@openstax/ts-utils 1.1.33 → 1.1.34

package/dist/esm/services/authProvider/decryption.d.ts

@@ -1,5 +1,5 @@
 import type { ConfigProviderForConfig } from '../../config';
-import { CookieAuthProvider } from '.';
+import { CookieAuthProvider, User } from '.';
 declare type Config = {
     cookieName: string;
     encryptionPrivateKey: string;
@@ -8,6 +8,9 @@ declare type Config = {
 interface Initializer<C> {
     configSpace?: C;
 }
+export declare type Jwt = {
+    sub?: User;
+};
 export declare const decryptionAuthProvider: <C extends string = "decryption">(initializer: Initializer<C>) => (configProvider: { [key in C]: {
     cookieName: import("../../config").ConfigValueProvider<string>;
     encryptionPrivateKey: import("../../config").ConfigValueProvider<string>;

package/dist/esm/services/authProvider/decryption.js

@@ -1,26 +1,13 @@
-import { compactDecrypt, compactVerify, importSPKI } from 'jose';
 import { resolveConfigValue } from '../../config/resolveConfigValue';
 import { ifDefined } from '../../guards';
 import { once } from '../../misc/helpers';
+import { decryptAndVerify } from './utils/decryptAndVerify';
 import { getAuthTokenOrCookie } from '.';
 export const decryptionAuthProvider = (initializer) => (configProvider) => {
     const config = configProvider[ifDefined(initializer.configSpace, 'decryption')];
     const cookieName = once(() => resolveConfigValue(config.cookieName));
     const encryptionPrivateKey = once(() => resolveConfigValue(config.encryptionPrivateKey));
     const signaturePublicKey = once(() => resolveConfigValue(config.signaturePublicKey));
-    const decryptAndVerify = async (jwt) => {
-        try {
-            // Decrypt SSO cookie
-            const { plaintext } = await compactDecrypt(jwt, Buffer.from(await encryptionPrivateKey()), // Note: Buffer.from() is node-js only
-            { contentEncryptionAlgorithms: ['A256GCM'], keyManagementAlgorithms: ['dir'] });
-            // Verify SSO cookie signature
-            const { payload } = await compactVerify(plaintext, await importSPKI(await signaturePublicKey(), 'RS256'), { algorithms: ['RS256'] });
-            return payload;
-        }
-        catch {
-            return undefined;
-        }
-    };
     return ({ request, profile }) => {
         let user;
         const getAuthorizedFetchConfig = profile.track('getAuthorizedFetchConfig', () => async () => {
@@ -35,18 +22,7 @@ export const decryptionAuthProvider = (initializer) => (configProvider) => {
             if (!token) {
                 return undefined;
             }
-            const payload = await decryptAndVerify(token);
-            if (!payload) {
-                return undefined;
-            }
-            // Note: Uint8Array.toString() returns text in node-js only
-            //       The browser version is new TextDecoder().decode(payload)
-            const jwt = JSON.parse(payload.toString());
-            // Allow clock skew up to 5 minutes
-            if (!jwt.sub || !jwt.sub.uuid || (jwt.exp && jwt.exp < Math.floor(Date.now() / 1000) - 300)) {
-                return undefined;
-            }
-            return jwt.sub;
+            return decryptAndVerify(token, await encryptionPrivateKey(), await signaturePublicKey());
         });
         return {
             getAuthorizedFetchConfig,

package/dist/esm/services/authProvider/utils/decryptAndVerify.d.ts

@@ -0,0 +1,2 @@
+import { User } from '..';
+export declare const decryptAndVerify: (token: string, encryptionPrivateKey: string, signaturePublicKey: string) => User | undefined;

package/dist/esm/services/authProvider/utils/decryptAndVerify.js

@@ -0,0 +1,36 @@
+import * as crypto from 'crypto';
+import { TextEncoder } from 'util';
+import jwt from 'jsonwebtoken';
+import { isPlainObject } from '../../../guards';
+const decrypt = (input, key) => {
+    const splitInput = input.split('.');
+    const aad = new TextEncoder().encode(splitInput[0]);
+    const iv = Buffer.from(splitInput[2], 'base64');
+    const ciphertext = Buffer.from(splitInput[3], 'base64');
+    const tag = Buffer.from(splitInput[4], 'base64');
+    const decipher = crypto.createDecipheriv('aes-256-gcm', Buffer.from(key), iv, { authTagLength: 16 });
+    decipher.setAAD(aad, { plaintextLength: ciphertext.length });
+    decipher.setAuthTag(tag);
+    const result = Buffer.concat([
+        decipher.update(ciphertext),
+        decipher.final(),
+    ]);
+    return result.toString('utf-8');
+};
+export const decryptAndVerify = (token, encryptionPrivateKey, signaturePublicKey) => {
+    try {
+        // Decrypt SSO cookie
+        const plaintext = decrypt(token, encryptionPrivateKey);
+        const payload = jwt.verify(plaintext, signaturePublicKey, {
+            clockTolerance: 300 // 5 minutes 
+        });
+        if (!isPlainObject(payload) || !isPlainObject(payload.sub) || !payload.sub.uuid) {
+            return undefined;
+        }
+        // TS is confused because the library types the `sub` as a string
+        return payload.sub;
+    }
+    catch {
+        return undefined;
+    }
+};