@guardian/pan-domain-node 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @guardian/pan-domain-node
 
+## 1.1.0
+
+### Minor Changes
+
+- b762261: Download public key from S3 with AWS credential
+
 ## 1.0.0
 
 ### Major Changes

package/README.md

@@ -40,16 +40,27 @@ Grace period:                          [------------- 24 hours ------]
 npm install --save-dev @guardian/pan-domain-node
 ```
 
+### Setup
+The library load the public key file from a S3 object.  Consuming applications can specify the S3 object via the arugments 'region', 'bucket' and 'keyFile' to the constructor of `PanDomainAuthentication` class as shown in the Initialisation below.
+
+Therefore, the application must run with an AWS credential that has read access to the S3 object in that bucket.
+
+You may refer to [Pan Domain authentication documentation](https://github.com/guardian/pan-domain-authentication) for details on how this authentication works. 
+
 ### Initialisation
 ```typescript
 import { PanDomainAuthentication, AuthenticationStatus, User, guardianValidation } from '@guardian/pan-domain-node';
+import { fromIni } from "@aws-sdk/credential-providers";
+
+const credentialsProvider = fromIni();  // get credentials locally using the default profile
 
 const panda = new PanDomainAuthentication(
   "gutoolsAuth-assym", // cookie name
   "eu-west-1", // AWS region
   "pan-domain-auth-settings", // Settings bucket
   "local.dev-gutools.co.uk.settings.public", // Settings file
-  guardianValidation
+  guardianValidation,
+  credentialsProvider, // it can be omitted if the app runs in AWS cloud.  In this case, "fromNodeProviderChain" is used by default.
 );
 
 // alternatively customise the validation function and pass at construction

package/dist/src/api.d.ts

@@ -29,7 +29,7 @@ export interface CookieFailure extends Failure {
 export interface UnknownFailure extends Failure {
     reason: 'unknown';
 }
-export declare type AuthenticationResult = FreshSuccess | StaleSuccess | CookieFailure | UserValidationFailure | UnknownFailure;
+export type AuthenticationResult = FreshSuccess | StaleSuccess | CookieFailure | UserValidationFailure | UnknownFailure;
 export interface User {
     firstName: string;
     lastName: string;
@@ -40,5 +40,5 @@ export interface User {
     expires: number;
     multifactor: boolean;
 }
-export declare type ValidateUserFn = (user: User) => boolean;
+export type ValidateUserFn = (user: User) => boolean;
 export declare function guardianValidation(user: User): boolean;

package/dist/src/api.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.guardianValidation = exports.gracePeriodInMillis = void 0;
+exports.gracePeriodInMillis = exports.PanDomainAuthentication = void 0;
+exports.guardianValidation = guardianValidation;
 var panda_1 = require("./panda");
 Object.defineProperty(exports, "PanDomainAuthentication", { enumerable: true, get: function () { return panda_1.PanDomainAuthentication; } });
 // We continue to consider the request authenticated for
@@ -19,4 +20,3 @@ function guardianValidation(user) {
     const isGuardianUser = user.email.indexOf('guardian.co.uk') !== -1;
     return isGuardianUser && user.multifactor;
 }
-exports.guardianValidation = guardianValidation;

package/dist/src/fetch-public-key.d.ts

@@ -1,5 +1,6 @@
+import { S3 } from "@aws-sdk/client-s3";
 export interface PublicKeyHolder {
     key: string;
     lastUpdated: Date;
 }
-export declare function fetchPublicKey(region: string, bucket: String, keyFile: String): Promise<PublicKeyHolder>;
+export declare function fetchPublicKey(s3: S3, bucket: string, keyFile: string): Promise<PublicKeyHolder>;

package/dist/src/fetch-public-key.js

@@ -1,7 +1,11 @@
 "use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
@@ -11,30 +15,54 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fetchPublicKey = void 0;
+exports.fetchPublicKey = fetchPublicKey;
 const iniparser = __importStar(require("iniparser"));
 const utils_1 = require("./utils");
-function fetchPublicKey(region, bucket, keyFile) {
-    const path = `https://s3.${region}.amazonaws.com/${bucket}/${keyFile}`;
-    return utils_1.httpGet(path).then(response => {
-        const config = iniparser.parseString(response);
-        if (config.publicKey) {
-            return {
-                key: utils_1.base64ToPEM(config.publicKey, "PUBLIC"),
-                lastUpdated: new Date()
-            };
+function fetchPublicKey(s3, bucket, keyFile) {
+    const publicKeyLocation = {
+        Bucket: bucket,
+        Key: keyFile,
+    };
+    return s3.getObject(publicKeyLocation)
+        .then(({ Body }) => Body === null || Body === void 0 ? void 0 : Body.transformToString())
+        .then((pandaConfigIni) => {
+        if (!pandaConfigIni) {
+            throw Error(`could not read panda config ${JSON.stringify(publicKeyLocation)}`);
         }
         else {
-            throw new Error("Missing publicKey setting from config");
+            const config = iniparser.parseString(pandaConfigIni);
+            if (config.publicKey) {
+                return {
+                    key: (0, utils_1.base64ToPEM)(config.publicKey, "PUBLIC"),
+                    lastUpdated: new Date()
+                };
+            }
+            else {
+                console.log(`Failed to retrieve panda public key from ${JSON.stringify(config)}`);
+                throw new Error("Missing publicKey setting from config");
+            }
         }
+    })
+        .catch((error) => {
+        console.error(`Error fetching public key from S3: ${error}`);
+        throw error;
     });
 }
-exports.fetchPublicKey = fetchPublicKey;

package/dist/src/panda.d.ts

@@ -1,6 +1,7 @@
-/// <reference types="node" />
 import { User, AuthenticationResult, ValidateUserFn } from './api';
 import { PublicKeyHolder } from './fetch-public-key';
+import { S3 } from "@aws-sdk/client-s3";
+import { AwsCredentialIdentityProvider } from "@aws-sdk/types";
 export declare function createCookie(user: User, privateKey: string): string;
 export declare function verifyUser(pandaCookie: string | undefined, publicKey: string, currentTime: Date, validateUser: ValidateUserFn): AuthenticationResult;
 export declare class PanDomainAuthentication {
@@ -12,7 +13,8 @@ export declare class PanDomainAuthentication {
     publicKey: Promise<PublicKeyHolder>;
     keyCacheTimeInMillis: number;
     keyUpdateTimer?: NodeJS.Timeout;
-    constructor(cookieName: string, region: string, bucket: string, keyFile: string, validateUser: ValidateUserFn);
+    s3Client: S3;
+    constructor(cookieName: string, region: string, bucket: string, keyFile: string, validateUser: ValidateUserFn, credentialsProvider?: AwsCredentialIdentityProvider);
     stop(): void;
     getPublicKey(): Promise<string>;
     verify(requestCookies: string): Promise<AuthenticationResult>;

package/dist/src/panda.js

@@ -1,7 +1,11 @@
 "use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
@@ -11,19 +15,33 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PanDomainAuthentication = exports.verifyUser = exports.createCookie = void 0;
+exports.PanDomainAuthentication = void 0;
+exports.createCookie = createCookie;
+exports.verifyUser = verifyUser;
 const cookie = __importStar(require("cookie"));
 const utils_1 = require("./utils");
 const api_1 = require("./api");
 const fetch_public_key_1 = require("./fetch-public-key");
+const client_s3_1 = require("@aws-sdk/client-s3");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
 function createCookie(user, privateKey) {
     let queryParams = [];
     queryParams.push("firstName=" + user.firstName);
@@ -36,10 +54,9 @@ function createCookie(user, privateKey) {
     queryParams.push("multifactor=" + String(user.multifactor));
     const combined = queryParams.join("&");
     const queryParamsString = Buffer.from(combined).toString('base64');
-    const signature = utils_1.sign(combined, privateKey);
+    const signature = (0, utils_1.sign)(combined, privateKey);
     return queryParamsString + "." + signature;
 }
-exports.createCookie = createCookie;
 function verifyUser(pandaCookie, publicKey, currentTime, validateUser) {
     if (!pandaCookie) {
         return {
@@ -47,7 +64,7 @@ function verifyUser(pandaCookie, publicKey, currentTime, validateUser) {
             reason: 'no-cookie'
         };
     }
-    const parsedCookie = utils_1.parseCookie(pandaCookie);
+    const parsedCookie = (0, utils_1.parseCookie)(pandaCookie);
     if (!parsedCookie) {
         return {
             success: false,
@@ -55,7 +72,7 @@ function verifyUser(pandaCookie, publicKey, currentTime, validateUser) {
         };
     }
     const { data, signature } = parsedCookie;
-    if (!utils_1.verifySignature(data, signature, publicKey)) {
+    if (!(0, utils_1.verifySignature)(data, signature, publicKey)) {
         return {
             success: false,
             reason: 'invalid-cookie'
@@ -63,7 +80,7 @@ function verifyUser(pandaCookie, publicKey, currentTime, validateUser) {
     }
     const currentTimestampInMillis = currentTime.getTime();
     try {
-        const user = utils_1.parseUser(data);
+        const user = (0, utils_1.parseUser)(data);
         const isExpired = user.expires < currentTimestampInMillis;
         if (isExpired) {
             const gracePeriodEndsAtEpochTimeMillis = user.expires + api_1.gracePeriodInMillis;
@@ -103,16 +120,20 @@ function verifyUser(pandaCookie, publicKey, currentTime, validateUser) {
         };
     }
 }
-exports.verifyUser = verifyUser;
 class PanDomainAuthentication {
-    constructor(cookieName, region, bucket, keyFile, validateUser) {
+    constructor(cookieName, region, bucket, keyFile, validateUser, credentialsProvider = (0, credential_providers_1.fromNodeProviderChain)()) {
         this.keyCacheTimeInMillis = 60 * 1000; // 1 minute
         this.cookieName = cookieName;
         this.region = region;
         this.bucket = bucket;
         this.keyFile = keyFile;
         this.validateUser = validateUser;
-        this.publicKey = fetch_public_key_1.fetchPublicKey(region, bucket, keyFile);
+        const standardAwsConfig = {
+            region: region,
+            credentials: credentialsProvider,
+        };
+        this.s3Client = new client_s3_1.S3(standardAwsConfig);
+        this.publicKey = (0, fetch_public_key_1.fetchPublicKey)(this.s3Client, bucket, keyFile);
         this.keyUpdateTimer = setInterval(() => this.getPublicKey(), this.keyCacheTimeInMillis);
     }
     stop() {
@@ -126,7 +147,7 @@ class PanDomainAuthentication {
             const now = new Date();
             const diff = now.getTime() - lastUpdated.getTime();
             if (diff > this.keyCacheTimeInMillis) {
-                this.publicKey = fetch_public_key_1.fetchPublicKey(this.region, this.bucket, this.keyFile);
+                this.publicKey = (0, fetch_public_key_1.fetchPublicKey)(this.s3Client, this.bucket, this.keyFile);
                 return this.publicKey.then(({ key }) => key);
             }
             else {

package/dist/src/utils.d.ts

@@ -1,6 +1,6 @@
 import { User } from './api';
 export declare function decodeBase64(data: string): string;
-export declare type ParsedCookie = {
+export type ParsedCookie = {
     data: string;
     signature: string;
 };

package/dist/src/utils.js

@@ -1,7 +1,11 @@
 "use strict";
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
 }) : (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     o[k2] = m[k];
@@ -11,22 +15,37 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseUser = exports.httpGet = exports.base64ToPEM = exports.sign = exports.verifySignature = exports.parseCookie = exports.decodeBase64 = void 0;
+exports.decodeBase64 = decodeBase64;
+exports.parseCookie = parseCookie;
+exports.verifySignature = verifySignature;
+exports.sign = sign;
+exports.base64ToPEM = base64ToPEM;
+exports.httpGet = httpGet;
+exports.parseUser = parseUser;
 const crypto = __importStar(require("crypto"));
 const https = __importStar(require("https"));
 const url_1 = require("url");
 function decodeBase64(data) {
     return Buffer.from(data, 'base64').toString('utf8');
 }
-exports.decodeBase64 = decodeBase64;
 /**
  * Check if a string is valid base64
  */
@@ -57,7 +76,6 @@ function parseCookie(cookie) {
         signature: signature
     };
 }
-exports.parseCookie = parseCookie;
 /**
  * Verify signed data using nodeJs crypto library
  */
@@ -66,14 +84,12 @@ function verifySignature(message, signature, pandaPublicKey) {
         .update(message, 'utf8')
         .verify(pandaPublicKey, signature, 'base64');
 }
-exports.verifySignature = verifySignature;
 function sign(message, privateKey) {
     const sign = crypto.createSign("sha256WithRSAEncryption");
     sign.write(message);
     sign.end();
     return sign.sign(privateKey, 'base64');
 }
-exports.sign = sign;
 const ASCII_NEW_LINE = String.fromCharCode(10);
 function base64ToPEM(key, headerFooter) {
     const PEM_HEADER = `-----BEGIN ${headerFooter} KEY-----`;
@@ -91,7 +107,6 @@ function base64ToPEM(key, headerFooter) {
     ret.push(Buffer.from(PEM_FOOTER).toString('ascii'));
     return ret.join(ASCII_NEW_LINE);
 }
-exports.base64ToPEM = base64ToPEM;
 function httpGet(path) {
     return new Promise((resolve, reject) => {
         const data = [];
@@ -113,7 +128,6 @@ function httpGet(path) {
         });
     });
 }
-exports.httpGet = httpGet;
 function parseUser(data) {
     const params = new url_1.URLSearchParams(data);
     function stringField(name) {
@@ -152,4 +166,3 @@ function parseUser(data) {
         multifactor: booleanField("multifactor")
     };
 }
-exports.parseUser = parseUser;

package/dist/test/fixtures.js

@@ -3,9 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sampleNonGuardianCookie = exports.sampleCookieWithoutMultifactor = exports.sampleCookie = exports.publicKey = exports.encodedPublicKey = exports.privateKey = exports.encodedPrivateKey = void 0;
 const utils_1 = require("../src/utils");
 exports.encodedPrivateKey = "MIIJKAIBAAKCAgEAur0hOjhB2QWjwOopCR+Qo27AYv97BJkVaKWPXpj9RfvY1wtpIratDN6tkXN9WCRPzVX8+5qaW034Kvf9WwBZD1ntS8iHYwY1YUaU8Mrp2sRT3K0RqyBlTswIH3HIqpASqv7ZtwDHdhk7Cbd13P5aomJSOjYFhCDUi3sRbjJP1kb6uQLdkZj8fIU518HzSR7Kw7p2mbDqSrGbnaeHWd0Tr3BvDHp9Pi0KpSAVm2qWAXix+BcjMA4ar7kLU1Pre0lt4K4DlSvq5XoHdX9/yvS6KGf+8pXDR9bY6dgRPSG4mzKpiKfkv1eXE8WKs0q3217QZItaSjocw4d0o47vSN+/MAh9V5Zewyb6ogs8JicX3Y3FPG29I1g8iLf3kBZ7V4mUimGuOq/L+1YVvyOTb2zWWMjNmECO2lrxXJc5LWRs5FmSJyCdilRktDE0WTGUo89O+DcF2752qtpUmlV2fllU1LXIAn0TJKiAZspKakamifrgYFIzZK4oZ8wDeFesQB/a/U7wtyv85vknzCtMLI28dnpGQ/ZFHNqWYVaHoHsnEmWion7lgMctnpY5pwKFfUSfZecl2Xqwjk1HZj71A9TFNQj+/x4z957cNtx+utAkGinK3eZF+H1o5YnSgjg4hN41kbXttk8nADerPdF7hDS6np7xzUl6qOicJhEOJ5x0c18CAwEAAQKCAgAFEDXDb10Rtl5vT6oXLjzswYcD6Ct8v23eLYcKqJlNeXuysQODxnJAxBTuubPvXOSxC6DVbaa7zQxqldjPy92eVfDiOii5naR648AMG2Rl4ybm9+Zfvnwgu9WIjLxFK6zl6A0dMi82W47HP6s5d8gbWREjtO1HXOCGe6rIUyLpC3mm5JX/aaeG9NHRsNeY5vXWgsrOdgaUSeaPSsiXvi/XdPP94aBdvDjqq0kKssQofA5PTMlOd0Nv+lN9Sew7po0NJ4q/U7aFzF5BaFidty8JA3DdQQRPgVrWVF57StvHkYMZSnwgWA6noZaWL/N2RkbeQw0KsDKxdo3KFYkVb8OuTN68b3J5sKIo48LaDbfWbuThcdUFdpKXUd6lvJ2vCnbN6e1fzJdjpCNg9mb2g8KnSW9xqXek8cx0b+LNh+p/YDUI/BZDfsXjeqODiGEruYWfaYiL4STOOXIq5SoyP6XEDbX41UHcb/P3pJExBB7R6fpUFREUd0tUAQAQ93YUitWIs8U1tVAB9/qaUO6BFgOghrbswUiX4twVdmqhrBVOcYUImu7LUdcpMLIdR/gyy47w8xEhiv/oudWVx7rkJS4+l949KtUmyd5x+MNT7nAF99eSIv3iNpL6eS7OWiak5gfoVATy0shNd48H62mGtYjfoGzndGE26tNCHXoAkTrbQQKCAQEA47QXH0Y5xbnq8rlqukwVt+EDMJUtZBqfxGDnkDmtfGefxiyE1VLb+Q0Z1es3lxjcmb1Qupl9tjrWeejK2QymSOzPaluOTpIFOZbFqzNha68nONoiWjqwkCg7VvTo0mRKLwSEnCrCOB8HiLKQAhirdPwtW/8PLd+B8HZSB3UKFylbT+ghHIz5b4P81GksRGbsb6g3+ipz53mvtJpe77J7Y84wPQppj6Ry0WjsQr4iv2hF5PWNMhHVDj8eO80DJvWRCFVTWqTE3WYxZJ/5jdeOdVTwtrYghP72X0zAnVpQCVzcn8tLghKsfePhCw3zNtFE3dk4XHQD4uhPU88GtxJ3vwKCAQEA0fHVZmW8EwxYUEzhFl+2J4evszh8R2Sga+LHv4hy2qGydiciVnv4Y/IoScc0IQ+YHoj9fNad+/UoR8ctSBgrPDzeiY/7ldSp/j5Tbqb4h3Ioaqf9uNg7qHpnciz1o8AI8fFelXZ5hA8GuXo8VGy60xMCyapjkLzTXshdRPjUzcLX1PrUy+me4ZR/KdIkqOOmzgvBVII3gb0iN70gTqn2HSIUC3yMiXA+X6OkHoDL7tn8tkF/aD+uenxOvOadsoJPtaFPaMD0X5vJ8LIjsBThAncVApx93XJIdkJm2ffXq2JhQJfZ6ZXypa6ooepzmB58kxA+TZiJpQLLQJ17xC/sYQKCAQBwuzJPW3cyuw7kyINcZFrERHRN0y07yCqdENTUBJotYygo9tV0v6cEMEZAMEm/VqGww5d6Ko+gbpTMmkIDH04cAJHXuChGIejQUCLg1Xk/1OF4NhaX0UKkvCZUsL+rmddYW8ZDgq/RFRunw6+kOg54xni2eRpMvcEZCZsm8fzi5qi8cNIjzm+XlCLSDpfJ7aLUzNWZ1va2/PnOUjb6OMT57pTXQ5ZrdSEbJ/UAPh354WfpKOCUj1uJyBnxxVfwK9d35rZzw+trKTL+/GySmst+r2TVMGn9LjVPjTI3NQU2/XCE9CMX7KLVWMKLtIZa91Q++VH8A7wA1L6hYXeTn2MFAoIBAEb5xvdTNX4LEmAzXXU+7kn26UNhuUI5lrJifL0X2BxpxfeDy2wJhTPkzhIDMnBq4TaRgYEO3WIsw21gvMI+yX8X5PQEpT1GJCI71+D0udiwk1Fbcb9n+uM+XnKPGIw/g8annx5Qa0xl+BQEaxjvmUl6h9q9q+Nmst68RivnI6pcULNECWTWmkwQ89yjmpkuPVozRyzWyQUnd8X4Pk/ZzcaTmss3VBuywqN6oyVczZT2RSUoh3Yq8UWfeM8L+Aw9Wc1Bt6LmeLdJ579jugTxShCXSZcUaMjQtgak9DiEPXlHTTGVJKp/cwToQ0JaDLJEvEDLoQSCqSYMB8LUet8chIECggEBANxvUJxCLbx4CZrUJC5O2w01GMDFdTfYOUcK75pFAbXkpBPXDLsuz2dK1y8ANk3ibWWrlV6YKDUwl+gWDHmJOcvKqKKAeUnrhIMmJGaO6C++5DxPE/n7g5M86GA0bu/+B+32wL/65B8HoJrkHnSMJp9GcCsVZA3+2xcJfo+xAiXeiRobRIxCQMYCDDM7Hr7X5jGa7l9bQr4GuWRKRYTroE9LCDnH/LLUN+0ny3UXrSjtTUVL4mVAJT0Ws2H1zUzVDbu7ZQgA0u3GjtdFvAnS/E+ln8DS3Q1DeD6Zsf0hrrJbtwU4zZIU445SZ+IUaTjueB9v/skukoIQi/0Mj+gpZ1c=";
-exports.privateKey = utils_1.base64ToPEM(exports.encodedPrivateKey, "RSA PRIVATE");
+exports.privateKey = (0, utils_1.base64ToPEM)(exports.encodedPrivateKey, "RSA PRIVATE");
 exports.encodedPublicKey = "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAur0hOjhB2QWjwOopCR+Qo27AYv97BJkVaKWPXpj9RfvY1wtpIratDN6tkXN9WCRPzVX8+5qaW034Kvf9WwBZD1ntS8iHYwY1YUaU8Mrp2sRT3K0RqyBlTswIH3HIqpASqv7ZtwDHdhk7Cbd13P5aomJSOjYFhCDUi3sRbjJP1kb6uQLdkZj8fIU518HzSR7Kw7p2mbDqSrGbnaeHWd0Tr3BvDHp9Pi0KpSAVm2qWAXix+BcjMA4ar7kLU1Pre0lt4K4DlSvq5XoHdX9/yvS6KGf+8pXDR9bY6dgRPSG4mzKpiKfkv1eXE8WKs0q3217QZItaSjocw4d0o47vSN+/MAh9V5Zewyb6ogs8JicX3Y3FPG29I1g8iLf3kBZ7V4mUimGuOq/L+1YVvyOTb2zWWMjNmECO2lrxXJc5LWRs5FmSJyCdilRktDE0WTGUo89O+DcF2752qtpUmlV2fllU1LXIAn0TJKiAZspKakamifrgYFIzZK4oZ8wDeFesQB/a/U7wtyv85vknzCtMLI28dnpGQ/ZFHNqWYVaHoHsnEmWion7lgMctnpY5pwKFfUSfZecl2Xqwjk1HZj71A9TFNQj+/x4z957cNtx+utAkGinK3eZF+H1o5YnSgjg4hN41kbXttk8nADerPdF7hDS6np7xzUl6qOicJhEOJ5x0c18CAwEAAQ==";
-exports.publicKey = utils_1.base64ToPEM(exports.encodedPublicKey, "PUBLIC");
+exports.publicKey = (0, utils_1.base64ToPEM)(exports.encodedPublicKey, "PUBLIC");
 // The comments above each fixture are the Scala case classe representation used to generate the encoded cookie
 /*
     val user = AuthenticatedUser(

package/dist/test/panda.test.js

@@ -15,14 +15,14 @@ const fetch_public_key_1 = require("../src/fetch-public-key");
 const fixtures_1 = require("./fixtures");
 const utils_1 = require("../src/utils");
 jest.mock('../src/fetch-public-key');
-jest.useFakeTimers('modern');
+jest.useFakeTimers();
 function userFromCookie(cookie) {
     // This function is only used to generate a `User` object from
     // a well-formed text fixture cookie, in order to check that successful
     // `AuthenticationResult`s have the right shape. As such we don't want
     // to have to deal with the case of a bad cookie so we just cast to `ParsedCookie`.
-    const parsedCookie = utils_1.parseCookie(cookie);
-    return utils_1.parseUser(parsedCookie.data);
+    const parsedCookie = (0, utils_1.parseCookie)(cookie);
+    return (0, utils_1.parseUser)(parsedCookie.data);
 }
 describe('verifyUser', function () {
     test("fail to authenticate if cookie is missing", () => {
@@ -30,7 +30,7 @@ describe('verifyUser', function () {
             success: false,
             reason: 'no-cookie'
         };
-        expect(panda_1.verifyUser(undefined, "", new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(undefined, "", new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("fail to authenticate if signature is malformed", () => {
         const [data, signature] = fixtures_1.sampleCookie.split(".");
@@ -39,7 +39,7 @@ describe('verifyUser', function () {
             success: false,
             reason: 'invalid-cookie'
         };
-        expect(panda_1.verifyUser(testCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(testCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("fail to authenticate if cookie expired and we're outside the grace period", () => {
         // Cookie expires at epoch time 1234
@@ -48,15 +48,15 @@ describe('verifyUser', function () {
             success: false,
             reason: 'expired-cookie'
         };
-        expect(panda_1.verifyUser(fixtures_1.sampleCookie, fixtures_1.publicKey, afterEndOfGracePeriod, api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(fixtures_1.sampleCookie, fixtures_1.publicKey, afterEndOfGracePeriod, api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("fail to authenticate if user fails validation function", () => {
-        expect(panda_1.verifyUser(fixtures_1.sampleCookieWithoutMultifactor, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual({
+        expect((0, panda_1.verifyUser)(fixtures_1.sampleCookieWithoutMultifactor, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual({
             success: false,
             reason: 'invalid-user',
             user: userFromCookie(fixtures_1.sampleCookieWithoutMultifactor)
         });
-        expect(panda_1.verifyUser(fixtures_1.sampleNonGuardianCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual({
+        expect((0, panda_1.verifyUser)(fixtures_1.sampleNonGuardianCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual({
             success: false,
             reason: 'invalid-user',
             user: userFromCookie(fixtures_1.sampleNonGuardianCookie)
@@ -68,7 +68,7 @@ describe('verifyUser', function () {
             reason: 'invalid-cookie'
         };
         const slightlyBadCookie = fixtures_1.sampleCookie.slice(0, -2);
-        expect(panda_1.verifyUser(slightlyBadCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(slightlyBadCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("fail to authenticate with invalid-cookie reason if data part is not base64", () => {
         const expected = {
@@ -78,7 +78,7 @@ describe('verifyUser', function () {
         const [_, signature] = fixtures_1.sampleCookie.split(".");
         const nonBase64Data = "not-base64-data";
         const testCookie = `${nonBase64Data}.${signature}`;
-        expect(panda_1.verifyUser(testCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(testCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("fail to authenticate with invalid-cookie reason if signature part is not base64", () => {
         const expected = {
@@ -88,7 +88,7 @@ describe('verifyUser', function () {
         const [data, _] = fixtures_1.sampleCookie.split(".");
         const nonBase64Signature = "not-base64-signature";
         const testCookie = `${data}.${nonBase64Signature}`;
-        expect(panda_1.verifyUser(testCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(testCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("fail to authenticate with invalid-cookie reason if cookie has no dot separator", () => {
         const expected = {
@@ -96,7 +96,7 @@ describe('verifyUser', function () {
             reason: 'invalid-cookie'
         };
         const noDotCookie = fixtures_1.sampleCookie.replace(".", "");
-        expect(panda_1.verifyUser(noDotCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(noDotCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("fail to authenticate with invalid-cookie reason if cookie has multiple dot separators", () => {
         const expected = {
@@ -104,7 +104,7 @@ describe('verifyUser', function () {
             reason: 'invalid-cookie'
         };
         const multipleDotsCookie = fixtures_1.sampleCookie.replace(".", "..");
-        expect(panda_1.verifyUser(multipleDotsCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(multipleDotsCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("authenticate if the cookie and user are valid", () => {
         const expected = {
@@ -113,7 +113,7 @@ describe('verifyUser', function () {
             shouldRefreshCredentials: false,
             user: userFromCookie(fixtures_1.sampleCookie)
         };
-        expect(panda_1.verifyUser(fixtures_1.sampleCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(fixtures_1.sampleCookie, fixtures_1.publicKey, new Date(0), api_1.guardianValidation)).toStrictEqual(expected);
     });
     test("authenticate with shouldRefreshCredentials if cookie expired but we're within the grace period", () => {
         const beforeEndOfGracePeriod = new Date(1234 + api_1.gracePeriodInMillis - 1);
@@ -123,7 +123,7 @@ describe('verifyUser', function () {
             shouldRefreshCredentials: true,
             mustRefreshByEpochTimeMillis: 1234 + api_1.gracePeriodInMillis
         };
-        expect(panda_1.verifyUser(fixtures_1.sampleCookie, fixtures_1.publicKey, beforeEndOfGracePeriod, api_1.guardianValidation)).toStrictEqual(expected);
+        expect((0, panda_1.verifyUser)(fixtures_1.sampleCookie, fixtures_1.publicKey, beforeEndOfGracePeriod, api_1.guardianValidation)).toStrictEqual(expected);
     });
 });
 describe('createCookie', function () {
@@ -137,8 +137,8 @@ describe('createCookie', function () {
             expires: 1234,
             multifactor: true
         };
-        const cookie = panda_1.createCookie(user, fixtures_1.privateKey);
-        expect(utils_1.decodeBase64(cookie)).toEqual(utils_1.decodeBase64(fixtures_1.sampleCookie));
+        const cookie = (0, panda_1.createCookie)(user, fixtures_1.privateKey);
+        expect((0, utils_1.decodeBase64)(cookie)).toEqual((0, utils_1.decodeBase64)(fixtures_1.sampleCookie));
         expect(cookie).toEqual(fixtures_1.sampleCookie);
     });
 });

package/dist/test/utils.test.js

@@ -4,7 +4,7 @@ const utils_1 = require("../src/utils");
 const fixtures_1 = require("./fixtures");
 const url_1 = require("url");
 test("decode a cookie", () => {
-    const parsedCookie = utils_1.parseCookie(fixtures_1.sampleCookie);
+    const parsedCookie = (0, utils_1.parseCookie)(fixtures_1.sampleCookie);
     expect(parsedCookie).toBeDefined();
     // Unfortunately the above expect() doesn't narrow the type
     if (parsedCookie) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guardian/pan-domain-node",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "NodeJs implementation of Guardian pan-domain auth verification",
   "main": "dist/src/api.js",
   "types": "dist/src/api.d.ts",
@@ -25,13 +25,16 @@
     "@changesets/cli": "^2.27.10",
     "@types/cookie": "^0.4.0",
     "@types/iniparser": "0.0.29",
-    "@types/jest": "^26.0.9",
-    "@types/node": "^14.0.27",
-    "jest": "^26.2.2",
-    "ts-jest": "^26.1.4",
-    "typescript": "^3.9.7"
+    "@types/jest": "^29.5.14",
+    "@types/node": "^22.10.1",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.7.3"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.299.0",
+    "@aws-sdk/credential-providers": "^3.299.0",
+    "@aws-sdk/types": "^3.299.0",
     "cookie": "^0.4.1",
     "iniparser": "^1.0.5"
   },

package/src/fetch-public-key.ts

@@ -1,5 +1,6 @@
 import * as iniparser from 'iniparser';
 import {base64ToPEM, httpGet} from './utils';
+import { S3 } from "@aws-sdk/client-s3";
 
 export interface PublicKeyHolder {
     key: string,
@@ -7,21 +8,36 @@ export interface PublicKeyHolder {
 }
 
 
-export function fetchPublicKey(region: string, bucket: String, keyFile: String): Promise<PublicKeyHolder> {
-    const path = `https://s3.${region}.amazonaws.com/${bucket}/${keyFile}`;
+export function fetchPublicKey(s3: S3, bucket: string, keyFile: string): Promise<PublicKeyHolder> {
 
-    return httpGet(path).then(response => {
-        const config: { publicKey?: string} = iniparser.parseString(response);
+    const publicKeyLocation = {
+        Bucket: bucket,
+        Key: keyFile,
+    };
 
-        if(config.publicKey) {
-            return {
-                key: base64ToPEM(config.publicKey, "PUBLIC"),
-                lastUpdated: new Date()
-            };
-        } else {
-            throw new Error("Missing publicKey setting from config");
-        }
-    });
+    return s3.getObject(publicKeyLocation)
+        .then(({ Body }) => Body?.transformToString())
+        .then((pandaConfigIni) => {
+            if (!pandaConfigIni) {
+                throw Error(`could not read panda config ${JSON.stringify(publicKeyLocation)}`);
+            }
+            else {
+                const config: { publicKey?: string } = iniparser.parseString(pandaConfigIni);
+                if (config.publicKey) {
+                    return {
+                        key: base64ToPEM(config.publicKey, "PUBLIC"),
+                        lastUpdated: new Date()
+                    };
+                } else {
+                    console.log(`Failed to retrieve panda public key from ${JSON.stringify(config)}`);
+                    throw new Error("Missing publicKey setting from config");
+                }
+            }
+        })
+        .catch((error) => {
+            console.error(`Error fetching public key from S3: ${error}`);
+            throw error;
+        });
 }
 
 

package/src/panda.ts

@@ -3,6 +3,9 @@ import * as cookie from 'cookie';
 import {parseCookie, parseUser, sign, verifySignature} from './utils';
 import {User, AuthenticationResult, ValidateUserFn, gracePeriodInMillis} from './api';
 import { fetchPublicKey, PublicKeyHolder } from './fetch-public-key';
+import { S3 } from "@aws-sdk/client-s3";
+import { fromNodeProviderChain } from "@aws-sdk/credential-providers";
+import { AwsCredentialIdentityProvider } from "@aws-sdk/types";
 
 export function createCookie(user: User, privateKey: string): string {
     let queryParams: string[] = [];
@@ -103,15 +106,21 @@ export class PanDomainAuthentication {
     publicKey: Promise<PublicKeyHolder>;
     keyCacheTimeInMillis: number = 60 * 1000; // 1 minute
     keyUpdateTimer?: NodeJS.Timeout;
+    s3Client: S3;
 
-    constructor(cookieName: string, region: string, bucket: string, keyFile: string, validateUser: ValidateUserFn) {
+    constructor(cookieName: string, region: string, bucket: string, keyFile: string, validateUser: ValidateUserFn, credentialsProvider: AwsCredentialIdentityProvider = fromNodeProviderChain()) {
         this.cookieName = cookieName;
         this.region = region;
         this.bucket = bucket;
         this.keyFile = keyFile;
         this.validateUser = validateUser;
 
-        this.publicKey = fetchPublicKey(region, bucket, keyFile);
+        const standardAwsConfig = {
+            region: region,
+            credentials: credentialsProvider,
+        }; 
+        this.s3Client = new S3(standardAwsConfig);
+        this.publicKey = fetchPublicKey(this.s3Client, bucket, keyFile);
 
         this.keyUpdateTimer = setInterval(() => this.getPublicKey(), this.keyCacheTimeInMillis);
     }
@@ -129,7 +138,7 @@ export class PanDomainAuthentication {
             const diff = now.getTime() - lastUpdated.getTime();
 
             if(diff > this.keyCacheTimeInMillis) {
-                this.publicKey = fetchPublicKey(this.region, this.bucket, this.keyFile);
+                this.publicKey = fetchPublicKey(this.s3Client, this.bucket, this.keyFile);
                 return this.publicKey.then(({ key }) => key);
             } else {
                 return key;
@@ -141,7 +150,6 @@ export class PanDomainAuthentication {
         return this.getPublicKey().then(publicKey => {
             const cookies = cookie.parse(requestCookies);
             const pandaCookie = cookies[this.cookieName];
-
             return verifyUser(pandaCookie, publicKey, new Date(), this.validateUser);
         });
     }

package/test/panda.test.ts

@@ -17,7 +17,7 @@ import {
 import {decodeBase64, parseCookie, ParsedCookie, parseUser} from "../src/utils";
 
 jest.mock('../src/fetch-public-key');
-jest.useFakeTimers('modern');
+jest.useFakeTimers();
 
 function userFromCookie(cookie: string): User {
     // This function is only used to generate a `User` object from