@logto/js 2.0.1 → 2.1.0

package/lib/index.cjs

@@ -9,6 +9,7 @@ var userInfo = require('./core/user-info.cjs');
 var callbackUri = require('./utils/callback-uri.cjs');
 var errors = require('./utils/errors.cjs');
 var idToken = require('./utils/id-token.cjs');
+var accessToken = require('./utils/access-token.cjs');
 var scopes = require('./utils/scopes.cjs');
 var arbitraryObject = require('./utils/arbitrary-object.cjs');
 var index = require('./consts/index.cjs');
@@ -31,6 +32,7 @@ exports.OidcError = errors.OidcError;
 exports.isLogtoRequestError = errors.isLogtoRequestError;
 exports.decodeIdToken = idToken.decodeIdToken;
 exports.verifyIdToken = idToken.verifyIdToken;
+exports.decodeAccessToken = accessToken.decodeAccessToken;
 exports.withDefaultScopes = scopes.withDefaultScopes;
 exports.isArbitraryObject = arbitraryObject.isArbitraryObject;
 exports.ContentType = index.ContentType;

package/lib/index.js

@@ -7,6 +7,7 @@ export { fetchUserInfo } from './core/user-info.js';
 export { parseUriParameters, verifyAndParseCodeFromCallbackUri } from './utils/callback-uri.js';
 export { LogtoError, LogtoRequestError, OidcError, isLogtoRequestError } from './utils/errors.js';
 export { decodeIdToken, verifyIdToken } from './utils/id-token.js';
+export { decodeAccessToken } from './utils/access-token.js';
 export { withDefaultScopes } from './utils/scopes.js';
 export { isArbitraryObject } from './utils/arbitrary-object.js';
 export { ContentType, Prompt, QueryKey, ReservedScope, TokenGrantType, UserScope } from './consts/index.js';

package/lib/utils/access-token.cjs

@@ -0,0 +1,40 @@
+'use strict';
+
+var essentials = require('@silverhand/essentials');
+var arbitraryObject = require('./arbitrary-object.cjs');
+var errors = require('./errors.cjs');
+
+// https://docs.logto.io/docs/recipes/protect-your-api/
+function assertAccessTokenClaims(data) {
+    if (!arbitraryObject.isArbitraryObject(data)) {
+        throw new TypeError('AccessToken is expected to be an object');
+    }
+    for (const key of ['jti', 'iss', 'sub', 'aud', 'client_id', 'scope']) {
+        if (data[key] === undefined) {
+            continue;
+        }
+        if (typeof data[key] !== 'string' && data[key] !== null) {
+            throw new TypeError(`At path: AccessToken.${key}: expected null or a string`);
+        }
+    }
+    for (const key of ['exp', 'iat']) {
+        if (data[key] === undefined) {
+            continue;
+        }
+        if (typeof data[key] !== 'number' && data[key] !== null) {
+            throw new TypeError(`At path: AccessToken.${key}: expected null or a number`);
+        }
+    }
+}
+const decodeAccessToken = (accessToken) => {
+    const { 1: encodedPayload } = accessToken.split('.');
+    if (!encodedPayload) {
+        throw new errors.LogtoError('access_token.invalid_token');
+    }
+    const json = essentials.urlSafeBase64.decode(encodedPayload);
+    const accessTokenClaims = JSON.parse(json);
+    assertAccessTokenClaims(accessTokenClaims);
+    return accessTokenClaims;
+};
+
+exports.decodeAccessToken = decodeAccessToken;

package/lib/utils/access-token.d.ts

@@ -0,0 +1,11 @@
+export type AccessTokenClaims = {
+    jti?: string;
+    iss?: string;
+    sub?: string;
+    aud?: string;
+    exp?: number;
+    iat?: number;
+    client_id?: string;
+    scope?: string;
+} & Record<string, unknown>;
+export declare const decodeAccessToken: (accessToken: string) => AccessTokenClaims;

package/lib/utils/access-token.js

@@ -0,0 +1,38 @@
+import { urlSafeBase64 } from '@silverhand/essentials';
+import { isArbitraryObject } from './arbitrary-object.js';
+import { LogtoError } from './errors.js';
+
+// https://docs.logto.io/docs/recipes/protect-your-api/
+function assertAccessTokenClaims(data) {
+    if (!isArbitraryObject(data)) {
+        throw new TypeError('AccessToken is expected to be an object');
+    }
+    for (const key of ['jti', 'iss', 'sub', 'aud', 'client_id', 'scope']) {
+        if (data[key] === undefined) {
+            continue;
+        }
+        if (typeof data[key] !== 'string' && data[key] !== null) {
+            throw new TypeError(`At path: AccessToken.${key}: expected null or a string`);
+        }
+    }
+    for (const key of ['exp', 'iat']) {
+        if (data[key] === undefined) {
+            continue;
+        }
+        if (typeof data[key] !== 'number' && data[key] !== null) {
+            throw new TypeError(`At path: AccessToken.${key}: expected null or a number`);
+        }
+    }
+}
+const decodeAccessToken = (accessToken) => {
+    const { 1: encodedPayload } = accessToken.split('.');
+    if (!encodedPayload) {
+        throw new LogtoError('access_token.invalid_token');
+    }
+    const json = urlSafeBase64.decode(encodedPayload);
+    const accessTokenClaims = JSON.parse(json);
+    assertAccessTokenClaims(accessTokenClaims);
+    return accessTokenClaims;
+};
+
+export { decodeAccessToken };

package/lib/utils/access-token.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/utils/errors.cjs

@@ -12,6 +12,7 @@ const logtoErrorCodes = Object.freeze({
     'callback_uri_verification.missing_code': 'Missing code in the callback URI',
     crypto_subtle_unavailable: 'Crypto.subtle is unavailable in insecure contexts (non-HTTPS).',
     unexpected_response_error: 'Unexpected response error from the server.',
+    'access_token.invalid_token': 'Invalid access token',
 });
 class LogtoError extends Error {
     constructor(code, data) {

package/lib/utils/errors.d.ts

@@ -8,6 +8,7 @@ declare const logtoErrorCodes: Readonly<{
     'callback_uri_verification.missing_code': "Missing code in the callback URI";
     crypto_subtle_unavailable: "Crypto.subtle is unavailable in insecure contexts (non-HTTPS).";
     unexpected_response_error: "Unexpected response error from the server.";
+    'access_token.invalid_token': "Invalid access token";
 }>;
 export type LogtoErrorCode = keyof typeof logtoErrorCodes;
 export declare class LogtoError extends Error {

package/lib/utils/errors.js

@@ -10,6 +10,7 @@ const logtoErrorCodes = Object.freeze({
     'callback_uri_verification.missing_code': 'Missing code in the callback URI',
     crypto_subtle_unavailable: 'Crypto.subtle is unavailable in insecure contexts (non-HTTPS).',
     unexpected_response_error: 'Unexpected response error from the server.',
+    'access_token.invalid_token': 'Invalid access token',
 });
 class LogtoError extends Error {
     constructor(code, data) {

package/lib/utils/index.d.ts

@@ -1,5 +1,6 @@
 export * from './callback-uri.js';
 export * from './errors.js';
 export * from './id-token.js';
+export * from './access-token.js';
 export * from './scopes.js';
 export * from './arbitrary-object.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/js",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "type": "module",
   "main": "./lib/index.cjs",
   "module": "./lib/index.js",