@guardian/pan-domain-node 0.4.1 → 0.5.0

package/.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

package/.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.0.4/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

package/.nvmrc

@@ -1 +1 @@
-8
+v20.18.1

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @guardian/pan-domain-node
+
+## 0.5.0
+
+### Minor Changes
+
+- 01ddac5: Fix bug preventing cookie expiry from being correctly validated

package/dist/src/api.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.guardianValidation = exports.AuthenticationStatus = void 0;
 var panda_1 = require("./panda");
-exports.PanDomainAuthentication = panda_1.PanDomainAuthentication;
+Object.defineProperty(exports, "PanDomainAuthentication", { enumerable: true, get: function () { return panda_1.PanDomainAuthentication; } });
 var AuthenticationStatus;
 (function (AuthenticationStatus) {
     AuthenticationStatus["INVALID_COOKIE"] = "Invalid Cookie";

package/dist/src/fetch-public-key.d.ts

@@ -0,0 +1,5 @@
+export interface PublicKeyHolder {
+    key: string;
+    lastUpdated: Date;
+}
+export declare function fetchPublicKey(region: string, bucket: String, keyFile: String): Promise<PublicKeyHolder>;

package/dist/src/fetch-public-key.js

@@ -0,0 +1,40 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchPublicKey = void 0;
+const iniparser = __importStar(require("iniparser"));
+const utils_1 = require("./utils");
+function fetchPublicKey(region, bucket, keyFile) {
+    const path = `https://s3.${region}.amazonaws.com/${bucket}/${keyFile}`;
+    return utils_1.httpGet(path).then(response => {
+        const config = iniparser.parseString(response);
+        if (config.publicKey) {
+            return {
+                key: utils_1.base64ToPEM(config.publicKey, "PUBLIC"),
+                lastUpdated: new Date()
+            };
+        }
+        else {
+            throw new Error("Missing publicKey setting from config");
+        }
+    });
+}
+exports.fetchPublicKey = fetchPublicKey;

package/dist/src/panda.d.ts

@@ -1,10 +1,8 @@
 /// <reference types="node" />
-import { ValidateUserFn, AuthenticationResult } from './api';
-interface PublicKeyHolder {
-    key: string;
-    lastUpdated: Date;
-}
-export declare function verifyUser(pandaCookie: string | undefined, publicKey: string, currentTimestamp: number, validateUser: ValidateUserFn): AuthenticationResult;
+import { User, AuthenticationResult, ValidateUserFn } from './api';
+import { PublicKeyHolder } from './fetch-public-key';
+export declare function createCookie(user: User, privateKey: string): string;
+export declare function verifyUser(pandaCookie: string | undefined, publicKey: string, currentTime: Date, validateUser: ValidateUserFn): AuthenticationResult;
 export declare class PanDomainAuthentication {
     cookieName: string;
     region: string;
@@ -19,4 +17,3 @@ export declare class PanDomainAuthentication {
     getPublicKey(): Promise<string>;
     verify(requestCookies: string): Promise<AuthenticationResult>;
 }
-export {};

package/dist/src/panda.js

@@ -1,32 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
 var __importStar = (this && this.__importStar) || function (mod) {
     if (mod && mod.__esModule) return mod;
     var result = {};
-    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
-    result["default"] = mod;
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const iniparser = __importStar(require("iniparser"));
+exports.PanDomainAuthentication = exports.verifyUser = exports.createCookie = void 0;
 const cookie = __importStar(require("cookie"));
 const utils_1 = require("./utils");
 const api_1 = require("./api");
-function fetchPublicKey(region, bucket, keyFile) {
-    const path = `https://s3.${region}.amazonaws.com/${bucket}/${keyFile}`;
-    return utils_1.httpGet(path).then(response => {
-        const config = iniparser.parseString(response);
-        if (config.publicKey) {
-            return {
-                key: utils_1.base64ToPEM(config.publicKey),
-                lastUpdated: new Date()
-            };
-        }
-        else {
-            throw new Error("Missing publicKey setting from config");
-        }
-    });
+const fetch_public_key_1 = require("./fetch-public-key");
+function createCookie(user, privateKey) {
+    let queryParams = [];
+    queryParams.push("firstName=" + user.firstName);
+    queryParams.push("lastName=" + user.lastName);
+    queryParams.push("email=" + user.email);
+    user.avatarUrl && queryParams.push("avatarUrl=" + user.avatarUrl);
+    queryParams.push("system=" + user.authenticatingSystem);
+    queryParams.push("authedIn=" + user.authenticatedIn.join(","));
+    queryParams.push("expires=" + user.expires.toString());
+    queryParams.push("multifactor=" + String(user.multifactor));
+    const combined = queryParams.join("&");
+    const queryParamsString = Buffer.from(combined).toString('base64');
+    const signature = utils_1.sign(combined, privateKey);
+    return queryParamsString + "." + signature;
 }
-function verifyUser(pandaCookie, publicKey, currentTimestamp, validateUser) {
+exports.createCookie = createCookie;
+function verifyUser(pandaCookie, publicKey, currentTime, validateUser) {
     if (!pandaCookie) {
         return { status: api_1.AuthenticationStatus.INVALID_COOKIE };
     }
@@ -34,9 +48,10 @@ function verifyUser(pandaCookie, publicKey, currentTimestamp, validateUser) {
     if (!utils_1.verifySignature(data, signature, publicKey)) {
         return { status: api_1.AuthenticationStatus.INVALID_COOKIE };
     }
+    const currentTimestampInMilliseconds = currentTime.getTime();
     try {
         const user = utils_1.parseUser(data);
-        const isExpired = user.expires < currentTimestamp;
+        const isExpired = user.expires < currentTimestampInMilliseconds;
         if (isExpired) {
             return { status: api_1.AuthenticationStatus.EXPIRED, user };
         }
@@ -59,20 +74,21 @@ class PanDomainAuthentication {
         this.bucket = bucket;
         this.keyFile = keyFile;
         this.validateUser = validateUser;
-        this.publicKey = fetchPublicKey(region, bucket, keyFile);
+        this.publicKey = fetch_public_key_1.fetchPublicKey(region, bucket, keyFile);
         this.keyUpdateTimer = setInterval(() => this.getPublicKey(), this.keyCacheTime);
     }
     stop() {
         if (this.keyUpdateTimer) {
             clearInterval(this.keyUpdateTimer);
+            this.keyUpdateTimer = undefined;
         }
     }
     getPublicKey() {
         return this.publicKey.then(({ key, lastUpdated }) => {
             const now = new Date();
-            const diff = now.getMilliseconds() - lastUpdated.getMilliseconds();
+            const diff = now.getTime() - lastUpdated.getTime();
             if (diff > this.keyCacheTime) {
-                this.publicKey = fetchPublicKey(this.region, this.bucket, this.keyFile);
+                this.publicKey = fetch_public_key_1.fetchPublicKey(this.region, this.bucket, this.keyFile);
                 return this.publicKey.then(({ key }) => key);
             }
             else {
@@ -84,8 +100,7 @@ class PanDomainAuthentication {
         return this.getPublicKey().then(publicKey => {
             const cookies = cookie.parse(requestCookies);
             const pandaCookie = cookies[this.cookieName];
-            const now = new Date().getMilliseconds();
-            return verifyUser(pandaCookie, publicKey, now, this.validateUser);
+            return verifyUser(pandaCookie, publicKey, new Date(), this.validateUser);
         });
     }
 }

package/dist/src/utils.d.ts

@@ -11,6 +11,7 @@ export declare function parseCookie(cookie: string): {
  * Verify signed data using nodeJs crypto library
  */
 export declare function verifySignature(message: string, signature: string, pandaPublicKey: string): boolean;
-export declare function base64ToPEM(key: string): string;
+export declare function sign(message: string, privateKey: string): string;
+export declare function base64ToPEM(key: string, headerFooter: string): string;
 export declare function httpGet(path: string): Promise<string>;
 export declare function parseUser(data: string): User;

package/dist/src/utils.js

@@ -1,17 +1,30 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
 var __importStar = (this && this.__importStar) || function (mod) {
     if (mod && mod.__esModule) return mod;
     var result = {};
-    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
-    result["default"] = mod;
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseUser = exports.httpGet = exports.base64ToPEM = exports.sign = exports.verifySignature = exports.parseCookie = exports.decodeBase64 = void 0;
 const crypto = __importStar(require("crypto"));
 const https = __importStar(require("https"));
 const url_1 = require("url");
 function decodeBase64(data) {
-    return (new Buffer(data, 'base64')).toString('utf8');
+    return Buffer.from(data, 'base64').toString('utf8');
 }
 exports.decodeBase64 = decodeBase64;
 /**
@@ -34,12 +47,19 @@ function verifySignature(message, signature, pandaPublicKey) {
         .verify(pandaPublicKey, signature, 'base64');
 }
 exports.verifySignature = verifySignature;
+function sign(message, privateKey) {
+    const sign = crypto.createSign("sha256WithRSAEncryption");
+    sign.write(message);
+    sign.end();
+    return sign.sign(privateKey, 'base64');
+}
+exports.sign = sign;
 const ASCII_NEW_LINE = String.fromCharCode(10);
-const PEM_HEADER = '-----BEGIN PUBLIC KEY-----';
-const PEM_FOOTER = '-----END PUBLIC KEY-----';
-function base64ToPEM(key) {
+function base64ToPEM(key, headerFooter) {
+    const PEM_HEADER = `-----BEGIN ${headerFooter} KEY-----`;
+    const PEM_FOOTER = `-----END ${headerFooter} KEY-----`;
     let tmp = [];
-    const ret = [new Buffer(PEM_HEADER).toString('ascii')];
+    const ret = [Buffer.from(PEM_HEADER).toString('ascii')];
     for (let i = 0, len = key.length; i < len; i++) {
         if (i > 0 && i % 64 === 0) {
             ret.push(tmp.join(''));
@@ -48,7 +68,7 @@ function base64ToPEM(key) {
         tmp.push(key[i]);
     }
     ret.push(tmp.join(''));
-    ret.push(new Buffer(PEM_FOOTER).toString('ascii'));
+    ret.push(Buffer.from(PEM_FOOTER).toString('ascii'));
     return ret.join(ASCII_NEW_LINE);
 }
 exports.base64ToPEM = base64ToPEM;

package/dist/test/fixtures.d.ts

@@ -1,4 +1,5 @@
 export declare const encodedPrivateKey = "MIIJKAIBAAKCAgEAur0hOjhB2QWjwOopCR+Qo27AYv97BJkVaKWPXpj9RfvY1wtpIratDN6tkXN9WCRPzVX8+5qaW034Kvf9WwBZD1ntS8iHYwY1YUaU8Mrp2sRT3K0RqyBlTswIH3HIqpASqv7ZtwDHdhk7Cbd13P5aomJSOjYFhCDUi3sRbjJP1kb6uQLdkZj8fIU518HzSR7Kw7p2mbDqSrGbnaeHWd0Tr3BvDHp9Pi0KpSAVm2qWAXix+BcjMA4ar7kLU1Pre0lt4K4DlSvq5XoHdX9/yvS6KGf+8pXDR9bY6dgRPSG4mzKpiKfkv1eXE8WKs0q3217QZItaSjocw4d0o47vSN+/MAh9V5Zewyb6ogs8JicX3Y3FPG29I1g8iLf3kBZ7V4mUimGuOq/L+1YVvyOTb2zWWMjNmECO2lrxXJc5LWRs5FmSJyCdilRktDE0WTGUo89O+DcF2752qtpUmlV2fllU1LXIAn0TJKiAZspKakamifrgYFIzZK4oZ8wDeFesQB/a/U7wtyv85vknzCtMLI28dnpGQ/ZFHNqWYVaHoHsnEmWion7lgMctnpY5pwKFfUSfZecl2Xqwjk1HZj71A9TFNQj+/x4z957cNtx+utAkGinK3eZF+H1o5YnSgjg4hN41kbXttk8nADerPdF7hDS6np7xzUl6qOicJhEOJ5x0c18CAwEAAQKCAgAFEDXDb10Rtl5vT6oXLjzswYcD6Ct8v23eLYcKqJlNeXuysQODxnJAxBTuubPvXOSxC6DVbaa7zQxqldjPy92eVfDiOii5naR648AMG2Rl4ybm9+Zfvnwgu9WIjLxFK6zl6A0dMi82W47HP6s5d8gbWREjtO1HXOCGe6rIUyLpC3mm5JX/aaeG9NHRsNeY5vXWgsrOdgaUSeaPSsiXvi/XdPP94aBdvDjqq0kKssQofA5PTMlOd0Nv+lN9Sew7po0NJ4q/U7aFzF5BaFidty8JA3DdQQRPgVrWVF57StvHkYMZSnwgWA6noZaWL/N2RkbeQw0KsDKxdo3KFYkVb8OuTN68b3J5sKIo48LaDbfWbuThcdUFdpKXUd6lvJ2vCnbN6e1fzJdjpCNg9mb2g8KnSW9xqXek8cx0b+LNh+p/YDUI/BZDfsXjeqODiGEruYWfaYiL4STOOXIq5SoyP6XEDbX41UHcb/P3pJExBB7R6fpUFREUd0tUAQAQ93YUitWIs8U1tVAB9/qaUO6BFgOghrbswUiX4twVdmqhrBVOcYUImu7LUdcpMLIdR/gyy47w8xEhiv/oudWVx7rkJS4+l949KtUmyd5x+MNT7nAF99eSIv3iNpL6eS7OWiak5gfoVATy0shNd48H62mGtYjfoGzndGE26tNCHXoAkTrbQQKCAQEA47QXH0Y5xbnq8rlqukwVt+EDMJUtZBqfxGDnkDmtfGefxiyE1VLb+Q0Z1es3lxjcmb1Qupl9tjrWeejK2QymSOzPaluOTpIFOZbFqzNha68nONoiWjqwkCg7VvTo0mRKLwSEnCrCOB8HiLKQAhirdPwtW/8PLd+B8HZSB3UKFylbT+ghHIz5b4P81GksRGbsb6g3+ipz53mvtJpe77J7Y84wPQppj6Ry0WjsQr4iv2hF5PWNMhHVDj8eO80DJvWRCFVTWqTE3WYxZJ/5jdeOdVTwtrYghP72X0zAnVpQCVzcn8tLghKsfePhCw3zNtFE3dk4XHQD4uhPU88GtxJ3vwKCAQEA0fHVZmW8EwxYUEzhFl+2J4evszh8R2Sga+LHv4hy2qGydiciVnv4Y/IoScc0IQ+YHoj9fNad+/UoR8ctSBgrPDzeiY/7ldSp/j5Tbqb4h3Ioaqf9uNg7qHpnciz1o8AI8fFelXZ5hA8GuXo8VGy60xMCyapjkLzTXshdRPjUzcLX1PrUy+me4ZR/KdIkqOOmzgvBVII3gb0iN70gTqn2HSIUC3yMiXA+X6OkHoDL7tn8tkF/aD+uenxOvOadsoJPtaFPaMD0X5vJ8LIjsBThAncVApx93XJIdkJm2ffXq2JhQJfZ6ZXypa6ooepzmB58kxA+TZiJpQLLQJ17xC/sYQKCAQBwuzJPW3cyuw7kyINcZFrERHRN0y07yCqdENTUBJotYygo9tV0v6cEMEZAMEm/VqGww5d6Ko+gbpTMmkIDH04cAJHXuChGIejQUCLg1Xk/1OF4NhaX0UKkvCZUsL+rmddYW8ZDgq/RFRunw6+kOg54xni2eRpMvcEZCZsm8fzi5qi8cNIjzm+XlCLSDpfJ7aLUzNWZ1va2/PnOUjb6OMT57pTXQ5ZrdSEbJ/UAPh354WfpKOCUj1uJyBnxxVfwK9d35rZzw+trKTL+/GySmst+r2TVMGn9LjVPjTI3NQU2/XCE9CMX7KLVWMKLtIZa91Q++VH8A7wA1L6hYXeTn2MFAoIBAEb5xvdTNX4LEmAzXXU+7kn26UNhuUI5lrJifL0X2BxpxfeDy2wJhTPkzhIDMnBq4TaRgYEO3WIsw21gvMI+yX8X5PQEpT1GJCI71+D0udiwk1Fbcb9n+uM+XnKPGIw/g8annx5Qa0xl+BQEaxjvmUl6h9q9q+Nmst68RivnI6pcULNECWTWmkwQ89yjmpkuPVozRyzWyQUnd8X4Pk/ZzcaTmss3VBuywqN6oyVczZT2RSUoh3Yq8UWfeM8L+Aw9Wc1Bt6LmeLdJ579jugTxShCXSZcUaMjQtgak9DiEPXlHTTGVJKp/cwToQ0JaDLJEvEDLoQSCqSYMB8LUet8chIECggEBANxvUJxCLbx4CZrUJC5O2w01GMDFdTfYOUcK75pFAbXkpBPXDLsuz2dK1y8ANk3ibWWrlV6YKDUwl+gWDHmJOcvKqKKAeUnrhIMmJGaO6C++5DxPE/n7g5M86GA0bu/+B+32wL/65B8HoJrkHnSMJp9GcCsVZA3+2xcJfo+xAiXeiRobRIxCQMYCDDM7Hr7X5jGa7l9bQr4GuWRKRYTroE9LCDnH/LLUN+0ny3UXrSjtTUVL4mVAJT0Ws2H1zUzVDbu7ZQgA0u3GjtdFvAnS/E+ln8DS3Q1DeD6Zsf0hrrJbtwU4zZIU445SZ+IUaTjueB9v/skukoIQi/0Mj+gpZ1c=";
+export declare const privateKey: string;
 export declare const encodedPublicKey = "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAur0hOjhB2QWjwOopCR+Qo27AYv97BJkVaKWPXpj9RfvY1wtpIratDN6tkXN9WCRPzVX8+5qaW034Kvf9WwBZD1ntS8iHYwY1YUaU8Mrp2sRT3K0RqyBlTswIH3HIqpASqv7ZtwDHdhk7Cbd13P5aomJSOjYFhCDUi3sRbjJP1kb6uQLdkZj8fIU518HzSR7Kw7p2mbDqSrGbnaeHWd0Tr3BvDHp9Pi0KpSAVm2qWAXix+BcjMA4ar7kLU1Pre0lt4K4DlSvq5XoHdX9/yvS6KGf+8pXDR9bY6dgRPSG4mzKpiKfkv1eXE8WKs0q3217QZItaSjocw4d0o47vSN+/MAh9V5Zewyb6ogs8JicX3Y3FPG29I1g8iLf3kBZ7V4mUimGuOq/L+1YVvyOTb2zWWMjNmECO2lrxXJc5LWRs5FmSJyCdilRktDE0WTGUo89O+DcF2752qtpUmlV2fllU1LXIAn0TJKiAZspKakamifrgYFIzZK4oZ8wDeFesQB/a/U7wtyv85vknzCtMLI28dnpGQ/ZFHNqWYVaHoHsnEmWion7lgMctnpY5pwKFfUSfZecl2Xqwjk1HZj71A9TFNQj+/x4z957cNtx+utAkGinK3eZF+H1o5YnSgjg4hN41kbXttk8nADerPdF7hDS6np7xzUl6qOicJhEOJ5x0c18CAwEAAQ==";
 export declare const publicKey: string;
 export declare const sampleCookie = "Zmlyc3ROYW1lPVRlc3QmbGFzdE5hbWU9VXNlciZlbWFpbD10ZXN0LnVzZXJAZ3VhcmRpYW4uY28udWsmc3lzdGVtPXRlc3QmYXV0aGVkSW49dGVzdCZleHBpcmVzPTEyMzQmbXVsdGlmYWN0b3I9dHJ1ZQ==.tDQmAb1HaXzrEaLQKK3xLtICoQm6R/8eFbjISe7IHggNOzdnypnPZKXiWXqYbC22ROL0i0e+iUWHc7icEfAO6LXv5PwTQuvI8i/q8IE5Vp+/8S319dvNOyivXiLAdTBIvqjPF0ue4Cj0j3uWMU/n0A54qtX7PDJJSDdYmRRbDN/FsmnEslqBGCDSzMTkNhPBBXcndn2YXLTnMv0vmZbRJxyygRfV3rvy6vzU4NqaIMkvSu3vd0Pqj75B9IAG0epSvC36ysAUrvhYSWcWMj8sv0oh0lWuo1Ilu5Vu+8oJ5eEr82ZqALT9o+8dP7h4NGtRNkgP81y2RtK68eDWCpOKp2JXwrvb+F7QInEsZcatEr2aKioCsaszNt5tH0FtVVuwZ+Ul6Fsu2hZG84a1pTq34zsxh0WafYTciAOmoMvQQcZSKpJc9GfxtBQo6lq9X7TPIG4flNyWS7GD61p9q8pqG5wgtandG9lIueEJLSsMOPkhGfBs/WOfLs1ftquwqt14q985twBw3k6yvMBcVB9pPdm0h/6vcLF4GwZekHiFhOmyguU7FLaDfHL+TIHSPlCy1iCtE9BmIU0g0e2RRN4bDMT6PrLPN+fx34/2dlonGHnDyQw794G0NOBKUtxsaw6dx60yv/J19dau91qyGfTMb4nXmehm8/B78y/RecveWgI=";

package/dist/test/fixtures.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sampleNonGuardianCookie = exports.sampleCookieWithoutMultifactor = exports.sampleCookie = exports.publicKey = exports.encodedPublicKey = exports.privateKey = exports.encodedPrivateKey = void 0;
 const utils_1 = require("../src/utils");
-// The private key is not required by the node module as it can only verify cookies, not generate them
-// I've included it here however so we can use it to generate new cookie data for future tests
 exports.encodedPrivateKey = "MIIJKAIBAAKCAgEAur0hOjhB2QWjwOopCR+Qo27AYv97BJkVaKWPXpj9RfvY1wtpIratDN6tkXN9WCRPzVX8+5qaW034Kvf9WwBZD1ntS8iHYwY1YUaU8Mrp2sRT3K0RqyBlTswIH3HIqpASqv7ZtwDHdhk7Cbd13P5aomJSOjYFhCDUi3sRbjJP1kb6uQLdkZj8fIU518HzSR7Kw7p2mbDqSrGbnaeHWd0Tr3BvDHp9Pi0KpSAVm2qWAXix+BcjMA4ar7kLU1Pre0lt4K4DlSvq5XoHdX9/yvS6KGf+8pXDR9bY6dgRPSG4mzKpiKfkv1eXE8WKs0q3217QZItaSjocw4d0o47vSN+/MAh9V5Zewyb6ogs8JicX3Y3FPG29I1g8iLf3kBZ7V4mUimGuOq/L+1YVvyOTb2zWWMjNmECO2lrxXJc5LWRs5FmSJyCdilRktDE0WTGUo89O+DcF2752qtpUmlV2fllU1LXIAn0TJKiAZspKakamifrgYFIzZK4oZ8wDeFesQB/a/U7wtyv85vknzCtMLI28dnpGQ/ZFHNqWYVaHoHsnEmWion7lgMctnpY5pwKFfUSfZecl2Xqwjk1HZj71A9TFNQj+/x4z957cNtx+utAkGinK3eZF+H1o5YnSgjg4hN41kbXttk8nADerPdF7hDS6np7xzUl6qOicJhEOJ5x0c18CAwEAAQKCAgAFEDXDb10Rtl5vT6oXLjzswYcD6Ct8v23eLYcKqJlNeXuysQODxnJAxBTuubPvXOSxC6DVbaa7zQxqldjPy92eVfDiOii5naR648AMG2Rl4ybm9+Zfvnwgu9WIjLxFK6zl6A0dMi82W47HP6s5d8gbWREjtO1HXOCGe6rIUyLpC3mm5JX/aaeG9NHRsNeY5vXWgsrOdgaUSeaPSsiXvi/XdPP94aBdvDjqq0kKssQofA5PTMlOd0Nv+lN9Sew7po0NJ4q/U7aFzF5BaFidty8JA3DdQQRPgVrWVF57StvHkYMZSnwgWA6noZaWL/N2RkbeQw0KsDKxdo3KFYkVb8OuTN68b3J5sKIo48LaDbfWbuThcdUFdpKXUd6lvJ2vCnbN6e1fzJdjpCNg9mb2g8KnSW9xqXek8cx0b+LNh+p/YDUI/BZDfsXjeqODiGEruYWfaYiL4STOOXIq5SoyP6XEDbX41UHcb/P3pJExBB7R6fpUFREUd0tUAQAQ93YUitWIs8U1tVAB9/qaUO6BFgOghrbswUiX4twVdmqhrBVOcYUImu7LUdcpMLIdR/gyy47w8xEhiv/oudWVx7rkJS4+l949KtUmyd5x+MNT7nAF99eSIv3iNpL6eS7OWiak5gfoVATy0shNd48H62mGtYjfoGzndGE26tNCHXoAkTrbQQKCAQEA47QXH0Y5xbnq8rlqukwVt+EDMJUtZBqfxGDnkDmtfGefxiyE1VLb+Q0Z1es3lxjcmb1Qupl9tjrWeejK2QymSOzPaluOTpIFOZbFqzNha68nONoiWjqwkCg7VvTo0mRKLwSEnCrCOB8HiLKQAhirdPwtW/8PLd+B8HZSB3UKFylbT+ghHIz5b4P81GksRGbsb6g3+ipz53mvtJpe77J7Y84wPQppj6Ry0WjsQr4iv2hF5PWNMhHVDj8eO80DJvWRCFVTWqTE3WYxZJ/5jdeOdVTwtrYghP72X0zAnVpQCVzcn8tLghKsfePhCw3zNtFE3dk4XHQD4uhPU88GtxJ3vwKCAQEA0fHVZmW8EwxYUEzhFl+2J4evszh8R2Sga+LHv4hy2qGydiciVnv4Y/IoScc0IQ+YHoj9fNad+/UoR8ctSBgrPDzeiY/7ldSp/j5Tbqb4h3Ioaqf9uNg7qHpnciz1o8AI8fFelXZ5hA8GuXo8VGy60xMCyapjkLzTXshdRPjUzcLX1PrUy+me4ZR/KdIkqOOmzgvBVII3gb0iN70gTqn2HSIUC3yMiXA+X6OkHoDL7tn8tkF/aD+uenxOvOadsoJPtaFPaMD0X5vJ8LIjsBThAncVApx93XJIdkJm2ffXq2JhQJfZ6ZXypa6ooepzmB58kxA+TZiJpQLLQJ17xC/sYQKCAQBwuzJPW3cyuw7kyINcZFrERHRN0y07yCqdENTUBJotYygo9tV0v6cEMEZAMEm/VqGww5d6Ko+gbpTMmkIDH04cAJHXuChGIejQUCLg1Xk/1OF4NhaX0UKkvCZUsL+rmddYW8ZDgq/RFRunw6+kOg54xni2eRpMvcEZCZsm8fzi5qi8cNIjzm+XlCLSDpfJ7aLUzNWZ1va2/PnOUjb6OMT57pTXQ5ZrdSEbJ/UAPh354WfpKOCUj1uJyBnxxVfwK9d35rZzw+trKTL+/GySmst+r2TVMGn9LjVPjTI3NQU2/XCE9CMX7KLVWMKLtIZa91Q++VH8A7wA1L6hYXeTn2MFAoIBAEb5xvdTNX4LEmAzXXU+7kn26UNhuUI5lrJifL0X2BxpxfeDy2wJhTPkzhIDMnBq4TaRgYEO3WIsw21gvMI+yX8X5PQEpT1GJCI71+D0udiwk1Fbcb9n+uM+XnKPGIw/g8annx5Qa0xl+BQEaxjvmUl6h9q9q+Nmst68RivnI6pcULNECWTWmkwQ89yjmpkuPVozRyzWyQUnd8X4Pk/ZzcaTmss3VBuywqN6oyVczZT2RSUoh3Yq8UWfeM8L+Aw9Wc1Bt6LmeLdJ579jugTxShCXSZcUaMjQtgak9DiEPXlHTTGVJKp/cwToQ0JaDLJEvEDLoQSCqSYMB8LUet8chIECggEBANxvUJxCLbx4CZrUJC5O2w01GMDFdTfYOUcK75pFAbXkpBPXDLsuz2dK1y8ANk3ibWWrlV6YKDUwl+gWDHmJOcvKqKKAeUnrhIMmJGaO6C++5DxPE/n7g5M86GA0bu/+B+32wL/65B8HoJrkHnSMJp9GcCsVZA3+2xcJfo+xAiXeiRobRIxCQMYCDDM7Hr7X5jGa7l9bQr4GuWRKRYTroE9LCDnH/LLUN+0ny3UXrSjtTUVL4mVAJT0Ws2H1zUzVDbu7ZQgA0u3GjtdFvAnS/E+ln8DS3Q1DeD6Zsf0hrrJbtwU4zZIU445SZ+IUaTjueB9v/skukoIQi/0Mj+gpZ1c=";
+exports.privateKey = utils_1.base64ToPEM(exports.encodedPrivateKey, "RSA PRIVATE");
 exports.encodedPublicKey = "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAur0hOjhB2QWjwOopCR+Qo27AYv97BJkVaKWPXpj9RfvY1wtpIratDN6tkXN9WCRPzVX8+5qaW034Kvf9WwBZD1ntS8iHYwY1YUaU8Mrp2sRT3K0RqyBlTswIH3HIqpASqv7ZtwDHdhk7Cbd13P5aomJSOjYFhCDUi3sRbjJP1kb6uQLdkZj8fIU518HzSR7Kw7p2mbDqSrGbnaeHWd0Tr3BvDHp9Pi0KpSAVm2qWAXix+BcjMA4ar7kLU1Pre0lt4K4DlSvq5XoHdX9/yvS6KGf+8pXDR9bY6dgRPSG4mzKpiKfkv1eXE8WKs0q3217QZItaSjocw4d0o47vSN+/MAh9V5Zewyb6ogs8JicX3Y3FPG29I1g8iLf3kBZ7V4mUimGuOq/L+1YVvyOTb2zWWMjNmECO2lrxXJc5LWRs5FmSJyCdilRktDE0WTGUo89O+DcF2752qtpUmlV2fllU1LXIAn0TJKiAZspKakamifrgYFIzZK4oZ8wDeFesQB/a/U7wtyv85vknzCtMLI28dnpGQ/ZFHNqWYVaHoHsnEmWion7lgMctnpY5pwKFfUSfZecl2Xqwjk1HZj71A9TFNQj+/x4z957cNtx+utAkGinK3eZF+H1o5YnSgjg4hN41kbXttk8nADerPdF7hDS6np7xzUl6qOicJhEOJ5x0c18CAwEAAQ==";
-exports.publicKey = utils_1.base64ToPEM(exports.encodedPublicKey);
+exports.publicKey = utils_1.base64ToPEM(exports.encodedPublicKey, "PUBLIC");
 // The comments above each fixture are the Scala case classe representation used to generate the encoded cookie
 /*
     val user = AuthenticatedUser(

package/dist/test/panda.test.js

@@ -1,24 +1,114 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const api_1 = require("../src/api");
 const panda_1 = require("../src/panda");
+const fetch_public_key_1 = require("../src/fetch-public-key");
 const fixtures_1 = require("./fixtures");
-test("return invalid cookie if missing", () => {
-    expect(panda_1.verifyUser(undefined, "", 0, api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.INVALID_COOKIE);
+const utils_1 = require("../src/utils");
+jest.mock('../src/fetch-public-key');
+jest.useFakeTimers('modern');
+describe('verifyUser', function () {
+    test("return invalid cookie if missing", () => {
+        expect(panda_1.verifyUser(undefined, "", new Date(0), api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.INVALID_COOKIE);
+    });
+    test("return invalid cookie for a malformed signature", () => {
+        const [data, signature] = fixtures_1.sampleCookie.split(".");
+        const testCookie = data + ".1234";
+        expect(panda_1.verifyUser(testCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.INVALID_COOKIE);
+    });
+    test("return expired", () => {
+        const someTimeInTheFuture = new Date(5678);
+        expect(someTimeInTheFuture.getTime()).toBe(5678);
+        expect(panda_1.verifyUser(fixtures_1.sampleCookie, fixtures_1.publicKey, someTimeInTheFuture, api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.EXPIRED);
+    });
+    test("return not authenticated if user fails validation function", () => {
+        expect(panda_1.verifyUser(fixtures_1.sampleCookieWithoutMultifactor, fixtures_1.publicKey, new Date(0), api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.NOT_AUTHORISED);
+        expect(panda_1.verifyUser(fixtures_1.sampleNonGuardianCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.NOT_AUTHORISED);
+    });
+    test("return authenticated", () => {
+        expect(panda_1.verifyUser(fixtures_1.sampleCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.AUTHORISED);
+    });
 });
-test("return invalid cookie for a malformed signature", () => {
-    const [data, signature] = fixtures_1.sampleCookie.split(".");
-    const testCookie = data + ".1234";
-    expect(panda_1.verifyUser(testCookie, fixtures_1.publicKey, 0, api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.INVALID_COOKIE);
+describe('createCookie', function () {
+    it('should return the same cookie based on the user details being provided', function () {
+        const user = {
+            firstName: "Test",
+            lastName: "User",
+            email: "test.user@guardian.co.uk",
+            authenticatingSystem: "test",
+            authenticatedIn: ["test"],
+            expires: 1234,
+            multifactor: true
+        };
+        const cookie = panda_1.createCookie(user, fixtures_1.privateKey);
+        expect(utils_1.decodeBase64(cookie)).toEqual(utils_1.decodeBase64(fixtures_1.sampleCookie));
+        expect(cookie).toEqual(fixtures_1.sampleCookie);
+    });
 });
-test("return expired", () => {
-    const someTimeInTheFuture = 5678;
-    expect(panda_1.verifyUser(fixtures_1.sampleCookie, fixtures_1.publicKey, someTimeInTheFuture, api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.EXPIRED);
-});
-test("return not authenticated if user fails validation function", () => {
-    expect(panda_1.verifyUser(fixtures_1.sampleCookieWithoutMultifactor, fixtures_1.publicKey, 0, api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.NOT_AUTHORISED);
-    expect(panda_1.verifyUser(fixtures_1.sampleNonGuardianCookie, fixtures_1.publicKey, 0, api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.NOT_AUTHORISED);
-});
-test("return authenticated", () => {
-    expect(panda_1.verifyUser(fixtures_1.sampleCookie, fixtures_1.publicKey, 0, api_1.guardianValidation).status).toBe(api_1.AuthenticationStatus.AUTHORISED);
+describe('panda class', function () {
+    beforeEach(() => {
+        fetch_public_key_1.fetchPublicKey.mockResolvedValue({ key: 'PUBLIC KEY', lastUpdated: new Date() });
+    });
+    describe('stop', () => {
+        it('stops auto refresh', () => {
+            const panda = new panda_1.PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u) => true);
+            expect(panda.keyUpdateTimer).not.toBeUndefined();
+            panda.stop();
+            expect(panda.keyUpdateTimer).toBeUndefined();
+        });
+    });
+    describe('getPublicKey', () => {
+        it('getsPublicKey immediately when last fetch is within the cache time', () => __awaiter(this, void 0, void 0, function* () {
+            const panda = new panda_1.PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u) => true);
+            const fetchesBeforeGet = fetch_public_key_1.fetchPublicKey.mock.calls.length;
+            yield expect(panda.getPublicKey()).resolves.toEqual('PUBLIC KEY');
+            const fetchesAfterGet = fetch_public_key_1.fetchPublicKey.mock.calls.length;
+            expect(fetchesAfterGet).toEqual(fetchesBeforeGet);
+        }));
+        it('getsPublicKey after refetching when last fetch is outside the cache time', () => __awaiter(this, void 0, void 0, function* () {
+            // cache time is 1 min
+            const fiveMinsAgo = new Date();
+            fiveMinsAgo.setMinutes(fiveMinsAgo.getMinutes() - 5);
+            fetch_public_key_1.fetchPublicKey.mockResolvedValue({ key: 'PUBLIC KEY', lastUpdated: fiveMinsAgo });
+            const panda = new panda_1.PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u) => true);
+            const fetchesBefore = fetch_public_key_1.fetchPublicKey.mock.calls.length;
+            yield expect(panda.getPublicKey()).resolves.toEqual('PUBLIC KEY');
+            fetch_public_key_1.fetchPublicKey.mockResolvedValue({ key: 'PUBLIC KEY 2', lastUpdated: fiveMinsAgo });
+            const fetchesAfter = fetch_public_key_1.fetchPublicKey.mock.calls.length;
+            yield expect(panda.getPublicKey()).resolves.toEqual('PUBLIC KEY 2');
+            expect(fetchesAfter).toEqual(fetchesBefore + 1);
+        }));
+    });
+    describe('verify', () => {
+        beforeEach(() => {
+            fetch_public_key_1.fetchPublicKey.mockResolvedValue({ key: fixtures_1.publicKey, lastUpdated: new Date() });
+        });
+        it('should return authenticated if valid', () => __awaiter(this, void 0, void 0, function* () {
+            jest.setSystemTime(100);
+            const panda = new panda_1.PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u) => true);
+            const { status } = yield panda.verify(`cookiename=${fixtures_1.sampleCookie}`);
+            expect(status).toBe(api_1.AuthenticationStatus.AUTHORISED);
+        }));
+        it('should return expired if expired', () => __awaiter(this, void 0, void 0, function* () {
+            jest.setSystemTime(10000);
+            const panda = new panda_1.PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u) => true);
+            const { status } = yield panda.verify(`cookiename=${fixtures_1.sampleCookie}`);
+            expect(status).toBe(api_1.AuthenticationStatus.EXPIRED);
+        }));
+        it('should return not authenticated if validation fails', () => __awaiter(this, void 0, void 0, function* () {
+            jest.setSystemTime(100);
+            const panda = new panda_1.PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', api_1.guardianValidation);
+            const { status } = yield panda.verify(`cookiename=${fixtures_1.sampleNonGuardianCookie}`);
+            expect(status).toBe(api_1.AuthenticationStatus.NOT_AUTHORISED);
+        }));
+    });
 });

package/jest.config.js

@@ -3,6 +3,7 @@ module.exports = {
     "<rootDir>/src",
     "<rootDir>/test"
   ],
+  "clearMocks": true,
   "transform": {
     "^.+\\.tsx?$": "ts-jest"
   },
@@ -15,4 +16,4 @@ module.exports = {
     "json",
     "node"
   ],
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guardian/pan-domain-node",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "NodeJs implementation of Guardian pan-domain auth verification",
   "main": "dist/src/api.js",
   "types": "dist/src/api.d.ts",
@@ -22,16 +22,17 @@
   },
   "homepage": "https://github.com/guardian/pan-domain-authentication",
   "devDependencies": {
-    "@types/cookie": "^0.3.2",
+    "@changesets/cli": "^2.27.10",
+    "@types/cookie": "^0.4.0",
     "@types/iniparser": "0.0.29",
-    "@types/jest": "^24.0.9",
-    "@types/node": "^11.10.5",
-    "jest": "^24.3.1",
-    "ts-jest": "^24.0.0",
-    "typescript": "^3.3.3333"
+    "@types/jest": "^26.0.9",
+    "@types/node": "^14.0.27",
+    "jest": "^26.2.2",
+    "ts-jest": "^26.1.4",
+    "typescript": "^3.9.7"
   },
   "dependencies": {
-    "cookie": "^0.3.1",
+    "cookie": "^0.4.1",
     "iniparser": "^1.0.5"
   },
   "scripts": {

package/src/fetch-public-key.ts

@@ -0,0 +1,27 @@
+import * as iniparser from 'iniparser';
+import {base64ToPEM, httpGet} from './utils';
+
+export interface PublicKeyHolder {
+    key: string,
+    lastUpdated: Date
+}
+
+
+export function fetchPublicKey(region: string, bucket: String, keyFile: String): Promise<PublicKeyHolder> {
+    const path = `https://s3.${region}.amazonaws.com/${bucket}/${keyFile}`;
+
+    return httpGet(path).then(response => {
+        const config: { publicKey?: string} = iniparser.parseString(response);
+
+        if(config.publicKey) {
+            return {
+                key: base64ToPEM(config.publicKey, "PUBLIC"),
+                lastUpdated: new Date()
+            };
+        } else {
+            throw new Error("Missing publicKey setting from config");
+        }
+    });
+}
+
+

package/src/panda.ts

@@ -1,32 +1,30 @@
-import * as iniparser from 'iniparser';
 import * as cookie from 'cookie';
 
-import { httpGet, base64ToPEM, parseCookie, verifySignature, parseUser } from './utils';
-import { ValidateUserFn, AuthenticationStatus, User, AuthenticationResult } from './api';
+import {parseCookie, parseUser, sign, verifySignature} from './utils';
+import {AuthenticationStatus, User, AuthenticationResult, ValidateUserFn} from './api';
+import { fetchPublicKey, PublicKeyHolder } from './fetch-public-key';
 
-interface PublicKeyHolder {
-    key: string,
-    lastUpdated: Date
-}
+export function createCookie(user: User, privateKey: string): string {
+    let queryParams: string[] = [];
 
-function fetchPublicKey(region: string, bucket: String, keyFile: String): Promise<PublicKeyHolder> {
-    const path = `https://s3.${region}.amazonaws.com/${bucket}/${keyFile}`;
-
-    return httpGet(path).then(response => {
-        const config: { publicKey?: string} = iniparser.parseString(response);
-        
-        if(config.publicKey) {
-            return {
-                key: base64ToPEM(config.publicKey),
-                lastUpdated: new Date()
-            };
-        } else {
-            throw new Error("Missing publicKey setting from config");
-        }
-    });
+    queryParams.push("firstName=" + user.firstName);
+    queryParams.push("lastName=" + user.lastName);
+    queryParams.push("email=" + user.email);
+    user.avatarUrl && queryParams.push("avatarUrl=" + user.avatarUrl);
+    queryParams.push("system=" + user.authenticatingSystem);
+    queryParams.push("authedIn=" + user.authenticatedIn.join(","));
+    queryParams.push("expires=" + user.expires.toString());
+    queryParams.push("multifactor=" + String(user.multifactor));
+    const combined = queryParams.join("&");
+
+    const queryParamsString = Buffer.from(combined).toString('base64');
+
+    const signature = sign(combined, privateKey);
+
+    return queryParamsString + "." + signature
 }
 
-export function verifyUser(pandaCookie: string | undefined, publicKey: string, currentTimestamp: number, validateUser: ValidateUserFn): AuthenticationResult {
+export function verifyUser(pandaCookie: string | undefined, publicKey: string, currentTime: Date, validateUser: ValidateUserFn): AuthenticationResult {
     if(!pandaCookie) {
         return { status: AuthenticationStatus.INVALID_COOKIE };
     }
@@ -37,9 +35,11 @@ export function verifyUser(pandaCookie: string | undefined, publicKey: string, c
         return { status: AuthenticationStatus.INVALID_COOKIE };
     }
 
+    const currentTimestampInMilliseconds = currentTime.getTime();
+
     try {
         const user: User = parseUser(data);
-        const isExpired = user.expires < currentTimestamp;
+        const isExpired = user.expires < currentTimestampInMilliseconds;
 
         if(isExpired) {
             return { status: AuthenticationStatus.EXPIRED, user };
@@ -65,7 +65,7 @@ export class PanDomainAuthentication {
 
     publicKey: Promise<PublicKeyHolder>;
     keyCacheTime: number = 60 * 1000; // 1 minute
-    keyUpdateTimer?: NodeJS.Timeout
+    keyUpdateTimer?: NodeJS.Timeout;
 
     constructor(cookieName: string, region: string, bucket: string, keyFile: string, validateUser: ValidateUserFn) {
         this.cookieName = cookieName;
@@ -75,20 +75,21 @@ export class PanDomainAuthentication {
         this.validateUser = validateUser;
 
         this.publicKey = fetchPublicKey(region, bucket, keyFile);
-        
+
         this.keyUpdateTimer = setInterval(() => this.getPublicKey(), this.keyCacheTime);
     }
 
     stop(): void {
         if(this.keyUpdateTimer) {
             clearInterval(this.keyUpdateTimer);
+            this.keyUpdateTimer = undefined;
         }
     }
 
     getPublicKey(): Promise<string> {
         return this.publicKey.then(({ key, lastUpdated }) => {
             const now = new Date();
-            const diff = now.getMilliseconds() - lastUpdated.getMilliseconds();
+            const diff = now.getTime() - lastUpdated.getTime();
 
             if(diff > this.keyCacheTime) {
                 this.publicKey = fetchPublicKey(this.region, this.bucket, this.keyFile);
@@ -104,8 +105,7 @@ export class PanDomainAuthentication {
             const cookies = cookie.parse(requestCookies);
             const pandaCookie = cookies[this.cookieName];
 
-            const now = new Date().getMilliseconds();
-            return verifyUser(pandaCookie, publicKey, now, this.validateUser);
+            return verifyUser(pandaCookie, publicKey, new Date(), this.validateUser);
         });
     }
-}
+}

package/src/utils.ts

@@ -1,11 +1,11 @@
 import * as crypto from 'crypto';
 import * as https from 'https';
 
-import { User } from './api';
-import { URLSearchParams } from 'url';
+import {User} from './api';
+import {URLSearchParams} from 'url';
 
 export function decodeBase64(data: string): string {
-    return (new Buffer(data, 'base64')).toString('utf8');
+    return Buffer.from(data, 'base64').toString('utf8');
 }
 
 /**
@@ -28,13 +28,22 @@ export function verifySignature(message: string, signature: string, pandaPublicK
         .verify(pandaPublicKey, signature, 'base64');
 }
 
+export function sign(message: string, privateKey: string): string {
+    const sign = crypto.createSign("sha256WithRSAEncryption");
+    sign.write(message);
+    sign.end();
+
+    return sign.sign(privateKey, 'base64');
+}
+
 const ASCII_NEW_LINE = String.fromCharCode(10);
-const PEM_HEADER = '-----BEGIN PUBLIC KEY-----';
-const PEM_FOOTER = '-----END PUBLIC KEY-----';
 
-export function base64ToPEM (key: string): string {
+export function base64ToPEM (key: string, headerFooter: string): string {
+    const PEM_HEADER = `-----BEGIN ${headerFooter} KEY-----`;
+    const PEM_FOOTER = `-----END ${headerFooter} KEY-----`;
+
 	let tmp = [];
-    const ret = [new Buffer(PEM_HEADER).toString('ascii')];
+    const ret = [Buffer.from(PEM_HEADER).toString('ascii')];
 
     for (let i = 0, len = key.length; i < len; i++) {
 
@@ -47,7 +56,7 @@ export function base64ToPEM (key: string): string {
     }
 
     ret.push(tmp.join(''));
-    ret.push(new Buffer(PEM_FOOTER).toString('ascii'));
+    ret.push(Buffer.from(PEM_FOOTER).toString('ascii'));
 
     return ret.join(ASCII_NEW_LINE);
 }
@@ -61,7 +70,7 @@ export function httpGet(path: string): Promise<string> {
             res.on('error', err => reject(err));
 
             res.on('end', () => {
-                const body = data.join(''); 
+                const body = data.join('');
 
                 if(res.statusCode == 200) {
                     resolve(body);
@@ -69,7 +78,7 @@ export function httpGet(path: string): Promise<string> {
                     // Response might be XML
                     const match = body.match(/<message>(.*)<\/message>/i);
                     const error = new Error(match ? match[1] : 'Invalid public key response');
-                    
+
                     reject(error);
                 }
             });
@@ -117,4 +126,4 @@ export function parseUser(data: string): User {
         expires: numberField("expires"),
         multifactor: booleanField("multifactor")
     };
-}
+}

package/test/fixtures.ts

@@ -1,11 +1,10 @@
 import { base64ToPEM } from '../src/utils';
 
-// The private key is not required by the node module as it can only verify cookies, not generate them
-// I've included it here however so we can use it to generate new cookie data for future tests
 export const encodedPrivateKey = "MIIJKAIBAAKCAgEAur0hOjhB2QWjwOopCR+Qo27AYv97BJkVaKWPXpj9RfvY1wtpIratDN6tkXN9WCRPzVX8+5qaW034Kvf9WwBZD1ntS8iHYwY1YUaU8Mrp2sRT3K0RqyBlTswIH3HIqpASqv7ZtwDHdhk7Cbd13P5aomJSOjYFhCDUi3sRbjJP1kb6uQLdkZj8fIU518HzSR7Kw7p2mbDqSrGbnaeHWd0Tr3BvDHp9Pi0KpSAVm2qWAXix+BcjMA4ar7kLU1Pre0lt4K4DlSvq5XoHdX9/yvS6KGf+8pXDR9bY6dgRPSG4mzKpiKfkv1eXE8WKs0q3217QZItaSjocw4d0o47vSN+/MAh9V5Zewyb6ogs8JicX3Y3FPG29I1g8iLf3kBZ7V4mUimGuOq/L+1YVvyOTb2zWWMjNmECO2lrxXJc5LWRs5FmSJyCdilRktDE0WTGUo89O+DcF2752qtpUmlV2fllU1LXIAn0TJKiAZspKakamifrgYFIzZK4oZ8wDeFesQB/a/U7wtyv85vknzCtMLI28dnpGQ/ZFHNqWYVaHoHsnEmWion7lgMctnpY5pwKFfUSfZecl2Xqwjk1HZj71A9TFNQj+/x4z957cNtx+utAkGinK3eZF+H1o5YnSgjg4hN41kbXttk8nADerPdF7hDS6np7xzUl6qOicJhEOJ5x0c18CAwEAAQKCAgAFEDXDb10Rtl5vT6oXLjzswYcD6Ct8v23eLYcKqJlNeXuysQODxnJAxBTuubPvXOSxC6DVbaa7zQxqldjPy92eVfDiOii5naR648AMG2Rl4ybm9+Zfvnwgu9WIjLxFK6zl6A0dMi82W47HP6s5d8gbWREjtO1HXOCGe6rIUyLpC3mm5JX/aaeG9NHRsNeY5vXWgsrOdgaUSeaPSsiXvi/XdPP94aBdvDjqq0kKssQofA5PTMlOd0Nv+lN9Sew7po0NJ4q/U7aFzF5BaFidty8JA3DdQQRPgVrWVF57StvHkYMZSnwgWA6noZaWL/N2RkbeQw0KsDKxdo3KFYkVb8OuTN68b3J5sKIo48LaDbfWbuThcdUFdpKXUd6lvJ2vCnbN6e1fzJdjpCNg9mb2g8KnSW9xqXek8cx0b+LNh+p/YDUI/BZDfsXjeqODiGEruYWfaYiL4STOOXIq5SoyP6XEDbX41UHcb/P3pJExBB7R6fpUFREUd0tUAQAQ93YUitWIs8U1tVAB9/qaUO6BFgOghrbswUiX4twVdmqhrBVOcYUImu7LUdcpMLIdR/gyy47w8xEhiv/oudWVx7rkJS4+l949KtUmyd5x+MNT7nAF99eSIv3iNpL6eS7OWiak5gfoVATy0shNd48H62mGtYjfoGzndGE26tNCHXoAkTrbQQKCAQEA47QXH0Y5xbnq8rlqukwVt+EDMJUtZBqfxGDnkDmtfGefxiyE1VLb+Q0Z1es3lxjcmb1Qupl9tjrWeejK2QymSOzPaluOTpIFOZbFqzNha68nONoiWjqwkCg7VvTo0mRKLwSEnCrCOB8HiLKQAhirdPwtW/8PLd+B8HZSB3UKFylbT+ghHIz5b4P81GksRGbsb6g3+ipz53mvtJpe77J7Y84wPQppj6Ry0WjsQr4iv2hF5PWNMhHVDj8eO80DJvWRCFVTWqTE3WYxZJ/5jdeOdVTwtrYghP72X0zAnVpQCVzcn8tLghKsfePhCw3zNtFE3dk4XHQD4uhPU88GtxJ3vwKCAQEA0fHVZmW8EwxYUEzhFl+2J4evszh8R2Sga+LHv4hy2qGydiciVnv4Y/IoScc0IQ+YHoj9fNad+/UoR8ctSBgrPDzeiY/7ldSp/j5Tbqb4h3Ioaqf9uNg7qHpnciz1o8AI8fFelXZ5hA8GuXo8VGy60xMCyapjkLzTXshdRPjUzcLX1PrUy+me4ZR/KdIkqOOmzgvBVII3gb0iN70gTqn2HSIUC3yMiXA+X6OkHoDL7tn8tkF/aD+uenxOvOadsoJPtaFPaMD0X5vJ8LIjsBThAncVApx93XJIdkJm2ffXq2JhQJfZ6ZXypa6ooepzmB58kxA+TZiJpQLLQJ17xC/sYQKCAQBwuzJPW3cyuw7kyINcZFrERHRN0y07yCqdENTUBJotYygo9tV0v6cEMEZAMEm/VqGww5d6Ko+gbpTMmkIDH04cAJHXuChGIejQUCLg1Xk/1OF4NhaX0UKkvCZUsL+rmddYW8ZDgq/RFRunw6+kOg54xni2eRpMvcEZCZsm8fzi5qi8cNIjzm+XlCLSDpfJ7aLUzNWZ1va2/PnOUjb6OMT57pTXQ5ZrdSEbJ/UAPh354WfpKOCUj1uJyBnxxVfwK9d35rZzw+trKTL+/GySmst+r2TVMGn9LjVPjTI3NQU2/XCE9CMX7KLVWMKLtIZa91Q++VH8A7wA1L6hYXeTn2MFAoIBAEb5xvdTNX4LEmAzXXU+7kn26UNhuUI5lrJifL0X2BxpxfeDy2wJhTPkzhIDMnBq4TaRgYEO3WIsw21gvMI+yX8X5PQEpT1GJCI71+D0udiwk1Fbcb9n+uM+XnKPGIw/g8annx5Qa0xl+BQEaxjvmUl6h9q9q+Nmst68RivnI6pcULNECWTWmkwQ89yjmpkuPVozRyzWyQUnd8X4Pk/ZzcaTmss3VBuywqN6oyVczZT2RSUoh3Yq8UWfeM8L+Aw9Wc1Bt6LmeLdJ579jugTxShCXSZcUaMjQtgak9DiEPXlHTTGVJKp/cwToQ0JaDLJEvEDLoQSCqSYMB8LUet8chIECggEBANxvUJxCLbx4CZrUJC5O2w01GMDFdTfYOUcK75pFAbXkpBPXDLsuz2dK1y8ANk3ibWWrlV6YKDUwl+gWDHmJOcvKqKKAeUnrhIMmJGaO6C++5DxPE/n7g5M86GA0bu/+B+32wL/65B8HoJrkHnSMJp9GcCsVZA3+2xcJfo+xAiXeiRobRIxCQMYCDDM7Hr7X5jGa7l9bQr4GuWRKRYTroE9LCDnH/LLUN+0ny3UXrSjtTUVL4mVAJT0Ws2H1zUzVDbu7ZQgA0u3GjtdFvAnS/E+ln8DS3Q1DeD6Zsf0hrrJbtwU4zZIU445SZ+IUaTjueB9v/skukoIQi/0Mj+gpZ1c=";
+export const privateKey = base64ToPEM(encodedPrivateKey, "RSA PRIVATE");
 
 export const encodedPublicKey = "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAur0hOjhB2QWjwOopCR+Qo27AYv97BJkVaKWPXpj9RfvY1wtpIratDN6tkXN9WCRPzVX8+5qaW034Kvf9WwBZD1ntS8iHYwY1YUaU8Mrp2sRT3K0RqyBlTswIH3HIqpASqv7ZtwDHdhk7Cbd13P5aomJSOjYFhCDUi3sRbjJP1kb6uQLdkZj8fIU518HzSR7Kw7p2mbDqSrGbnaeHWd0Tr3BvDHp9Pi0KpSAVm2qWAXix+BcjMA4ar7kLU1Pre0lt4K4DlSvq5XoHdX9/yvS6KGf+8pXDR9bY6dgRPSG4mzKpiKfkv1eXE8WKs0q3217QZItaSjocw4d0o47vSN+/MAh9V5Zewyb6ogs8JicX3Y3FPG29I1g8iLf3kBZ7V4mUimGuOq/L+1YVvyOTb2zWWMjNmECO2lrxXJc5LWRs5FmSJyCdilRktDE0WTGUo89O+DcF2752qtpUmlV2fllU1LXIAn0TJKiAZspKakamifrgYFIzZK4oZ8wDeFesQB/a/U7wtyv85vknzCtMLI28dnpGQ/ZFHNqWYVaHoHsnEmWion7lgMctnpY5pwKFfUSfZecl2Xqwjk1HZj71A9TFNQj+/x4z957cNtx+utAkGinK3eZF+H1o5YnSgjg4hN41kbXttk8nADerPdF7hDS6np7xzUl6qOicJhEOJ5x0c18CAwEAAQ==";
-export const publicKey = base64ToPEM(encodedPublicKey);
+export const publicKey = base64ToPEM(encodedPublicKey, "PUBLIC");
 
 // The comments above each fixture are the Scala case classe representation used to generate the encoded cookie
 
@@ -42,4 +41,4 @@ export const sampleCookieWithoutMultifactor =
     )
 */
 export const sampleNonGuardianCookie =
-"Zmlyc3ROYW1lPVRlc3QmbGFzdE5hbWU9VXNlciZlbWFpbD10ZXN0LnVzZXJAYmJjLmNvLnVrJnN5c3RlbT10ZXN0JmF1dGhlZEluPXRlc3QmZXhwaXJlcz0xMjM0Jm11bHRpZmFjdG9yPWZhbHNl.mX4eQF7RXNJXnI9szVwGaMN5XL8ruTiZyDQ8/fEjO+TcC+q/y1rPCjRWAjhmBD+VjVES3IcCdlC4bVQ+T9BM9eLtZYnDGFDAalKP1BnoGYg3nGku0vJi7n+lS/UC16zmJyy19SgkI7GqjoTgaeN7PRgE4kZPWHtXJQa8GyC9Bc5SInvhgW04yIe6Pm9IIVGGNqWo3/qmiTDHxWPHBSxf8gNO3d1VTmp4homkIxKoqaJNloCPSjYvgk1kf8ZJQFPL00HNA+gYNRjQDpDbMAINMS3/BQLdEkRKaTIqmIEmp3+LVoN+8p11K7fd8deOQXsMqnhGCFwxAr3Mk1hUXQsvOl2uHSFg2eRhHbTbILvurNp3hmtF3kld6EmrFbKiag73YsLV6/x03CrhktvUmQlhP9/DdOt+qWEkDCcZP5z4oazJjiiVl21F2TZ1EOD3Yjw9OSVR7tGxe6gPzi/bQQa/Yl3Gd5FtR53QMbnKMBB3NIWxFl7JeVHtvZo+4SSjVRTPxtBnnwnYW+jQulhMCYuGRIKUJ4v4fbCsUXhBguYGYz6v1vKcllobkyMa8AVX38bLH/+CFY1u8mCdjD81Ojwg5iWPoJu/7z/AZ+cKNRquHuEa3z5R6OZBE4IxDqGFc5U8ZdvBYxtrPR19NzwmDZ0uebtZ047P7xQKHAaS+NTitDo=";
+"Zmlyc3ROYW1lPVRlc3QmbGFzdE5hbWU9VXNlciZlbWFpbD10ZXN0LnVzZXJAYmJjLmNvLnVrJnN5c3RlbT10ZXN0JmF1dGhlZEluPXRlc3QmZXhwaXJlcz0xMjM0Jm11bHRpZmFjdG9yPWZhbHNl.mX4eQF7RXNJXnI9szVwGaMN5XL8ruTiZyDQ8/fEjO+TcC+q/y1rPCjRWAjhmBD+VjVES3IcCdlC4bVQ+T9BM9eLtZYnDGFDAalKP1BnoGYg3nGku0vJi7n+lS/UC16zmJyy19SgkI7GqjoTgaeN7PRgE4kZPWHtXJQa8GyC9Bc5SInvhgW04yIe6Pm9IIVGGNqWo3/qmiTDHxWPHBSxf8gNO3d1VTmp4homkIxKoqaJNloCPSjYvgk1kf8ZJQFPL00HNA+gYNRjQDpDbMAINMS3/BQLdEkRKaTIqmIEmp3+LVoN+8p11K7fd8deOQXsMqnhGCFwxAr3Mk1hUXQsvOl2uHSFg2eRhHbTbILvurNp3hmtF3kld6EmrFbKiag73YsLV6/x03CrhktvUmQlhP9/DdOt+qWEkDCcZP5z4oazJjiiVl21F2TZ1EOD3Yjw9OSVR7tGxe6gPzi/bQQa/Yl3Gd5FtR53QMbnKMBB3NIWxFl7JeVHtvZo+4SSjVRTPxtBnnwnYW+jQulhMCYuGRIKUJ4v4fbCsUXhBguYGYz6v1vKcllobkyMa8AVX38bLH/+CFY1u8mCdjD81Ojwg5iWPoJu/7z/AZ+cKNRquHuEa3z5R6OZBE4IxDqGFc5U8ZdvBYxtrPR19NzwmDZ0uebtZ047P7xQKHAaS+NTitDo=";

package/test/panda.test.ts

@@ -1,29 +1,153 @@
-import { guardianValidation, AuthenticationStatus } from '../src/api';
-import { verifyUser } from '../src/panda';
+import {guardianValidation, AuthenticationStatus, User} from '../src/api';
+import { verifyUser, createCookie, PanDomainAuthentication } from '../src/panda';
+import { fetchPublicKey } from '../src/fetch-public-key';
 
-import { sampleCookie, sampleCookieWithoutMultifactor, sampleNonGuardianCookie, publicKey } from './fixtures';
+import {
+    sampleCookie,
+    sampleCookieWithoutMultifactor,
+    sampleNonGuardianCookie,
+    publicKey,
+    privateKey
+} from './fixtures';
+import {decodeBase64} from "../src/utils";
 
-test("return invalid cookie if missing", () => {
-    expect(verifyUser(undefined, "", 0, guardianValidation).status).toBe(AuthenticationStatus.INVALID_COOKIE);
-});
+jest.mock('../src/fetch-public-key');
+jest.useFakeTimers('modern');
 
-test("return invalid cookie for a malformed signature", () => {
-    const [data, signature] = sampleCookie.split(".");
-    const testCookie = data + ".1234";
+describe('verifyUser', function () {
 
-    expect(verifyUser(testCookie, publicKey, 0, guardianValidation).status).toBe(AuthenticationStatus.INVALID_COOKIE);
-});
+    test("return invalid cookie if missing", () => {
+        expect(verifyUser(undefined, "", new Date(0), guardianValidation).status).toBe(AuthenticationStatus.INVALID_COOKIE);
+    });
+
+    test("return invalid cookie for a malformed signature", () => {
+        const [data, signature] = sampleCookie.split(".");
+        const testCookie = data + ".1234";
+
+        expect(verifyUser(testCookie, publicKey, new Date(0), guardianValidation).status).toBe(AuthenticationStatus.INVALID_COOKIE);
+    });
+
+    test("return expired", () => {
+        const someTimeInTheFuture = new Date(5678);
+        expect(someTimeInTheFuture.getTime()).toBe(5678);
+        expect(verifyUser(sampleCookie, publicKey, someTimeInTheFuture, guardianValidation).status).toBe(AuthenticationStatus.EXPIRED);
+    });
 
-test("return expired", () => {
-    const someTimeInTheFuture = 5678;
-    expect(verifyUser(sampleCookie, publicKey, someTimeInTheFuture, guardianValidation).status).toBe(AuthenticationStatus.EXPIRED);
+    test("return not authenticated if user fails validation function", () => {
+        expect(verifyUser(sampleCookieWithoutMultifactor, publicKey, new Date(0), guardianValidation).status).toBe(AuthenticationStatus.NOT_AUTHORISED);
+        expect(verifyUser(sampleNonGuardianCookie, publicKey, new Date(0), guardianValidation).status).toBe(AuthenticationStatus.NOT_AUTHORISED);
+    });
+
+    test("return authenticated", () => {
+        expect(verifyUser(sampleCookie, publicKey, new Date(0), guardianValidation).status).toBe(AuthenticationStatus.AUTHORISED);
+    });
 });
 
-test("return not authenticated if user fails validation function", () => {
-    expect(verifyUser(sampleCookieWithoutMultifactor, publicKey, 0, guardianValidation).status).toBe(AuthenticationStatus.NOT_AUTHORISED);
-    expect(verifyUser(sampleNonGuardianCookie, publicKey, 0, guardianValidation).status).toBe(AuthenticationStatus.NOT_AUTHORISED);
+describe('createCookie', function () {
+    it('should return the same cookie based on the user details being provided', function () {
+        const user: User = {
+            firstName: "Test",
+            lastName: "User",
+            email: "test.user@guardian.co.uk",
+            authenticatingSystem: "test",
+            authenticatedIn: ["test"],
+            expires: 1234,
+            multifactor: true
+        };
+
+        const cookie = createCookie(user, privateKey);
+
+        expect(decodeBase64(cookie)).toEqual(decodeBase64(sampleCookie));
+        expect(cookie).toEqual(sampleCookie)
+    });
 });
 
-test("return authenticated", () => {
-    expect(verifyUser(sampleCookie, publicKey, 0, guardianValidation).status).toBe(AuthenticationStatus.AUTHORISED);
-});
+describe('panda class', function () {
+  beforeEach(() => {
+    (fetchPublicKey as jest.MockedFunction<typeof fetchPublicKey>).mockResolvedValue({ key: 'PUBLIC KEY', lastUpdated: new Date() });
+  });
+
+  describe('stop', () => {
+
+    it('stops auto refresh', () => {
+      const panda = new PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u)=> true);
+      expect(panda.keyUpdateTimer).not.toBeUndefined();
+      panda.stop();
+      expect(panda.keyUpdateTimer).toBeUndefined();
+    });
+
+  });
+
+  describe('getPublicKey', () => {
+
+    it('getsPublicKey immediately when last fetch is within the cache time', async () => {
+
+      const panda = new PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u)=> true);
+      const fetchesBeforeGet = (fetchPublicKey as jest.MockedFunction<typeof fetchPublicKey>).mock.calls.length;
+
+      await expect(panda.getPublicKey()).resolves.toEqual('PUBLIC KEY');
+      const fetchesAfterGet = (fetchPublicKey as jest.MockedFunction<typeof fetchPublicKey>).mock.calls.length;
+
+      expect(fetchesAfterGet).toEqual(fetchesBeforeGet);
+
+    });
+
+    it('getsPublicKey after refetching when last fetch is outside the cache time', async () => {
+      // cache time is 1 min
+      const fiveMinsAgo = new Date();
+      fiveMinsAgo.setMinutes(fiveMinsAgo.getMinutes() - 5);
+
+      (fetchPublicKey as jest.MockedFunction<typeof fetchPublicKey>).mockResolvedValue({ key: 'PUBLIC KEY', lastUpdated: fiveMinsAgo });
+
+      const panda = new PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u)=> true);
+
+      const fetchesBefore = (fetchPublicKey as jest.MockedFunction<typeof fetchPublicKey>).mock.calls.length;
+
+      await expect(panda.getPublicKey()).resolves.toEqual('PUBLIC KEY');
+
+      (fetchPublicKey as jest.MockedFunction<typeof fetchPublicKey>).mockResolvedValue({ key: 'PUBLIC KEY 2', lastUpdated: fiveMinsAgo });
+
+      const fetchesAfter = (fetchPublicKey as jest.MockedFunction<typeof fetchPublicKey>).mock.calls.length;
+
+      await expect(panda.getPublicKey()).resolves.toEqual('PUBLIC KEY 2');
+
+      expect(fetchesAfter).toEqual(fetchesBefore + 1);
+    });
+
+  });
+
+  describe('verify', () => {
+
+    beforeEach(() => {
+      (fetchPublicKey as jest.MockedFunction<typeof fetchPublicKey>).mockResolvedValue({ key: publicKey, lastUpdated: new Date() });
+    });
+
+    it('should return authenticated if valid', async () => {
+      jest.setSystemTime(100);
+      const panda = new PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u)=> true);
+      const { status } = await panda.verify(`cookiename=${sampleCookie}`);
+
+      expect(status).toBe(AuthenticationStatus.AUTHORISED);
+    });
+
+    it('should return expired if expired', async () => {
+      jest.setSystemTime(10_000);
+
+      const panda = new PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', (u)=> true);
+      const { status } = await panda.verify(`cookiename=${sampleCookie}`);
+
+      expect(status).toBe(AuthenticationStatus.EXPIRED);
+    });
+
+    it('should return not authenticated if validation fails', async () => {
+      jest.setSystemTime(100);
+
+      const panda = new PanDomainAuthentication('cookiename', 'region', 'bucket', 'keyfile', guardianValidation);
+      const { status } = await panda.verify(`cookiename=${sampleNonGuardianCookie}`);
+
+      expect(status).toBe(AuthenticationStatus.NOT_AUTHORISED);
+    });
+
+  });
+
+});