@fabrika/jwks 0.2.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/jwks",
-	"version": "0.2.0",
+	"version": "0.3.1",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -26,7 +26,8 @@
 		"test": "bun test"
 	},
 	"dependencies": {
-		"@fabrika/auth-core": "^0.2.0",
+		"zod": "^3.25.76",
+		"@fabrika/auth-core": "^0.3.1",
 		"jose": "^5.9.0"
 	}
 }

package/src/index.ts

@@ -6,5 +6,6 @@
 // the code because it is deliberately dependency-free (no `jose`) for its browser-side consumers.
 // So the implementation lives here and both wrap it with their own construction shape.
 
+export { parseJwks } from './parse'
 export { createJwksCache, JWKS_REFETCH_COOLDOWN_SECONDS, JWKS_TTL_SECONDS, TokenVerifier } from './verifier'
 export type { JwksCache, TokenVerifierOptions, VerifyResult } from './verifier'

package/src/parse.ts

@@ -0,0 +1,36 @@
+import type { Jwks } from '@fabrika/auth-core'
+import { z } from 'zod'
+
+const publicJwkSchema = z.preprocess(
+	(raw) => {
+		if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) return raw
+		// Binding responses can carry prototypes; inherited fields are not part of a public key.
+		const fields = Object.fromEntries(
+			['kty', 'crv', 'x', 'y', 'kid', 'alg', 'use']
+				.filter(field => Object.hasOwn(raw, field))
+				.map(field => [field, Reflect.get(raw, field)]),
+		)
+		Object.setPrototypeOf(fields, null)
+		return fields
+	},
+	z.object({
+		kty: z.literal('EC'),
+		crv: z.string().optional(),
+		x: z.string().optional(),
+		y: z.string().optional(),
+		kid: z.string().optional(),
+		alg: z.string().optional(),
+		use: z.string().optional(),
+	}).refine(key => Object.values(key).every(value => value !== undefined)),
+)
+
+const jwksSchema = z.preprocess((body) => {
+	if (typeof body !== 'object' || body === null || Array.isArray(body)) return body
+	return { keys: Object.hasOwn(body, 'keys') ? Reflect.get(body, 'keys') : undefined }
+}, z.object({ keys: z.array(publicJwkSchema) }))
+
+/** Reject the whole set when a member cannot be represented; dropping one would misreport an outage as an invalid token. */
+export function parseJwks(body: unknown): Jwks | null {
+	const result = jwksSchema.safeParse(body)
+	return result.success ? result.data : null
+}