@metaplay/metaplay-auth 1.9.0 → 1.9.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@metaplay/metaplay-auth",
   "description": "Utility CLI for authenticating with the Metaplay Auth and making authenticated calls to infrastructure endpoints.",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://metaplay.io",
@@ -17,28 +17,29 @@
   },
   "devDependencies": {
     "@metaplay/eslint-config": "workspace:*",
-    "@types/dockerode": "3.3.32",
-    "@types/express": "5.0.0",
+    "@types/dockerode": "3.3.39",
+    "@types/express": "5.0.2",
     "@types/js-yaml": "4.0.9",
-    "@types/jsonwebtoken": "9.0.8",
+    "@types/jsonwebtoken": "9.0.9",
     "@types/jwk-to-pem": "2.0.3",
-    "@types/node": "22.13.5",
-    "@types/semver": "7.5.8",
-    "esbuild": "0.25.0",
-    "tsx": "4.19.3",
-    "typescript": "5.6.3",
-    "vitest": "3.0.6",
-    "@aws-sdk/client-ecr": "3.750.0",
+    "@types/node": "22.15.29",
+    "@types/semver": "7.7.0",
+    "esbuild": "0.25.5",
+    "tsx": "4.19.4",
+    "typescript": "5.8.3",
+    "vitest": "3.1.3",
+    "@aws-sdk/client-ecr": "3.810.0",
     "@kubernetes/client-node": "1.0.0-rc7",
-    "@ory/client": "1.16.7",
+    "@ory/client": "1.20.11",
     "commander": "12.1.0",
-    "dockerode": "4.0.2",
-    "h3": "1.15.0",
+    "dockerode": "4.0.6",
+    "h3": "1.15.3",
     "js-yaml": "4.1.0",
     "jsonwebtoken": "9.0.2",
     "jwk-to-pem": "2.0.7",
     "open": "8.4.2",
-    "semver": "7.7.1",
-    "tslog": "4.9.3"
+    "semver": "7.7.2",
+    "tslog": "4.9.3",
+    "eslint": "9.31.0"
   }
 }

package/src/auth.ts

@@ -1,12 +1,12 @@
 
 import { toNodeListener, createApp, defineEventHandler, getQuery, sendError } from 'h3'
-import jwt from 'jsonwebtoken'
-import jwkToPem from 'jwk-to-pem'
+import jwt, { JwtPayload } from 'jsonwebtoken'
+
 import { randomBytes, createHash } from 'node:crypto'
 import { createServer } from 'node:http'
 import open from 'open'
 
-import { Configuration, WellknownApi, OidcApi } from '@ory/client'
+import { Configuration, OidcApi } from '@ory/client'
 
 import { portalBaseUrl } from './config.js'
 import { logger } from './logging.js'
@@ -23,11 +23,6 @@ const clientId = 'c16ea663-ced3-46c6-8f85-38c9681fe1f0'
 const baseURL = 'https://auth.metaplay.dev'
 const authorizationEndpoint = `${baseURL}/oauth2/auth`
 const tokenEndpoint = `${baseURL}/oauth2/token`
-const wellknownApi = new WellknownApi(
-  new Configuration({
-    basePath: baseURL,
-  })
-)
 const oidcApi = new OidcApi(
   new Configuration({
     basePath: baseURL,
@@ -233,8 +228,11 @@ export async function extendCurrentSession(): Promise<void> {
   try {
     const tokens = await loadTokens()
 
+    // Check whether the token has expired and needs to be refreshed.
+    // Note: We don't properly validate the token here as it's the servers that need to
+    // perform these checks; there is no benefit in doing it locally.
     logger.debug('Check if access token still valid...')
-    if (await validateToken(tokens.access_token)) {
+    if (isJwtStillValid(tokens.access_token)) {
       // Access token is not expired, return to the caller
       logger.debug('Access token is valid, no need to refresh.')
       return
@@ -347,7 +345,7 @@ async function getTokensWithAuthorizationCode(
     if (error instanceof Error) {
       logger.error(`Error exchanging code for tokens: ${error.message}`)
     }
-    // eslint-disable-next-line @typescript-eslint/only-throw-error
+
     throw error
   }
 }
@@ -368,7 +366,7 @@ export async function loadTokens(): Promise<TokenSet> {
     if (error instanceof Error) {
       throw new Error(`Error loading tokens: ${error.message}`)
     }
-    // eslint-disable-next-line @typescript-eslint/only-throw-error
+
     throw error
   }
 }
@@ -397,7 +395,7 @@ export async function saveTokens(tokens: Record<string, string>): Promise<void>
     if (error instanceof Error) {
       throw new Error(`Failed to save tokens: ${error.message}`)
     }
-    // eslint-disable-next-line @typescript-eslint/only-throw-error
+
     throw error
   }
 }
@@ -413,45 +411,52 @@ export async function removeTokens(): Promise<void> {
     if (error instanceof Error) {
       throw new Error(`Error removing tokens: ${error.message}`)
     }
-    // eslint-disable-next-line @typescript-eslint/only-throw-error
+
     throw error
   }
 }
 
 /**
- * This function validates a token by checking its signature, expiration and issuer.
- * @param token The token being validated
- * @returns return if token is valid, throw errors otherwise
+ * Check whether a given JWT is still valid, i.e., hsa not expired. Does a few sanity
+ * checks as well and throws on malformed tokens, but does not do a full validation
+ * of the token (there's no point to do this on the client).
+ *
+ * @param token The JWT to check for expiration.
+ * @returns True if token is still valid (not expired), false otherwise.
+ * @throws Error if the token is malformed.
  */
-async function validateToken(token: string): Promise<boolean> {
-  try {
-    // Decode the token
-    const completeTokenData = jwt.decode(token, { complete: true })
+function isJwtStillValid(token: string): boolean {
+  // Decode the token
+  const completeTokenData = jwt.decode(token, { complete: true })
 
-    // Handle junk data.
-    if (!completeTokenData) {
-      throw new Error('Invalid token')
-    }
+  // Handle junk data.
+  if (!completeTokenData) {
+    throw new Error('Invalid token: unable to decode JWT')
+  }
 
-    // Get the JSON web keys from the wellknown API.
-    const res = await wellknownApi.discoverJsonWebKeys()
-    const jwk = res.data.keys?.find((key) => key.kid === completeTokenData.header.kid)
-    if (!jwk) {
-      throw new Error('No public key found for token signature')
-    }
-    // Convert to PEM format.
-    const pem = jwkToPem(jwk as jwkToPem.JWK)
+  // Perform simple local validation without network requests
+  const payload = completeTokenData.payload as JwtPayload
 
-    // Verify the token signature, expiration and decode it.
-    jwt.verify(token, pem, { issuer: baseURL, ignoreExpiration: false })
+  // Check if token has required fields
+  if (!payload.exp) {
+    throw new Error('Invalid token: missing expiration time (exp)')
+  }
 
-    return true
-  } catch (error) {
-    if (error instanceof Error) {
-      logger.info(`Token not valid: ${error.message}`)
-    }
+  if (!payload.iss) {
+    throw new Error('Invalid token: missing issuer (iss)')
+  }
+
+  // Check if token is expired
+  const now = Math.floor(Date.now() / 1000)
+  if (payload.exp < now) {
     return false
   }
+
+  // Ignore nbf (not before). No additional value in checking it and
+  // the check is vulnerable to local clock skew.
+
+  // Token is still valid
+  return true
 }
 
 /**

package/src/deployment.ts

@@ -596,7 +596,7 @@ export async function debugGameServer(targetEnv: TargetEnvironment, targetPodNam
   }
 
   // Execute 'kubectl debug ..'
-  const tmpKubeconfigPath = path.join(os.tmpdir(), `temp-kubeconfig-${+Date.now()}`)
+  const tmpKubeconfigPath = path.join(os.tmpdir(), `temp-kubeconfig-${Date.now()}`)
   try {
     // Write kubeconfig to a file
     logger.debug(`Write temporary kubeconfig to ${tmpKubeconfigPath}`)

package/src/secret_store.ts

@@ -38,7 +38,7 @@ async function loadSecrets(): Promise<Secrets> {
     if (password.length === 0) {
       throw new Error('The file is encrypted. Please set the METAPLAY_AUTH_PASSWORD environment variable.')
     }
-    // eslint-disable-next-line @typescript-eslint/only-throw-error
+     
     throw error
   }
 }

package/src/utils.ts

@@ -262,7 +262,7 @@ export async function executeHelmCommand(kubeconfigPayload: string, args: string
  */
 export interface HelmRelease {
   name: string // Eg, "gameserver"
-  namespace: string // Eg, "idler-develop"
+  namespace: string // Eg, "lovely-wombats-build-nimbly"
   revision: string // Eg, "334"
   updated: string // Eg, "2024-11-21 10:38:06.105016472 +0000 UTC"
   status: string // Eg, "deployed"

package/src/version.ts

@@ -1 +1 @@
-export const PACKAGE_VERSION = "1.9.0"
+export const PACKAGE_VERSION = "1.9.1"