@entifix/jwt 0.12.1 → 0.14.0

package/dist/token-service/unverified-claims.d.ts

@@ -5,7 +5,7 @@ import type { TokenClaims } from '@entifix/business';
  * ⚠️ This proves nothing. A caller can forge any claims it likes. Use it only
  * for presentation — deciding which nav entries to render, say — where being
  * wrong costs a menu item and every request behind that item is still refused
- * by the service's `requirePermission`. Never branch on it for access.
+ * by the service's endpoint guards. Never branch on it for access.
  *
  * It exists so a Next server component can shape a menu without either calling
  * a service on every render or copying `jwt.secret` out of config-service into

package/dist/token-service/unverified-claims.js

@@ -14,7 +14,7 @@
  * ⚠️ This proves nothing. A caller can forge any claims it likes. Use it only
  * for presentation — deciding which nav entries to render, say — where being
  * wrong costs a menu item and every request behind that item is still refused
- * by the service's `requirePermission`. Never branch on it for access.
+ * by the service's endpoint guards. Never branch on it for access.
  *
  * It exists so a Next server component can shape a menu without either calling
  * a service on every render or copying `jwt.secret` out of config-service into

package/dist/token-service/unverified-claims.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/token-service/unverified-claims.ts"],"sourcesContent":["import type { TokenClaims } from '@entifix/business';\n\n/**\n * Base64url → JSON. `atob` + `TextDecoder` rather than `Buffer` so the same\n * function runs in Node, the browser and the edge runtime unchanged.\n */\nconst decodeSegment = (segment: string): unknown => {\n  const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64.padEnd(\n    base64.length + ((4 - (base64.length % 4)) % 4),\n    '=',\n  );\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n  return JSON.parse(new TextDecoder().decode(bytes));\n};\n\n/**\n * Read a token's claims **without checking its signature**.\n *\n * ⚠️ This proves nothing. A caller can forge any claims it likes. Use it only\n * for presentation — deciding which nav entries to render, say — where being\n * wrong costs a menu item and every request behind that item is still refused\n * by the service's `requirePermission`. Never branch on it for access.\n *\n * It exists so a Next server component can shape a menu without either calling\n * a service on every render or copying `jwt.secret` out of config-service into\n * the app runtime. Anything that must be *true* goes to\n * {@link verifyAccessToken} or to the owning service.\n *\n * Returns `undefined` for anything that is not a well-formed JWT payload.\n */\nexport const unverifiedClaims = (token: string): TokenClaims | undefined => {\n  const [, payloadSegment, signature] = token.split('.');\n  if (payloadSegment === undefined || signature === undefined) {\n    return undefined;\n  }\n  try {\n    const payload = decodeSegment(payloadSegment);\n    return typeof payload === 'object' && payload !== null\n      ? (payload as TokenClaims)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n};\n"],"names":["decodeSegment","segment","base64","replace","padded","padEnd","length","binary","atob","bytes","Uint8Array","from","character","charCodeAt","JSON","parse","TextDecoder","decode","unverifiedClaims","token","payloadSegment","signature","split","undefined","payload"],"mappings":"AAEA;;;CAGC,GACD,MAAMA,gBAAgB,CAACC;IACrB,MAAMC,SAASD,QAAQE,OAAO,CAAC,MAAM,KAAKA,OAAO,CAAC,MAAM;IACxD,MAAMC,SAASF,OAAOG,MAAM,CAC1BH,OAAOI,MAAM,GAAI,AAAC,CAAA,IAAKJ,OAAOI,MAAM,GAAG,CAAC,IAAK,GAC7C;IAEF,MAAMC,SAASC,KAAKJ;IACpB,MAAMK,QAAQC,WAAWC,IAAI,CAACJ,QAAQK,CAAAA,YAAaA,UAAUC,UAAU,CAAC;IACxE,OAAOC,KAAKC,KAAK,CAAC,IAAIC,cAAcC,MAAM,CAACR;AAC7C;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMS,mBAAmB,CAACC;IAC/B,MAAM,GAAGC,gBAAgBC,UAAU,GAAGF,MAAMG,KAAK,CAAC;IAClD,IAAIF,mBAAmBG,aAAaF,cAAcE,WAAW;QAC3D,OAAOA;IACT;IACA,IAAI;QACF,MAAMC,UAAUxB,cAAcoB;QAC9B,OAAO,OAAOI,YAAY,YAAYA,YAAY,OAC7CA,UACDD;IACN,EAAE,eAAM;QACN,OAAOA;IACT;AACF,EAAE"}
+{"version":3,"sources":["../../src/token-service/unverified-claims.ts"],"sourcesContent":["import type { TokenClaims } from '@entifix/business';\n\n/**\n * Base64url → JSON. `atob` + `TextDecoder` rather than `Buffer` so the same\n * function runs in Node, the browser and the edge runtime unchanged.\n */\nconst decodeSegment = (segment: string): unknown => {\n  const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64.padEnd(\n    base64.length + ((4 - (base64.length % 4)) % 4),\n    '=',\n  );\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n  return JSON.parse(new TextDecoder().decode(bytes));\n};\n\n/**\n * Read a token's claims **without checking its signature**.\n *\n * ⚠️ This proves nothing. A caller can forge any claims it likes. Use it only\n * for presentation — deciding which nav entries to render, say — where being\n * wrong costs a menu item and every request behind that item is still refused\n * by the service's endpoint guards. Never branch on it for access.\n *\n * It exists so a Next server component can shape a menu without either calling\n * a service on every render or copying `jwt.secret` out of config-service into\n * the app runtime. Anything that must be *true* goes to\n * {@link verifyAccessToken} or to the owning service.\n *\n * Returns `undefined` for anything that is not a well-formed JWT payload.\n */\nexport const unverifiedClaims = (token: string): TokenClaims | undefined => {\n  const [, payloadSegment, signature] = token.split('.');\n  if (payloadSegment === undefined || signature === undefined) {\n    return undefined;\n  }\n  try {\n    const payload = decodeSegment(payloadSegment);\n    return typeof payload === 'object' && payload !== null\n      ? (payload as TokenClaims)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n};\n"],"names":["decodeSegment","segment","base64","replace","padded","padEnd","length","binary","atob","bytes","Uint8Array","from","character","charCodeAt","JSON","parse","TextDecoder","decode","unverifiedClaims","token","payloadSegment","signature","split","undefined","payload"],"mappings":"AAEA;;;CAGC,GACD,MAAMA,gBAAgB,CAACC;IACrB,MAAMC,SAASD,QAAQE,OAAO,CAAC,MAAM,KAAKA,OAAO,CAAC,MAAM;IACxD,MAAMC,SAASF,OAAOG,MAAM,CAC1BH,OAAOI,MAAM,GAAI,AAAC,CAAA,IAAKJ,OAAOI,MAAM,GAAG,CAAC,IAAK,GAC7C;IAEF,MAAMC,SAASC,KAAKJ;IACpB,MAAMK,QAAQC,WAAWC,IAAI,CAACJ,QAAQK,CAAAA,YAAaA,UAAUC,UAAU,CAAC;IACxE,OAAOC,KAAKC,KAAK,CAAC,IAAIC,cAAcC,MAAM,CAACR;AAC7C;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMS,mBAAmB,CAACC;IAC/B,MAAM,GAAGC,gBAAgBC,UAAU,GAAGF,MAAMG,KAAK,CAAC;IAClD,IAAIF,mBAAmBG,aAAaF,cAAcE,WAAW;QAC3D,OAAOA;IACT;IACA,IAAI;QACF,MAAMC,UAAUxB,cAAcoB;QAC9B,OAAO,OAAOI,YAAY,YAAYA,YAAY,OAC7CA,UACDD;IACN,EAAE,eAAM;QACN,OAAOA;IACT;AACF,EAAE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entifix/jwt",
-  "version": "0.12.1",
+  "version": "0.14.0",
   "description": "RS256 access tokens on jose: sign, verify with the algorithm pinned, and publish the JWKS.",
   "license": "MIT",
   "repository": {
@@ -51,15 +51,15 @@
   },
   "dependencies": {
     "@swc/helpers": "0.5.23",
-    "jose": "6.2.12",
-    "@entifix/business": "0.12.1",
-    "@entifix/core": "0.12.1"
+    "jose": "6.2.14",
+    "@entifix/business": "0.14.0",
+    "@entifix/core": "0.14.0"
   },
   "devDependencies": {
-    "effect": "4.0.6",
-    "@entifix/testing-unit": "0.12.1"
+    "effect": "4.0.7",
+    "@entifix/testing-unit": "0.14.0"
   },
   "peerDependencies": {
-    "effect": "^4.0.6"
+    "effect": "^4.0.7"
   }
 }