@hubspot/app-connect-sdk 1.0.0-alpha.3 → 1.0.0-alpha.4

package/dist/server/utils/jwt-utils.js

@@ -1,87 +0,0 @@
-import { base64url, base64urlDecode } from "../shared/encoding/base64.js";
-//#region src/server/utils/jwt-utils.ts
-/**
-* Low-level helper that encodes a JWS Compact Serialization JWT
-* (RFC 7519) and signs it with the supplied `privateKey` using
-* ES256 (P-256 + SHA-256). Returns the three-segment compact form.
-*/
-async function encodeAndSignJwt(options) {
-	const { header, payload, privateKey } = options;
-	const signingInput = `${base64url(new TextEncoder().encode(JSON.stringify(header)))}.${base64url(new TextEncoder().encode(JSON.stringify(payload)))}`;
-	const signatureBuffer = await crypto.subtle.sign({
-		name: "ECDSA",
-		hash: "SHA-256"
-	}, privateKey, new TextEncoder().encode(signingInput));
-	return `${signingInput}.${base64url(new Uint8Array(signatureBuffer))}`;
-}
-async function importPublicKey(jwk) {
-	return crypto.subtle.importKey("jwk", jwk, {
-		name: "ECDSA",
-		namedCurve: "P-256"
-	}, false, ["verify"]);
-}
-/**
-* Verifies the ES256 signature on `token` against `publicKeyJwk` and
-* returns the decoded payload. Does not check `exp` — use
-* {@link verifyJwt} when expiry enforcement is desired.
-*
-* @throws {Error} When the token isn't three segments, when the
-*   signature fails verification, or when the payload isn't valid
-*   JSON.
-*/
-async function decodeAndVerifyJwt(options) {
-	const { token, publicKeyJwk } = options;
-	const parts = token.split(".");
-	if (parts.length !== 3) throw new Error("Invalid JWT format");
-	const [encodedHeader, encodedPayload, encodedSignature] = parts;
-	const publicKey = await importPublicKey(publicKeyJwk);
-	if (!await crypto.subtle.verify({
-		name: "ECDSA",
-		hash: "SHA-256"
-	}, publicKey, base64urlDecode(encodedSignature), new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`))) throw new Error("JWT signature verification failed");
-	return JSON.parse(new TextDecoder().decode(base64urlDecode(encodedPayload)));
-}
-/**
-* Verifies signature and (if present) `exp` (RFC 7519 §4.1.4) on a
-* JWT and returns its payload.
-*
-* @throws {Error} When the signature fails or when `exp` has passed.
-*/
-async function verifyJwt(options) {
-	const { token, publicKeyJwk } = options;
-	const payload = await decodeAndVerifyJwt({
-		token,
-		publicKeyJwk
-	});
-	const now = Math.floor(Date.now() / 1e3);
-	if (typeof payload["exp"] === "number" && payload["exp"] < now) throw new Error("JWT expired");
-	return payload;
-}
-/**
-* Signs a JWT (RFC 7519) with `alg=ES256, typ=JWT` and returns the
-* compact serialization. Always sets `iat` to the current second; the
-* caller controls every other claim via `payload`.
-*/
-async function signJwt(options) {
-	const { privateKey, payload, ttlSeconds } = options;
-	const now = Math.floor(Date.now() / 1e3);
-	return encodeAndSignJwt({
-		header: {
-			alg: "ES256",
-			typ: "JWT"
-		},
-		payload: ttlSeconds !== void 0 ? {
-			iat: now,
-			exp: now + ttlSeconds,
-			...payload
-		} : {
-			iat: now,
-			...payload
-		},
-		privateKey
-	});
-}
-//#endregion
-export { decodeAndVerifyJwt, encodeAndSignJwt, signJwt, verifyJwt };
-
-//# sourceMappingURL=jwt-utils.js.map

package/dist/server/utils/jwt-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-utils.js","names":[],"sources":["../../../src/server/utils/jwt-utils.ts"],"sourcesContent":["import { base64url, base64urlDecode } from './base64-utils.ts';\n\ninterface EncodeAndSignJwtOptions {\n  header: Record<string, unknown>;\n  payload: Record<string, unknown>;\n  privateKey: CryptoKey;\n}\n\n/**\n * Low-level helper that encodes a JWS Compact Serialization JWT\n * (RFC 7519) and signs it with the supplied `privateKey` using\n * ES256 (P-256 + SHA-256). Returns the three-segment compact form.\n */\nexport async function encodeAndSignJwt(\n  options: EncodeAndSignJwtOptions\n): Promise<string> {\n  const { header, payload, privateKey } = options;\n\n  const encodedHeader = base64url(\n    new TextEncoder().encode(JSON.stringify(header))\n  );\n  const encodedPayload = base64url(\n    new TextEncoder().encode(JSON.stringify(payload))\n  );\n  const signingInput = `${encodedHeader}.${encodedPayload}`;\n  const signatureBuffer = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    privateKey,\n    new TextEncoder().encode(signingInput)\n  );\n  return `${signingInput}.${base64url(new Uint8Array(signatureBuffer))}`;\n}\n\nasync function importPublicKey(jwk: JsonWebKey): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    'jwk',\n    jwk,\n    { name: 'ECDSA', namedCurve: 'P-256' },\n    false,\n    ['verify']\n  );\n}\n\ninterface DecodeAndVerifyJwtOptions {\n  token: string;\n  publicKeyJwk: JsonWebKey;\n}\n\n/**\n * Verifies the ES256 signature on `token` against `publicKeyJwk` and\n * returns the decoded payload. Does not check `exp` — use\n * {@link verifyJwt} when expiry enforcement is desired.\n *\n * @throws {Error} When the token isn't three segments, when the\n *   signature fails verification, or when the payload isn't valid\n *   JSON.\n */\nexport async function decodeAndVerifyJwt(\n  options: DecodeAndVerifyJwtOptions\n): Promise<Record<string, unknown>> {\n  const { token, publicKeyJwk } = options;\n  const parts = token.split('.');\n  if (parts.length !== 3) throw new Error('Invalid JWT format');\n  const [encodedHeader, encodedPayload, encodedSignature] = parts as [\n    string,\n    string,\n    string,\n  ];\n  const publicKey = await importPublicKey(publicKeyJwk);\n  const valid = await crypto.subtle.verify(\n    { name: 'ECDSA', hash: 'SHA-256' },\n    publicKey,\n    base64urlDecode(encodedSignature),\n    new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`)\n  );\n  if (!valid) throw new Error('JWT signature verification failed');\n  return JSON.parse(\n    new TextDecoder().decode(base64urlDecode(encodedPayload))\n  ) as Record<string, unknown>;\n}\n\nexport interface VerifyJwtOptions {\n  /** Compact-serialized JWT to verify. */\n  token: string;\n  /** Public key in JWK form. Caller is responsible for trusting it. */\n  publicKeyJwk: JsonWebKey;\n}\n\n/**\n * Verifies signature and (if present) `exp` (RFC 7519 §4.1.4) on a\n * JWT and returns its payload.\n *\n * @throws {Error} When the signature fails or when `exp` has passed.\n */\nexport async function verifyJwt(\n  options: VerifyJwtOptions\n): Promise<Record<string, unknown>> {\n  const { token, publicKeyJwk } = options;\n  const payload = await decodeAndVerifyJwt({ token, publicKeyJwk });\n  const now = Math.floor(Date.now() / 1000);\n  if (typeof payload['exp'] === 'number' && payload['exp'] < now) {\n    throw new Error('JWT expired');\n  }\n  return payload;\n}\n\nexport interface SignJwtOptions {\n  /** ES256 private key as a non-extractable WebCrypto key. */\n  privateKey: CryptoKey;\n  /**\n   * Custom claims merged onto an `iat` claim (and `exp` when\n   * `ttlSeconds` is supplied). Caller-provided keys override the\n   * standard ones.\n   */\n  payload: Record<string, unknown>;\n  /**\n   * Lifetime of the token in seconds. When set, the JWT's `exp` claim\n   * is computed as `iat + ttlSeconds`. When omitted, no `exp` is added\n   * (the caller is responsible for one if needed).\n   */\n  ttlSeconds?: number;\n}\n\n/**\n * Signs a JWT (RFC 7519) with `alg=ES256, typ=JWT` and returns the\n * compact serialization. Always sets `iat` to the current second; the\n * caller controls every other claim via `payload`.\n */\nexport async function signJwt(options: SignJwtOptions): Promise<string> {\n  const { privateKey, payload, ttlSeconds } = options;\n  const now = Math.floor(Date.now() / 1000);\n  const payloadWithStandardClaims =\n    ttlSeconds !== undefined\n      ? { iat: now, exp: now + ttlSeconds, ...payload }\n      : { iat: now, ...payload };\n  return encodeAndSignJwt({\n    header: { alg: 'ES256', typ: 'JWT' },\n    payload: payloadWithStandardClaims,\n    privateKey,\n  });\n}\n"],"mappings":";;;;;;;AAaA,eAAsB,iBACpB,SACiB;CACjB,MAAM,EAAE,QAAQ,SAAS,eAAe;CAQxC,MAAM,eAAe,GANC,UACpB,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,OAAO,CAAC,CAKb,CAAC,GAHf,UACrB,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,QAAQ,CAAC,CAEI;CACvD,MAAM,kBAAkB,MAAM,OAAO,OAAO,KAC1C;EAAE,MAAM;EAAS,MAAM;EAAW,EAClC,YACA,IAAI,aAAa,CAAC,OAAO,aAAa,CACvC;CACD,OAAO,GAAG,aAAa,GAAG,UAAU,IAAI,WAAW,gBAAgB,CAAC;;AAGtE,eAAe,gBAAgB,KAAqC;CAClE,OAAO,OAAO,OAAO,UACnB,OACA,KACA;EAAE,MAAM;EAAS,YAAY;EAAS,EACtC,OACA,CAAC,SAAS,CACX;;;;;;;;;;;AAiBH,eAAsB,mBACpB,SACkC;CAClC,MAAM,EAAE,OAAO,iBAAiB;CAChC,MAAM,QAAQ,MAAM,MAAM,IAAI;CAC9B,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,qBAAqB;CAC7D,MAAM,CAAC,eAAe,gBAAgB,oBAAoB;CAK1D,MAAM,YAAY,MAAM,gBAAgB,aAAa;CAOrD,IAAI,CAAC,MANe,OAAO,OAAO,OAChC;EAAE,MAAM;EAAS,MAAM;EAAW,EAClC,WACA,gBAAgB,iBAAiB,EACjC,IAAI,aAAa,CAAC,OAAO,GAAG,cAAc,GAAG,iBAAiB,CAC/D,EACW,MAAM,IAAI,MAAM,oCAAoC;CAChE,OAAO,KAAK,MACV,IAAI,aAAa,CAAC,OAAO,gBAAgB,eAAe,CAAC,CAC1D;;;;;;;;AAgBH,eAAsB,UACpB,SACkC;CAClC,MAAM,EAAE,OAAO,iBAAiB;CAChC,MAAM,UAAU,MAAM,mBAAmB;EAAE;EAAO;EAAc,CAAC;CACjE,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CACzC,IAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,SAAS,KACzD,MAAM,IAAI,MAAM,cAAc;CAEhC,OAAO;;;;;;;AAyBT,eAAsB,QAAQ,SAA0C;CACtE,MAAM,EAAE,YAAY,SAAS,eAAe;CAC5C,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAKzC,OAAO,iBAAiB;EACtB,QAAQ;GAAE,KAAK;GAAS,KAAK;GAAO;EACpC,SALA,eAAe,KAAA,IACX;GAAE,KAAK;GAAK,KAAK,MAAM;GAAY,GAAG;GAAS,GAC/C;GAAE,KAAK;GAAK,GAAG;GAAS;EAI5B;EACD,CAAC"}