@nebulr-group/bridge-auth-core 0.4.0-beta.5 → 0.4.0-beta.6

package/dist/backend/jwks-service.d.ts

@@ -14,14 +14,28 @@ export type JwksLogger = (message: string, ...args: unknown[]) => void;
 export interface JwksServiceConfig {
     /** JWKS endpoint for user-token verification. */
     jwksUrl: string;
-    /** JWKS endpoint for API-token verification (cached independently). */
-    apiTokenJwksUrl: string;
+    /**
+     * Token-introspection endpoint for API-token verification.
+     *
+     * API tokens are signed with the per-app HS256 secret, which a plugin never
+     * holds — so the plugin cannot verify them locally. Instead it POSTs the
+     * token here (`{ token }`) and the Bridge returns `{ active, sub, appId,
+     * tenantId, type, privileges, exp }`. This also gives instant revocation:
+     * the Bridge re-checks the backing record on every (uncached) call.
+     */
+    introspectionUrl: string;
     /** Expected `iss` for user tokens. */
     issuer: string;
     /** Expected `aud` for user tokens (typically the appId). */
     audience: string;
     /** How long a remote JWKS client is reused before it is re-created. @default 3600000 (1h) */
     cacheTtlMs?: number;
+    /**
+     * How long a successful introspection result is cached, keyed by token.
+     * Trades revocation latency for fewer network calls. `0` disables caching
+     * (every request introspects → instant revocation). @default 0
+     */
+    introspectionCacheTtlMs?: number;
     /** Optional debug logger. @default no-op */
     log?: JwksLogger;
 }
@@ -37,11 +51,17 @@ export declare class TokenVerificationError extends Error {
     constructor(message: string, code: string);
 }
 /**
- * Framework-agnostic, Node-only JWKS-based JWT verification.
+ * Framework-agnostic, Node-only Bridge token verification.
  *
- * Covers BOTH the user-token path (issuer/audience validated) and the
- * API-token path (type + appId validated). The two JWKS clients are cached
- * independently with the same TTL behavior.
+ * Covers two paths:
+ *  - **User tokens** — verified locally via remote JWKS (asymmetric PS256;
+ *    issuer/audience validated). The verifier needs no secret, so offline
+ *    JWKS verification is the right tool.
+ *  - **API tokens** — verified via remote *introspection* (a POST to the
+ *    Bridge). API tokens are signed with the per-app HS256 secret which the
+ *    plugin never holds, so the secret-holder (the Bridge) is asked. This also
+ *    gives instant revocation. Successful results may be cached (off by
+ *    default; see `introspectionCacheTtlMs`).
  *
  * This is a plain class — NOT a DI provider. Framework plugins wrap it.
  */
@@ -49,19 +69,16 @@ export declare class JwksService {
     private readonly config;
     private jwks;
     private jwksInitTime;
-    private apiTokenJwks;
-    private apiTokenJwksInitTime;
+    /** token → { result, expiresAt(ms) }. Only successful introspections are cached. */
+    private readonly introspectionCache;
     private readonly cacheTtlMs;
+    private readonly introspectionCacheTtlMs;
     private readonly log;
     constructor(config: JwksServiceConfig);
     /**
      * Initialize or refresh the user-token JWKS client.
      */
     private ensureJwks;
-    /**
-     * Initialize or refresh the API-token JWKS client (cached independently).
-     */
-    private ensureApiTokenJwks;
     /**
      * Verify a user JWT and return its claims.
      *
@@ -69,15 +86,31 @@ export declare class JwksService {
      */
     verifyToken(token: string): Promise<JwtClaims>;
     /**
-     * Verify a Bridge API token JWT and return its claims.
+     * Verify a Bridge API token by introspecting it against the Bridge.
+     *
+     * Unlike user tokens, API tokens are signed with the per-app HS256 secret
+     * which this verifier does not hold — so it asks the secret-holder. The
+     * Bridge returns whether the token is active (signature valid AND backing
+     * record live: not revoked, not expired) plus its claims.
      *
-     * Uses a separate JWKS client (cached independently from the user-token
-     * client). Validates `type === 'api'` and `appId === expectedAppId`.
+     * The returned `{ active: false }` covers every rejection (forged, tampered,
+     * wrong type, revoked, expired) without distinguishing them — no information
+     * leak. App-scoping is then enforced here: the introspected `appId` must
+     * equal `expectedAppId`.
      *
-     * @throws {TokenVerificationError} if the token is invalid, expired, the
-     *   wrong type, or issued for a different app.
+     * @throws {TokenVerificationError}
+     *   - `TOKEN_INVALID` if the token is inactive or not an API token
+     *   - `APP_MISMATCH` if the token belongs to a different app
+     *   - `UNKNOWN_ERROR` if the introspection request itself fails
      */
     verifyApiToken(token: string, expectedAppId: string): Promise<ApiTokenClaims>;
+    /**
+     * POST the token to the introspection endpoint, with optional short-lived
+     * caching of successful results (see `introspectionCacheTtlMs`).
+     */
+    private introspect;
+    private getCachedIntrospection;
+    private cacheIntrospection;
     /**
      * Map a jose verification error to a stable TokenVerificationError.
      */

package/dist/backend/jwks-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwks-service.d.ts","sourceRoot":"","sources":["../../src/backend/jwks-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,eAAe,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAG7B,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAID;;;;;;;;GAQG;AACH,qBAAa,WAAW;IAUV,OAAO,CAAC,QAAQ,CAAC,MAAM;IATnC,OAAO,CAAC,IAAI,CAAsD;IAClE,OAAO,CAAC,YAAY,CAAK;IAEzB,OAAO,CAAC,YAAY,CAAsD;IAC1E,OAAO,CAAC,oBAAoB,CAAK;IAEjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAEJ,MAAM,EAAE,iBAAiB;IAKtD;;OAEG;IACH,OAAO,CAAC,UAAU;IAYlB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAqBpD;;;;;;;;OAQG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA4BnF;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAqB7B"}
+{"version":3,"file":"jwks-service.d.ts","sourceRoot":"","sources":["../../src/backend/jwks-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,4CAA4C;IAC5C,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAeD;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAG7B,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAKD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAW;IAcV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbnC,OAAO,CAAC,IAAI,CAAsD;IAClE,OAAO,CAAC,YAAY,CAAK;IAEzB,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAG/B;IAEJ,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAEJ,MAAM,EAAE,iBAAiB;IAOtD;;OAEG;IACH,OAAO,CAAC,UAAU;IAYlB;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAqBpD;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA+BnF;;;OAGG;YACW,UAAU;IAwCxB,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,kBAAkB;IAU1B;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAqB7B"}

package/dist/backend/jwks-service.js

@@ -15,12 +15,19 @@ export class TokenVerificationError extends Error {
     }
 }
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
+const DEFAULT_INTROSPECTION_CACHE_TTL_MS = 0; // disabled → instant revocation
 /**
- * Framework-agnostic, Node-only JWKS-based JWT verification.
+ * Framework-agnostic, Node-only Bridge token verification.
  *
- * Covers BOTH the user-token path (issuer/audience validated) and the
- * API-token path (type + appId validated). The two JWKS clients are cached
- * independently with the same TTL behavior.
+ * Covers two paths:
+ *  - **User tokens** — verified locally via remote JWKS (asymmetric PS256;
+ *    issuer/audience validated). The verifier needs no secret, so offline
+ *    JWKS verification is the right tool.
+ *  - **API tokens** — verified via remote *introspection* (a POST to the
+ *    Bridge). API tokens are signed with the per-app HS256 secret which the
+ *    plugin never holds, so the secret-holder (the Bridge) is asked. This also
+ *    gives instant revocation. Successful results may be cached (off by
+ *    default; see `introspectionCacheTtlMs`).
  *
  * This is a plain class — NOT a DI provider. Framework plugins wrap it.
  */
@@ -28,13 +35,16 @@ export class JwksService {
     config;
     jwks = null;
     jwksInitTime = 0;
-    apiTokenJwks = null;
-    apiTokenJwksInitTime = 0;
+    /** token → { result, expiresAt(ms) }. Only successful introspections are cached. */
+    introspectionCache = new Map();
     cacheTtlMs;
+    introspectionCacheTtlMs;
     log;
     constructor(config) {
         this.config = config;
         this.cacheTtlMs = config.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
+        this.introspectionCacheTtlMs =
+            config.introspectionCacheTtlMs ?? DEFAULT_INTROSPECTION_CACHE_TTL_MS;
         this.log = config.log ?? (() => { });
     }
     /**
@@ -49,18 +59,6 @@ export class JwksService {
         }
         return this.jwks;
     }
-    /**
-     * Initialize or refresh the API-token JWKS client (cached independently).
-     */
-    ensureApiTokenJwks() {
-        const now = Date.now();
-        if (!this.apiTokenJwks || now - this.apiTokenJwksInitTime > this.cacheTtlMs) {
-            this.log('Initializing API token JWKS client', { url: this.config.apiTokenJwksUrl });
-            this.apiTokenJwks = createRemoteJWKSet(new URL(this.config.apiTokenJwksUrl));
-            this.apiTokenJwksInitTime = now;
-        }
-        return this.apiTokenJwks;
-    }
     /**
      * Verify a user JWT and return its claims.
      *
@@ -85,36 +83,111 @@ export class JwksService {
         }
     }
     /**
-     * Verify a Bridge API token JWT and return its claims.
+     * Verify a Bridge API token by introspecting it against the Bridge.
+     *
+     * Unlike user tokens, API tokens are signed with the per-app HS256 secret
+     * which this verifier does not hold — so it asks the secret-holder. The
+     * Bridge returns whether the token is active (signature valid AND backing
+     * record live: not revoked, not expired) plus its claims.
      *
-     * Uses a separate JWKS client (cached independently from the user-token
-     * client). Validates `type === 'api'` and `appId === expectedAppId`.
+     * The returned `{ active: false }` covers every rejection (forged, tampered,
+     * wrong type, revoked, expired) without distinguishing them — no information
+     * leak. App-scoping is then enforced here: the introspected `appId` must
+     * equal `expectedAppId`.
      *
-     * @throws {TokenVerificationError} if the token is invalid, expired, the
-     *   wrong type, or issued for a different app.
+     * @throws {TokenVerificationError}
+     *   - `TOKEN_INVALID` if the token is inactive or not an API token
+     *   - `APP_MISMATCH` if the token belongs to a different app
+     *   - `UNKNOWN_ERROR` if the introspection request itself fails
      */
     async verifyApiToken(token, expectedAppId) {
-        const jwks = this.ensureApiTokenJwks();
+        const introspection = await this.introspect(token);
+        if (!introspection.active) {
+            // Bridge already collapsed forged/tampered/revoked/expired → inactive.
+            throw new TokenVerificationError('Invalid token', 'TOKEN_INVALID');
+        }
+        if (introspection.type !== 'api') {
+            throw new TokenVerificationError('Wrong token type', 'TOKEN_INVALID');
+        }
+        if (introspection.appId !== expectedAppId) {
+            throw new TokenVerificationError('Token issued for a different app', 'APP_MISMATCH');
+        }
+        this.log('API token verified via introspection', {
+            sub: introspection.sub,
+            appId: introspection.appId,
+        });
+        return {
+            sub: introspection.sub,
+            appId: introspection.appId,
+            tenantId: introspection.tenantId ?? null,
+            type: 'api',
+            privileges: introspection.privileges ?? [],
+            ...(introspection.exp != null ? { exp: introspection.exp } : {}),
+        };
+    }
+    /**
+     * POST the token to the introspection endpoint, with optional short-lived
+     * caching of successful results (see `introspectionCacheTtlMs`).
+     */
+    async introspect(token) {
+        const cached = this.getCachedIntrospection(token);
+        if (cached) {
+            this.log('API token introspection cache hit');
+            return cached;
+        }
+        let response;
         try {
-            const { payload } = await jwtVerify(token, jwks);
-            if (payload['type'] !== 'api') {
-                throw new TokenVerificationError('Wrong token type', 'TOKEN_INVALID');
-            }
-            if (payload['appId'] !== expectedAppId) {
-                throw new TokenVerificationError('Token issued for a different app', 'APP_MISMATCH');
-            }
-            this.log('API token verified successfully', {
-                sub: payload.sub,
-                appId: payload['appId'],
+            response = await fetch(this.config.introspectionUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token }),
             });
-            return payload;
         }
         catch (error) {
-            if (error instanceof TokenVerificationError) {
-                throw error;
-            }
-            throw this.mapVerificationError(error, 'API token');
+            this.log('API token introspection request failed', error);
+            throw new TokenVerificationError('Introspection request failed', 'UNKNOWN_ERROR');
+        }
+        if (!response.ok) {
+            this.log('API token introspection returned a non-OK status', {
+                status: response.status,
+            });
+            throw new TokenVerificationError('Introspection endpoint error', 'UNKNOWN_ERROR');
+        }
+        let body;
+        try {
+            body = (await response.json());
+        }
+        catch (error) {
+            this.log('API token introspection returned invalid JSON', error);
+            throw new TokenVerificationError('Introspection response invalid', 'UNKNOWN_ERROR');
+        }
+        if (body.active) {
+            this.cacheIntrospection(token, body);
+        }
+        return body;
+    }
+    getCachedIntrospection(token) {
+        if (this.introspectionCacheTtlMs <= 0) {
+            return null;
+        }
+        const entry = this.introspectionCache.get(token);
+        if (!entry) {
+            return null;
+        }
+        if (Date.now() >= entry.expiresAt) {
+            this.introspectionCache.delete(token);
+            return null;
+        }
+        return entry.result;
+    }
+    cacheIntrospection(token, result) {
+        if (this.introspectionCacheTtlMs <= 0) {
+            return;
         }
+        this.introspectionCache.set(token, {
+            result,
+            expiresAt: Date.now() + this.introspectionCacheTtlMs,
+        });
     }
     /**
      * Map a jose verification error to a stable TokenVerificationError.

package/dist/backend/jwks-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwks-service.js","sourceRoot":"","sources":["../../src/backend/jwks-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AA+B3E;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B;IAFlB,YACE,OAAe,EACC,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAEtD;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IAUO;IATrB,IAAI,GAAiD,IAAI,CAAC;IAC1D,YAAY,GAAG,CAAC,CAAC;IAEjB,YAAY,GAAiD,IAAI,CAAC;IAClE,oBAAoB,GAAG,CAAC,CAAC;IAEhB,UAAU,CAAS;IACnB,GAAG,CAAa;IAEjC,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QACpD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,oBAAoB,CAAC;QAC5D,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5E,IAAI,CAAC,GAAG,CAAC,oCAAoC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,oBAAoB,GAAG,GAAG,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;aAC/B,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE;gBACtC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YAEH,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,aAAqB;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAEjD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC9B,MAAM,IAAI,sBAAsB,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,aAAa,EAAE,CAAC;gBACvC,MAAM,IAAI,sBAAsB,CAAC,kCAAkC,EAAE,cAAc,CAAC,CAAC;YACvF,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE;gBAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;aACxB,CAAC,CAAC;YAEH,OAAO,OAAoC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,KAAc,EAAE,KAAa;QACxD,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;YACxD,OAAO,IAAI,sBAAsB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;YACxD,OAAO,IAAI,sBAAsB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;YAClE,OAAO,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,+CAA+C,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;YAC5F,OAAO,IAAI,sBAAsB,CAAC,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,eAAe,CAAC,CAAC;IAClF,CAAC;CACF"}
+{"version":3,"file":"jwks-service.js","sourceRoot":"","sources":["../../src/backend/jwks-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AA0D3E;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B;IAFlB,YACE,OAAe,EACC,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AACtD,MAAM,kCAAkC,GAAG,CAAC,CAAC,CAAC,gCAAgC;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,WAAW;IAcO;IAbrB,IAAI,GAAiD,IAAI,CAAC;IAC1D,YAAY,GAAG,CAAC,CAAC;IAEzB,oFAAoF;IACnE,kBAAkB,GAAG,IAAI,GAAG,EAG1C,CAAC;IAEa,UAAU,CAAS;IACnB,uBAAuB,CAAS;IAChC,GAAG,CAAa;IAEjC,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QACpD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,oBAAoB,CAAC;QAC5D,IAAI,CAAC,uBAAuB;YAC1B,MAAM,CAAC,uBAAuB,IAAI,kCAAkC,CAAC;QACvE,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;aAC/B,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE;gBACtC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YAEH,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,aAAqB;QACvD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1B,uEAAuE;YACvE,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,sBAAsB,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,aAAa,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAAC,kCAAkC,EAAE,cAAc,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,sCAAsC,EAAE;YAC/C,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,KAAK,EAAE,aAAa,CAAC,KAAK;SAC3B,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,EAAE,aAAa,CAAC,GAAa;YAChC,KAAK,EAAE,aAAa,CAAC,KAAe;YACpC,QAAQ,EAAE,aAAa,CAAC,QAAQ,IAAI,IAAI;YACxC,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,aAAa,CAAC,UAAU,IAAI,EAAE;YAC1C,GAAG,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACtB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,KAAa;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,IAAI,sBAAsB,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,kDAAkD,EAAE;gBAC3D,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,IAAI,sBAAsB,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,IAA2B,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;YACjE,MAAM,IAAI,sBAAsB,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,KAAa;QAC1C,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAEO,kBAAkB,CAAC,KAAa,EAAE,MAA6B;QACrE,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE;YACjC,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB;SACrD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,KAAc,EAAE,KAAa;QACxD,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;YACxD,OAAO,IAAI,sBAAsB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;YACxD,OAAO,IAAI,sBAAsB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;YAClE,OAAO,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,+CAA+C,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;YAC5F,OAAO,IAAI,sBAAsB,CAAC,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,eAAe,CAAC,CAAC;IAClF,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-auth-core",
-  "version": "0.4.0-beta.5",
+  "version": "0.4.0-beta.6",
   "description": "Framework-agnostic auth core for Bridge platform",
   "type": "module",
   "main": "./dist/index.js",