@forklaunch/core 1.5.18 → 1.5.20

package/lib/http/discriminateAuthMethod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discriminateAuthMethod.d.ts","sourceRoot":"","sources":["../../src/http/discriminateAuthMethod.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,UAAU,EAAa,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAK9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAYzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CA4B5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,SAAS,kBAAkB,EAC7B,CAAC,SAAS,gBAAgB,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,QAAQ,SAAS,QAAQ,EACzB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,aAAa,SAAS,iBAAiB,EACvC,WAAW,EAEX,IAAI,EAAE,WAAW,CACf,EAAE,EACF,CAAC,EACD,OAAO,EACP,QAAQ,EACR,UAAU,EACV,aAAa,EACb,WAAW,CACZ,EACD,sBAAsB,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,GACjE,OAAO,CACN;IACE,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QACJ,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;KAC3C,CAAC;CACH,GACD;IACE,IAAI,EAAE,KAAK,CAAC;IACZ,IAAI,EACA;QACE,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,GACD;QACE,oBAAoB,EAAE,CACpB,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;KACtC,CAAC;CACP,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE;QACJ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,oBAAoB,EAAE,CAAC,EACrB,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,SAAS,EACT,KAAK,EACL,SAAS,EACT,SAAS,EACV,EAAE;YACD,MAAM,EAAE,MAAM,CAAC;YACf,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,OAAO,CAAC;YACf,SAAS,EAAE,IAAI,CAAC;YAChB,KAAK,EAAE,MAAM,CAAC;YACd,SAAS,EAAE,MAAM,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC;SACnB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;KACpC,CAAC;CACH,CACJ,CA+GA"}
+{"version":3,"file":"discriminateAuthMethod.d.ts","sourceRoot":"","sources":["../../src/http/discriminateAuthMethod.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,UAAU,EAAa,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAK9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAYzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CA4B5E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,SAAS,kBAAkB,EAC7B,CAAC,SAAS,gBAAgB,EAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,QAAQ,SAAS,QAAQ,EACzB,UAAU,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,aAAa,SAAS,iBAAiB,EACvC,WAAW,EAEX,IAAI,EAAE,WAAW,CACf,EAAE,EACF,CAAC,EACD,OAAO,EACP,QAAQ,EACR,UAAU,EACV,aAAa,EACb,WAAW,CACZ,EACD,sBAAsB,CAAC,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,GACjE,OAAO,CACN;IACE,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QACJ,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;KAC3C,CAAC;CACH,GACD;IACE,IAAI,EAAE,KAAK,CAAC;IACZ,IAAI,EACA;QACE,cAAc,CAAC,EAAE,cAAc,CAAC;KACjC,GACD;QACE,oBAAoB,EAAE,CACpB,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;KACtC,CAAC;CACP,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE;QACJ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,oBAAoB,EAAE,CAAC,EACrB,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,SAAS,EACT,KAAK,EACL,SAAS,EACT,SAAS,EACV,EAAE;YACD,MAAM,EAAE,MAAM,CAAC;YACf,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,OAAO,CAAC;YACf,SAAS,EAAE,IAAI,CAAC;YAChB,KAAK,EAAE,MAAM,CAAC;YACd,SAAS,EAAE,MAAM,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC;SACnB,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;KACpC,CAAC;CACH,CACJ,CAqHA"}

package/lib/http/index.js

@@ -809,17 +809,20 @@ async function discriminateAuthMethod(auth, openTelemetryCollector) {
         jwks = [jwt.jwksPublicKey];
       }
       verificationFunction = async (token) => {
+        let lastError;
         for (const key of jwks) {
           try {
             const { payload } = await (0, import_jose.jwtVerify)(token, key);
             return payload;
-          } catch {
+          } catch (error) {
+            lastError = error;
             cachedJwks.value = null;
             cachedJwks.lastUpdated = null;
             cachedJwks.ttl = DEFAULT_TTL;
             continue;
           }
         }
+        if (lastError !== void 0) throw lastError;
       };
     }
     authMethod = {
@@ -888,6 +891,58 @@ function hasSubscriptionChecks(maybeSubscriptionAuth) {
   return typeof maybeSubscriptionAuth === "object" && maybeSubscriptionAuth !== null && "requireActiveSubscription" in maybeSubscriptionAuth && maybeSubscriptionAuth.requireActiveSubscription === true;
 }
 
+// src/http/middleware/request/authLogContext.ts
+var import_crypto2 = require("crypto");
+var import_jose2 = require("jose");
+var FINGERPRINT_LENGTH = 8;
+var MAX_CLAIM_LENGTH = 128;
+function bounded(value) {
+  return typeof value === "string" && value.length > 0 ? value.slice(0, MAX_CLAIM_LENGTH) : void 0;
+}
+function authLogContext(headerValue) {
+  if (typeof headerValue !== "string" || headerValue.length === 0) {
+    return { hasToken: false };
+  }
+  const context2 = {
+    hasToken: true,
+    tokenFingerprint: (0, import_crypto2.createHash)("sha256").update(headerValue).digest("hex").slice(0, FINGERPRINT_LENGTH)
+  };
+  const parts = headerValue.trim().split(/\s+/);
+  const candidate = parts[parts.length - 1];
+  if (candidate.split(".").length !== 3) {
+    return context2;
+  }
+  try {
+    const payload = (0, import_jose2.decodeJwt)(candidate);
+    const header = (0, import_jose2.decodeProtectedHeader)(candidate);
+    context2.claimed = {
+      sub: bounded(payload.sub),
+      organizationId: bounded(payload.organizationId),
+      iss: bounded(payload.iss),
+      exp: typeof payload.exp === "number" ? payload.exp : void 0,
+      kid: bounded(header.kid)
+    };
+  } catch {
+  }
+  return context2;
+}
+function jwtFailureReason(error) {
+  if (error instanceof import_jose2.errors.JWTExpired) return "jwt_expired";
+  if (error instanceof import_jose2.errors.JWTClaimValidationFailed) {
+    return `jwt_claim_${error.claim}`;
+  }
+  if (error instanceof import_jose2.errors.JWSSignatureVerificationFailed) {
+    return "jwt_bad_signature";
+  }
+  if (error instanceof import_jose2.errors.JWKSNoMatchingKey) return "jwks_no_key";
+  if (error instanceof import_jose2.errors.JWKSTimeout) return "jwks_unavailable";
+  if (error instanceof import_jose2.errors.JWTInvalid || error instanceof import_jose2.errors.JWSInvalid) {
+    return "jwt_malformed";
+  }
+  if (error instanceof import_jose2.errors.JOSEError) return error.code.toLowerCase();
+  return "unknown";
+}
+
 // src/http/middleware/request/auth.middleware.ts
 var invalidAuthorizationTokenFormat = [
   401,
@@ -1003,13 +1058,14 @@ async function checkAuthorizationToken(req, authorizationMethod, authorizationTo
         }
         sessionPayload = decodedJwt;
       } catch (error) {
-        req?.openTelemetryCollector?.error(
+        req?.openTelemetryCollector?.warn(
           "JWT Verification Failed",
           meta({
-            error,
+            reason: jwtFailureReason(error),
+            error: error instanceof Error ? error.message : String(error),
             method: req.method,
             path: req.path,
-            token
+            ...authLogContext(token)
           })
         );
         return invalidAuthorizationToken;
@@ -1160,13 +1216,13 @@ async function parseRequestAuth(req, res, next) {
   const token = req.headers[auth?.headerName ?? "Authorization"] || req.headers[auth?.headerName ?? "authorization"];
   const [error, message] = await checkAuthorizationToken(req, auth, token, req._globalOptions?.()?.auth, access) ?? [];
   if (error != null) {
-    req.openTelemetryCollector?.error(
+    req.openTelemetryCollector?.warn(
       message || "Authorization Failed",
       meta({
         statusCode: error,
         method: req.method,
         path: req.path,
-        token
+        ...authLogContext(token)
       })
     );
     res.type("text/plain");
@@ -2395,7 +2451,7 @@ function isPortBound(port, host = "localhost") {
 }
 
 // src/http/generateHmacAuthHeaders.ts
-var import_crypto2 = require("crypto");
+var import_crypto3 = require("crypto");
 function generateHmacAuthHeaders({
   secretKey,
   method,
@@ -2404,7 +2460,7 @@ function generateHmacAuthHeaders({
   keyId = "default"
 }) {
   const timestamp = /* @__PURE__ */ new Date();
-  const nonce = (0, import_crypto2.randomUUID)();
+  const nonce = (0, import_crypto3.randomUUID)();
   const signature = createHmacToken({
     secretKey,
     method,
@@ -4379,7 +4435,7 @@ function generateOpenApiSpecs(schemaValidator, serverUrls, serverDescriptions, a
 }
 
 // src/http/telemetry/auditLogger.ts
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 var AuditLogger = class {
   _otel;
   constructor(otel) {
@@ -4412,7 +4468,7 @@ var AuditLogger = class {
     if (body === void 0 || body === null || body === "") {
       return "";
     }
-    return (0, import_crypto3.createHash)("sha256").update(body).digest("hex");
+    return (0, import_crypto4.createHash)("sha256").update(body).digest("hex");
   }
 };