@hawcx/oauth-client 0.2.0 → 5.1.0

package/dist/stepup/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./client"), exports);
+__exportStar(require("./types"), exports);
+//# sourceMappingURL=index.js.map

package/dist/stepup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/stepup/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,0CAAwB"}

package/dist/stepup/types.d.ts

@@ -0,0 +1,35 @@
+export type StepUpPurpose = 'change_mfa_method';
+export type HxAuthMfaMethod = 'sms_otp' | 'email_otp' | 'totp';
+export interface StepUpStartTokenResponse {
+    start_token: string;
+    expires_in: number;
+}
+export interface StepUpConsumeResponse {
+    ok: boolean;
+}
+export interface StepUpStartOptions {
+    userId: string;
+    purpose: StepUpPurpose;
+    newMfaMethod: HxAuthMfaMethod;
+}
+export interface StepUpConsumeOptions {
+    receipt: string;
+}
+export interface StepUpClientBaseOptions {
+    /** Base URL to hx_auth, e.g. http://localhost:8000 */
+    baseUrl: string;
+    /** API version prefix (default: /v1) */
+    apiPrefix?: string;
+    /** Required by hx_auth for tenant routing in most deployments (forwarded via headers). */
+    tenantHeaderName?: string;
+    tenantHeaderValue?: string;
+    /** Required by hx_auth relying party validation. */
+    relyingParty?: string;
+    /** Optional additional headers (e.g., apikey) */
+    extraHeaders?: Record<string, string>;
+    /** Request timeout in seconds (default: 15) */
+    timeoutSeconds?: number;
+    /** Allowed response timestamp skew in seconds (default: 300) */
+    clockSkewSeconds?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/stepup/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/stepup/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEhD,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,eAAe,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,+CAA+C;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/stepup/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/stepup/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/stepup/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,40 +1,38 @@
 {
   "name": "@hawcx/oauth-client",
-  "version": "0.2.0",
-  "description": "Lightweight OAuth client for exchanging authorization codes and verifying JWT claims with Hawcx delegation support",
+  "version": "5.1.0",
+  "description": "Simple OAuth client for Hawcx authentication with delegation support",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
     "build": "tsc",
     "test": "jest",
-    "test:coverage": "jest --coverage",
-    "lint": "eslint 'src/**/*.ts'",
-    "format": "prettier --write 'src/**/*.ts'",
+    "lint": "eslint \"src/**/*.ts\"",
+    "format": "prettier --write \"src/**/*.ts\"",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
     "oauth",
     "jwt",
     "authentication",
-    "oauth2",
-    "verification",
     "hawcx",
+    "pkce",
     "mfa",
-    "delegation",
-    "pkce"
+    "delegation"
   ],
   "author": "Hawcx Team",
   "license": "MIT",
   "dependencies": {
-    "jsonwebtoken": "^9.0.2",
-    "axios": "^1.6.0",
-    "uuid": "^9.0.0"
+    "jose": "^5.10.0"
+  },
+  "overrides": {
+    "@typescript-eslint/typescript-estree": {
+      "minimatch": ">=9.0.7"
+    }
   },
   "devDependencies": {
     "@types/jest": "^29.5.0",
-    "@types/jsonwebtoken": "^9.0.5",
     "@types/node": "^20.10.0",
-    "@types/uuid": "^9.0.0",
     "@typescript-eslint/eslint-plugin": "^6.0.0",
     "@typescript-eslint/parser": "^6.0.0",
     "eslint": "^8.50.0",
@@ -44,7 +42,7 @@
     "typescript": "^5.3.0"
   },
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=18.0.0"
   },
   "files": [
     "dist",
@@ -52,4 +50,3 @@
     "LICENSE"
   ]
 }
-

package/dist/client.d.ts

@@ -1,134 +0,0 @@
-/**
- * Core OAuth client implementation
- */
-/**
- * Options for exchanging authorization code for claims
- */
-export interface ExchangeCodeOptions {
-    /** Authorization code from OAuth flow */
-    code: string;
-    /** Token endpoint URL */
-    oauthTokenUrl: string;
-    /** OAuth client identifier */
-    clientId: string;
-    /** Ed25519 public key (PEM string or file path) - optional if jwksUrl provided */
-    publicKey?: string;
-    /** JWKS URL for dynamic key fetching (alternative to publicKey) */
-    jwksUrl?: string;
-    /** API key for OAuth provider (required for Hawcx) */
-    apiKey: string;
-    /** PKCE code verifier (optional, recommended for security) */
-    codeVerifier?: string;
-    /** OAuth redirect URI (optional, required by some providers) */
-    redirectUri?: string;
-    /** Request timeout in seconds (default: 20) */
-    timeout?: number;
-    /** Expected 'aud' claim (optional but recommended) */
-    audience?: string;
-    /** Expected 'iss' claim (optional but recommended) */
-    issuer?: string;
-    /** Verify token expiration (default: true) */
-    verifyExp?: boolean;
-    /** Clock skew tolerance in seconds (default: 0) */
-    leeway?: number;
-    /** List of allowed signing algorithms (default: RS256, ES256/384/512, EdDSA) */
-    algorithms?: string[];
-}
-/**
- * Options for verifying JWT tokens
- */
-export interface VerifyJwtOptions {
-    /** JWT token to verify */
-    token: string;
-    /** Public key for JWT verification (PEM string or file path) - optional if jwksUrl provided */
-    publicKey?: string;
-    /** JWKS URL for dynamic key fetching (alternative to publicKey) */
-    jwksUrl?: string;
-    /** Expected 'aud' claim (optional but recommended) */
-    audience?: string;
-    /** Expected 'iss' claim (optional but recommended) */
-    issuer?: string;
-    /** Verify token expiration (default: true) */
-    verifyExp?: boolean;
-    /** Clock skew tolerance in seconds (default: 0) */
-    leeway?: number;
-    /** List of allowed signing algorithms (default: RS256, ES256/384/512, EdDSA) */
-    algorithms?: string[];
-}
-/**
- * Exchange OAuth authorization code for verified JWT claims.
- *
- * Supports PKCE (Proof Key for Code Exchange) per RFC 7636 for enhanced security.
- *
- * @param options - Configuration options for code exchange
- * @returns Dictionary containing the verified JWT claims
- * @throws OAuthExchangeError - Code exchange failed
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- *
- * @example
- * ```typescript
- * // Basic usage
- * const claims = await exchangeCodeForClaims({
- *   code: req.body.code,
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: '/path/to/public.pem'
- * });
- *
- * // With PKCE (recommended)
- * const claims = await exchangeCodeForClaims({
- *   code: req.body.code,
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: process.env.OAUTH_PUBLIC_KEY!,
- *   codeVerifier: session.pkceVerifier,
- *   redirectUri: 'https://myapp.com/callback',
- *   audience: 'my-app',
- *   issuer: 'https://oauth.example.com'
- * });
- * ```
- */
-export declare function exchangeCodeForClaims(options: ExchangeCodeOptions): Promise<Record<string, any>>;
-/**
- * Exchange OAuth authorization code for verified JWT claims and the raw id_token.
- *
- * @param options - Configuration options for code exchange
- * @returns Tuple containing [claims, idToken]
- * @throws OAuthExchangeError - Code exchange failed
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- */
-export declare function exchangeCodeForTokenAndClaims(options: ExchangeCodeOptions): Promise<[Record<string, any>, string]>;
-/**
- * Verify a JWT and return its claims.
- *
- * This function verifies the JWT signature using the provided public key
- * and validates claims (audience, issuer, expiration).
- *
- * @param options - Configuration options for JWT verification
- * @returns Dictionary containing the verified JWT claims
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- *
- * @example
- * ```typescript
- * // Basic usage
- * const claims = verifyJwt({
- *   token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...',
- *   publicKey: 'keys/public.pem'
- * });
- * console.log(`User: ${claims.sub}`);
- *
- * // With validation
- * const claims = verifyJwt({
- *   token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...',
- *   publicKey: process.env.OAUTH_PUBLIC_KEY!,
- *   audience: 'my-app',
- *   issuer: 'https://oauth.example.com',
- *   leeway: 10  // Allow 10 seconds clock skew
- * });
- * ```
- */
-export declare function verifyJwt(options: VerifyJwtOptions): Promise<Record<string, any>>;
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAgED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAwE9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAiDxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAkHvF"}

package/dist/client.js

@@ -1,300 +0,0 @@
-"use strict";
-/**
- * Core OAuth client implementation
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.exchangeCodeForClaims = exchangeCodeForClaims;
-exports.exchangeCodeForTokenAndClaims = exchangeCodeForTokenAndClaims;
-exports.verifyJwt = verifyJwt;
-const axios_1 = __importDefault(require("axios"));
-const jwt = __importStar(require("jsonwebtoken"));
-const utils_1 = require("./utils");
-const exceptions_1 = require("./exceptions");
-/**
- * Internal helper to perform the code-for-token exchange with optional PKCE support
- */
-async function exchangeForToken(code, oauthTokenUrl, clientId, apiKey, timeout = 20, codeVerifier, redirectUri) {
-    try {
-        // Build token request payload
-        const payload = {
-            grant_type: 'authorization_code',
-            code,
-            client_id: clientId,
-        };
-        // Add PKCE code_verifier if provided (RFC 7636)
-        if (codeVerifier) {
-            payload.code_verifier = codeVerifier;
-        }
-        // Add redirect_uri if provided (OAuth 2.0 standard)
-        if (redirectUri) {
-            payload.redirect_uri = redirectUri;
-        }
-        const headers = {
-            'Content-Type': 'application/x-www-form-urlencoded',
-            Accept: 'application/json',
-            apikey: apiKey,
-        };
-        const response = await axios_1.default.post(oauthTokenUrl, payload, {
-            timeout: timeout * 1000,
-            headers,
-        });
-        return response.data;
-    }
-    catch (error) {
-        if (axios_1.default.isAxiosError(error)) {
-            const axiosError = error;
-            if (axiosError.response) {
-                const responseBody = axiosError.response.data;
-                const errorMsg = responseBody?.error_description ||
-                    responseBody?.error ||
-                    'Unknown server error';
-                throw new exceptions_1.OAuthExchangeError(`Code exchange failed: ${errorMsg}`, axiosError.response.status, responseBody);
-            }
-        }
-        throw new exceptions_1.OAuthExchangeError(`Network error while exchanging code: ${error}`);
-    }
-}
-/**
- * Exchange OAuth authorization code for verified JWT claims.
- *
- * Supports PKCE (Proof Key for Code Exchange) per RFC 7636 for enhanced security.
- *
- * @param options - Configuration options for code exchange
- * @returns Dictionary containing the verified JWT claims
- * @throws OAuthExchangeError - Code exchange failed
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- *
- * @example
- * ```typescript
- * // Basic usage
- * const claims = await exchangeCodeForClaims({
- *   code: req.body.code,
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: '/path/to/public.pem'
- * });
- *
- * // With PKCE (recommended)
- * const claims = await exchangeCodeForClaims({
- *   code: req.body.code,
- *   oauthTokenUrl: 'https://oauth.example.com/token',
- *   clientId: 'my-app',
- *   publicKey: process.env.OAUTH_PUBLIC_KEY!,
- *   codeVerifier: session.pkceVerifier,
- *   redirectUri: 'https://myapp.com/callback',
- *   audience: 'my-app',
- *   issuer: 'https://oauth.example.com'
- * });
- * ```
- */
-async function exchangeCodeForClaims(options) {
-    const { code, oauthTokenUrl, clientId, publicKey, jwksUrl, apiKey, codeVerifier, redirectUri, timeout = 20, audience, issuer, verifyExp = true, leeway = 0, algorithms, } = options;
-    // Input validation
-    if (!code || typeof code !== 'string') {
-        throw new exceptions_1.OAuthExchangeError('Authorization code must be a non-empty string');
-    }
-    if (!oauthTokenUrl || typeof oauthTokenUrl !== 'string') {
-        throw new exceptions_1.OAuthExchangeError('OAuth token URL must be a non-empty string');
-    }
-    if (!clientId || typeof clientId !== 'string') {
-        throw new exceptions_1.OAuthExchangeError('Client ID must be a non-empty string');
-    }
-    if (!apiKey || typeof apiKey !== 'string') {
-        throw new exceptions_1.OAuthExchangeError('API key must be a non-empty string');
-    }
-    if (!publicKey && !jwksUrl) {
-        throw new exceptions_1.OAuthExchangeError("Must provide either 'publicKey' or 'jwksUrl' for JWT verification");
-    }
-    // Exchange code for id_token (with PKCE support)
-    const responseBody = await exchangeForToken(code, oauthTokenUrl, clientId, apiKey, timeout, codeVerifier, redirectUri);
-    const idToken = responseBody.id_token;
-    if (!idToken) {
-        throw new exceptions_1.OAuthExchangeError("OAuth server response missing 'id_token' field", undefined, responseBody);
-    }
-    // Verify JWT
-    const claims = await verifyJwt({
-        token: idToken,
-        publicKey,
-        jwksUrl,
-        audience,
-        issuer,
-        verifyExp,
-        leeway,
-        algorithms,
-    });
-    return claims;
-}
-/**
- * Exchange OAuth authorization code for verified JWT claims and the raw id_token.
- *
- * @param options - Configuration options for code exchange
- * @returns Tuple containing [claims, idToken]
- * @throws OAuthExchangeError - Code exchange failed
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- */
-async function exchangeCodeForTokenAndClaims(options) {
-    const { code, oauthTokenUrl, clientId, publicKey, jwksUrl, apiKey, codeVerifier, redirectUri, timeout = 20, audience, issuer, verifyExp = true, leeway = 0, algorithms, } = options;
-    const responseBody = await exchangeForToken(code, oauthTokenUrl, clientId, apiKey, timeout, codeVerifier, redirectUri);
-    const idToken = responseBody.id_token;
-    if (!idToken) {
-        throw new exceptions_1.OAuthExchangeError("OAuth server response missing 'id_token' field", undefined, responseBody);
-    }
-    const claims = await verifyJwt({
-        token: idToken,
-        publicKey,
-        jwksUrl,
-        audience,
-        issuer,
-        verifyExp,
-        leeway,
-        algorithms,
-    });
-    return [claims, idToken];
-}
-/**
- * Verify a JWT and return its claims.
- *
- * This function verifies the JWT signature using the provided public key
- * and validates claims (audience, issuer, expiration).
- *
- * @param options - Configuration options for JWT verification
- * @returns Dictionary containing the verified JWT claims
- * @throws JWTVerificationError - JWT verification failed
- * @throws InvalidPublicKeyError - Public key invalid
- *
- * @example
- * ```typescript
- * // Basic usage
- * const claims = verifyJwt({
- *   token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...',
- *   publicKey: 'keys/public.pem'
- * });
- * console.log(`User: ${claims.sub}`);
- *
- * // With validation
- * const claims = verifyJwt({
- *   token: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...',
- *   publicKey: process.env.OAUTH_PUBLIC_KEY!,
- *   audience: 'my-app',
- *   issuer: 'https://oauth.example.com',
- *   leeway: 10  // Allow 10 seconds clock skew
- * });
- * ```
- */
-async function verifyJwt(options) {
-    const { token, publicKey, jwksUrl, audience, issuer, verifyExp = true, leeway = 0, algorithms, } = options;
-    // Input validation
-    if (!token || typeof token !== 'string') {
-        throw new exceptions_1.JWTVerificationError('Token must be a non-empty string');
-    }
-    if (!publicKey && !jwksUrl) {
-        throw new exceptions_1.JWTVerificationError("Must provide either 'publicKey' or 'jwksUrl'");
-    }
-    // Load and validate public key - jwksUrl takes precedence
-    let pemKey;
-    try {
-        if (jwksUrl) {
-            // First decode JWT header to get kid
-            const header = jwt.decode(token, { complete: true })?.header;
-            if (!header) {
-                throw new exceptions_1.JWTVerificationError('Failed to decode JWT header');
-            }
-            const kid = header.kid;
-            const jwks = await (0, utils_1.fetchJwks)(jwksUrl);
-            pemKey = (0, utils_1.getKeyFromJwks)(jwks, kid);
-        }
-        else {
-            pemKey = (0, utils_1.loadPublicKey)(publicKey);
-        }
-    }
-    catch (error) {
-        if (error instanceof exceptions_1.InvalidPublicKeyError) {
-            throw error;
-        }
-        throw new exceptions_1.InvalidPublicKeyError(`Unexpected error loading public key: ${error}`);
-    }
-    // Build verification options
-    const verifyOptions = {
-        algorithms: algorithms || ['RS256', 'ES256', 'ES384', 'ES512', 'EdDSA'],
-        clockTolerance: leeway,
-        ignoreExpiration: !verifyExp,
-    };
-    if (audience) {
-        verifyOptions.audience = audience;
-    }
-    if (issuer) {
-        verifyOptions.issuer = issuer;
-    }
-    // Decode and verify
-    try {
-        const claims = jwt.verify(token, pemKey, verifyOptions);
-        // jwt.verify can return string or object, ensure we have an object
-        if (typeof claims === 'string') {
-            throw new exceptions_1.JWTVerificationError('Unexpected JWT format: claims is a string');
-        }
-        return claims;
-    }
-    catch (error) {
-        if (error instanceof jwt.TokenExpiredError) {
-            throw new exceptions_1.JWTVerificationError('Token has expired. Please re-authenticate.', error);
-        }
-        if (error instanceof jwt.JsonWebTokenError) {
-            if (error.message.includes('audience')) {
-                throw new exceptions_1.JWTVerificationError(`Token audience validation failed. Expected: ${audience}`, error);
-            }
-            if (error.message.includes('issuer')) {
-                throw new exceptions_1.JWTVerificationError(`Token issuer validation failed. Expected: ${issuer}`, error);
-            }
-            if (error.message.includes('signature')) {
-                throw new exceptions_1.JWTVerificationError('Token signature verification failed. Token may have been tampered with.', error);
-            }
-            if (error.message.includes('jwt malformed')) {
-                throw new exceptions_1.JWTVerificationError('Token has invalid structure or encoding', error);
-            }
-            throw new exceptions_1.JWTVerificationError(`Token validation failed: ${error.message}`, error);
-        }
-        if (error instanceof jwt.NotBeforeError) {
-            throw new exceptions_1.JWTVerificationError('Token not yet valid (nbf claim). Check server clock synchronization.', error);
-        }
-        throw new exceptions_1.JWTVerificationError(`Unexpected error during JWT verification: ${error}`, error);
-    }
-}
-//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmKH,sDA0EC;AAWD,sEAmDC;AAgCD,8BAkHC;AA3bD,kDAA0C;AAC1C,kDAAoC;AACpC,mCAAmE;AACnE,6CAIsB;AA0DtB;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EACZ,aAAqB,EACrB,QAAgB,EAChB,MAAc,EACd,UAAkB,EAAE,EACpB,YAAqB,EACrB,WAAoB;IAEpB,IAAI,CAAC;QACH,8BAA8B;QAC9B,MAAM,OAAO,GAAQ;YACnB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,QAAQ;SACpB,CAAC;QAEF,gDAAgD;QAChD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC;QACvC,CAAC;QAED,oDAAoD;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAQ;YACnB,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM;SACf,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,eAAK,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE;YACxD,OAAO,EAAE,OAAO,GAAG,IAAI;YACvB,OAAO;SACR,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,KAAmB,CAAC;YACvC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC9C,MAAM,QAAQ,GACX,YAAoB,EAAE,iBAAiB;oBACvC,YAAoB,EAAE,KAAK;oBAC5B,sBAAsB,CAAC;gBACzB,MAAM,IAAI,+BAAkB,CAC1B,yBAAyB,QAAQ,EAAE,EACnC,UAAU,CAAC,QAAQ,CAAC,MAAM,EAC1B,YAAY,CACb,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,+BAAkB,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACI,KAAK,UAAU,qBAAqB,CACzC,OAA4B;IAE5B,MAAM,EACJ,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,SAAS,EACT,OAAO,EACP,MAAM,EACN,YAAY,EACZ,WAAW,EACX,OAAO,GAAG,EAAE,EACZ,QAAQ,EACR,MAAM,EACN,SAAS,GAAG,IAAI,EAChB,MAAM,GAAG,CAAC,EACV,UAAU,GACX,GAAG,OAAO,CAAC;IAEZ,mBAAmB;IACnB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,+BAAkB,CAAC,+CAA+C,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,+BAAkB,CAAC,4CAA4C,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,+BAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,+BAAkB,CAAC,oCAAoC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,+BAAkB,CAAC,mEAAmE,CAAC,CAAC;IACpG,CAAC;IAED,iDAAiD;IACjD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,MAAM,EACN,OAAO,EACP,YAAY,EACZ,WAAW,CACZ,CAAC;IAEF,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,+BAAkB,CAC1B,gDAAgD,EAChD,SAAS,EACT,YAAY,CACb,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,KAAK,EAAE,OAAO;QACd,SAAS;QACT,OAAO;QACP,QAAQ;QACR,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,6BAA6B,CACjD,OAA4B;IAE5B,MAAM,EACJ,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,SAAS,EACT,OAAO,EACP,MAAM,EACN,YAAY,EACZ,WAAW,EACX,OAAO,GAAG,EAAE,EACZ,QAAQ,EACR,MAAM,EACN,SAAS,GAAG,IAAI,EAChB,MAAM,GAAG,CAAC,EACV,UAAU,GACX,GAAG,OAAO,CAAC;IAEZ,MAAM,YAAY,GAAG,MAAM,gBAAgB,CACzC,IAAI,EACJ,aAAa,EACb,QAAQ,EACR,MAAM,EACN,OAAO,EACP,YAAY,EACZ,WAAW,CACZ,CAAC;IAEF,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,+BAAkB,CAC1B,gDAAgD,EAChD,SAAS,EACT,YAAY,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,KAAK,EAAE,OAAO;QACd,SAAS;QACT,OAAO;QACP,QAAQ;QACR,MAAM;QACN,SAAS;QACT,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACI,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,MAAM,EACJ,KAAK,EACL,SAAS,EACT,OAAO,EACP,QAAQ,EACR,MAAM,EACN,SAAS,GAAG,IAAI,EAChB,MAAM,GAAG,CAAC,EACV,UAAU,GACX,GAAG,OAAO,CAAC;IAEZ,mBAAmB;IACnB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,iCAAoB,CAAC,kCAAkC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,iCAAoB,CAAC,8CAA8C,CAAC,CAAC;IACjF,CAAC;IAED,0DAA0D;IAC1D,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACZ,qCAAqC;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;YAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iCAAoB,CAAC,6BAA6B,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAA,iBAAS,EAAC,OAAO,CAAC,CAAC;YACtC,MAAM,GAAG,IAAA,sBAAc,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAA,qBAAa,EAAC,SAAU,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,kCAAqB,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,6BAA6B;IAC7B,MAAM,aAAa,GAAsB;QACvC,UAAU,EAAG,UAA8B,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC5F,cAAc,EAAE,MAAM;QACtB,gBAAgB,EAAE,CAAC,SAAS;KAC7B,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC;IAChC,CAAC;IAED,oBAAoB;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAExD,mEAAmE;QACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,iCAAoB,CAAC,2CAA2C,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,MAA6B,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3C,MAAM,IAAI,iCAAoB,CAC5B,4CAA4C,EAC5C,KAAK,CACN,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,iCAAoB,CAC5B,+CAA+C,QAAQ,EAAE,EACzD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,iCAAoB,CAC5B,6CAA6C,MAAM,EAAE,EACrD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,iCAAoB,CAC5B,yEAAyE,EACzE,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,iCAAoB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YACnF,CAAC;YAED,MAAM,IAAI,iCAAoB,CAAC,4BAA4B,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,KAAK,YAAY,GAAG,CAAC,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,iCAAoB,CAC5B,sEAAsE,EACtE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,iCAAoB,CAC5B,6CAA6C,KAAK,EAAE,EACpD,KAAc,CACf,CAAC;IACJ,CAAC;AACH,CAAC"}