@openstax/ts-utils 1.34.0 → 1.35.0

package/packages/utils/src/services/fileServer/s3FileServer.ts

@@ -1,155 +0,0 @@
-/* cspell:ignore presigner */
-import path from 'path';
-import { CopyObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
-import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
-import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
-import { v4 as uuid } from 'uuid';
-import { once } from '../..';
-import { assertDefined } from '../../assertions';
-import { ConfigProviderForConfig, resolveConfigValue } from '../../config';
-import { ifDefined } from '../../guards';
-import { FileServerAdapter, FileValue } from '.';
-
-export type Config = {
-  bucketName: string;
-  bucketRegion: string;
-  // optional, if not provided attempting to get a public URL will throw an error
-  publicViewerDomain?: string;
-};
-interface Initializer<C> {
-  configSpace?: C;
-  getS3Client?: (...args: ConstructorParameters<typeof S3Client>) => S3Client;
-}
-
-export const s3FileServer = <C extends string = 'deployed'>(initializer: Initializer<C>) => (configProvider: {[_key in C]: ConfigProviderForConfig<Config>}): FileServerAdapter => {
-  const config = configProvider[ifDefined(initializer.configSpace, 'deployed' as C)];
-  const bucketName = once(() => resolveConfigValue(config.bucketName));
-  const bucketRegion = once(() => resolveConfigValue(config.bucketRegion));
-  const publicViewerDomain = once(() => 'publicViewerDomain' in config && config.publicViewerDomain
-    ? resolveConfigValue(config.publicViewerDomain)
-    : undefined
-  );
-  const s3Service = once(async () => {
-    const args = {apiVersion: '2012-08-10', region: await bucketRegion()};
-    return initializer.getS3Client?.(args) ?? new S3Client(args);
-  });
-
-  /*
-   * https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html
-   */
-  const getSignedViewerUrl = async (source: FileValue) => {
-    const bucket = (await bucketName());
-    const command = new GetObjectCommand({Bucket: bucket, Key: source.path});
-    return getSignedUrl(await s3Service(), command, {
-      expiresIn: 3600, // 1 hour
-    });
-  };
-  const getPublicViewerUrl = async (source: FileValue) => {
-    const host = assertDefined(await publicViewerDomain(),
-      new Error(`Tried to get public viewer URL for ${source.path} but no publicViewerDomain configured`)
-    );
-    return `https://${host}/${source.path}`;
-  };
-  const getFileContent = async (source: FileValue) => {
-    const bucket = await bucketName();
-    const command = new GetObjectCommand({Bucket: bucket, Key: source.path});
-    const response = await (await s3Service()).send(command);
-
-    return Buffer.from(await assertDefined(response.Body, new Error('Invalid Response from s3')).transformToByteArray());
-  };
-  const putFileContent = async (source: FileValue, content: string) => {
-    const bucket = await bucketName();
-    const command = new PutObjectCommand({
-      Bucket: bucket,
-      Key: source.path,
-      Body: content,
-      ContentType: source.mimeType,
-    });
-    await (await s3Service()).send(command);
-    return source;
-  };
-
-  /*
-   * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/modules/_aws_sdk_s3_presigned_post.html
-   * https://docs.aws.amazon.com/AmazonS3/latest/userguide/HTTPPOSTExamples.html
-   * https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-post-example.html
-   */
-  const getSignedFileUploadConfig = async() => {
-    const prefix = 'uploads/' + uuid();
-    const bucket = (await bucketName());
-
-    const Conditions = [
-      { acl: 'private' },
-      { bucket } as {bucket: string},
-      ['starts-with', '$key', prefix] as ['starts-with', string, string]
-    ];
-
-    const defaultFields = {
-      acl: 'private',
-    };
-    const { url, fields } = await createPresignedPost(await s3Service(), {
-      Bucket: bucket,
-      Key: prefix + '/${filename}',
-      Conditions,
-      Fields: defaultFields,
-      Expires: 3600, // 1 hour
-    });
-
-    return {
-      url, payload: fields
-    };
-  };
-
-  const copyFileTo = async (source: FileValue, destinationPath: string) => {
-    const bucket = (await bucketName());
-    const destinationPathWithoutLeadingSlash = destinationPath.replace(/^\//, '');
-
-    const command = new CopyObjectCommand({
-      Bucket: bucket,
-      Key: destinationPathWithoutLeadingSlash,
-      CopySource: path.join(bucket, source.path),
-    });
-    await (await s3Service()).send(command);
-
-    return {
-      ...source,
-      path: destinationPathWithoutLeadingSlash
-    };
-  };
-
-  const copyFileToDirectory = async (source: FileValue, destination: string) => {
-    const destinationPath = path.join(destination, source.label);
-    return copyFileTo(source, destinationPath);
-  };
-
-  const isTemporaryUpload = (source: FileValue) => {
-    return source.path.indexOf('uploads/') === 0;
-  };
-
-  const getFileChecksum = async (source: FileValue) => {
-    const bucket = (await bucketName());
-    const command = new HeadObjectCommand({Bucket: bucket, Key: source.path});
-    const response = await (await s3Service()).send(command);
-    return assertDefined(response.ETag);
-  };
-
-  const filesEqual = async (sourceA: FileValue, sourceB: FileValue) => {
-    const [aSum, bSum] = await Promise.all(
-      [getFileChecksum(sourceA), getFileChecksum(sourceB)]
-    );
-    return aSum === bSum;
-  };
-
-  return {
-    getFileContent,
-    putFileContent,
-    getSignedViewerUrl,
-    getPublicViewerUrl,
-    getSignedFileUploadConfig,
-    copyFileTo,
-    copyFileToDirectory,
-    isTemporaryUpload,
-    getFileChecksum,
-    filesEqual,
-  };
-};

package/packages/utils/src/services/launchParams/index.spec.ts

@@ -1,366 +0,0 @@
-/* spell-checker: ignore Xgub Jpbmci Blbn Imlzcy XVCIs */
-import jwt from 'jsonwebtoken';
-import { JwksClient } from 'jwks-rsa';
-import ms from 'ms';
-import { z } from 'zod';
-import { SessionExpiredError } from '../../errors';
-import { createLaunchSigner, createLaunchVerifier } from '.';
-
-const alg = 'RS256' as const;
-const expiresIn = '1m';
-const iss = 'https://openstax.org';
-// privateKey generated for testing only
-const privateKey = `-----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDdyPcrfMDym/eS
-jFEddXdbVh5PhvcikruXvzyJ/Ehocd0lgV/OMaSvdSqbmw1lJvC7NwuuhnslxwoD
-0zHaUq+XR6dkaw09wPG4jzj76FByKyvFOKB8E+z3ARFDZkiRK6rdVTVnVwFG0TCl
-Zwdb6FSX8DL8qOqRIDzxuXBmp02Y79srcarYpaHKwwOBt8Fjs8XSADj6OR+/abXP
-5cAwtqM/P18efcSfGVqoraJMSNh7tJGTdOMiSrSY8n/F7xJytZf7YeVoppjIdjvG
-TyHf3R3vg6xFJP63ISE1fdz8gDHR/Ix6kmWQN+t83/uYcxmcmA5CgszJXtKNxKAy
-WtucJhj7AgMBAAECggEAWNKuov0ArWlneoq1xc2QssTHuOP9wBvyA3E0hrLCMQpB
-Hk81FnhtU1Pib5VmhPdWfDQseoYjddrEGQoRMjXhWv34fVAeangGlvrNQJ4m8cJ2
-cjMemvLD+Zy01EB3maRadvA0RiHjQgBvsh6UJOvkTUGGugfQgbTek5TH/mTMwA24
-02DsewnNk5UnLkUsh5tDeJkq9UhI2sSdkLkUoUAyZYXdUF0RRxotPK9IIorA22Vu
-Hw/WQ3Sr8RDyNDW0eVsmvh2jWj+vTKndqvryNqqHztpxeXh3BC9/flZjLZPgAFZ9
-NVnB3nj2a3A9kqz/gu/jyK1DoC9e7a8xnetp1KxK+QKBgQD07n9yBmSh06kL71Sn
-8YXD5BGKWCLW+w5GM2EqzwtwXy5TGP6A6ctQESQycYEer9P0PfOG8/T4eHe0xleB
-OEVM/k+FfaxHuY3FU09gb0X04jKZnE3D9gNEzJfuejb12RLJkbFPGpzmrOSy+rgb
-Kw9LUmppk3tkNE9aTGR+Wyj+5wKBgQDnzrHyorFuomebcih5HEXfozHg2XmLUwlW
-ajF9c/VPKcLuzDsK0v10ZjLY30mR9i9tcwURb+YGMo3RxAxAXwcUvKzsi32fYpnn
-oVn2vJeauasTL+NjKp/8SSlVQykyuVNHc5WD+CrfyMRuDQWitmZVmH0oX38xejML
-OttDAaD2zQKBgQDieRySnGK0V3f5tyR53ZMoHFwzpWchjSYXty5jXOpgz0GQSI4b
-ORJrSE5F7jnL3ByJvDbPVAfxL8LP/o2uyA8cMBHrhtajw2jZSj0dGAaBdh3/d01Y
-osNG/D6Hna3wCPWcOADQ+fSWPsuAyt8tD9WmeeA3Gs1/S/cLsZNCWpw/hQKBgQDi
-MbE2gEb/G/5ZksWnmE0ecpJjRBL0PuynpCvyrMo8mxWaCzO51jR39pm7Qfb6NO4G
-sOvLHhOpDH+SpukFjzTLqWhb0amdc4uWmL2+pDyTQIWMzXfm9lryxTlN96El2+1F
-laXaBrlfcPssIAzVv4KQF6JZWQY2c3WHicEW22oEKQKBgHt6n+j0ZO+Quq7k7FNr
-6RAKDmAURh/+rPc3o357inI9u5oxktXvxI41ijHXTQRKrakAmiSYikPQOb/aOgjO
-PNpj6gag4Srw7QkLI8ttl0yUCP155dxvnrK8Dd/t+oTsKTCR0EINSUUM8omDnHCL
-5kaLB/QpHAKj0pF54unD8VzI
------END PRIVATE KEY-----`;
-
-const signerConfig = {
-  test: {
-    alg,
-    expiresIn,
-    iss,
-    privateKey,
-  }
-};
-
-const launchSigner = createLaunchSigner({ configSpace: 'test' })(signerConfig);
-
-describe('launchSigner', () => {
-  describe('jwks', () => {
-    it('outputs the public part of the key', async() => {
-      // cspell:disable
-      expect(await launchSigner.jwks()).toMatchInlineSnapshot(`
-{
-  "keys": [
-    {
-      "e": "AQAB",
-      "kid": "wKgbD-KbvgA_GIKnggurrTGH_tGYVI8cDU01BuM6zC8",
-      "kty": "RSA",
-      "n": "3cj3K3zA8pv3koxRHXV3W1YeT4b3IpK7l788ifxIaHHdJYFfzjGkr3Uqm5sNZSbwuzcLroZ7JccKA9Mx2lKvl0enZGsNPcDxuI84--hQcisrxTigfBPs9wERQ2ZIkSuq3VU1Z1cBRtEwpWcHW-hUl_Ay_KjqkSA88blwZqdNmO_bK3Gq2KWhysMDgbfBY7PF0gA4-jkfv2m1z-XAMLajPz9fHn3EnxlaqK2iTEjYe7SRk3TjIkq0mPJ_xe8ScrWX-2HlaKaYyHY7xk8h390d74OsRST-tyEhNX3c_IAx0fyMepJlkDfrfN_7mHMZnJgOQoLMyV7SjcSgMlrbnCYY-w",
-    },
-  ],
-}
-`);
-      // cspell:enable
-    });
-  });
-
-  describe('sign', () => {
-    let publicKey: string;
-
-    beforeEach(async() => {
-      const jwksUri = 'https://localhost/test';
-      const fetcher = (uri: string) => {
-        if (uri !== jwksUri) { throw new Error(`Unexpected URI: "${uri}"`); }
-        return launchSigner.jwks();
-      };
-      const jwksClient = new JwksClient({ fetcher, jwksUri });
-      const key = await jwksClient.getSigningKey();
-      publicKey = key.getPublicKey();
-    });
-
-    it('returns a signed token', async() => {
-      const token = await launchSigner.sign({}, 'userId');
-      const { header, payload } = jwt.verify(token, publicKey, { complete: true });
-      if (typeof payload !== 'object') { throw new Error('Unexpected string payload'); }
-
-      expect(header.alg).toBe(alg);
-      expect(header.typ).toBe('JWT');
-
-      expect(payload.exp).toBeLessThanOrEqual(Math.floor(Date.now() / 1000) + 60);
-      expect(payload.sub).toBe('userId');
-    });
-
-    it('can set token duration using a unix timestamp', async() => {
-      const maxExp = Math.floor(Date.now() / 1000) + 30;
-      const token = await launchSigner.sign({}, 'userId', maxExp);
-      const { payload } = jwt.verify(token, publicKey, { complete: true });
-      if (typeof payload !== 'object') { throw new Error('Unexpected string payload'); }
-      expect(payload.exp).toBeLessThanOrEqual(maxExp);
-      expect(payload.exp).toBeGreaterThanOrEqual(maxExp - 5);
-    });
-
-    it('cannot exceed the configured max token duration', async() => {
-      const now = Math.floor(Date.now()/1000);
-      const maxExp = now + 86400; // 1 day
-      const actualMax = now + Math.floor(ms(expiresIn)/1000);
-      const token = await launchSigner.sign({}, 'userId', maxExp);
-      const { payload } = jwt.verify(token, publicKey, { complete: true });
-      if (typeof payload !== 'object') { throw new Error('Unexpected string payload'); }
-      expect(payload.exp).toBeLessThanOrEqual(actualMax);
-      expect(payload.exp).toBeGreaterThanOrEqual(actualMax - 5);
-    });
-
-    it('throws when alg is invalid', () => {
-      const invalidLaunchSigner = createLaunchSigner({ configSpace: 'test' })({ test: { ...signerConfig.test, alg: 'none' } });
-      return expect(invalidLaunchSigner.sign({}, 'userId')).rejects.toThrow('"none" is not a valid algorithm');
-    });
-  });
-});
-
-describe('launchVerifier', () => {
-  const verifierConfig = {
-    test: {
-      trustedDomain: 'openstax.org',
-      bypassSignatureVerification: 'false',
-    }
-  };
-
-  const fetcher = (uri: string) => {
-    if (uri !== new URL('/.well-known/jwks.json', iss).toString()) { throw new Error(`Unexpected URI: "${uri}"`); }
-    return launchSigner.jwks();
-  };
-
-  const services = {};
-  const launchVerifier = createLaunchVerifier({ configSpace: 'test', fetcher })(verifierConfig);
-
-  describe('with legacy format token', () => {
-    it('can verify string value tokens signed by the launchSigner reading value from .sub', async() => {
-      const token = await launchSigner.sign({}, 'testSuccessful=true');
-      expect((await launchVerifier(services).verify(token)).sub).toMatchInlineSnapshot('"testSuccessful=true"');
-    });
-
-    it('can verify json value tokens signed by the launchSigner reading value from .sub', async() => {
-      const token = await launchSigner.sign({}, '{"testSuccessful":true}');
-      expect((await launchVerifier(services).verify(token)).sub).toMatchInlineSnapshot('"{"testSuccessful":true}"');
-    });
-
-    it('can verify json value tokens signed by the launchSigner reading value from token', async() => {
-      const token = await launchSigner.sign({}, '{"testSuccessful":true}');
-      expect((await launchVerifier(services).verify(token)).testSuccessful).toMatchInlineSnapshot('true');
-    });
-
-    it('can verify extended claim tokens signed by the launchSigner reading value from token', async() => {
-      const token = await launchSigner.sign({testSuccessful:true}, 'userId');
-      expect((await launchVerifier(services).verify(token)).testSuccessful).toMatchInlineSnapshot('true');
-    });
-
-    describe('with a validator', () => {
-      it('can use a default token', async() => {
-        const token = await launchSigner.sign({}, 'userId');
-        const validator = z.object({sub: z.string()});
-        expect((await launchVerifier(services, () => token).verify(validator.parse)).sub).toBe('userId');
-      });
-
-      it('throws with no token provided', async() => {
-        const validator = z.object({sub: z.string()});
-        await expect(() => launchVerifier(services).verify(validator.parse)).rejects
-          .toThrowErrorMatchingInlineSnapshot('"Missing token for launch verification"')
-        ;
-      });
-
-      it('can verify string value tokens signed by the launchSigner reading value from .sub', async() => {
-        const token = await launchSigner.sign({}, 'testSuccessful=true');
-        const validator = z.object({sub: z.string()});
-        expect((await launchVerifier(services).verify(token, validator.parse)).sub).toMatchInlineSnapshot('"testSuccessful=true"');
-      });
-
-      it('can verify json value tokens signed by the launchSigner reading value from .sub', async() => {
-        const token = await launchSigner.sign({}, '{"testSuccessful":true}');
-        const validator = z.object({sub: z.string()});
-        expect((await launchVerifier(services).verify(token, validator.parse)).sub).toMatchInlineSnapshot('"{"testSuccessful":true}"');
-      });
-
-      it('can verify json value tokens signed by the launchSigner reading extracted value', async() => {
-        const token = await launchSigner.sign({}, '{"testSuccessful":true}');
-        const validator = z.object({testSuccessful: z.boolean()});
-        expect((await launchVerifier(services).verify(token, validator.parse)).testSuccessful).toMatchInlineSnapshot('true');
-      });
-
-      it('can verify extended claim tokens signed by the launchSigner reading extracted value', async() => {
-        const token = await launchSigner.sign({testSuccessful:true}, 'userId');
-        const validator = z.object({testSuccessful: z.boolean()});
-        expect((await launchVerifier(services).verify(token, validator.parse)).testSuccessful).toMatchInlineSnapshot('true');
-      });
-
-      it('strips unknown claims from result', async() => {
-        const token = await launchSigner.sign({}, '{"testSuccessful":true,"unknown":"value"}');
-        const validator = z.object({sub: z.string(), iss: z.string(), testSuccessful: z.boolean()});
-        expect(await launchVerifier(services).verify(token, validator.parse)).toMatchInlineSnapshot(`
-{
-  "iss": "https://openstax.org",
-  "sub": "{"testSuccessful":true,"unknown":"value"}",
-  "testSuccessful": true,
-}
-`);
-      });
-
-      it('throws on invalid token parameters', async() => {
-        const token = await launchSigner.sign({}, '{"testSuccessful":true}');
-        const validator = z.object({testSuccessfullyBad: z.boolean()});
-        await expect(() => launchVerifier(services).verify(token, validator.parse)).rejects.toThrowErrorMatchingInlineSnapshot(`
-"error in secret or public key callback: [
-  {
-    "expected": "boolean",
-    "code": "invalid_type",
-    "path": [
-      "testSuccessfullyBad"
-    ],
-    "message": "Invalid input: expected boolean, received undefined"
-  }
-]"
-`);
-      });
-    });
-  });
-
-  it('throws when the token is invalid', () => {
-    const token = 'R4ND0M';
-    return expect(launchVerifier(services).verify(token)).rejects.toThrow('jwt malformed');
-  });
-
-  it('throws when the token header is missing the iss claim', () => {
-    const token = jwt.sign({}, privateKey, { algorithm: alg, expiresIn, issuer: iss });
-    return expect(launchVerifier(services).verify(token)).rejects.toThrow('error in secret or public key callback: JWT header missing iss claim');
-  });
-
-  it('throws when the token is expired', () => {
-    const header = { alg, iss };
-    const token = jwt.sign({}, privateKey, { algorithm: alg, expiresIn: -1, header });
-    return expect(launchVerifier(services).verify(token)).rejects.toThrow(SessionExpiredError);
-  });
-
-  it('throws when the token iss is an invalid URL', () => {
-    const issuer = 'openstax.org';
-    const header = { alg, iss: issuer };
-    const token = jwt.sign({}, privateKey, { algorithm: alg, expiresIn, header, issuer });
-    return expect(launchVerifier(services).verify(token)).rejects.toThrow('error in secret or public key callback: Invalid URL');
-  });
-
-  it('throws when the token iss is untrusted', () => {
-    const issuer = 'https://example.com';
-    const header = { alg, iss: issuer };
-    const token = jwt.sign({}, privateKey, { algorithm: alg, expiresIn, header, issuer });
-    return expect(launchVerifier(services).verify(token)).rejects.toThrow(
-      'error in secret or public key callback: Untrusted launch domain: "example.com"'
-    );
-  });
-
-  it('throws when the token payload is a string', () => {
-    const header = { alg, iss };
-    const token = jwt.sign('testSuccessful=true', privateKey, { header });
-    return expect(launchVerifier(services).verify(token)).rejects.toThrow('received JWT token with unexpected non-JSON payload');
-  });
-
-  it('throws when the token payload is missing the sub claim', () => {
-    const header = { alg, iss };
-    const token = jwt.sign({}, privateKey, { expiresIn, header, issuer: iss });
-    return expect(launchVerifier(services).verify(token)).rejects.toThrow('JWT payload missing sub claim');
-  });
-
-  describe('with bypassSignatureVerification enabled', () => {
-    const bypassVerifierConfig = {
-      test: {
-        trustedDomain: 'openstax.org',
-        bypassSignatureVerification: 'true',
-      }
-    };
-
-    const bypassLaunchVerifier = createLaunchVerifier({ configSpace: 'test', fetcher })(bypassVerifierConfig);
-
-    it('can verify tokens without signature verification', async() => {
-      const token = await launchSigner.sign({}, 'testSuccessful=true');
-      expect((await bypassLaunchVerifier(services).verify(token)).sub).toMatchInlineSnapshot('"testSuccessful=true"');
-    });
-
-    it('can verify json value tokens reading value from token', async() => {
-      const token = await launchSigner.sign({}, '{"testSuccessful":true}');
-      expect((await bypassLaunchVerifier(services).verify(token)).testSuccessful).toMatchInlineSnapshot('true');
-    });
-
-    it('can verify extended claim tokens reading value from token', async() => {
-      const token = await launchSigner.sign({testSuccessful:true}, 'userId');
-      expect((await bypassLaunchVerifier(services).verify(token)).testSuccessful).toMatchInlineSnapshot('true');
-    });
-
-    it('can verify tokens with invalid signatures when bypass is enabled', async() => {
-      // Create a malformed token that would normally fail signature verification
-      // but should succeed when bypass is enabled
-      const validToken = await launchSigner.sign({testSuccessful: true}, 'userId');
-      const [header, payload] = validToken.split('.');
-      const invalidToken = `${header}.${payload}.invalid_signature`;
-
-      expect((await bypassLaunchVerifier(services).verify(invalidToken)).testSuccessful).toBe(true);
-    });
-
-    it('can verify expired tokens when bypass is enabled', async() => {
-      const expiredToken = jwt.sign({testSuccessful: true}, privateKey, {
-        algorithm: alg,
-        expiresIn: -1,
-        subject: 'userId',
-        issuer: iss
-      });
-
-      expect((await bypassLaunchVerifier(services).verify(expiredToken)).testSuccessful).toBe(true);
-    });
-
-    it('still throws when the token payload is missing the sub claim', async() => {
-      const tokenWithoutSub = jwt.sign({testSuccessful: true}, privateKey, {
-        algorithm: alg,
-        expiresIn,
-        issuer: iss
-      });
-
-      await expect(bypassLaunchVerifier(services).verify(tokenWithoutSub)).rejects.toThrow('JWT payload missing sub claim');
-    });
-
-    it('still throws when the token payload is not an object', async() => {
-      // Create a malformed token that would decode to a string
-      const malformedToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImlzcyI6Imh0dHBzOi8vb3BlbnN0YXgub3JnIn0.InRlc3RTdHJpbmci.signature';
-
-      await expect(bypassLaunchVerifier(services).verify(malformedToken)).rejects.toThrow('received JWT token with unexpected non-JSON payload');
-    });
-
-    it('works with validator when bypass is enabled', async() => {
-      const token = await launchSigner.sign({}, '{"testSuccessful":true}');
-      const validator = z.object({testSuccessful: z.boolean()});
-      expect((await bypassLaunchVerifier(services).verify(token, validator.parse)).testSuccessful).toBe(true);
-    });
-
-  });
-
-  describe('with bypassSignatureVerification disabled', () => {
-    const normalVerifierConfig = {
-      test: {
-        trustedDomain: 'openstax.org',
-        bypassSignatureVerification: 'false',
-      }
-    };
-
-    const normalLaunchVerifier = createLaunchVerifier({ configSpace: 'test', fetcher })(normalVerifierConfig);
-
-    it('still performs signature verification when bypass is explicitly disabled', async() => {
-      // Create a token with invalid signature that should fail verification when bypass is disabled
-      const validToken = await launchSigner.sign({testSuccessful: true}, 'userId');
-      const [header, payload] = validToken.split('.');
-      const invalidToken = `${header}.${payload}.invalid_signature`;
-
-      await expect(normalLaunchVerifier(services).verify(invalidToken)).rejects.toThrow();
-    });
-  });
-});

package/packages/utils/src/services/launchParams/signer.ts

@@ -1,73 +0,0 @@
-import jwt from 'jsonwebtoken';
-import ms from 'ms';
-import { JWK } from 'node-jose';
-import { once } from '../..';
-import { ConfigProviderForConfig, resolveConfigValue } from '../../config';
-import { ifDefined } from '../../guards';
-import type { JsonCompatibleStruct } from '../../routing';
-
-type Config = {
-  alg: string;
-  expiresIn: string;
-  iss: string;
-  privateKey: string;
-};
-interface Initializer<C> {
-  configSpace?: C;
-}
-
-// jsonwebtoken does not export this list
-type SupportedAlgorithm = Exclude<jwt.Algorithm, 'none'>;
-const SUPPORTED_ALGORITHMS: SupportedAlgorithm[] & ReadonlyArray<string> = [
-  'RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'HS256', 'HS384', 'HS512', 'PS256', 'PS384', 'PS512'
-];
-const assertAlg = (alg: string) => {
-  if ((SUPPORTED_ALGORITHMS).includes(alg)) {
-    return alg as SupportedAlgorithm;
-  }
-
-  throw new Error(`"${alg}" is not a valid algorithm`);
-};
-
-/**
- * Creates a class that can sign launch params
- */
-export const createLaunchSigner = <C extends string = 'launch'>({configSpace}: Initializer<C>) => (configProvider: {[_key in C]: ConfigProviderForConfig<Config>}) => {
-  const config = configProvider[ifDefined(configSpace, 'launch' as C)];
-  const getAlg = once(async() => assertAlg(await resolveConfigValue(config.alg)));
-  const getExpiresIn = once(() => resolveConfigValue(config.expiresIn));
-  const getIss = once(() => resolveConfigValue(config.iss));
-  const getPrivateKey = once(() => resolveConfigValue(config.privateKey));
-  const getKeyStore = once(async() => {
-    const keystore = JWK.createKeyStore();
-    await keystore.add(await getPrivateKey(), 'pem');
-    return keystore;
-  });
-
-  const jwks = async() => (await getKeyStore()).toJSON(false) as { keys: JWK.RawKey[] };
-
-  const getExpiresInWithMax = async(maxExp?: number | null) => {
-    const expiresIn = await getExpiresIn();
-
-    // The ms library used by jsonwebtoken can handle a value in seconds as well as a string like '1d'
-    if (!maxExp) { return expiresIn; }
-
-    // Convert both values to seconds for comparison
-    const expiresInSeconds = Math.floor(ms(expiresIn)/1000);
-    const maxExpSeconds = maxExp - Math.floor(Date.now()/1000);
-    return Math.min(expiresInSeconds, maxExpSeconds);
-  };
-
-  const sign = async(data: JsonCompatibleStruct, subject: string, maxExp?: number | null) => {
-    const alg = await getAlg();
-    // expiresIn can be a number of seconds or a string like '1h' or '1d'
-    const expiresIn = await getExpiresInWithMax(maxExp);
-    const iss = await getIss();
-    const header = { alg, iss };
-    return jwt.sign(data, await getPrivateKey(), { algorithm: alg, expiresIn, header, issuer: iss, subject });
-  };
-
-  return { jwks, sign };
-};
-
-export type LaunchSigner = ReturnType<ReturnType<typeof createLaunchSigner>>;