@cemiar/auth-sdk 1.0.5 → 1.0.7

package/dist/browser/CemiarAuthClient.js

@@ -99,7 +99,11 @@ export class CemiarAuthClient {
         return `${this.baseUrl}/microsoft?${params.toString()}`;
     }
     async refreshToken() {
-        const data = await this.authPost("/refresh", {}, true);
+        const refreshPayload = {
+            tenantId: this.tenantId,
+            auds: this.auds
+        };
+        const data = await this.authPost("/refresh", refreshPayload, true);
         const accessToken = extractAccessToken(data);
         this.setAccessToken(accessToken);
         return { accessToken };

package/dist/server/ServerHandler.js

@@ -35,7 +35,7 @@ function createSigningKeyResolver(jwksUri, cacheMaxAgeMs) {
 }
 export async function registerCemiarAuthHapi(server, options) {
     var _a;
-    const { authUrl, strategyName = "cemiar-jwt", algorithms = DEFAULT_ALGORITHMS, cacheMaxAgeMs = DEFAULT_CACHE_MAX_AGE, validate = defaultValidate } = options;
+    const { authUrl, auds, strategyName = "cemiar-jwt", algorithms = DEFAULT_ALGORITHMS, cacheMaxAgeMs = DEFAULT_CACHE_MAX_AGE, validate = defaultValidate } = options;
     const jwksUri = `${normalizeBaseUrl(authUrl)}/.well-known/jwks.json`;
     const { getKey } = createSigningKeyResolver(jwksUri, cacheMaxAgeMs);
     const pluginModule = await import("hapi-auth-jwt2");
@@ -47,6 +47,13 @@ export async function registerCemiarAuthHapi(server, options) {
             return { key };
         },
         validate: async (decoded, request, h) => {
+            const payload = decoded.payload;
+            const tokenAud = payload === null || payload === void 0 ? void 0 : payload.aud;
+            const tokenAuds = Array.isArray(tokenAud) ? tokenAud : tokenAud ? [tokenAud] : [];
+            const hasValidAud = tokenAuds.length > 0 && tokenAuds.every(aud => auds.includes(aud));
+            if (!hasValidAud) {
+                return { isValid: false };
+            }
             return validate(decoded, request, h);
         },
         verifyOptions: {

package/dist/shared/Types.d.ts

@@ -68,6 +68,7 @@ export interface JwtValidateResult {
 export type JwtValidateFn = (decoded: JwtParts, request: Request, h: ResponseToolkit) => Promise<JwtValidateResult> | JwtValidateResult;
 export interface HapiJwtStrategyOptions {
     authUrl: string;
+    auds: string[];
     strategyName?: string;
     algorithms?: string[];
     cacheMaxAgeMs?: number;

package/dist/shared/models/RefreshPayload.d.ts

@@ -0,0 +1,4 @@
+export interface RefreshPayload {
+    tenantId: string;
+    auds: string[];
+}

package/dist/shared/models/RefreshPayload.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cemiar/auth-sdk",
-    "version": "1.0.5",
+    "version": "1.0.7",
     "description": "Cemiar Auth integration helpers for web apps and APIs.",
     "type": "module",
     "main": "dist/index.js",