@forklaunch/core 1.5.19 → 1.6.0

package/lib/http/index.mjs

@@ -733,17 +733,20 @@ async function discriminateAuthMethod(auth, openTelemetryCollector) {
         jwks = [jwt.jwksPublicKey];
       }
       verificationFunction = async (token) => {
+        let lastError;
         for (const key of jwks) {
           try {
             const { payload } = await jwtVerify(token, key);
             return payload;
-          } catch {
+          } catch (error) {
+            lastError = error;
             cachedJwks.value = null;
             cachedJwks.lastUpdated = null;
             cachedJwks.ttl = DEFAULT_TTL;
             continue;
           }
         }
+        if (lastError !== void 0) throw lastError;
       };
     }
     authMethod = {
@@ -812,6 +815,58 @@ function hasSubscriptionChecks(maybeSubscriptionAuth) {
   return typeof maybeSubscriptionAuth === "object" && maybeSubscriptionAuth !== null && "requireActiveSubscription" in maybeSubscriptionAuth && maybeSubscriptionAuth.requireActiveSubscription === true;
 }
 
+// src/http/middleware/request/authLogContext.ts
+import { createHash } from "crypto";
+import { decodeJwt, decodeProtectedHeader, errors as joseErrors } from "jose";
+var FINGERPRINT_LENGTH = 8;
+var MAX_CLAIM_LENGTH = 128;
+function bounded(value) {
+  return typeof value === "string" && value.length > 0 ? value.slice(0, MAX_CLAIM_LENGTH) : void 0;
+}
+function authLogContext(headerValue) {
+  if (typeof headerValue !== "string" || headerValue.length === 0) {
+    return { hasToken: false };
+  }
+  const context2 = {
+    hasToken: true,
+    tokenFingerprint: createHash("sha256").update(headerValue).digest("hex").slice(0, FINGERPRINT_LENGTH)
+  };
+  const parts = headerValue.trim().split(/\s+/);
+  const candidate = parts[parts.length - 1];
+  if (candidate.split(".").length !== 3) {
+    return context2;
+  }
+  try {
+    const payload = decodeJwt(candidate);
+    const header = decodeProtectedHeader(candidate);
+    context2.claimed = {
+      sub: bounded(payload.sub),
+      organizationId: bounded(payload.organizationId),
+      iss: bounded(payload.iss),
+      exp: typeof payload.exp === "number" ? payload.exp : void 0,
+      kid: bounded(header.kid)
+    };
+  } catch {
+  }
+  return context2;
+}
+function jwtFailureReason(error) {
+  if (error instanceof joseErrors.JWTExpired) return "jwt_expired";
+  if (error instanceof joseErrors.JWTClaimValidationFailed) {
+    return `jwt_claim_${error.claim}`;
+  }
+  if (error instanceof joseErrors.JWSSignatureVerificationFailed) {
+    return "jwt_bad_signature";
+  }
+  if (error instanceof joseErrors.JWKSNoMatchingKey) return "jwks_no_key";
+  if (error instanceof joseErrors.JWKSTimeout) return "jwks_unavailable";
+  if (error instanceof joseErrors.JWTInvalid || error instanceof joseErrors.JWSInvalid) {
+    return "jwt_malformed";
+  }
+  if (error instanceof joseErrors.JOSEError) return error.code.toLowerCase();
+  return "unknown";
+}
+
 // src/http/middleware/request/auth.middleware.ts
 var invalidAuthorizationTokenFormat = [
   401,
@@ -927,13 +982,14 @@ async function checkAuthorizationToken(req, authorizationMethod, authorizationTo
         }
         sessionPayload = decodedJwt;
       } catch (error) {
-        req?.openTelemetryCollector?.error(
+        req?.openTelemetryCollector?.warn(
           "JWT Verification Failed",
           meta({
-            error,
+            reason: jwtFailureReason(error),
+            error: error instanceof Error ? error.message : String(error),
             method: req.method,
             path: req.path,
-            token
+            ...authLogContext(token)
           })
         );
         return invalidAuthorizationToken;
@@ -1084,13 +1140,13 @@ async function parseRequestAuth(req, res, next) {
   const token = req.headers[auth?.headerName ?? "Authorization"] || req.headers[auth?.headerName ?? "authorization"];
   const [error, message] = await checkAuthorizationToken(req, auth, token, req._globalOptions?.()?.auth, access) ?? [];
   if (error != null) {
-    req.openTelemetryCollector?.error(
+    req.openTelemetryCollector?.warn(
       message || "Authorization Failed",
       meta({
         statusCode: error,
         method: req.method,
         path: req.path,
-        token
+        ...authLogContext(token)
       })
     );
     res.type("text/plain");
@@ -4319,7 +4375,7 @@ function generateOpenApiSpecs(schemaValidator, serverUrls, serverDescriptions, a
 }
 
 // src/http/telemetry/auditLogger.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var AuditLogger = class {
   _otel;
   constructor(otel) {
@@ -4352,7 +4408,7 @@ var AuditLogger = class {
     if (body === void 0 || body === null || body === "") {
       return "";
     }
-    return createHash("sha256").update(body).digest("hex");
+    return createHash2("sha256").update(body).digest("hex");
   }
 };