@elysiajs/jwt 1.3.1 → 1.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -5
- package/dist/cjs/index.d.ts +113 -27
- package/dist/cjs/index.js +56 -34
- package/dist/index.d.ts +113 -27
- package/dist/index.mjs +61 -35
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# @elysiajs/
|
|
1
|
+
# @elysiajs/jwt
|
|
2
2
|
|
|
3
3
|
Plugin for [Elysia](https://github.com/elysiajs/elysia) for using JWT Authentication.
|
|
4
4
|
|
|
@@ -13,7 +13,6 @@ bun add @elysiajs/jwt
|
|
|
13
13
|
```typescript
|
|
14
14
|
import { Elysia, t } from 'elysia';
|
|
15
15
|
import { jwt } from '@elysiajs/jwt';
|
|
16
|
-
import { cookie } from '@elysiajs/cookie';
|
|
17
16
|
|
|
18
17
|
const app = new Elysia()
|
|
19
18
|
.use(
|
|
@@ -23,9 +22,9 @@ const app = new Elysia()
|
|
|
23
22
|
secret: 'MY_SECRETS',
|
|
24
23
|
})
|
|
25
24
|
)
|
|
26
|
-
.
|
|
27
|
-
|
|
28
|
-
|
|
25
|
+
.get('/sign/:name', async ({ jwt, cookie: { auth }, params }) => {
|
|
26
|
+
auth.set({
|
|
27
|
+
value: await jwt.sign(params),
|
|
29
28
|
httpOnly: true,
|
|
30
29
|
});
|
|
31
30
|
|
package/dist/cjs/index.d.ts
CHANGED
|
@@ -1,17 +1,121 @@
|
|
|
1
|
-
import { Elysia } from 'elysia';
|
|
2
|
-
import { type
|
|
3
|
-
import type { Static, TSchema } from '@sinclair/typebox';
|
|
1
|
+
import { Elysia, type TSchema, type UnwrapSchema as Static } from 'elysia';
|
|
2
|
+
import { type CryptoKey, type JWK, type KeyObject, type JoseHeaderParameters, type JWTVerifyOptions } from 'jose';
|
|
4
3
|
type UnwrapSchema<Schema extends TSchema | undefined, Fallback = unknown> = Schema extends TSchema ? Static<NonNullable<Schema>> : Fallback;
|
|
4
|
+
type NormalizedClaim = 'nbf' | 'exp' | 'iat';
|
|
5
|
+
type AllowClaimValue = string | number | boolean | null | undefined | AllowClaimValue[] | {
|
|
6
|
+
[key: string]: AllowClaimValue;
|
|
7
|
+
};
|
|
8
|
+
type ClaimType = Record<string, AllowClaimValue>;
|
|
9
|
+
/**
|
|
10
|
+
* This interface is a specific, strongly-typed representation of the
|
|
11
|
+
* standard claims found in a JWT payload.
|
|
12
|
+
*
|
|
13
|
+
* It is re-declared here to override potentially generic definitions from
|
|
14
|
+
* third-party libraries, ensuring the compiler knows every expected field.
|
|
15
|
+
*
|
|
16
|
+
* This interface can be modified as needed within the plugin to easily
|
|
17
|
+
* accommodate custom claims for specific use cases.
|
|
18
|
+
*/
|
|
5
19
|
export interface JWTPayloadSpec {
|
|
20
|
+
/**
|
|
21
|
+
* JWT Issuer
|
|
22
|
+
*
|
|
23
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1 RFC7519#section-4.1.1}
|
|
24
|
+
*/
|
|
6
25
|
iss?: string;
|
|
26
|
+
/**
|
|
27
|
+
* JWT Subject
|
|
28
|
+
*
|
|
29
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.2 RFC7519#section-4.1.2}
|
|
30
|
+
*/
|
|
7
31
|
sub?: string;
|
|
32
|
+
/**
|
|
33
|
+
* JWT Audience
|
|
34
|
+
*
|
|
35
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3 RFC7519#section-4.1.3}
|
|
36
|
+
*/
|
|
8
37
|
aud?: string | string[];
|
|
38
|
+
/**
|
|
39
|
+
* JWT ID
|
|
40
|
+
*
|
|
41
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.7 RFC7519#section-4.1.7}
|
|
42
|
+
*/
|
|
9
43
|
jti?: string;
|
|
44
|
+
/**
|
|
45
|
+
* JWT Not Before
|
|
46
|
+
*
|
|
47
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5 RFC7519#section-4.1.5}
|
|
48
|
+
*/
|
|
10
49
|
nbf?: number;
|
|
50
|
+
/**
|
|
51
|
+
* JWT Expiration Time
|
|
52
|
+
*
|
|
53
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4 RFC7519#section-4.1.4}
|
|
54
|
+
*/
|
|
11
55
|
exp?: number;
|
|
56
|
+
/**
|
|
57
|
+
* JWT Issued At
|
|
58
|
+
*
|
|
59
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}
|
|
60
|
+
*/
|
|
12
61
|
iat?: number;
|
|
13
62
|
}
|
|
14
|
-
|
|
63
|
+
/**
|
|
64
|
+
* This interface defines the shape of JWT payload fields that can be
|
|
65
|
+
* provided as input when creating or signing a token.
|
|
66
|
+
*
|
|
67
|
+
* Unlike `JWTPayloadSpec`, values here may be expressed in more flexible forms,
|
|
68
|
+
* such as relative time strings or control flags (e.g., `iat: true`).
|
|
69
|
+
*
|
|
70
|
+
* This interface is parsed and normalized by the plugin before becoming part
|
|
71
|
+
* of the final JWT payload.
|
|
72
|
+
*/
|
|
73
|
+
export interface JWTPayloadInput extends Omit<JWTPayloadSpec, NormalizedClaim> {
|
|
74
|
+
/**
|
|
75
|
+
* JWT Not Before
|
|
76
|
+
*
|
|
77
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5 RFC7519#section-4.1.5}
|
|
78
|
+
*/
|
|
79
|
+
nbf?: string | number;
|
|
80
|
+
/**
|
|
81
|
+
* JWT Expiration Time
|
|
82
|
+
*
|
|
83
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4 RFC7519#section-4.1.4}
|
|
84
|
+
*/
|
|
85
|
+
exp?: string | number;
|
|
86
|
+
/**
|
|
87
|
+
* JWT Issued At
|
|
88
|
+
*
|
|
89
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}
|
|
90
|
+
*/
|
|
91
|
+
iat?: boolean;
|
|
92
|
+
}
|
|
93
|
+
/**
|
|
94
|
+
* Defines the types for the header parameters of a JWS.
|
|
95
|
+
*
|
|
96
|
+
* Much like `JWTPayloadSpec`, this interface is declared to provide strong,
|
|
97
|
+
* explicit typing, allowing TypeScript to validate the header's structure
|
|
98
|
+
* and provide accurate autocompletion.
|
|
99
|
+
*
|
|
100
|
+
* It can also be modified within the plugin to handle custom header
|
|
101
|
+
* parameters required for specific development scenarios.
|
|
102
|
+
*/
|
|
103
|
+
export interface JWTHeaderParameters extends JoseHeaderParameters {
|
|
104
|
+
/**
|
|
105
|
+
* JWS "alg" (Algorithm) Header Parameter
|
|
106
|
+
*
|
|
107
|
+
* @see {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}
|
|
108
|
+
*/
|
|
109
|
+
alg?: string;
|
|
110
|
+
/**
|
|
111
|
+
* This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
|
|
112
|
+
* Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
|
|
113
|
+
*/
|
|
114
|
+
b64?: true;
|
|
115
|
+
/** JWS "crit" (Critical) Header Parameter */
|
|
116
|
+
crit?: string[];
|
|
117
|
+
}
|
|
118
|
+
export interface JWTOption<Name extends string | undefined = 'jwt', Schema extends TSchema | undefined = undefined> extends JWTHeaderParameters, JWTPayloadInput {
|
|
15
119
|
/**
|
|
16
120
|
* Name to decorate method as
|
|
17
121
|
*
|
|
@@ -39,32 +143,14 @@ export interface JWTOption<Name extends string | undefined = 'jwt', Schema exten
|
|
|
39
143
|
* Type strict validation for JWT payload
|
|
40
144
|
*/
|
|
41
145
|
schema?: Schema;
|
|
42
|
-
/**
|
|
43
|
-
* JWT Not Before
|
|
44
|
-
*
|
|
45
|
-
* @see [RFC7519#section-4.1.5](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5)
|
|
46
|
-
*/
|
|
47
|
-
nbf?: string | number;
|
|
48
|
-
/**
|
|
49
|
-
* JWT Expiration Time
|
|
50
|
-
*
|
|
51
|
-
* @see [RFC7519#section-4.1.4](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4)
|
|
52
|
-
*/
|
|
53
|
-
exp?: string | number;
|
|
54
146
|
}
|
|
55
|
-
export declare const jwt: <const Name extends string = "jwt", const Schema extends TSchema | undefined = undefined>({ name, secret,
|
|
147
|
+
export declare const jwt: <const Name extends string = "jwt", const Schema extends TSchema | undefined = undefined>({ name, secret, schema, ...defaultValues }: JWTOption<Name, Schema>) => Elysia<"", {
|
|
56
148
|
decorator: { [name in Name extends string ? Name : "jwt"]: {
|
|
57
|
-
sign(
|
|
58
|
-
|
|
59
|
-
nbf?: string | number;
|
|
60
|
-
}): Promise<string>;
|
|
61
|
-
verify(jwt?: string): Promise<(UnwrapSchema<Schema, Record<string, string | number>> & JWTPayloadSpec) | false>;
|
|
149
|
+
sign(signValue: Omit<UnwrapSchema<Schema, ClaimType>, NormalizedClaim> & JWTPayloadInput): Promise<string>;
|
|
150
|
+
verify(jwt?: string, options?: JWTVerifyOptions): Promise<(UnwrapSchema<Schema, ClaimType> & Omit<JWTPayloadSpec, keyof UnwrapSchema<Schema, {}>>) | false>;
|
|
62
151
|
}; } extends infer T ? { [K in keyof T]: { [name in Name extends string ? Name : "jwt"]: {
|
|
63
|
-
sign(
|
|
64
|
-
|
|
65
|
-
nbf?: string | number;
|
|
66
|
-
}): Promise<string>;
|
|
67
|
-
verify(jwt?: string): Promise<(UnwrapSchema<Schema, Record<string, string | number>> & JWTPayloadSpec) | false>;
|
|
152
|
+
sign(signValue: Omit<UnwrapSchema<Schema, ClaimType>, NormalizedClaim> & JWTPayloadInput): Promise<string>;
|
|
153
|
+
verify(jwt?: string, options?: JWTVerifyOptions): Promise<(UnwrapSchema<Schema, ClaimType> & Omit<JWTPayloadSpec, keyof UnwrapSchema<Schema, {}>>) | false>;
|
|
68
154
|
}; }[K]; } : never;
|
|
69
155
|
store: {};
|
|
70
156
|
derive: {};
|
package/dist/cjs/index.js
CHANGED
|
@@ -2642,15 +2642,8 @@ var Type = type_exports2;
|
|
|
2642
2642
|
var jwt = ({
|
|
2643
2643
|
name = "jwt",
|
|
2644
2644
|
secret,
|
|
2645
|
-
// Start JWT Header
|
|
2646
|
-
alg = "HS256",
|
|
2647
|
-
crit,
|
|
2648
2645
|
schema,
|
|
2649
|
-
|
|
2650
|
-
// Start JWT Payload
|
|
2651
|
-
nbf,
|
|
2652
|
-
exp,
|
|
2653
|
-
...payload
|
|
2646
|
+
...defaultValues
|
|
2654
2647
|
}) => {
|
|
2655
2648
|
if (!secret) throw new Error("Secret can't be empty");
|
|
2656
2649
|
const key = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
|
|
@@ -2664,9 +2657,9 @@ var jwt = ({
|
|
|
2664
2657
|
Type.Union([Type.String(), Type.Array(Type.String())])
|
|
2665
2658
|
),
|
|
2666
2659
|
jti: Type.Optional(Type.String()),
|
|
2667
|
-
nbf: Type.Optional(Type.
|
|
2668
|
-
exp: Type.Optional(Type.
|
|
2669
|
-
iat: Type.Optional(Type.
|
|
2660
|
+
nbf: Type.Optional(Type.Number()),
|
|
2661
|
+
exp: Type.Optional(Type.Number()),
|
|
2662
|
+
iat: Type.Optional(Type.Number())
|
|
2670
2663
|
})
|
|
2671
2664
|
]),
|
|
2672
2665
|
{
|
|
@@ -2678,39 +2671,68 @@ var jwt = ({
|
|
|
2678
2671
|
seed: {
|
|
2679
2672
|
name,
|
|
2680
2673
|
secret,
|
|
2681
|
-
alg,
|
|
2682
|
-
crit,
|
|
2683
2674
|
schema,
|
|
2684
|
-
|
|
2685
|
-
exp,
|
|
2686
|
-
...payload
|
|
2675
|
+
...defaultValues
|
|
2687
2676
|
}
|
|
2688
2677
|
}).decorate(name, {
|
|
2689
|
-
sign(
|
|
2690
|
-
const {
|
|
2691
|
-
|
|
2692
|
-
|
|
2693
|
-
|
|
2694
|
-
|
|
2695
|
-
|
|
2696
|
-
|
|
2697
|
-
|
|
2698
|
-
|
|
2699
|
-
|
|
2700
|
-
|
|
2678
|
+
sign(signValue) {
|
|
2679
|
+
const { nbf, exp, iat, ...data } = signValue;
|
|
2680
|
+
const JWTHeader = {
|
|
2681
|
+
alg: defaultValues.alg ?? "HS256",
|
|
2682
|
+
b64: defaultValues.b64,
|
|
2683
|
+
crit: defaultValues.crit,
|
|
2684
|
+
cty: defaultValues.cty,
|
|
2685
|
+
jku: defaultValues.jku,
|
|
2686
|
+
jwk: defaultValues.jwk,
|
|
2687
|
+
kid: defaultValues.kid,
|
|
2688
|
+
typ: defaultValues.typ ?? "JWT",
|
|
2689
|
+
x5c: defaultValues.x5c,
|
|
2690
|
+
x5t: defaultValues.x5t,
|
|
2691
|
+
x5u: defaultValues.x5u
|
|
2692
|
+
};
|
|
2693
|
+
const JWTPayload = {
|
|
2694
|
+
/**
|
|
2695
|
+
* Audience (aud): Identifies the recipients that the JWT is intended for.
|
|
2696
|
+
*/
|
|
2697
|
+
aud: data.aud ?? defaultValues.aud,
|
|
2698
|
+
/**
|
|
2699
|
+
* Issuer (iss): Identifies the principal that issued the JWT.
|
|
2700
|
+
*/
|
|
2701
|
+
iss: data.iss ?? defaultValues.iss,
|
|
2702
|
+
/**
|
|
2703
|
+
* JWT ID (jti): Provides a unique identifier for the JWT.
|
|
2704
|
+
*/
|
|
2705
|
+
jti: data.jti ?? defaultValues.jti,
|
|
2706
|
+
/**
|
|
2707
|
+
* Subject (sub): Identifies the principal that is the subject of the JWT.
|
|
2708
|
+
*/
|
|
2709
|
+
sub: data.sub ?? defaultValues.sub,
|
|
2710
|
+
// Includes all other properties from the data source, both standard and custom,
|
|
2711
|
+
// excluding standard JWT claims like `nbf`, `exp` and `iat`.
|
|
2712
|
+
...data
|
|
2713
|
+
};
|
|
2714
|
+
let jwt2 = new import_jose.SignJWT({ ...JWTPayload }).setProtectedHeader({
|
|
2715
|
+
alg: JWTHeader.alg,
|
|
2716
|
+
...JWTHeader
|
|
2701
2717
|
});
|
|
2702
|
-
|
|
2703
|
-
|
|
2718
|
+
const setNbf = "nbf" in signValue ? nbf : defaultValues.nbf;
|
|
2719
|
+
if (setNbf !== void 0) {
|
|
2720
|
+
jwt2 = jwt2.setNotBefore(setNbf);
|
|
2704
2721
|
}
|
|
2705
|
-
|
|
2706
|
-
|
|
2722
|
+
const setExp = "exp" in signValue ? exp : defaultValues.exp;
|
|
2723
|
+
if (setExp !== void 0) {
|
|
2724
|
+
jwt2 = jwt2.setExpirationTime(setExp);
|
|
2725
|
+
}
|
|
2726
|
+
const setIat = "iat" in signValue ? iat : defaultValues.iat;
|
|
2727
|
+
if (setIat !== false) {
|
|
2728
|
+
jwt2 = jwt2.setIssuedAt(/* @__PURE__ */ new Date());
|
|
2707
2729
|
}
|
|
2708
2730
|
return jwt2.sign(key);
|
|
2709
2731
|
},
|
|
2710
|
-
async verify(jwt2) {
|
|
2732
|
+
async verify(jwt2, options) {
|
|
2711
2733
|
if (!jwt2) return false;
|
|
2712
2734
|
try {
|
|
2713
|
-
const data = (await (0, import_jose.jwtVerify)(jwt2, key)).payload;
|
|
2735
|
+
const data = (await (options ? (0, import_jose.jwtVerify)(jwt2, key, options) : (0, import_jose.jwtVerify)(jwt2, key))).payload;
|
|
2714
2736
|
if (validator && !validator.Check(data))
|
|
2715
2737
|
throw new import_elysia.ValidationError("JWT", validator, data);
|
|
2716
2738
|
return data;
|
package/dist/index.d.ts
CHANGED
|
@@ -1,17 +1,121 @@
|
|
|
1
|
-
import { Elysia } from 'elysia';
|
|
2
|
-
import { type
|
|
3
|
-
import type { Static, TSchema } from '@sinclair/typebox';
|
|
1
|
+
import { Elysia, type TSchema, type UnwrapSchema as Static } from 'elysia';
|
|
2
|
+
import { type CryptoKey, type JWK, type KeyObject, type JoseHeaderParameters, type JWTVerifyOptions } from 'jose';
|
|
4
3
|
type UnwrapSchema<Schema extends TSchema | undefined, Fallback = unknown> = Schema extends TSchema ? Static<NonNullable<Schema>> : Fallback;
|
|
4
|
+
type NormalizedClaim = 'nbf' | 'exp' | 'iat';
|
|
5
|
+
type AllowClaimValue = string | number | boolean | null | undefined | AllowClaimValue[] | {
|
|
6
|
+
[key: string]: AllowClaimValue;
|
|
7
|
+
};
|
|
8
|
+
type ClaimType = Record<string, AllowClaimValue>;
|
|
9
|
+
/**
|
|
10
|
+
* This interface is a specific, strongly-typed representation of the
|
|
11
|
+
* standard claims found in a JWT payload.
|
|
12
|
+
*
|
|
13
|
+
* It is re-declared here to override potentially generic definitions from
|
|
14
|
+
* third-party libraries, ensuring the compiler knows every expected field.
|
|
15
|
+
*
|
|
16
|
+
* This interface can be modified as needed within the plugin to easily
|
|
17
|
+
* accommodate custom claims for specific use cases.
|
|
18
|
+
*/
|
|
5
19
|
export interface JWTPayloadSpec {
|
|
20
|
+
/**
|
|
21
|
+
* JWT Issuer
|
|
22
|
+
*
|
|
23
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1 RFC7519#section-4.1.1}
|
|
24
|
+
*/
|
|
6
25
|
iss?: string;
|
|
26
|
+
/**
|
|
27
|
+
* JWT Subject
|
|
28
|
+
*
|
|
29
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.2 RFC7519#section-4.1.2}
|
|
30
|
+
*/
|
|
7
31
|
sub?: string;
|
|
32
|
+
/**
|
|
33
|
+
* JWT Audience
|
|
34
|
+
*
|
|
35
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3 RFC7519#section-4.1.3}
|
|
36
|
+
*/
|
|
8
37
|
aud?: string | string[];
|
|
38
|
+
/**
|
|
39
|
+
* JWT ID
|
|
40
|
+
*
|
|
41
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.7 RFC7519#section-4.1.7}
|
|
42
|
+
*/
|
|
9
43
|
jti?: string;
|
|
44
|
+
/**
|
|
45
|
+
* JWT Not Before
|
|
46
|
+
*
|
|
47
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5 RFC7519#section-4.1.5}
|
|
48
|
+
*/
|
|
10
49
|
nbf?: number;
|
|
50
|
+
/**
|
|
51
|
+
* JWT Expiration Time
|
|
52
|
+
*
|
|
53
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4 RFC7519#section-4.1.4}
|
|
54
|
+
*/
|
|
11
55
|
exp?: number;
|
|
56
|
+
/**
|
|
57
|
+
* JWT Issued At
|
|
58
|
+
*
|
|
59
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}
|
|
60
|
+
*/
|
|
12
61
|
iat?: number;
|
|
13
62
|
}
|
|
14
|
-
|
|
63
|
+
/**
|
|
64
|
+
* This interface defines the shape of JWT payload fields that can be
|
|
65
|
+
* provided as input when creating or signing a token.
|
|
66
|
+
*
|
|
67
|
+
* Unlike `JWTPayloadSpec`, values here may be expressed in more flexible forms,
|
|
68
|
+
* such as relative time strings or control flags (e.g., `iat: true`).
|
|
69
|
+
*
|
|
70
|
+
* This interface is parsed and normalized by the plugin before becoming part
|
|
71
|
+
* of the final JWT payload.
|
|
72
|
+
*/
|
|
73
|
+
export interface JWTPayloadInput extends Omit<JWTPayloadSpec, NormalizedClaim> {
|
|
74
|
+
/**
|
|
75
|
+
* JWT Not Before
|
|
76
|
+
*
|
|
77
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5 RFC7519#section-4.1.5}
|
|
78
|
+
*/
|
|
79
|
+
nbf?: string | number;
|
|
80
|
+
/**
|
|
81
|
+
* JWT Expiration Time
|
|
82
|
+
*
|
|
83
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4 RFC7519#section-4.1.4}
|
|
84
|
+
*/
|
|
85
|
+
exp?: string | number;
|
|
86
|
+
/**
|
|
87
|
+
* JWT Issued At
|
|
88
|
+
*
|
|
89
|
+
* @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}
|
|
90
|
+
*/
|
|
91
|
+
iat?: boolean;
|
|
92
|
+
}
|
|
93
|
+
/**
|
|
94
|
+
* Defines the types for the header parameters of a JWS.
|
|
95
|
+
*
|
|
96
|
+
* Much like `JWTPayloadSpec`, this interface is declared to provide strong,
|
|
97
|
+
* explicit typing, allowing TypeScript to validate the header's structure
|
|
98
|
+
* and provide accurate autocompletion.
|
|
99
|
+
*
|
|
100
|
+
* It can also be modified within the plugin to handle custom header
|
|
101
|
+
* parameters required for specific development scenarios.
|
|
102
|
+
*/
|
|
103
|
+
export interface JWTHeaderParameters extends JoseHeaderParameters {
|
|
104
|
+
/**
|
|
105
|
+
* JWS "alg" (Algorithm) Header Parameter
|
|
106
|
+
*
|
|
107
|
+
* @see {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}
|
|
108
|
+
*/
|
|
109
|
+
alg?: string;
|
|
110
|
+
/**
|
|
111
|
+
* This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
|
|
112
|
+
* Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
|
|
113
|
+
*/
|
|
114
|
+
b64?: true;
|
|
115
|
+
/** JWS "crit" (Critical) Header Parameter */
|
|
116
|
+
crit?: string[];
|
|
117
|
+
}
|
|
118
|
+
export interface JWTOption<Name extends string | undefined = 'jwt', Schema extends TSchema | undefined = undefined> extends JWTHeaderParameters, JWTPayloadInput {
|
|
15
119
|
/**
|
|
16
120
|
* Name to decorate method as
|
|
17
121
|
*
|
|
@@ -39,32 +143,14 @@ export interface JWTOption<Name extends string | undefined = 'jwt', Schema exten
|
|
|
39
143
|
* Type strict validation for JWT payload
|
|
40
144
|
*/
|
|
41
145
|
schema?: Schema;
|
|
42
|
-
/**
|
|
43
|
-
* JWT Not Before
|
|
44
|
-
*
|
|
45
|
-
* @see [RFC7519#section-4.1.5](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5)
|
|
46
|
-
*/
|
|
47
|
-
nbf?: string | number;
|
|
48
|
-
/**
|
|
49
|
-
* JWT Expiration Time
|
|
50
|
-
*
|
|
51
|
-
* @see [RFC7519#section-4.1.4](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4)
|
|
52
|
-
*/
|
|
53
|
-
exp?: string | number;
|
|
54
146
|
}
|
|
55
|
-
export declare const jwt: <const Name extends string = "jwt", const Schema extends TSchema | undefined = undefined>({ name, secret,
|
|
147
|
+
export declare const jwt: <const Name extends string = "jwt", const Schema extends TSchema | undefined = undefined>({ name, secret, schema, ...defaultValues }: JWTOption<Name, Schema>) => Elysia<"", {
|
|
56
148
|
decorator: { [name in Name extends string ? Name : "jwt"]: {
|
|
57
|
-
sign(
|
|
58
|
-
|
|
59
|
-
nbf?: string | number;
|
|
60
|
-
}): Promise<string>;
|
|
61
|
-
verify(jwt?: string): Promise<(UnwrapSchema<Schema, Record<string, string | number>> & JWTPayloadSpec) | false>;
|
|
149
|
+
sign(signValue: Omit<UnwrapSchema<Schema, ClaimType>, NormalizedClaim> & JWTPayloadInput): Promise<string>;
|
|
150
|
+
verify(jwt?: string, options?: JWTVerifyOptions): Promise<(UnwrapSchema<Schema, ClaimType> & Omit<JWTPayloadSpec, keyof UnwrapSchema<Schema, {}>>) | false>;
|
|
62
151
|
}; } extends infer T ? { [K in keyof T]: { [name in Name extends string ? Name : "jwt"]: {
|
|
63
|
-
sign(
|
|
64
|
-
|
|
65
|
-
nbf?: string | number;
|
|
66
|
-
}): Promise<string>;
|
|
67
|
-
verify(jwt?: string): Promise<(UnwrapSchema<Schema, Record<string, string | number>> & JWTPayloadSpec) | false>;
|
|
152
|
+
sign(signValue: Omit<UnwrapSchema<Schema, ClaimType>, NormalizedClaim> & JWTPayloadInput): Promise<string>;
|
|
153
|
+
verify(jwt?: string, options?: JWTVerifyOptions): Promise<(UnwrapSchema<Schema, ClaimType> & Omit<JWTPayloadSpec, keyof UnwrapSchema<Schema, {}>>) | false>;
|
|
68
154
|
}; }[K]; } : never;
|
|
69
155
|
store: {};
|
|
70
156
|
derive: {};
|
package/dist/index.mjs
CHANGED
|
@@ -5,7 +5,11 @@ var __export = (target, all) => {
|
|
|
5
5
|
};
|
|
6
6
|
|
|
7
7
|
// src/index.ts
|
|
8
|
-
import {
|
|
8
|
+
import {
|
|
9
|
+
Elysia,
|
|
10
|
+
ValidationError,
|
|
11
|
+
getSchemaValidator
|
|
12
|
+
} from "elysia";
|
|
9
13
|
import {
|
|
10
14
|
SignJWT,
|
|
11
15
|
jwtVerify
|
|
@@ -2626,15 +2630,8 @@ var Type = type_exports2;
|
|
|
2626
2630
|
var jwt = ({
|
|
2627
2631
|
name = "jwt",
|
|
2628
2632
|
secret,
|
|
2629
|
-
// Start JWT Header
|
|
2630
|
-
alg = "HS256",
|
|
2631
|
-
crit,
|
|
2632
2633
|
schema,
|
|
2633
|
-
|
|
2634
|
-
// Start JWT Payload
|
|
2635
|
-
nbf,
|
|
2636
|
-
exp,
|
|
2637
|
-
...payload
|
|
2634
|
+
...defaultValues
|
|
2638
2635
|
}) => {
|
|
2639
2636
|
if (!secret) throw new Error("Secret can't be empty");
|
|
2640
2637
|
const key = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
|
|
@@ -2648,9 +2645,9 @@ var jwt = ({
|
|
|
2648
2645
|
Type.Union([Type.String(), Type.Array(Type.String())])
|
|
2649
2646
|
),
|
|
2650
2647
|
jti: Type.Optional(Type.String()),
|
|
2651
|
-
nbf: Type.Optional(Type.
|
|
2652
|
-
exp: Type.Optional(Type.
|
|
2653
|
-
iat: Type.Optional(Type.
|
|
2648
|
+
nbf: Type.Optional(Type.Number()),
|
|
2649
|
+
exp: Type.Optional(Type.Number()),
|
|
2650
|
+
iat: Type.Optional(Type.Number())
|
|
2654
2651
|
})
|
|
2655
2652
|
]),
|
|
2656
2653
|
{
|
|
@@ -2662,39 +2659,68 @@ var jwt = ({
|
|
|
2662
2659
|
seed: {
|
|
2663
2660
|
name,
|
|
2664
2661
|
secret,
|
|
2665
|
-
alg,
|
|
2666
|
-
crit,
|
|
2667
2662
|
schema,
|
|
2668
|
-
|
|
2669
|
-
exp,
|
|
2670
|
-
...payload
|
|
2663
|
+
...defaultValues
|
|
2671
2664
|
}
|
|
2672
2665
|
}).decorate(name, {
|
|
2673
|
-
sign(
|
|
2674
|
-
const {
|
|
2675
|
-
|
|
2676
|
-
|
|
2677
|
-
|
|
2678
|
-
|
|
2679
|
-
|
|
2680
|
-
|
|
2681
|
-
|
|
2682
|
-
|
|
2683
|
-
|
|
2684
|
-
|
|
2666
|
+
sign(signValue) {
|
|
2667
|
+
const { nbf, exp, iat, ...data } = signValue;
|
|
2668
|
+
const JWTHeader = {
|
|
2669
|
+
alg: defaultValues.alg ?? "HS256",
|
|
2670
|
+
b64: defaultValues.b64,
|
|
2671
|
+
crit: defaultValues.crit,
|
|
2672
|
+
cty: defaultValues.cty,
|
|
2673
|
+
jku: defaultValues.jku,
|
|
2674
|
+
jwk: defaultValues.jwk,
|
|
2675
|
+
kid: defaultValues.kid,
|
|
2676
|
+
typ: defaultValues.typ ?? "JWT",
|
|
2677
|
+
x5c: defaultValues.x5c,
|
|
2678
|
+
x5t: defaultValues.x5t,
|
|
2679
|
+
x5u: defaultValues.x5u
|
|
2680
|
+
};
|
|
2681
|
+
const JWTPayload = {
|
|
2682
|
+
/**
|
|
2683
|
+
* Audience (aud): Identifies the recipients that the JWT is intended for.
|
|
2684
|
+
*/
|
|
2685
|
+
aud: data.aud ?? defaultValues.aud,
|
|
2686
|
+
/**
|
|
2687
|
+
* Issuer (iss): Identifies the principal that issued the JWT.
|
|
2688
|
+
*/
|
|
2689
|
+
iss: data.iss ?? defaultValues.iss,
|
|
2690
|
+
/**
|
|
2691
|
+
* JWT ID (jti): Provides a unique identifier for the JWT.
|
|
2692
|
+
*/
|
|
2693
|
+
jti: data.jti ?? defaultValues.jti,
|
|
2694
|
+
/**
|
|
2695
|
+
* Subject (sub): Identifies the principal that is the subject of the JWT.
|
|
2696
|
+
*/
|
|
2697
|
+
sub: data.sub ?? defaultValues.sub,
|
|
2698
|
+
// Includes all other properties from the data source, both standard and custom,
|
|
2699
|
+
// excluding standard JWT claims like `nbf`, `exp` and `iat`.
|
|
2700
|
+
...data
|
|
2701
|
+
};
|
|
2702
|
+
let jwt2 = new SignJWT({ ...JWTPayload }).setProtectedHeader({
|
|
2703
|
+
alg: JWTHeader.alg,
|
|
2704
|
+
...JWTHeader
|
|
2685
2705
|
});
|
|
2686
|
-
|
|
2687
|
-
|
|
2706
|
+
const setNbf = "nbf" in signValue ? nbf : defaultValues.nbf;
|
|
2707
|
+
if (setNbf !== void 0) {
|
|
2708
|
+
jwt2 = jwt2.setNotBefore(setNbf);
|
|
2709
|
+
}
|
|
2710
|
+
const setExp = "exp" in signValue ? exp : defaultValues.exp;
|
|
2711
|
+
if (setExp !== void 0) {
|
|
2712
|
+
jwt2 = jwt2.setExpirationTime(setExp);
|
|
2688
2713
|
}
|
|
2689
|
-
|
|
2690
|
-
|
|
2714
|
+
const setIat = "iat" in signValue ? iat : defaultValues.iat;
|
|
2715
|
+
if (setIat !== false) {
|
|
2716
|
+
jwt2 = jwt2.setIssuedAt(/* @__PURE__ */ new Date());
|
|
2691
2717
|
}
|
|
2692
2718
|
return jwt2.sign(key);
|
|
2693
2719
|
},
|
|
2694
|
-
async verify(jwt2) {
|
|
2720
|
+
async verify(jwt2, options) {
|
|
2695
2721
|
if (!jwt2) return false;
|
|
2696
2722
|
try {
|
|
2697
|
-
const data = (await jwtVerify(jwt2, key)).payload;
|
|
2723
|
+
const data = (await (options ? jwtVerify(jwt2, key, options) : jwtVerify(jwt2, key))).payload;
|
|
2698
2724
|
if (validator && !validator.Check(data))
|
|
2699
2725
|
throw new ValidationError("JWT", validator, data);
|
|
2700
2726
|
return data;
|