@opendatalabs/service-auth 1.0.0-next.9 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -15,6 +15,8 @@
|
|
|
15
15
|
*
|
|
16
16
|
* - RFC 9068 access token shape. We do NOT invent Vana-specific
|
|
17
17
|
* claim names; we read `aud`, `iss`, `client_id`, `scope`, `sub`.
|
|
18
|
+
* Hydra deployments may emit scopes as `scp`; accept that as the
|
|
19
|
+
* issuer-specific projection of the same OAuth scope set.
|
|
18
20
|
* - Algorithm allowlist defaults to `["RS256", "ES256"]`. Hydra's
|
|
19
21
|
* defaults are `ES256` for access tokens; allowing both lets
|
|
20
22
|
* services bring their own key shape without our code knowing.
|
|
@@ -42,6 +44,7 @@ export type AccessTokenValidationResult = {
|
|
|
42
44
|
valid: true;
|
|
43
45
|
claims: JWTPayload & {
|
|
44
46
|
client_id?: string;
|
|
47
|
+
scp?: string | string[];
|
|
45
48
|
sub?: string;
|
|
46
49
|
scope?: string;
|
|
47
50
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resource-server/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/resource-server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,UAAU,EAEhB,MAAM,MAAM,CAAC;AAId,MAAM,MAAM,2BAA2B,GACnC,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,WAAW,2BAA2B;IAC1C,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,iBAAiB,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAClD,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,2BAA2B,GACnC;IACE,KAAK,EAAE,IAAI,CAAC;IACZ,MAAM,EAAE,UAAU,GAAG;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EACF,YAAY,GACZ,WAAW,GACX,SAAS,GACT,cAAc,GACd,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,gBAAgB,GAChB,oBAAoB,GACpB,cAAc,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,CACjB,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9C,KAAK,CAAC,EAAE,wBAAwB,GAC/B,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxC,UAAU,CACR,KAAK,CAAC,EAAE,wBAAwB,GAC/B,CACD,OAAO,EAAE,OAAO,KACb,OAAO,CACV;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC,2BAA2B,EAAE;YAAE,KAAK,EAAE,IAAI,CAAA;SAAE,CAAC,CAAA;KAAE,GACzE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CACpC,CAAC;CACH;AAmBD,sDAAsD;AACtD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAyCD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,2BAA2B,GACnC,oBAAoB,CAyFtB"}
|
|
@@ -15,6 +15,8 @@
|
|
|
15
15
|
*
|
|
16
16
|
* - RFC 9068 access token shape. We do NOT invent Vana-specific
|
|
17
17
|
* claim names; we read `aud`, `iss`, `client_id`, `scope`, `sub`.
|
|
18
|
+
* Hydra deployments may emit scopes as `scp`; accept that as the
|
|
19
|
+
* issuer-specific projection of the same OAuth scope set.
|
|
18
20
|
* - Algorithm allowlist defaults to `["RS256", "ES256"]`. Hydra's
|
|
19
21
|
* defaults are `ES256` for access tokens; allowing both lets
|
|
20
22
|
* services bring their own key shape without our code knowing.
|
|
@@ -66,9 +68,13 @@ function audienceIncludes(claim, expected) {
|
|
|
66
68
|
function scopeIncludes(claim, required) {
|
|
67
69
|
if (required.length === 0)
|
|
68
70
|
return true;
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
71
|
+
let present = null;
|
|
72
|
+
if (typeof claim === "string") {
|
|
73
|
+
present = new Set(claim.split(/\s+/).filter(Boolean));
|
|
74
|
+
}
|
|
75
|
+
else if (Array.isArray(claim)) {
|
|
76
|
+
present = new Set(claim.filter((scope) => typeof scope === "string"));
|
|
77
|
+
}
|
|
72
78
|
if (!present)
|
|
73
79
|
return false;
|
|
74
80
|
for (const r of required) {
|
|
@@ -112,7 +118,7 @@ export function createServiceAuthValidator(options) {
|
|
|
112
118
|
if (!audienceIncludes(payload.aud, options.audience)) {
|
|
113
119
|
return { valid: false, reason: "wrong_audience" };
|
|
114
120
|
}
|
|
115
|
-
if (!scopeIncludes(payload.scope, input?.requiredScopes ?? [])) {
|
|
121
|
+
if (!scopeIncludes(payload.scope ?? payload.scp, input?.requiredScopes ?? [])) {
|
|
116
122
|
return { valid: false, reason: "insufficient_scope" };
|
|
117
123
|
}
|
|
118
124
|
let clientId = null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resource-server/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resource-server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,IAAI,UAAU,EAGpB,SAAS,GACV,MAAM,MAAM,CAAC;AAEd,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AA2E/D,sEAAsE;AACtE,sEAAsE;AACtE,0CAA0C;AAC1C,MAAM,eAAe,GAAG,IAAI,GAAG,EAG5B,CAAC;AAEJ,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,uBAAuB;IACrC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,aAAa,CAAC,MAAiC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,QAAgB;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,QAAQ,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,QAAkB;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,GAAuB,IAAI,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,IAAI,GAAG,CACf,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAoC;IAEpC,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,iBAAiB;QAClD,0BAA0B,CAAsB,CAAC;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI;QAC9B,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,OAAiB,CAAC,CAAC;IAE7C,KAAK,UAAU,mBAAmB,CAChC,MAAiC,EACjC,KAAgC;QAEhC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAE3E,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE;gBACvD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,iBAA6B;gBACzC,cAAc;aACf,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACpD,CAAC;QAED,IACE,CAAC,aAAa,CACZ,OAAO,CAAC,KAAK,IAAK,OAA6B,CAAC,GAAG,EACnD,KAAK,EAAE,cAAc,IAAI,EAAE,CAC5B,EACD,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACxD,CAAC;QAED,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC1C,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QAC/B,CAAC;aAAM,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,oBAAoB;aAC7B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,OAKP;YACD,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,SAAS,UAAU,CAAC,KAAgC;QAClD,OAAO,KAAK,EAAE,OAAgB,EAAE,EAAE;YAChC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EACpC,KAAK,CACN,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,CAAC;YACvC,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAc;gBAClB,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC;aAC3C,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,GAAG,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,CAAC,8BAA8B,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,CAAC,iBAAiB,EAAE,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACvD,MAAM,KAAK,GAAI,GAA0B,CAAC,KAAK,CAAC;QAChD,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACrE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,SAAS,KAAK,IAAI,SAAS,EAAE;SACtC,CAAC;IACJ,CAAC;IACD,IACE,GAAG,YAAY,UAAU,CAAC,UAAU;QACpC,GAAG,YAAY,UAAU,CAAC,UAAU,EACpC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAwE;IAExE,4DAA4D;IAC5D,uDAAuD;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,MAAM,KAAK,GACT,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,MAAM,KAAK,oBAAoB;YAC/B,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,eAAe,CAAC;IACxB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EACjC;QACE,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,iBAAiB,KAAK,GAAG;SAC9C;KACF,CACF,CAAC;AACJ,CAAC"}
|