@caracalai/identity 0.1.6-rc.3 → 0.2.0-rc.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/jwks.d.ts.map +1 -1
- package/dist/jwks.js +33 -5
- package/dist/jwks.js.map +1 -1
- package/dist/types.d.ts +8 -8
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +1 -1
- package/dist/types.js.map +1 -1
- package/dist/verify.d.ts +1 -1
- package/dist/verify.d.ts.map +1 -1
- package/dist/verify.js +26 -39
- package/dist/verify.js.map +1 -1
- package/package.json +4 -4
package/dist/jwks.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAQ9D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IACvE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAClD;
|
|
1
|
+
{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAKA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,MAAM,CAAA;AAQ9D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IACvE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAClD;AAwBD,wBAAgB,eAAe,CAAC,IAAI,GAAE,gBAAqB,GAAG,SAAS,CA4FtE;AAQD,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAExF;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5E;AAED,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAErE"}
|
package/dist/jwks.js
CHANGED
|
@@ -6,17 +6,16 @@ import { createLocalJWKSet } from 'jose';
|
|
|
6
6
|
const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1000;
|
|
7
7
|
const DEFAULT_MAX_STALE_MS = 10 * 60 * 1000;
|
|
8
8
|
const DEFAULT_FETCH_TIMEOUT_MS = 5_000;
|
|
9
|
+
const MAX_JWKS_BYTES = 256 * 1024;
|
|
9
10
|
function assertSecureIssuer(issuer) {
|
|
10
11
|
const parsed = new URL(issuer);
|
|
11
12
|
if (parsed.protocol === 'https:')
|
|
12
13
|
return;
|
|
13
14
|
if (parsed.protocol === 'http:') {
|
|
14
|
-
const insecureAllowed = isLoopbackHost(parsed.hostname) ||
|
|
15
|
-
(process.env.NODE_ENV ?? 'development') === 'development' ||
|
|
16
|
-
process.env.CARACAL_ALLOW_INSECURE_CONFIG_URLS === 'true';
|
|
15
|
+
const insecureAllowed = isLoopbackHost(parsed.hostname) || process.env.CARACAL_ALLOW_INSECURE_CONFIG_URLS === 'true';
|
|
17
16
|
if (insecureAllowed)
|
|
18
17
|
return;
|
|
19
|
-
throw new Error('insecure issuer scheme: http requires a loopback host or
|
|
18
|
+
throw new Error('insecure issuer scheme: http requires a loopback host or CARACAL_ALLOW_INSECURE_CONFIG_URLS=true');
|
|
20
19
|
}
|
|
21
20
|
throw new Error(`unsupported issuer scheme: ${parsed.protocol}`);
|
|
22
21
|
}
|
|
@@ -67,7 +66,36 @@ export function createJwksCache(opts = {}) {
|
|
|
67
66
|
const res = await (fetchImpl ?? fetch)(url, { signal: controller.signal });
|
|
68
67
|
if (!res.ok)
|
|
69
68
|
throw new Error(`JWKS fetch failed: ${res.status}`);
|
|
70
|
-
const
|
|
69
|
+
const length = Number(res.headers?.get('content-length'));
|
|
70
|
+
if (Number.isFinite(length) && length > MAX_JWKS_BYTES)
|
|
71
|
+
throw new Error('JWKS document too large');
|
|
72
|
+
const reader = res.body?.getReader();
|
|
73
|
+
const chunks = [];
|
|
74
|
+
let size = 0;
|
|
75
|
+
if (reader) {
|
|
76
|
+
for (;;) {
|
|
77
|
+
const { done, value } = await reader.read();
|
|
78
|
+
if (done)
|
|
79
|
+
break;
|
|
80
|
+
size += value.byteLength;
|
|
81
|
+
if (size > MAX_JWKS_BYTES) {
|
|
82
|
+
await reader.cancel();
|
|
83
|
+
throw new Error('JWKS document too large');
|
|
84
|
+
}
|
|
85
|
+
chunks.push(value);
|
|
86
|
+
}
|
|
87
|
+
}
|
|
88
|
+
const bytes = new Uint8Array(size);
|
|
89
|
+
let offset = 0;
|
|
90
|
+
for (const chunk of chunks) {
|
|
91
|
+
bytes.set(chunk, offset);
|
|
92
|
+
offset += chunk.byteLength;
|
|
93
|
+
}
|
|
94
|
+
const body = reader
|
|
95
|
+
? JSON.parse(new TextDecoder().decode(bytes))
|
|
96
|
+
: 'text' in res && typeof res.text === 'function'
|
|
97
|
+
? JSON.parse(await res.text())
|
|
98
|
+
: (await res.json());
|
|
71
99
|
const keySet = createLocalJWKSet({ keys: body.keys });
|
|
72
100
|
cache.set(cacheKey(issuer, zoneId), { keySet, fetchedAtMonoMs: performance.now() });
|
|
73
101
|
return keySet;
|
package/dist/jwks.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,wEAAwE;AAExE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,MAAM,CAAA;AAqB9D,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC1C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3C,MAAM,wBAAwB,GAAG,KAAK,CAAA;
|
|
1
|
+
{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,wEAAwE;AAExE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,MAAM,CAAA;AAqB9D,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC1C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC3C,MAAM,wBAAwB,GAAG,KAAK,CAAA;AACtC,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAA;AAEjC,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAM;IACxC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,kCAAkC,KAAK,MAAM,CAAA;QACpH,IAAI,eAAe;YAAE,OAAM;QAC3B,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAA;IACrH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACnD,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAyB,EAAE;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAA;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,oBAAoB,EAAE,KAAK,CAAC,CAAA;IAC3E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAA;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAE1C,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc;QACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,eAAe,CAAA;YACvC,IAAI,GAAG,GAAG,KAAK;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAA;YACpC,IAAI,GAAG,GAAG,UAAU;gBAAE,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC1D,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;gBACxB,KAAK,CAAC,YAAY,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC;qBAC/C,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;qBACzB,OAAO,CAAC,GAAG,EAAE;oBACZ,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBAC9B,IAAI,OAAO;wBAAE,OAAO,CAAC,YAAY,GAAG,SAAS,CAAA;gBAC/C,CAAC,CAAC,CAAA;YACN,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAA;QACrB,CAAC;QACD,OAAO,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,MAAc;QACzD,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC1B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QACxF,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;QAC5G,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAA;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YAC1E,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAChE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;YACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;YAClG,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;YACpC,MAAM,MAAM,GAAiB,EAAE,CAAA;YAC/B,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,CAAC;oBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;oBAC3C,IAAI,IAAI;wBAAE,MAAK;oBACf,IAAI,IAAI,KAAK,CAAC,UAAU,CAAA;oBACxB,IAAI,IAAI,GAAG,cAAc,EAAE,CAAC;wBAC1B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;wBACrB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;oBAC5C,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACpB,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,MAAM,GAAG,CAAC,CAAA;YACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;gBACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;YAC5B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAwB;gBACrE,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;oBAC/C,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB;oBACtD,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;YAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAA6C,CAAC,CAAA;YAChG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACnF,OAAO,MAAM,CAAA;QACf,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,MAAc;YACvC,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,CAAC,MAAe,EAAE,MAAe;YACpC,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;gBACrB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;gBACtC,OAAM;YACR,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,QAAQ,CAAC;wBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC1D,CAAC;gBACD,OAAM;YACR,CAAC;YACD,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAc;IAC9C,OAAO,GAAG,MAAM,SAAS,MAAM,EAAE,CAAA;AACnC,CAAC;AAED,MAAM,YAAY,GAAG,eAAe,EAAE,CAAA;AAEtC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc;IAC5D,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAe,EAAE,MAAe;IAC7D,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AACpC,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -6,26 +6,26 @@ export declare const SUBJECT_TYPE_APPLICATION = "application";
|
|
|
6
6
|
export interface JwtConfig {
|
|
7
7
|
issuer: string;
|
|
8
8
|
audience: string;
|
|
9
|
-
zoneId
|
|
9
|
+
zoneId: string;
|
|
10
10
|
requiredScopes?: string[];
|
|
11
11
|
requiredTargets?: string[];
|
|
12
12
|
requiredUse?: string;
|
|
13
|
-
|
|
13
|
+
requireSession?: boolean;
|
|
14
14
|
requireDelegation?: boolean;
|
|
15
15
|
requireChainContains?: string[];
|
|
16
16
|
maxHopCount?: number;
|
|
17
17
|
}
|
|
18
18
|
export interface ChainHop {
|
|
19
19
|
applicationId: string;
|
|
20
|
-
|
|
21
|
-
|
|
20
|
+
sessionId?: string;
|
|
21
|
+
delegationId?: string;
|
|
22
22
|
}
|
|
23
23
|
export interface Claims {
|
|
24
24
|
sub: string;
|
|
25
25
|
zoneId: string;
|
|
26
26
|
clientId: string;
|
|
27
|
-
|
|
28
|
-
|
|
27
|
+
authorityRecordId: string;
|
|
28
|
+
rootAuthorityRecordId: string;
|
|
29
29
|
use: string;
|
|
30
30
|
subType: string;
|
|
31
31
|
jti: string;
|
|
@@ -33,8 +33,8 @@ export interface Claims {
|
|
|
33
33
|
expiresAt: number;
|
|
34
34
|
scope: string;
|
|
35
35
|
targetResources?: string[];
|
|
36
|
-
|
|
37
|
-
|
|
36
|
+
sessionId?: string;
|
|
37
|
+
delegationId?: string;
|
|
38
38
|
sourceSessionId?: string;
|
|
39
39
|
targetSessionId?: string;
|
|
40
40
|
delegationPath?: string[];
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,mBAAmB,YAAY,CAAA;AAC5C,eAAO,MAAM,oBAAoB,aAAa,CAAA;AAC9C,eAAO,MAAM,iBAAiB,SAAS,CAAA;AACvC,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,mBAAmB,YAAY,CAAA;AAC5C,eAAO,MAAM,oBAAoB,aAAa,CAAA;AAC9C,eAAO,MAAM,iBAAiB,SAAS,CAAA;AACvC,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAIhB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,iBAAiB,EAAE,MAAM,CAAA;IACzB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB"}
|
package/dist/types.js
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
// Caracal JWT claim shapes and verification configuration types.
|
|
5
5
|
// DefaultMaxHopCount caps delegation chain depth when verifier callers leave
|
|
6
6
|
// JwtConfig.maxHopCount unset. Matches the coordinator's MAX_DEPTH so a token
|
|
7
|
-
// that would have been blocked
|
|
7
|
+
// that would have been blocked when a Session starts cannot pass a permissive resource
|
|
8
8
|
// server.
|
|
9
9
|
export const DEFAULT_MAX_HOP_COUNT = 10;
|
|
10
10
|
export const MANDATE_USE_SESSION = 'session';
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,6EAA6E;AAC7E,8EAA8E;AAC9E
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,6EAA6E;AAC7E,8EAA8E;AAC9E,uFAAuF;AACvF,UAAU;AACV,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAA;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AACvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA"}
|
package/dist/verify.d.ts
CHANGED
|
@@ -11,7 +11,7 @@ export declare class ScopeInsufficientError extends CaracalError {
|
|
|
11
11
|
readonly missingScope: string;
|
|
12
12
|
constructor(missingScope: string);
|
|
13
13
|
}
|
|
14
|
-
export declare class
|
|
14
|
+
export declare class SessionRequiredError extends CaracalError {
|
|
15
15
|
constructor(message?: string);
|
|
16
16
|
}
|
|
17
17
|
export declare class DelegationRequiredError extends CaracalError {
|
package/dist/verify.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAY,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAmF,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAKzI,qBAAa,iBAAkB,SAAQ,YAAY;gBACrC,OAAO,SAA4B,EAAE,KAAK,CAAC,EAAE,OAAO;CAIjE;AAED,qBAAa,gBAAiB,SAAQ,YAAY;gBACpC,OAAO,SAAiC;CAIrD;AAED,qBAAa,sBAAuB,SAAQ,YAAY;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;gBACjB,YAAY,EAAE,MAAM;CAKjC;AAED,qBAAa,
|
|
1
|
+
{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAY,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAmF,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAKzI,qBAAa,iBAAkB,SAAQ,YAAY;gBACrC,OAAO,SAA4B,EAAE,KAAK,CAAC,EAAE,OAAO;CAIjE;AAED,qBAAa,gBAAiB,SAAQ,YAAY;gBACpC,OAAO,SAAiC;CAIrD;AAED,qBAAa,sBAAuB,SAAQ,YAAY;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;gBACjB,YAAY,EAAE,MAAM;CAKjC;AAED,qBAAa,oBAAqB,SAAQ,YAAY;gBACxC,OAAO,SAAqB;CAIzC;AAED,qBAAa,uBAAwB,SAAQ,YAAY;gBAC3C,OAAO,SAAwB;CAI5C;AAED,qBAAa,kBAAmB,SAAQ,YAAY;IAClD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;gBACzB,oBAAoB,EAAE,MAAM;CAOzC;AAED,qBAAa,qBAAsB,SAAQ,YAAY;gBACzC,OAAO,SAAuB;CAI3C;AA4DD,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG;IAAE,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiG1G;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAIlF"}
|
package/dist/verify.js
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
// Caracal, a product of Garudex Labs
|
|
3
3
|
//
|
|
4
4
|
// Verifies a Caracal JWT against an issuer JWKS and enforces zone and scope claims.
|
|
5
|
-
import {
|
|
5
|
+
import { jwtVerify } from 'jose';
|
|
6
6
|
import { CaracalError, hasScope } from '@caracalai/core';
|
|
7
7
|
import { getKeySet } from './jwks.js';
|
|
8
8
|
import { DEFAULT_MAX_HOP_COUNT, MANDATE_USE_RESOURCE, MANDATE_USE_SESSION } from './types.js';
|
|
@@ -28,10 +28,10 @@ export class ScopeInsufficientError extends CaracalError {
|
|
|
28
28
|
this.missingScope = missingScope;
|
|
29
29
|
}
|
|
30
30
|
}
|
|
31
|
-
export class
|
|
32
|
-
constructor(message = '
|
|
33
|
-
super('
|
|
34
|
-
this.name = '
|
|
31
|
+
export class SessionRequiredError extends CaracalError {
|
|
32
|
+
constructor(message = 'Session required') {
|
|
33
|
+
super('session_required', message);
|
|
34
|
+
this.name = 'SessionRequiredError';
|
|
35
35
|
}
|
|
36
36
|
}
|
|
37
37
|
export class DelegationRequiredError extends CaracalError {
|
|
@@ -111,32 +111,19 @@ function readChain(raw) {
|
|
|
111
111
|
}
|
|
112
112
|
const r = item;
|
|
113
113
|
const applicationId = requiredString(r, 'application_id');
|
|
114
|
-
const
|
|
115
|
-
const
|
|
116
|
-
out.push({ applicationId,
|
|
114
|
+
const sessionId = optionalString(r, 'agent_session_id');
|
|
115
|
+
const delegationId = optionalString(r, 'delegation_edge_id');
|
|
116
|
+
out.push({ applicationId, sessionId, delegationId });
|
|
117
117
|
}
|
|
118
118
|
return out.length === 0 ? undefined : out;
|
|
119
119
|
}
|
|
120
|
-
// STS serves one signing keyset per zone, so the JWKS fetch needs a zone. The
|
|
121
|
-
// configured zone wins; otherwise the unverified zone_id claim selects the
|
|
122
|
-
// keyset, which is safe because it only routes the key lookup - the signature
|
|
123
|
-
// check against that zone's keys then proves the claim.
|
|
124
|
-
function fetchZone(token, config) {
|
|
125
|
-
if (config.zoneId)
|
|
126
|
-
return config.zoneId;
|
|
127
|
-
let claimedZone;
|
|
128
|
-
try {
|
|
129
|
-
claimedZone = decodeJwt(token)['zone_id'];
|
|
130
|
-
}
|
|
131
|
-
catch (err) {
|
|
132
|
-
throw new TokenInvalidError('Token validation failed', err);
|
|
133
|
-
}
|
|
134
|
-
if (typeof claimedZone !== 'string' || claimedZone === '')
|
|
135
|
-
throw new ZoneInvalidError();
|
|
136
|
-
return claimedZone;
|
|
137
|
-
}
|
|
138
120
|
export async function verify(token, config) {
|
|
139
|
-
|
|
121
|
+
// The configured zone is the only trust anchor: it selects the signing keyset
|
|
122
|
+
// and must equal the zone_id claim. Verification never reads the zone from the
|
|
123
|
+
// unverified token, so key selection cannot be influenced by attacker input.
|
|
124
|
+
const zone = config.zoneId;
|
|
125
|
+
if (typeof zone !== 'string' || zone === '')
|
|
126
|
+
throw new ZoneInvalidError();
|
|
140
127
|
let payload;
|
|
141
128
|
try {
|
|
142
129
|
const keySet = config.jwksCache ? await config.jwksCache.getKeySet(config.issuer, zone) : await getKeySet(config.issuer, zone);
|
|
@@ -154,8 +141,8 @@ export async function verify(token, config) {
|
|
|
154
141
|
const jti = requiredString(payload, 'jti');
|
|
155
142
|
const sub = requiredString(payload, 'sub');
|
|
156
143
|
const clientId = requiredString(payload, 'client_id');
|
|
157
|
-
const
|
|
158
|
-
const
|
|
144
|
+
const authorityRecordId = requiredString(payload, 'sid');
|
|
145
|
+
const rootAuthorityRecordId = requiredString(payload, 'root_sid');
|
|
159
146
|
const use = requiredString(payload, 'use');
|
|
160
147
|
if (use !== MANDATE_USE_SESSION && use !== MANDATE_USE_RESOURCE)
|
|
161
148
|
throw new TokenInvalidError('Token use validation failed');
|
|
@@ -169,7 +156,7 @@ export async function verify(token, config) {
|
|
|
169
156
|
throw new TokenInvalidError('Token claim scope must be a string');
|
|
170
157
|
const targetResources = readStringList(payload['target'], 'target');
|
|
171
158
|
const rawZoneId = payload['zone_id'];
|
|
172
|
-
if (typeof rawZoneId !== 'string' || rawZoneId === '' || rawZoneId !== zone
|
|
159
|
+
if (typeof rawZoneId !== 'string' || rawZoneId === '' || rawZoneId !== zone) {
|
|
173
160
|
throw new ZoneInvalidError();
|
|
174
161
|
}
|
|
175
162
|
const zoneId = rawZoneId;
|
|
@@ -185,18 +172,18 @@ export async function verify(token, config) {
|
|
|
185
172
|
throw new TokenInvalidError('Token target resource validation failed');
|
|
186
173
|
}
|
|
187
174
|
}
|
|
188
|
-
const
|
|
189
|
-
const
|
|
175
|
+
const sessionId = optionalString(payload, 'agent_session_id');
|
|
176
|
+
const delegationId = optionalString(payload, 'delegation_edge_id');
|
|
190
177
|
const sourceSessionId = optionalString(payload, 'source_session_id');
|
|
191
178
|
const targetSessionId = optionalString(payload, 'target_session_id');
|
|
192
179
|
const delegationPath = readStringList(payload['delegation_path'], 'delegation_path');
|
|
193
180
|
const delegationChain = readChain(payload['delegation_chain']);
|
|
194
181
|
const graphEpoch = optionalInteger(payload, 'delegation_graph_epoch');
|
|
195
182
|
const hopCount = optionalInteger(payload, 'hop_count');
|
|
196
|
-
if (config.
|
|
197
|
-
throw new
|
|
183
|
+
if (config.requireSession && !sessionId) {
|
|
184
|
+
throw new SessionRequiredError();
|
|
198
185
|
}
|
|
199
|
-
if (config.requireDelegation && !
|
|
186
|
+
if (config.requireDelegation && !delegationId) {
|
|
200
187
|
throw new DelegationRequiredError();
|
|
201
188
|
}
|
|
202
189
|
const maxHops = config.maxHopCount !== undefined && config.maxHopCount > 0 ? config.maxHopCount : DEFAULT_MAX_HOP_COUNT;
|
|
@@ -212,8 +199,8 @@ export async function verify(token, config) {
|
|
|
212
199
|
sub,
|
|
213
200
|
zoneId,
|
|
214
201
|
clientId,
|
|
215
|
-
|
|
216
|
-
|
|
202
|
+
authorityRecordId,
|
|
203
|
+
rootAuthorityRecordId,
|
|
217
204
|
use,
|
|
218
205
|
subType,
|
|
219
206
|
jti,
|
|
@@ -221,8 +208,8 @@ export async function verify(token, config) {
|
|
|
221
208
|
expiresAt,
|
|
222
209
|
scope,
|
|
223
210
|
targetResources,
|
|
224
|
-
|
|
225
|
-
|
|
211
|
+
sessionId,
|
|
212
|
+
delegationId,
|
|
226
213
|
sourceSessionId,
|
|
227
214
|
targetSessionId,
|
|
228
215
|
delegationPath,
|
package/dist/verify.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,oFAAoF;AAEpF,OAAO,EAAE,SAAS,EAAE,
|
|
1
|
+
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,oFAAoF;AAEpF,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAkB,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAA8C,MAAM,YAAY,CAAA;AAEzI,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;AACvG,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC,MAAM,OAAO,iBAAkB,SAAQ,YAAY;IACjD,YAAY,OAAO,GAAG,yBAAyB,EAAE,KAAe;QAC9D,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACrE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IAChD,YAAY,OAAO,GAAG,8BAA8B;QAClD,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;QAC9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IAC7C,YAAY,CAAQ;IAC7B,YAAY,YAAoB;QAC9B,KAAK,CAAC,oBAAoB,EAAE,kBAAkB,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QAC5F,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;QACpC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;IAClC,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IACpD,YAAY,OAAO,GAAG,kBAAkB;QACtC,KAAK,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,YAAY;IACvD,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IACzC,oBAAoB,CAAQ;IACrC,YAAY,oBAA4B;QACtC,KAAK,CAAC,gBAAgB,EAAE,yCAAyC,oBAAoB,EAAE,EAAE;YACvF,OAAO,EAAE,EAAE,oBAAoB,EAAE;SAClC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;IAClD,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IACrD,YAAY,OAAO,GAAG,oBAAoB;QACxC,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF;AAED,SAAS,cAAc,CAAC,OAAgC,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,cAAc,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAAgC,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,mBAAmB,CAAC,CAAA;IAClG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,iCAAiC,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5C,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,cAAc,CAAC,CAAA;IACvF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,IAAY;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAA;IAClG,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAA;QACxH,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAA;IACrG,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,CAAC,CAAA;QAClF,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAA;QACzC,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;QACzD,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAA;QACvD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,MAA6C;IACvF,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAA;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAA;IACzE,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAC7H;QAAA,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,cAAc,EAAE,eAAe;YAC/B,cAAc,EAAE,2BAA2B;SAC5C,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACrD,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,qBAAqB,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACjE,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC1C,IAAI,GAAG,KAAK,mBAAmB,IAAI,GAAG,KAAK,oBAAoB;QAAE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAA;IAC3H,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACnD,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,aAAa;QAAE,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,CAAC,CAAA;IACxH,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACjD,MAAM,KAAK,GAAI,OAAO,CAAC,OAAO,CAAwB,IAAI,EAAE,CAAA;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAA;IAChG,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACpC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,EAAE,CAAA;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAA;IACxB,IAAI,MAAM,CAAC,WAAW,IAAI,GAAG,KAAK,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAA;IAChH,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAC7D,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;IAClE,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACpE,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IACpE,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACpF,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAA;IACrE,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAEtD,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,oBAAoB,EAAE,CAAA;IAClC,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,EAAE,CAAA;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAA;IACvH,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,qBAAqB,EAAE,CAAA;IACnC,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACtD,CAAC;IAED,OAAO;QACL,GAAG;QACH,MAAM;QACN,QAAQ;QACR,iBAAiB;QACjB,qBAAqB;QACrB,GAAG;QACH,OAAO;QACP,GAAG;QACH,QAAQ;QACR,SAAS;QACT,KAAK;QACL,eAAe;QACf,SAAS;QACT,YAAY;QACZ,eAAe;QACf,eAAe;QACf,cAAc;QACd,eAAe;QACf,UAAU;QACV,QAAQ;KACT,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,aAAqB;IACvE,IAAI,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,aAAa,CAAC;QAAE,OAAO,IAAI,CAAA;IACvF,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO,KAAK,CAAA;AACd,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@caracalai/identity",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.2.0-rc.2",
|
|
4
4
|
"description": "Caracal identity primitives: JWT verification, JWKS, scope, claims.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://github.com/Garudex-Labs/caracal",
|
|
@@ -40,12 +40,12 @@
|
|
|
40
40
|
"prepublishOnly": "tsc"
|
|
41
41
|
},
|
|
42
42
|
"dependencies": {
|
|
43
|
-
"@caracalai/core": "0.
|
|
43
|
+
"@caracalai/core": "0.2.0-rc.2",
|
|
44
44
|
"jose": "^6.2.3"
|
|
45
45
|
},
|
|
46
46
|
"devDependencies": {
|
|
47
|
-
"@types/node": "^26.0
|
|
47
|
+
"@types/node": "^26.1.0",
|
|
48
48
|
"typescript": "^6.0.3",
|
|
49
|
-
"vitest": "^4.1.
|
|
49
|
+
"vitest": "^4.1.10"
|
|
50
50
|
}
|
|
51
51
|
}
|