@gjermundgaraba/clankerauth-dev 0.6.0 → 0.7.0

package/dist/testing.d.ts

@@ -0,0 +1,40 @@
+/** Claims set on a signed token. Each one overrides this issuer's default. */
+export interface TokenClaims {
+    readonly iss?: string;
+    readonly sub?: string;
+    readonly aud?: string | Array<string>;
+    readonly iat?: number;
+    /** Epoch seconds. Default: five minutes from now. */
+    readonly exp?: number;
+    /** Space-separated, as the wire carries it. */
+    readonly scope?: string;
+    readonly client_id?: string;
+    /** Proof of possession, for checking that a sender-constrained token is refused. */
+    readonly cnf?: {
+        readonly jkt: string;
+    };
+}
+export interface FakeIssuerOptions {
+    /** The resource identifier tokens are minted for: an application's public origin root. */
+    readonly resource: string;
+    /** The scopes a signed token carries unless the caller names its own. */
+    readonly scopes: readonly string[];
+    /** Who every credential belongs to. Default `"owner"`. */
+    readonly subject?: string;
+}
+export interface FakeIssuer {
+    /** What a resource server is configured with: `http://127.0.0.1:<port>/api/auth`. */
+    readonly issuer: string;
+    /** Sign an access token this issuer's JWKS verifies. */
+    readonly sign: (claims?: TokenClaims, typ?: string) => Promise<string>;
+    /** Mint an API key the verification endpoint accepts, granted on one resource. */
+    readonly apiKey: (scopes: readonly string[], resource?: string) => string;
+    /** Stop accepting a minted key, so the next verification answers `401`. */
+    readonly revoke: (key: string) => void;
+    /** Answer both endpoints with this status instead of serving them; omit to restore. */
+    readonly fail: (status?: number) => void;
+    /** API-key verifications served, so a test can see that revocation is checked online. */
+    readonly verifications: () => number;
+    readonly close: () => Promise<void>;
+}
+export declare const startFakeIssuer: (options: FakeIssuerOptions) => Promise<FakeIssuer>;

package/dist/testing.mjs

@@ -0,0 +1 @@
+import{i as e,n as t,t as n}from"./generate_key_pair-ExJspZNk.mjs";import{randomBytes as r}from"node:crypto";import{createServer as i}from"node:http";const a=e=>typeof e==`string`,o=e=>{try{let t=JSON.parse(e);if(!(t instanceof Object)||!(`resource`in t))return;let n=t.resource;return a(n)?n:void 0}catch{return}},s=async a=>{let s=a.subject??`owner`,c=await n(`EdDSA`),l={...await t(c.publicKey),kid:`fixture`,alg:`EdDSA`,use:`sig`},u=/* @__PURE__ */ new Map,d=0,f,p=i(async(e,t)=>{let n=(e,n)=>{t.writeHead(e,{"content-type":`application/json`}),t.end(n)};if(e.url===`/api/auth/jwks`)return n(f??200,JSON.stringify({keys:[l]}));if(e.url!==`/api/issuer/verifyApiKey`||e.method!==`POST`)return n(404,`{}`);if(d++,f!==void 0)return n(f,`{}`);let r=u.get(e.headers.authorization?.replace(/^Bearer /iu,``)??``);if(r===void 0)return n(401,`{"error":"Invalid API key"}`);let i=``;for await(let t of e)i+=String(t);let a=o(i);return a===void 0?n(400,`{"error":"Invalid request"}`):a===r.resource?n(200,JSON.stringify({keyId:r.keyId,ownerId:s,resource:r.resource,scopes:r.scopes,expiresAt:null})):n(403,`{"error":"No access to this Resource"}`)});await new Promise(e=>p.listen(0,`127.0.0.1`,e));let m=p.address();if(!(m instanceof Object))throw Error(`The fake issuer failed to bind a TCP port`);let h=`http://127.0.0.1:${m.port}/api/auth`;return{issuer:h,sign:(t={},n=`at+jwt`)=>{let r=Math.floor(Date.now()/1e3);return new e({iss:h,sub:s,aud:a.resource,iat:r,exp:r+300,client_id:`fixture`,scope:a.scopes.join(` `),...t}).setProtectedHeader({alg:`EdDSA`,kid:`fixture`,typ:n}).sign(c.privateKey)},apiKey:(e,t=a.resource)=>{let n=`ca_${r(24).toString(`base64url`)}`;return u.set(n,{keyId:`key-${u.size+1}`,resource:t,scopes:e}),n},revoke:e=>{u.delete(e)},fail:e=>{f=e},verifications:()=>d,close:()=>new Promise((e,t)=>{p.closeAllConnections(),p.close(n=>n?t(n):e())})}};export{s as startFakeIssuer};