAI,QAAQ,KAAK,UAAU,EAAE;oBAClC,OAAO,GAAG,MAAM,IAAA,mDAAuB,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC;iBAC5D;aACF;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,GAAG,IAAA,6BAAmB,EAC3D,GAAG,EACH,QAAQ,EACR,KAAK,EACL,UAAU,CACX,CAAC;SACH;KACF;SAAM;QACL,IAAI,GAAG,+BAAa,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAC9C,OAAO,GAAG,+BAAa,CAAC,mBAAmB,CAAC,OAAO,CAAC;QACpD,aAAa,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;KACpC;IAED,IACE,IAAI,KAAK,SAAS;QAClB,OAAO,KAAK,SAAS;QACrB,aAAa,KAAK,SAAS,EAC3B;QACA,aAAa,GAAG;YACd,IAAI;YACJ,OAAO;YACP,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC;KACH;IAED,gDAAgD;IAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE;QAC/D,OAAO;YACL,OAAO,EAAE,OAAyC;YAClD,aAAa;SACd,CAAC;KACH;SAAM;QACL,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,MAAK,0BAAW,CAAC,cAAc,EAAE;YACvD,OAAO;gBACL,OAAO,EAAE,OAA+B;gBACxC,aAAa;aACd,CAAC;SACH;aAAM;YACL,OAAO;gBACL,OAAO,EAAE,OAA0C;gBACnD,aAAa;aACd,CAAC;SACH;KACF;AACH,CAAC,CAAC;AAxFW,QAAA,aAAa,iBAwFxB;AAEF;;;;GAIG;AACI,MAAM,2BAA2B,GAAG,CACzC,KAAa,EACmB,EAAE;IAClC,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAmC,CAAC;AAC7D,CAAC,CAAC;AAJW,QAAA,2BAA2B,+BAItC;AAEF;;;;GAIG;AACI,MAAM,wBAAwB,GAAG,CACtC,KAAa,EACS,EAAE;IACxB,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAyB,CAAC;AACnD,CAAC,CAAC;AAJW,QAAA,wBAAwB,4BAInC;AAEF;;;;;;GAMG;AACI,MAAM,qBAAqB,GAAG,KAAK,EACxC,KAAa,EACb,oBAA4B,EACV,EAAE;IACpB,MAAM,UAAU,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,UAAU,KAAK,IAAI,EAAE;QACvB,MAAM,IAAI,6BAAY,CAAC,+BAAa,CAAC,kBAAkB,CAAC,CAAC;KAC1D;IACD,MAAM,OAAO,GAAG,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,OAAyC,CAAC;IAEtE,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,aAAa,wBAAwB,EACrE,oBAAoB,CACrB,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;IAExC,MAAM,WAAW,GAAG,IAAoB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE;QAC7B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAK,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,MAAM,CAAC,GAAG,CAAA,EAAE;YACtD,OAAO,IAAI,CAAC;SACb;KACF;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAzBW,QAAA,qBAAqB,yBAyBhC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@axinom/mosaic-id-guard",
|
|
3
|
-
"version": "0.34.0-rc.
|
|
3
|
+
"version": "0.34.0-rc.3",
|
|
4
4
|
"description": "Authentication and authorization helpers for Axinom Mosaic services",
|
|
5
5
|
"author": "Axinom",
|
|
6
6
|
"license": "PROPRIETARY",
|
|
@@ -28,10 +28,10 @@
|
|
|
28
28
|
"lint": "eslint . --ext .ts,.tsx,.js --color --cache"
|
|
29
29
|
},
|
|
30
30
|
"dependencies": {
|
|
31
|
-
"@axinom/mosaic-id-utils": "^0.15.19-rc.
|
|
32
|
-
"@axinom/mosaic-message-bus": "^0.29.0-rc.
|
|
33
|
-
"@axinom/mosaic-service-common": "^0.51.0-rc.
|
|
34
|
-
"@axinom/mosaic-transactional-inbox-outbox": "^0.11.0-rc.
|
|
31
|
+
"@axinom/mosaic-id-utils": "^0.15.19-rc.3",
|
|
32
|
+
"@axinom/mosaic-message-bus": "^0.29.0-rc.3",
|
|
33
|
+
"@axinom/mosaic-service-common": "^0.51.0-rc.3",
|
|
34
|
+
"@axinom/mosaic-transactional-inbox-outbox": "^0.11.0-rc.3",
|
|
35
35
|
"amqplib": "^0.10.3",
|
|
36
36
|
"express": "^4.17.1",
|
|
37
37
|
"express-bearer-token": "^2.4.0",
|
|
@@ -41,7 +41,7 @@
|
|
|
41
41
|
"graphql-tag": "^2.11.0",
|
|
42
42
|
"graphql-ws": "^5.11.2",
|
|
43
43
|
"jsonwebtoken": "^9.0.0",
|
|
44
|
-
"jwks-rsa": "^1.
|
|
44
|
+
"jwks-rsa": "^3.1.0",
|
|
45
45
|
"lru-cache": "^7.18.3",
|
|
46
46
|
"pg": "^8.11.3",
|
|
47
47
|
"pg-transactional-outbox": "^0.5.7",
|
|
@@ -65,5 +65,5 @@
|
|
|
65
65
|
"publishConfig": {
|
|
66
66
|
"access": "public"
|
|
67
67
|
},
|
|
68
|
-
"gitHead": "
|
|
68
|
+
"gitHead": "aed31bb968e8cb0204f5532abbcb67aaaa3593ae"
|
|
69
69
|
}
|
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
import { isNullOrWhitespace } from '@axinom/mosaic-service-common';
|
|
2
2
|
import jwt from 'jsonwebtoken';
|
|
3
|
-
import jwks from 'jwks-rsa';
|
|
4
3
|
import { IdGuardError } from './id-guard-error';
|
|
5
4
|
import { IdGuardErrors } from './id-guard-errors';
|
|
6
5
|
import { getJwksClient } from './jwks-client';
|
|
@@ -188,16 +187,17 @@ const verifyTokenAndGetAuthenticatedSubject = async (
|
|
|
188
187
|
header: jwt.JwtHeader,
|
|
189
188
|
callback: jwt.SigningKeyCallback,
|
|
190
189
|
): void => {
|
|
191
|
-
jwksClient
|
|
192
|
-
header.kid ?? 'MISSING_KEY_ID_IN_JWT_HEADER'
|
|
193
|
-
(
|
|
194
|
-
|
|
190
|
+
jwksClient
|
|
191
|
+
.getSigningKey(header.kid ?? 'MISSING_KEY_ID_IN_JWT_HEADER')
|
|
192
|
+
.then(
|
|
193
|
+
(key) => {
|
|
194
|
+
callback(null, key.getPublicKey());
|
|
195
|
+
},
|
|
196
|
+
(error) => {
|
|
195
197
|
reject(error);
|
|
196
198
|
return;
|
|
197
|
-
}
|
|
198
|
-
|
|
199
|
-
},
|
|
200
|
-
);
|
|
199
|
+
},
|
|
200
|
+
);
|
|
201
201
|
};
|
|
202
202
|
|
|
203
203
|
jwt.verify(token, getPublicKey, getJwtVerifyOptions(), (error, decoded) => {
|
|
@@ -922,8 +922,8 @@ describe('parse-jwt-token', () => {
|
|
|
922
922
|
.spyOn(jwksClient, 'getJwksClient')
|
|
923
923
|
.mockImplementation((_jwksUri: string) => {
|
|
924
924
|
return {
|
|
925
|
-
getKeys: jest.fn().mockImplementation((
|
|
926
|
-
|
|
925
|
+
getKeys: jest.fn().mockImplementation(() => {
|
|
926
|
+
return keys;
|
|
927
927
|
}),
|
|
928
928
|
getKeysAsync: jest.fn(),
|
|
929
929
|
getSigningKey: jest.fn(),
|
|
@@ -10,6 +10,7 @@ import {
|
|
|
10
10
|
getAuthenticatedManagementSubject,
|
|
11
11
|
} from './get-authenticated-subject';
|
|
12
12
|
import { handleJwtParseError } from './helpers';
|
|
13
|
+
import { IdGuardError } from './id-guard-error';
|
|
13
14
|
import { IdGuardErrors } from './id-guard-errors';
|
|
14
15
|
import { getJwksClient } from './jwks-client';
|
|
15
16
|
import { getJwtVerifyOptions } from './jwt-verify-options';
|
|
@@ -152,33 +153,25 @@ export const checkSigningKeyExists = async (
|
|
|
152
153
|
token: string,
|
|
153
154
|
idServiceAuthBaseUrl: string,
|
|
154
155
|
): Promise<boolean> => {
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
}
|
|
161
|
-
const subject = decodedJwt?.payload as AuthenticatedManagementSubject;
|
|
156
|
+
const decodedJwt = jwt.decode(token, { complete: true });
|
|
157
|
+
if (decodedJwt === null) {
|
|
158
|
+
throw new IdGuardError(IdGuardErrors.AccessTokenInvalid);
|
|
159
|
+
}
|
|
160
|
+
const subject = decodedJwt?.payload as AuthenticatedManagementSubject;
|
|
162
161
|
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
162
|
+
const jwksUri = new URL(
|
|
163
|
+
`/${subject.tenantId}/${subject.environmentId}/.well-known/jwks.json`,
|
|
164
|
+
idServiceAuthBaseUrl,
|
|
165
|
+
);
|
|
167
166
|
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
if (error) {
|
|
171
|
-
reject(error);
|
|
172
|
-
return;
|
|
173
|
-
}
|
|
167
|
+
const jwksClient = getJwksClient(jwksUri.toString());
|
|
168
|
+
const keys = await jwksClient.getKeys();
|
|
174
169
|
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
});
|
|
183
|
-
});
|
|
170
|
+
const signingKeys = keys as SigningKey[];
|
|
171
|
+
for (const idx in signingKeys) {
|
|
172
|
+
if (signingKeys[idx]['kid'] === decodedJwt?.header.kid) {
|
|
173
|
+
return true;
|
|
174
|
+
}
|
|
175
|
+
}
|
|
176
|
+
return false;
|
|
184
177
|
};
|