@owox/idp-owox 0.0.0

package/dist/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadIdpOwoxConfigFromEnv = exports.OwoxIdp = void 0;
+var owoxIdp_1 = require("./owoxIdp");
+Object.defineProperty(exports, "OwoxIdp", { enumerable: true, get: function () { return owoxIdp_1.OwoxIdp; } });
+var config_1 = require("./config");
+Object.defineProperty(exports, "loadIdpOwoxConfigFromEnv", { enumerable: true, get: function () { return config_1.loadIdpOwoxConfigFromEnv; } });

package/dist/mappers/idpOwoxPayloadToPayloadMapper.d.ts

@@ -0,0 +1,3 @@
+import { Payload } from '@owox/idp-protocol';
+export declare function toPayload(input: unknown): Payload;
+//# sourceMappingURL=idpOwoxPayloadToPayloadMapper.d.ts.map

package/dist/mappers/idpOwoxPayloadToPayloadMapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idpOwoxPayloadToPayloadMapper.d.ts","sourceRoot":"","sources":["../../src/mappers/idpOwoxPayloadToPayloadMapper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAiB,MAAM,oBAAoB,CAAC;AAY5D,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEjD"}

package/dist/mappers/idpOwoxPayloadToPayloadMapper.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPayload = toPayload;
+const client_1 = require("../client");
+const idp_protocol_1 = require("@owox/idp-protocol");
+const IdpOwoxToPayloadSchema = client_1.IdpOwoxPayloadSchema.transform(src => ({
+    userId: src.userId,
+    projectId: src.projectId,
+    email: src.userEmail,
+    fullName: src.userFullName,
+    avatar: src.userAvatar,
+    roles: src.roles,
+    projectTitle: src.projectTitle,
+})).pipe(idp_protocol_1.PayloadSchema);
+function toPayload(input) {
+    return IdpOwoxToPayloadSchema.parse(input);
+}

package/dist/owoxIdp.d.ts

@@ -0,0 +1,25 @@
+import { AuthResult, IdpProvider, Payload } from '@owox/idp-protocol';
+import e, { NextFunction } from 'express';
+import { IdpOwoxConfig } from './config';
+export declare class OwoxIdp implements IdpProvider {
+    private readonly config;
+    private readonly store;
+    private readonly identityClient;
+    constructor(config: IdpOwoxConfig);
+    initialize(): Promise<void>;
+    introspectToken(token: string): Promise<Payload | null>;
+    parseToken(token: string): Promise<Payload | null>;
+    refreshToken(refreshToken: string): Promise<AuthResult>;
+    revokeToken(token: string): Promise<void>;
+    shutdown(): Promise<void>;
+    signInMiddleware(_req: e.Request, res: e.Response, _next: NextFunction): Promise<void | e.Response>;
+    signOutMiddleware(req: e.Request, res: e.Response, _next: NextFunction): Promise<void | e.Response>;
+    userApiMiddleware(req: e.Request, res: e.Response): Promise<e.Response<Payload>>;
+    accessTokenMiddleware(req: e.Request, res: e.Response, _next: NextFunction): Promise<void | e.Response>;
+    registerRoutes(app: e.Express): void;
+    private changeAuthCode;
+    private setTokenToCookie;
+    private normalizeToken;
+    private formatError;
+}
+//# sourceMappingURL=owoxIdp.d.ts.map

package/dist/owoxIdp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owoxIdp.d.ts","sourceRoot":"","sources":["../src/owoxIdp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAiB,MAAM,oBAAoB,CAAC;AACrF,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAkBzC,qBAAa,OAAQ,YAAW,WAAW;IAI7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;gBAEvB,MAAM,EAAE,aAAa;IAKlD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAW7D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAU5C,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAiBvD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAInB,gBAAgB,CACpB,IAAI,EAAE,CAAC,CAAC,OAAO,EACf,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IAYvB,iBAAiB,CACrB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IASvB,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAchF,qBAAqB,CACzB,GAAG,EAAE,CAAC,CAAC,OAAO,EACd,GAAG,EAAE,CAAC,CAAC,QAAQ,EACf,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IA0B7B,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI;YAyBtB,cAAc;IAgB5B,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,WAAW;CAOpB"}

package/dist/owoxIdp.js

@@ -0,0 +1,172 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OwoxIdp = void 0;
+const idp_protocol_1 = require("@owox/idp-protocol");
+const client_1 = require("./client");
+const AuthorizationStoreFactory_1 = require("./auth/AuthorizationStoreFactory");
+const parseToken_1 = require("./token/parseToken");
+const pkce_1 = require("./pkce");
+const idpOwoxPayloadToPayloadMapper_1 = require("./mappers/idpOwoxPayloadToPayloadMapper");
+const ms_1 = __importDefault(require("ms"));
+const COOKIE_NAME = 'refreshToken';
+class OwoxIdp {
+    config;
+    store;
+    identityClient;
+    constructor(config) {
+        this.config = config;
+        this.store = (0, AuthorizationStoreFactory_1.createAuthorizationStore)(config.dbConfig);
+        this.identityClient = new client_1.IdentityOwoxClient(config.identityOwoxClientConfig);
+    }
+    initialize() {
+        return this.store.initialize();
+    }
+    async introspectToken(token) {
+        const request = { token: token };
+        const response = await this.identityClient.introspectToken(request);
+        if (!response.isActive) {
+            return null;
+        }
+        return (0, idpOwoxPayloadToPayloadMapper_1.toPayload)(response);
+    }
+    parseToken(token) {
+        const config = {
+            jwtKeyCacheTtl: this.config.jwtConfig.jwtKeyCacheTtl,
+            clockTolerance: this.config.jwtConfig.clockTolerance,
+            expectedIss: this.config.jwtConfig.issuer,
+            algorithm: this.config.jwtConfig.algorithm,
+        };
+        return (0, parseToken_1.parseToken)(this.normalizeToken(token), this.identityClient, config);
+    }
+    async refreshToken(refreshToken) {
+        const request = {
+            grantType: 'refresh_token',
+            refreshToken: refreshToken,
+            clientId: this.config.idpConfig.clientId,
+        };
+        const response = await this.identityClient.getToken(request);
+        return {
+            accessToken: response.accessToken,
+            refreshToken: response.refreshToken,
+            accessTokenExpiresIn: response.accessTokenExpiresIn,
+            refreshTokenExpiresIn: response.refreshTokenExpiresIn,
+        };
+    }
+    async revokeToken(token) {
+        const request = { token: token, tokenType: 'refresh_token' };
+        await this.identityClient.revokeToken(request);
+    }
+    shutdown() {
+        return this.store.shutdown();
+    }
+    async signInMiddleware(_req, res, _next) {
+        const { codeVerifier, codeChallenge } = await (0, pkce_1.generatePkce)();
+        const state = (0, pkce_1.generateState)();
+        const clientId = this.config.idpConfig.clientId;
+        const expiresAt = new Date(Date.now() + (0, ms_1.default)('1m'));
+        await this.store.save(state, codeVerifier, expiresAt);
+        const url = `${this.config.idpConfig.platformSignInUrl}?state=${state}&codeChallenge=${codeChallenge}&clientId=${clientId}`;
+        res.redirect(url);
+    }
+    async signOutMiddleware(req, res, _next) {
+        const refreshToken = req.cookies[COOKIE_NAME];
+        if (refreshToken) {
+            await this.revokeToken(refreshToken);
+        }
+        res.clearCookie(COOKIE_NAME);
+        res.redirect(idp_protocol_1.ProtocolRoute.SIGN_IN);
+    }
+    async userApiMiddleware(req, res) {
+        const accessToken = req.headers['x-owox-authorization'];
+        if (!accessToken) {
+            return res.status(401).json({ message: 'Unauthorized', reason: 'uam1' });
+        }
+        const payload = await this.parseToken(accessToken);
+        if (!payload) {
+            return res.status(401).json({ message: 'Unauthorized', reason: 'uam2' });
+        }
+        return res.json(payload);
+    }
+    async accessTokenMiddleware(req, res, _next) {
+        try {
+            const refreshToken = req.cookies[COOKIE_NAME];
+            if (!refreshToken) {
+                return res.json({ reason: 'atm1' });
+            }
+            const auth = await this.refreshToken(refreshToken);
+            const newRefreshToken = auth.refreshToken;
+            if (!newRefreshToken) {
+                return res.json({ reason: 'atm2' });
+            }
+            if (!auth.refreshTokenExpiresIn) {
+                return res.json({ reason: 'atm3' });
+            }
+            this.setTokenToCookie(res, req, newRefreshToken, auth.refreshTokenExpiresIn);
+            return res.json(auth);
+        }
+        catch (error) {
+            console.log(this.formatError(error));
+            res.clearCookie(COOKIE_NAME);
+            return res.json({ reason: 'atm4' });
+        }
+    }
+    registerRoutes(app) {
+        app.get(this.config.idpConfig.callbackUrl, async (req, res) => {
+            const code = req.query.code;
+            const state = req.query.state;
+            if (!code) {
+                console.log('Redirect url should contain code param');
+                return res.redirect(idp_protocol_1.ProtocolRoute.SIGN_IN);
+            }
+            if (!state) {
+                console.log('Redirect url should contain state param');
+                return res.redirect(idp_protocol_1.ProtocolRoute.SIGN_IN);
+            }
+            try {
+                const response = await this.changeAuthCode(code, state);
+                this.setTokenToCookie(res, req, response.refreshToken, response.refreshTokenExpiresIn);
+                res.redirect('/');
+            }
+            catch (error) {
+                console.log(this.formatError(error));
+                return res.redirect(idp_protocol_1.ProtocolRoute.SIGN_IN);
+            }
+        });
+    }
+    async changeAuthCode(code, state) {
+        const codeVerifier = await this.store.get(state);
+        if (!codeVerifier) {
+            throw Error('Code verifier is empty');
+        }
+        const request = {
+            grantType: 'authorization_code',
+            authCode: code,
+            codeVerifier: codeVerifier,
+            clientId: this.config.idpConfig.clientId,
+        };
+        return await this.identityClient.getToken(request);
+    }
+    setTokenToCookie(res, req, refreshToken, expiresIn) {
+        const isSecure = req.protocol !== 'http' && !(req.hostname === 'localhost' || req.hostname === '127.0.0.1');
+        res.cookie(COOKIE_NAME, refreshToken, {
+            httpOnly: true,
+            secure: isSecure,
+            sameSite: 'lax',
+            maxAge: expiresIn * 1000,
+            path: '/',
+        });
+    }
+    normalizeToken(authorization) {
+        return authorization.replace(/^Bearer\s+/i, '').trim();
+    }
+    formatError(error) {
+        if (error instanceof Error) {
+            return `${error.message}\n${error.stack ?? ''}`;
+        }
+        return String(error);
+    }
+}
+exports.OwoxIdp = OwoxIdp;

package/dist/pkce.d.ts

@@ -0,0 +1,21 @@
+export interface PkceDto {
+    codeVerifier: string;
+    codeChallenge: string;
+}
+/**
+ * Generates a PKCE (Proof Key for Code Exchange) pair consisting of a code verifier and a code challenge.
+ *
+ * @param {number} [length=86] - The desired length of the code verifier. Defaults to 86 if not specified.
+ * @return {Promise<{codeVerifier: string, codeChallenge: string}>} A promise that resolves to an object containing the code verifier and code challenge.
+ */
+export declare function generatePkce(length?: number): Promise<PkceDto>;
+/**
+ * Generates a random string state encoded in Base64 URL format.
+ * Optionally allows truncation of the generated state to a specific length.
+ *
+ * @param {number} [bytes=32] - The number of random bytes to generate.
+ * @param {number} [targetLen] - The desired length of the output string. If not specified, the full generated string is returned.
+ * @return {string} - A randomly generated Base64 URL-encoded string. If targetLen is provided, returns a substring of the specified length.
+ */
+export declare function generateState(bytes?: number, targetLen?: number): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,OAAO;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAGxE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAG5E"}

package/dist/pkce.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePkce = generatePkce;
+exports.generateState = generateState;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const pkce_challenge_1 = __importDefault(require("pkce-challenge"));
+/**
+ * Generates a PKCE (Proof Key for Code Exchange) pair consisting of a code verifier and a code challenge.
+ *
+ * @param {number} [length=86] - The desired length of the code verifier. Defaults to 86 if not specified.
+ * @return {Promise<{codeVerifier: string, codeChallenge: string}>} A promise that resolves to an object containing the code verifier and code challenge.
+ */
+async function generatePkce(length = 86) {
+    const { code_verifier, code_challenge } = await (0, pkce_challenge_1.default)(length);
+    return { codeVerifier: code_verifier, codeChallenge: code_challenge };
+}
+/**
+ * Generates a random string state encoded in Base64 URL format.
+ * Optionally allows truncation of the generated state to a specific length.
+ *
+ * @param {number} [bytes=32] - The number of random bytes to generate.
+ * @param {number} [targetLen] - The desired length of the output string. If not specified, the full generated string is returned.
+ * @return {string} - A randomly generated Base64 URL-encoded string. If targetLen is provided, returns a substring of the specified length.
+ */
+function generateState(bytes = 32, targetLen) {
+    const state = base64url(node_crypto_1.default.randomBytes(bytes));
+    return targetLen ? state.slice(0, targetLen) : state;
+}
+function base64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}

package/dist/token/jwksCache.d.ts

@@ -0,0 +1,19 @@
+import { createLocalJWKSet, JWK } from 'jose';
+export interface JWKSet {
+    keys: JWK[];
+}
+export interface JwksFetcher {
+    (): Promise<JWKSet>;
+}
+interface CacheEntry {
+    jwks: JWKSet;
+    keyResolver: ReturnType<typeof createLocalJWKSet>;
+    exp: number;
+    inflight?: Promise<CacheEntry>;
+}
+export declare function makeJwksCache(fetchJwks: JwksFetcher, key: string): {
+    get: (ttlMs: number) => Promise<CacheEntry>;
+    refresh: (ttlMs: number) => Promise<CacheEntry>;
+};
+export {};
+//# sourceMappingURL=jwksCache.d.ts.map

package/dist/token/jwksCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwksCache.d.ts","sourceRoot":"","sources":["../../src/token/jwksCache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAE9C,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,GAAG,EAAE,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACrB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CAChC;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM;iBA2BrC,MAAM,KAAG,OAAO,CAAC,UAAU,CAAC;qBAMxB,MAAM;EAKrC"}

package/dist/token/jwksCache.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeJwksCache = makeJwksCache;
+const jose_1 = require("jose");
+function makeJwksCache(fetchJwks, key) {
+    const cache = new Map();
+    async function load(ttlMs) {
+        const existing = cache.get(key);
+        if (existing?.inflight)
+            return existing.inflight;
+        const inflight = (async () => {
+            const jwks = await fetchJwks();
+            const cacheEntry = {
+                jwks,
+                keyResolver: (0, jose_1.createLocalJWKSet)(jwks),
+                exp: Date.now() + ttlMs,
+            };
+            cache.set(key, cacheEntry);
+            return cacheEntry;
+        })();
+        cache.set(key, { ...(existing ?? {}), inflight });
+        try {
+            return await inflight;
+        }
+        finally {
+            const cacheEntry = cache.get(key);
+            if (cacheEntry)
+                cacheEntry.inflight = undefined;
+        }
+    }
+    async function get(ttlMs) {
+        const cacheEntry = cache.get(key);
+        if (!cacheEntry || cacheEntry.exp <= Date.now())
+            return load(ttlMs);
+        return cacheEntry;
+    }
+    async function refresh(ttlMs) {
+        return load(ttlMs);
+    }
+    return { get, refresh };
+}

package/dist/token/parseToken.d.ts

@@ -0,0 +1,11 @@
+import { Payload } from '@owox/idp-protocol';
+import { IdentityOwoxClient } from '../client';
+import ms from 'ms';
+export interface ParseTokenConfig {
+    jwtKeyCacheTtl: ms.StringValue;
+    clockTolerance: string | number;
+    expectedIss: string;
+    algorithm: string;
+}
+export declare function parseToken(token: string, client: IdentityOwoxClient, config: ParseTokenConfig): Promise<Payload>;
+//# sourceMappingURL=parseToken.d.ts.map

package/dist/token/parseToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseToken.d.ts","sourceRoot":"","sources":["../../src/token/parseToken.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,EAAE,CAAC,WAAW,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,CA0BlB"}

package/dist/token/parseToken.js

@@ -0,0 +1,29 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseToken = parseToken;
+const jose_1 = require("jose");
+const jwksCache_1 = require("./jwksCache");
+const verifyJwt_1 = require("./verifyJwt");
+const idpOwoxPayloadToPayloadMapper_1 = require("../mappers/idpOwoxPayloadToPayloadMapper");
+const ms_1 = __importDefault(require("ms"));
+async function parseToken(token, client, config) {
+    const { alg } = (0, jose_1.decodeProtectedHeader)(token);
+    if (alg && alg !== config.algorithm) {
+        throw new Error(`Unsupported JWT alg: ${alg}`);
+    }
+    const fetchJwks = async () => {
+        const resp = await client.getJwks();
+        return { keys: resp.keys };
+    };
+    const cacheKey = 'JWKS_KEYS';
+    const cache = (0, jwksCache_1.makeJwksCache)(fetchJwks, cacheKey);
+    const { payload } = await (0, verifyJwt_1.verify)(token, async () => (await cache.get((0, ms_1.default)(config.jwtKeyCacheTtl))).keyResolver, async () => (await cache.refresh((0, ms_1.default)(config.jwtKeyCacheTtl))).keyResolver, {
+        algorithm: config.algorithm,
+        clockTolerance: config.clockTolerance,
+        issuer: config.expectedIss,
+    });
+    return (0, idpOwoxPayloadToPayloadMapper_1.toPayload)(payload);
+}

package/dist/token/verifyJwt.d.ts

@@ -0,0 +1,9 @@
+import { createLocalJWKSet } from 'jose';
+interface verifyConfig {
+    algorithm: string;
+    clockTolerance: string | number;
+    issuer: string;
+}
+export declare function verify(token: string, getKeyResolver: () => Promise<ReturnType<typeof createLocalJWKSet>>, refreshKeyResolver: () => Promise<ReturnType<typeof createLocalJWKSet>>, config: verifyConfig): Promise<import("jose", { with: { "resolution-mode": "import" } }).JWTVerifyResult<import("jose", { with: { "resolution-mode": "import" } }).JWTPayload> & import("jose", { with: { "resolution-mode": "import" } }).ResolvedKey>;
+export {};
+//# sourceMappingURL=verifyJwt.d.ts.map

package/dist/token/verifyJwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyJwt.d.ts","sourceRoot":"","sources":["../../src/token/verifyJwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAIpD,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,EACnE,kBAAkB,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,EACvE,MAAM,EAAE,YAAY,oOAmBrB"}

package/dist/token/verifyJwt.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verify = verify;
+const jose_1 = require("jose");
+const errors_1 = require("jose/errors");
+async function verify(token, getKeyResolver, refreshKeyResolver, config) {
+    const jwtVerifyOptions = {
+        algorithms: [config.algorithm],
+        clockTolerance: config.clockTolerance,
+        issuer: config.issuer,
+    };
+    try {
+        const key = await getKeyResolver();
+        return await (0, jose_1.jwtVerify)(token, key, jwtVerifyOptions);
+    }
+    catch (err) {
+        const shouldRefreshKey = err instanceof errors_1.JWKSNoMatchingKey || err instanceof errors_1.JWSSignatureVerificationFailed;
+        if (!shouldRefreshKey)
+            throw err;
+        const keyAfterReload = await refreshKeyResolver();
+        return await (0, jose_1.jwtVerify)(token, keyAfterReload, jwtVerifyOptions);
+    }
+}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@owox/idp-owox",
+  "version": "0.0.0",
+  "description": "Identity Provider implementation from OWOX",
+  "author": "OWOX",
+  "license": "ELv2",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "build:dep": "npm run build:idp-protocol",
+    "build:idp-protocol": "npm run build -w @owox/idp-protocol --prefix ../..",
+    "clean": "rimraf dist",
+    "test": "jest",
+    "lint": "eslint . --config ./eslint.config.js",
+    "lint:fix": "eslint . --fix --config ./eslint.config.js",
+    "format": "prettier --write \"**/*.{ts,js,json,md}\"",
+    "format:check": "prettier --check \"**/*.{ts,js,json,md}\"",
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm audit && npm run lint && npm run typecheck"
+  },
+  "dependencies": {
+    "@owox/idp-protocol": "0.5.0",
+    "pkce-challenge": "^5.0.0",
+    "cookie-parser": "^1.4.7",
+    "env-paths": "^3.0.0",
+    "jose": "^6.0.12",
+    "ms": "^2.1.3",
+    "better-sqlite3": "^12.2.0",
+    "mysql2": "^3.14.3"
+  },
+  "devDependencies": {
+    "@types/cookie-parser": "^1.4.9",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.10.7",
+    "typescript": "^5.7.3",
+    "eslint": "^9.20.1",
+    "prettier": "^3.5.3",
+    "ts-jest": "^29.2.5"
+  },
+  "peerDependencies": {
+    "zod": "^3.25.67"
+  },
+  "engines": {
+    "node": ">=22.16.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  }
+}