@nihplod/sso-verify 1.0.2 → 1.0.3

package/README.md

@@ -14,6 +14,8 @@ npm install @nihplod/sso-verify
 
 Suitable for all sub-projects; no signing keys required.
 
+#### Confidential Client (server-side or BFF)
+
 ```typescript
 import { createTokenVerifier } from "@nihplod/sso-verify";
 
@@ -31,6 +33,23 @@ if (payload) {
 }
 ```
 
+#### Public Client (SPA / mobile / desktop)
+
+Public Clients have no `client_secret`. The introspection endpoint still accepts verification with `client_id` only.
+
+```typescript
+import { createTokenVerifier } from "@nihplod/sso-verify";
+
+const verifier = createTokenVerifier({
+  introspectionEndpoint: "https://nihplod.cn/api/oauth/introspect",
+  clientId: "your-public-client-id",
+  audience: "your-public-client-id",
+  issuer: "https://nihplod.cn",
+});
+
+const payload = await verifier.verify(token);
+```
+
 ### Method 2: Local JWT Verification (Internal Confidential Clients Only)
 
 Only use this when the sub-project shares `JWT_ACCESS_SECRET` with the main site.

package/dist/index.js

@@ -80,7 +80,7 @@ function createTokenVerifier(options) {
     return _rs256PublicKey;
   }
   async function introspect(token) {
-    if (!introspectionEndpoint || !clientId || !clientSecret) {
+    if (!introspectionEndpoint || !clientId) {
       return null;
     }
     const cached = introspectCache.get(token);
@@ -88,14 +88,14 @@ function createTokenVerifier(options) {
       return { active: cached.active, ...cached.payload || {} };
     }
     try {
+      const params = new URLSearchParams({ token, client_id: clientId });
+      if (clientSecret) {
+        params.set("client_secret", clientSecret);
+      }
       const response = await fetch(introspectionEndpoint, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          token,
-          client_id: clientId,
-          client_secret: clientSecret
-        })
+        body: params
       });
       if (!response.ok) return null;
       const data = await response.json();

package/dist/index.mjs

@@ -54,7 +54,7 @@ function createTokenVerifier(options) {
     return _rs256PublicKey;
   }
   async function introspect(token) {
-    if (!introspectionEndpoint || !clientId || !clientSecret) {
+    if (!introspectionEndpoint || !clientId) {
       return null;
     }
     const cached = introspectCache.get(token);
@@ -62,14 +62,14 @@ function createTokenVerifier(options) {
       return { active: cached.active, ...cached.payload || {} };
     }
     try {
+      const params = new URLSearchParams({ token, client_id: clientId });
+      if (clientSecret) {
+        params.set("client_secret", clientSecret);
+      }
       const response = await fetch(introspectionEndpoint, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          token,
-          client_id: clientId,
-          client_secret: clientSecret
-        })
+        body: params
       });
       if (!response.ok) return null;
       const data = await response.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nihplod/sso-verify",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "NIHPLOD 一网通 SSO Token 验证工具包 — 供子项目在后端验证主站签发的 Access Token",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",