@nsshunt/stsappframework 2.19.163 → 2.19.165

package/dist/authutilsnode.js

@@ -22,16 +22,58 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
-var _AuthUtilsNode_cookiejar;
+var _AuthUtilsNode_cookiejar, _AuthUtilsNode_httpsAgent, _AuthUtilsNode_debug, _AuthUtilsNode_GetHttpsAgent;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthUtilsNode = void 0;
+exports.AuthUtilsNode = exports.STSClientID = void 0;
 const tough_cookie_1 = __importDefault(require("tough-cookie"));
+const https_1 = __importDefault(require("https"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const jwt_decode_1 = __importDefault(require("jwt-decode"));
+const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
+const axios_1 = __importDefault(require("axios"));
+const stsconfig_1 = require("@nsshunt/stsconfig");
+const goptions = (0, stsconfig_1.$Options)();
+const debug_1 = __importDefault(require("debug"));
 const stsutils_1 = require("@nsshunt/stsutils");
 const errors_1 = require("./validation/errors");
 const http_status_codes_1 = require("http-status-codes");
+var STSClientID;
+(function (STSClientID) {
+    STSClientID["STSRest01Service"] = "KgSyRECcvnJwwOZqf7GPqUw508sx7VBFEbDC0iP4oeY=";
+    STSClientID["STSAuthService"] = "q6a9F0kksXDDcrsCUKRwHKDnTNh7yZfxCShAgIJqfGg=";
+    STSClientID["STSUITerminal"] = "U0E4c4cuRKlBsGo7OhOl3qTkoNGFBXjORUS/T4R4xyA=";
+    STSClientID["STSCLI"] = "EcCpnQOIQFizAnWphlFJ4tSylosgVnwKTSNtgwuL2tw=";
+    STSClientID["STSUIWebApp"] = "lww8Je8n2P0OI/KEfJ+4p/bqsk8uE/noeq13tl4zlQ0=";
+    STSClientID["XXSTSUserAgentRunnerX"] = "y1h2nNr1BzTVPIzNmP/f041uxbnyZYTJeF/5GcwRCtw=";
+    STSClientID["STSInstrumentManagerService"] = "l8u2E912eR44ZYRHUkSBCCnDOXxQqYOPahDVQzYowrw=";
+    STSClientID["STSTestOrchestratorService"] = "CU1sVlS6vsEe3O3VvNzKFdBnQd9pQ83w9RyVx/7tJfc=";
+    STSClientID["STSTestRunnerNode"] = "aX9dJbsT06V1G4j06xEIQ/rZ2CDlpzggU58aLtZ8fzE=";
+    STSClientID["STSBrokerService"] = "TRppBuvxcjL7jrY9lCASJ5st8JpU8WlhAUAWoX/KKQ4=";
+    STSClientID["STSTestingService"] = "4Mtb3ABdSzZvSz4T51HPJhT14znVnqVDRFiZsvDNAOg=";
+    STSClientID["XXSTSAuthenticateSPAXX"] = "v4qBrds3Autl/i86xT+5z0K53kJ/2hHTfxNo0QO/0Jk=";
+    STSClientID["STSTestRunnerAgentSPA"] = "yDbklCH3awzDNuHICuco9mjDqhdzCa8m7w/UE9Opexc=";
+    STSClientID["STSClientApp01SPA"] = "FDX/CPyDb3m6d9G2k+wDX8Uvey+yCkllaT4EuEt4QyU=";
+    STSClientID["PowerPlatformCustomConnectorSPA"] = "fcdcebb5-d154-4699-b99d-87d29e5e148f";
+})(STSClientID = exports.STSClientID || (exports.STSClientID = {}));
 class AuthUtilsNode {
     constructor() {
         _AuthUtilsNode_cookiejar.set(this, void 0);
+        _AuthUtilsNode_httpsAgent.set(this, null);
+        _AuthUtilsNode_debug.set(this, (0, debug_1.default)(`proc:${process.pid}:AuthUtilsNode`));
+        _AuthUtilsNode_GetHttpsAgent.set(this, () => {
+            if (__classPrivateFieldGet(this, _AuthUtilsNode_httpsAgent, "f") === null) {
+                // https://nodejs.org/api/http.html#class-httpagent
+                __classPrivateFieldSet(this, _AuthUtilsNode_httpsAgent, new https_1.default.Agent({
+                    keepAlive: goptions.keepAlive,
+                    maxSockets: goptions.maxSockets,
+                    maxTotalSockets: goptions.maxTotalSockets,
+                    maxFreeSockets: goptions.maxFreeSockets,
+                    timeout: goptions.timeout,
+                    rejectUnauthorized: false
+                }), "f");
+            }
+            return __classPrivateFieldGet(this, _AuthUtilsNode_httpsAgent, "f");
+        });
         this.SetCookiesToJar = (headers, endpoint) => __awaiter(this, void 0, void 0, function* () {
             if (headers['set-cookie']) {
                 headers['set-cookie'].map((headerCookie) => {
@@ -48,6 +90,91 @@ class AuthUtilsNode {
         this.GetCookiesFromJar = (endpoint) => __awaiter(this, void 0, void 0, function* () {
             return __classPrivateFieldGet(this, _AuthUtilsNode_cookiejar, "f").getCookies(endpoint);
         });
+        this.ValidateJWT = (token, audience, endpoint) => __awaiter(this, void 0, void 0, function* () {
+            const jwksClientUri = (endpoint
+                ? `${endpoint}${goptions.asoauthapiroot}${goptions.asjwksjsonpath}`
+                : `${goptions.asendpoint}:${goptions.asport}${goptions.asoauthapiroot}${goptions.asjwksjsonpath}`);
+            const jwks = (0, jwks_rsa_1.default)({
+                cache: true,
+                cacheMaxEntries: 5,
+                cacheMaxAge: 600000,
+                rateLimit: true,
+                jwksRequestsPerMinute: 10,
+                jwksUri: jwksClientUri,
+                timeout: 30000,
+                requestAgent: __classPrivateFieldGet(this, _AuthUtilsNode_GetHttpsAgent, "f").call(this)
+            });
+            // Use decode to get the kid
+            const decodedRefreshToken = (0, jwt_decode_1.default)(token, { header: true });
+            const kid = decodedRefreshToken.kid;
+            const key = yield jwks.getSigningKey(kid);
+            const signingKey = key.getPublicKey();
+            const verifyOptions = {
+                issuer: 'https://stsmda.com.au/stsauth/',
+                //subject:  s,
+                audience: audience,
+                //expiresIn:  600, // 10 minutes
+                algorithm: ["RS256"] // RSASSA [ "RS256", "RS384", "RS512" ]
+            };
+            return jsonwebtoken_1.default.verify(token, signingKey, verifyOptions);
+        });
+        this.GetAPITokenFromAuthServer = (clientId, authClientSecret, audience, endPoint) => __awaiter(this, void 0, void 0, function* () {
+            try {
+                const headers = { 'Content-Type': 'application/json' };
+                const payload = {
+                    client_id: clientId,
+                    client_secret: authClientSecret,
+                    //client_secret: goptions.brokerclientsecret, // Broker service client secret
+                    audience: audience,
+                    //@@ remove audience
+                    //@@ need scope to be the API identifier
+                    grant_type: "client_credentials"
+                };
+                const url = (endPoint
+                    ? `${endPoint}${goptions.asoauthapiroot}/token`
+                    : `${goptions.asendpoint}:${goptions.asport}${goptions.asoauthapiroot}/token`);
+                const retVal = yield (0, axios_1.default)({
+                    url,
+                    method: 'post',
+                    data: payload,
+                    headers: headers,
+                    httpsAgent: __classPrivateFieldGet(this, _AuthUtilsNode_GetHttpsAgent, "f").call(this)
+                });
+                if (retVal.status) {
+                    if (retVal.status !== 200) {
+                        // Just provide a warning here
+                        __classPrivateFieldGet(this, _AuthUtilsNode_debug, "f").call(this, `Error (AuthUtilsNode:GetAPITokenFromServer): Invalid response from server: [${retVal.status}]`.magenta);
+                    }
+                }
+                else {
+                    const msg = `Error (AuthUtilsNode:GetAPITokenFromServer:No retVal.status)`.red;
+                    __classPrivateFieldGet(this, _AuthUtilsNode_debug, "f").call(this, msg);
+                    throw new Error(msg);
+                }
+                if (retVal.data) {
+                    if (retVal.data.access_token) {
+                        return retVal.data.access_token;
+                    }
+                    else {
+                        const msg = `Error (AuthUtilsNode:GetAPITokenFromServer:No retVal.data.access_token)`.red;
+                        __classPrivateFieldGet(this, _AuthUtilsNode_debug, "f").call(this, msg);
+                        throw new Error(msg);
+                    }
+                }
+                else {
+                    const msg = `Error (AuthUtilsNode:GetAPITokenFromServer:No retVal.data)`.red;
+                    __classPrivateFieldGet(this, _AuthUtilsNode_debug, "f").call(this, msg);
+                    throw new Error(msg);
+                }
+            }
+            catch (error) {
+                __classPrivateFieldGet(this, _AuthUtilsNode_debug, "f").call(this, `Error (AuthUtilsNode:GetAPITokenFromServer:catch): ${error}`.red);
+                if (error.response && error.response.data) {
+                    __classPrivateFieldGet(this, _AuthUtilsNode_debug, "f").call(this, `Details: [${JSON.stringify(error.response.data)}]`.red);
+                }
+                throw error;
+            }
+        });
         __classPrivateFieldSet(this, _AuthUtilsNode_cookiejar, new tough_cookie_1.default.CookieJar(), "f");
     }
     VerifyRequestMiddlewareFactory(options) {
@@ -114,5 +241,5 @@ class AuthUtilsNode {
     }
 }
 exports.AuthUtilsNode = AuthUtilsNode;
-_AuthUtilsNode_cookiejar = new WeakMap();
+_AuthUtilsNode_cookiejar = new WeakMap(), _AuthUtilsNode_httpsAgent = new WeakMap(), _AuthUtilsNode_debug = new WeakMap(), _AuthUtilsNode_GetHttpsAgent = new WeakMap();
 //# sourceMappingURL=authutilsnode.js.map

package/dist/authutilsnode.js.map

@@ -1 +1 @@
-{"version":3,"file":"authutilsnode.js","sourceRoot":"","sources":["../src/authutilsnode.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gEAAiC;AAEjC,gDAAmD;AAEnD,gDAA2D;AAE3D,yDAAgD;AAMhD,MAAa,aAAa;IAItB;QAFA,2CAA4B;QAmE5B,oBAAe,GAAG,CAAO,OAA4B,EAAE,QAAgB,EAA2B,EAAE;YAEhG,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE;gBACvB,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,YAAiB,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAQ,sBAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;oBACrD,uBAAA,IAAI,gCAAW,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACpD,CAAC,CAAC,CAAC;aACN;iBAAM;gBACH,MAAM,MAAM,GAAQ,sBAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC9D,uBAAA,IAAI,gCAAW,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACnD;YAED,OAAO,uBAAA,IAAI,gCAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC,CAAA,CAAC;QAEF,sBAAiB,GAAG,CAAO,QAAgB,EAA2B,EAAE;YAEpE,OAAO,uBAAA,IAAI,gCAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC,CAAA,CAAC;QAlFE,uBAAA,IAAI,4BAAc,IAAI,sBAAK,CAAC,SAAS,EAAE,MAAA,CAAC;IAC5C,CAAC;IAED,8BAA8B,CAAC,OAA8B;QACzD,OAAO,UAAe,GAAQ,EAAE,GAAQ,EAAE,IAAS;;gBAC/C,IAAI,OAAO,CAAC,WAAW,EAAE;oBACrB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACzC,MAAM,mBAAmB,GAAG,EAAG,CAAC;oBAChC,KAAK,IAAI,CAAC,GAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;wBAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;wBAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;4BAC9B,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;yBACxC;qBACJ;oBACD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE;wBAChC,MAAM,YAAY,GAAG,IAAA,0BAAe,EAAC,8BAAqB,CAAC,+BAA+B,EAAE,mBAAmB,CAAC,CAAC;wBACjH,GAAG,CAAC,MAAM,CAAC,+BAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAE,EAAE,MAAM,EAAE,+BAAW,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;wBACtG,OAAO;qBACV;iBACJ;gBACD,IAAI,EAAE,CAAC;YACX,CAAC;SAAA,CAAA;IACL,CAAC;IACD;;;;;;;;;;;;;;;MAeD;IAEO,uBAAuB,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAS;;YAEvD,IAAI,EAAE,CAAC;YACP;;;;;;;;;;;;;;;;;;cAkBJ;QACA,CAAC;KAAA;CAgHJ;AAnLD,sCAmLC"}
+{"version":3,"file":"authutilsnode.js","sourceRoot":"","sources":["../src/authutilsnode.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gEAAiC;AACjC,kDAAyB;AACzB,gEAA+B;AAC/B,4DAAoC;AACpC,wDAAkC;AAElC,kDAA0B;AAE1B,kDAA6C;AAC7C,MAAM,QAAQ,GAAG,IAAA,oBAAQ,GAAE,CAAA;AAE3B,kDAA+B;AAE/B,gDAA+D;AAE/D,gDAA2D;AAE3D,yDAAgD;AAMhD,IAAY,WAgBX;AAhBD,WAAY,WAAW;IACnB,gFAAiE,CAAA;IACjE,8EAA+D,CAAA;IAC/D,6EAA8D,CAAA;IAC9D,sEAAuD,CAAA;IACvD,2EAA4D,CAAA;IAC5D,qFAAsE,CAAA;IACtE,2FAA4E,CAAA;IAC5E,0FAA2E,CAAA;IAC3E,iFAAkE,CAAA;IAClE,gFAAiE,CAAA;IACjE,iFAAkE,CAAA;IAClE,sFAAuE,CAAA;IACvE,qFAAsE,CAAA;IACtE,iFAAkE,CAAA;IAClE,uFAAwE,CAAA;AAC5E,CAAC,EAhBW,WAAW,GAAX,mBAAW,KAAX,mBAAW,QAgBtB;AAED,MAAa,aAAa;IAMtB;QAJA,2CAA4B;QAC5B,oCAAkC,IAAI,EAAC;QACvC,+BAAS,IAAA,eAAW,EAAC,QAAQ,OAAO,CAAC,GAAG,gBAAgB,CAAC,EAAC;QAM1D,uCAAiB,GAAG,EAAE;YAElB,IAAI,uBAAA,IAAI,iCAAY,KAAK,IAAI,EAAE;gBAC3B,mDAAmD;gBACnD,uBAAA,IAAI,6BAAe,IAAI,eAAK,CAAC,KAAK,CAAC;oBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,eAAe,EAAE,QAAQ,CAAC,eAAe;oBACzC,cAAc,EAAE,QAAQ,CAAC,cAAc;oBACvC,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,kBAAkB,EAAE,KAAK;iBAC5B,CAAC,MAAA,CAAC;aACN;YACD,OAAO,uBAAA,IAAI,iCAAY,CAAC;QAC5B,CAAC,EAAA;QA+DD,oBAAe,GAAG,CAAO,OAA4B,EAAE,QAAgB,EAA2B,EAAE;YAEhG,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE;gBACvB,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,YAAiB,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAQ,sBAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;oBACrD,uBAAA,IAAI,gCAAW,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACpD,CAAC,CAAC,CAAC;aACN;iBAAM;gBACH,MAAM,MAAM,GAAQ,sBAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC9D,uBAAA,IAAI,gCAAW,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;aACnD;YAED,OAAO,uBAAA,IAAI,gCAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC,CAAA,CAAC;QAEF,sBAAiB,GAAG,CAAO,QAAgB,EAA2B,EAAE;YAEpE,OAAO,uBAAA,IAAI,gCAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC,CAAA,CAAC;QAEF,gBAAW,GAAG,CAAO,KAAa,EAAE,QAAgB,EAAE,QAAiB,EAAmB,EAAE;YACxF,MAAM,aAAa,GAAG,CAAC,QAAQ;gBAC3B,CAAC,CAAC,GAAG,QAAQ,GAAG,QAAQ,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,EAAE;gBACnE,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,cAAc,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;YAEvG,MAAM,IAAI,GAAG,IAAA,kBAAU,EAAC;gBACpB,KAAK,EAAE,IAAI;gBACX,eAAe,EAAE,CAAC;gBAClB,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,IAAI;gBACf,qBAAqB,EAAE,EAAE;gBACzB,OAAO,EAAE,aAAa;gBACtB,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE,uBAAA,IAAI,oCAAe,MAAnB,IAAI,CAAiB;aACtC,CAAC,CAAC;YAEH,4BAA4B;YAC5B,MAAM,mBAAmB,GAAG,IAAA,oBAAU,EAAa,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC;YAEpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;YAEtC,MAAM,aAAa,GAAG;gBAClB,MAAM,EAAG,gCAAgC;gBACzC,cAAc;gBACd,QAAQ,EAAG,QAAQ;gBACnB,gCAAgC;gBAChC,SAAS,EAAG,CAAC,OAAO,CAAC,CAAG,uCAAuC;aAClE,CAAC;YAEF,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAW,CAAC;QAClE,CAAC,CAAA,CAAA;QAED,8BAAyB,GAAG,CAAO,QAAqB,EAAE,gBAAwB,EAAE,QAAgB,EAAE,QAAiB,EAAmB,EAAE;YACxI,IAAI;gBACA,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAC,CAAC;gBACtD,MAAM,OAAO,GAAG;oBACZ,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,gBAAgB;oBAC/B,6EAA6E;oBAC7E,QAAQ,EAAE,QAAQ;oBAClB,oBAAoB;oBACpB,wCAAwC;oBACxC,UAAU,EAAE,oBAAoB;iBACnC,CAAA;gBACD,MAAM,GAAG,GAAG,CAAC,QAAQ;oBACjB,CAAC,CAAC,GAAG,QAAQ,GAAG,QAAQ,CAAC,cAAc,QAAQ;oBAC/C,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,cAAc,QAAQ,CAAC,CAAC;gBACnF,MAAM,MAAM,GAAG,MAAM,IAAA,eAAK,EAAC;oBACvB,GAAG;oBACF,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,OAAO;oBAChB,UAAU,EAAE,uBAAA,IAAI,oCAAe,MAAnB,IAAI,CAAiB;iBACrC,CAAC,CAAC;gBAEH,IAAI,MAAM,CAAC,MAAM,EAAE;oBACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE;wBACvB,8BAA8B;wBAC9B,uBAAA,IAAI,4BAAO,MAAX,IAAI,EAAQ,+EAA+E,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC;qBACxH;iBACJ;qBAAM;oBACH,MAAM,GAAG,GAAG,8DAA8D,CAAC,GAAG,CAAA;oBAC9E,uBAAA,IAAI,4BAAO,MAAX,IAAI,EAAQ,GAAG,CAAC,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;iBACxB;gBACD,IAAI,MAAM,CAAC,IAAI,EAAE;oBACb,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE;wBAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,YAAsB,CAAC;qBAC7C;yBAAM;wBACH,MAAM,GAAG,GAAG,yEAAyE,CAAC,GAAG,CAAA;wBACzF,uBAAA,IAAI,4BAAO,MAAX,IAAI,EAAQ,GAAG,CAAC,CAAC;wBACjB,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;qBACxB;iBACJ;qBAAM;oBACH,MAAM,GAAG,GAAG,4DAA4D,CAAC,GAAG,CAAA;oBAC5E,uBAAA,IAAI,4BAAO,MAAX,IAAI,EAAQ,GAAG,CAAC,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;iBACxB;aACJ;YAAC,OAAO,KAAU,EAAE;gBACjB,uBAAA,IAAI,4BAAO,MAAX,IAAI,EAAQ,sDAAsD,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;gBAC/E,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;oBACvC,uBAAA,IAAI,4BAAO,MAAX,IAAI,EAAQ,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;iBACxE;gBACD,MAAM,KAAK,CAAC;aACf;QACL,CAAC,CAAA,CAAA;QA3LG,uBAAA,IAAI,4BAAc,IAAI,sBAAK,CAAC,SAAS,EAAE,MAAA,CAAC;IAC5C,CAAC;IAkBD,8BAA8B,CAAC,OAA8B;QACzD,OAAO,UAAe,GAAQ,EAAE,GAAQ,EAAE,IAAS;;gBAC/C,IAAI,OAAO,CAAC,WAAW,EAAE;oBACrB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACzC,MAAM,mBAAmB,GAAG,EAAG,CAAC;oBAChC,KAAK,IAAI,CAAC,GAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;wBAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;wBAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;4BAC9B,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;yBACxC;qBACJ;oBACD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE;wBAChC,MAAM,YAAY,GAAG,IAAA,0BAAe,EAAC,8BAAqB,CAAC,+BAA+B,EAAE,mBAAmB,CAAC,CAAC;wBACjH,GAAG,CAAC,MAAM,CAAC,+BAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAE,EAAE,MAAM,EAAE,+BAAW,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;wBACtG,OAAO;qBACV;iBACJ;gBACD,IAAI,EAAE,CAAC;YACX,CAAC;SAAA,CAAA;IACL,CAAC;IACD;;;;;;;;;;;;;;;MAeD;IAEO,uBAAuB,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAS;;YAEvD,IAAI,EAAE,CAAC;YACP;;;;;;;;;;;;;;;;;;cAkBJ;QACA,CAAC;KAAA;CAyMJ;AA9RD,sCA8RC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nsshunt/stsappframework",
-  "version": "2.19.163",
+  "version": "2.19.165",
   "description": "",
   "main": "dist/index.js",
   "types": "./types/index.d.ts",
@@ -29,6 +29,7 @@
     "@types/debug": "^4.1.7",
     "@types/express": "^4.17.17",
     "@types/jest": "^29.5.0",
+    "@types/jsonwebtoken": "^9.0.1",
     "@types/pg": "^8.6.6",
     "@types/uuid": "^9.0.1",
     "@typescript-eslint/eslint-plugin": "^5.58.0",
@@ -54,6 +55,9 @@
     "debug": "^4.3.4",
     "express": "^4.18.2",
     "http-status-codes": "^2.2.0",
+    "jsonwebtoken": "^9.0.0",
+    "jwks-rsa": "^3.0.1",
+    "jwt-decode": "^3.1.2",
     "pidusage": "^3.0.2",
     "prom-client": "^14.2.0",
     "socket.io": "^4.6.1",

package/src/authutilsnode.ts

@@ -1,6 +1,17 @@
 import tough from 'tough-cookie';
+import https from 'https'
+import jwt from 'jsonwebtoken';
+import jwt_decode from 'jwt-decode';
+import jwksClient from 'jwks-rsa';
 
-import { GetErrorPayload } from '@nsshunt/stsutils'
+import axios from 'axios';
+
+import { $Options } from '@nsshunt/stsconfig'
+const goptions = $Options()
+
+import debugModule from 'debug'
+
+import { GetErrorPayload, JSONObject } from '@nsshunt/stsutils'
 
 import { AppFrameworkErrorCode } from './validation/errors'
 
@@ -10,14 +21,50 @@ export interface IAuthUtilsNodeOptions {
     permissions: string[]
 }
 
+export enum STSClientID {
+    STSRest01Service = 'KgSyRECcvnJwwOZqf7GPqUw508sx7VBFEbDC0iP4oeY=',
+    STSAuthService = 'q6a9F0kksXDDcrsCUKRwHKDnTNh7yZfxCShAgIJqfGg=',
+    STSUITerminal = 'U0E4c4cuRKlBsGo7OhOl3qTkoNGFBXjORUS/T4R4xyA=',
+    STSCLI = 'EcCpnQOIQFizAnWphlFJ4tSylosgVnwKTSNtgwuL2tw=',
+    STSUIWebApp = 'lww8Je8n2P0OI/KEfJ+4p/bqsk8uE/noeq13tl4zlQ0=',
+    XXSTSUserAgentRunnerX = 'y1h2nNr1BzTVPIzNmP/f041uxbnyZYTJeF/5GcwRCtw=',
+    STSInstrumentManagerService = 'l8u2E912eR44ZYRHUkSBCCnDOXxQqYOPahDVQzYowrw=',
+    STSTestOrchestratorService = 'CU1sVlS6vsEe3O3VvNzKFdBnQd9pQ83w9RyVx/7tJfc=',
+    STSTestRunnerNode = 'aX9dJbsT06V1G4j06xEIQ/rZ2CDlpzggU58aLtZ8fzE=',
+    STSBrokerService = 'TRppBuvxcjL7jrY9lCASJ5st8JpU8WlhAUAWoX/KKQ4=',
+    STSTestingService = '4Mtb3ABdSzZvSz4T51HPJhT14znVnqVDRFiZsvDNAOg=',
+    XXSTSAuthenticateSPAXX = 'v4qBrds3Autl/i86xT+5z0K53kJ/2hHTfxNo0QO/0Jk=',
+    STSTestRunnerAgentSPA = 'yDbklCH3awzDNuHICuco9mjDqhdzCa8m7w/UE9Opexc=',
+    STSClientApp01SPA = 'FDX/CPyDb3m6d9G2k+wDX8Uvey+yCkllaT4EuEt4QyU=',
+    PowerPlatformCustomConnectorSPA = 'fcdcebb5-d154-4699-b99d-87d29e5e148f'
+}
+
 export class AuthUtilsNode
 {
     #cookiejar: tough.CookieJar;
+    #httpsAgent: https.Agent | null = null;
+    #debug = debugModule(`proc:${process.pid}:AuthUtilsNode`);
 
     constructor() {
         this.#cookiejar = new tough.CookieJar();
     }
 
+    #GetHttpsAgent = () =>
+    {
+        if (this.#httpsAgent === null) {
+            // https://nodejs.org/api/http.html#class-httpagent
+            this.#httpsAgent = new https.Agent({ 
+                keepAlive: goptions.keepAlive,
+                maxSockets: goptions.maxSockets,
+                maxTotalSockets: goptions.maxTotalSockets,
+                maxFreeSockets: goptions.maxFreeSockets,
+                timeout: goptions.timeout,
+                rejectUnauthorized: false
+            });
+        }
+        return this.#httpsAgent;
+    }
+
     VerifyRequestMiddlewareFactory(options: IAuthUtilsNodeOptions) {
         return async function(req: any, res: any, next: any) {
             if (options.permissions) {
@@ -99,6 +146,95 @@ export class AuthUtilsNode
         return this.#cookiejar.getCookies(endpoint);
     };
 
+    ValidateJWT = async (token: string, audience: string, endpoint?: string): Promise<string> => {
+        const jwksClientUri = (endpoint 
+            ? `${endpoint}${goptions.asoauthapiroot}${goptions.asjwksjsonpath}` 
+            : `${goptions.asendpoint}:${goptions.asport}${goptions.asoauthapiroot}${goptions.asjwksjsonpath}`);
+
+        const jwks = jwksClient({
+            cache: true, //@@ all config items
+            cacheMaxEntries: 5, // Default value
+            cacheMaxAge: 600000, // Defaults to 10m
+            rateLimit: true,
+            jwksRequestsPerMinute: 10, // Default value
+            jwksUri: jwksClientUri,
+            timeout: 30000, //@@ config
+            requestAgent: this.#GetHttpsAgent()
+        });
+
+        // Use decode to get the kid
+        const decodedRefreshToken = jwt_decode<JSONObject>(token, { header: true });
+        const kid = decodedRefreshToken.kid;
+
+        const key = await jwks.getSigningKey(kid);
+        const signingKey = key.getPublicKey();
+		
+        const verifyOptions = {
+            issuer:  'https://stsmda.com.au/stsauth/',
+            //subject:  s,
+            audience:  audience,
+            //expiresIn:  600, // 10 minutes
+            algorithm:  ["RS256"]   // RSASSA [ "RS256", "RS384", "RS512" ]
+        };
+
+        return jwt.verify(token, signingKey, verifyOptions) as string;
+    }
+
+    GetAPITokenFromAuthServer = async (clientId: STSClientID, authClientSecret: string, audience: string, endPoint?: string): Promise<string> => {
+        try {
+            const headers = { 'Content-Type': 'application/json'};
+            const payload = { //@@ make a type
+                client_id: clientId, // The service calling this method
+                client_secret: authClientSecret, // Auth service client secret
+                //client_secret: goptions.brokerclientsecret, // Broker service client secret
+                audience: audience, // required API
+                //@@ remove audience
+                //@@ need scope to be the API identifier
+                grant_type: "client_credentials"
+            }
+            const url = (endPoint 
+                ? `${endPoint}${goptions.asoauthapiroot}/token`
+                : `${goptions.asendpoint}:${goptions.asport}${goptions.asoauthapiroot}/token`);
+            const retVal = await axios({
+                url
+                ,method: 'post'
+                ,data: payload
+                ,headers: headers
+                ,httpsAgent: this.#GetHttpsAgent()
+            });
+
+            if (retVal.status) {
+                if (retVal.status !== 200) {
+                    // Just provide a warning here
+                    this.#debug(`Error (AuthUtilsNode:GetAPITokenFromServer): Invalid response from server: [${retVal.status}]`.magenta);
+                }
+            } else {
+                const msg = `Error (AuthUtilsNode:GetAPITokenFromServer:No retVal.status)`.red
+                this.#debug(msg);
+                throw new Error(msg);
+            }
+            if (retVal.data) {
+                if (retVal.data.access_token) {
+                    return retVal.data.access_token as string;
+                } else {
+                    const msg = `Error (AuthUtilsNode:GetAPITokenFromServer:No retVal.data.access_token)`.red
+                    this.#debug(msg);
+                    throw new Error(msg);
+                }
+            } else {
+                const msg = `Error (AuthUtilsNode:GetAPITokenFromServer:No retVal.data)`.red
+                this.#debug(msg);
+                throw new Error(msg);
+            }
+        } catch (error: any) {
+            this.#debug(`Error (AuthUtilsNode:GetAPITokenFromServer:catch): ${error}`.red);
+            if (error.response && error.response.data) {
+                this.#debug(`Details: [${JSON.stringify(error.response.data)}]`.red);
+            }
+            throw error;
+        }
+    }
+
     /*
 	#getHttpsAgent = () =>
 	{

package/types/authutilsnode.d.ts

@@ -2,6 +2,23 @@ import tough from 'tough-cookie';
 export interface IAuthUtilsNodeOptions {
     permissions: string[];
 }
+export declare enum STSClientID {
+    STSRest01Service = "KgSyRECcvnJwwOZqf7GPqUw508sx7VBFEbDC0iP4oeY=",
+    STSAuthService = "q6a9F0kksXDDcrsCUKRwHKDnTNh7yZfxCShAgIJqfGg=",
+    STSUITerminal = "U0E4c4cuRKlBsGo7OhOl3qTkoNGFBXjORUS/T4R4xyA=",
+    STSCLI = "EcCpnQOIQFizAnWphlFJ4tSylosgVnwKTSNtgwuL2tw=",
+    STSUIWebApp = "lww8Je8n2P0OI/KEfJ+4p/bqsk8uE/noeq13tl4zlQ0=",
+    XXSTSUserAgentRunnerX = "y1h2nNr1BzTVPIzNmP/f041uxbnyZYTJeF/5GcwRCtw=",
+    STSInstrumentManagerService = "l8u2E912eR44ZYRHUkSBCCnDOXxQqYOPahDVQzYowrw=",
+    STSTestOrchestratorService = "CU1sVlS6vsEe3O3VvNzKFdBnQd9pQ83w9RyVx/7tJfc=",
+    STSTestRunnerNode = "aX9dJbsT06V1G4j06xEIQ/rZ2CDlpzggU58aLtZ8fzE=",
+    STSBrokerService = "TRppBuvxcjL7jrY9lCASJ5st8JpU8WlhAUAWoX/KKQ4=",
+    STSTestingService = "4Mtb3ABdSzZvSz4T51HPJhT14znVnqVDRFiZsvDNAOg=",
+    XXSTSAuthenticateSPAXX = "v4qBrds3Autl/i86xT+5z0K53kJ/2hHTfxNo0QO/0Jk=",
+    STSTestRunnerAgentSPA = "yDbklCH3awzDNuHICuco9mjDqhdzCa8m7w/UE9Opexc=",
+    STSClientApp01SPA = "FDX/CPyDb3m6d9G2k+wDX8Uvey+yCkllaT4EuEt4QyU=",
+    PowerPlatformCustomConnectorSPA = "fcdcebb5-d154-4699-b99d-87d29e5e148f"
+}
 export declare class AuthUtilsNode {
     #private;
     constructor();
@@ -9,5 +26,7 @@ export declare class AuthUtilsNode {
     verifyRequestMiddleware(req: any, res: any, next: any): Promise<void>;
     SetCookiesToJar: (headers: Record<string, any>, endpoint: string) => Promise<tough.Cookie[]>;
     GetCookiesFromJar: (endpoint: string) => Promise<tough.Cookie[]>;
+    ValidateJWT: (token: string, audience: string, endpoint?: string) => Promise<string>;
+    GetAPITokenFromAuthServer: (clientId: STSClientID, authClientSecret: string, audience: string, endPoint?: string) => Promise<string>;
 }
 //# sourceMappingURL=authutilsnode.d.ts.map

package/types/authutilsnode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authutilsnode.d.ts","sourceRoot":"","sources":["../src/authutilsnode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,cAAc,CAAC;AAQjC,MAAM,WAAW,qBAAqB;IAClC,WAAW,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,qBAAa,aAAa;;;IAQtB,8BAA8B,CAAC,OAAO,EAAE,qBAAqB,SAC9B,GAAG,OAAO,GAAG,QAAQ,GAAG;IAoCjD,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAwB3D,eAAe,YAAmB,OAAO,MAAM,EAAE,GAAG,CAAC,YAAY,MAAM,KAAG,QAAQ,MAAM,MAAM,EAAE,CAAC,CAa/F;IAEF,iBAAiB,aAAoB,MAAM,KAAG,QAAQ,MAAM,MAAM,EAAE,CAAC,CAGnE;CA4FL"}
+{"version":3,"file":"authutilsnode.d.ts","sourceRoot":"","sources":["../src/authutilsnode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,cAAc,CAAC;AAmBjC,MAAM,WAAW,qBAAqB;IAClC,WAAW,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,oBAAY,WAAW;IACnB,gBAAgB,iDAAiD;IACjE,cAAc,iDAAiD;IAC/D,aAAa,iDAAiD;IAC9D,MAAM,iDAAiD;IACvD,WAAW,iDAAiD;IAC5D,qBAAqB,iDAAiD;IACtE,2BAA2B,iDAAiD;IAC5E,0BAA0B,iDAAiD;IAC3E,iBAAiB,iDAAiD;IAClE,gBAAgB,iDAAiD;IACjE,iBAAiB,iDAAiD;IAClE,sBAAsB,iDAAiD;IACvE,qBAAqB,iDAAiD;IACtE,iBAAiB,iDAAiD;IAClE,+BAA+B,yCAAyC;CAC3E;AAED,qBAAa,aAAa;;;IA0BtB,8BAA8B,CAAC,OAAO,EAAE,qBAAqB,SAC9B,GAAG,OAAO,GAAG,QAAQ,GAAG;IAoCjD,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;IAwB3D,eAAe,YAAmB,OAAO,MAAM,EAAE,GAAG,CAAC,YAAY,MAAM,KAAG,QAAQ,MAAM,MAAM,EAAE,CAAC,CAa/F;IAEF,iBAAiB,aAAoB,MAAM,KAAG,QAAQ,MAAM,MAAM,EAAE,CAAC,CAGnE;IAEF,WAAW,UAAiB,MAAM,YAAY,MAAM,aAAa,MAAM,KAAG,QAAQ,MAAM,CAAC,CAgCxF;IAED,yBAAyB,aAAoB,WAAW,oBAAoB,MAAM,YAAY,MAAM,aAAa,MAAM,KAAG,QAAQ,MAAM,CAAC,CAqDxI;CA4FJ"}