@meistrari/data-token 0.0.17 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/adapters/elysia.mjs +0 -1
  2. package/dist/adapters/hono.mjs +0 -1
  3. package/dist/index.d.mts +60 -6
  4. package/dist/index.d.ts +60 -6
  5. package/dist/index.mjs +21 -9
  6. package/package.json +5 -1
package/dist/adapters/elysia.mjs CHANGED
@@ -1,7 +1,6 @@
1
1
  import Elysia from 'elysia';
2
2
  import { getValidator } from '../index.mjs';
3
3
  import 'jose';
4
- import 'jose/dist/types/util/errors';
5
4
  import 'zod';
6
5
 
7
6
  function createDataTokenPlugin(url, skipOnError = false, getToken = (c) => c.headers["x-data-token"] ?? "") {
package/dist/adapters/hono.mjs CHANGED
@@ -1,7 +1,6 @@
1
1
  import { createMiddleware } from 'hono/factory';
2
2
  import { getValidator } from '../index.mjs';
3
3
  import 'jose';
4
- import 'jose/dist/types/util/errors';
5
4
  import 'zod';
6
5
 
7
6
  function createDataTokenMiddleware(url, skipOnError = false, getToken = (c) => c.req.header("x-data-token") ?? "") {
package/dist/index.d.mts CHANGED
@@ -1,6 +1,7 @@
1
- import { JOSEError } from 'jose/dist/types/util/errors';
1
+ import * as jose from 'jose';
2
+ import { RemoteJWKSetOptions, errors } from 'jose';
3
+ import * as zod from 'zod';
2
4
  export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb5e.mjs';
3
- import 'zod';
4
5
 
5
6
  /**
6
7
  * Get a validator function that can validate a data token.
@@ -8,10 +9,12 @@ import 'zod';
8
9
  * @param jwksUrl - The URL of the JWKS endpoint.
9
10
  * @param options - The options for the validator.
10
11
  * @param options.algorithms - The algorithms to use for validation.
12
+ * @param options.remoteJwksOptions - The options to pass to `createRemoteJWKSet`.
11
13
  * @returns A function that can validate a data token.
12
14
  */
13
- declare function getValidator(jwksUrl: string, { algorithms }?: {
14
- algorithms: string[];
15
+ declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions }?: {
16
+ algorithms?: string[] | undefined;
17
+ remoteJwksOptions?: RemoteJWKSetOptions | undefined;
15
18
  }): (token: string) => Promise<{
16
19
  requestId: string;
17
20
  workspace: {
@@ -30,6 +33,57 @@ declare function getValidator(jwksUrl: string, { algorithms }?: {
30
33
  * @param err - The error to check.
31
34
  * @returns True if the error is an authentication error, false otherwise.
32
35
  */
33
- declare function isAuthenticationError(err: unknown): err is JOSEError;
36
+ declare function isAuthenticationError(err: unknown): err is errors.JOSEError;
37
+ /**
38
+ * **THIS DOES NOT VALIDATE THE TOKEN. DO NOT USE IN AUTHENTICATION-SENSITIVE CONTEXTS**
39
+ *
40
+ * Decodes a JWT and tries to parse its payload according to the data token schema.
41
+ *
42
+ * @param jwt JWT string to be parsed
43
+ * @returns Result of trying to porse the payload
44
+ */
45
+ declare function safeParse(jwt: string): zod.SafeParseReturnType<{
46
+ requestId: string;
47
+ workspace: {
48
+ id: string;
49
+ title: string;
50
+ };
51
+ user?: {
52
+ id: string;
53
+ email: string;
54
+ uuid: string | null;
55
+ } | undefined;
56
+ }, {
57
+ requestId: string;
58
+ workspace: {
59
+ id: string;
60
+ title: string;
61
+ };
62
+ user?: {
63
+ id: string;
64
+ email: string;
65
+ uuid: string | null;
66
+ } | undefined;
67
+ }>;
68
+ /**
69
+ * **THIS DOES NOT VALIDATE THE TOKEN. DO NOT USE IN AUTHENTICATION-SENSITIVE CONTEXTS**
70
+ *
71
+ * Type-unsafe version of {@link safeParse}. Decodes a JWT and casts its type to {@link DataToken} but **does not perform any payload validation**.
72
+ *
73
+ * @param jwt JWT string to be decoded
74
+ * @returns The JWT payload typed as a DataToken
75
+ */
76
+ declare function unsafeDecode(jwt: string): {
77
+ requestId: string;
78
+ workspace: {
79
+ id: string;
80
+ title: string;
81
+ };
82
+ user?: {
83
+ id: string;
84
+ email: string;
85
+ uuid: string | null;
86
+ } | undefined;
87
+ } & jose.JWTPayload;
34
88
 
35
- export { getValidator, isAuthenticationError };
89
+ export { getValidator, isAuthenticationError, safeParse, unsafeDecode };
package/dist/index.d.ts CHANGED
@@ -1,6 +1,7 @@
1
- import { JOSEError } from 'jose/dist/types/util/errors';
1
+ import * as jose from 'jose';
2
+ import { RemoteJWKSetOptions, errors } from 'jose';
3
+ import * as zod from 'zod';
2
4
  export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb5e.js';
3
- import 'zod';
4
5
 
5
6
  /**
6
7
  * Get a validator function that can validate a data token.
@@ -8,10 +9,12 @@ import 'zod';
8
9
  * @param jwksUrl - The URL of the JWKS endpoint.
9
10
  * @param options - The options for the validator.
10
11
  * @param options.algorithms - The algorithms to use for validation.
12
+ * @param options.remoteJwksOptions - The options to pass to `createRemoteJWKSet`.
11
13
  * @returns A function that can validate a data token.
12
14
  */
13
- declare function getValidator(jwksUrl: string, { algorithms }?: {
14
- algorithms: string[];
15
+ declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions }?: {
16
+ algorithms?: string[] | undefined;
17
+ remoteJwksOptions?: RemoteJWKSetOptions | undefined;
15
18
  }): (token: string) => Promise<{
16
19
  requestId: string;
17
20
  workspace: {
@@ -30,6 +33,57 @@ declare function getValidator(jwksUrl: string, { algorithms }?: {
30
33
  * @param err - The error to check.
31
34
  * @returns True if the error is an authentication error, false otherwise.
32
35
  */
33
- declare function isAuthenticationError(err: unknown): err is JOSEError;
36
+ declare function isAuthenticationError(err: unknown): err is errors.JOSEError;
37
+ /**
38
+ * **THIS DOES NOT VALIDATE THE TOKEN. DO NOT USE IN AUTHENTICATION-SENSITIVE CONTEXTS**
39
+ *
40
+ * Decodes a JWT and tries to parse its payload according to the data token schema.
41
+ *
42
+ * @param jwt JWT string to be parsed
43
+ * @returns Result of trying to porse the payload
44
+ */
45
+ declare function safeParse(jwt: string): zod.SafeParseReturnType<{
46
+ requestId: string;
47
+ workspace: {
48
+ id: string;
49
+ title: string;
50
+ };
51
+ user?: {
52
+ id: string;
53
+ email: string;
54
+ uuid: string | null;
55
+ } | undefined;
56
+ }, {
57
+ requestId: string;
58
+ workspace: {
59
+ id: string;
60
+ title: string;
61
+ };
62
+ user?: {
63
+ id: string;
64
+ email: string;
65
+ uuid: string | null;
66
+ } | undefined;
67
+ }>;
68
+ /**
69
+ * **THIS DOES NOT VALIDATE THE TOKEN. DO NOT USE IN AUTHENTICATION-SENSITIVE CONTEXTS**
70
+ *
71
+ * Type-unsafe version of {@link safeParse}. Decodes a JWT and casts its type to {@link DataToken} but **does not perform any payload validation**.
72
+ *
73
+ * @param jwt JWT string to be decoded
74
+ * @returns The JWT payload typed as a DataToken
75
+ */
76
+ declare function unsafeDecode(jwt: string): {
77
+ requestId: string;
78
+ workspace: {
79
+ id: string;
80
+ title: string;
81
+ };
82
+ user?: {
83
+ id: string;
84
+ email: string;
85
+ uuid: string | null;
86
+ } | undefined;
87
+ } & jose.JWTPayload;
34
88
 
35
- export { getValidator, isAuthenticationError };
89
+ export { getValidator, isAuthenticationError, safeParse, unsafeDecode };
package/dist/index.mjs CHANGED
@@ -1,5 +1,4 @@
1
- import { createRemoteJWKSet, jwtVerify, errors } from 'jose';
2
- import { JOSEError } from 'jose/dist/types/util/errors';
1
+ import { createRemoteJWKSet, jwtVerify, errors, decodeJwt } from 'jose';
3
2
  import { z } from 'zod';
4
3
 
5
4
  const sleep = async (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -57,12 +56,18 @@ const retry = createExponentialBackoff({
57
56
  maxRetries: 3,
58
57
  jitter: true
59
58
  });
60
- function getValidator(jwksUrl, { algorithms } = { algorithms: ["RS256"] }) {
61
- const JWKS = createRemoteJWKSet(
62
- new URL(jwksUrl),
63
- { cacheMaxAge: 0, headers: { "cache-control": "no-cache", "pragma": "no-cache" } }
64
- );
59
+ function getValidator(jwksUrl, { algorithms = ["RS256"], remoteJwksOptions = {} } = {}) {
60
+ let JWKS;
65
61
  return async (token) => {
62
+ JWKS || (JWKS = createRemoteJWKSet(
63
+ new URL(jwksUrl),
64
+ {
65
+ // Cache control is done by the remote JWKS instance, so we need to set it to no-cache to avoid
66
+ // interference from any CDN that might be caching the JWKS.
67
+ headers: { "cache-control": "no-cache", "pragma": "no-cache" },
68
+ ...remoteJwksOptions
69
+ }
70
+ ));
66
71
  const { payload } = await retry(
67
72
  async () => jwtVerify(token, JWKS, { algorithms }),
68
73
  (err) => err instanceof errors.JWKSTimeout || err instanceof Error && err.message.includes("ECONNRESET")
@@ -71,7 +76,14 @@ function getValidator(jwksUrl, { algorithms } = { algorithms: ["RS256"] }) {
71
76
  };
72
77
  }
73
78
  function isAuthenticationError(err) {
74
- return err instanceof JOSEError;
79
+ return err instanceof errors.JOSEError;
80
+ }
81
+ function safeParse(jwt) {
82
+ const payload = decodeJwt(jwt);
83
+ return DataToken.safeParse(payload);
84
+ }
85
+ function unsafeDecode(jwt) {
86
+ return decodeJwt(jwt);
75
87
  }
76
88
 
77
- export { DataToken, getValidator, isAuthenticationError };
89
+ export { DataToken, getValidator, isAuthenticationError, safeParse, unsafeDecode };
package/package.json CHANGED
@@ -1,10 +1,14 @@
1
1
  {
2
2
  "name": "@meistrari/data-token",
3
3
  "type": "module",
4
- "version": "0.0.17",
4
+ "version": "1.0.0",
5
5
  "description": "Internal library to verify and decode the API Gateway data token",
6
6
  "author": "Roz <roz@meistrari.com>",
7
7
  "license": "UNLICENSED",
8
+ "repository": {
9
+ "type": "git",
10
+ "url": "github:meistrari/data-token"
11
+ },
8
12
  "exports": {
9
13
  ".": {
10
14
  "types": "./dist/index.d.ts",