@meistrari/data-token 1.0.0 → 1.0.1

package/dist/adapters/elysia.mjs

@@ -1,6 +1,8 @@
 import Elysia from 'elysia';
 import { getValidator } from '../index.mjs';
+import 'node:buffer';
 import 'jose';
+import 'jose/dist/types/util/errors';
 import 'zod';
 
 function createDataTokenPlugin(url, skipOnError = false, getToken = (c) => c.headers["x-data-token"] ?? "") {

package/dist/adapters/hono.mjs

@@ -1,6 +1,8 @@
 import { createMiddleware } from 'hono/factory';
 import { getValidator } from '../index.mjs';
+import 'node:buffer';
 import 'jose';
+import 'jose/dist/types/util/errors';
 import 'zod';
 
 function createDataTokenMiddleware(url, skipOnError = false, getToken = (c) => c.req.header("x-data-token") ?? "") {

package/dist/index.d.mts

@@ -10,11 +10,13 @@ export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb
  * @param options - The options for the validator.
  * @param options.algorithms - The algorithms to use for validation.
  * @param options.remoteJwksOptions - The options to pass to `createRemoteJWKSet`.
+ * @param options.logger - The logger to use for logging errors.
  * @returns A function that can validate a data token.
  */
-declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions }?: {
+declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions, logger, }?: {
     algorithms?: string[] | undefined;
     remoteJwksOptions?: RemoteJWKSetOptions | undefined;
+    logger?: any;
 }): (token: string) => Promise<{
     requestId: string;
     workspace: {

package/dist/index.d.ts

@@ -10,11 +10,13 @@ export { D as DataToken, V as ValidatorConfig } from './shared/data-token.1d70cb
  * @param options - The options for the validator.
  * @param options.algorithms - The algorithms to use for validation.
  * @param options.remoteJwksOptions - The options to pass to `createRemoteJWKSet`.
+ * @param options.logger - The logger to use for logging errors.
  * @returns A function that can validate a data token.
  */
-declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions }?: {
+declare function getValidator(jwksUrl: string, { algorithms, remoteJwksOptions, logger, }?: {
     algorithms?: string[] | undefined;
     remoteJwksOptions?: RemoteJWKSetOptions | undefined;
+    logger?: any;
 }): (token: string) => Promise<{
     requestId: string;
     workspace: {

package/dist/index.mjs

@@ -1,4 +1,6 @@
+import { Buffer } from 'node:buffer';
 import { createRemoteJWKSet, jwtVerify, errors, decodeJwt } from 'jose';
+import { JWKSNoMatchingKey } from 'jose/dist/types/util/errors';
 import { z } from 'zod';
 
 const sleep = async (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -56,7 +58,11 @@ const retry = createExponentialBackoff({
   maxRetries: 3,
   jitter: true
 });
-function getValidator(jwksUrl, { algorithms = ["RS256"], remoteJwksOptions = {} } = {}) {
+function getValidator(jwksUrl, {
+  algorithms = ["RS256"],
+  remoteJwksOptions = {},
+  logger = console
+} = {}) {
   let JWKS;
   return async (token) => {
     JWKS || (JWKS = createRemoteJWKSet(
@@ -68,11 +74,29 @@ function getValidator(jwksUrl, { algorithms = ["RS256"], remoteJwksOptions = {}
         ...remoteJwksOptions
       }
     ));
-    const { payload } = await retry(
-      async () => jwtVerify(token, JWKS, { algorithms }),
-      (err) => err instanceof errors.JWKSTimeout || err instanceof Error && err.message.includes("ECONNRESET")
-    );
-    return DataToken.parse(payload);
+    try {
+      const { payload } = await retry(
+        async () => jwtVerify(token, JWKS, { algorithms }),
+        (err) => err instanceof errors.JWKSTimeout || err instanceof Error && err.message.includes("ECONNRESET")
+      );
+      return DataToken.parse(payload);
+    } catch (error) {
+      if (error instanceof JWKSNoMatchingKey) {
+        const [header] = token.split(".");
+        const tokenHeader = JSON.parse(Buffer.from(header, "base64").toString("utf-8"));
+        const jwksResponse = await fetch(jwksUrl);
+        const jwksText = await jwksResponse.json();
+        logger.error({
+          level: "error",
+          message: "No matching key found in JWKS for token",
+          jwksUrl,
+          algorithms,
+          jwks: jwksText,
+          tokenHeader
+        });
+      }
+      throw error;
+    }
   };
 }
 function isAuthenticationError(err) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@meistrari/data-token",
   "type": "module",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Internal library to verify and decode the API Gateway data token",
   "author": "Roz <roz@meistrari.com>",
   "license": "UNLICENSED",