@knocklabs/node 0.6.19 → 1.1.0

package/internal/utils.d.ts

@@ -0,0 +1,7 @@
+export * from "./utils/values.js";
+export * from "./utils/base64.js";
+export * from "./utils/env.js";
+export * from "./utils/log.js";
+export * from "./utils/uuid.js";
+export * from "./utils/sleep.js";
+//# sourceMappingURL=utils.d.ts.map

package/internal/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/internal/utils.ts"],"names":[],"mappings":""}

package/internal/utils.js

@@ -0,0 +1,11 @@
+"use strict";
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("./tslib.js");
+tslib_1.__exportStar(require("./utils/values.js"), exports);
+tslib_1.__exportStar(require("./utils/base64.js"), exports);
+tslib_1.__exportStar(require("./utils/env.js"), exports);
+tslib_1.__exportStar(require("./utils/log.js"), exports);
+tslib_1.__exportStar(require("./utils/uuid.js"), exports);
+tslib_1.__exportStar(require("./utils/sleep.js"), exports);
+//# sourceMappingURL=utils.js.map

package/internal/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/internal/utils.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;AAEtF,4DAA+B;AAC/B,4DAA+B;AAC/B,yDAA4B;AAC5B,yDAA4B;AAC5B,0DAA6B;AAC7B,2DAA8B"}

package/internal/utils.mjs

@@ -0,0 +1,8 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+export * from "./utils/values.mjs";
+export * from "./utils/base64.mjs";
+export * from "./utils/env.mjs";
+export * from "./utils/log.mjs";
+export * from "./utils/uuid.mjs";
+export * from "./utils/sleep.mjs";
+//# sourceMappingURL=utils.mjs.map

package/internal/utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.mjs","sourceRoot":"","sources":["../src/internal/utils.ts"],"names":[],"mappings":"AAAA,sFAAsF"}

package/lib/index.d.mts

@@ -0,0 +1,6 @@
+/**
+ * Exports for Knock custom functionality
+ */
+export * from "./userTokens.mjs";
+export * from "./tokenSigner.mjs";
+//# sourceMappingURL=index.d.mts.map

package/lib/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/lib/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Exports for Knock custom functionality
+ */
+export * from "./userTokens.js";
+export * from "./tokenSigner.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/lib/index.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Exports for Knock custom functionality
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("../internal/tslib.js");
+tslib_1.__exportStar(require("./userTokens.js"), exports);
+tslib_1.__exportStar(require("./tokenSigner.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,0DAA6B;AAC7B,2DAA8B"}

package/lib/index.mjs

@@ -0,0 +1,6 @@
+/**
+ * Exports for Knock custom functionality
+ */
+export * from "./userTokens.mjs";
+export * from "./tokenSigner.mjs";
+//# sourceMappingURL=index.mjs.map

package/lib/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","sourceRoot":"","sources":["../src/lib/index.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/lib/tokenSigner.d.mts

@@ -0,0 +1,46 @@
+/**
+ * Token signing functionality for Knock authentication
+ */
+import type { TokenEntity, TokenGrant, TokenGrantOptions } from "./userTokens.mjs";
+/**
+ * Options for signing a user token
+ */
+export interface SignUserTokenOptions {
+    /**
+     * The signing key to use (in PEM or base-64 encoded format)
+     * If not provided, it will try to use process.env.KNOCK_SIGNING_KEY
+     */
+    signingKey?: string | undefined;
+    /**
+     * How long the token should be valid for in seconds
+     * @default 3600 (1 hour)
+     */
+    expiresInSeconds?: number | undefined;
+    /**
+     * Grants to include in the token
+     */
+    grants?: TokenGrant[] | undefined;
+}
+/**
+ * Prepare user token grants
+ */
+export declare function maybePrepareUserTokenGrants(grants: TokenGrant[] | undefined): Record<string, TokenGrant['grants']> | undefined;
+/**
+ * Helper function to build user token grants to pass to the `signUserToken` method.
+ *
+ * @param entity {TokenEntity} The type of entity to build a grant for
+ * @param grants {TokenGrantOptions} A list of grants to give to the entity for the user
+ *
+ * @returns {TokenGrant} A single token grant that can be passed to the signUserToken function
+ */
+export declare function buildUserTokenGrant(entity: TokenEntity, grants: TokenGrantOptions): TokenGrant;
+/**
+ * Generate JWT for authenticating client-side requests (e.g. in-app feeds)
+ * For more information, visit https://docs.knock.app/in-app-ui/security-and-authentication#authentication-with-enhanced-security-enabled
+ *
+ * @param userId {string} The ID of the user that needs a token, e.g. the user viewing an in-app feed.
+ * @param options Optionally specify the signing key to use (in PEM or base-64 encoded format), and how long the token should be valid for in seconds
+ * @returns {Promise<string>} A JWT token that can be used to authenticate requests to the Knock API (e.g. by passing into the <KnockFeedProvider /> component)
+ */
+export declare function signUserToken(userId: string, options?: SignUserTokenOptions): Promise<string>;
+//# sourceMappingURL=tokenSigner.d.mts.map

package/lib/tokenSigner.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSigner.d.mts","sourceRoot":"","sources":["../src/lib/tokenSigner.ts"],"names":[],"mappings":"AAAA;;GAEG;OAGI,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE;AAK1D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;CACnC;AAuED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,GAC/B,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,CAalD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,GAAG,UAAU,CAK9F;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBnG"}

package/lib/tokenSigner.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Token signing functionality for Knock authentication
+ */
+import type { TokenEntity, TokenGrant, TokenGrantOptions } from "./userTokens.js";
+/**
+ * Options for signing a user token
+ */
+export interface SignUserTokenOptions {
+    /**
+     * The signing key to use (in PEM or base-64 encoded format)
+     * If not provided, it will try to use process.env.KNOCK_SIGNING_KEY
+     */
+    signingKey?: string | undefined;
+    /**
+     * How long the token should be valid for in seconds
+     * @default 3600 (1 hour)
+     */
+    expiresInSeconds?: number | undefined;
+    /**
+     * Grants to include in the token
+     */
+    grants?: TokenGrant[] | undefined;
+}
+/**
+ * Prepare user token grants
+ */
+export declare function maybePrepareUserTokenGrants(grants: TokenGrant[] | undefined): Record<string, TokenGrant['grants']> | undefined;
+/**
+ * Helper function to build user token grants to pass to the `signUserToken` method.
+ *
+ * @param entity {TokenEntity} The type of entity to build a grant for
+ * @param grants {TokenGrantOptions} A list of grants to give to the entity for the user
+ *
+ * @returns {TokenGrant} A single token grant that can be passed to the signUserToken function
+ */
+export declare function buildUserTokenGrant(entity: TokenEntity, grants: TokenGrantOptions): TokenGrant;
+/**
+ * Generate JWT for authenticating client-side requests (e.g. in-app feeds)
+ * For more information, visit https://docs.knock.app/in-app-ui/security-and-authentication#authentication-with-enhanced-security-enabled
+ *
+ * @param userId {string} The ID of the user that needs a token, e.g. the user viewing an in-app feed.
+ * @param options Optionally specify the signing key to use (in PEM or base-64 encoded format), and how long the token should be valid for in seconds
+ * @returns {Promise<string>} A JWT token that can be used to authenticate requests to the Knock API (e.g. by passing into the <KnockFeedProvider /> component)
+ */
+export declare function signUserToken(userId: string, options?: SignUserTokenOptions): Promise<string>;
+//# sourceMappingURL=tokenSigner.d.ts.map

package/lib/tokenSigner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSigner.d.ts","sourceRoot":"","sources":["../src/lib/tokenSigner.ts"],"names":[],"mappings":"AAAA;;GAEG;OAGI,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE;AAK1D;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEhC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;CACnC;AAuED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,GAC/B,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,CAalD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,GAAG,UAAU,CAK9F;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBnG"}

package/lib/tokenSigner.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * Token signing functionality for Knock authentication
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maybePrepareUserTokenGrants = maybePrepareUserTokenGrants;
+exports.buildUserTokenGrant = buildUserTokenGrant;
+exports.signUserToken = signUserToken;
+const tslib_1 = require("../internal/tslib.js");
+const crypto = tslib_1.__importStar(require("crypto"));
+// Default hostname for Knock API
+const DEFAULT_HOSTNAME = 'https://api.knock.app';
+/**
+ * Prepare the signing key for use
+ */
+function prepareSigningKey(key) {
+    const maybeSigningKey = key ?? process.env['KNOCK_SIGNING_KEY'];
+    if (!maybeSigningKey)
+        throw new Error('No signing key provided. Set KNOCK_SIGNING_KEY environment variable or pass signingKey option.');
+    // If it's already in PEM format
+    if (maybeSigningKey.startsWith('-----BEGIN'))
+        return maybeSigningKey;
+    // LS0tLS1CRUdJTi is the base64 encoded version of "-----BEGIN"
+    if (maybeSigningKey.startsWith('LS0tLS1CRUdJTi'))
+        return Buffer.from(maybeSigningKey, 'base64').toString('utf-8');
+    throw new Error('Invalid signing key format. Must be PEM or base64 encoded PEM.');
+}
+/**
+ * Prepare the token entity URI
+ */
+function prepareTokenEntityUri(entity) {
+    switch (entity.type) {
+        case 'user':
+            return `${DEFAULT_HOSTNAME}/v1/users/${entity.id}`;
+        case 'tenant':
+            return `${DEFAULT_HOSTNAME}/v1/objects/$tenants/${entity.id}`;
+        case 'object':
+            return `${DEFAULT_HOSTNAME}/v1/objects/${entity.collection}/${entity.id}`;
+    }
+}
+/**
+ * Create and sign a JWT using Node.js crypto
+ */
+function createJWT(header, payload, privateKey) {
+    // Base64Url encode the header
+    const headerBase64 = Buffer.from(JSON.stringify(header))
+        .toString('base64')
+        .replace(/=/g, '')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_');
+    // Base64Url encode the payload
+    const payloadBase64 = Buffer.from(JSON.stringify(payload))
+        .toString('base64')
+        .replace(/=/g, '')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_');
+    // Create the content to sign
+    const signatureContent = `${headerBase64}.${payloadBase64}`;
+    // Sign the content
+    const signer = crypto.createSign('RSA-SHA256');
+    signer.update(signatureContent);
+    const signature = signer
+        .sign(privateKey, 'base64')
+        .replace(/=/g, '')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_');
+    // Combine to create the JWT
+    return `${signatureContent}.${signature}`;
+}
+/**
+ * Prepare user token grants
+ */
+function maybePrepareUserTokenGrants(grants) {
+    if (!grants)
+        return undefined;
+    // Given a list of token grants, flattens them into a single object
+    // like: { "entity": { "slack/channels_read": [] } }
+    return grants.reduce((acc, grant) => {
+        if (acc[grant.entity]) {
+            const currentGrants = acc[grant.entity];
+            return { ...acc, [grant.entity]: { ...currentGrants, ...grant.grants } };
+        }
+        else {
+            return { ...acc, [grant.entity]: grant.grants };
+        }
+    }, {});
+}
+/**
+ * Helper function to build user token grants to pass to the `signUserToken` method.
+ *
+ * @param entity {TokenEntity} The type of entity to build a grant for
+ * @param grants {TokenGrantOptions} A list of grants to give to the entity for the user
+ *
+ * @returns {TokenGrant} A single token grant that can be passed to the signUserToken function
+ */
+function buildUserTokenGrant(entity, grants) {
+    return {
+        entity: prepareTokenEntityUri(entity),
+        grants: grants.reduce((acc, grant) => ({ ...acc, [grant]: [] }), {}),
+    };
+}
+/**
+ * Generate JWT for authenticating client-side requests (e.g. in-app feeds)
+ * For more information, visit https://docs.knock.app/in-app-ui/security-and-authentication#authentication-with-enhanced-security-enabled
+ *
+ * @param userId {string} The ID of the user that needs a token, e.g. the user viewing an in-app feed.
+ * @param options Optionally specify the signing key to use (in PEM or base-64 encoded format), and how long the token should be valid for in seconds
+ * @returns {Promise<string>} A JWT token that can be used to authenticate requests to the Knock API (e.g. by passing into the <KnockFeedProvider /> component)
+ */
+async function signUserToken(userId, options) {
+    const signingKey = prepareSigningKey(options?.signingKey);
+    // JWT NumericDates specified in seconds
+    const currentTime = Math.floor(Date.now() / 1000);
+    // Default to 1 hour from now
+    const expireInSeconds = options?.expiresInSeconds ?? 60 * 60;
+    // Create JWT header
+    const header = {
+        alg: 'RS256',
+        typ: 'JWT',
+    };
+    // Create JWT payload
+    const payload = {
+        sub: userId,
+        grants: maybePrepareUserTokenGrants(options?.grants),
+        iat: currentTime,
+        exp: currentTime + expireInSeconds,
+    };
+    // Create and sign the JWT
+    return createJWT(header, payload, signingKey);
+}
+//# sourceMappingURL=tokenSigner.js.map

package/lib/tokenSigner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSigner.js","sourceRoot":"","sources":["../src/lib/tokenSigner.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAsGH,kEAeC;AAUD,kDAKC;AAUD,sCAyBC;;AArKD,uDAAiC;AAGjC,iCAAiC;AACjC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAwBjD;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,eAAe,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAChE,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IAEJ,gCAAgC;IAChC,IAAI,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,eAAe,CAAC;IAErE,+DAA+D;IAC/D,IAAI,eAAe,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;AACpF,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,MAAmB;IAChD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,GAAG,gBAAgB,aAAa,MAAM,CAAC,EAAE,EAAE,CAAC;QACrD,KAAK,QAAQ;YACX,OAAO,GAAG,gBAAgB,wBAAwB,MAAM,CAAC,EAAE,EAAE,CAAC;QAChE,KAAK,QAAQ;YACX,OAAO,GAAG,gBAAgB,eAAe,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe,EAAE,UAAkB;IACpE,8BAA8B;IAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;SACrD,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,+BAA+B;IAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SACvD,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,6BAA6B;IAC7B,MAAM,gBAAgB,GAAG,GAAG,YAAY,IAAI,aAAa,EAAE,CAAC;IAE5D,mBAAmB;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEhC,MAAM,SAAS,GAAG,MAAM;SACrB,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC1B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,4BAA4B;IAC5B,OAAO,GAAG,gBAAgB,IAAI,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAgB,2BAA2B,CACzC,MAAgC;IAEhC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,mEAAmE;IACnE,oDAAoD;IACpD,OAAO,MAAM,CAAC,MAAM,CAAuC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACxE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,MAAmB,EAAE,MAAyB;IAChF,OAAO;QACL,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAA8B;IAChF,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE1D,wCAAwC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAElD,6BAA6B;IAC7B,MAAM,eAAe,GAAG,OAAO,EAAE,gBAAgB,IAAI,EAAE,GAAG,EAAE,CAAC;IAE7D,oBAAoB;IACpB,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,qBAAqB;IACrB,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,MAAM;QACX,MAAM,EAAE,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC;QACpD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,WAAW,GAAG,eAAe;KACnC,CAAC;IAEF,0BAA0B;IAC1B,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAChD,CAAC"}

package/lib/tokenSigner.mjs

@@ -0,0 +1,125 @@
+/**
+ * Token signing functionality for Knock authentication
+ */
+import * as crypto from 'crypto';
+// Default hostname for Knock API
+const DEFAULT_HOSTNAME = 'https://api.knock.app';
+/**
+ * Prepare the signing key for use
+ */
+function prepareSigningKey(key) {
+    const maybeSigningKey = key ?? process.env['KNOCK_SIGNING_KEY'];
+    if (!maybeSigningKey)
+        throw new Error('No signing key provided. Set KNOCK_SIGNING_KEY environment variable or pass signingKey option.');
+    // If it's already in PEM format
+    if (maybeSigningKey.startsWith('-----BEGIN'))
+        return maybeSigningKey;
+    // LS0tLS1CRUdJTi is the base64 encoded version of "-----BEGIN"
+    if (maybeSigningKey.startsWith('LS0tLS1CRUdJTi'))
+        return Buffer.from(maybeSigningKey, 'base64').toString('utf-8');
+    throw new Error('Invalid signing key format. Must be PEM or base64 encoded PEM.');
+}
+/**
+ * Prepare the token entity URI
+ */
+function prepareTokenEntityUri(entity) {
+    switch (entity.type) {
+        case 'user':
+            return `${DEFAULT_HOSTNAME}/v1/users/${entity.id}`;
+        case 'tenant':
+            return `${DEFAULT_HOSTNAME}/v1/objects/$tenants/${entity.id}`;
+        case 'object':
+            return `${DEFAULT_HOSTNAME}/v1/objects/${entity.collection}/${entity.id}`;
+    }
+}
+/**
+ * Create and sign a JWT using Node.js crypto
+ */
+function createJWT(header, payload, privateKey) {
+    // Base64Url encode the header
+    const headerBase64 = Buffer.from(JSON.stringify(header))
+        .toString('base64')
+        .replace(/=/g, '')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_');
+    // Base64Url encode the payload
+    const payloadBase64 = Buffer.from(JSON.stringify(payload))
+        .toString('base64')
+        .replace(/=/g, '')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_');
+    // Create the content to sign
+    const signatureContent = `${headerBase64}.${payloadBase64}`;
+    // Sign the content
+    const signer = crypto.createSign('RSA-SHA256');
+    signer.update(signatureContent);
+    const signature = signer
+        .sign(privateKey, 'base64')
+        .replace(/=/g, '')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_');
+    // Combine to create the JWT
+    return `${signatureContent}.${signature}`;
+}
+/**
+ * Prepare user token grants
+ */
+export function maybePrepareUserTokenGrants(grants) {
+    if (!grants)
+        return undefined;
+    // Given a list of token grants, flattens them into a single object
+    // like: { "entity": { "slack/channels_read": [] } }
+    return grants.reduce((acc, grant) => {
+        if (acc[grant.entity]) {
+            const currentGrants = acc[grant.entity];
+            return { ...acc, [grant.entity]: { ...currentGrants, ...grant.grants } };
+        }
+        else {
+            return { ...acc, [grant.entity]: grant.grants };
+        }
+    }, {});
+}
+/**
+ * Helper function to build user token grants to pass to the `signUserToken` method.
+ *
+ * @param entity {TokenEntity} The type of entity to build a grant for
+ * @param grants {TokenGrantOptions} A list of grants to give to the entity for the user
+ *
+ * @returns {TokenGrant} A single token grant that can be passed to the signUserToken function
+ */
+export function buildUserTokenGrant(entity, grants) {
+    return {
+        entity: prepareTokenEntityUri(entity),
+        grants: grants.reduce((acc, grant) => ({ ...acc, [grant]: [] }), {}),
+    };
+}
+/**
+ * Generate JWT for authenticating client-side requests (e.g. in-app feeds)
+ * For more information, visit https://docs.knock.app/in-app-ui/security-and-authentication#authentication-with-enhanced-security-enabled
+ *
+ * @param userId {string} The ID of the user that needs a token, e.g. the user viewing an in-app feed.
+ * @param options Optionally specify the signing key to use (in PEM or base-64 encoded format), and how long the token should be valid for in seconds
+ * @returns {Promise<string>} A JWT token that can be used to authenticate requests to the Knock API (e.g. by passing into the <KnockFeedProvider /> component)
+ */
+export async function signUserToken(userId, options) {
+    const signingKey = prepareSigningKey(options?.signingKey);
+    // JWT NumericDates specified in seconds
+    const currentTime = Math.floor(Date.now() / 1000);
+    // Default to 1 hour from now
+    const expireInSeconds = options?.expiresInSeconds ?? 60 * 60;
+    // Create JWT header
+    const header = {
+        alg: 'RS256',
+        typ: 'JWT',
+    };
+    // Create JWT payload
+    const payload = {
+        sub: userId,
+        grants: maybePrepareUserTokenGrants(options?.grants),
+        iat: currentTime,
+        exp: currentTime + expireInSeconds,
+    };
+    // Create and sign the JWT
+    return createJWT(header, payload, signingKey);
+}
+//# sourceMappingURL=tokenSigner.mjs.map

package/lib/tokenSigner.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenSigner.mjs","sourceRoot":"","sources":["../src/lib/tokenSigner.ts"],"names":[],"mappings":"AAAA;;GAEG;OAEI,KAAK,MAAM,MAAM,QAAQ;AAGhC,iCAAiC;AACjC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAwBjD;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,eAAe,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAChE,IAAI,CAAC,eAAe;QAClB,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;IAEJ,gCAAgC;IAChC,IAAI,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,eAAe,CAAC;IAErE,+DAA+D;IAC/D,IAAI,eAAe,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;AACpF,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,MAAmB;IAChD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,GAAG,gBAAgB,aAAa,MAAM,CAAC,EAAE,EAAE,CAAC;QACrD,KAAK,QAAQ;YACX,OAAO,GAAG,gBAAgB,wBAAwB,MAAM,CAAC,EAAE,EAAE,CAAC;QAChE,KAAK,QAAQ;YACX,OAAO,GAAG,gBAAgB,eAAe,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe,EAAE,UAAkB;IACpE,8BAA8B;IAC9B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;SACrD,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,+BAA+B;IAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;SACvD,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,6BAA6B;IAC7B,MAAM,gBAAgB,GAAG,GAAG,YAAY,IAAI,aAAa,EAAE,CAAC;IAE5D,mBAAmB;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEhC,MAAM,SAAS,GAAG,MAAM;SACrB,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC1B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,4BAA4B;IAC5B,OAAO,GAAG,gBAAgB,IAAI,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAgC;IAEhC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,mEAAmE;IACnE,oDAAoD;IACpD,OAAO,MAAM,CAAC,MAAM,CAAuC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACxE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACxC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB,EAAE,MAAyB;IAChF,OAAO;QACL,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAA8B;IAChF,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE1D,wCAAwC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAElD,6BAA6B;IAC7B,MAAM,eAAe,GAAG,OAAO,EAAE,gBAAgB,IAAI,EAAE,GAAG,EAAE,CAAC;IAE7D,oBAAoB;IACpB,MAAM,MAAM,GAAG;QACb,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IAEF,qBAAqB;IACrB,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,MAAM;QACX,MAAM,EAAE,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC;QACpD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,WAAW,GAAG,eAAe;KACnC,CAAC;IAEF,0BAA0B;IAC1B,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAChD,CAAC"}

package/lib/userTokens.d.mts

@@ -0,0 +1,32 @@
+/**
+ * User token signing functionality for Knock authentication
+ */
+export declare enum Grants {
+    SlackChannelsRead = "slack/channels_read",
+    MsTeamsChannelsRead = "ms_teams/channels_read",
+    ChannelDataRead = "channel_data/read",
+    ChannelDataWrite = "channel_data/write",
+    UserFeedRead = "user/feed_read"
+}
+export type TokenGrantOptions = Grants[];
+export type TokenEntity = TenantTokenEntity | UserTokenEntity | ObjectTokenEntity;
+export interface TenantTokenEntity {
+    type: 'tenant';
+    id: string;
+    collection?: never;
+}
+export interface ObjectTokenEntity {
+    type: 'object';
+    id: string;
+    collection: string;
+}
+export interface UserTokenEntity {
+    type: 'user';
+    id: string;
+    collection?: never;
+}
+export type TokenGrant = {
+    entity: string;
+    grants: Partial<Record<Grants, []>>;
+};
+//# sourceMappingURL=userTokens.d.mts.map

package/lib/userTokens.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userTokens.d.mts","sourceRoot":"","sources":["../src/lib/userTokens.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,oBAAY,MAAM;IAChB,iBAAiB,wBAAwB;IACzC,mBAAmB,2BAA2B;IAC9C,eAAe,sBAAsB;IACrC,gBAAgB,uBAAuB;IACvC,YAAY,mBAAmB;CAChC;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC;AAEzC,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAElF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;CACrC,CAAC"}

package/{dist/src/common → lib}/userTokens.d.ts

@@ -1,3 +1,6 @@
+/**
+ * User token signing functionality for Knock authentication
+ */
 export declare enum Grants {
     SlackChannelsRead = "slack/channels_read",
     MsTeamsChannelsRead = "ms_teams/channels_read",
@@ -8,17 +11,17 @@ export declare enum Grants {
 export type TokenGrantOptions = Grants[];
 export type TokenEntity = TenantTokenEntity | UserTokenEntity | ObjectTokenEntity;
 export interface TenantTokenEntity {
-    type: "tenant";
+    type: 'tenant';
     id: string;
     collection?: never;
 }
 export interface ObjectTokenEntity {
-    type: "object";
+    type: 'object';
     id: string;
     collection: string;
 }
 export interface UserTokenEntity {
-    type: "user";
+    type: 'user';
     id: string;
     collection?: never;
 }
@@ -26,3 +29,4 @@ export type TokenGrant = {
     entity: string;
     grants: Partial<Record<Grants, []>>;
 };
+//# sourceMappingURL=userTokens.d.ts.map

package/lib/userTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userTokens.d.ts","sourceRoot":"","sources":["../src/lib/userTokens.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,oBAAY,MAAM;IAChB,iBAAiB,wBAAwB;IACzC,mBAAmB,2BAA2B;IAC9C,eAAe,sBAAsB;IACrC,gBAAgB,uBAAuB;IACvC,YAAY,mBAAmB;CAChC;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC;AAEzC,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAElF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,KAAK,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;CACrC,CAAC"}

package/{dist/src/common → lib}/userTokens.js

@@ -1,4 +1,7 @@
 "use strict";
+/**
+ * User token signing functionality for Knock authentication
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Grants = void 0;
 var Grants;
@@ -9,3 +12,4 @@ var Grants;
     Grants["ChannelDataWrite"] = "channel_data/write";
     Grants["UserFeedRead"] = "user/feed_read";
 })(Grants || (exports.Grants = Grants = {}));
+//# sourceMappingURL=userTokens.js.map

package/lib/userTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userTokens.js","sourceRoot":"","sources":["../src/lib/userTokens.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,IAAY,MAMX;AAND,WAAY,MAAM;IAChB,mDAAyC,CAAA;IACzC,wDAA8C,CAAA;IAC9C,+CAAqC,CAAA;IACrC,iDAAuC,CAAA;IACvC,yCAA+B,CAAA;AACjC,CAAC,EANW,MAAM,sBAAN,MAAM,QAMjB"}

package/lib/userTokens.mjs

@@ -0,0 +1,12 @@
+/**
+ * User token signing functionality for Knock authentication
+ */
+export var Grants;
+(function (Grants) {
+    Grants["SlackChannelsRead"] = "slack/channels_read";
+    Grants["MsTeamsChannelsRead"] = "ms_teams/channels_read";
+    Grants["ChannelDataRead"] = "channel_data/read";
+    Grants["ChannelDataWrite"] = "channel_data/write";
+    Grants["UserFeedRead"] = "user/feed_read";
+})(Grants || (Grants = {}));
+//# sourceMappingURL=userTokens.mjs.map

package/lib/userTokens.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"userTokens.mjs","sourceRoot":"","sources":["../src/lib/userTokens.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,CAAN,IAAY,MAMX;AAND,WAAY,MAAM;IAChB,mDAAyC,CAAA;IACzC,wDAA8C,CAAA;IAC9C,+CAAqC,CAAA;IACrC,iDAAuC,CAAA;IACvC,yCAA+B,CAAA;AACjC,CAAC,EANW,MAAM,KAAN,MAAM,QAMjB"}