@meistrari/data-token 0.0.19 → 1.0.0

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import * as jose from 'jose';
-import { errors } from 'jose';
+import { RemoteJWKSetOptions, errors } from 'jose';
 import * as zod from 'zod';
 export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb5e.mjs';
 
@@ -9,10 +9,12 @@ export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb
  * @param jwksUrl - The URL of the JWKS endpoint.
  * @param options - The options for the validator.
  * @param options.algorithms - The algorithms to use for validation.
+ * @param options.remoteJwksOptions - The options to pass to `createRemoteJWKSet`.
  * @returns A function that can validate a data token.
  */
-declare function getValidator(jwksUrl: string, { algorithms }?: {
-    algorithms: string[];
+declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions }?: {
+    algorithms?: string[] | undefined;
+    remoteJwksOptions?: RemoteJWKSetOptions | undefined;
 }): (token: string) => Promise<{
     requestId: string;
     workspace: {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as jose from 'jose';
-import { errors } from 'jose';
+import { RemoteJWKSetOptions, errors } from 'jose';
 import * as zod from 'zod';
 export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb5e.js';
 
@@ -9,10 +9,12 @@ export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb
  * @param jwksUrl - The URL of the JWKS endpoint.
  * @param options - The options for the validator.
  * @param options.algorithms - The algorithms to use for validation.
+ * @param options.remoteJwksOptions - The options to pass to `createRemoteJWKSet`.
  * @returns A function that can validate a data token.
  */
-declare function getValidator(jwksUrl: string, { algorithms }?: {
-    algorithms: string[];
+declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions }?: {
+    algorithms?: string[] | undefined;
+    remoteJwksOptions?: RemoteJWKSetOptions | undefined;
 }): (token: string) => Promise<{
     requestId: string;
     workspace: {

package/dist/index.mjs

@@ -56,12 +56,18 @@ const retry = createExponentialBackoff({
   maxRetries: 3,
   jitter: true
 });
-function getValidator(jwksUrl, { algorithms } = { algorithms: ["RS256"] }) {
-  const JWKS = createRemoteJWKSet(
-    new URL(jwksUrl),
-    { cacheMaxAge: 0, headers: { "cache-control": "no-cache", "pragma": "no-cache" } }
-  );
+function getValidator(jwksUrl, { algorithms = ["RS256"], remoteJwksOptions = {} } = {}) {
+  let JWKS;
   return async (token) => {
+    JWKS || (JWKS = createRemoteJWKSet(
+      new URL(jwksUrl),
+      {
+        // Cache control is done by the remote JWKS instance, so we need to set it to no-cache to avoid
+        // interference from any CDN that might be caching the JWKS.
+        headers: { "cache-control": "no-cache", "pragma": "no-cache" },
+        ...remoteJwksOptions
+      }
+    ));
     const { payload } = await retry(
       async () => jwtVerify(token, JWKS, { algorithms }),
       (err) => err instanceof errors.JWKSTimeout || err instanceof Error && err.message.includes("ECONNRESET")

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@meistrari/data-token",
   "type": "module",
-  "version": "0.0.19",
+  "version": "1.0.0",
   "description": "Internal library to verify and decode the API Gateway data token",
   "author": "Roz <roz@meistrari.com>",
   "license": "UNLICENSED",