@optimizely-opal/opal-tool-ocp-sdk 0.0.0-beta.10 → 0.0.0-beta.11

package/src/auth/TokenVerifier.ts

@@ -1,145 +0,0 @@
-import { jwtVerify, createRemoteJWKSet } from 'jose';
-import { logger } from '@zaiusinc/app-sdk';
-
-/**
- * Default JWKS cache expiration time in milliseconds (1 hour)
- */
-const DEFAULT_JWKS_EXPIRES_IN = 60 * 60 * 1000;
-
-/**
- * Default clock skew tolerance in seconds
- */
-const DEFAULT_LEEWAY = 30;
-
-/**
- * Expected JWT audience for token validation
- */
-const AUDIENCE = 'api://default';
-
-/**
- * Prep Base URL for Optimizely OAuth2 endpoints
- */
-const PREP_BASE_URL = 'https://prep.login.optimizely.com/oauth2/default';
-
-/**
- * Prod Base URL for Optimizely OAuth2 endpoints
- */
-const PROD_BASE_URL = 'https://login.optimizely.com/oauth2/default';
-
-interface DiscoveryDocument {
-  issuer: string;
-  jwks_uri: string;
-  [key: string]: any;
-}
-
-export class TokenVerifier {
-  private static instance: TokenVerifier | null = null;
-  private jwksUri?: string;
-  private issuer?: string;
-  private jwks?: ReturnType<typeof createRemoteJWKSet>;
-  private initialized: boolean = false;
-
-  /**
-   * Verify the provided Optimizely JWT token string
-   * @param token JWT token string to verify
-   * @returns boolean true if verification successful, false otherwise
-   * @throws Error if token is null, empty, or verifier is not properly configured
-   */
-  public async verify(token: string | undefined): Promise<boolean> {
-    if (!token || token.trim().length === 0) {
-      throw new Error('Token cannot be null or empty');
-    }
-
-    return this.verifyToken(token);
-  }
-
-  private static getInstance(): TokenVerifier {
-    if (!TokenVerifier.instance) {
-      TokenVerifier.instance = new TokenVerifier();
-    }
-    return TokenVerifier.instance;
-  }
-
-  /**
-   * Get singleton instance of TokenVerifier and ensure it's initialized
-   * @returns Promise<TokenVerifier> - initialized singleton instance
-   */
-  public static async getInitializedInstance(): Promise<TokenVerifier> {
-    const instance = TokenVerifier.getInstance();
-    if (!instance.initialized) {
-      await instance.initialize();
-    }
-    return instance;
-  }
-
-  /**
-   * Initialize the TokenVerifier with discovery document from well-known endpoint
-   */
-  private async initialize(): Promise<void> {
-    if (this.initialized) {
-      return;
-    }
-
-    try {
-      // Use prep URL when environment variable is set to 'staging', otherwise use prod
-      const environment = process.env.environment || 'production';
-      const baseUrl = environment === 'staging' ? PREP_BASE_URL : PROD_BASE_URL;
-      const discoveryDocument = await this.fetchDiscoveryDocument(baseUrl);
-      this.issuer = discoveryDocument.issuer;
-      this.jwksUri = discoveryDocument.jwks_uri;
-      this.jwks = createRemoteJWKSet(new URL(this.jwksUri), {
-        cacheMaxAge: DEFAULT_JWKS_EXPIRES_IN,
-        cooldownDuration: DEFAULT_JWKS_EXPIRES_IN
-      });
-      this.initialized = true;
-      logger.info(`TokenVerifier initialized with issuer: ${this.issuer} (environment: ${environment})`);
-    } catch (error) {
-      logger.error('Failed to initialize TokenVerifier', error);
-      // Re-throw the original error to preserve specific error messages for tests
-      throw error;
-    }
-  }
-
-  /**
-   * Fetch discovery document from well-known endpoint
-   */
-  private async fetchDiscoveryDocument(baseUrl: string): Promise<DiscoveryDocument> {
-    const wellKnownUrl = `${baseUrl}/.well-known/oauth-authorization-server`;
-
-    const response = await fetch(wellKnownUrl);
-    if (!response.ok) {
-      throw new Error(`Failed to fetch discovery document: ${response.status} ${response.statusText}`);
-    }
-    const discoveryDocument = await response.json() as DiscoveryDocument;
-    if (!discoveryDocument.issuer || !discoveryDocument.jwks_uri) {
-      throw new Error('Invalid discovery document: missing issuer or jwks_uri');
-    }
-
-    return discoveryDocument;
-  }
-
-  private async verifyToken(token: string): Promise<boolean> {
-    if (!this.initialized) {
-      throw new Error('TokenVerifier not initialized. Call initialize() first.');
-    }
-
-    if (!this.jwks || !this.issuer) {
-      throw new Error('TokenVerifier not properly configured.');
-    }
-
-    try {
-      await jwtVerify(token, this.jwks, {
-        issuer: this.issuer,
-        audience: AUDIENCE,
-        clockTolerance: DEFAULT_LEEWAY,
-      });
-      return true;
-    } catch (error) {
-      logger.error('Token verification failed:', error);
-      return false;
-    }
-  }
-
-}
-
-export const getTokenVerifier = async (): Promise<TokenVerifier> => TokenVerifier.getInitializedInstance();