@pallasoft/ps-utilities 2.5.0 → 2.7.0

package/dist/common/constants/email-preview-config.d.ts

@@ -4,6 +4,7 @@ export declare const EmailPreviewConfig: {
     readonly imageName: "email.png";
     readonly imageContentType: "image/png";
     readonly fallbackSubject: "Email";
+    readonly dateFormat: "D MMM YYYY, h:mm A";
     readonly page: {
         readonly width: 860;
         readonly padding: 48;
@@ -13,7 +14,7 @@ export declare const EmailPreviewConfig: {
         readonly bodySize: 15;
         readonly lineHeight: 24;
         readonly maxLines: 140;
-        readonly minHeight: 520;
+        readonly minHeight: 320;
         readonly charWidth: 7.4;
         readonly subjectWidthRatio: 1.45;
         readonly metaWidthRatio: 0.9;

package/dist/common/constants/email-preview-config.js

@@ -7,6 +7,7 @@ exports.EmailPreviewConfig = {
     imageName: 'email.png',
     imageContentType: 'image/png',
     fallbackSubject: 'Email',
+    dateFormat: 'D MMM YYYY, h:mm A',
     page: {
         width: 860,
         padding: 48,
@@ -16,7 +17,7 @@ exports.EmailPreviewConfig = {
         bodySize: 15,
         lineHeight: 24,
         maxLines: 140,
-        minHeight: 520,
+        minHeight: 320,
         charWidth: 7.4,
         subjectWidthRatio: 1.45,
         metaWidthRatio: 0.9,

package/dist/common/constants/index.d.ts

@@ -1 +1,3 @@
 export * from './email-preview-config';
+export * from './signed-token-config';
+export * from './user-token-config';

package/dist/common/constants/index.js

@@ -15,3 +15,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./email-preview-config"), exports);
+__exportStar(require("./signed-token-config"), exports);
+__exportStar(require("./user-token-config"), exports);

package/dist/common/constants/signed-token-config.d.ts

@@ -0,0 +1,17 @@
+export declare const SignedTokenConfig: {
+    readonly algorithm: "ES256";
+    readonly type: "JWT";
+    readonly keyAlgorithm: {
+        readonly name: "ECDSA";
+        readonly namedCurve: "P-256";
+    };
+    readonly signAlgorithm: {
+        readonly name: "ECDSA";
+        readonly hash: "SHA-256";
+    };
+    readonly privateKeyFormat: "pkcs8";
+    readonly publicKeyFormat: "spki";
+    readonly separator: ".";
+    readonly partCount: 3;
+    readonly keyCacheLimit: 20;
+};

package/dist/common/constants/signed-token-config.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignedTokenConfig = void 0;
+exports.SignedTokenConfig = {
+    algorithm: 'ES256',
+    type: 'JWT',
+    keyAlgorithm: { name: 'ECDSA', namedCurve: 'P-256' },
+    signAlgorithm: { name: 'ECDSA', hash: 'SHA-256' },
+    privateKeyFormat: 'pkcs8',
+    publicKeyFormat: 'spki',
+    separator: '.',
+    partCount: 3,
+    keyCacheLimit: 20,
+};

package/dist/common/constants/user-token-config.d.ts

@@ -0,0 +1,6 @@
+export declare const UserTokenConfig: {
+    readonly defaultLifetimeSeconds: 60;
+    readonly maxLifetimeSeconds: 120;
+    readonly clockSkewSeconds: 5;
+    readonly millisecondsPerSecond: 1000;
+};

package/dist/common/constants/user-token-config.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserTokenConfig = void 0;
+exports.UserTokenConfig = {
+    defaultLifetimeSeconds: 60,
+    maxLifetimeSeconds: 120,
+    clockSkewSeconds: 5,
+    millisecondsPerSecond: 1000,
+};

package/dist/common/email-preview-service.d.ts

@@ -2,6 +2,7 @@ import type { EmailPreviewInput } from '../models/email-preview-input';
 export declare class EmailPreviewService {
     static escape(value: string): string;
     static hasContent(input: EmailPreviewInput): boolean;
+    static receivedOf(input: EmailPreviewInput): string;
     static subjectOf(input: EmailPreviewInput): string;
     static toText(input: EmailPreviewInput): string;
     static toDocument(input: EmailPreviewInput): string;

package/dist/common/email-preview-service.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EmailPreviewService = void 0;
 var email_preview_config_1 = require("./constants/email-preview-config");
+var date_service_1 = require("./date-service");
 var EmailPreviewService = /** @class */ (function () {
     function EmailPreviewService() {
     }
@@ -17,6 +18,9 @@ var EmailPreviewService = /** @class */ (function () {
         return ((input.html !== null && input.html.trim() !== '') ||
             (input.text !== null && input.text.trim() !== ''));
     };
+    EmailPreviewService.receivedOf = function (input) {
+        return date_service_1.DateService.formatDateInTimezone(input.receivedAt, input.timezone, email_preview_config_1.EmailPreviewConfig.dateFormat);
+    };
     EmailPreviewService.subjectOf = function (input) {
         return input.subject === null || input.subject.trim() === ''
             ? email_preview_config_1.EmailPreviewConfig.fallbackSubject
@@ -34,13 +38,13 @@ var EmailPreviewService = /** @class */ (function () {
         var body = input.html !== null && input.html.trim() !== ''
             ? EmailPreviewService.body(input.html)
             : "<pre style=\"white-space:pre-wrap;font-family:inherit;margin:0;\">".concat(EmailPreviewService.escape(input.text === null ? '' : input.text), "</pre>");
-        return "<!doctype html>\n<html lang=\"en\">\n\t<head>\n\t\t<meta charset=\"utf-8\" />\n\t\t<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n\t\t<title>".concat(EmailPreviewService.escape(subject), "</title>\n\t</head>\n\t<body style=\"margin:0;padding:24px;background:#f5f7fa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:#101828;\">\n\t\t<div style=\"max-width:760px;margin:0 auto;background:#ffffff;border:1px solid #e4e8ee;border-radius:12px;overflow:hidden;\">\n\t\t\t<div style=\"padding:16px 20px;border-bottom:1px solid #e4e8ee;background:#f9fafb;\">\n\t\t\t\t<div style=\"font-size:15px;font-weight:700;\">").concat(EmailPreviewService.escape(subject), "</div>\n\t\t\t\t<div style=\"margin-top:4px;font-size:12px;color:#667085;\">From ").concat(EmailPreviewService.escape(input.from), " \u00B7 ").concat(EmailPreviewService.escape(input.receivedAt), "</div>\n\t\t\t</div>\n\t\t\t<div style=\"padding:20px;\">").concat(body, "</div>\n\t\t</div>\n\t</body>\n</html>");
+        return "<!doctype html>\n<html lang=\"en\">\n\t<head>\n\t\t<meta charset=\"utf-8\" />\n\t\t<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n\t\t<title>".concat(EmailPreviewService.escape(subject), "</title>\n\t</head>\n\t<body style=\"margin:0;padding:24px;background:#f5f7fa;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:#101828;\">\n\t\t<div style=\"max-width:760px;margin:0 auto;background:#ffffff;border:1px solid #e4e8ee;border-radius:12px;overflow:hidden;\">\n\t\t\t<div style=\"padding:16px 20px;border-bottom:1px solid #e4e8ee;background:#f9fafb;\">\n\t\t\t\t<div style=\"font-size:15px;font-weight:700;\">").concat(EmailPreviewService.escape(subject), "</div>\n\t\t\t\t<div style=\"margin-top:4px;font-size:12px;color:#667085;\">From ").concat(EmailPreviewService.escape(input.from), " \u00B7 ").concat(EmailPreviewService.escape(EmailPreviewService.receivedOf(input)), "</div>\n\t\t\t</div>\n\t\t\t<div style=\"padding:20px;\">").concat(body, "</div>\n\t\t</div>\n\t</body>\n</html>");
     };
     EmailPreviewService.toImageMarkup = function (input) {
         var page = email_preview_config_1.EmailPreviewConfig.page;
         var width = page.width - page.padding * 2;
         var subject = EmailPreviewService.clip(EmailPreviewService.subjectOf(input), Math.floor(width / (page.charWidth * page.subjectWidthRatio)));
-        var meta = EmailPreviewService.clip("From ".concat(input.from, " \u00B7 ").concat(input.receivedAt), Math.floor(width / (page.charWidth * page.metaWidthRatio)));
+        var meta = EmailPreviewService.clip("From ".concat(input.from, " \u00B7 ").concat(EmailPreviewService.receivedOf(input)), Math.floor(width / (page.charWidth * page.metaWidthRatio)));
         var lines = EmailPreviewService.wrap(EmailPreviewService.toText(input), Math.floor(width / page.charWidth)).slice(0, page.maxLines);
         var metaBaseline = page.padding + page.subjectSize + 10 + page.metaSize;
         var bodyTop = metaBaseline + page.headerGap;

package/dist/common/index.d.ts

@@ -7,6 +7,8 @@ export * from './envelope-crypto-service';
 export * from './date-service';
 export * from './number-format-service';
 export * from './recaptcha-service';
+export * from './signed-token-service';
 export * from './url-service';
 export * from './string-service';
 export * from './transform-service';
+export * from './user-token-service';

package/dist/common/index.js

@@ -23,6 +23,8 @@ __exportStar(require("./envelope-crypto-service"), exports);
 __exportStar(require("./date-service"), exports);
 __exportStar(require("./number-format-service"), exports);
 __exportStar(require("./recaptcha-service"), exports);
+__exportStar(require("./signed-token-service"), exports);
 __exportStar(require("./url-service"), exports);
 __exportStar(require("./string-service"), exports);
 __exportStar(require("./transform-service"), exports);
+__exportStar(require("./user-token-service"), exports);

package/dist/common/signed-token-service.d.ts

@@ -0,0 +1,19 @@
+import type { SignedTokenKeyPair } from '../models/signed-token-key-pair';
+export declare class SignedTokenService {
+    private static _textEncoder;
+    private static _textDecoder;
+    private static _privateKeys;
+    private static _publicKeys;
+    static generateKeyPair(): Promise<SignedTokenKeyPair>;
+    static sign<Claims extends object>(claims: Claims, privateKey: string): Promise<string>;
+    static verify<Claims extends object>(token: string, publicKeys: string[]): Promise<Claims | null>;
+    private static _privateKey;
+    private static _publicKey;
+    private static _remember;
+    private static _encodeJson;
+    private static _decodeJson;
+    private static _toBase64;
+    private static _fromBase64;
+    private static _toBase64Url;
+    private static _fromBase64Url;
+}

package/dist/common/signed-token-service.js

@@ -0,0 +1,233 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignedTokenService = void 0;
+var signed_token_config_1 = require("./constants/signed-token-config");
+var SignedTokenService = /** @class */ (function () {
+    function SignedTokenService() {
+    }
+    SignedTokenService.generateKeyPair = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var pair, privateKey, publicKey;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, crypto.subtle.generateKey(signed_token_config_1.SignedTokenConfig.keyAlgorithm, true, [
+                            'sign',
+                            'verify',
+                        ])];
+                    case 1:
+                        pair = (_a.sent());
+                        return [4 /*yield*/, crypto.subtle.exportKey(signed_token_config_1.SignedTokenConfig.privateKeyFormat, pair.privateKey)];
+                    case 2:
+                        privateKey = _a.sent();
+                        return [4 /*yield*/, crypto.subtle.exportKey(signed_token_config_1.SignedTokenConfig.publicKeyFormat, pair.publicKey)];
+                    case 3:
+                        publicKey = _a.sent();
+                        return [2 /*return*/, {
+                                privateKey: this._toBase64(new Uint8Array(privateKey)),
+                                publicKey: this._toBase64(new Uint8Array(publicKey)),
+                            }];
+                }
+            });
+        });
+    };
+    SignedTokenService.sign = function (claims, privateKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var header, signingInput, signature, _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        header = {
+                            alg: signed_token_config_1.SignedTokenConfig.algorithm,
+                            typ: signed_token_config_1.SignedTokenConfig.type,
+                        };
+                        signingInput = "".concat(this._encodeJson(header)).concat(signed_token_config_1.SignedTokenConfig.separator).concat(this._encodeJson(claims));
+                        _b = (_a = crypto.subtle).sign;
+                        _c = [signed_token_config_1.SignedTokenConfig.signAlgorithm];
+                        return [4 /*yield*/, this._privateKey(privateKey)];
+                    case 1: return [4 /*yield*/, _b.apply(_a, _c.concat([_d.sent(), this._textEncoder.encode(signingInput)]))];
+                    case 2:
+                        signature = _d.sent();
+                        return [2 /*return*/, "".concat(signingInput).concat(signed_token_config_1.SignedTokenConfig.separator).concat(this._toBase64Url(new Uint8Array(signature)))];
+                }
+            });
+        });
+    };
+    SignedTokenService.verify = function (token, publicKeys) {
+        return __awaiter(this, void 0, void 0, function () {
+            var parts, encodedHeader, encodedClaims, encodedSignature, header, signature, signingInput, _i, publicKeys_1, publicKey, key, isValid;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        parts = token.split(signed_token_config_1.SignedTokenConfig.separator);
+                        if (parts.length !== signed_token_config_1.SignedTokenConfig.partCount)
+                            return [2 /*return*/, null];
+                        encodedHeader = parts[0], encodedClaims = parts[1], encodedSignature = parts[2];
+                        header = this._decodeJson(encodedHeader);
+                        if (header === null ||
+                            header.alg !== signed_token_config_1.SignedTokenConfig.algorithm ||
+                            header.typ !== signed_token_config_1.SignedTokenConfig.type)
+                            return [2 /*return*/, null];
+                        signature = this._fromBase64Url(encodedSignature);
+                        if (signature === null)
+                            return [2 /*return*/, null];
+                        signingInput = this._textEncoder.encode("".concat(encodedHeader).concat(signed_token_config_1.SignedTokenConfig.separator).concat(encodedClaims));
+                        _i = 0, publicKeys_1 = publicKeys;
+                        _a.label = 1;
+                    case 1:
+                        if (!(_i < publicKeys_1.length)) return [3 /*break*/, 5];
+                        publicKey = publicKeys_1[_i];
+                        return [4 /*yield*/, this._publicKey(publicKey).catch(function () { return null; })];
+                    case 2:
+                        key = _a.sent();
+                        if (key === null)
+                            return [3 /*break*/, 4];
+                        return [4 /*yield*/, crypto.subtle
+                                .verify(signed_token_config_1.SignedTokenConfig.signAlgorithm, key, signature, signingInput)
+                                .catch(function () { return false; })];
+                    case 3:
+                        isValid = _a.sent();
+                        if (isValid)
+                            return [2 /*return*/, this._decodeJson(encodedClaims)];
+                        _a.label = 4;
+                    case 4:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 5: return [2 /*return*/, null];
+                }
+            });
+        });
+    };
+    SignedTokenService._privateKey = function (privateKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var cached, key;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        cached = this._privateKeys.get(privateKey);
+                        if (cached !== undefined)
+                            return [2 /*return*/, cached];
+                        return [4 /*yield*/, crypto.subtle.importKey(signed_token_config_1.SignedTokenConfig.privateKeyFormat, this._fromBase64(privateKey), signed_token_config_1.SignedTokenConfig.keyAlgorithm, false, ['sign'])];
+                    case 1:
+                        key = _a.sent();
+                        this._remember(this._privateKeys, privateKey, key);
+                        return [2 /*return*/, key];
+                }
+            });
+        });
+    };
+    SignedTokenService._publicKey = function (publicKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var cached, key;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        cached = this._publicKeys.get(publicKey);
+                        if (cached !== undefined)
+                            return [2 /*return*/, cached];
+                        return [4 /*yield*/, crypto.subtle.importKey(signed_token_config_1.SignedTokenConfig.publicKeyFormat, this._fromBase64(publicKey), signed_token_config_1.SignedTokenConfig.keyAlgorithm, false, ['verify'])];
+                    case 1:
+                        key = _a.sent();
+                        this._remember(this._publicKeys, publicKey, key);
+                        return [2 /*return*/, key];
+                }
+            });
+        });
+    };
+    SignedTokenService._remember = function (cache, source, key) {
+        if (cache.size >= signed_token_config_1.SignedTokenConfig.keyCacheLimit) {
+            var oldest = cache.keys().next().value;
+            if (oldest !== undefined)
+                cache.delete(oldest);
+        }
+        cache.set(source, key);
+    };
+    SignedTokenService._encodeJson = function (value) {
+        return this._toBase64Url(this._textEncoder.encode(JSON.stringify(value)));
+    };
+    SignedTokenService._decodeJson = function (encoded) {
+        var bytes = this._fromBase64Url(encoded);
+        if (bytes === null)
+            return null;
+        try {
+            var value = JSON.parse(this._textDecoder.decode(bytes));
+            return typeof value === 'object' && value !== null && !Array.isArray(value)
+                ? value
+                : null;
+        }
+        catch (_a) {
+            return null;
+        }
+    };
+    SignedTokenService._toBase64 = function (bytes) {
+        var binary = '';
+        for (var index = 0; index < bytes.length; index += 1) {
+            binary += String.fromCharCode(bytes[index]);
+        }
+        return btoa(binary);
+    };
+    SignedTokenService._fromBase64 = function (value) {
+        var binary = atob(value.trim());
+        var bytes = new Uint8Array(binary.length);
+        for (var index = 0; index < binary.length; index += 1) {
+            bytes[index] = binary.charCodeAt(index);
+        }
+        return bytes;
+    };
+    SignedTokenService._toBase64Url = function (bytes) {
+        return this._toBase64(bytes).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    };
+    SignedTokenService._fromBase64Url = function (value) {
+        if (!/^[A-Za-z0-9_-]*$/.test(value))
+            return null;
+        var base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+        var padding = base64.length % 4 === 0 ? '' : '='.repeat(4 - (base64.length % 4));
+        try {
+            return this._fromBase64("".concat(base64).concat(padding));
+        }
+        catch (_a) {
+            return null;
+        }
+    };
+    SignedTokenService._textEncoder = new TextEncoder();
+    SignedTokenService._textDecoder = new TextDecoder();
+    SignedTokenService._privateKeys = new Map();
+    SignedTokenService._publicKeys = new Map();
+    return SignedTokenService;
+}());
+exports.SignedTokenService = SignedTokenService;

package/dist/common/user-token-service.d.ts

@@ -0,0 +1,11 @@
+import type { UserTokenClaims } from '../models/user-token-claims';
+import type { UserTokenIssueOptions } from '../models/user-token-issue-options';
+import type { UserTokenRequest } from '../models/user-token-request';
+import type { UserTokenSubject } from '../models/user-token-subject';
+import type { UserTokenVerifyOptions } from '../models/user-token-verify-options';
+export declare class UserTokenService {
+    static issue(subject: UserTokenSubject, request: UserTokenRequest, options: UserTokenIssueOptions): Promise<string>;
+    static verify(token: string, request: UserTokenRequest, options: UserTokenVerifyOptions): Promise<UserTokenClaims | null>;
+    private static _isWellFormed;
+    private static _now;
+}

package/dist/common/user-token-service.js

@@ -0,0 +1,115 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserTokenService = void 0;
+var user_token_config_1 = require("./constants/user-token-config");
+var signed_token_service_1 = require("./signed-token-service");
+var UserTokenService = /** @class */ (function () {
+    function UserTokenService() {
+    }
+    UserTokenService.issue = function (subject, request, options) {
+        return __awaiter(this, void 0, void 0, function () {
+            var issuedAt, lifetime, claims;
+            return __generator(this, function (_a) {
+                issuedAt = this._now();
+                lifetime = typeof options.lifetimeSeconds === 'number'
+                    ? Math.min(options.lifetimeSeconds, user_token_config_1.UserTokenConfig.maxLifetimeSeconds)
+                    : user_token_config_1.UserTokenConfig.defaultLifetimeSeconds;
+                claims = {
+                    iss: options.issuer,
+                    aud: options.audience,
+                    sub: subject.id,
+                    email: subject.email.trim().toLowerCase(),
+                    name: subject.displayName,
+                    htm: request.method.toUpperCase(),
+                    htu: request.path,
+                    iat: issuedAt,
+                    exp: issuedAt + lifetime,
+                    jti: crypto.randomUUID(),
+                };
+                return [2 /*return*/, signed_token_service_1.SignedTokenService.sign(claims, options.privateKey)];
+            });
+        });
+    };
+    UserTokenService.verify = function (token, request, options) {
+        return __awaiter(this, void 0, void 0, function () {
+            var claims, now, maxLifetime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, signed_token_service_1.SignedTokenService.verify(token, options.publicKeys)];
+                    case 1:
+                        claims = _a.sent();
+                        if (claims === null || !this._isWellFormed(claims))
+                            return [2 /*return*/, null];
+                        now = this._now();
+                        maxLifetime = typeof options.maxLifetimeSeconds === 'number'
+                            ? options.maxLifetimeSeconds
+                            : user_token_config_1.UserTokenConfig.maxLifetimeSeconds;
+                        if (claims.iss !== options.issuer ||
+                            claims.aud !== options.audience ||
+                            claims.htm !== request.method.toUpperCase() ||
+                            claims.htu !== request.path ||
+                            claims.iat > now + user_token_config_1.UserTokenConfig.clockSkewSeconds ||
+                            claims.exp <= now - user_token_config_1.UserTokenConfig.clockSkewSeconds ||
+                            claims.exp - claims.iat > maxLifetime)
+                            return [2 /*return*/, null];
+                        return [2 /*return*/, claims];
+                }
+            });
+        });
+    };
+    UserTokenService._isWellFormed = function (claims) {
+        return (typeof claims.iss === 'string' &&
+            typeof claims.aud === 'string' &&
+            typeof claims.sub === 'string' &&
+            typeof claims.email === 'string' &&
+            claims.email !== '' &&
+            typeof claims.name === 'string' &&
+            typeof claims.htm === 'string' &&
+            typeof claims.htu === 'string' &&
+            typeof claims.iat === 'number' &&
+            typeof claims.exp === 'number' &&
+            typeof claims.jti === 'string' &&
+            claims.jti !== '');
+    };
+    UserTokenService._now = function () {
+        return Math.floor(Date.now() / user_token_config_1.UserTokenConfig.millisecondsPerSecond);
+    };
+    return UserTokenService;
+}());
+exports.UserTokenService = UserTokenService;

package/dist/index.d.ts

@@ -3,5 +3,12 @@ import * as CommonNamespace from './common';
 export declare const Common: typeof CommonNamespace;
 export declare const Client: typeof ClientNamespace;
 export type { EmailPreviewInput } from './models/email-preview-input';
+export type { SignedTokenHeader } from './models/signed-token-header';
+export type { SignedTokenKeyPair } from './models/signed-token-key-pair';
+export type { UserTokenClaims } from './models/user-token-claims';
+export type { UserTokenIssueOptions } from './models/user-token-issue-options';
+export type { UserTokenRequest } from './models/user-token-request';
+export type { UserTokenSubject } from './models/user-token-subject';
+export type { UserTokenVerifyOptions } from './models/user-token-verify-options';
 export type { EncryptedFieldsSpec } from './common/encrypted-fields-service';
 export type { DataKeyPair } from './common/envelope-crypto-service';

package/dist/models/email-preview-input.d.ts

@@ -3,5 +3,6 @@ export interface EmailPreviewInput {
     html: string | null;
     receivedAt: string;
     subject: string | null;
+    timezone: string;
     text: string | null;
 }

package/dist/models/signed-token-header.d.ts

@@ -0,0 +1,4 @@
+export interface SignedTokenHeader {
+    alg: string;
+    typ: string;
+}

package/dist/models/signed-token-header.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/signed-token-key-pair.d.ts

@@ -0,0 +1,4 @@
+export interface SignedTokenKeyPair {
+    privateKey: string;
+    publicKey: string;
+}

package/dist/models/signed-token-key-pair.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/user-token-claims.d.ts

@@ -0,0 +1,12 @@
+export interface UserTokenClaims {
+    iss: string;
+    aud: string;
+    sub: string;
+    email: string;
+    name: string;
+    htm: string;
+    htu: string;
+    iat: number;
+    exp: number;
+    jti: string;
+}

package/dist/models/user-token-claims.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/user-token-issue-options.d.ts

@@ -0,0 +1,6 @@
+export interface UserTokenIssueOptions {
+    issuer: string;
+    audience: string;
+    privateKey: string;
+    lifetimeSeconds?: number;
+}

package/dist/models/user-token-issue-options.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/user-token-request.d.ts

@@ -0,0 +1,4 @@
+export interface UserTokenRequest {
+    method: string;
+    path: string;
+}

package/dist/models/user-token-request.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/user-token-subject.d.ts

@@ -0,0 +1,5 @@
+export interface UserTokenSubject {
+    id: string;
+    email: string;
+    displayName: string;
+}

package/dist/models/user-token-subject.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/models/user-token-verify-options.d.ts

@@ -0,0 +1,6 @@
+export interface UserTokenVerifyOptions {
+    issuer: string;
+    audience: string;
+    publicKeys: string[];
+    maxLifetimeSeconds?: number;
+}

package/dist/models/user-token-verify-options.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@pallasoft/ps-utilities",
-	"version": "2.5.0",
+	"version": "2.7.0",
 	"private": false,
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",