@betterportal/framework 10.6.0 → 10.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/codegen/emitter.d.ts.map +1 -1
- package/lib/codegen/emitter.js +12 -1
- package/lib/codegen/emitter.js.map +1 -1
- package/lib/codegen/scanner.d.ts +1 -0
- package/lib/codegen/scanner.d.ts.map +1 -1
- package/lib/codegen/scanner.js +26 -0
- package/lib/codegen/scanner.js.map +1 -1
- package/lib/codegen/validate.d.ts.map +1 -1
- package/lib/codegen/validate.js +7 -0
- package/lib/codegen/validate.js.map +1 -1
- package/lib/contracts/platformConfig.js +1 -1
- package/lib/contracts/platformConfig.js.map +1 -1
- package/lib/runtime/auth/envelope.d.ts.map +1 -1
- package/lib/runtime/auth/envelope.js +11 -13
- package/lib/runtime/auth/envelope.js.map +1 -1
- package/lib/runtime/auth/externalOidc.d.ts.map +1 -1
- package/lib/runtime/auth/externalOidc.js +3 -4
- package/lib/runtime/auth/externalOidc.js.map +1 -1
- package/lib/runtime/auth/jwks.d.ts.map +1 -1
- package/lib/runtime/auth/jwks.js +51 -11
- package/lib/runtime/auth/jwks.js.map +1 -1
- package/lib/runtime/auth/jwtCrypto.d.ts +8 -0
- package/lib/runtime/auth/jwtCrypto.d.ts.map +1 -0
- package/lib/runtime/auth/jwtCrypto.js +42 -0
- package/lib/runtime/auth/jwtCrypto.js.map +1 -0
- package/lib/runtime/auth/serviceToken.d.ts.map +1 -1
- package/lib/runtime/auth/serviceToken.js +7 -8
- package/lib/runtime/auth/serviceToken.js.map +1 -1
- package/lib/runtime/auth/tokens.d.ts.map +1 -1
- package/lib/runtime/auth/tokens.js +8 -11
- package/lib/runtime/auth/tokens.js.map +1 -1
- package/lib/runtime/configTicket.d.ts.map +1 -1
- package/lib/runtime/configTicket.js +10 -33
- package/lib/runtime/configTicket.js.map +1 -1
- package/lib/runtime/llms.d.ts.map +1 -1
- package/lib/runtime/llms.js +2 -0
- package/lib/runtime/llms.js.map +1 -1
- package/package.json +5 -6
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
import jwt from "jsonwebtoken";
|
|
2
1
|
import { CpEnvelopeClaimsSchema, SetupTokenClaimsSchema } from "../../contracts/auth.js";
|
|
3
2
|
import { uuidv7 } from "../uuid.js";
|
|
4
3
|
import { getSigningKeyForKid } from "./jwks.js";
|
|
4
|
+
import { signRs256Jwt, verifyRs256Jwt } from "./jwtCrypto.js";
|
|
5
5
|
const ALLOWED_ALGORITHM = "RS256";
|
|
6
6
|
const ALLOWED_TYP = "JWT";
|
|
7
7
|
const KID_PATTERN = /^[A-Za-z0-9_-]+$/;
|
|
@@ -15,10 +15,10 @@ export function signCpEnvelope(options) {
|
|
|
15
15
|
jti: jti ?? uuidv7()
|
|
16
16
|
};
|
|
17
17
|
const validated = CpEnvelopeClaimsSchema.parse(fullClaims);
|
|
18
|
-
return
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
18
|
+
return signRs256Jwt(validated, options.privateKeyPem, {
|
|
19
|
+
alg: ALLOWED_ALGORITHM,
|
|
20
|
+
typ: ALLOWED_TYP,
|
|
21
|
+
kid: options.kid
|
|
22
22
|
});
|
|
23
23
|
}
|
|
24
24
|
export function signSetupToken(options) {
|
|
@@ -31,10 +31,10 @@ export function signSetupToken(options) {
|
|
|
31
31
|
jti: jti ?? uuidv7()
|
|
32
32
|
};
|
|
33
33
|
const validated = SetupTokenClaimsSchema.parse(fullClaims);
|
|
34
|
-
return
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
34
|
+
return signRs256Jwt(validated, options.privateKeyPem, {
|
|
35
|
+
alg: ALLOWED_ALGORITHM,
|
|
36
|
+
typ: ALLOWED_TYP,
|
|
37
|
+
kid: options.kid
|
|
38
38
|
});
|
|
39
39
|
}
|
|
40
40
|
export async function verifyCpEnvelope(token, options) {
|
|
@@ -78,12 +78,10 @@ async function verifyTypedToken(token, options) {
|
|
|
78
78
|
: await getSigningKeyForKid(requireJwks(options), header.kid);
|
|
79
79
|
let verified;
|
|
80
80
|
try {
|
|
81
|
-
verified =
|
|
82
|
-
algorithms: [ALLOWED_ALGORITHM],
|
|
81
|
+
verified = await verifyRs256Jwt(token, publicKeyPem, {
|
|
83
82
|
issuer: options.expectedIssuer,
|
|
84
83
|
audience: options.expectedAudience,
|
|
85
|
-
|
|
86
|
-
complete: false
|
|
84
|
+
clockToleranceSeconds: options.clockToleranceSeconds ?? 0
|
|
87
85
|
});
|
|
88
86
|
}
|
|
89
87
|
catch (error) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/runtime/auth/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/runtime/auth/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EAGvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAA0B,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE9D,MAAM,iBAAiB,GAAG,OAAgB,CAAC;AAC3C,MAAM,WAAW,GAAG,KAAc,CAAC;AACnC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AA8BvC,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI;QACP,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,gBAAgB;QAC3B,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE;KACrB,CAAC;IAEF,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE;QACpD,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI;QACP,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,gBAAgB;QAC3B,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE;KACrB,CAAC;IAEF,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE;QACpD,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAA8B;IAClF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAA8B;IAClF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAA8B;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW;QACtC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEhE,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE;YACnD,MAAM,EAAE,OAAO,CAAC,cAAc;YAC9B,QAAQ,EAAE,OAAO,CAAC,gBAAgB;YAClC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iCAAkC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,QAAmC,CAAC;AAC7C,CAAC;AAED,SAAS,WAAW,CAAC,aAAqB;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,OAA8B;IACjD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"externalOidc.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/externalOidc.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,0FAA0F;AAC1F,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"externalOidc.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/externalOidc.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,0FAA0F;AAC1F,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA0BlC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import jwt from "jsonwebtoken";
|
|
2
1
|
import { getSigningKeyForKid } from "./jwks.js";
|
|
2
|
+
import { verifyRs256Jwt } from "./jwtCrypto.js";
|
|
3
3
|
const KID_PATTERN = /^[A-Za-z0-9_-]+$/;
|
|
4
4
|
/** Verify a standards-based external OIDC token without requiring BetterPortal claims. */
|
|
5
5
|
export async function verifyExternalOidcToken(token, options) {
|
|
@@ -19,11 +19,10 @@ export async function verifyExternalOidcToken(token, options) {
|
|
|
19
19
|
if ("jku" in header || "x5u" in header)
|
|
20
20
|
throw new Error("OIDC token contains an untrusted key reference");
|
|
21
21
|
const publicKey = await getSigningKeyForKid({ issuer: options.issuer, jwksUri: options.jwksUri }, header.kid);
|
|
22
|
-
const verified =
|
|
23
|
-
algorithms: ["RS256"],
|
|
22
|
+
const verified = await verifyRs256Jwt(token, publicKey, {
|
|
24
23
|
issuer: options.issuer,
|
|
25
24
|
audience: options.audience,
|
|
26
|
-
|
|
25
|
+
clockToleranceSeconds: options.clockToleranceSeconds ?? 30
|
|
27
26
|
});
|
|
28
27
|
if (!verified || typeof verified !== "object" || Array.isArray(verified)) {
|
|
29
28
|
throw new Error("OIDC token claims are invalid");
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"externalOidc.js","sourceRoot":"","sources":["../../../src/runtime/auth/externalOidc.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"externalOidc.js","sourceRoot":"","sources":["../../../src/runtime/auth/externalOidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,GAAG,kBAAkB,CAAC;AASvC,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,OAAuC;IAEvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAEpF,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACjH,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAE1G,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE;QACtD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,EAAE;KAC3D,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAmC,CAAC;AAC7C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACtF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/jwks.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/jwks.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAiGD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,wBAAgB,cAAc,IAAI,IAAI,CAKrC"}
|
package/lib/runtime/auth/jwks.js
CHANGED
|
@@ -1,15 +1,17 @@
|
|
|
1
1
|
import { createPublicKey } from "node:crypto";
|
|
2
2
|
const KID_PATTERN = /^[A-Za-z0-9_-]+$/;
|
|
3
3
|
const clientCache = new Map();
|
|
4
|
+
const refreshes = new Map();
|
|
5
|
+
const nextMissRefreshAt = new Map();
|
|
4
6
|
const CACHE_TTL_MS = 30 * 60 * 1000;
|
|
5
|
-
|
|
6
|
-
|
|
7
|
+
const MISS_REFRESH_INTERVAL_MS = 2_000;
|
|
8
|
+
let cacheGeneration = 0;
|
|
9
|
+
function getCacheKey(options) {
|
|
10
|
+
return `${options.issuer}|${options.jwksUri}`;
|
|
11
|
+
}
|
|
12
|
+
async function loadJwksKeys(options, generation) {
|
|
13
|
+
const cacheKey = getCacheKey(options);
|
|
7
14
|
const now = Date.now();
|
|
8
|
-
const existing = clientCache.get(cacheKey);
|
|
9
|
-
if (existing && now - existing.lastUsed < CACHE_TTL_MS) {
|
|
10
|
-
existing.lastUsed = now;
|
|
11
|
-
return existing.keys;
|
|
12
|
-
}
|
|
13
15
|
let response;
|
|
14
16
|
try {
|
|
15
17
|
response = await fetch(options.jwksUri, {
|
|
@@ -52,8 +54,32 @@ async function getJwksKeys(options) {
|
|
|
52
54
|
// Skip unusable keys; lookup below reports the missing kid.
|
|
53
55
|
}
|
|
54
56
|
}
|
|
55
|
-
|
|
56
|
-
|
|
57
|
+
const client = { keys, jwksUri: options.jwksUri, fetchedAt: now };
|
|
58
|
+
if (generation === cacheGeneration) {
|
|
59
|
+
clientCache.set(cacheKey, client);
|
|
60
|
+
nextMissRefreshAt.set(cacheKey, now + MISS_REFRESH_INTERVAL_MS);
|
|
61
|
+
}
|
|
62
|
+
return client;
|
|
63
|
+
}
|
|
64
|
+
function refreshJwksKeys(options) {
|
|
65
|
+
const cacheKey = getCacheKey(options);
|
|
66
|
+
const existing = refreshes.get(cacheKey);
|
|
67
|
+
if (existing)
|
|
68
|
+
return existing;
|
|
69
|
+
const refresh = loadJwksKeys(options, cacheGeneration);
|
|
70
|
+
refreshes.set(cacheKey, refresh);
|
|
71
|
+
const clearRefresh = () => {
|
|
72
|
+
if (refreshes.get(cacheKey) === refresh)
|
|
73
|
+
refreshes.delete(cacheKey);
|
|
74
|
+
};
|
|
75
|
+
void refresh.then(clearRefresh, clearRefresh);
|
|
76
|
+
return refresh;
|
|
77
|
+
}
|
|
78
|
+
async function getJwksKeys(options) {
|
|
79
|
+
const existing = clientCache.get(getCacheKey(options));
|
|
80
|
+
if (existing && Date.now() - existing.fetchedAt < CACHE_TTL_MS)
|
|
81
|
+
return existing;
|
|
82
|
+
return refreshJwksKeys(options);
|
|
57
83
|
}
|
|
58
84
|
function networkErrorDetails(error) {
|
|
59
85
|
if (!(error instanceof Error))
|
|
@@ -79,14 +105,28 @@ export async function getSigningKeyForKid(options, kid) {
|
|
|
79
105
|
if (!KID_PATTERN.test(kid)) {
|
|
80
106
|
throw new Error(`Invalid kid: must match ${KID_PATTERN.source}`);
|
|
81
107
|
}
|
|
82
|
-
const
|
|
83
|
-
|
|
108
|
+
const cacheKey = getCacheKey(options);
|
|
109
|
+
let client = await getJwksKeys(options);
|
|
110
|
+
let key = client.keys.get(kid);
|
|
111
|
+
const pendingRefresh = refreshes.get(cacheKey);
|
|
112
|
+
if (!key && pendingRefresh) {
|
|
113
|
+
client = await pendingRefresh;
|
|
114
|
+
key = client.keys.get(kid);
|
|
115
|
+
}
|
|
116
|
+
else if (!key && Date.now() >= (nextMissRefreshAt.get(cacheKey) ?? 0)) {
|
|
117
|
+
nextMissRefreshAt.set(cacheKey, Date.now() + MISS_REFRESH_INTERVAL_MS);
|
|
118
|
+
client = await refreshJwksKeys(options);
|
|
119
|
+
key = client.keys.get(kid);
|
|
120
|
+
}
|
|
84
121
|
if (!key) {
|
|
85
122
|
throw new Error(`JWKS key not found for kid ${kid}: ${options.jwksUri}`);
|
|
86
123
|
}
|
|
87
124
|
return key;
|
|
88
125
|
}
|
|
89
126
|
export function clearJwksCache() {
|
|
127
|
+
cacheGeneration += 1;
|
|
90
128
|
clientCache.clear();
|
|
129
|
+
refreshes.clear();
|
|
130
|
+
nextMissRefreshAt.clear();
|
|
91
131
|
}
|
|
92
132
|
//# sourceMappingURL=jwks.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../../src/runtime/auth/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAQvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AACpD,MAAM,
|
|
1
|
+
{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../../src/runtime/auth/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAQvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;AAC3D,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;AACpD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,IAAI,eAAe,GAAG,CAAC,CAAC;AAOxB,SAAS,WAAW,CAAC,OAA0B;IAC7C,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE,UAAkB;IACxE,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE;YACtC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,OAAO,KAAK,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,OAAO,SAAS,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,OAAO,iBAAiB,WAAW,IAAI,WAAW,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,OAAO,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,OAAO,GAAI,MAA6B,CAAC,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAI,MAA4B,CAAC,GAAG,CAAC;QAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,MAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;YACvH,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAClE,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACnC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,wBAAwB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAA0B;IACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACvD,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO;YAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,KAAK,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAA0B;IACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,GAAG,YAAY;QAAE,OAAO,QAAQ,CAAC;IAChF,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,YAAY,KAAK;QACxC,CAAC,CAAC,KAAK,CAAC,KAA6G;QACrH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,OAAO;QACb,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QACtD,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/D,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QACtD,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;KACtD,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA0B,EAC1B,GAAW;IAEX,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,IAAI,cAAc,EAAE,CAAC;QAC3B,MAAM,GAAG,MAAM,cAAc,CAAC;QAC9B,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;SAAM,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAC,CAAC;QACvE,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,eAAe,IAAI,CAAC,CAAC;IACrB,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC"}
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
export interface VerifyRs256JwtOptions {
|
|
2
|
+
issuer?: string | string[];
|
|
3
|
+
audience?: string | string[];
|
|
4
|
+
clockToleranceSeconds?: number;
|
|
5
|
+
}
|
|
6
|
+
export declare function signRs256Jwt(payload: Readonly<Record<string, unknown>>, privateKeyPem: string, protectedHeader: Readonly<Record<string, unknown>>): string;
|
|
7
|
+
export declare function verifyRs256Jwt(token: string, publicKeyPem: string, options?: VerifyRs256JwtOptions): Promise<Record<string, unknown>>;
|
|
8
|
+
//# sourceMappingURL=jwtCrypto.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"jwtCrypto.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/jwtCrypto.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACjD,MAAM,CAUR;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAyBlC"}
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
import { createPrivateKey, createPublicKey, sign as signData } from "node:crypto";
|
|
2
|
+
import { errors, jwtVerify } from "jose";
|
|
3
|
+
export function signRs256Jwt(payload, privateKeyPem, protectedHeader) {
|
|
4
|
+
const privateKey = createPrivateKey(privateKeyPem);
|
|
5
|
+
if (privateKey.asymmetricKeyType !== "rsa" || (privateKey.asymmetricKeyDetails?.modulusLength ?? 0) < 2048) {
|
|
6
|
+
throw new Error("RS256 requires an RSA private key with a modulus of at least 2048 bits");
|
|
7
|
+
}
|
|
8
|
+
const encodedHeader = Buffer.from(JSON.stringify(protectedHeader)).toString("base64url");
|
|
9
|
+
const encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url");
|
|
10
|
+
const signingInput = `${encodedHeader}.${encodedPayload}`;
|
|
11
|
+
const signature = signData("RSA-SHA256", Buffer.from(signingInput), privateKey).toString("base64url");
|
|
12
|
+
return `${signingInput}.${signature}`;
|
|
13
|
+
}
|
|
14
|
+
export async function verifyRs256Jwt(token, publicKeyPem, options = {}) {
|
|
15
|
+
try {
|
|
16
|
+
const { payload } = await jwtVerify(token, createPublicKey(publicKeyPem), {
|
|
17
|
+
algorithms: ["RS256"],
|
|
18
|
+
issuer: options.issuer,
|
|
19
|
+
audience: options.audience,
|
|
20
|
+
clockTolerance: options.clockToleranceSeconds ?? 0
|
|
21
|
+
});
|
|
22
|
+
return payload;
|
|
23
|
+
}
|
|
24
|
+
catch (error) {
|
|
25
|
+
if (error instanceof errors.JWTExpired) {
|
|
26
|
+
throw new Error("jwt expired", { cause: error });
|
|
27
|
+
}
|
|
28
|
+
if (error instanceof errors.JWTClaimValidationFailed) {
|
|
29
|
+
const message = error.claim === "nbf"
|
|
30
|
+
? "jwt not active"
|
|
31
|
+
: error.claim === "iss"
|
|
32
|
+
? "jwt issuer invalid"
|
|
33
|
+
: error.claim === "aud"
|
|
34
|
+
? "jwt audience invalid"
|
|
35
|
+
: undefined;
|
|
36
|
+
if (message)
|
|
37
|
+
throw new Error(message, { cause: error });
|
|
38
|
+
}
|
|
39
|
+
throw error;
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
//# sourceMappingURL=jwtCrypto.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"jwtCrypto.js","sourceRoot":"","sources":["../../../src/runtime/auth/jwtCrypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAQzC,MAAM,UAAU,YAAY,CAC1B,OAA0C,EAC1C,aAAqB,EACrB,eAAkD;IAElD,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,aAAa,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtG,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,YAAoB,EACpB,UAAiC,EAAE;IAEnC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE;YACxE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,OAAO,CAAC,qBAAqB,IAAI,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,KAAK,YAAY,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK;gBACnC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK;oBACrB,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK;wBACrB,CAAC,CAAC,sBAAsB;wBACxB,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"serviceToken.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/serviceToken.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"serviceToken.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/serviceToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAS/C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,qBAAa,8BAA+B,SAAQ,KAAK;IAC1B,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;gBAA3C,OAAO,EAAE,MAAM,EAAW,MAAM,EAAE,GAAG,GAAG,GAAG;CAIxD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,MAAM,CAwBzE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMrD;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAwDlC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import jwt from "jsonwebtoken";
|
|
2
1
|
import { ServiceTokenClaimsSchema } from "../../contracts/m2m.js";
|
|
2
|
+
import { signRs256Jwt, verifyRs256Jwt } from "./jwtCrypto.js";
|
|
3
3
|
import { uuidv7 } from "../uuid.js";
|
|
4
4
|
const ALGORITHM = "RS256";
|
|
5
5
|
const TOKEN_TYP = "BP-S2S-JWT";
|
|
@@ -32,10 +32,10 @@ export function signServiceToken(options) {
|
|
|
32
32
|
jti: uuidv7(),
|
|
33
33
|
tokenType: "service"
|
|
34
34
|
});
|
|
35
|
-
return
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
35
|
+
return signRs256Jwt(claims, options.keyPair.privateKeyPem, {
|
|
36
|
+
alg: ALGORITHM,
|
|
37
|
+
typ: TOKEN_TYP,
|
|
38
|
+
kid: options.keyPair.kid
|
|
39
39
|
});
|
|
40
40
|
}
|
|
41
41
|
export function isServiceToken(token) {
|
|
@@ -60,9 +60,8 @@ export async function authorizeServiceToken(token, options) {
|
|
|
60
60
|
throw new ServiceTokenAuthorizationError("Service signing key is not trusted", 401);
|
|
61
61
|
let verified;
|
|
62
62
|
try {
|
|
63
|
-
verified =
|
|
64
|
-
|
|
65
|
-
clockTolerance: options.clockToleranceSeconds ?? 5
|
|
63
|
+
verified = await verifyRs256Jwt(token, source.publicKeyPem, {
|
|
64
|
+
clockToleranceSeconds: options.clockToleranceSeconds ?? 5
|
|
66
65
|
});
|
|
67
66
|
}
|
|
68
67
|
catch (error) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"serviceToken.js","sourceRoot":"","sources":["../../../src/runtime/auth/serviceToken.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"serviceToken.js","sourceRoot":"","sources":["../../../src/runtime/auth/serviceToken.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,wBAAwB,EAEzB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAgB,CAAC;AACnC,MAAM,SAAS,GAAG,YAAY,CAAC;AAC/B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AA6B7C,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACjB;IAAtC,YAAY,OAAe,EAAW,MAAiB;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,WAAM,GAAN,MAAM,CAAW;QAErD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACnF,MAAM,IAAI,8BAA8B,CAAC,+CAA+C,GAAG,oBAAoB,GAAG,UAAU,EAAE,GAAG,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC;QAC5C,GAAG,EAAE,OAAO,CAAC,eAAe;QAC5B,GAAG,EAAE,OAAO,CAAC,eAAe;QAC5B,GAAG,EAAE,OAAO,CAAC,eAAe;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,QAAQ;QACnB,GAAG,EAAE,MAAM,EAAE;QACb,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE;QACzD,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG;KACzB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,OAAqC;IAErC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5H,MAAM,IAAI,8BAA8B,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM;QAAE,MAAM,IAAI,8BAA8B,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;IAE3I,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACtD,OAAO,CAAC,EAAE,KAAK,eAAe,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,CAC3G,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,YAAY;QAAE,MAAM,IAAI,8BAA8B,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IAE/G,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;YAC1D,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,8BAA8B,CAAC,qCAAqC,GAAI,KAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,8BAA8B,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;IAC5H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,eAAe;QAAE,MAAM,IAAI,8BAA8B,CAAC,qDAAqD,EAAE,GAAG,CAAC,CAAC;IACjJ,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,oBAAoB;QAAE,MAAM,IAAI,8BAA8B,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;IAChJ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,8BAA8B,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IACjJ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3E,MAAM,IAAI,8BAA8B,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACzD,SAAS,CAAC,OAAO;WACd,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS;WACjC,SAAS,CAAC,eAAe,KAAK,MAAM,CAAC,GAAG;WACxC,SAAS,CAAC,eAAe,KAAK,MAAM,CAAC,GAAG;WACxC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;WAC/B,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WACtC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;WACtD,SAAS,CAAC,YAAY,KAAK,OAAO,CAAC,MAAM,CAC7C,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,8BAA8B,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAE9F,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACrD,SAAS,CAAC,OAAO;WACd,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE;WAClC,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WACtC,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;WACtD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAC9C,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,8BAA8B,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,8BAA8B,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC/E,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC/E,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,KAAK,GAAG,aAAa,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,KAAK,GAAG,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/tokens.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/runtime/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAE1F,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAOxE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;QAC/D,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACvB,gBAAgB,EAAE,MAAM,CAAC;QACzB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAiBvD;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAiF5F;AAgCD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI7D"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
import jwt from "jsonwebtoken";
|
|
2
1
|
import { JwtClaimsSchema } from "../../contracts/auth.js";
|
|
3
2
|
import { uuidv7 } from "../uuid.js";
|
|
4
3
|
import { getSigningKeyForKid } from "./jwks.js";
|
|
4
|
+
import { signRs256Jwt, verifyRs256Jwt } from "./jwtCrypto.js";
|
|
5
5
|
const ALLOWED_ALGORITHM = "RS256";
|
|
6
6
|
const ALLOWED_TYP = "JWT";
|
|
7
7
|
const KID_PATTERN = /^[A-Za-z0-9_-]+$/;
|
|
@@ -15,12 +15,11 @@ export function signJwt(options) {
|
|
|
15
15
|
jti: jti ?? generateJti()
|
|
16
16
|
};
|
|
17
17
|
const validated = JwtClaimsSchema.parse(fullClaims);
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
};
|
|
23
|
-
return jwt.sign(validated, options.privateKeyPem, signOptions);
|
|
18
|
+
return signRs256Jwt(validated, options.privateKeyPem, {
|
|
19
|
+
alg: ALLOWED_ALGORITHM,
|
|
20
|
+
typ: ALLOWED_TYP,
|
|
21
|
+
kid: options.kid
|
|
22
|
+
});
|
|
24
23
|
}
|
|
25
24
|
export async function verifyJwt(token, options) {
|
|
26
25
|
if (typeof token !== "string" || token.length === 0) {
|
|
@@ -52,12 +51,10 @@ export async function verifyJwt(token, options) {
|
|
|
52
51
|
: await getSigningKeyForKid(requireJwks(options), header.kid);
|
|
53
52
|
let libVerified;
|
|
54
53
|
try {
|
|
55
|
-
libVerified =
|
|
56
|
-
algorithms: [ALLOWED_ALGORITHM],
|
|
54
|
+
libVerified = await verifyRs256Jwt(token, publicKeyPem, {
|
|
57
55
|
issuer: options.expectedIssuer,
|
|
58
56
|
audience: options.expectedAudience,
|
|
59
|
-
|
|
60
|
-
complete: false
|
|
57
|
+
clockToleranceSeconds: options.clockToleranceSeconds ?? 0
|
|
61
58
|
});
|
|
62
59
|
}
|
|
63
60
|
catch (error) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/runtime/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/runtime/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkC,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAA0B,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE9D,MAAM,iBAAiB,GAAG,OAAgB,CAAC;AAC3C,MAAM,WAAW,GAAG,KAAc,CAAC;AACnC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAwBvC,MAAM,UAAU,OAAO,CAAC,OAAuB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI;QACP,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,gBAAgB;QAC3B,GAAG,EAAE,GAAG,IAAI,WAAW,EAAE;KAC1B,CAAC;IAEF,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEpD,OAAO,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,EAAE;QACpD,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,OAAyB;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,2BAA2B,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW;QACtC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;QACvC,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAEhE,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE;YACtD,MAAM,EAAE,OAAO,CAAC,cAAc;YAC9B,QAAQ,EAAE,OAAO,CAAC,gBAAgB;YAClC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gCAAiC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAElD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,SAAS,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,GAAG,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,gBAAgB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,CAAC,iBAAiB,SAAS,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,aAAqB;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,OAAyB;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"configTicket.d.ts","sourceRoot":"","sources":["../../src/runtime/configTicket.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"configTicket.d.ts","sourceRoot":"","sources":["../../src/runtime/configTicket.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC/B,MAAM,+BAA+B,CAAC;AASvC,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AAIpE,MAAM,WAAW,8BAA8B;IAC7C,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,8BAA8B,GAAG,MAAM,CAqBvF;AAID,MAAM,WAAW,gCAAgC;IAC/C,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IACxD,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,yBAAyB,CAAC,CAkEpC;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,gCAAgC,GACxC,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAS/F;AAED,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
import jwt from "jsonwebtoken";
|
|
2
|
-
import jwksClient from "jwks-rsa";
|
|
3
1
|
import { ServiceConfigTicketClaimsSchema } from "../contracts/serviceConfig.js";
|
|
4
2
|
import { uuidv7 } from "./uuid.js";
|
|
3
|
+
import { clearJwksCache, getSigningKeyForKid } from "./auth/jwks.js";
|
|
4
|
+
import { signRs256Jwt, verifyRs256Jwt } from "./auth/jwtCrypto.js";
|
|
5
5
|
const ALLOWED_ALGORITHM = "RS256";
|
|
6
6
|
const ALLOWED_TYP = "JWT";
|
|
7
7
|
const KID_PATTERN = /^[A-Za-z0-9_-]+$/;
|
|
@@ -27,33 +27,12 @@ export function signServiceConfigTicket(options) {
|
|
|
27
27
|
...(options.bindingId ? { bindingId: options.bindingId } : {}),
|
|
28
28
|
actions: options.actions
|
|
29
29
|
});
|
|
30
|
-
return
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
30
|
+
return signRs256Jwt(claims, options.privateKeyPem, {
|
|
31
|
+
alg: ALLOWED_ALGORITHM,
|
|
32
|
+
typ: ALLOWED_TYP,
|
|
33
|
+
kid: options.kid
|
|
34
34
|
});
|
|
35
35
|
}
|
|
36
|
-
const clientCache = new Map();
|
|
37
|
-
const CLIENT_CACHE_TTL_MS = 30 * 60 * 1000;
|
|
38
|
-
function getJwksClient(jwksUri, issuer) {
|
|
39
|
-
const cacheKey = `${issuer}|${jwksUri}`;
|
|
40
|
-
const now = Date.now();
|
|
41
|
-
const existing = clientCache.get(cacheKey);
|
|
42
|
-
if (existing && now - existing.lastUsed < CLIENT_CACHE_TTL_MS) {
|
|
43
|
-
existing.lastUsed = now;
|
|
44
|
-
return existing.client;
|
|
45
|
-
}
|
|
46
|
-
const client = jwksClient({
|
|
47
|
-
jwksUri,
|
|
48
|
-
cache: true,
|
|
49
|
-
cacheMaxAge: 10 * 60 * 1000,
|
|
50
|
-
rateLimit: true,
|
|
51
|
-
jwksRequestsPerMinute: 30,
|
|
52
|
-
timeout: 5000
|
|
53
|
-
});
|
|
54
|
-
clientCache.set(cacheKey, { client, lastUsed: now });
|
|
55
|
-
return client;
|
|
56
|
-
}
|
|
57
36
|
/**
|
|
58
37
|
* Verify a CP-signed config ticket against the CP JWKS. Throws on any failure.
|
|
59
38
|
* Pins RS256, rejects jku/x5u key references, and re-checks iss/aud/exp/serviceId
|
|
@@ -86,19 +65,17 @@ export async function verifyServiceConfigTicket(token, options) {
|
|
|
86
65
|
publicKeyPem = await options.keyResolver(kid);
|
|
87
66
|
}
|
|
88
67
|
else if (options.jwksUri) {
|
|
89
|
-
publicKeyPem =
|
|
68
|
+
publicKeyPem = await getSigningKeyForKid({ issuer: options.issuer, jwksUri: options.jwksUri }, kid);
|
|
90
69
|
}
|
|
91
70
|
else {
|
|
92
71
|
throw new Error("verifyServiceConfigTicket requires either jwksUri or keyResolver");
|
|
93
72
|
}
|
|
94
73
|
let verified;
|
|
95
74
|
try {
|
|
96
|
-
verified =
|
|
97
|
-
algorithms: [ALLOWED_ALGORITHM],
|
|
75
|
+
verified = await verifyRs256Jwt(token, publicKeyPem, {
|
|
98
76
|
issuer: options.issuer,
|
|
99
77
|
audience: CONFIG_TICKET_AUDIENCE,
|
|
100
|
-
|
|
101
|
-
complete: false
|
|
78
|
+
clockToleranceSeconds: options.clockToleranceSeconds ?? 0
|
|
102
79
|
});
|
|
103
80
|
}
|
|
104
81
|
catch (error) {
|
|
@@ -143,7 +120,7 @@ export function createCpConfigTicketValidator(options) {
|
|
|
143
120
|
};
|
|
144
121
|
}
|
|
145
122
|
export function clearConfigTicketJwksCache() {
|
|
146
|
-
|
|
123
|
+
clearJwksCache();
|
|
147
124
|
}
|
|
148
125
|
function parseHeader(encodedHeader) {
|
|
149
126
|
let json;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"configTicket.js","sourceRoot":"","sources":["../../src/runtime/configTicket.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"configTicket.js","sourceRoot":"","sources":["../../src/runtime/configTicket.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAGhC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEnE,MAAM,iBAAiB,GAAG,OAAgB,CAAC;AAC3C,MAAM,WAAW,GAAG,KAAc,CAAC;AACnC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAEvC,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,6BAA6B,CAAC;AAoBpE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAuC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC;QACnD,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,GAAG,EAAE,CAAC,sBAAsB,CAAC;QAC7B,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,4BAA4B;QACpD,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,gBAAgB;QACnC,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,MAAM,EAAE;QAC5B,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;QACjD,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;AACL,CAAC;AAgBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,OAAyC;IAEzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,YAAY,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,YAAY,GAAG,MAAM,mBAAmB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE;YACnD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,sBAAsB;YAChC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sCAAuC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,sDAAsD,sBAAsB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,SAAS,OAAO,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IACtH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAyC;IAEzC,OAAO,KAAK,EAAE,WAA0B,EAAE,EAAE;QAC1C,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,yBAAyB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,cAAc,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,aAAqB;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"llms.d.ts","sourceRoot":"","sources":["../../src/runtime/llms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAEjG,OAAO,EAAwB,KAAK,8BAA8B,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAItG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAA;KAAE,CAAC;IAC/F,QAAQ,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAYD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,SAAS,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE,8BAAmC,GAC/C,gBAAgB,GAAG,IAAI,CAsCzB;AASD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,SAAS,EAAE,aAAa,CAAC,iBAAiB,CAAC,EAC3C,OAAO,CAAC,EAAE,MAAM,GACf,SAAS,CA4BX;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CA+BtE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAkCpE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,
|
|
1
|
+
{"version":3,"file":"llms.d.ts","sourceRoot":"","sources":["../../src/runtime/llms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAEjG,OAAO,EAAwB,KAAK,8BAA8B,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAItG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAA;KAAE,CAAC;IAC/F,QAAQ,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAYD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,SAAS,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE,8BAAmC,GAC/C,gBAAgB,GAAG,IAAI,CAsCzB;AASD,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,gBAAgB,EACzB,SAAS,EAAE,aAAa,CAAC,iBAAiB,CAAC,EAC3C,OAAO,CAAC,EAAE,MAAM,GACf,SAAS,CA4BX;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CA+BtE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAkCpE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAwBpE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAoBhH"}
|
package/lib/runtime/llms.js
CHANGED
|
@@ -148,6 +148,8 @@ export function renderThemeLlmsDev(context) {
|
|
|
148
148
|
`- [Current app API guide](${absolute(context.app.url, "/llms-api.txt")}): Installed services and live schemas.`,
|
|
149
149
|
"",
|
|
150
150
|
"For TypeScript, use `bp client install <registry-ref-or-plugin-id>` and `bp client sync`. For another language, consume `/.well-known/bp/schema.json` or a registry schema directly.",
|
|
151
|
+
"A Node service's `BPServiceDefinition` is `{ manifest }`. Do not import or return `.bp-generated/registry`; codegen creates it and BetterPortal loads it automatically.",
|
|
152
|
+
"Export `PluginFeature` from the service plugin index, usually as `Pick<Plugin, ...>`, to expose only the plugin methods route handlers need. If omitted, generated handlers intentionally receive `Record<never, never>`.",
|
|
151
153
|
"Service requests use `routeUrl`, not `uiRouteUrl`; `uiRouteUrl` is only for GET navigation through a mounted page route. For another service, pass its declared dependency alias as `serviceId`; both helpers resolve it through the synced application route index.",
|
|
152
154
|
"HTML renderers receive `ViewRenderContext` as their second argument. Its limited `tenant` and `app` projections are presentation-only; authorization and business data remain in the route handler.",
|
|
153
155
|
"App auth login/logout references are view IDs, not paths. Resolve them with `ctx.url.uiRoute(viewId, { serviceId })`; do not add renderer-only navigation to the JSON response schema.",
|