@meistrari/data-token 0.0.19 → 1.0.1

package/dist/adapters/elysia.mjs

@@ -1,6 +1,8 @@
 import Elysia from 'elysia';
 import { getValidator } from '../index.mjs';
+import 'node:buffer';
 import 'jose';
+import 'jose/dist/types/util/errors';
 import 'zod';
 
 function createDataTokenPlugin(url, skipOnError = false, getToken = (c) => c.headers["x-data-token"] ?? "") {

package/dist/adapters/hono.mjs

@@ -1,6 +1,8 @@
 import { createMiddleware } from 'hono/factory';
 import { getValidator } from '../index.mjs';
+import 'node:buffer';
 import 'jose';
+import 'jose/dist/types/util/errors';
 import 'zod';
 
 function createDataTokenMiddleware(url, skipOnError = false, getToken = (c) => c.req.header("x-data-token") ?? "") {

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import * as jose from 'jose';
-import { errors } from 'jose';
+import { RemoteJWKSetOptions, errors } from 'jose';
 import * as zod from 'zod';
 export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb5e.mjs';
 
@@ -9,10 +9,14 @@ export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb
  * @param jwksUrl - The URL of the JWKS endpoint.
  * @param options - The options for the validator.
  * @param options.algorithms - The algorithms to use for validation.
+ * @param options.remoteJwksOptions - The options to pass to `createRemoteJWKSet`.
+ * @param options.logger - The logger to use for logging errors.
  * @returns A function that can validate a data token.
  */
-declare function getValidator(jwksUrl: string, { algorithms }?: {
-    algorithms: string[];
+declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions, logger, }?: {
+    algorithms?: string[] | undefined;
+    remoteJwksOptions?: RemoteJWKSetOptions | undefined;
+    logger?: any;
 }): (token: string) => Promise<{
     requestId: string;
     workspace: {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as jose from 'jose';
-import { errors } from 'jose';
+import { RemoteJWKSetOptions, errors } from 'jose';
 import * as zod from 'zod';
 export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb5e.js';
 
@@ -9,10 +9,14 @@ export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb
  * @param jwksUrl - The URL of the JWKS endpoint.
  * @param options - The options for the validator.
  * @param options.algorithms - The algorithms to use for validation.
+ * @param options.remoteJwksOptions - The options to pass to `createRemoteJWKSet`.
+ * @param options.logger - The logger to use for logging errors.
  * @returns A function that can validate a data token.
  */
-declare function getValidator(jwksUrl: string, { algorithms }?: {
-    algorithms: string[];
+declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions, logger, }?: {
+    algorithms?: string[] | undefined;
+    remoteJwksOptions?: RemoteJWKSetOptions | undefined;
+    logger?: any;
 }): (token: string) => Promise<{
     requestId: string;
     workspace: {

package/dist/index.mjs

@@ -1,4 +1,6 @@
+import { Buffer } from 'node:buffer';
 import { createRemoteJWKSet, jwtVerify, errors, decodeJwt } from 'jose';
+import { JWKSNoMatchingKey } from 'jose/dist/types/util/errors';
 import { z } from 'zod';
 
 const sleep = async (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -56,17 +58,45 @@ const retry = createExponentialBackoff({
   maxRetries: 3,
   jitter: true
 });
-function getValidator(jwksUrl, { algorithms } = { algorithms: ["RS256"] }) {
-  const JWKS = createRemoteJWKSet(
-    new URL(jwksUrl),
-    { cacheMaxAge: 0, headers: { "cache-control": "no-cache", "pragma": "no-cache" } }
-  );
+function getValidator(jwksUrl, {
+  algorithms = ["RS256"],
+  remoteJwksOptions = {},
+  logger = console
+} = {}) {
+  let JWKS;
   return async (token) => {
-    const { payload } = await retry(
-      async () => jwtVerify(token, JWKS, { algorithms }),
-      (err) => err instanceof errors.JWKSTimeout || err instanceof Error && err.message.includes("ECONNRESET")
-    );
-    return DataToken.parse(payload);
+    JWKS || (JWKS = createRemoteJWKSet(
+      new URL(jwksUrl),
+      {
+        // Cache control is done by the remote JWKS instance, so we need to set it to no-cache to avoid
+        // interference from any CDN that might be caching the JWKS.
+        headers: { "cache-control": "no-cache", "pragma": "no-cache" },
+        ...remoteJwksOptions
+      }
+    ));
+    try {
+      const { payload } = await retry(
+        async () => jwtVerify(token, JWKS, { algorithms }),
+        (err) => err instanceof errors.JWKSTimeout || err instanceof Error && err.message.includes("ECONNRESET")
+      );
+      return DataToken.parse(payload);
+    } catch (error) {
+      if (error instanceof JWKSNoMatchingKey) {
+        const [header] = token.split(".");
+        const tokenHeader = JSON.parse(Buffer.from(header, "base64").toString("utf-8"));
+        const jwksResponse = await fetch(jwksUrl);
+        const jwksText = await jwksResponse.json();
+        logger.error({
+          level: "error",
+          message: "No matching key found in JWKS for token",
+          jwksUrl,
+          algorithms,
+          jwks: jwksText,
+          tokenHeader
+        });
+      }
+      throw error;
+    }
   };
 }
 function isAuthenticationError(err) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@meistrari/data-token",
   "type": "module",
-  "version": "0.0.19",
+  "version": "1.0.1",
   "description": "Internal library to verify and decode the API Gateway data token",
   "author": "Roz <roz@meistrari.com>",
   "license": "UNLICENSED",