@bitblit/ratchet-epsilon-common 4.0.85-alpha

package/dist/es/http/auth/google-web-token-manipulator.js

@@ -0,0 +1,67 @@
+import { Logger } from '@bitblit/ratchet-common';
+import { StringRatchet } from '@bitblit/ratchet-common';
+import jwt from 'jsonwebtoken';
+import jwks from 'jwks-rsa';
+import fetch from 'cross-fetch';
+export class GoogleWebTokenManipulator {
+    constructor(clientId) {
+        this.clientId = clientId;
+    }
+    async extractTokenFromAuthorizationHeader(authHeader) {
+        let tokenString = StringRatchet.trimToEmpty(authHeader);
+        if (tokenString.toLowerCase().startsWith('bearer ')) {
+            tokenString = tokenString.substring(7);
+        }
+        const validated = !!tokenString ? await this.parseAndValidateGoogleToken(tokenString, false) : null;
+        return validated;
+    }
+    async parseAndValidateGoogleToken(googleToken, allowExpired = false) {
+        Logger.debug('Auth : %s', StringRatchet.obscure(googleToken, 4));
+        const fullToken = jwt.decode(googleToken, { complete: true });
+        const kid = fullToken.header.kid;
+        const nowEpochSeconds = Math.floor(new Date().getTime() / 1000);
+        const pubKey = await this.fetchSigningKey(kid);
+        const validated = jwt.verify(googleToken, pubKey, {
+            audience: this.clientId,
+            issuer: ['https://accounts.google.com', 'accounts.google.com'],
+            ignoreExpiration: allowExpired,
+            clockTimestamp: nowEpochSeconds,
+        });
+        return validated;
+    }
+    async fetchSigningKey(kid) {
+        const jClient = await this.fetchJwksClient();
+        return new Promise((res, rej) => {
+            jClient.getSigningKey(kid, (err, key) => {
+                if (err) {
+                    rej(err);
+                }
+                else {
+                    res(key.publicKey || key.rsaPublicKey);
+                }
+            });
+        });
+    }
+    async fetchJwksClient() {
+        if (!this.jwksClient) {
+            const discDoc = await this.fetchGoogleDiscoveryDocument();
+            const client = jwks({
+                cache: true,
+                cacheMaxEntries: 5,
+                cacheMaxAge: 1000 * 60 * 60 * 10,
+                jwksUri: discDoc.jwks_uri,
+            });
+            this.jwksClient = client;
+        }
+        return this.jwksClient;
+    }
+    async fetchGoogleDiscoveryDocument() {
+        if (!this.cacheGoogleDiscoveryDocument) {
+            const resp = await fetch(GoogleWebTokenManipulator.GOOGLE_DISCOVERY_DOCUMENT);
+            const doc = await resp.json();
+            this.cacheGoogleDiscoveryDocument = doc;
+        }
+        return this.cacheGoogleDiscoveryDocument;
+    }
+}
+GoogleWebTokenManipulator.GOOGLE_DISCOVERY_DOCUMENT = 'https://accounts.google.com/.well-known/openid-configuration';

package/dist/es/http/auth/jwt-ratchet-local-web-token-manipulator.js

@@ -0,0 +1,25 @@
+import { StringRatchet } from '@bitblit/ratchet-common';
+import { RequireRatchet } from '@bitblit/ratchet-common';
+import { ExpiredJwtHandling } from '@bitblit/ratchet-common';
+export class JwtRatchetLocalWebTokenManipulator {
+    constructor(_jwtRatchet, _issuer) {
+        this._jwtRatchet = _jwtRatchet;
+        this._issuer = _issuer;
+        RequireRatchet.notNullOrUndefined(_jwtRatchet, '_jwtRatchet');
+        RequireRatchet.notNullOrUndefined(StringRatchet.trimToNull(_issuer), '_issuer');
+    }
+    get jwtRatchet() {
+        return this._jwtRatchet;
+    }
+    get issuer() {
+        return this._issuer;
+    }
+    async extractTokenFromAuthorizationHeader(header) {
+        let tokenString = StringRatchet.trimToEmpty(header);
+        if (tokenString.toLowerCase().startsWith('bearer ')) {
+            tokenString = tokenString.substring(7);
+        }
+        const validated = !!tokenString ? await this.jwtRatchet.decodeToken(tokenString, ExpiredJwtHandling.THROW_EXCEPTION) : null;
+        return validated;
+    }
+}

package/dist/es/http/auth/local-web-token-manipulator.js

@@ -0,0 +1,70 @@
+import { Logger } from '@bitblit/ratchet-common';
+import { UnauthorizedError } from '../error/unauthorized-error';
+import { StringRatchet } from '@bitblit/ratchet-common';
+import { RequireRatchet } from '@bitblit/ratchet-common';
+import { ExpiredJwtHandling, JwtRatchet } from '@bitblit/ratchet-common';
+export class LocalWebTokenManipulator {
+    constructor(encryptionKeys, issuer) {
+        this.encryptionKeys = encryptionKeys;
+        this.issuer = issuer;
+        RequireRatchet.notNullOrUndefined(encryptionKeys, 'encryptionKeys');
+        RequireRatchet.noNullOrUndefinedValuesInArray(encryptionKeys, encryptionKeys.length);
+        this._ratchet = new JwtRatchet(Promise.resolve(encryptionKeys));
+    }
+    withExtraDecryptionKeys(keys) {
+        RequireRatchet.notNullOrUndefined(keys, 'keys');
+        RequireRatchet.noNullOrUndefinedValuesInArray(keys, keys.length);
+        this._ratchet = new JwtRatchet(this._ratchet.encryptionKeyPromise, Promise.resolve(keys), this._ratchet.jtiGenerator, this._ratchet.decryptOnlyKeyUseLogLevel, this._ratchet.parseFailureLogLevel);
+        return this;
+    }
+    withParseFailureLogLevel(logLevel) {
+        this._ratchet = new JwtRatchet(this._ratchet.encryptionKeyPromise, this._ratchet.decryptKeysPromise, this._ratchet.jtiGenerator, this._ratchet.decryptOnlyKeyUseLogLevel, logLevel);
+        return this;
+    }
+    withOldKeyUseLogLevel(logLevel) {
+        this._ratchet = new JwtRatchet(this._ratchet.encryptionKeyPromise, this._ratchet.decryptKeysPromise, this._ratchet.jtiGenerator, logLevel, this._ratchet.parseFailureLogLevel);
+        return this;
+    }
+    get jwtRatchet() {
+        return this._ratchet;
+    }
+    get selectRandomEncryptionKey() {
+        return this._ratchet.selectRandomEncryptionKey();
+    }
+    createRefreshedJWTString(tokenString, expirationSeconds, allowExpired) {
+        return this._ratchet.refreshJWTString(tokenString, allowExpired || false, expirationSeconds);
+    }
+    async parseAndValidateJWTStringAsync(tokenString) {
+        const payload = await this._ratchet.decodeToken(tokenString, ExpiredJwtHandling.ADD_FLAG);
+        if (JwtRatchet.hasExpiredFlag(payload)) {
+            throw new UnauthorizedError('Failing JWT token read/validate - token expired on ' + payload.exp);
+        }
+        else {
+            return payload;
+        }
+    }
+    async createJWTStringAsync(principal, userObject, roles = ['USER'], expirationSeconds = 3600, proxyUser = null) {
+        Logger.info('Creating JWT token for %s  that expires in %s', principal, expirationSeconds);
+        const now = new Date().getTime();
+        const expires = now + expirationSeconds * 1000;
+        const tokenData = {
+            exp: expires,
+            iss: this.issuer,
+            sub: principal,
+            iat: now,
+            user: userObject,
+            proxy: proxyUser,
+            roles: roles,
+        };
+        const token = await this._ratchet.createTokenString(tokenData, expirationSeconds);
+        return token;
+    }
+    async extractTokenFromAuthorizationHeader(header) {
+        let tokenString = StringRatchet.trimToEmpty(header);
+        if (tokenString.toLowerCase().startsWith('bearer ')) {
+            tokenString = tokenString.substring(7);
+        }
+        const validated = !!tokenString ? await this.parseAndValidateJWTStringAsync(tokenString) : null;
+        return validated;
+    }
+}

package/dist/es/http/auth/web-token-manipulator.js

@@ -0,0 +1 @@
+export {};

package/dist/es/http/error/bad-gateway.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class BadGateway extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(BadGateway.HTTP_CODE);
+    }
+}
+BadGateway.HTTP_CODE = 502;

package/dist/es/http/error/bad-request-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class BadRequestError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(BadRequestError.HTTP_CODE);
+    }
+}
+BadRequestError.HTTP_CODE = 400;

package/dist/es/http/error/conflict-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class ConflictError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(ConflictError.HTTP_CODE);
+    }
+}
+ConflictError.HTTP_CODE = 409;

package/dist/es/http/error/epsilon-http-error.js

@@ -0,0 +1,127 @@
+import util from 'util';
+import { NumberRatchet } from '@bitblit/ratchet-common';
+export class EpsilonHttpError extends Error {
+    constructor(...errors) {
+        super(EpsilonHttpError.combineErrorStringsWithDefault(errors));
+        this._httpStatusCode = 500;
+        Object.setPrototypeOf(this, EpsilonHttpError.prototype);
+        this._errors = errors;
+        this[EpsilonHttpError.EPSILON_HTTP_ERROR_FLAG_KEY] = true;
+    }
+    static combineErrorStringsWithDefault(errors, defMessage = 'Internal Server Error') {
+        return errors && errors.length > 0 ? errors.join(',') : defMessage;
+    }
+    setFormattedErrorMessage(format, ...input) {
+        const msg = util.format(format, ...input);
+        this.errors = [msg];
+    }
+    withFormattedErrorMessage(format, ...input) {
+        this.setFormattedErrorMessage(format, ...input);
+        return this;
+    }
+    withHttpStatusCode(httpStatusCode) {
+        this.httpStatusCode = httpStatusCode;
+        return this;
+    }
+    withErrors(errors) {
+        this.errors = errors;
+        return this;
+    }
+    withDetailErrorCode(detailErrorCode) {
+        this._detailErrorCode = detailErrorCode;
+        return this;
+    }
+    withEndUserErrors(endUserErrors) {
+        this._endUserErrors = endUserErrors;
+        return this;
+    }
+    withDetails(details) {
+        this._details = details;
+        return this;
+    }
+    withRequestId(requestId) {
+        this._requestId = requestId;
+        return this;
+    }
+    withWrappedError(err) {
+        this._wrappedError = err;
+        return this;
+    }
+    isWrappedError() {
+        return !!this._wrappedError;
+    }
+    static wrapError(err) {
+        let rval = null;
+        if (EpsilonHttpError.objectIsEpsilonHttpError(err)) {
+            rval = err;
+        }
+        else {
+            rval = new EpsilonHttpError(err.message).withWrappedError(err).withHttpStatusCode(500);
+        }
+        return rval;
+    }
+    static objectIsEpsilonHttpError(obj) {
+        return obj && obj['__epsilonHttpErrorFlag'] === true;
+    }
+    get httpStatusCode() {
+        return this._httpStatusCode;
+    }
+    get errors() {
+        return this._errors;
+    }
+    get detailErrorCode() {
+        return this._detailErrorCode;
+    }
+    get endUserErrors() {
+        return this._endUserErrors;
+    }
+    get details() {
+        return this._details;
+    }
+    get requestId() {
+        return this._requestId;
+    }
+    get wrappedError() {
+        return this._wrappedError;
+    }
+    set httpStatusCode(value) {
+        this._httpStatusCode = value || 500;
+    }
+    set errors(value) {
+        this._errors = value || ['Internal Server Error'];
+        this.message = EpsilonHttpError.combineErrorStringsWithDefault(this._errors);
+    }
+    set detailErrorCode(value) {
+        this._detailErrorCode = value;
+    }
+    set endUserErrors(value) {
+        this._endUserErrors = value;
+    }
+    set details(value) {
+        this._details = value;
+    }
+    set requestId(value) {
+        this._requestId = value || 'MISSING';
+    }
+    set wrappedError(value) {
+        this._wrappedError = value;
+    }
+    static errorIsX0x(errIn, xClass) {
+        let rval = false;
+        if (errIn && EpsilonHttpError.objectIsEpsilonHttpError(errIn)) {
+            const err = errIn;
+            const val = NumberRatchet.safeNumber(err.httpStatusCode);
+            const bot = xClass * 100;
+            const top = bot + 99;
+            rval = val >= bot && val <= top;
+        }
+        return rval;
+    }
+    static errorIs40x(err) {
+        return EpsilonHttpError.errorIsX0x(err, 4);
+    }
+    static errorIs50x(err) {
+        return EpsilonHttpError.errorIsX0x(err, 5);
+    }
+}
+EpsilonHttpError.EPSILON_HTTP_ERROR_FLAG_KEY = '__epsilonHttpErrorFlag';

package/dist/es/http/error/forbidden-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class ForbiddenError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(ForbiddenError.HTTP_CODE);
+    }
+}
+ForbiddenError.HTTP_CODE = 403;

package/dist/es/http/error/gateway-timeout.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class GatewayTimeout extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(GatewayTimeout.HTTP_CODE);
+    }
+}
+GatewayTimeout.HTTP_CODE = 504;

package/dist/es/http/error/method-not-allowed-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class MethodNotAllowedError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(MethodNotAllowedError.HTTP_CODE);
+    }
+}
+MethodNotAllowedError.HTTP_CODE = 405;

package/dist/es/http/error/misconfigured-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class MisconfiguredError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(MisconfiguredError.HTTP_CODE);
+    }
+}
+MisconfiguredError.HTTP_CODE = 500;

package/dist/es/http/error/not-found-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class NotFoundError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(NotFoundError.HTTP_CODE);
+    }
+}
+NotFoundError.HTTP_CODE = 404;

package/dist/es/http/error/not-implemented.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class NotImplemented extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(NotImplemented.HTTP_CODE);
+    }
+}
+NotImplemented.HTTP_CODE = 501;

package/dist/es/http/error/request-timeout-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class RequestTimeoutError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(RequestTimeoutError.HTTP_CODE);
+    }
+}
+RequestTimeoutError.HTTP_CODE = 500;

package/dist/es/http/error/service-unavailable.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class ServiceUnavailable extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(ServiceUnavailable.HTTP_CODE);
+    }
+}
+ServiceUnavailable.HTTP_CODE = 503;

package/dist/es/http/error/too-many-requests-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class TooManyRequestsError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(TooManyRequestsError.HTTP_CODE);
+    }
+}
+TooManyRequestsError.HTTP_CODE = 429;

package/dist/es/http/error/unauthorized-error.js

@@ -0,0 +1,8 @@
+import { EpsilonHttpError } from './epsilon-http-error';
+export class UnauthorizedError extends EpsilonHttpError {
+    constructor(...errors) {
+        super(...errors);
+        this.withHttpStatusCode(UnauthorizedError.HTTP_CODE);
+    }
+}
+UnauthorizedError.HTTP_CODE = 401;

package/dist/es/http/event-util.js

@@ -0,0 +1,175 @@
+import { UnauthorizedError } from './error/unauthorized-error';
+import { Logger } from '@bitblit/ratchet-common';
+import { BadRequestError } from './error/bad-request-error';
+import { MapRatchet } from '@bitblit/ratchet-common';
+import jwt from 'jsonwebtoken';
+import { Base64Ratchet } from '@bitblit/ratchet-common';
+import { StringRatchet } from '@bitblit/ratchet-common';
+import { EpsilonConstants } from '../epsilon-constants';
+import { EnumRatchet, LoggerLevelName } from '@bitblit/ratchet-common';
+export class EventUtil {
+    constructor() { }
+    static extractStage(event) {
+        if (!event.path.startsWith('/')) {
+            throw new BadRequestError('Path should start with / but does not : ' + event.path);
+        }
+        const idx = event.path.indexOf('/', 1);
+        if (idx == -1) {
+            throw new BadRequestError('No second / found in the path : ' + event.path);
+        }
+        return event.path.substring(1, idx);
+    }
+    static extractHostHeader(event) {
+        return MapRatchet.extractValueFromMapIgnoreCase(event.headers, 'Host');
+    }
+    static extractProtocol(event) {
+        return MapRatchet.extractValueFromMapIgnoreCase(event.headers, 'X-Forwarded-Proto');
+    }
+    static extractApiGatewayStage(event) {
+        const rc = EventUtil.extractRequestContext(event);
+        return rc ? rc.stage : null;
+    }
+    static extractRequestContext(event) {
+        return event.requestContext;
+    }
+    static extractAuthorizer(event) {
+        const rc = EventUtil.extractRequestContext(event);
+        return rc ? rc.authorizer : null;
+    }
+    static ipAddressChain(event) {
+        const headerVal = event && event.headers ? MapRatchet.extractValueFromMapIgnoreCase(event.headers, 'X-Forwarded-For') : null;
+        let headerList = headerVal ? String(headerVal).split(',') : [];
+        headerList = headerList.map((s) => s.trim());
+        return headerList;
+    }
+    static ipAddress(event) {
+        const list = EventUtil.ipAddressChain(event);
+        return list && list.length > 0 ? list[0] : null;
+    }
+    static extractFullPath(event, overrideProtocol = null) {
+        const protocol = overrideProtocol || EventUtil.extractProtocol(event) || 'https';
+        return protocol + '://' + event.requestContext['domainName'] + event.requestContext.path;
+    }
+    static extractFullPrefix(event, overrideProtocol = null) {
+        const protocol = overrideProtocol || EventUtil.extractProtocol(event) || 'https';
+        const prefix = event.requestContext.path.substring(0, event.requestContext.path.indexOf('/', 1));
+        return protocol + '://' + event.requestContext['domainName'] + prefix;
+    }
+    static jsonBodyToObject(event) {
+        let rval = null;
+        if (event.body) {
+            const contentType = MapRatchet.extractValueFromMapIgnoreCase(event.headers, 'Content-Type') || 'application/octet-stream';
+            rval = event.body;
+            if (event.isBase64Encoded) {
+                rval = Buffer.from(rval, 'base64');
+            }
+            if (contentType.startsWith('application/json')) {
+                rval = JSON.parse(rval.toString('ascii'));
+            }
+        }
+        return rval;
+    }
+    static calcLogLevelViaEventOrEnvParam(curLevel, event, rConfig) {
+        let rval = curLevel;
+        if (rConfig?.envParamLogLevelName && process.env[rConfig.envParamLogLevelName]) {
+            rval = EnumRatchet.keyToEnum(LoggerLevelName, process.env[rConfig.envParamLogLevelName]);
+            Logger.silly('Found env log level : %s', rval);
+        }
+        if (rConfig &&
+            rConfig.queryParamLogLevelName &&
+            event &&
+            event.queryStringParameters &&
+            event.queryStringParameters[rConfig.queryParamLogLevelName]) {
+            rval = EnumRatchet.keyToEnum(LoggerLevelName, event.queryStringParameters[rConfig.queryParamLogLevelName]);
+            Logger.silly('Found query log level : %s', rval);
+        }
+        return rval;
+    }
+    static fixStillEncodedQueryParams(event) {
+        if (event?.queryStringParameters) {
+            const newParams = {};
+            Object.keys(event.queryStringParameters).forEach((k) => {
+                const val = event.queryStringParameters[k];
+                if (k.toLowerCase().startsWith('amp;')) {
+                    newParams[k.substring(4)] = val;
+                }
+                else {
+                    newParams[k] = val;
+                }
+            });
+            event.queryStringParameters = newParams;
+        }
+        if (event?.multiValueQueryStringParameters) {
+            const newParams = {};
+            Object.keys(event.multiValueQueryStringParameters).forEach((k) => {
+                const val = event.multiValueQueryStringParameters[k];
+                if (k.toLowerCase().startsWith('amp;')) {
+                    newParams[k.substring(4)] = val;
+                }
+                else {
+                    newParams[k] = val;
+                }
+            });
+            event.multiValueQueryStringParameters = newParams;
+        }
+    }
+    static applyTokenToEventForTesting(event, jwtToken) {
+        const jwtFullData = jwt.decode(jwtToken, { complete: true });
+        if (!jwtFullData['payload']) {
+            throw new Error('No payload found in passed token');
+        }
+        const jwtData = jwtFullData['payload'];
+        event.headers = event.headers || {};
+        event.headers[EpsilonConstants.AUTH_HEADER_NAME.toLowerCase()] = 'Bearer ' + jwtToken;
+        event.requestContext = event.requestContext || {};
+        const newAuth = Object.assign({}, event.requestContext.authorizer);
+        newAuth.userData = jwtData;
+        newAuth.userDataJSON = jwtData ? JSON.stringify(jwtData) : null;
+        newAuth.srcData = jwtToken;
+        event.requestContext.authorizer = newAuth;
+    }
+    static extractBasicAuthenticationToken(event, throwErrorOnMissingBad = false) {
+        let rval = null;
+        if (!!event && !!event.headers) {
+            const headerVal = EventUtil.extractAuthorizationHeaderCaseInsensitive(event);
+            if (!!headerVal && headerVal.startsWith('Basic ')) {
+                const parsed = Base64Ratchet.base64StringToString(headerVal.substring(6));
+                const sp = parsed.split(':');
+                Logger.silly('Parsed to %j', sp);
+                if (!!sp && sp.length === 2) {
+                    rval = {
+                        username: sp[0],
+                        password: sp[1],
+                    };
+                }
+            }
+        }
+        if (!rval && throwErrorOnMissingBad) {
+            throw new UnauthorizedError('Could not find valid basic authentication header');
+        }
+        return rval;
+    }
+    static eventIsAGraphQLIntrospection(event) {
+        let rval = false;
+        if (!!event) {
+            if (!!event.httpMethod && 'post' === event.httpMethod.toLowerCase()) {
+                if (!!event.path && event.path.endsWith('/graphql')) {
+                    const body = EventUtil.jsonBodyToObject(event);
+                    rval = !!body && !!body['operationName'] && body['operationName'] === 'IntrospectionQuery';
+                }
+            }
+        }
+        return rval;
+    }
+    static extractAuthorizationHeaderCaseInsensitive(evt) {
+        return MapRatchet.caseInsensitiveAccess(evt?.headers || {}, EpsilonConstants.AUTH_HEADER_NAME);
+    }
+    static extractBearerTokenFromEvent(evt) {
+        let rval = null;
+        const authHeader = StringRatchet.trimToEmpty(EventUtil.extractAuthorizationHeaderCaseInsensitive(evt));
+        if (authHeader.toLowerCase().startsWith('bearer ')) {
+            rval = authHeader.substring(7);
+        }
+        return rval;
+    }
+}