@broberg/sso 0.12.0 → 0.13.0

package/dist/index.cjs

@@ -666,6 +666,103 @@ function createSsoClient(config, options = {}) {
     }
   };
 }
+var PRINCIPAL_TYPES = ["human", "service", "agent"];
+function createTicketVerifier(options) {
+  const {
+    issuer,
+    audience,
+    maxLifetimeSec = 15 * 60,
+    clockToleranceSec = 30,
+    fetchImpl = fetch
+  } = options;
+  if (!issuer) throw new SsoError("createTicketVerifier needs an issuer");
+  if (!audience) throw new SsoError("createTicketVerifier needs this receiver's audience");
+  let cachePromise = null;
+  const cacheFor = (jwksUri) => createJwksCache({
+    jwksUri,
+    fetchImpl,
+    ...options.warmUp ? { warmUp: true } : {},
+    ...options.minRefetchIntervalMs !== void 0 ? { minRefetchIntervalMs: options.minRefetchIntervalMs } : {}
+  });
+  async function keys() {
+    cachePromise ??= (async () => {
+      if (options.jwksUri) return cacheFor(options.jwksUri);
+      const url = `${issuer}/.well-known/openid-configuration`;
+      let doc;
+      try {
+        const res = await fetchImpl(url);
+        if (!res.ok) throw new Error(`answered ${res.status}`);
+        doc = await res.json();
+      } catch (cause) {
+        throw new JwksUnavailableError(`${url}: ${cause instanceof Error ? cause.message : String(cause)}`);
+      }
+      if (doc.issuer !== issuer) {
+        throw new SsoError(`issuer is ${issuer} but ${url} says ${doc.issuer} \u2014 they must match exactly`);
+      }
+      if (!doc.jwks_uri) throw new SsoError(`${url} names no jwks_uri`);
+      return cacheFor(doc.jwks_uri);
+    })().catch((err) => {
+      cachePromise = null;
+      throw err;
+    });
+    return cachePromise;
+  }
+  if (options.warmUp) void keys().catch(() => {
+  });
+  return {
+    async verify(token, opts = {}) {
+      let header;
+      try {
+        header = jose.decodeProtectedHeader(token);
+      } catch {
+        throw new SsoError("ticket is not a JWS");
+      }
+      if (!header.kid) throw new SsoError("ticket has no kid \u2014 cannot pick a signing key");
+      if (header.typ === "logout+jwt") throw new SsoError("a logout token is not a ticket");
+      const cache = await keys();
+      let payload;
+      try {
+        ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "EdDSA"), {
+          issuer,
+          audience,
+          algorithms: ALLOWED_ALGS,
+          clockTolerance: clockToleranceSec,
+          requiredClaims: ["exp", "iat", "jti", "sub"]
+        }));
+      } catch (e) {
+        if (e instanceof JwksUnavailableError) throw e;
+        throw new SsoError(`ticket rejected: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      if ("events" in payload) throw new SsoError("a logout token is not a ticket");
+      if ("nonce" in payload) throw new SsoError("an ID token is not a ticket");
+      const type = payload.principal_type;
+      if (typeof type !== "string" || !PRINCIPAL_TYPES.includes(type)) {
+        throw new SsoError(`ticket has no valid principal_type (got ${JSON.stringify(type)})`);
+      }
+      const lifetime = payload.exp - payload.iat;
+      if (lifetime > maxLifetimeSec) {
+        throw new SsoError(`ticket claims a ${lifetime}s lifetime; at most ${maxLifetimeSec}s is accepted`);
+      }
+      if (typeof payload.sub !== "string" || payload.sub === "") throw new SsoError("ticket has no sub");
+      const scopes = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [];
+      const required2 = opts.scope === void 0 ? [] : Array.isArray(opts.scope) ? opts.scope : [opts.scope];
+      const missing = required2.filter((s) => !scopes.includes(s));
+      if (missing.length) throw new SsoError(`ticket lacks scope ${missing.join(", ")}`);
+      const actRaw = payload.act;
+      const act = actRaw && typeof actRaw.sub === "string" && actRaw.sub ? { sub: actRaw.sub } : null;
+      return {
+        principal: payload.sub,
+        type,
+        clientId: typeof payload.client_id === "string" && payload.client_id ? payload.client_id : payload.sub,
+        org: typeof payload.org === "string" && payload.org ? payload.org : null,
+        act,
+        scopes,
+        exp: payload.exp,
+        jti: String(payload.jti)
+      };
+    }
+  };
+}
 
 // src/session.ts
 var enc = new TextEncoder();
@@ -802,6 +899,7 @@ exports.SsoReauthError = SsoReauthError;
 exports.cookieHeader = cookieHeader;
 exports.createJwksCache = createJwksCache;
 exports.createSsoClient = createSsoClient;
+exports.createTicketVerifier = createTicketVerifier;
 exports.loadSsoConfig = loadSsoConfig;
 exports.memoryTokenStore = memoryTokenStore;
 exports.readCookie = readCookie;