@openstax/ts-utils 1.44.4 → 1.46.0

package/dist/cjs/index.d.ts

@@ -2,4 +2,3 @@ export * from './misc/hashValue.js';
 export * from './misc/helpers.js';
 export * from './misc/merge.js';
 export * from './misc/partitionSequence.js';
-export * from './misc/timingSafeCompareStrings.js';

package/dist/cjs/index.js

@@ -18,4 +18,3 @@ __exportStar(require("./misc/hashValue.js"), exports);
 __exportStar(require("./misc/helpers.js"), exports);
 __exportStar(require("./misc/merge.js"), exports);
 __exportStar(require("./misc/partitionSequence.js"), exports);
-__exportStar(require("./misc/timingSafeCompareStrings.js"), exports);

package/dist/cjs/services/accountsGateway/index.d.ts

@@ -1,7 +1,7 @@
 import { ConfigProviderForConfig } from '../../config/index.js';
 import { GenericFetch } from '../../fetch/index.js';
 import { JsonCompatibleStruct } from '../../routing/index.js';
-import { ApiUser } from '../authProvider/index.js';
+import { ApiUser, ExternalId } from '../authProvider/index.js';
 import { Logger } from '../logger/index.js';
 export type Config = {
     accountsBase: string;
@@ -36,12 +36,12 @@ export type FindOrCreateUserPayload = {
 export type FindOrCreateUserResponse = {
     id: number;
     uuid: string;
-    external_ids: string[];
+    external_ids: ExternalId[];
     is_test: boolean;
     sso: string;
 };
 export type FindUserResponse = (FindOrCreateUserResponse & {
-    external_ids: string[];
+    external_ids: ExternalId[];
 }) | undefined;
 export type LinkUserPayload = {
     userId: number;
@@ -59,7 +59,7 @@ export type SearchUsersPayload = {
 };
 export type SearchUsersResponse = {
     items: Array<ApiUser & {
-        external_ids: string[];
+        external_ids: ExternalId[];
     } & JsonCompatibleStruct>;
     total_count: number;
 };
@@ -72,6 +72,10 @@ export type MappedUserInfo<T> = {
     platformUserId?: string;
     uuid: string;
 };
+/**
+ * Normalize an external_id to always return the string representation.
+ */
+export declare const normalizeExternalId: (externalId: ExternalId) => string;
 export declare const accountsGateway: <C extends string = "accounts">(initializer: Initializer<C>) => (configProvider: { [_key in C]: ConfigProviderForConfig<Config>; }) => ({ logger }: {
     logger: Logger;
 }) => {

package/dist/cjs/services/accountsGateway/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accountsGateway = void 0;
+exports.accountsGateway = exports.normalizeExternalId = void 0;
 const lodash_1 = require("lodash");
 const query_string_1 = __importDefault(require("query-string"));
 const index_js_1 = require("../../config/index.js");
@@ -17,6 +17,13 @@ class ApiError extends Error {
         this.status = status;
     }
 }
+/**
+ * Normalize an external_id to always return the string representation.
+ */
+const normalizeExternalId = (externalId) => {
+    return typeof externalId === 'string' ? externalId : externalId.external_id;
+};
+exports.normalizeExternalId = normalizeExternalId;
 const accountsGateway = (initializer) => (configProvider) => {
     const config = configProvider[(0, index_js_2.ifDefined)(initializer.configSpace, 'accounts')];
     const accountsBase = (0, helpers_js_1.once)(() => (0, index_js_1.resolveConfigValue)(config.accountsBase));
@@ -65,7 +72,8 @@ const accountsGateway = (initializer) => (configProvider) => {
         const searchUsers = async (payload) => request(index_js_3.METHOD.GET, `users?${query_string_1.default.stringify(payload)}`, {});
         const updateUser = async (token, body) => request(index_js_3.METHOD.PUT, 'user', { body, token });
         const getPlatformUserId = (externalIds, platformId) => {
-            for (const externalId of externalIds) {
+            const normalizedIds = externalIds.map(exports.normalizeExternalId);
+            for (const externalId of normalizedIds) {
                 const [userPlatformId, userId] = externalId.split('/', 2);
                 if (userPlatformId === platformId) {
                     return userId;

package/dist/cjs/services/authProvider/index.d.ts

@@ -11,6 +11,11 @@ export type TokenUser = {
     name: string;
     uuid: string;
 };
+export type ExternalId = string | {
+    external_id: string;
+    user_id?: number;
+    role: string;
+};
 export type ApiUser = TokenUser & {
     id: number;
     first_name: string;
@@ -27,7 +32,7 @@ export type ApiUser = TokenUser & {
         name: string;
         roles: string[];
     }>;
-    external_ids: string[];
+    external_ids: ExternalId[];
     faculty_status: string;
     is_admin: boolean;
     is_not_gdpr_location: boolean;

package/dist/cjs/services/httpMessage/index.d.ts

@@ -0,0 +1,2 @@
+export { createHttpMessageSigner } from './signer.js';
+export { createHttpMessageVerifier } from './verifier.js';

package/dist/cjs/services/httpMessage/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHttpMessageVerifier = exports.createHttpMessageSigner = void 0;
+var signer_js_1 = require("./signer.js");
+Object.defineProperty(exports, "createHttpMessageSigner", { enumerable: true, get: function () { return signer_js_1.createHttpMessageSigner; } });
+var verifier_js_1 = require("./verifier.js");
+Object.defineProperty(exports, "createHttpMessageVerifier", { enumerable: true, get: function () { return verifier_js_1.createHttpMessageVerifier; } });

package/dist/cjs/services/httpMessage/signer.d.ts

@@ -0,0 +1,15 @@
+import { ConfigProviderForConfig } from '../../config/index.js';
+import { KeyStore } from '../keyStore/index.js';
+type Config = {
+    iss: string;
+};
+interface Initializer<C> {
+    configSpace?: C;
+}
+export declare const createHttpMessageSigner: <C extends string = "signer">({ configSpace }: Initializer<C>) => (configProvider: { [_key in C]: ConfigProviderForConfig<Config>; }, services: {
+    keyStore: KeyStore;
+}) => {
+    signRequest: (method: string, url: string, bodyString: string) => Promise<Record<string, string>>;
+};
+export type HttpMessageSigner = ReturnType<ReturnType<typeof createHttpMessageSigner>>;
+export {};

package/dist/cjs/services/httpMessage/signer.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHttpMessageSigner = void 0;
+/* spell-checker: ignore httpbis meunier keyid */
+const crypto_1 = require("crypto");
+const http_message_signatures_1 = require("http-message-signatures");
+const index_js_1 = require("../../config/index.js");
+const helpers_js_1 = require("../../misc/helpers.js");
+const createHttpMessageSigner = ({ configSpace }) => (configProvider, services) => {
+    const config = configProvider[configSpace !== null && configSpace !== void 0 ? configSpace : 'signer'];
+    const getIss = (0, helpers_js_1.once)(async () => (await (0, index_js_1.resolveConfigValue)(config.iss)).replace(/\/+$/, ''));
+    const getKey = (0, helpers_js_1.once)(() => services.keyStore.getPrivateKey());
+    const getSigner = (0, helpers_js_1.once)(async () => {
+        const { pem } = await getKey();
+        return (0, http_message_signatures_1.createSigner)(pem, 'rsa-v1_5-sha256');
+    });
+    return {
+        signRequest: async (method, url, bodyString) => {
+            const { kid } = await getKey();
+            const digest = (0, crypto_1.createHash)('sha256').update(bodyString).digest('base64');
+            const key = await getSigner();
+            const signed = await http_message_signatures_1.httpbis.signMessage({
+                key,
+                // draft-meunier-http-message-signatures-directory requires signature-agent
+                // to be a covered component alongside the standard RFC 9421 derived components
+                fields: ['@method', '@target-uri', 'content-digest', 'signature-agent'],
+                params: ['keyid', 'alg'],
+                paramValues: { keyid: kid, alg: 'rsa-v1_5-sha256' },
+            }, {
+                method,
+                url,
+                headers: {
+                    // RFC 8941 byte sequence: sha-256=:base64value:
+                    'Content-Digest': `sha-256=:${digest}:`,
+                    'Signature-Agent': `${await getIss()}/.well-known/jwks.json`,
+                },
+            });
+            return signed.headers;
+        },
+    };
+};
+exports.createHttpMessageSigner = createHttpMessageSigner;

package/dist/cjs/services/keyStore/index.d.ts

@@ -0,0 +1,20 @@
+import { JWK } from 'node-jose';
+import { ConfigProviderForConfig } from '../../config/index.js';
+type Config = {
+    privateKey: string;
+};
+export type PrivateKey = {
+    kid: string;
+    pem: string;
+};
+export declare const createKeyStore: (config: ConfigProviderForConfig<Config>) => {
+    getPrivateKey: () => Promise<{
+        kid: string;
+        pem: string;
+    }>;
+    jwks: () => Promise<{
+        keys: JWK.RawKey[];
+    }>;
+};
+export type KeyStore = ReturnType<typeof createKeyStore>;
+export {};

package/dist/cjs/services/keyStore/index.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createKeyStore = void 0;
+const node_jose_1 = require("node-jose");
+const index_js_1 = require("../../config/index.js");
+const helpers_js_1 = require("../../misc/helpers.js");
+const createKeyStore = (config) => {
+    const store = (0, helpers_js_1.once)(async () => {
+        const pem = await (0, index_js_1.resolveConfigValue)(config.privateKey);
+        const keyStore = node_jose_1.JWK.createKeyStore();
+        const { kid } = await keyStore.add(pem, 'pem');
+        const keys = [{ kid, pem }];
+        return { keyStore, keys };
+    });
+    return {
+        // this method only supports one key for now (always returns the first key)
+        getPrivateKey: async () => {
+            const { keys } = await store();
+            return keys[0];
+        },
+        jwks: async () => {
+            const { keyStore } = await store();
+            return keyStore.toJSON(false);
+        },
+    };
+};
+exports.createKeyStore = createKeyStore;

package/dist/cjs/services/launchParams/signer.d.ts

@@ -1,11 +1,10 @@
-import { JWK } from 'node-jose';
 import { ConfigProviderForConfig } from '../../config/index.js';
 import type { JsonCompatibleStruct } from '../../routing/index.js';
+import { KeyStore } from '../keyStore/index.js';
 type Config = {
     alg: string;
     expiresIn: string;
     iss: string;
-    privateKey: string;
 };
 interface Initializer<C> {
     configSpace?: C;
@@ -13,10 +12,9 @@ interface Initializer<C> {
 /**
  * Creates a class that can sign launch params
  */
-export declare const createLaunchSigner: <C extends string = "launch">({ configSpace }: Initializer<C>) => (configProvider: { [_key in C]: ConfigProviderForConfig<Config>; }) => {
-    jwks: () => Promise<{
-        keys: JWK.RawKey[];
-    }>;
+export declare const createLaunchSigner: <C extends string = "launch">({ configSpace }: Initializer<C>) => (configProvider: { [_key in C]: ConfigProviderForConfig<Config>; }, services: {
+    keyStore: KeyStore;
+}) => {
     sign: (data: JsonCompatibleStruct, subject: string, maxExp?: number | null) => Promise<string>;
 };
 export type LaunchSigner = ReturnType<ReturnType<typeof createLaunchSigner>>;

package/dist/cjs/services/launchParams/signer.js

@@ -6,7 +6,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createLaunchSigner = void 0;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const ms_1 = __importDefault(require("ms"));
-const node_jose_1 = require("node-jose");
 const index_js_1 = require("../../config/index.js");
 const index_js_2 = require("../../guards/index.js");
 const index_js_3 = require("../../index.js");
@@ -22,18 +21,12 @@ const assertAlg = (alg) => {
 /**
  * Creates a class that can sign launch params
  */
-const createLaunchSigner = ({ configSpace }) => (configProvider) => {
+const createLaunchSigner = ({ configSpace }) => (configProvider, services) => {
     const config = configProvider[(0, index_js_2.ifDefined)(configSpace, 'launch')];
     const getAlg = (0, index_js_3.once)(async () => assertAlg(await (0, index_js_1.resolveConfigValue)(config.alg)));
     const getExpiresIn = (0, index_js_3.once)(() => (0, index_js_1.resolveConfigValue)(config.expiresIn));
     const getIss = (0, index_js_3.once)(() => (0, index_js_1.resolveConfigValue)(config.iss));
-    const getPrivateKey = (0, index_js_3.once)(() => (0, index_js_1.resolveConfigValue)(config.privateKey));
-    const getKeyStore = (0, index_js_3.once)(async () => {
-        const keystore = node_jose_1.JWK.createKeyStore();
-        await keystore.add(await getPrivateKey(), 'pem');
-        return keystore;
-    });
-    const jwks = async () => (await getKeyStore()).toJSON(false);
+    const getKey = (0, index_js_3.once)(() => services.keyStore.getPrivateKey());
     const getExpiresInWithMax = async (maxExp) => {
         const expiresIn = await getExpiresIn();
         // The ms library used by jsonwebtoken can handle a value in seconds as well as a string like '1d'
@@ -46,13 +39,14 @@ const createLaunchSigner = ({ configSpace }) => (configProvider) => {
         return Math.min(expiresInSeconds, maxExpSeconds);
     };
     const sign = async (data, subject, maxExp) => {
+        const { kid, pem } = await getKey();
         const alg = await getAlg();
         // expiresIn can be a number of seconds or a string like '1h' or '1d'
         const expiresIn = await getExpiresInWithMax(maxExp);
         const iss = await getIss();
-        const header = { alg, iss };
-        return jsonwebtoken_1.default.sign(data, await getPrivateKey(), { algorithm: alg, expiresIn, header, issuer: iss, subject });
+        const header = { alg, iss, kid };
+        return jsonwebtoken_1.default.sign(data, pem, { algorithm: alg, expiresIn, header, issuer: iss, subject });
     };
-    return { jwks, sign };
+    return { sign };
 };
 exports.createLaunchSigner = createLaunchSigner;