@caracalai/identity 0.1.6-rc.2 → 0.2.0-rc.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/jwks.d.ts.map +1 -1
- package/dist/jwks.js +33 -5
- package/dist/jwks.js.map +1 -1
- package/dist/types.d.ts +8 -8
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +1 -1
- package/dist/types.js.map +1 -1
- package/dist/verify.d.ts +1 -1
- package/dist/verify.d.ts.map +1 -1
- package/dist/verify.js +28 -45
- package/dist/verify.js.map +1 -1
- package/package.json +4 -4
package/dist/jwks.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAQ9D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IACvE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAClD;
|
|
1
|
+
{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAQ9D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IACvE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAClD;AAwBD,wBAAgB,eAAe,CAAC,IAAI,GAAE,gBAAqB,GAAG,SAAS,CA4FtE;AAQD,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAExF;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAErE"}
|
package/dist/jwks.js
CHANGED
|
@@ -6,17 +6,16 @@ import { createLocalJWKSet } from 'jose';
|
|
|
6
6
|
const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
|
|
7
7
|
const DEFAULT_MAX_STALE_MS = 10 * 60 * 1000;
|
|
8
8
|
const DEFAULT_FETCH_TIMEOUT_MS = 5_000;
|
|
9
|
+
const MAX_JWKS_BYTES = 256 * 1024;
|
|
9
10
|
function assertSecureIssuer(issuer) {
|
|
10
11
|
const parsed = new URL(issuer);
|
|
11
12
|
if (parsed.protocol === 'https:')
|
|
12
13
|
return;
|
|
13
14
|
if (parsed.protocol === 'http:') {
|
|
14
|
-
const insecureAllowed = isLoopbackHost(parsed.hostname) ||
|
|
15
|
-
(process.env.NODE_ENV ?? 'development') === 'development' ||
|
|
16
|
-
process.env.CARACAL_ALLOW_INSECURE_CONFIG_URLS === 'true';
|
|
15
|
+
const insecureAllowed = isLoopbackHost(parsed.hostname) || process.env.CARACAL_ALLOW_INSECURE_CONFIG_URLS === 'true';
|
|
17
16
|
if (insecureAllowed)
|
|
18
17
|
return;
|
|
19
|
-
throw new Error('insecure issuer scheme: http requires a loopback host or
|
|
18
|
+
throw new Error('insecure issuer scheme: http requires a loopback host or CARACAL_ALLOW_INSECURE_CONFIG_URLS=true');
|
|
20
19
|
}
|
|
21
20
|
throw new Error(`unsupported issuer scheme: ${parsed.protocol}`);
|
|
22
21
|
}
|
|
@@ -67,7 +66,36 @@ export function createJwksCache(opts = {}) {
|
|
|
67
66
|
const res = await (fetchImpl ?? fetch)(url, { signal: controller.signal });
|
|
68
67
|
if (!res.ok)
|
|
69
68
|
throw new Error(`JWKS fetch failed: ${res.status}`);
|
|
70
|
-
const
|
|
69
|
+
const length = Number(res.headers?.get('content-length'));
|
|
70
|
+
if (Number.isFinite(length) && length > MAX_JWKS_BYTES)
|
|
71
|
+
throw new Error('JWKS document too large');
|
|
72
|
+
const reader = res.body?.getReader();
|
|
73
|
+
const chunks = [];
|
|
74
|
+
let size = 0;
|
|
75
|
+
if (reader) {
|
|
76
|
+
for (;;) {
|
|
77
|
+
const { done, value } = await reader.read();
|
|
78
|
+
if (done)
|
|
79
|
+
break;
|
|
80
|
+
size += value.byteLength;
|
|
81
|
+
if (size > MAX_JWKS_BYTES) {
|
|
82
|
+
await reader.cancel();
|
|
83
|
+
throw new Error('JWKS document too large');
|
|
84
|
+
}
|
|
85
|
+
chunks.push(value);
|
|
86
|
+
}
|
|
87
|
+
}
|
|
88
|
+
const bytes = new Uint8Array(size);
|
|
89
|
+
let offset = 0;
|
|
90
|
+
for (const chunk of chunks) {
|
|
91
|
+
bytes.set(chunk, offset);
|
|
92
|
+
offset += chunk.byteLength;
|
|
93
|
+
}
|
|
94
|
+
const body = reader
|
|
95
|
+
? JSON.parse(new TextDecoder().decode(bytes))
|
|
96
|
+
: 'text' in res && typeof res.text === 'function'
|
|
97
|
+
? JSON.parse(await res.text())
|
|
98
|
+
: (await res.json());
|
|
71
99
|
const keySet = createLocalJWKSet({ keys: body.keys });
|
|
72
100
|
cache.set(cacheKey(issuer, zoneId), { keySet, fetchedAtMonoMs: performance.now() });
|
|
73
101
|
return keySet;
|
package/dist/jwks.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,wEAAwE;AAExE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,MAAM,CAAA;AAqB9D,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC1C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3C,MAAM,wBAAwB,GAAG,KAAK,CAAA;
|
|
1
|
+
{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,wEAAwE;AAExE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,MAAM,CAAA;AAqB9D,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC1C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3C,MAAM,wBAAwB,GAAG,KAAK,CAAA;AACtC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAA;AAEjC,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAM;IACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,kCAAkC,KAAK,MAAM,CAAA;QACpH,IAAI,eAAe;YAAE,OAAM;QAC3B,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAA;IACrH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACnD,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAyB,EAAE;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAA;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,oBAAoB,EAAE,KAAK,CAAC,CAAA;IAC3E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAA;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAE1C,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc;QACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,eAAe,CAAA;YACvC,IAAI,GAAG,GAAG,KAAK;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAA;YACpC,IAAI,GAAG,GAAG,UAAU;gBAAE,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC1D,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACxB,KAAK,CAAC,YAAY,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC;qBAC/C,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;qBACzB,OAAO,CAAC,GAAG,EAAE;oBACZ,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBAC9B,IAAI,OAAO;wBAAE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAA;gBAC/C,CAAC,CAAC,CAAA;YACN,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAA;QACrB,CAAC;QACD,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,MAAc;QACzD,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QACxF,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;QAC5G,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAA;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAChE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;YACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;YAClG,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;YACpC,MAAM,MAAM,GAAiB,EAAE,CAAA;YAC/B,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,CAAC;oBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;oBAC3C,IAAI,IAAI;wBAAE,MAAK;oBACf,IAAI,IAAI,KAAK,CAAC,UAAU,CAAA;oBACxB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;wBAC1B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;wBACrB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;oBAC5C,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,MAAM,GAAG,CAAC,CAAA;YACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;gBACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;YAC5B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAwB;gBACrE,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;oBAC/C,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB;oBACtD,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;YAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAA6C,CAAC,CAAA;YAChG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACnF,OAAO,MAAM,CAAA;QACf,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,MAAc;YACvC,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,CAAC,MAAe,EAAE,MAAe;YACpC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBACrB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;gBACtC,OAAM;YACR,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,QAAQ,CAAC;wBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC1D,CAAC;gBACD,OAAM;YACR,CAAC;YACD,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAc;IAC9C,OAAO,GAAG,MAAM,SAAS,MAAM,EAAE,CAAA;AACnC,CAAC;AAED,MAAM,YAAY,GAAG,eAAe,EAAE,CAAA;AAEtC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc;IAC5D,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAe,EAAE,MAAe;IAC7D,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACpC,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -6,26 +6,26 @@ export declare const SUBJECT_TYPE_APPLICATION = "application";
|
|
|
6
6
|
export interface JwtConfig {
|
|
7
7
|
issuer: string;
|
|
8
8
|
audience: string;
|
|
9
|
-
zoneId
|
|
9
|
+
zoneId: string;
|
|
10
10
|
requiredScopes?: string[];
|
|
11
11
|
requiredTargets?: string[];
|
|
12
12
|
requiredUse?: string;
|
|
13
|
-
|
|
13
|
+
requireSession?: boolean;
|
|
14
14
|
requireDelegation?: boolean;
|
|
15
15
|
requireChainContains?: string[];
|
|
16
16
|
maxHopCount?: number;
|
|
17
17
|
}
|
|
18
18
|
export interface ChainHop {
|
|
19
19
|
applicationId: string;
|
|
20
|
-
|
|
21
|
-
|
|
20
|
+
sessionId?: string;
|
|
21
|
+
delegationId?: string;
|
|
22
22
|
}
|
|
23
23
|
export interface Claims {
|
|
24
24
|
sub: string;
|
|
25
25
|
zoneId: string;
|
|
26
26
|
clientId: string;
|
|
27
|
-
|
|
28
|
-
|
|
27
|
+
authorityRecordId: string;
|
|
28
|
+
rootAuthorityRecordId: string;
|
|
29
29
|
use: string;
|
|
30
30
|
subType: string;
|
|
31
31
|
jti: string;
|
|
@@ -33,8 +33,8 @@ export interface Claims {
|
|
|
33
33
|
expiresAt: number;
|
|
34
34
|
scope: string;
|
|
35
35
|
targetResources?: string[];
|
|
36
|
-
|
|
37
|
-
|
|
36
|
+
sessionId?: string;
|
|
37
|
+
delegationId?: string;
|
|
38
38
|
sourceSessionId?: string;
|
|
39
39
|
targetSessionId?: string;
|
|
40
40
|
delegationPath?: string[];
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,mBAAmB,YAAY,CAAA;AAC5C,eAAO,MAAM,oBAAoB,aAAa,CAAA;AAC9C,eAAO,MAAM,iBAAiB,SAAS,CAAA;AACvC,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,mBAAmB,YAAY,CAAA;AAC5C,eAAO,MAAM,oBAAoB,aAAa,CAAA;AAC9C,eAAO,MAAM,iBAAiB,SAAS,CAAA;AACvC,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAIhB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,iBAAiB,EAAE,MAAM,CAAA;IACzB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB"}
|
package/dist/types.js
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
// Caracal JWT claim shapes and verification configuration types.
|
|
5
5
|
// DefaultMaxHopCount caps delegation chain depth when verifier callers leave
|
|
6
6
|
// JwtConfig.maxHopCount unset. Matches the coordinator's MAX_DEPTH so a token
|
|
7
|
-
// that would have been blocked
|
|
7
|
+
// that would have been blocked when a Session starts cannot pass a permissive resource
|
|
8
8
|
// server.
|
|
9
9
|
export const DEFAULT_MAX_HOP_COUNT = 10;
|
|
10
10
|
export const MANDATE_USE_SESSION = 'session';
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,6EAA6E;AAC7E,8EAA8E;AAC9E
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,6EAA6E;AAC7E,8EAA8E;AAC9E,uFAAuF;AACvF,UAAU;AACV,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAA;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AACvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA"}
|
package/dist/verify.d.ts
CHANGED
|
@@ -11,7 +11,7 @@ export declare class ScopeInsufficientError extends CaracalError {
|
|
|
11
11
|
readonly missingScope: string;
|
|
12
12
|
constructor(missingScope: string);
|
|
13
13
|
}
|
|
14
|
-
export declare class
|
|
14
|
+
export declare class SessionRequiredError extends CaracalError {
|
|
15
15
|
constructor(message?: string);
|
|
16
16
|
}
|
|
17
17
|
export declare class DelegationRequiredError extends CaracalError {
|
package/dist/verify.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAY,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAmF,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAKzI,qBAAa,iBAAkB,SAAQ,YAAY;gBACrC,OAAO,SAA4B,EAAE,KAAK,CAAC,EAAE,OAAO;CAIjE;AAED,qBAAa,gBAAiB,SAAQ,YAAY;gBACpC,OAAO,SAAiC;CAIrD;AAED,qBAAa,sBAAuB,SAAQ,YAAY;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;gBACjB,YAAY,EAAE,MAAM;CAKjC;AAED,qBAAa,
|
|
1
|
+
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAY,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAmF,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAKzI,qBAAa,iBAAkB,SAAQ,YAAY;gBACrC,OAAO,SAA4B,EAAE,KAAK,CAAC,EAAE,OAAO;CAIjE;AAED,qBAAa,gBAAiB,SAAQ,YAAY;gBACpC,OAAO,SAAiC;CAIrD;AAED,qBAAa,sBAAuB,SAAQ,YAAY;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;gBACjB,YAAY,EAAE,MAAM;CAKjC;AAED,qBAAa,oBAAqB,SAAQ,YAAY;gBACxC,OAAO,SAAqB;CAIzC;AAED,qBAAa,uBAAwB,SAAQ,YAAY;gBAC3C,OAAO,SAAwB;CAI5C;AAED,qBAAa,kBAAmB,SAAQ,YAAY;IAClD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;gBACzB,oBAAoB,EAAE,MAAM;CAOzC;AAED,qBAAa,qBAAsB,SAAQ,YAAY;gBACzC,OAAO,SAAuB;CAI3C;AA4DD,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiG1G;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAIlF"}
|
package/dist/verify.js
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
// Caracal, a product of Garudex Labs
|
|
3
3
|
//
|
|
4
4
|
// Verifies a Caracal JWT against an issuer JWKS and enforces zone and scope claims.
|
|
5
|
-
import {
|
|
5
|
+
import { jwtVerify } from 'jose';
|
|
6
6
|
import { CaracalError, hasScope } from '@caracalai/core';
|
|
7
7
|
import { getKeySet } from './jwks.js';
|
|
8
8
|
import { DEFAULT_MAX_HOP_COUNT, MANDATE_USE_RESOURCE, MANDATE_USE_SESSION } from './types.js';
|
|
@@ -28,10 +28,10 @@ export class ScopeInsufficientError extends CaracalError {
|
|
|
28
28
|
this.missingScope = missingScope;
|
|
29
29
|
}
|
|
30
30
|
}
|
|
31
|
-
export class
|
|
32
|
-
constructor(message = '
|
|
33
|
-
super('
|
|
34
|
-
this.name = '
|
|
31
|
+
export class SessionRequiredError extends CaracalError {
|
|
32
|
+
constructor(message = 'Session required') {
|
|
33
|
+
super('session_required', message);
|
|
34
|
+
this.name = 'SessionRequiredError';
|
|
35
35
|
}
|
|
36
36
|
}
|
|
37
37
|
export class DelegationRequiredError extends CaracalError {
|
|
@@ -111,37 +111,22 @@ function readChain(raw) {
|
|
|
111
111
|
}
|
|
112
112
|
const r = item;
|
|
113
113
|
const applicationId = requiredString(r, 'application_id');
|
|
114
|
-
const
|
|
115
|
-
const
|
|
116
|
-
out.push({ applicationId,
|
|
114
|
+
const sessionId = optionalString(r, 'agent_session_id');
|
|
115
|
+
const delegationId = optionalString(r, 'delegation_edge_id');
|
|
116
|
+
out.push({ applicationId, sessionId, delegationId });
|
|
117
117
|
}
|
|
118
118
|
return out.length === 0 ? undefined : out;
|
|
119
119
|
}
|
|
120
|
-
// STS serves one signing keyset per zone, so the JWKS fetch needs a zone. The
|
|
121
|
-
// configured zone wins; otherwise the unverified zone_id claim selects the
|
|
122
|
-
// keyset, which is safe because it only routes the key lookup — the signature
|
|
123
|
-
// check against that zone's keys then proves the claim.
|
|
124
|
-
function fetchZone(token, config) {
|
|
125
|
-
if (config.zoneId)
|
|
126
|
-
return config.zoneId;
|
|
127
|
-
let claimedZone;
|
|
128
|
-
try {
|
|
129
|
-
claimedZone = decodeJwt(token)['zone_id'];
|
|
130
|
-
}
|
|
131
|
-
catch (err) {
|
|
132
|
-
throw new TokenInvalidError('Token validation failed', err);
|
|
133
|
-
}
|
|
134
|
-
if (typeof claimedZone !== 'string' || claimedZone === '')
|
|
135
|
-
throw new ZoneInvalidError();
|
|
136
|
-
return claimedZone;
|
|
137
|
-
}
|
|
138
120
|
export async function verify(token, config) {
|
|
139
|
-
|
|
121
|
+
// The configured zone is the only trust anchor: it selects the signing keyset
|
|
122
|
+
// and must equal the zone_id claim. Verification never reads the zone from the
|
|
123
|
+
// unverified token, so key selection cannot be influenced by attacker input.
|
|
124
|
+
const zone = config.zoneId;
|
|
125
|
+
if (typeof zone !== 'string' || zone === '')
|
|
126
|
+
throw new ZoneInvalidError();
|
|
140
127
|
let payload;
|
|
141
128
|
try {
|
|
142
|
-
const keySet = config.jwksCache
|
|
143
|
-
? await config.jwksCache.getKeySet(config.issuer, zone)
|
|
144
|
-
: await getKeySet(config.issuer, zone);
|
|
129
|
+
const keySet = config.jwksCache ? await config.jwksCache.getKeySet(config.issuer, zone) : await getKeySet(config.issuer, zone);
|
|
145
130
|
({ payload } = await jwtVerify(token, keySet, {
|
|
146
131
|
issuer: config.issuer,
|
|
147
132
|
audience: config.audience,
|
|
@@ -156,8 +141,8 @@ export async function verify(token, config) {
|
|
|
156
141
|
const jti = requiredString(payload, 'jti');
|
|
157
142
|
const sub = requiredString(payload, 'sub');
|
|
158
143
|
const clientId = requiredString(payload, 'client_id');
|
|
159
|
-
const
|
|
160
|
-
const
|
|
144
|
+
const authorityRecordId = requiredString(payload, 'sid');
|
|
145
|
+
const rootAuthorityRecordId = requiredString(payload, 'root_sid');
|
|
161
146
|
const use = requiredString(payload, 'use');
|
|
162
147
|
if (use !== MANDATE_USE_SESSION && use !== MANDATE_USE_RESOURCE)
|
|
163
148
|
throw new TokenInvalidError('Token use validation failed');
|
|
@@ -171,7 +156,7 @@ export async function verify(token, config) {
|
|
|
171
156
|
throw new TokenInvalidError('Token claim scope must be a string');
|
|
172
157
|
const targetResources = readStringList(payload['target'], 'target');
|
|
173
158
|
const rawZoneId = payload['zone_id'];
|
|
174
|
-
if (typeof rawZoneId !== 'string' || rawZoneId === '' || rawZoneId !== zone
|
|
159
|
+
if (typeof rawZoneId !== 'string' || rawZoneId === '' || rawZoneId !== zone) {
|
|
175
160
|
throw new ZoneInvalidError();
|
|
176
161
|
}
|
|
177
162
|
const zoneId = rawZoneId;
|
|
@@ -187,23 +172,21 @@ export async function verify(token, config) {
|
|
|
187
172
|
throw new TokenInvalidError('Token target resource validation failed');
|
|
188
173
|
}
|
|
189
174
|
}
|
|
190
|
-
const
|
|
191
|
-
const
|
|
175
|
+
const sessionId = optionalString(payload, 'agent_session_id');
|
|
176
|
+
const delegationId = optionalString(payload, 'delegation_edge_id');
|
|
192
177
|
const sourceSessionId = optionalString(payload, 'source_session_id');
|
|
193
178
|
const targetSessionId = optionalString(payload, 'target_session_id');
|
|
194
179
|
const delegationPath = readStringList(payload['delegation_path'], 'delegation_path');
|
|
195
180
|
const delegationChain = readChain(payload['delegation_chain']);
|
|
196
181
|
const graphEpoch = optionalInteger(payload, 'delegation_graph_epoch');
|
|
197
182
|
const hopCount = optionalInteger(payload, 'hop_count');
|
|
198
|
-
if (config.
|
|
199
|
-
throw new
|
|
183
|
+
if (config.requireSession && !sessionId) {
|
|
184
|
+
throw new SessionRequiredError();
|
|
200
185
|
}
|
|
201
|
-
if (config.requireDelegation && !
|
|
186
|
+
if (config.requireDelegation && !delegationId) {
|
|
202
187
|
throw new DelegationRequiredError();
|
|
203
188
|
}
|
|
204
|
-
const maxHops = config.maxHopCount !== undefined && config.maxHopCount > 0
|
|
205
|
-
? config.maxHopCount
|
|
206
|
-
: DEFAULT_MAX_HOP_COUNT;
|
|
189
|
+
const maxHops = config.maxHopCount !== undefined && config.maxHopCount > 0 ? config.maxHopCount : DEFAULT_MAX_HOP_COUNT;
|
|
207
190
|
if ((hopCount ?? 0) > maxHops) {
|
|
208
191
|
throw new HopCountExceededError();
|
|
209
192
|
}
|
|
@@ -216,8 +199,8 @@ export async function verify(token, config) {
|
|
|
216
199
|
sub,
|
|
217
200
|
zoneId,
|
|
218
201
|
clientId,
|
|
219
|
-
|
|
220
|
-
|
|
202
|
+
authorityRecordId,
|
|
203
|
+
rootAuthorityRecordId,
|
|
221
204
|
use,
|
|
222
205
|
subType,
|
|
223
206
|
jti,
|
|
@@ -225,8 +208,8 @@ export async function verify(token, config) {
|
|
|
225
208
|
expiresAt,
|
|
226
209
|
scope,
|
|
227
210
|
targetResources,
|
|
228
|
-
|
|
229
|
-
|
|
211
|
+
sessionId,
|
|
212
|
+
delegationId,
|
|
230
213
|
sourceSessionId,
|
|
231
214
|
targetSessionId,
|
|
232
215
|
delegationPath,
|
package/dist/verify.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,oFAAoF;AAEpF,OAAO,EAAE,SAAS,EAAE,
|
|
1
|
+
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,oFAAoF;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAkB,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAA8C,MAAM,YAAY,CAAA;AAEzI,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;AACvG,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC,MAAM,OAAO,iBAAkB,SAAQ,YAAY;IACjD,YAAY,OAAO,GAAG,yBAAyB,EAAE,KAAe;QAC9D,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACrE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IAChD,YAAY,OAAO,GAAG,8BAA8B;QAClD,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IAC7C,YAAY,CAAQ;IAC7B,YAAY,YAAoB;QAC9B,KAAK,CAAC,oBAAoB,EAAE,kBAAkB,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QAC5F,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;IAClC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IACpD,YAAY,OAAO,GAAG,kBAAkB;QACtC,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,YAAY;IACvD,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IACzC,oBAAoB,CAAQ;IACrC,YAAY,oBAA4B;QACtC,KAAK,CAAC,gBAAgB,EAAE,yCAAyC,oBAAoB,EAAE,EAAE;YACvF,OAAO,EAAE,EAAE,oBAAoB,EAAE;SAClC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;IAClD,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IACrD,YAAY,OAAO,GAAG,oBAAoB;QACxC,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF;AAED,SAAS,cAAc,CAAC,OAAgC,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,cAAc,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAAgC,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,mBAAmB,CAAC,CAAA;IAClG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,iCAAiC,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,cAAc,CAAC,CAAA;IACvF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,IAAY;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAA;IAClG,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAA;QACxH,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAA;IACrG,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,CAAC,CAAA;QAClF,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAA;QACzC,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACzD,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAA;QACvD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,MAA6C;IACvF,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAA;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAA;IACzE,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAC7H;QAAA,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,cAAc,EAAE,eAAe;YAC/B,cAAc,EAAE,2BAA2B;SAC5C,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACrD,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,qBAAqB,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACjE,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC1C,IAAI,GAAG,KAAK,mBAAmB,IAAI,GAAG,KAAK,oBAAoB;QAAE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAA;IAC3H,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACnD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,aAAa;QAAE,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,CAAC,CAAA;IACxH,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACjD,MAAM,KAAK,GAAI,OAAO,CAAC,OAAO,CAAwB,IAAI,EAAE,CAAA;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAA;IAChG,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,EAAE,CAAA;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAA;IACxB,IAAI,MAAM,CAAC,WAAW,IAAI,GAAG,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAA;IAChH,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAC7D,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;IAClE,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACpE,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACpE,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACpF,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAEtD,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,oBAAoB,EAAE,CAAA;IAClC,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,EAAE,CAAA;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAA;IACvH,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,qBAAqB,EAAE,CAAA;IACnC,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,QAAQ;QACR,iBAAiB;QACjB,qBAAqB;QACrB,GAAG;QACH,OAAO;QACP,GAAG;QACH,QAAQ;QACR,SAAS;QACT,KAAK;QACL,eAAe;QACf,SAAS;QACT,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,eAAe;QACf,UAAU;QACV,QAAQ;KACT,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,aAAqB;IACvE,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IACvF,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO,KAAK,CAAA;AACd,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@caracalai/identity",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.2.0-rc.1",
|
|
4
4
|
"description": "Caracal identity primitives: JWT verification, JWKS, scope, claims.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://github.com/Garudex-Labs/caracal",
|
|
@@ -40,12 +40,12 @@
|
|
|
40
40
|
"prepublishOnly": "tsc"
|
|
41
41
|
},
|
|
42
42
|
"dependencies": {
|
|
43
|
-
"@caracalai/core": "0.
|
|
43
|
+
"@caracalai/core": "0.2.0-rc.1",
|
|
44
44
|
"jose": "^6.2.3"
|
|
45
45
|
},
|
|
46
46
|
"devDependencies": {
|
|
47
|
-
"@types/node": "^26.
|
|
47
|
+
"@types/node": "^26.1.0",
|
|
48
48
|
"typescript": "^6.0.3",
|
|
49
|
-
"vitest": "^4.1.
|
|
49
|
+
"vitest": "^4.1.10"
|
|
50
50
|
}
|
|
51
51
|
}
|