@marxbiotech/signet-integration 0.1.0

package/dist/options.d.ts

@@ -0,0 +1,31 @@
+export interface SignetEnvNames {
+    readonly deploymentNamespace: string;
+    readonly jwtAudience: string;
+    readonly jwtClockToleranceS: string;
+    readonly jwtIssuer: string;
+    readonly jwtJwksUri: string;
+    readonly legacyApiKeyEnabled?: string;
+    readonly signetEnabled?: string;
+}
+export interface SignetDeployedProfile {
+    readonly host: string;
+    readonly namespace: string;
+}
+export interface SignetDevelopmentProfile {
+    readonly canonicalResource: string;
+    readonly host: string;
+    readonly namespace: string;
+}
+export declare const DEVELOPMENT_ENVIRONMENT = "development";
+export interface SignetIntegrationOptions<E extends string = string> {
+    readonly admissionScope: string;
+    readonly canonicalResourceFor: (host: string) => string;
+    readonly deployedProfiles: Readonly<Record<E, SignetDeployedProfile>>;
+    readonly developmentProfile: SignetDevelopmentProfile;
+    readonly env: SignetEnvNames;
+    readonly principalRefusalMessage?: string;
+    readonly realm: string;
+    readonly requestPrincipalKey: string;
+    readonly scopesSupported: readonly string[];
+}
+export declare const SIGNET_INTEGRATION_OPTIONS: unique symbol;

package/dist/options.js

@@ -0,0 +1,9 @@
+"use strict";
+// What a consumer supplies to the integration: its values, behind the
+// SIGNET_INTEGRATION_OPTIONS token or as a parameter to the pure functions.
+// The mechanism files in this package carry no consumer value of their own.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNET_INTEGRATION_OPTIONS = exports.DEVELOPMENT_ENVIRONMENT = void 0;
+exports.DEVELOPMENT_ENVIRONMENT = 'development';
+exports.SIGNET_INTEGRATION_OPTIONS = Symbol('SIGNET_INTEGRATION_OPTIONS');
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;;;AAoC/D,QAAA,uBAAuB,GAAG,aAAa,CAAC;AAmCxC,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC"}

package/dist/principal-resolver.d.ts

@@ -0,0 +1,19 @@
+import { type VerifiedSignetIdentity } from './jwt-verifier';
+export interface SignetPrincipalResolver<P = unknown> {
+    resolve(identity: VerifiedSignetIdentity): Promise<PrincipalResolution<P>>;
+}
+export type PrincipalResolution<P> = {
+    logFields?: Readonly<Record<string, string>>;
+    ok: false;
+    reason: string;
+} | {
+    logFields?: Readonly<Record<string, string>>;
+    ok: true;
+    principal: P;
+};
+export declare const SIGNET_PRINCIPAL_RESOLVER: unique symbol;
+export declare class PrincipalStoreUnavailableError extends Error {
+    readonly causeName: string;
+    readonly causeStack: string | undefined;
+    constructor(cause: unknown);
+}

package/dist/principal-resolver.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrincipalStoreUnavailableError = exports.SIGNET_PRINCIPAL_RESOLVER = void 0;
+exports.SIGNET_PRINCIPAL_RESOLVER = Symbol('SIGNET_PRINCIPAL_RESOLVER');
+// Thrown by a resolver when its STORE could not be reached, as opposed to when
+// it answered. Which errors mean "unreachable" is the resolver's knowledge:
+// a socket error, a DNS failure, a driver exception are facts about HOW its
+// store is queried, and this package carries no driver import.
+//
+// `causeName` and `causeStack` are captured at construction, in the same form
+// the guard's 500 branch uses for an unwrapped error, so the 503 log line
+// reads the cause's class and stack.
+class PrincipalStoreUnavailableError extends Error {
+    causeName;
+    causeStack;
+    constructor(cause) {
+        super('authorization store unavailable', { cause });
+        this.name = 'PrincipalStoreUnavailableError';
+        this.causeName =
+            cause instanceof Error && cause.name ? cause.name : typeof cause;
+        this.causeStack = cause instanceof Error ? cause.stack : undefined;
+    }
+}
+exports.PrincipalStoreUnavailableError = PrincipalStoreUnavailableError;
+//# sourceMappingURL=principal-resolver.js.map

package/dist/principal-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-resolver.js","sourceRoot":"","sources":["../src/principal-resolver.ts"],"names":[],"mappings":";;;AA6Ba,QAAA,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAE7E,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,qCAAqC;AACrC,MAAa,8BAA+B,SAAQ,KAAK;IAC9C,SAAS,CAAS;IAClB,UAAU,CAAqB;IAExC,YAAY,KAAc;QACxB,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,SAAS;YACZ,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;CACF;AAXD,wEAWC"}

package/dist/principal.decorator.d.ts

@@ -0,0 +1,2 @@
+import { type SignetIntegrationOptions } from './options';
+export declare function createSignetPrincipalDecorator<P>(options: Pick<SignetIntegrationOptions, 'requestPrincipalKey'>, validate: (value: unknown) => value is P): () => ParameterDecorator;

package/dist/principal.decorator.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSignetPrincipalDecorator = createSignetPrincipalDecorator;
+const common_1 = require("@nestjs/common");
+// A parameter decorator that reads the principal the Bearer guard attached
+// under `requestPrincipalKey`. Built per consumer from the same options the
+// guard runs with, because a decorator is evaluated at class definition,
+// before any provider exists, so the key cannot come through injection.
+//
+// `validate` is the runtime shape check: nothing at runtime enforces a
+// principal on a handler someone mounted without the guard, and Nest does not
+// check the parameter's declared type against what arrives. A failing check
+// is a 500, because a missing principal on a protected route is a wiring
+// bug, not a caller's credential problem.
+function createSignetPrincipalDecorator(options, validate) {
+    const { requestPrincipalKey } = options;
+    return (0, common_1.createParamDecorator)((_data, context) => {
+        const request = context
+            .switchToHttp()
+            .getRequest();
+        const value = request[requestPrincipalKey];
+        if (!validate(value)) {
+            throw new common_1.InternalServerErrorException(`no principal on request.${requestPrincipalKey}: is the Bearer guard mounted on this route?`);
+        }
+        return value;
+    });
+}
+//# sourceMappingURL=principal.decorator.js.map

package/dist/principal.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.decorator.js","sourceRoot":"","sources":["../src/principal.decorator.ts"],"names":[],"mappings":";;AAkBA,wEAiBC;AAnCD,2CAIwB;AAIxB,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,0CAA0C;AAC1C,SAAgB,8BAA8B,CAC5C,OAA8D,EAC9D,QAAwC;IAExC,MAAM,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACxC,OAAO,IAAA,6BAAoB,EAAC,CAAC,KAAc,EAAE,OAAyB,EAAE,EAAE;QACxE,MAAM,OAAO,GAAG,OAAO;aACpB,YAAY,EAAE;aACd,UAAU,EAA2B,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,qCAA4B,CACpC,2BAA2B,mBAAmB,8CAA8C,CAC7F,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/protected-resource.controller.d.ts

@@ -0,0 +1,11 @@
+import { type Type } from '@nestjs/common';
+import { type SignetIntegrationOptions } from './options';
+export interface ProtectedResourceMetadata {
+    readonly authorization_servers: readonly string[];
+    readonly bearer_methods_supported: readonly string[];
+    readonly resource: string;
+    readonly scopes_supported: readonly string[];
+}
+export declare function createProtectedResourceController(options: SignetIntegrationOptions): Type<{
+    metadata(): ProtectedResourceMetadata;
+}>;

package/dist/protected-resource.controller.js

@@ -0,0 +1,130 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProtectedResourceController = createProtectedResourceController;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const swagger_1 = require("@nestjs/swagger");
+const throttler_1 = require("@nestjs/throttler");
+const bearer_challenge_1 = require("./bearer-challenge");
+const config_2 = require("./config");
+const deployment_profile_1 = require("./deployment-profile");
+const options_1 = require("./options");
+const public_decorator_1 = require("./public.decorator");
+const PROTECTED_RESOURCE_METADATA_SCHEMA = {
+    properties: {
+        authorization_servers: { items: { type: 'string' }, type: 'array' },
+        bearer_methods_supported: { items: { type: 'string' }, type: 'array' },
+        resource: { type: 'string' },
+        scopes_supported: { items: { type: 'string' }, type: 'array' },
+    },
+    required: [
+        'authorization_servers',
+        'bearer_methods_supported',
+        'resource',
+        'scopes_supported',
+    ],
+    type: 'object',
+};
+// Tells a client WHICH authorization server issues tokens for this resource
+// (RFC 9728). This controller's whole part in authorisation: it issues
+// nothing, it points. An OAuth client goes 401 → the challenge's
+// `resource_metadata` → this document's `authorization_servers` → issuer
+// discovery → login.
+//
+// A FACTORY rather than a class, because the route path is a decorator
+// argument -- evaluated at class definition, before any provider exists --
+// and it is derived from the consumer's canonical resource. The consumer
+// calls this once with its options and declares the returned class in the
+// module of the process that serves the resource. Nothing else about the
+// class depends on the options at definition time; the values it publishes
+// are read through injection, from the SAME settings the verifier uses,
+// never a second set -- metadata and verification that can be configured
+// apart will drift apart.
+//
+// Public: a client that has no token yet is the one that needs to read it.
+// Throttling is skipped: discovery precedes login and must not compete with
+// a client's own request budget.
+//
+// The factory's `options` choose the route; the injected options choose the
+// published values. They are the same object in every sane wiring, and the
+// constructor refuses to start if they disagree on the metadata path.
+function createProtectedResourceController(options) {
+    var ProtectedResourceController_1;
+    const mountedPath = (0, bearer_challenge_1.protectedResourceMetadataPath)(options);
+    let ProtectedResourceController = ProtectedResourceController_1 = class ProtectedResourceController {
+        configService;
+        profiles;
+        injected;
+        logger = new common_1.Logger(ProtectedResourceController_1.name);
+        config;
+        constructor(configService, profiles, injected) {
+            this.configService = configService;
+            this.profiles = profiles;
+            this.injected = injected;
+            const injectedPath = (0, bearer_challenge_1.protectedResourceMetadataPath)(injected);
+            if (injectedPath !== mountedPath) {
+                throw new Error(`protected resource metadata is mounted at ${mountedPath} but the injected options put it at ${injectedPath}; pass the same options to createProtectedResourceController and to SignetIntegrationModule.forRoot`);
+            }
+        }
+        metadata() {
+            this.config ??= (0, config_2.readSignetAuthConfig)(this.injected, this.configService, this.profiles.profile);
+            const { jwt } = this.config;
+            if (jwt === null) {
+                // The 404 body says nothing; this line is what tells it apart from
+                // an ingress or routing miss.
+                this.logger.warn('protected resource metadata not served: metric=metadata_channel_disabled reason=signet_disabled');
+                throw new common_1.NotFoundException();
+            }
+            return {
+                authorization_servers: [jwt.issuer],
+                bearer_methods_supported: ['header'],
+                resource: jwt.audience,
+                scopes_supported: this.injected.scopesSupported,
+            };
+        }
+    };
+    __decorate([
+        (0, common_1.Get)(),
+        (0, throttler_1.SkipThrottle)(),
+        (0, swagger_1.ApiOkResponse)({
+            description: 'RFC 9728 protected resource metadata',
+            schema: PROTECTED_RESOURCE_METADATA_SCHEMA,
+        }),
+        (0, swagger_1.ApiNotFoundResponse)({
+            description: 'The Signet Bearer channel is disabled in this deployment',
+        }),
+        (0, swagger_1.ApiOperation)({
+            description: 'OAuth 2.0 Protected Resource Metadata (RFC 9728) for this ' +
+                'resource. Public; no credential required. Available only while ' +
+                'the Signet Bearer channel is enabled -- 404 otherwise, so a ' +
+                'discovery client is never pointed at an issuer this deployment does ' +
+                'not accept tokens from.',
+            summary: 'Protected resource metadata',
+        }),
+        __metadata("design:type", Function),
+        __metadata("design:paramtypes", []),
+        __metadata("design:returntype", Object)
+    ], ProtectedResourceController.prototype, "metadata", null);
+    ProtectedResourceController = ProtectedResourceController_1 = __decorate([
+        (0, swagger_1.ApiTags)('OAuth'),
+        (0, public_decorator_1.Public)(),
+        (0, common_1.Controller)(mountedPath),
+        __param(2, (0, common_1.Inject)(options_1.SIGNET_INTEGRATION_OPTIONS)),
+        __metadata("design:paramtypes", [config_1.ConfigService,
+            deployment_profile_1.SignetDeploymentProfileService, Object])
+    ], ProtectedResourceController);
+    return ProtectedResourceController;
+}
+//# sourceMappingURL=protected-resource.controller.js.map

package/dist/protected-resource.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-resource.controller.js","sourceRoot":"","sources":["../src/protected-resource.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AA0EA,8EAmEC;AA7ID,2CAOwB;AACxB,2CAA+C;AAC/C,6CAKyB;AAEzB,iDAAiD;AAEjD,yDAAmE;AACnE,qCAAuE;AACvE,6DAAsE;AACtE,uCAGmB;AACnB,yDAA4C;AAU5C,MAAM,kCAAkC,GAAiB;IACvD,UAAU,EAAE;QACV,qBAAqB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACnE,wBAAwB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;QACtE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC5B,gBAAgB,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KAC/D;IACD,QAAQ,EAAE;QACR,uBAAuB;QACvB,0BAA0B;QAC1B,UAAU;QACV,kBAAkB;KACnB;IACD,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF,4EAA4E;AAC5E,uEAAuE;AACvE,iEAAiE;AACjE,yEAAyE;AACzE,qBAAqB;AACrB,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,yEAAyE;AACzE,0BAA0B;AAC1B,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,iCAAiC;AACjC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,sEAAsE;AACtE,SAAgB,iCAAiC,CAC/C,OAAiC;;IAEjC,MAAM,WAAW,GAAG,IAAA,gDAA6B,EAAC,OAAO,CAAC,CAAC;IAC3D,IAGM,2BAA2B,mCAHjC,MAGM,2BAA2B;QAKZ;QACA;QAEA;QAPF,MAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAA+B;QAE7C,YACmB,aAA4B,EAC5B,QAAwC,EAExC,QAAkC;YAHlC,kBAAa,GAAb,aAAa,CAAe;YAC5B,aAAQ,GAAR,QAAQ,CAAgC;YAExC,aAAQ,GAAR,QAAQ,CAA0B;YAEnD,MAAM,YAAY,GAAG,IAAA,gDAA6B,EAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,6CAA6C,WAAW,uCAAuC,YAAY,qGAAqG,CACjN,CAAC;YACJ,CAAC;QACH,CAAC;QAoBD,QAAQ;YACN,IAAI,CAAC,MAAM,KAAK,IAAA,6BAAoB,EAClC,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CAAC,OAAO,CACtB,CAAC;YACF,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,mEAAmE;gBACnE,8BAA8B;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iGAAiG,CAClG,CAAC;gBACF,MAAM,IAAI,0BAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO;gBACL,qBAAqB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;gBACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;aAChD,CAAC;QACJ,CAAC;KACF,CAAA;IAtBC;QAlBC,IAAA,YAAG,GAAE;QACL,IAAA,wBAAY,GAAE;QACd,IAAA,uBAAa,EAAC;YACb,WAAW,EAAE,sCAAsC;YACnD,MAAM,EAAE,kCAAkC;SAC3C,CAAC;QACD,IAAA,6BAAmB,EAAC;YACnB,WAAW,EAAE,0DAA0D;SACxE,CAAC;QACD,IAAA,sBAAY,EAAC;YACZ,WAAW,EACT,4DAA4D;gBAC5D,iEAAiE;gBACjE,8DAA8D;gBAC9D,sEAAsE;gBACtE,yBAAyB;YAC3B,OAAO,EAAE,6BAA6B;SACvC,CAAC;;;;+DAsBD;IAzDG,2BAA2B;QAHhC,IAAA,iBAAO,EAAC,OAAO,CAAC;QAChB,IAAA,yBAAM,GAAE;QACR,IAAA,mBAAU,EAAC,WAAW,CAAC;QAQnB,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;yCAFH,sBAAa;YAClB,mDAA8B;OANvD,2BAA2B,CA0DhC;IACD,OAAO,2BAA2B,CAAC;AACrC,CAAC"}

package/dist/public.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const IS_PUBLIC_ROUTE = "signet-integration:public-route";
+export declare const Public: () => ClassDecorator & MethodDecorator;

package/dist/public.decorator.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_ROUTE = void 0;
+const common_1 = require("@nestjs/common");
+// Marks a route, or a whole controller, as reachable without a Bearer
+// credential. SignetBearerGuard lets a marked route through before running
+// the strategy; a consumer's own credential dispatcher reads the same key.
+exports.IS_PUBLIC_ROUTE = 'signet-integration:public-route';
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_ROUTE, true);
+exports.Public = Public;
+//# sourceMappingURL=public.decorator.js.map

package/dist/public.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../src/public.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAE7C,sEAAsE;AACtE,2EAA2E;AAC3E,2EAA2E;AAC9D,QAAA,eAAe,GAAG,iCAAiC,CAAC;AAE1D,MAAM,MAAM,GAAG,GAAqC,EAAE,CAC3D,IAAA,oBAAW,EAAC,uBAAe,EAAE,IAAI,CAAC,CAAC;AADxB,QAAA,MAAM,UACkB"}

package/dist/scope-vocabulary.d.ts

@@ -0,0 +1,17 @@
+export interface TokenScopeRead<A extends string> {
+    readonly actions: ReadonlySet<A>;
+}
+export interface ScopeVocabularyInput<A extends string> {
+    readonly admissionScope: string;
+    readonly actions: readonly A[];
+    readonly defaultActions: ReadonlySet<A>;
+    readonly tokenScopeFor?: (action: A) => string;
+}
+export interface ScopeVocabulary<A extends string> {
+    readonly actionByScope: ReadonlyMap<string, A>;
+    readonly readTokenScopes: (scopes: readonly string[]) => TokenScopeRead<A>;
+    readonly scopesForAction: (action: A, held: ReadonlySet<A>) => readonly string[];
+    readonly supportedScopes: readonly string[];
+    readonly tokenScopeFor: (action: A) => string;
+}
+export declare function createScopeVocabulary<A extends string>(input: ScopeVocabularyInput<A>): ScopeVocabulary<A>;

package/dist/scope-vocabulary.js

@@ -0,0 +1,52 @@
+"use strict";
+// Token-level narrowing: one token carries no more than the scopes it was
+// issued with, even when its holder's local authorization says more. The
+// consumer supplies its action vocabulary; this file supplies the rules.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createScopeVocabulary = createScopeVocabulary;
+function createScopeVocabulary(input) {
+    const tokenScopeFor = input.tokenScopeFor ?? ((action) => action);
+    const actionByScope = new Map(input.actions.map((action) => [tokenScopeFor(action), action]));
+    // The invariants the rest of this file relies on, refused rather than
+    // silently repaired: a non-injective encoder would make the Map keep the
+    // later action (a scope grants the wrong thing and `supportedScopes` loses
+    // one); an action spelled as the admission scope would make admission grant
+    // a business action; a default outside the vocabulary could never be
+    // narrowed away.
+    if (actionByScope.size !== new Set(input.actions).size) {
+        throw new Error('scope vocabulary: tokenScopeFor must map actions to distinct scopes');
+    }
+    if (actionByScope.has(input.admissionScope)) {
+        throw new Error(`scope vocabulary: an action is spelled as the admission scope ${input.admissionScope}`);
+    }
+    for (const action of input.defaultActions) {
+        if (!input.actions.includes(action)) {
+            throw new Error(`scope vocabulary: default action ${String(action)} is not in actions`);
+        }
+    }
+    return {
+        actionByScope,
+        readTokenScopes: (scopes) => {
+            const actions = new Set();
+            for (const scope of scopes) {
+                const action = actionByScope.get(scope);
+                if (action !== undefined)
+                    actions.add(action);
+            }
+            if (actions.size > 0)
+                return { actions };
+            return { actions: input.defaultActions };
+        },
+        scopesForAction: (action, held) => {
+            const actions = new Set(held);
+            actions.add(action);
+            return [input.admissionScope, ...[...actions].map(tokenScopeFor).sort()];
+        },
+        supportedScopes: [
+            input.admissionScope,
+            ...[...actionByScope.keys()].sort(),
+        ],
+        tokenScopeFor,
+    };
+}
+//# sourceMappingURL=scope-vocabulary.js.map

package/dist/scope-vocabulary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-vocabulary.js","sourceRoot":"","sources":["../src/scope-vocabulary.ts"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;;AAkDzE,sDAoDC;AApDD,SAAgB,qBAAqB,CACnC,KAA8B;IAE9B,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,MAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,aAAa,GAA2B,IAAI,GAAG,CACnD,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAC/D,CAAC;IACF,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,iBAAiB;IACjB,IAAI,aAAa,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,iEAAiE,KAAK,CAAC,cAAc,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,aAAa;QACb,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAK,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;QAC3C,CAAC;QACD,eAAe,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,eAAe,EAAE;YACf,KAAK,CAAC,cAAc;YACpB,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SACpC;QACD,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/strategy.d.ts

@@ -0,0 +1,16 @@
+import { ConfigService } from '@nestjs/config';
+import { type Request } from 'express';
+import { SignetDeploymentProfileService } from './deployment-profile';
+import { type VerifiedSignetIdentity } from './jwt-verifier';
+import { type SignetIntegrationOptions } from './options';
+export declare const SIGNET_JWT_STRATEGY = "signet-jwt";
+declare const SignetJwtStrategy_base: new (...args: any[]) => import("passport-custom");
+export declare class SignetJwtStrategy extends SignetJwtStrategy_base {
+    private readonly logger;
+    private readonly verifier;
+    constructor(configService: ConfigService, profiles: SignetDeploymentProfileService, options: SignetIntegrationOptions);
+    validate(request: Request): Promise<VerifiedSignetIdentity | false>;
+    private reject;
+}
+export declare function bearerToken(request: Request): string | undefined;
+export {};

package/dist/strategy.js

@@ -0,0 +1,89 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var SignetJwtStrategy_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignetJwtStrategy = exports.SIGNET_JWT_STRATEGY = void 0;
+exports.bearerToken = bearerToken;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const passport_1 = require("@nestjs/passport");
+const passport_custom_1 = require("passport-custom");
+const config_2 = require("./config");
+const deployment_profile_1 = require("./deployment-profile");
+const jwt_verifier_1 = require("./jwt-verifier");
+const log_sanitise_1 = require("./log-sanitise");
+const options_1 = require("./options");
+exports.SIGNET_JWT_STRATEGY = 'signet-jwt';
+// Extracts `Authorization: Bearer <jwt>` and hands it to JwtVerifier.
+// passport-custom rather than passport-jwt: passport-jwt is a second JWT
+// implementation (jsonwebtoken) with its own JWKS story, and two verifiers
+// means two places to get the algorithm allowlist right. Only Passport's
+// registration and dispatch are borrowed; the cryptography stays in one place.
+//
+// Failure is `false`, never a throw. Passport moves to the next strategy only
+// on fail(); error() short-circuits the chain, and Nest turns a thrown
+// validate() into error(). A throw would also replace the guard's uniform 401
+// with whatever the exception said.
+//
+// The log line carries the reason and the source address and NOTHING derived
+// from the token: no fingerprint, no sub.
+let SignetJwtStrategy = SignetJwtStrategy_1 = class SignetJwtStrategy extends (0, passport_1.PassportStrategy)(passport_custom_1.Strategy, exports.SIGNET_JWT_STRATEGY) {
+    logger = new common_1.Logger(SignetJwtStrategy_1.name);
+    verifier;
+    constructor(configService, profiles, options) {
+        super();
+        const config = (0, config_2.readSignetAuthConfig)(options, configService, profiles.profile);
+        if (config.signetEnabled) {
+            // Constructed once per process: the remote JWKS cache lives on it.
+            this.verifier = new jwt_verifier_1.JwtVerifier(config.jwt);
+            this.logger.log(`signet jwt verification loaded: iss=${config.jwt.issuer} aud=${config.jwt.audience}`);
+        }
+        else {
+            this.verifier = null;
+        }
+    }
+    async validate(request) {
+        if (this.verifier === null)
+            return this.reject(request, 'signet_disabled');
+        const token = bearerToken(request);
+        if (token === undefined) {
+            const present = typeof request.headers.authorization === 'string';
+            return this.reject(request, present ? 'header_malformed' : 'header_missing');
+        }
+        const result = await this.verifier.verify(token);
+        if (!result.ok)
+            return this.reject(request, result.reason);
+        return result.identity;
+    }
+    // Every false path goes through here, so there is no unlogged rejection.
+    reject(request, reason) {
+        this.logger.warn(`signet auth rejected: metric=signet_auth_rejected reason=${(0, log_sanitise_1.sanitiseLogToken)(reason)} source=${(0, log_sanitise_1.sanitiseLogToken)(request.ip ?? 'none')} method=${(0, log_sanitise_1.sanitiseLogToken)(request.method)} route=${(0, log_sanitise_1.sanitiseLogToken)((0, log_sanitise_1.truncate)(request.originalUrl, log_sanitise_1.REFUSAL_ROUTE_MAX))}`);
+        return false;
+    }
+};
+exports.SignetJwtStrategy = SignetJwtStrategy;
+exports.SignetJwtStrategy = SignetJwtStrategy = SignetJwtStrategy_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(options_1.SIGNET_INTEGRATION_OPTIONS)),
+    __metadata("design:paramtypes", [config_1.ConfigService,
+        deployment_profile_1.SignetDeploymentProfileService, Object])
+], SignetJwtStrategy);
+// `authorization` is `string | undefined` on IncomingHttpHeaders -- Node
+// discards duplicates of this header, so a dispatcher that must refuse
+// repeats counts them on rawHeaders instead. Scheme matching is
+// case-insensitive per RFC 7235; the token is taken verbatim.
+function bearerToken(request) {
+    return /^Bearer +(\S+)$/i.exec(request.headers.authorization?.trim() ?? '')?.[1];
+}
+//# sourceMappingURL=strategy.js.map

package/dist/strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../src/strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAwFA,kCAIC;AA5FD,2CAA4D;AAC5D,2CAA+C;AAC/C,+CAAoD;AAEpD,qDAA2C;AAE3C,qCAAgD;AAChD,6DAAsE;AACtE,iDAA0E;AAC1E,iDAA+E;AAC/E,uCAGmB;AAEN,QAAA,mBAAmB,GAAG,YAAY,CAAC;AAEhD,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAC9E,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,0CAA0C;AAEnC,IAAM,iBAAiB,yBAAvB,MAAM,iBAAkB,SAAQ,IAAA,2BAAgB,EACrD,0BAAQ,EACR,2BAAmB,CACpB;IACkB,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YACE,aAA4B,EAC5B,QAAwC,EACJ,OAAiC;QAErE,KAAK,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,IAAA,6BAAoB,EACjC,OAAO,EACP,aAAa,EACb,QAAQ,CAAC,OAAO,CACjB,CAAC;QACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,mEAAmE;YACnE,IAAI,CAAC,QAAQ,GAAG,IAAI,0BAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,uCAAuC,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CACtF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC;YAClE,OAAO,IAAI,CAAC,MAAM,CAChB,OAAO,EACP,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,MAAM,CAAC,OAAgB,EAAE,MAAc;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,IAAA,+BAAgB,EAAC,MAAM,CAAC,WAAW,IAAA,+BAAgB,EAAC,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,WAAW,IAAA,+BAAgB,EAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAA,+BAAgB,EAAC,IAAA,uBAAQ,EAAC,OAAO,CAAC,WAAW,EAAE,gCAAiB,CAAC,CAAC,EAAE,CAC/P,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAnDY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAWR,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;qCAFpB,sBAAa;QAClB,mDAA8B;GAT/B,iBAAiB,CAmD7B;AAED,yEAAyE;AACzE,uEAAuE;AACvE,gEAAgE;AAChE,8DAA8D;AAC9D,SAAgB,WAAW,CAAC,OAAgB;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAC5B,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAC5C,EAAE,CAAC,CAAC,CAAC,CAAC;AACT,CAAC"}

package/dist/testing/fixture.d.ts

@@ -0,0 +1,8 @@
+import { type SignetIntegrationOptions } from '../options';
+export declare const FIXTURE_OPTIONS: SignetIntegrationOptions<'production' | 'staging'>;
+export declare const FIXTURE_DEVELOPMENT_PROFILE: {
+    environment: "development";
+    canonicalResource: string;
+    host: string;
+    namespace: string;
+};

package/dist/testing/fixture.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FIXTURE_DEVELOPMENT_PROFILE = exports.FIXTURE_OPTIONS = void 0;
+// A complete options object for a fictional second service, for tests of
+// the mechanism and for consumers' tests that need "some other service".
+// Its canonical resource keeps a PATH (`/mcp`) so every derived path and URL
+// differs from a bare-origin consumer's; a test that needs the bare-origin
+// shape spreads over it with `canonicalResourceFor: (h) => \`https://${h}\``.
+exports.FIXTURE_OPTIONS = {
+    admissionScope: 'acme:access',
+    canonicalResourceFor: (host) => `https://${host}/mcp`,
+    deployedProfiles: {
+        production: { host: 'acme.example', namespace: 'acme-production' },
+        staging: { host: 'acme.staging.example', namespace: 'acme-staging' },
+    },
+    developmentProfile: {
+        canonicalResource: 'http://localhost/mcp',
+        host: 'localhost',
+        namespace: 'development',
+    },
+    env: {
+        deploymentNamespace: 'ACME_DEPLOYMENT_NAMESPACE',
+        jwtAudience: 'ACME_JWT_AUDIENCE',
+        jwtClockToleranceS: 'ACME_JWT_CLOCK_TOLERANCE_S',
+        jwtIssuer: 'ACME_JWT_ISSUER',
+        jwtJwksUri: 'ACME_JWT_JWKS_URI',
+        legacyApiKeyEnabled: 'ACME_LEGACY_ENABLED',
+        signetEnabled: 'ACME_SIGNET_ENABLED',
+    },
+    realm: 'acme',
+    requestPrincipalKey: 'principal',
+    scopesSupported: ['acme:access', 'widgets:read', 'widgets:write'],
+};
+exports.FIXTURE_DEVELOPMENT_PROFILE = {
+    ...exports.FIXTURE_OPTIONS.developmentProfile,
+    environment: 'development',
+};
+//# sourceMappingURL=fixture.js.map

package/dist/testing/fixture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture.js","sourceRoot":"","sources":["../../src/testing/fixture.ts"],"names":[],"mappings":";;;AAEA,yEAAyE;AACzE,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AACjE,QAAA,eAAe,GAExB;IACF,cAAc,EAAE,aAAa;IAC7B,oBAAoB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,IAAI,MAAM;IACrD,gBAAgB,EAAE;QAChB,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE;QAClE,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,cAAc,EAAE;KACrE;IACD,kBAAkB,EAAE;QAClB,iBAAiB,EAAE,sBAAsB;QACzC,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,aAAa;KACzB;IACD,GAAG,EAAE;QACH,mBAAmB,EAAE,2BAA2B;QAChD,WAAW,EAAE,mBAAmB;QAChC,kBAAkB,EAAE,4BAA4B;QAChD,SAAS,EAAE,iBAAiB;QAC5B,UAAU,EAAE,mBAAmB;QAC/B,mBAAmB,EAAE,qBAAqB;QAC1C,aAAa,EAAE,qBAAqB;KACrC;IACD,KAAK,EAAE,MAAM;IACb,mBAAmB,EAAE,WAAW;IAChC,eAAe,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,eAAe,CAAC;CAClE,CAAC;AAEW,QAAA,2BAA2B,GAAG;IACzC,GAAG,uBAAe,CAAC,kBAAkB;IACrC,WAAW,EAAE,aAAsB;CACpC,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,3 @@
+export { FIXTURE_DEVELOPMENT_PROFILE, FIXTURE_OPTIONS } from './fixture';
+export { type JwksServer, startJwksServer } from './jwks-server';
+export { startTestIssuer, type TestIssuer } from './signet-token';

package/dist/testing/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startTestIssuer = exports.startJwksServer = exports.FIXTURE_OPTIONS = exports.FIXTURE_DEVELOPMENT_PROFILE = void 0;
+var fixture_1 = require("./fixture");
+Object.defineProperty(exports, "FIXTURE_DEVELOPMENT_PROFILE", { enumerable: true, get: function () { return fixture_1.FIXTURE_DEVELOPMENT_PROFILE; } });
+Object.defineProperty(exports, "FIXTURE_OPTIONS", { enumerable: true, get: function () { return fixture_1.FIXTURE_OPTIONS; } });
+var jwks_server_1 = require("./jwks-server");
+Object.defineProperty(exports, "startJwksServer", { enumerable: true, get: function () { return jwks_server_1.startJwksServer; } });
+var signet_token_1 = require("./signet-token");
+Object.defineProperty(exports, "startTestIssuer", { enumerable: true, get: function () { return signet_token_1.startTestIssuer; } });
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":";;;AAAA,qCAAyE;AAAhE,sHAAA,2BAA2B,OAAA;AAAE,0GAAA,eAAe,OAAA;AACrD,6CAAiE;AAAvC,8GAAA,eAAe,OAAA;AACzC,+CAAkE;AAAzD,+GAAA,eAAe,OAAA"}

package/dist/testing/jwks-server.d.ts

@@ -0,0 +1,10 @@
+import { type JSONWebKeySet } from 'jose';
+export interface JwksServer {
+    readonly calls: () => number;
+    readonly close: () => Promise<void>;
+    readonly fail: (status: number) => void;
+    readonly serve: (jwks: JSONWebKeySet) => void;
+    readonly serveRaw: (body: string) => void;
+    readonly url: string;
+}
+export declare function startJwksServer(jwks: JSONWebKeySet): Promise<JwksServer>;

package/dist/testing/jwks-server.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startJwksServer = startJwksServer;
+const node_http_1 = require("node:http");
+async function startJwksServer(jwks) {
+    let body = JSON.stringify(jwks);
+    let status = 200;
+    let calls = 0;
+    const server = (0, node_http_1.createServer)((_req, res) => {
+        calls += 1;
+        res.writeHead(status, { 'content-type': 'application/json' });
+        res.end(body);
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const { port } = server.address();
+    return {
+        calls: () => calls,
+        close: () => new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve()))),
+        fail: (next) => {
+            status = next;
+        },
+        serve: (next) => {
+            body = JSON.stringify(next);
+            status = 200;
+        },
+        serveRaw: (next) => {
+            body = next;
+            status = 200;
+        },
+        url: `http://127.0.0.1:${port}/.well-known/jwks.json`,
+    };
+}
+//# sourceMappingURL=jwks-server.js.map

package/dist/testing/jwks-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-server.js","sourceRoot":"","sources":["../../src/testing/jwks-server.ts"],"names":[],"mappings":";;AAwBA,0CAgCC;AAxDD,yCAAsD;AAwB/C,KAAK,UAAU,eAAe,CACnC,IAAmB;IAEnB,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAW,IAAA,wBAAY,EAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChD,KAAK,IAAI,CAAC,CAAC;QACX,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;QAClB,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC7D;QACH,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;YACb,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC5B,MAAM,GAAG,GAAG,CAAC;QACf,CAAC;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,GAAG,GAAG,CAAC;QACf,CAAC;QACD,GAAG,EAAE,oBAAoB,IAAI,wBAAwB;KACtD,CAAC;AACJ,CAAC"}