@commercetools/connect-payments-sdk 0.0.4 → 0.0.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @commercetools/connect-payments-sdk
 
+## 0.0.5
+
+### Patch Changes
+
+- 22434c9: Enforce validation of projectkey on the jwt authentication.
+
 ## 0.0.4
 
 ### Patch Changes

package/dist/index.js

@@ -73,6 +73,7 @@ const setupPaymentSDK = (opts) => {
     const jwtAuthenticationManager = new security_1.JWTAuthenticationManager({
         jwtService,
         iss: opts.jwtIssuer,
+        projectKey: opts.projectKey,
     });
     const sessionAuthHookFn = new api_1.SessionAuthenticationHook({
         authenticationManager: sessionAuthenticationManager,

package/dist/security/authn/jwt-authn-manager.d.ts

@@ -4,9 +4,11 @@ import { AuthenticationManager } from './types/authn.type';
 export declare class JWTAuthenticationManager implements AuthenticationManager {
     private jwtService;
     private iss;
+    private projectKey;
     constructor(opts: {
         jwtService: JWTService;
         iss: string;
+        projectKey: string;
     });
     authenticate(authentication: HeaderBasedAuthentication): Promise<JWTAuthentication>;
 }

package/dist/security/authn/jwt-authn-manager.js

@@ -7,9 +7,11 @@ const bearer_utils_1 = require("./bearer-utils");
 class JWTAuthenticationManager {
     jwtService;
     iss;
+    projectKey;
     constructor(opts) {
         this.jwtService = opts.jwtService;
         this.iss = opts.iss;
+        this.projectKey = opts.projectKey;
     }
     async authenticate(authentication) {
         const principal = authentication.getPrincipal();
@@ -18,13 +20,23 @@ class JWTAuthenticationManager {
             token,
         }));
         if (decodedToken.iss !== this.iss) {
-            throw new errorx_1.ErrorAuthErrorResponse('Issuer in the token does not match the expected issuer', {
+            throw new errorx_1.ErrorAuthErrorResponse('Issuer in the token does not match the expected issuer.', {
                 privateFields: {
                     expectedIssuer: this.iss,
                     actualIssuer: decodedToken['iss'],
                 },
             });
         }
+        const projectKey = decodedToken[`${this.iss}/claims/project_key`];
+        if (projectKey !== this.projectKey) {
+            throw new errorx_1.ErrorAuthErrorResponse('Project key does not match.', {
+                privateFields: {
+                    expectedIssuer: this.iss,
+                    actualIssuer: decodedToken['iss'],
+                    projectKey,
+                },
+            });
+        }
         return new authns_1.JWTAuthentication(token, {
             mcCustomerId: decodedToken['sub'],
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools/connect-payments-sdk",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Payment SDK for commercetools payment connectors",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",