@degenerate/endpoints 0.0.3 → 0.0.4

package/dist/generic/src/authorization/jwt/sign/create-jwt-options.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJwtOptions = void 0;
+const authorization_models_1 = require("../../../models/authorization/authorization-models");
+const authorization_settings_1 = require("../../../_settings/authorization-settings");
+/**
+ * This function creates the options for the jwt token issuance
+ *
+ * @param subject the subject of the token
+ * @param audience the audience of the token (default is sharedata)
+ * @param algorithm the algorithm to use (default is ES512)
+ * @param expiresIn the expiration time of the token (default is 1 hour)
+ * @param notBefore the not before time of the token (default is 0)
+ * @param keyid A unique identifier for the key used to sign the token. This can be used to prevent replay attacks. (optional)
+ * @param header An object containing additional header properties to include in the token. (optional)
+ * @returns
+ */
+const createJwtOptions = (subject, // the subject of the token
+audience = authorization_models_1.AuthorizationAudience.SHAREDATA, // audience
+algorithm = authorization_settings_1.AuthorizationSettings.JWT.Algorithm, // ECDSA using P-521 curve and SHA-512 hash algorithm
+expiresIn = authorization_settings_1.AuthorizationSettings.JWT.ExpiresInDefault, // Default expiration time
+notBefore = authorization_settings_1.AuthorizationSettings.JWT.NotBeforeDefault, // Default not before time
+keyid, // A unique identifier for the key used to sign the token. This can be used to prevent replay attacks.
+header) => {
+    const jwtOptions = {
+        subject,
+        audience,
+        algorithm,
+        expiresIn,
+        notBefore,
+        mutatePayload: authorization_settings_1.AuthorizationSettings.JWT.MutatePayload, // If true, the payload object will be mutated with the standard claims (iat, exp, etc.). Default is false.
+        noTimestamp: authorization_settings_1.AuthorizationSettings.JWT.NoTimestamp, // If true, the iat (issued at) claim will not be included in the token.
+        encoding: authorization_settings_1.AuthorizationSettings.JWT.EncodingDefault, // The encoding to use when converting the payload to a string.
+        allowInsecureKeySizes: authorization_settings_1.AuthorizationSettings.JWT.AllowInsecureKeySizes, // If true, allows the use of insecure key sizes.
+        allowInvalidAsymmetricKeyTypes: authorization_settings_1.AuthorizationSettings.JWT.AllowInvalidAsymmetricKeyTypes, // If true, allows the use of invalid asymmetric key types.
+    };
+    if (keyid)
+        jwtOptions.keyid = keyid;
+    if (header)
+        jwtOptions.header = header;
+    return jwtOptions;
+};
+exports.createJwtOptions = createJwtOptions;

package/dist/generic/src/authorization/jwt/sign/create-jwt-signed-token.d.ts

@@ -0,0 +1,13 @@
+import { IAuthorizationPayload } from '../../../models/authorization/authorization-models';
+import jwt from 'jsonwebtoken';
+/**
+ * This creates a signed JWT token with the given payload and secret key.
+ *
+ * @param payload the payload to sign
+ * @param secretKey the secret key to sign the token with
+ * @param options the options for the signed jwt token
+ * @returns
+ */
+declare const createJWTSignedToken: (payload: IAuthorizationPayload, secretKey: string, options: jwt.SignOptions) => string;
+export { createJWTSignedToken };
+//# sourceMappingURL=create-jwt-signed-token.d.ts.map

package/dist/generic/src/authorization/jwt/sign/create-jwt-signed-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-jwt-signed-token.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/jwt/sign/create-jwt-signed-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,qBAAqB,EACxB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,GAAG,MAAM,cAAc,CAAC;AAG/B;;;;;;;GAOG;AACH,QAAA,MAAM,oBAAoB,YACb,qBAAqB,aACnB,MAAM,WACR,GAAG,CAAC,WAAW,KACzB,MAIF,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/generic/src/authorization/jwt/sign/create-jwt-signed-token.js

@@ -0,0 +1,22 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJWTSignedToken = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const create_secret_key_pem_1 = require("../keys/create-secret-key-pem");
+/**
+ * This creates a signed JWT token with the given payload and secret key.
+ *
+ * @param payload the payload to sign
+ * @param secretKey the secret key to sign the token with
+ * @param options the options for the signed jwt token
+ * @returns
+ */
+const createJWTSignedToken = (payload, secretKey, options) => {
+    const jwtKey = (0, create_secret_key_pem_1.createSecretKeyPem)(secretKey);
+    const jwtToken = jsonwebtoken_1.default.sign(payload, jwtKey, options);
+    return jwtToken;
+};
+exports.createJWTSignedToken = createJWTSignedToken;

package/dist/generic/src/authorization/jwt/transform/transform-token-payload-to-safe-payload.d.ts

@@ -0,0 +1,10 @@
+import { IDecodedJwtToken, IValidSafeTokenPayload } from '../../../models/authorization/authorization-models';
+/**
+ * This function transforms the token payload to a safe payload with custom claims (if any).
+ *
+ * @param payload the payload to transform
+ * @returns the safe payload
+ */
+declare const transformTokenPayloadToSafePayload: (payload: IValidSafeTokenPayload) => IDecodedJwtToken;
+export { transformTokenPayloadToSafePayload };
+//# sourceMappingURL=transform-token-payload-to-safe-payload.d.ts.map

package/dist/generic/src/authorization/jwt/transform/transform-token-payload-to-safe-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform-token-payload-to-safe-payload.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/jwt/transform/transform-token-payload-to-safe-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,oDAAoD,CAAC;AAE9G;;;;;GAKG;AACH,QAAA,MAAM,kCAAkC,YAAa,sBAAsB,KAAG,gBAuB7E,CAAC;AAEF,OAAO,EAAE,kCAAkC,EAAE,CAAC"}

package/dist/generic/src/authorization/jwt/transform/transform-token-payload-to-safe-payload.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transformTokenPayloadToSafePayload = void 0;
+/**
+ * This function transforms the token payload to a safe payload with custom claims (if any).
+ *
+ * @param payload the payload to transform
+ * @returns the safe payload
+ */
+const transformTokenPayloadToSafePayload = (payload) => {
+    // get any other properties from the payload other than the default ones
+    const otherProperties = Object.keys(payload).reduce((acc, key) => {
+        if (!['iat', 'nbf', 'exp', 'sub', 'aud', 'iss'].includes(key)) {
+            acc[key] = payload[key];
+        }
+        return acc;
+    }, {});
+    const safePayload = {
+        iat: payload.iat,
+        nbf: payload.nbf,
+        exp: payload.exp,
+        sub: payload.sub,
+        aud: payload.aud,
+        iss: payload.iss,
+    };
+    if (Object.keys(otherProperties).length > 0) {
+        safePayload.customClaims = otherProperties;
+    }
+    return safePayload;
+};
+exports.transformTokenPayloadToSafePayload = transformTokenPayloadToSafePayload;

package/dist/generic/src/authorization/jwt/verify/get-decoded-jwt-header.d.ts

@@ -0,0 +1,10 @@
+import { IAuthorizationHeader } from '../../../models/authorization/authorization-models';
+/**
+ * This function gets the decoded jwt header from the token.
+ *
+ * @param token the token to get the header from.
+ * @returns
+ */
+declare const getDecodedJwtHeader: (token: string) => IAuthorizationHeader;
+export { getDecodedJwtHeader };
+//# sourceMappingURL=get-decoded-jwt-header.d.ts.map

package/dist/generic/src/authorization/jwt/verify/get-decoded-jwt-header.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-decoded-jwt-header.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/jwt/verify/get-decoded-jwt-header.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAE1F;;;;;GAKG;AACH,QAAA,MAAM,mBAAmB,UAAW,MAAM,KAAG,oBAU5C,CAAC;AAEF,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/generic/src/authorization/jwt/verify/get-decoded-jwt-header.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDecodedJwtHeader = void 0;
+const authorization_errors_1 = require("../../../errors/authorization/authorization-errors");
+/**
+ * This function gets the decoded jwt header from the token.
+ *
+ * @param token the token to get the header from.
+ * @returns
+ */
+const getDecodedJwtHeader = (token) => {
+    // break the token apart
+    const jwtTokenParts = token.split('.');
+    if (jwtTokenParts.length !== 3) {
+        throw new authorization_errors_1.SafeAuthorizationTokenNotBase64Error();
+    }
+    const header = JSON.parse(Buffer.from(jwtTokenParts[0], 'base64').toString('utf-8'));
+    return header;
+};
+exports.getDecodedJwtHeader = getDecodedJwtHeader;

package/dist/generic/src/authorization/jwt/verify/get-decoded-jwt-signed-token-payload.d.ts

@@ -0,0 +1,9 @@
+import { JwtPayload } from 'jsonwebtoken';
+/**
+ * This function gets the decoded payload from a signed JWT token.
+ *
+ * @param token the token to get the payload from
+ */
+declare const getDecodedJwtSignedTokenPayload: (token: string) => JwtPayload | null | string;
+export { getDecodedJwtSignedTokenPayload };
+//# sourceMappingURL=get-decoded-jwt-signed-token-payload.d.ts.map

package/dist/generic/src/authorization/jwt/verify/get-decoded-jwt-signed-token-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-decoded-jwt-signed-token-payload.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/jwt/verify/get-decoded-jwt-signed-token-payload.ts"],"names":[],"mappings":"AAAA,OAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;GAIG;AACH,QAAA,MAAM,+BAA+B,UAAW,MAAM,KAAG,UAAU,GAAG,IAAI,GAAG,MAG5E,CAAC;AAEF,OAAO,EAAE,+BAA+B,EAAE,CAAC"}

package/dist/generic/src/authorization/jwt/verify/get-decoded-jwt-signed-token-payload.js

@@ -0,0 +1,17 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDecodedJwtSignedTokenPayload = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+/**
+ * This function gets the decoded payload from a signed JWT token.
+ *
+ * @param token the token to get the payload from
+ */
+const getDecodedJwtSignedTokenPayload = (token) => {
+    const payload = jsonwebtoken_1.default.decode(token);
+    return payload;
+};
+exports.getDecodedJwtSignedTokenPayload = getDecodedJwtSignedTokenPayload;

package/dist/generic/src/authorization/jwt/verify/verify-jwt-signed-token.d.ts

@@ -0,0 +1,12 @@
+import jwt from 'jsonwebtoken';
+/**
+ * This verifies a JWT signed token with the given secret key or public key.
+ *
+ * @param tokenToVerify the jwt token to verify
+ * @param secretKey the secret key to verify the token with
+ * @param publicKey the public key to verify the token with
+ * @returns
+ */
+declare const verifyJwtSignedToken: (tokenToVerify: string, secretKey?: string, publicKey?: string) => string | jwt.JwtPayload;
+export { verifyJwtSignedToken };
+//# sourceMappingURL=verify-jwt-signed-token.d.ts.map

package/dist/generic/src/authorization/jwt/verify/verify-jwt-signed-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-jwt-signed-token.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/jwt/verify/verify-jwt-signed-token.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAQ/B;;;;;;;GAOG;AACH,QAAA,MAAM,oBAAoB,kBACP,MAAM,cACT,MAAM,cACN,MAAM,KACnB,MAAM,GAAG,GAAG,CAAC,UAgBf,CAAC;AAEF,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/generic/src/authorization/jwt/verify/verify-jwt-signed-token.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyJwtSignedToken = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const authorization_errors_1 = require("../../../errors/authorization/authorization-errors");
+const create_public_key_pem_1 = require("../keys/create-public-key-pem");
+const create_secret_key_pem_1 = require("../keys/create-secret-key-pem");
+/**
+ * This verifies a JWT signed token with the given secret key or public key.
+ *
+ * @param tokenToVerify the jwt token to verify
+ * @param secretKey the secret key to verify the token with
+ * @param publicKey the public key to verify the token with
+ * @returns
+ */
+const verifyJwtSignedToken = (tokenToVerify, secretKey, publicKey) => {
+    // break the token apart
+    const jwtTokenParts = tokenToVerify.split('.');
+    if (jwtTokenParts.length !== 3) {
+        throw new authorization_errors_1.SafeAuthorizationTokenNotBase64Error();
+    }
+    if (!secretKey && !publicKey) {
+        throw new authorization_errors_1.SafeAuthorizationKeyNotIncludedForVerificationError();
+    }
+    // create the key
+    const jwtKey = (secretKey) ? (0, create_secret_key_pem_1.createSecretKeyPem)(secretKey) : (0, create_public_key_pem_1.createPublicKeyPem)(publicKey);
+    // verify the token
+    const payload = jsonwebtoken_1.default.verify(tokenToVerify, jwtKey);
+    return payload;
+};
+exports.verifyJwtSignedToken = verifyJwtSignedToken;

package/dist/generic/src/authorization/safe/authorization/authorized-authorities.d.ts

@@ -0,0 +1,42 @@
+import { AuthorizationAudience, IAuthorizationIssuer } from '../../../models/authorization/authorization-models';
+/**
+ * This class is used to keep and maintain the authorized authorities in the SAFE system.
+ */
+export declare class AuthorizedAuthorities {
+    private _authorizedJWTAuthorities;
+    private _currentJWTAuthoritiesHash;
+    constructor();
+    /**
+    * This adds a JWT authority to the authorized authorities for the given audience.
+    *
+    * @param audience the audience the authority is for
+    * @param authorizationIssuer the authority to add
+    * @param publicKey the public key
+    */
+    addAuthorizedJWTAuthority(audience: AuthorizationAudience, authorizationIssuer: IAuthorizationIssuer, publicKey: string): void;
+    /**
+     * This removes a JWT authority from the authorized authorities for the given audience.
+     *
+     * @param authority the authority to remove
+     */
+    removeAuthorizedJWTAuthority(audience: AuthorizationAudience, authority: IAuthorizationIssuer): void;
+    /**
+     * This gets the public key for the given authority for the given audience.
+     *
+     * @param authority the authority to get the public key for
+     * @returns
+     */
+    getAuthorizedJWTAuthorityPublicKey(audience: AuthorizationAudience, authority: IAuthorizationIssuer): string | undefined;
+    /**
+     * this gets the authorized JWT authorities for the given audience.
+     * @param audience the audience to get the authorized authorities for
+     * @returns
+     */
+    getAuthorizedJWTAuthorities(audience: AuthorizationAudience): Map<IAuthorizationIssuer, string>;
+    /**
+     * This gets the number of authorized JWT providers for the given audience.
+     * @returns
+     */
+    getAuthorizedJWTAuthoritiesCount(audience: AuthorizationAudience): number;
+}
+//# sourceMappingURL=authorized-authorities.d.ts.map

package/dist/generic/src/authorization/safe/authorization/authorized-authorities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-authorities.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/safe/authorization/authorized-authorities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAiB,MAAM,oDAAoD,CAAC;AAEhI;;GAEG;AACH,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,yBAAyB,CAAgE;IAEjG,OAAO,CAAC,0BAA0B,CAAqC;;IAYtE;;;;;;MAME;IACI,yBAAyB,CAC5B,QAAQ,EAAE,qBAAqB,EAC/B,mBAAmB,EAAE,oBAAoB,EACzC,SAAS,EAAE,MAAM,GAClB,IAAI;IAKP;;;;OAIG;IACI,4BAA4B,CAAC,QAAQ,EAAE,qBAAqB,EAAE,SAAS,EAAE,oBAAoB,GAAG,IAAI;IAO3G;;;;;OAKG;IACI,kCAAkC,CAAC,QAAQ,EAAE,qBAAqB,EAAE,SAAS,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS;IAI/H;;;;OAIG;IACI,2BAA2B,CAAC,QAAQ,EAAE,qBAAqB,GAAG,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAItG;;;OAGG;IACI,gCAAgC,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM;CAGnF"}

package/dist/generic/src/authorization/safe/authorization/authorized-authorities.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizedAuthorities = void 0;
+const authorization_errors_1 = require("../../../errors/authorization/authorization-errors");
+const authorization_models_1 = require("../../../models/authorization/authorization-models");
+/**
+ * This class is used to keep and maintain the authorized authorities in the SAFE system.
+ */
+class AuthorizedAuthorities {
+    constructor() {
+        this._authorizedJWTAuthorities = new Map();
+        this._currentJWTAuthoritiesHash = new Map();
+        Object.values(authorization_models_1.AuthorizationAudience).forEach(audience => {
+            this._authorizedJWTAuthorities.set(audience, new Map());
+            this._currentJWTAuthoritiesHash.set(audience, '');
+        });
+    }
+    /**
+    * This adds a JWT authority to the authorized authorities for the given audience.
+    *
+    * @param audience the audience the authority is for
+    * @param authorizationIssuer the authority to add
+    * @param publicKey the public key
+    */
+    addAuthorizedJWTAuthority(audience, authorizationIssuer, publicKey) {
+        const audienceMap = this._authorizedJWTAuthorities.get(audience);
+        audienceMap?.set(authorizationIssuer, publicKey);
+    }
+    /**
+     * This removes a JWT authority from the authorized authorities for the given audience.
+     *
+     * @param authority the authority to remove
+     */
+    removeAuthorizedJWTAuthority(audience, authority) {
+        const removed = this._authorizedJWTAuthorities.get(audience)?.delete(authority);
+        if (!removed) {
+            throw new authorization_errors_1.SafeAuthorizationIssuerDoesNotExistError(authority);
+        }
+    }
+    /**
+     * This gets the public key for the given authority for the given audience.
+     *
+     * @param authority the authority to get the public key for
+     * @returns
+     */
+    getAuthorizedJWTAuthorityPublicKey(audience, authority) {
+        return this._authorizedJWTAuthorities.get(audience)?.get(authority);
+    }
+    /**
+     * this gets the authorized JWT authorities for the given audience.
+     * @param audience the audience to get the authorized authorities for
+     * @returns
+     */
+    getAuthorizedJWTAuthorities(audience) {
+        return this._authorizedJWTAuthorities.get(audience) || new Map();
+    }
+    /**
+     * This gets the number of authorized JWT providers for the given audience.
+     * @returns
+     */
+    getAuthorizedJWTAuthoritiesCount(audience) {
+        return this._authorizedJWTAuthorities.get(audience)?.size || 0;
+    }
+}
+exports.AuthorizedAuthorities = AuthorizedAuthorities;

package/dist/generic/src/authorization/safe/request/decode-bearer-token.d.ts

@@ -0,0 +1,11 @@
+import { IDecodedJwtToken } from '../../../models/authorization/authorization-models';
+/**
+ * This function decodes the bearer token and verifies the issuer is as expected.
+ *
+ * @param bearerToken the bearer token to decode
+ * @param verificationKey the key to verify the token with
+ * @param issuerExpected the expected issuer of the token
+ */
+declare const decodeBearerToken: (bearerToken: string, verificationKey: string, issuerExpected: string) => IDecodedJwtToken;
+export { decodeBearerToken };
+//# sourceMappingURL=decode-bearer-token.d.ts.map

package/dist/generic/src/authorization/safe/request/decode-bearer-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode-bearer-token.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/safe/request/decode-bearer-token.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAC;AAKtF;;;;;;GAMG;AACH,QAAA,MAAM,iBAAiB,gBAAiB,MAAM,mBAAmB,MAAM,kBAAkB,MAAM,KAAG,gBAkBjG,CAAC;AAEF,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/generic/src/authorization/safe/request/decode-bearer-token.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeBearerToken = void 0;
+const authorization_errors_1 = require("../../../errors/authorization/authorization-errors");
+const transform_token_payload_to_safe_payload_1 = require("../../jwt/transform/transform-token-payload-to-safe-payload");
+const verify_jwt_signed_token_1 = require("../../jwt/verify/verify-jwt-signed-token");
+const verify_token_payload_1 = require("../validation/jwt/verify-token-payload");
+/**
+ * This function decodes the bearer token and verifies the issuer is as expected.
+ *
+ * @param bearerToken the bearer token to decode
+ * @param verificationKey the key to verify the token with
+ * @param issuerExpected the expected issuer of the token
+ */
+const decodeBearerToken = (bearerToken, verificationKey, issuerExpected) => {
+    const decodedToken = (0, verify_jwt_signed_token_1.verifyJwtSignedToken)(bearerToken, verificationKey);
+    if (!decodedToken || typeof decodedToken === 'string') {
+        throw new authorization_errors_1.SafeAuthorizationTokenNotObjectError();
+    }
+    if (issuerExpected !== decodedToken.iss) {
+        throw new authorization_errors_1.SafeAuthorizationIssuerNotMatchingExpectedError(issuerExpected, decodedToken.iss.toString());
+    }
+    // validate the token payload
+    if (!(0, verify_token_payload_1.verifyTokenPayload)(decodedToken)) {
+        throw new authorization_errors_1.SafeAuthorizationPayloadNotValidError();
+    }
+    // transform the token payload to a safe payload
+    const decodedTokenPayload = (0, transform_token_payload_to_safe_payload_1.transformTokenPayloadToSafePayload)(decodedToken);
+    return decodedTokenPayload;
+};
+exports.decodeBearerToken = decodeBearerToken;

package/dist/generic/src/authorization/safe/request/decode-safe-request.d.ts

@@ -0,0 +1,11 @@
+import { IDecodedJwtToken } from '../../../models/authorization/authorization-models';
+/**
+ * This function decodes the safe request and returns the decoded token.
+ * This will throw an error if the request is not authorized.
+ *
+ * @param req the request to ensure authorization exists on.
+ * @returns
+ */
+declare const decodeSafeRequest: (req: any, verificationKey: string, issuerExpected: string) => IDecodedJwtToken;
+export { decodeSafeRequest };
+//# sourceMappingURL=decode-safe-request.d.ts.map

package/dist/generic/src/authorization/safe/request/decode-safe-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode-safe-request.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/safe/request/decode-safe-request.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oDAAoD,CAAC;AAEtF;;;;;;GAMG;AACH,QAAA,MAAM,iBAAiB,QAAS,GAAG,mBAAmB,MAAM,kBAAkB,MAAM,KAAG,gBAatF,CAAC;AAEF,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/generic/src/authorization/safe/request/decode-safe-request.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeSafeRequest = void 0;
+const authorization_errors_1 = require("../../../errors/authorization/authorization-errors");
+const decode_bearer_token_1 = require("./decode-bearer-token");
+/**
+ * This function decodes the safe request and returns the decoded token.
+ * This will throw an error if the request is not authorized.
+ *
+ * @param req the request to ensure authorization exists on.
+ * @returns
+ */
+const decodeSafeRequest = (req, verificationKey, issuerExpected) => {
+    if (!req.headers)
+        throw new authorization_errors_1.SafeRequestAuthorizationHeadersNotFound();
+    if (!req.headers.authorization)
+        throw new authorization_errors_1.SafeRequestAuthorizationHeaderNotFound();
+    if (typeof req.headers.authorization === 'string' && req.headers.authorization.startsWith('Bearer ')) {
+        const bearerToken = req.headers.authorization.split('Bearer ')[1];
+        if (!bearerToken) {
+            throw new authorization_errors_1.SafeAuthorizationBearerTokenNotFound();
+        }
+        const decodedToken = (0, decode_bearer_token_1.decodeBearerToken)(bearerToken, verificationKey, issuerExpected);
+        return decodedToken;
+    }
+    else {
+        throw new authorization_errors_1.SafeAuthorizationBearerTokenNotFound();
+    }
+};
+exports.decodeSafeRequest = decodeSafeRequest;

package/dist/generic/src/authorization/safe/request/determine-issuer-from-request.d.ts

@@ -0,0 +1,10 @@
+import { IAuthorizationIssuer } from '../../../models/authorization/authorization-models';
+/**
+ * This function determines the issuer from the request.
+ *
+ * @param req the request to determine the issuer from
+ * @returns
+ */
+declare const determineIssuerFromRequest: (req: any) => IAuthorizationIssuer;
+export { determineIssuerFromRequest };
+//# sourceMappingURL=determine-issuer-from-request.d.ts.map

package/dist/generic/src/authorization/safe/request/determine-issuer-from-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"determine-issuer-from-request.d.ts","sourceRoot":"","sources":["../../../../../../../generic/src/authorization/safe/request/determine-issuer-from-request.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAG1F;;;;;GAKG;AACH,QAAA,MAAM,0BAA0B,QAAS,GAAG,KAAG,oBAa9C,CAAA;AAED,OAAO,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/generic/src/authorization/safe/request/determine-issuer-from-request.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.determineIssuerFromRequest = void 0;
+const authorization_errors_1 = require("../../../errors/authorization/authorization-errors");
+const determine_issuer_from_bearer_token_1 = require("./issuer/determine-issuer-from-bearer-token");
+/**
+ * This function determines the issuer from the request.
+ *
+ * @param req the request to determine the issuer from
+ * @returns
+ */
+const determineIssuerFromRequest = (req) => {
+    if (!req.headers)
+        throw new authorization_errors_1.SafeRequestAuthorizationHeadersNotFound();
+    if (!req.headers.authorization)
+        throw new authorization_errors_1.SafeRequestAuthorizationHeaderNotFound();
+    if (typeof req.headers.authorization === 'string' && req.headers.authorization.startsWith('Bearer ')) {
+        const bearerToken = req.headers.authorization.split('Bearer ')[1];
+        if (!bearerToken) {
+            throw new authorization_errors_1.SafeAuthorizationBearerTokenNotFound();
+        }
+        const issuer = (0, determine_issuer_from_bearer_token_1.determineIssuerFromBearerToken)(bearerToken);
+        return issuer;
+    }
+    else {
+        throw new authorization_errors_1.SafeAuthorizationBearerTokenNotFound();
+    }
+};
+exports.determineIssuerFromRequest = determineIssuerFromRequest;

package/dist/generic/src/authorization/safe/request/issuer/determine-issuer-from-bearer-token.d.ts

@@ -0,0 +1,12 @@
+import { IAuthorizationIssuer } from '../../../../models/authorization/authorization-models';
+/**
+ * This function determines the issuer from the bearer token (if it exists).
+ * doesn't validate the signature of the token, just that the shape is correct and
+ * can be used to determine the signature to use to validate the token.
+ *
+ * @param bearerToken the bearer token to determine the issuer from
+ * @returns
+ */
+declare const determineIssuerFromBearerToken: (bearerToken: string) => IAuthorizationIssuer;
+export { determineIssuerFromBearerToken };
+//# sourceMappingURL=determine-issuer-from-bearer-token.d.ts.map

package/dist/generic/src/authorization/safe/request/issuer/determine-issuer-from-bearer-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"determine-issuer-from-bearer-token.d.ts","sourceRoot":"","sources":["../../../../../../../../generic/src/authorization/safe/request/issuer/determine-issuer-from-bearer-token.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uDAAuD,CAAC;AAI7F;;;;;;;GAOG;AACH,QAAA,MAAM,8BAA8B,gBAAiB,MAAM,KAAG,oBAiB7D,CAAC;AAEF,OAAO,EAAE,8BAA8B,EAAE,CAAC"}

package/dist/generic/src/authorization/safe/request/issuer/determine-issuer-from-bearer-token.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.determineIssuerFromBearerToken = void 0;
+const authorization_errors_1 = require("../../../../errors/authorization/authorization-errors");
+const get_decoded_jwt_signed_token_payload_1 = require("../../../jwt/verify/get-decoded-jwt-signed-token-payload");
+const verify_authorization_issuer_1 = require("../../validation/jwt/payload/verify-authorization-issuer");
+/**
+ * This function determines the issuer from the bearer token (if it exists).
+ * doesn't validate the signature of the token, just that the shape is correct and
+ * can be used to determine the signature to use to validate the token.
+ *
+ * @param bearerToken the bearer token to determine the issuer from
+ * @returns
+ */
+const determineIssuerFromBearerToken = (bearerToken) => {
+    const decodedToken = (0, get_decoded_jwt_signed_token_payload_1.getDecodedJwtSignedTokenPayload)(bearerToken); // get the payload from the token
+    if (decodedToken === null || typeof decodedToken === 'string') {
+        throw new authorization_errors_1.SafeAuthorizationTokenNotObjectError();
+    }
+    // make sure the iss property exists
+    if (!decodedToken.iss) {
+        throw new authorization_errors_1.SafeAuthorizationTokenPropertyDataTypeNotValidError('iss', decodedToken.iss, 'string');
+    }
+    // make sure the type is an issuer
+    if (!(0, verify_authorization_issuer_1.verifyAuthorizationIssuer)(decodedToken.iss)) {
+        throw new authorization_errors_1.SafeAuthorizationIssuerNotValidError(decodedToken.iss);
+    }
+    return decodedToken.iss;
+};
+exports.determineIssuerFromBearerToken = determineIssuerFromBearerToken;

package/dist/generic/src/authorization/safe/validation/jwt/payload/verify-authorization-audience.d.ts

@@ -0,0 +1,10 @@
+import { AuthorizationAudience } from '../../../../../models/authorization/authorization-models';
+/**
+ * This verifiies the audience of the token
+ *
+ * @param aud the audience to verify
+ * @returns
+ */
+declare const verifyAuthorizationAudience: (aud: unknown) => aud is AuthorizationAudience;
+export { verifyAuthorizationAudience };
+//# sourceMappingURL=verify-authorization-audience.d.ts.map

package/dist/generic/src/authorization/safe/validation/jwt/payload/verify-authorization-audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-authorization-audience.d.ts","sourceRoot":"","sources":["../../../../../../../../../generic/src/authorization/safe/validation/jwt/payload/verify-authorization-audience.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAEjG;;;;;GAKG;AACH,QAAA,MAAM,2BAA2B,QAAS,OAAO,KAAG,GAAG,IAAI,qBAc1D,CAAA;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAC"}

package/dist/generic/src/authorization/safe/validation/jwt/payload/verify-authorization-audience.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAuthorizationAudience = void 0;
+const authorization_errors_1 = require("../../../../../errors/authorization/authorization-errors");
+const authorization_models_1 = require("../../../../../models/authorization/authorization-models");
+/**
+ * This verifiies the audience of the token
+ *
+ * @param aud the audience to verify
+ * @returns
+ */
+const verifyAuthorizationAudience = (aud) => {
+    if (!aud) {
+        throw new authorization_errors_1.SafeAuthorizationMissingPropertyError('aud');
+    }
+    if (typeof aud !== 'string') {
+        throw new authorization_errors_1.SafeAuthorizationTokenPropertyDataTypeNotValidError('aud', aud, 'string');
+    }
+    if (!Object.values(authorization_models_1.AuthorizationAudience).includes(aud)) {
+        throw new authorization_errors_1.SafeAuthorizationPayloadNotValidError();
+    }
+    return true;
+};
+exports.verifyAuthorizationAudience = verifyAuthorizationAudience;

package/dist/generic/src/authorization/safe/validation/jwt/payload/verify-authorization-expiration-time.d.ts

@@ -0,0 +1,8 @@
+/**
+ * this function validates the expiration time of the token hasn't passed
+ *
+ * @param exp the expiration time of the token
+ */
+declare const verifyAuthorizationExpirationTime: (exp: unknown) => exp is number;
+export { verifyAuthorizationExpirationTime };
+//# sourceMappingURL=verify-authorization-expiration-time.d.ts.map

package/dist/generic/src/authorization/safe/validation/jwt/payload/verify-authorization-expiration-time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-authorization-expiration-time.d.ts","sourceRoot":"","sources":["../../../../../../../../../generic/src/authorization/safe/validation/jwt/payload/verify-authorization-expiration-time.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,QAAA,MAAM,iCAAiC,QAAS,OAAO,KAAG,GAAG,IAAI,MAchE,CAAC;AAEF,OAAO,EAAE,iCAAiC,EAAE,CAAC"}