@openstax/ts-utils 1.33.1 → 1.34.0

package/packages/utils/src/services/fileServer/s3FileServer.ts

@@ -0,0 +1,155 @@
+/* cspell:ignore presigner */
+import path from 'path';
+import { CopyObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { v4 as uuid } from 'uuid';
+import { once } from '../..';
+import { assertDefined } from '../../assertions';
+import { ConfigProviderForConfig, resolveConfigValue } from '../../config';
+import { ifDefined } from '../../guards';
+import { FileServerAdapter, FileValue } from '.';
+
+export type Config = {
+  bucketName: string;
+  bucketRegion: string;
+  // optional, if not provided attempting to get a public URL will throw an error
+  publicViewerDomain?: string;
+};
+interface Initializer<C> {
+  configSpace?: C;
+  getS3Client?: (...args: ConstructorParameters<typeof S3Client>) => S3Client;
+}
+
+export const s3FileServer = <C extends string = 'deployed'>(initializer: Initializer<C>) => (configProvider: {[_key in C]: ConfigProviderForConfig<Config>}): FileServerAdapter => {
+  const config = configProvider[ifDefined(initializer.configSpace, 'deployed' as C)];
+  const bucketName = once(() => resolveConfigValue(config.bucketName));
+  const bucketRegion = once(() => resolveConfigValue(config.bucketRegion));
+  const publicViewerDomain = once(() => 'publicViewerDomain' in config && config.publicViewerDomain
+    ? resolveConfigValue(config.publicViewerDomain)
+    : undefined
+  );
+  const s3Service = once(async () => {
+    const args = {apiVersion: '2012-08-10', region: await bucketRegion()};
+    return initializer.getS3Client?.(args) ?? new S3Client(args);
+  });
+
+  /*
+   * https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html
+   */
+  const getSignedViewerUrl = async (source: FileValue) => {
+    const bucket = (await bucketName());
+    const command = new GetObjectCommand({Bucket: bucket, Key: source.path});
+    return getSignedUrl(await s3Service(), command, {
+      expiresIn: 3600, // 1 hour
+    });
+  };
+  const getPublicViewerUrl = async (source: FileValue) => {
+    const host = assertDefined(await publicViewerDomain(),
+      new Error(`Tried to get public viewer URL for ${source.path} but no publicViewerDomain configured`)
+    );
+    return `https://${host}/${source.path}`;
+  };
+  const getFileContent = async (source: FileValue) => {
+    const bucket = await bucketName();
+    const command = new GetObjectCommand({Bucket: bucket, Key: source.path});
+    const response = await (await s3Service()).send(command);
+
+    return Buffer.from(await assertDefined(response.Body, new Error('Invalid Response from s3')).transformToByteArray());
+  };
+  const putFileContent = async (source: FileValue, content: string) => {
+    const bucket = await bucketName();
+    const command = new PutObjectCommand({
+      Bucket: bucket,
+      Key: source.path,
+      Body: content,
+      ContentType: source.mimeType,
+    });
+    await (await s3Service()).send(command);
+    return source;
+  };
+
+  /*
+   * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/modules/_aws_sdk_s3_presigned_post.html
+   * https://docs.aws.amazon.com/AmazonS3/latest/userguide/HTTPPOSTExamples.html
+   * https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-post-example.html
+   */
+  const getSignedFileUploadConfig = async() => {
+    const prefix = 'uploads/' + uuid();
+    const bucket = (await bucketName());
+
+    const Conditions = [
+      { acl: 'private' },
+      { bucket } as {bucket: string},
+      ['starts-with', '$key', prefix] as ['starts-with', string, string]
+    ];
+
+    const defaultFields = {
+      acl: 'private',
+    };
+    const { url, fields } = await createPresignedPost(await s3Service(), {
+      Bucket: bucket,
+      Key: prefix + '/${filename}',
+      Conditions,
+      Fields: defaultFields,
+      Expires: 3600, // 1 hour
+    });
+
+    return {
+      url, payload: fields
+    };
+  };
+
+  const copyFileTo = async (source: FileValue, destinationPath: string) => {
+    const bucket = (await bucketName());
+    const destinationPathWithoutLeadingSlash = destinationPath.replace(/^\//, '');
+
+    const command = new CopyObjectCommand({
+      Bucket: bucket,
+      Key: destinationPathWithoutLeadingSlash,
+      CopySource: path.join(bucket, source.path),
+    });
+    await (await s3Service()).send(command);
+
+    return {
+      ...source,
+      path: destinationPathWithoutLeadingSlash
+    };
+  };
+
+  const copyFileToDirectory = async (source: FileValue, destination: string) => {
+    const destinationPath = path.join(destination, source.label);
+    return copyFileTo(source, destinationPath);
+  };
+
+  const isTemporaryUpload = (source: FileValue) => {
+    return source.path.indexOf('uploads/') === 0;
+  };
+
+  const getFileChecksum = async (source: FileValue) => {
+    const bucket = (await bucketName());
+    const command = new HeadObjectCommand({Bucket: bucket, Key: source.path});
+    const response = await (await s3Service()).send(command);
+    return assertDefined(response.ETag);
+  };
+
+  const filesEqual = async (sourceA: FileValue, sourceB: FileValue) => {
+    const [aSum, bSum] = await Promise.all(
+      [getFileChecksum(sourceA), getFileChecksum(sourceB)]
+    );
+    return aSum === bSum;
+  };
+
+  return {
+    getFileContent,
+    putFileContent,
+    getSignedViewerUrl,
+    getPublicViewerUrl,
+    getSignedFileUploadConfig,
+    copyFileTo,
+    copyFileToDirectory,
+    isTemporaryUpload,
+    getFileChecksum,
+    filesEqual,
+  };
+};

package/packages/utils/src/services/launchParams/index.spec.ts

@@ -0,0 +1,366 @@
+/* spell-checker: ignore Xgub Jpbmci Blbn Imlzcy XVCIs */
+import jwt from 'jsonwebtoken';
+import { JwksClient } from 'jwks-rsa';
+import ms from 'ms';
+import { z } from 'zod';
+import { SessionExpiredError } from '../../errors';
+import { createLaunchSigner, createLaunchVerifier } from '.';
+
+const alg = 'RS256' as const;
+const expiresIn = '1m';
+const iss = 'https://openstax.org';
+// privateKey generated for testing only
+const privateKey = `-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDdyPcrfMDym/eS
+jFEddXdbVh5PhvcikruXvzyJ/Ehocd0lgV/OMaSvdSqbmw1lJvC7NwuuhnslxwoD
+0zHaUq+XR6dkaw09wPG4jzj76FByKyvFOKB8E+z3ARFDZkiRK6rdVTVnVwFG0TCl
+Zwdb6FSX8DL8qOqRIDzxuXBmp02Y79srcarYpaHKwwOBt8Fjs8XSADj6OR+/abXP
+5cAwtqM/P18efcSfGVqoraJMSNh7tJGTdOMiSrSY8n/F7xJytZf7YeVoppjIdjvG
+TyHf3R3vg6xFJP63ISE1fdz8gDHR/Ix6kmWQN+t83/uYcxmcmA5CgszJXtKNxKAy
+WtucJhj7AgMBAAECggEAWNKuov0ArWlneoq1xc2QssTHuOP9wBvyA3E0hrLCMQpB
+Hk81FnhtU1Pib5VmhPdWfDQseoYjddrEGQoRMjXhWv34fVAeangGlvrNQJ4m8cJ2
+cjMemvLD+Zy01EB3maRadvA0RiHjQgBvsh6UJOvkTUGGugfQgbTek5TH/mTMwA24
+02DsewnNk5UnLkUsh5tDeJkq9UhI2sSdkLkUoUAyZYXdUF0RRxotPK9IIorA22Vu
+Hw/WQ3Sr8RDyNDW0eVsmvh2jWj+vTKndqvryNqqHztpxeXh3BC9/flZjLZPgAFZ9
+NVnB3nj2a3A9kqz/gu/jyK1DoC9e7a8xnetp1KxK+QKBgQD07n9yBmSh06kL71Sn
+8YXD5BGKWCLW+w5GM2EqzwtwXy5TGP6A6ctQESQycYEer9P0PfOG8/T4eHe0xleB
+OEVM/k+FfaxHuY3FU09gb0X04jKZnE3D9gNEzJfuejb12RLJkbFPGpzmrOSy+rgb
+Kw9LUmppk3tkNE9aTGR+Wyj+5wKBgQDnzrHyorFuomebcih5HEXfozHg2XmLUwlW
+ajF9c/VPKcLuzDsK0v10ZjLY30mR9i9tcwURb+YGMo3RxAxAXwcUvKzsi32fYpnn
+oVn2vJeauasTL+NjKp/8SSlVQykyuVNHc5WD+CrfyMRuDQWitmZVmH0oX38xejML
+OttDAaD2zQKBgQDieRySnGK0V3f5tyR53ZMoHFwzpWchjSYXty5jXOpgz0GQSI4b
+ORJrSE5F7jnL3ByJvDbPVAfxL8LP/o2uyA8cMBHrhtajw2jZSj0dGAaBdh3/d01Y
+osNG/D6Hna3wCPWcOADQ+fSWPsuAyt8tD9WmeeA3Gs1/S/cLsZNCWpw/hQKBgQDi
+MbE2gEb/G/5ZksWnmE0ecpJjRBL0PuynpCvyrMo8mxWaCzO51jR39pm7Qfb6NO4G
+sOvLHhOpDH+SpukFjzTLqWhb0amdc4uWmL2+pDyTQIWMzXfm9lryxTlN96El2+1F
+laXaBrlfcPssIAzVv4KQF6JZWQY2c3WHicEW22oEKQKBgHt6n+j0ZO+Quq7k7FNr
+6RAKDmAURh/+rPc3o357inI9u5oxktXvxI41ijHXTQRKrakAmiSYikPQOb/aOgjO
+PNpj6gag4Srw7QkLI8ttl0yUCP155dxvnrK8Dd/t+oTsKTCR0EINSUUM8omDnHCL
+5kaLB/QpHAKj0pF54unD8VzI
+-----END PRIVATE KEY-----`;
+
+const signerConfig = {
+  test: {
+    alg,
+    expiresIn,
+    iss,
+    privateKey,
+  }
+};
+
+const launchSigner = createLaunchSigner({ configSpace: 'test' })(signerConfig);
+
+describe('launchSigner', () => {
+  describe('jwks', () => {
+    it('outputs the public part of the key', async() => {
+      // cspell:disable
+      expect(await launchSigner.jwks()).toMatchInlineSnapshot(`
+{
+  "keys": [
+    {
+      "e": "AQAB",
+      "kid": "wKgbD-KbvgA_GIKnggurrTGH_tGYVI8cDU01BuM6zC8",
+      "kty": "RSA",
+      "n": "3cj3K3zA8pv3koxRHXV3W1YeT4b3IpK7l788ifxIaHHdJYFfzjGkr3Uqm5sNZSbwuzcLroZ7JccKA9Mx2lKvl0enZGsNPcDxuI84--hQcisrxTigfBPs9wERQ2ZIkSuq3VU1Z1cBRtEwpWcHW-hUl_Ay_KjqkSA88blwZqdNmO_bK3Gq2KWhysMDgbfBY7PF0gA4-jkfv2m1z-XAMLajPz9fHn3EnxlaqK2iTEjYe7SRk3TjIkq0mPJ_xe8ScrWX-2HlaKaYyHY7xk8h390d74OsRST-tyEhNX3c_IAx0fyMepJlkDfrfN_7mHMZnJgOQoLMyV7SjcSgMlrbnCYY-w",
+    },
+  ],
+}
+`);
+      // cspell:enable
+    });
+  });
+
+  describe('sign', () => {
+    let publicKey: string;
+
+    beforeEach(async() => {
+      const jwksUri = 'https://localhost/test';
+      const fetcher = (uri: string) => {
+        if (uri !== jwksUri) { throw new Error(`Unexpected URI: "${uri}"`); }
+        return launchSigner.jwks();
+      };
+      const jwksClient = new JwksClient({ fetcher, jwksUri });
+      const key = await jwksClient.getSigningKey();
+      publicKey = key.getPublicKey();
+    });
+
+    it('returns a signed token', async() => {
+      const token = await launchSigner.sign({}, 'userId');
+      const { header, payload } = jwt.verify(token, publicKey, { complete: true });
+      if (typeof payload !== 'object') { throw new Error('Unexpected string payload'); }
+
+      expect(header.alg).toBe(alg);
+      expect(header.typ).toBe('JWT');
+
+      expect(payload.exp).toBeLessThanOrEqual(Math.floor(Date.now() / 1000) + 60);
+      expect(payload.sub).toBe('userId');
+    });
+
+    it('can set token duration using a unix timestamp', async() => {
+      const maxExp = Math.floor(Date.now() / 1000) + 30;
+      const token = await launchSigner.sign({}, 'userId', maxExp);
+      const { payload } = jwt.verify(token, publicKey, { complete: true });
+      if (typeof payload !== 'object') { throw new Error('Unexpected string payload'); }
+      expect(payload.exp).toBeLessThanOrEqual(maxExp);
+      expect(payload.exp).toBeGreaterThanOrEqual(maxExp - 5);
+    });
+
+    it('cannot exceed the configured max token duration', async() => {
+      const now = Math.floor(Date.now()/1000);
+      const maxExp = now + 86400; // 1 day
+      const actualMax = now + Math.floor(ms(expiresIn)/1000);
+      const token = await launchSigner.sign({}, 'userId', maxExp);
+      const { payload } = jwt.verify(token, publicKey, { complete: true });
+      if (typeof payload !== 'object') { throw new Error('Unexpected string payload'); }
+      expect(payload.exp).toBeLessThanOrEqual(actualMax);
+      expect(payload.exp).toBeGreaterThanOrEqual(actualMax - 5);
+    });
+
+    it('throws when alg is invalid', () => {
+      const invalidLaunchSigner = createLaunchSigner({ configSpace: 'test' })({ test: { ...signerConfig.test, alg: 'none' } });
+      return expect(invalidLaunchSigner.sign({}, 'userId')).rejects.toThrow('"none" is not a valid algorithm');
+    });
+  });
+});
+
+describe('launchVerifier', () => {
+  const verifierConfig = {
+    test: {
+      trustedDomain: 'openstax.org',
+      bypassSignatureVerification: 'false',
+    }
+  };
+
+  const fetcher = (uri: string) => {
+    if (uri !== new URL('/.well-known/jwks.json', iss).toString()) { throw new Error(`Unexpected URI: "${uri}"`); }
+    return launchSigner.jwks();
+  };
+
+  const services = {};
+  const launchVerifier = createLaunchVerifier({ configSpace: 'test', fetcher })(verifierConfig);
+
+  describe('with legacy format token', () => {
+    it('can verify string value tokens signed by the launchSigner reading value from .sub', async() => {
+      const token = await launchSigner.sign({}, 'testSuccessful=true');
+      expect((await launchVerifier(services).verify(token)).sub).toMatchInlineSnapshot('"testSuccessful=true"');
+    });
+
+    it('can verify json value tokens signed by the launchSigner reading value from .sub', async() => {
+      const token = await launchSigner.sign({}, '{"testSuccessful":true}');
+      expect((await launchVerifier(services).verify(token)).sub).toMatchInlineSnapshot('"{"testSuccessful":true}"');
+    });
+
+    it('can verify json value tokens signed by the launchSigner reading value from token', async() => {
+      const token = await launchSigner.sign({}, '{"testSuccessful":true}');
+      expect((await launchVerifier(services).verify(token)).testSuccessful).toMatchInlineSnapshot('true');
+    });
+
+    it('can verify extended claim tokens signed by the launchSigner reading value from token', async() => {
+      const token = await launchSigner.sign({testSuccessful:true}, 'userId');
+      expect((await launchVerifier(services).verify(token)).testSuccessful).toMatchInlineSnapshot('true');
+    });
+
+    describe('with a validator', () => {
+      it('can use a default token', async() => {
+        const token = await launchSigner.sign({}, 'userId');
+        const validator = z.object({sub: z.string()});
+        expect((await launchVerifier(services, () => token).verify(validator.parse)).sub).toBe('userId');
+      });
+
+      it('throws with no token provided', async() => {
+        const validator = z.object({sub: z.string()});
+        await expect(() => launchVerifier(services).verify(validator.parse)).rejects
+          .toThrowErrorMatchingInlineSnapshot('"Missing token for launch verification"')
+        ;
+      });
+
+      it('can verify string value tokens signed by the launchSigner reading value from .sub', async() => {
+        const token = await launchSigner.sign({}, 'testSuccessful=true');
+        const validator = z.object({sub: z.string()});
+        expect((await launchVerifier(services).verify(token, validator.parse)).sub).toMatchInlineSnapshot('"testSuccessful=true"');
+      });
+
+      it('can verify json value tokens signed by the launchSigner reading value from .sub', async() => {
+        const token = await launchSigner.sign({}, '{"testSuccessful":true}');
+        const validator = z.object({sub: z.string()});
+        expect((await launchVerifier(services).verify(token, validator.parse)).sub).toMatchInlineSnapshot('"{"testSuccessful":true}"');
+      });
+
+      it('can verify json value tokens signed by the launchSigner reading extracted value', async() => {
+        const token = await launchSigner.sign({}, '{"testSuccessful":true}');
+        const validator = z.object({testSuccessful: z.boolean()});
+        expect((await launchVerifier(services).verify(token, validator.parse)).testSuccessful).toMatchInlineSnapshot('true');
+      });
+
+      it('can verify extended claim tokens signed by the launchSigner reading extracted value', async() => {
+        const token = await launchSigner.sign({testSuccessful:true}, 'userId');
+        const validator = z.object({testSuccessful: z.boolean()});
+        expect((await launchVerifier(services).verify(token, validator.parse)).testSuccessful).toMatchInlineSnapshot('true');
+      });
+
+      it('strips unknown claims from result', async() => {
+        const token = await launchSigner.sign({}, '{"testSuccessful":true,"unknown":"value"}');
+        const validator = z.object({sub: z.string(), iss: z.string(), testSuccessful: z.boolean()});
+        expect(await launchVerifier(services).verify(token, validator.parse)).toMatchInlineSnapshot(`
+{
+  "iss": "https://openstax.org",
+  "sub": "{"testSuccessful":true,"unknown":"value"}",
+  "testSuccessful": true,
+}
+`);
+      });
+
+      it('throws on invalid token parameters', async() => {
+        const token = await launchSigner.sign({}, '{"testSuccessful":true}');
+        const validator = z.object({testSuccessfullyBad: z.boolean()});
+        await expect(() => launchVerifier(services).verify(token, validator.parse)).rejects.toThrowErrorMatchingInlineSnapshot(`
+"error in secret or public key callback: [
+  {
+    "expected": "boolean",
+    "code": "invalid_type",
+    "path": [
+      "testSuccessfullyBad"
+    ],
+    "message": "Invalid input: expected boolean, received undefined"
+  }
+]"
+`);
+      });
+    });
+  });
+
+  it('throws when the token is invalid', () => {
+    const token = 'R4ND0M';
+    return expect(launchVerifier(services).verify(token)).rejects.toThrow('jwt malformed');
+  });
+
+  it('throws when the token header is missing the iss claim', () => {
+    const token = jwt.sign({}, privateKey, { algorithm: alg, expiresIn, issuer: iss });
+    return expect(launchVerifier(services).verify(token)).rejects.toThrow('error in secret or public key callback: JWT header missing iss claim');
+  });
+
+  it('throws when the token is expired', () => {
+    const header = { alg, iss };
+    const token = jwt.sign({}, privateKey, { algorithm: alg, expiresIn: -1, header });
+    return expect(launchVerifier(services).verify(token)).rejects.toThrow(SessionExpiredError);
+  });
+
+  it('throws when the token iss is an invalid URL', () => {
+    const issuer = 'openstax.org';
+    const header = { alg, iss: issuer };
+    const token = jwt.sign({}, privateKey, { algorithm: alg, expiresIn, header, issuer });
+    return expect(launchVerifier(services).verify(token)).rejects.toThrow('error in secret or public key callback: Invalid URL');
+  });
+
+  it('throws when the token iss is untrusted', () => {
+    const issuer = 'https://example.com';
+    const header = { alg, iss: issuer };
+    const token = jwt.sign({}, privateKey, { algorithm: alg, expiresIn, header, issuer });
+    return expect(launchVerifier(services).verify(token)).rejects.toThrow(
+      'error in secret or public key callback: Untrusted launch domain: "example.com"'
+    );
+  });
+
+  it('throws when the token payload is a string', () => {
+    const header = { alg, iss };
+    const token = jwt.sign('testSuccessful=true', privateKey, { header });
+    return expect(launchVerifier(services).verify(token)).rejects.toThrow('received JWT token with unexpected non-JSON payload');
+  });
+
+  it('throws when the token payload is missing the sub claim', () => {
+    const header = { alg, iss };
+    const token = jwt.sign({}, privateKey, { expiresIn, header, issuer: iss });
+    return expect(launchVerifier(services).verify(token)).rejects.toThrow('JWT payload missing sub claim');
+  });
+
+  describe('with bypassSignatureVerification enabled', () => {
+    const bypassVerifierConfig = {
+      test: {
+        trustedDomain: 'openstax.org',
+        bypassSignatureVerification: 'true',
+      }
+    };
+
+    const bypassLaunchVerifier = createLaunchVerifier({ configSpace: 'test', fetcher })(bypassVerifierConfig);
+
+    it('can verify tokens without signature verification', async() => {
+      const token = await launchSigner.sign({}, 'testSuccessful=true');
+      expect((await bypassLaunchVerifier(services).verify(token)).sub).toMatchInlineSnapshot('"testSuccessful=true"');
+    });
+
+    it('can verify json value tokens reading value from token', async() => {
+      const token = await launchSigner.sign({}, '{"testSuccessful":true}');
+      expect((await bypassLaunchVerifier(services).verify(token)).testSuccessful).toMatchInlineSnapshot('true');
+    });
+
+    it('can verify extended claim tokens reading value from token', async() => {
+      const token = await launchSigner.sign({testSuccessful:true}, 'userId');
+      expect((await bypassLaunchVerifier(services).verify(token)).testSuccessful).toMatchInlineSnapshot('true');
+    });
+
+    it('can verify tokens with invalid signatures when bypass is enabled', async() => {
+      // Create a malformed token that would normally fail signature verification
+      // but should succeed when bypass is enabled
+      const validToken = await launchSigner.sign({testSuccessful: true}, 'userId');
+      const [header, payload] = validToken.split('.');
+      const invalidToken = `${header}.${payload}.invalid_signature`;
+
+      expect((await bypassLaunchVerifier(services).verify(invalidToken)).testSuccessful).toBe(true);
+    });
+
+    it('can verify expired tokens when bypass is enabled', async() => {
+      const expiredToken = jwt.sign({testSuccessful: true}, privateKey, {
+        algorithm: alg,
+        expiresIn: -1,
+        subject: 'userId',
+        issuer: iss
+      });
+
+      expect((await bypassLaunchVerifier(services).verify(expiredToken)).testSuccessful).toBe(true);
+    });
+
+    it('still throws when the token payload is missing the sub claim', async() => {
+      const tokenWithoutSub = jwt.sign({testSuccessful: true}, privateKey, {
+        algorithm: alg,
+        expiresIn,
+        issuer: iss
+      });
+
+      await expect(bypassLaunchVerifier(services).verify(tokenWithoutSub)).rejects.toThrow('JWT payload missing sub claim');
+    });
+
+    it('still throws when the token payload is not an object', async() => {
+      // Create a malformed token that would decode to a string
+      const malformedToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImlzcyI6Imh0dHBzOi8vb3BlbnN0YXgub3JnIn0.InRlc3RTdHJpbmci.signature';
+
+      await expect(bypassLaunchVerifier(services).verify(malformedToken)).rejects.toThrow('received JWT token with unexpected non-JSON payload');
+    });
+
+    it('works with validator when bypass is enabled', async() => {
+      const token = await launchSigner.sign({}, '{"testSuccessful":true}');
+      const validator = z.object({testSuccessful: z.boolean()});
+      expect((await bypassLaunchVerifier(services).verify(token, validator.parse)).testSuccessful).toBe(true);
+    });
+
+  });
+
+  describe('with bypassSignatureVerification disabled', () => {
+    const normalVerifierConfig = {
+      test: {
+        trustedDomain: 'openstax.org',
+        bypassSignatureVerification: 'false',
+      }
+    };
+
+    const normalLaunchVerifier = createLaunchVerifier({ configSpace: 'test', fetcher })(normalVerifierConfig);
+
+    it('still performs signature verification when bypass is explicitly disabled', async() => {
+      // Create a token with invalid signature that should fail verification when bypass is disabled
+      const validToken = await launchSigner.sign({testSuccessful: true}, 'userId');
+      const [header, payload] = validToken.split('.');
+      const invalidToken = `${header}.${payload}.invalid_signature`;
+
+      await expect(normalLaunchVerifier(services).verify(invalidToken)).rejects.toThrow();
+    });
+  });
+});

package/packages/utils/src/services/launchParams/signer.ts

@@ -0,0 +1,73 @@
+import jwt from 'jsonwebtoken';
+import ms from 'ms';
+import { JWK } from 'node-jose';
+import { once } from '../..';
+import { ConfigProviderForConfig, resolveConfigValue } from '../../config';
+import { ifDefined } from '../../guards';
+import type { JsonCompatibleStruct } from '../../routing';
+
+type Config = {
+  alg: string;
+  expiresIn: string;
+  iss: string;
+  privateKey: string;
+};
+interface Initializer<C> {
+  configSpace?: C;
+}
+
+// jsonwebtoken does not export this list
+type SupportedAlgorithm = Exclude<jwt.Algorithm, 'none'>;
+const SUPPORTED_ALGORITHMS: SupportedAlgorithm[] & ReadonlyArray<string> = [
+  'RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'HS256', 'HS384', 'HS512', 'PS256', 'PS384', 'PS512'
+];
+const assertAlg = (alg: string) => {
+  if ((SUPPORTED_ALGORITHMS).includes(alg)) {
+    return alg as SupportedAlgorithm;
+  }
+
+  throw new Error(`"${alg}" is not a valid algorithm`);
+};
+
+/**
+ * Creates a class that can sign launch params
+ */
+export const createLaunchSigner = <C extends string = 'launch'>({configSpace}: Initializer<C>) => (configProvider: {[_key in C]: ConfigProviderForConfig<Config>}) => {
+  const config = configProvider[ifDefined(configSpace, 'launch' as C)];
+  const getAlg = once(async() => assertAlg(await resolveConfigValue(config.alg)));
+  const getExpiresIn = once(() => resolveConfigValue(config.expiresIn));
+  const getIss = once(() => resolveConfigValue(config.iss));
+  const getPrivateKey = once(() => resolveConfigValue(config.privateKey));
+  const getKeyStore = once(async() => {
+    const keystore = JWK.createKeyStore();
+    await keystore.add(await getPrivateKey(), 'pem');
+    return keystore;
+  });
+
+  const jwks = async() => (await getKeyStore()).toJSON(false) as { keys: JWK.RawKey[] };
+
+  const getExpiresInWithMax = async(maxExp?: number | null) => {
+    const expiresIn = await getExpiresIn();
+
+    // The ms library used by jsonwebtoken can handle a value in seconds as well as a string like '1d'
+    if (!maxExp) { return expiresIn; }
+
+    // Convert both values to seconds for comparison
+    const expiresInSeconds = Math.floor(ms(expiresIn)/1000);
+    const maxExpSeconds = maxExp - Math.floor(Date.now()/1000);
+    return Math.min(expiresInSeconds, maxExpSeconds);
+  };
+
+  const sign = async(data: JsonCompatibleStruct, subject: string, maxExp?: number | null) => {
+    const alg = await getAlg();
+    // expiresIn can be a number of seconds or a string like '1h' or '1d'
+    const expiresIn = await getExpiresInWithMax(maxExp);
+    const iss = await getIss();
+    const header = { alg, iss };
+    return jwt.sign(data, await getPrivateKey(), { algorithm: alg, expiresIn, header, issuer: iss, subject });
+  };
+
+  return { jwks, sign };
+};
+
+export type LaunchSigner = ReturnType<ReturnType<typeof createLaunchSigner>>;