@commercetools-backend/express 23.2.0 → 23.2.2

package/dist/commercetools-backend-express.cjs.dev.js

@@ -2,20 +2,10 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var _defineProperty = require('@babel/runtime-corejs3/helpers/defineProperty');
 var _URL = require('@babel/runtime-corejs3/core-js-stable/url');
+var _Map = require('@babel/runtime-corejs3/core-js-stable/map');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
-var _Promise = require('@babel/runtime-corejs3/core-js-stable/promise');
-var _Object$keys = require('@babel/runtime-corejs3/core-js-stable/object/keys');
-var _Object$getOwnPropertySymbols = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
-var _filterInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/filter');
-var _Object$getOwnPropertyDescriptor = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor');
-var _forEachInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/for-each');
-var _Object$getOwnPropertyDescriptors = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptors');
-var _Object$defineProperties = require('@babel/runtime-corejs3/core-js-stable/object/define-properties');
-var _Object$defineProperty = require('@babel/runtime-corejs3/core-js-stable/object/define-property');
-var expressJwt = require('express-jwt');
-var jwksRsa = require('jwks-rsa');
+var jose = require('jose');
 var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
 var _findInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/find');
 var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entries');
@@ -24,17 +14,8 @@ var _Array$isArray = require('@babel/runtime-corejs3/core-js-stable/array/is-arr
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
 
 var _URL__default = /*#__PURE__*/_interopDefault(_URL);
+var _Map__default = /*#__PURE__*/_interopDefault(_Map);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
-var _Promise__default = /*#__PURE__*/_interopDefault(_Promise);
-var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
-var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
-var _filterInstanceProperty__default = /*#__PURE__*/_interopDefault(_filterInstanceProperty);
-var _Object$getOwnPropertyDescriptor__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptor);
-var _forEachInstanceProperty__default = /*#__PURE__*/_interopDefault(_forEachInstanceProperty);
-var _Object$getOwnPropertyDescriptors__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptors);
-var _Object$defineProperties__default = /*#__PURE__*/_interopDefault(_Object$defineProperties);
-var _Object$defineProperty__default = /*#__PURE__*/_interopDefault(_Object$defineProperty);
-var jwksRsa__default = /*#__PURE__*/_interopDefault(jwksRsa);
 var _findInstanceProperty__default = /*#__PURE__*/_interopDefault(_findInstanceProperty);
 var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
 var _Array$isArray__default = /*#__PURE__*/_interopDefault(_Array$isArray);
@@ -96,27 +77,18 @@ const getFirstHeaderValueOrThrow = (headers, headerKey, errorMessage) => {
   return headerValue;
 };
 
-function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
-const decodedTokenKey = 'decoded_token';
 // Assign a session object to the request object.
-const writeSessionContext = request => {
-  const decodedToken = request[decodedTokenKey];
-  if (decodedToken) {
-    const publicClaimForProjectKey = `${decodedToken.iss}/claims/project_key`;
-    const publicClaimForUserPermissionsKey = `${decodedToken.iss}/claims/user_permissions`;
-    request.session = {
-      userId: decodedToken.sub,
-      projectKey: decodedToken[publicClaimForProjectKey]
-    };
-    const userPermissions = decodedToken[publicClaimForUserPermissionsKey];
-    if (Boolean(userPermissions?.length)) {
-      request.session.userPermissions = userPermissions;
-    }
+const writeSessionContext = (request, verifiedToken) => {
+  const publicClaimForProjectKey = `${verifiedToken.iss}/claims/project_key`;
+  const publicClaimForUserPermissionsKey = `${verifiedToken.iss}/claims/user_permissions`;
+  request.session = {
+    userId: verifiedToken.sub,
+    projectKey: verifiedToken[publicClaimForProjectKey]
+  };
+  const userPermissions = verifiedToken[publicClaimForUserPermissionsKey];
+  if (Boolean(userPermissions?.length)) {
+    request.session.userPermissions = userPermissions;
   }
-
-  // Remove the field used by the JWT middleware.
-  delete request.decoded_token;
 };
 
 // Given a cloud identifier, try to map it to one of the supported
@@ -199,12 +171,22 @@ const getConfiguredAudience = (options, requestPath) => {
       }
   }
 };
+const jwksClientByIssuer = new _Map__default["default"]();
+function getJwksClientByIssuer(issuer) {
+  const client = jwksClientByIssuer.get(issuer);
+  if (client) {
+    return client;
+  }
+  const newClient = jose.createRemoteJWKSet(new _URL__default["default"](`/.well-known/jwks.json`, issuer));
+  jwksClientByIssuer.set(issuer, newClient);
+  return newClient;
+}
 function createSessionAuthVerifier(options) {
   validateRequiredValues(options);
   const configuredDefaultIssuer = getConfiguredDefaultIssuer(options);
 
   // Returns an async HTTP handler.
-  return async (request, response) => {
+  return async request => {
     // Get the cloud identifier header, forwarded by the `/proxy/forward-to` endpoint.
     const cloudIdentifierHeader = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.CLOUD_IDENTIFIER, `Missing "X-MC-API-Cloud-Identifier" header.`);
     let issuer = options.inferIssuer && cloudIdentifierHeader ? mapCloudIdentifierToIssuer(cloudIdentifierHeader) ?? configuredDefaultIssuer : configuredDefaultIssuer;
@@ -221,44 +203,27 @@ function createSessionAuthVerifier(options) {
       throw new Error(`Invalid request URI path "${requestUrlPath}". Please make sure that the "request" object has either a property "originalUrl" or "url". If not, you should implement the "getRequestUrl" function and make sure to return a valid URI path value starting with "/". More info at https://docs.commercetools.com/merchant-center-customizations/concepts/integrate-with-your-own-api#validating-the-json-web-token`);
     }
     const audience = getConfiguredAudience(options, requestUrlPath);
-    return new _Promise__default["default"]((resolve, reject) => {
-      expressJwt.expressjwt({
-        // Dynamically provide a signing key based on the kid in the header
-        // and the singing keys provided by the JWKS endpoint
-        secret: jwksRsa__default["default"].expressJwtSecret(_objectSpread(_objectSpread({
-          // Default options
-          cache: true,
-          rateLimit: true,
-          jwksRequestsPerMinute: 5
-        }, options.jwks || {}), {}, {
-          // This should be set by the middleware, no matter what.
-          jwksUri: `${issuer}/.well-known/jwks.json`
-        })),
-        requestProperty: decodedTokenKey,
-        // Validate the audience and the issuer.
-        audience,
-        issuer,
-        algorithms: ['RS256']
-        // @ts-ignore: the middleware expects an Express.js Request/Response objects
-      })(request, response ?? {}, error => {
-        if (error) {
-          reject(error);
-        } else {
-          // @ts-ignore: the Request object does not know about some additional fields
-          // like `decoded_token` and `session`
-          writeSessionContext(request);
-          resolve();
-        }
-      });
+    const authorizationHeader = request.headers['authorization'];
+    if (typeof authorizationHeader !== 'string') {
+      throw new Error(`Missing "authorization" header`);
+    }
+    const exchangeToken = authorizationHeader.replace(/^Bearer (.*)$/, '$1');
+    const jwksClient = getJwksClientByIssuer(issuer);
+    const verifiedToken = await jose.jwtVerify(exchangeToken, jwksClient, {
+      algorithms: ['RS256'],
+      audience,
+      issuer
     });
+    writeSessionContext(request, verifiedToken.payload);
+    return;
   };
 }
 
 function createSessionMiddleware(options) {
   const sessionAuthVerifier = createSessionAuthVerifier(options);
-  return async (request, response, next) => {
+  return async (request, _response, next) => {
     try {
-      await sessionAuthVerifier(request, response);
+      await sessionAuthVerifier(request);
       next();
     } catch (error) {
       next(error);

package/dist/commercetools-backend-express.cjs.prod.js

@@ -2,20 +2,10 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var _defineProperty = require('@babel/runtime-corejs3/helpers/defineProperty');
 var _URL = require('@babel/runtime-corejs3/core-js-stable/url');
+var _Map = require('@babel/runtime-corejs3/core-js-stable/map');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
-var _Promise = require('@babel/runtime-corejs3/core-js-stable/promise');
-var _Object$keys = require('@babel/runtime-corejs3/core-js-stable/object/keys');
-var _Object$getOwnPropertySymbols = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
-var _filterInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/filter');
-var _Object$getOwnPropertyDescriptor = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor');
-var _forEachInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/for-each');
-var _Object$getOwnPropertyDescriptors = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptors');
-var _Object$defineProperties = require('@babel/runtime-corejs3/core-js-stable/object/define-properties');
-var _Object$defineProperty = require('@babel/runtime-corejs3/core-js-stable/object/define-property');
-var expressJwt = require('express-jwt');
-var jwksRsa = require('jwks-rsa');
+var jose = require('jose');
 var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
 var _findInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/find');
 var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entries');
@@ -24,17 +14,8 @@ var _Array$isArray = require('@babel/runtime-corejs3/core-js-stable/array/is-arr
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
 
 var _URL__default = /*#__PURE__*/_interopDefault(_URL);
+var _Map__default = /*#__PURE__*/_interopDefault(_Map);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
-var _Promise__default = /*#__PURE__*/_interopDefault(_Promise);
-var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
-var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
-var _filterInstanceProperty__default = /*#__PURE__*/_interopDefault(_filterInstanceProperty);
-var _Object$getOwnPropertyDescriptor__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptor);
-var _forEachInstanceProperty__default = /*#__PURE__*/_interopDefault(_forEachInstanceProperty);
-var _Object$getOwnPropertyDescriptors__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptors);
-var _Object$defineProperties__default = /*#__PURE__*/_interopDefault(_Object$defineProperties);
-var _Object$defineProperty__default = /*#__PURE__*/_interopDefault(_Object$defineProperty);
-var jwksRsa__default = /*#__PURE__*/_interopDefault(jwksRsa);
 var _findInstanceProperty__default = /*#__PURE__*/_interopDefault(_findInstanceProperty);
 var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
 var _Array$isArray__default = /*#__PURE__*/_interopDefault(_Array$isArray);
@@ -96,27 +77,18 @@ const getFirstHeaderValueOrThrow = (headers, headerKey, errorMessage) => {
   return headerValue;
 };
 
-function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
-const decodedTokenKey = 'decoded_token';
 // Assign a session object to the request object.
-const writeSessionContext = request => {
-  const decodedToken = request[decodedTokenKey];
-  if (decodedToken) {
-    const publicClaimForProjectKey = `${decodedToken.iss}/claims/project_key`;
-    const publicClaimForUserPermissionsKey = `${decodedToken.iss}/claims/user_permissions`;
-    request.session = {
-      userId: decodedToken.sub,
-      projectKey: decodedToken[publicClaimForProjectKey]
-    };
-    const userPermissions = decodedToken[publicClaimForUserPermissionsKey];
-    if (Boolean(userPermissions?.length)) {
-      request.session.userPermissions = userPermissions;
-    }
+const writeSessionContext = (request, verifiedToken) => {
+  const publicClaimForProjectKey = `${verifiedToken.iss}/claims/project_key`;
+  const publicClaimForUserPermissionsKey = `${verifiedToken.iss}/claims/user_permissions`;
+  request.session = {
+    userId: verifiedToken.sub,
+    projectKey: verifiedToken[publicClaimForProjectKey]
+  };
+  const userPermissions = verifiedToken[publicClaimForUserPermissionsKey];
+  if (Boolean(userPermissions?.length)) {
+    request.session.userPermissions = userPermissions;
   }
-
-  // Remove the field used by the JWT middleware.
-  delete request.decoded_token;
 };
 
 // Given a cloud identifier, try to map it to one of the supported
@@ -199,12 +171,22 @@ const getConfiguredAudience = (options, requestPath) => {
       }
   }
 };
+const jwksClientByIssuer = new _Map__default["default"]();
+function getJwksClientByIssuer(issuer) {
+  const client = jwksClientByIssuer.get(issuer);
+  if (client) {
+    return client;
+  }
+  const newClient = jose.createRemoteJWKSet(new _URL__default["default"](`/.well-known/jwks.json`, issuer));
+  jwksClientByIssuer.set(issuer, newClient);
+  return newClient;
+}
 function createSessionAuthVerifier(options) {
   validateRequiredValues(options);
   const configuredDefaultIssuer = getConfiguredDefaultIssuer(options);
 
   // Returns an async HTTP handler.
-  return async (request, response) => {
+  return async request => {
     // Get the cloud identifier header, forwarded by the `/proxy/forward-to` endpoint.
     const cloudIdentifierHeader = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.CLOUD_IDENTIFIER, `Missing "X-MC-API-Cloud-Identifier" header.`);
     let issuer = options.inferIssuer && cloudIdentifierHeader ? mapCloudIdentifierToIssuer(cloudIdentifierHeader) ?? configuredDefaultIssuer : configuredDefaultIssuer;
@@ -221,44 +203,27 @@ function createSessionAuthVerifier(options) {
       throw new Error(`Invalid request URI path "${requestUrlPath}". Please make sure that the "request" object has either a property "originalUrl" or "url". If not, you should implement the "getRequestUrl" function and make sure to return a valid URI path value starting with "/". More info at https://docs.commercetools.com/merchant-center-customizations/concepts/integrate-with-your-own-api#validating-the-json-web-token`);
     }
     const audience = getConfiguredAudience(options, requestUrlPath);
-    return new _Promise__default["default"]((resolve, reject) => {
-      expressJwt.expressjwt({
-        // Dynamically provide a signing key based on the kid in the header
-        // and the singing keys provided by the JWKS endpoint
-        secret: jwksRsa__default["default"].expressJwtSecret(_objectSpread(_objectSpread({
-          // Default options
-          cache: true,
-          rateLimit: true,
-          jwksRequestsPerMinute: 5
-        }, options.jwks || {}), {}, {
-          // This should be set by the middleware, no matter what.
-          jwksUri: `${issuer}/.well-known/jwks.json`
-        })),
-        requestProperty: decodedTokenKey,
-        // Validate the audience and the issuer.
-        audience,
-        issuer,
-        algorithms: ['RS256']
-        // @ts-ignore: the middleware expects an Express.js Request/Response objects
-      })(request, response ?? {}, error => {
-        if (error) {
-          reject(error);
-        } else {
-          // @ts-ignore: the Request object does not know about some additional fields
-          // like `decoded_token` and `session`
-          writeSessionContext(request);
-          resolve();
-        }
-      });
+    const authorizationHeader = request.headers['authorization'];
+    if (typeof authorizationHeader !== 'string') {
+      throw new Error(`Missing "authorization" header`);
+    }
+    const exchangeToken = authorizationHeader.replace(/^Bearer (.*)$/, '$1');
+    const jwksClient = getJwksClientByIssuer(issuer);
+    const verifiedToken = await jose.jwtVerify(exchangeToken, jwksClient, {
+      algorithms: ['RS256'],
+      audience,
+      issuer
     });
+    writeSessionContext(request, verifiedToken.payload);
+    return;
   };
 }
 
 function createSessionMiddleware(options) {
   const sessionAuthVerifier = createSessionAuthVerifier(options);
-  return async (request, response, next) => {
+  return async (request, _response, next) => {
     try {
-      await sessionAuthVerifier(request, response);
+      await sessionAuthVerifier(request);
       next();
     } catch (error) {
       next(error);

package/dist/commercetools-backend-express.esm.js

@@ -1,17 +1,7 @@
-import _defineProperty from '@babel/runtime-corejs3/helpers/esm/defineProperty';
 import _URL from '@babel/runtime-corejs3/core-js-stable/url';
+import _Map from '@babel/runtime-corejs3/core-js-stable/map';
 import _startsWithInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/starts-with';
-import _Promise from '@babel/runtime-corejs3/core-js-stable/promise';
-import _Object$keys from '@babel/runtime-corejs3/core-js-stable/object/keys';
-import _Object$getOwnPropertySymbols from '@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols';
-import _filterInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/filter';
-import _Object$getOwnPropertyDescriptor from '@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor';
-import _forEachInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/for-each';
-import _Object$getOwnPropertyDescriptors from '@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptors';
-import _Object$defineProperties from '@babel/runtime-corejs3/core-js-stable/object/define-properties';
-import _Object$defineProperty from '@babel/runtime-corejs3/core-js-stable/object/define-property';
-import { expressjwt } from 'express-jwt';
-import jwksRsa from 'jwks-rsa';
+import { jwtVerify, createRemoteJWKSet } from 'jose';
 import _slicedToArray from '@babel/runtime-corejs3/helpers/esm/slicedToArray';
 import _findInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/find';
 import _Object$entries from '@babel/runtime-corejs3/core-js-stable/object/entries';
@@ -74,27 +64,18 @@ const getFirstHeaderValueOrThrow = (headers, headerKey, errorMessage) => {
   return headerValue;
 };
 
-function ownKeys(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
-const decodedTokenKey = 'decoded_token';
 // Assign a session object to the request object.
-const writeSessionContext = request => {
-  const decodedToken = request[decodedTokenKey];
-  if (decodedToken) {
-    const publicClaimForProjectKey = `${decodedToken.iss}/claims/project_key`;
-    const publicClaimForUserPermissionsKey = `${decodedToken.iss}/claims/user_permissions`;
-    request.session = {
-      userId: decodedToken.sub,
-      projectKey: decodedToken[publicClaimForProjectKey]
-    };
-    const userPermissions = decodedToken[publicClaimForUserPermissionsKey];
-    if (Boolean(userPermissions?.length)) {
-      request.session.userPermissions = userPermissions;
-    }
+const writeSessionContext = (request, verifiedToken) => {
+  const publicClaimForProjectKey = `${verifiedToken.iss}/claims/project_key`;
+  const publicClaimForUserPermissionsKey = `${verifiedToken.iss}/claims/user_permissions`;
+  request.session = {
+    userId: verifiedToken.sub,
+    projectKey: verifiedToken[publicClaimForProjectKey]
+  };
+  const userPermissions = verifiedToken[publicClaimForUserPermissionsKey];
+  if (Boolean(userPermissions?.length)) {
+    request.session.userPermissions = userPermissions;
   }
-
-  // Remove the field used by the JWT middleware.
-  delete request.decoded_token;
 };
 
 // Given a cloud identifier, try to map it to one of the supported
@@ -177,12 +158,22 @@ const getConfiguredAudience = (options, requestPath) => {
       }
   }
 };
+const jwksClientByIssuer = new _Map();
+function getJwksClientByIssuer(issuer) {
+  const client = jwksClientByIssuer.get(issuer);
+  if (client) {
+    return client;
+  }
+  const newClient = createRemoteJWKSet(new _URL(`/.well-known/jwks.json`, issuer));
+  jwksClientByIssuer.set(issuer, newClient);
+  return newClient;
+}
 function createSessionAuthVerifier(options) {
   validateRequiredValues(options);
   const configuredDefaultIssuer = getConfiguredDefaultIssuer(options);
 
   // Returns an async HTTP handler.
-  return async (request, response) => {
+  return async request => {
     // Get the cloud identifier header, forwarded by the `/proxy/forward-to` endpoint.
     const cloudIdentifierHeader = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.CLOUD_IDENTIFIER, `Missing "X-MC-API-Cloud-Identifier" header.`);
     let issuer = options.inferIssuer && cloudIdentifierHeader ? mapCloudIdentifierToIssuer(cloudIdentifierHeader) ?? configuredDefaultIssuer : configuredDefaultIssuer;
@@ -199,44 +190,27 @@ function createSessionAuthVerifier(options) {
       throw new Error(`Invalid request URI path "${requestUrlPath}". Please make sure that the "request" object has either a property "originalUrl" or "url". If not, you should implement the "getRequestUrl" function and make sure to return a valid URI path value starting with "/". More info at https://docs.commercetools.com/merchant-center-customizations/concepts/integrate-with-your-own-api#validating-the-json-web-token`);
     }
     const audience = getConfiguredAudience(options, requestUrlPath);
-    return new _Promise((resolve, reject) => {
-      expressjwt({
-        // Dynamically provide a signing key based on the kid in the header
-        // and the singing keys provided by the JWKS endpoint
-        secret: jwksRsa.expressJwtSecret(_objectSpread(_objectSpread({
-          // Default options
-          cache: true,
-          rateLimit: true,
-          jwksRequestsPerMinute: 5
-        }, options.jwks || {}), {}, {
-          // This should be set by the middleware, no matter what.
-          jwksUri: `${issuer}/.well-known/jwks.json`
-        })),
-        requestProperty: decodedTokenKey,
-        // Validate the audience and the issuer.
-        audience,
-        issuer,
-        algorithms: ['RS256']
-        // @ts-ignore: the middleware expects an Express.js Request/Response objects
-      })(request, response ?? {}, error => {
-        if (error) {
-          reject(error);
-        } else {
-          // @ts-ignore: the Request object does not know about some additional fields
-          // like `decoded_token` and `session`
-          writeSessionContext(request);
-          resolve();
-        }
-      });
+    const authorizationHeader = request.headers['authorization'];
+    if (typeof authorizationHeader !== 'string') {
+      throw new Error(`Missing "authorization" header`);
+    }
+    const exchangeToken = authorizationHeader.replace(/^Bearer (.*)$/, '$1');
+    const jwksClient = getJwksClientByIssuer(issuer);
+    const verifiedToken = await jwtVerify(exchangeToken, jwksClient, {
+      algorithms: ['RS256'],
+      audience,
+      issuer
     });
+    writeSessionContext(request, verifiedToken.payload);
+    return;
   };
 }
 
 function createSessionMiddleware(options) {
   const sessionAuthVerifier = createSessionAuthVerifier(options);
-  return async (request, response, next) => {
+  return async (request, _response, next) => {
     try {
-      await sessionAuthVerifier(request, response);
+      await sessionAuthVerifier(request);
       next();
     } catch (error) {
       next(error);

package/dist/declarations/src/auth.d.ts

@@ -1,13 +1,12 @@
 import type { TSessionMiddlewareOptions, TSession, TBaseRequest } from './types';
-type TDecodedJWT = {
+export type TDecodedJWT = {
     sub: string;
     iss: string;
     [property: string]: string | string[];
 };
-declare const writeSessionContext: <Request_1 extends TBaseRequest>(request: Request_1 & {
-    decoded_token?: TDecodedJWT | undefined;
-    session?: TSession | undefined;
-}) => void;
-export declare const getConfiguredAudience: <Request_1 extends TBaseRequest>(options: TSessionMiddlewareOptions<Request_1>, requestPath: string) => string;
-declare function createSessionAuthVerifier<Request extends TBaseRequest>(options: TSessionMiddlewareOptions<Request>): (request: Request, response?: unknown) => Promise<void>;
+declare const writeSessionContext: <Request extends TBaseRequest>(request: Request & {
+    session?: TSession;
+}, verifiedToken: TDecodedJWT) => void;
+export declare const getConfiguredAudience: <Request extends TBaseRequest>(options: TSessionMiddlewareOptions<Request>, requestPath: string) => string;
+declare function createSessionAuthVerifier<Request extends TBaseRequest>(options: TSessionMiddlewareOptions<Request>): (request: Request) => Promise<void>;
 export { createSessionAuthVerifier, writeSessionContext };

package/dist/declarations/src/middlewares/session-middleware.d.ts

@@ -1,4 +1,4 @@
 import type { Response, NextFunction } from 'express';
 import type { TBaseRequest, TSessionMiddlewareOptions } from '../types';
-declare function createSessionMiddleware<Request extends TBaseRequest>(options: TSessionMiddlewareOptions<Request>): (request: Request, response: Response, next: NextFunction) => Promise<void>;
+declare function createSessionMiddleware<Request extends TBaseRequest>(options: TSessionMiddlewareOptions<Request>): (request: Request, _response: Response, next: NextFunction) => Promise<void>;
 export default createSessionMiddleware;

package/dist/declarations/src/types.d.ts

@@ -1,4 +1,3 @@
-import type { ExpressJwtOptions } from 'jwks-rsa';
 import { CLOUD_IDENTIFIERS } from './constants';
 export type TAudience = string;
 export type TIssuer = string;
@@ -35,8 +34,10 @@ export type TSessionMiddlewareOptions<Request extends TBaseRequest> = {
     inferIssuer?: boolean;
     /**
      * Options for the `jwksRsa.expressJwtSecret`
+     *
+     * @deprecated
      */
-    jwks?: Omit<ExpressJwtOptions, 'jwksUri'>;
+    jwks?: unknown;
     /**
      * By default we assume that the `request` is a Node.js-like object having either
      * an `originalUrl` or `url` properties.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools-backend/express",
-  "version": "23.2.0",
+  "version": "23.2.2",
   "description": "Zero-config HTTP server as Express.js to facilitate development",
   "bugs": "https://github.com/commercetools/merchant-center-application-kit/issues",
   "repository": {
@@ -34,14 +34,15 @@
     "@babel/runtime-corejs3": "^7.22.15",
     "@types/express": "^4.17.17",
     "@types/node": "^22.13.2",
-    "express": "4.20.0",
-    "express-jwt": "8.4.1",
-    "jwks-rsa": "2.1.5"
+    "express": "^4.21.2",
+    "jose": "^5.10.0"
   },
   "devDependencies": {
     "@tsconfig/node22": "^22.0.0",
-    "@types/jsonwebtoken": "^9.0.2",
-    "jose": "2.0.7",
+    "typescript": "^5.2.2",
     "msw": "0.49.3"
+  },
+  "engines": {
+    "node": "18.x || 20.x || >=22.0.0"
   }
 }