@schemavaults/jwt 0.11.11 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
|
|
2
|
-
import type
|
|
2
|
+
import { type UserData } from "@schemavaults/auth-common";
|
|
3
3
|
import type { I_JWT_Keys } from "./jwt_keys";
|
|
4
4
|
/**
|
|
5
5
|
* OIDC id_token lifetime in seconds. Deliberately short-lived: the
|
|
@@ -26,6 +26,13 @@ export interface GenerateIdTokenOptions {
|
|
|
26
26
|
jwt_keys: I_JWT_Keys;
|
|
27
27
|
environment: SchemaVaultsAppEnvironment;
|
|
28
28
|
auth_server_url?: string;
|
|
29
|
+
/**
|
|
30
|
+
* This deployment's own app id (SCHEMAVAULTS_AUTH_SERVER_APP_ID) —
|
|
31
|
+
* prefixes the `sub` claim as `<auth_server_app_id>|<uid>` (see
|
|
32
|
+
* formatOidcSubClaim in @schemavaults/auth-common). Server-side
|
|
33
|
+
* callers may rely on the env-resolved default.
|
|
34
|
+
*/
|
|
35
|
+
auth_server_app_id?: string;
|
|
29
36
|
}
|
|
30
37
|
export interface GeneratedIdToken {
|
|
31
38
|
id_token: string;
|
|
@@ -39,5 +46,5 @@ export interface GeneratedIdToken {
|
|
|
39
46
|
* platform convention (`<keyset_id>-verification`) so it matches the
|
|
40
47
|
* keys served by the jwks_uri.
|
|
41
48
|
*/
|
|
42
|
-
export declare function generateIdToken({ user, client_id, nonce, scopes, jwt_keys, environment, auth_server_url, }: GenerateIdTokenOptions): Promise<GeneratedIdToken>;
|
|
49
|
+
export declare function generateIdToken({ user, client_id, nonce, scopes, jwt_keys, environment, auth_server_url, auth_server_app_id, }: GenerateIdTokenOptions): Promise<GeneratedIdToken>;
|
|
43
50
|
export default generateIdToken;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { SignJWT } from "jose";
|
|
2
|
-
import { getAuthServerUrl, } from "@schemavaults/app-definitions";
|
|
2
|
+
import { getAuthServerAppId, getAuthServerUrl, } from "@schemavaults/app-definitions";
|
|
3
|
+
import { formatOidcSubClaim } from "@schemavaults/auth-common";
|
|
3
4
|
import signAndVerifyAlg from "./sign_verify_alg";
|
|
4
5
|
import isValidUuid from "../utils/isValidUuid";
|
|
5
6
|
/**
|
|
@@ -15,7 +16,7 @@ export const ID_TOKEN_EXPIRY = 3600;
|
|
|
15
16
|
* platform convention (`<keyset_id>-verification`) so it matches the
|
|
16
17
|
* keys served by the jwks_uri.
|
|
17
18
|
*/
|
|
18
|
-
export async function generateIdToken({ user, client_id, nonce, scopes, jwt_keys, environment, auth_server_url = getAuthServerUrl(environment), }) {
|
|
19
|
+
export async function generateIdToken({ user, client_id, nonce, scopes, jwt_keys, environment, auth_server_url = getAuthServerUrl(environment), auth_server_app_id = getAuthServerAppId(), }) {
|
|
19
20
|
if (typeof user?.uid !== "string" || user.uid.length === 0) {
|
|
20
21
|
throw new TypeError("generateIdToken requires a user with a uid!");
|
|
21
22
|
}
|
|
@@ -49,7 +50,11 @@ export async function generateIdToken({ user, client_id, nonce, scopes, jwt_keys
|
|
|
49
50
|
kid: `${keyset_id}-verification`,
|
|
50
51
|
})
|
|
51
52
|
.setIssuer(auth_server_url)
|
|
52
|
-
|
|
53
|
+
// The OIDC-facing subject is namespaced by this deployment's app id
|
|
54
|
+
// (`<app_id>|<uid>`); /api/oidc/userinfo and introspection MUST
|
|
55
|
+
// report the same form (OIDC Core §5.3.2 — RP libraries reject a
|
|
56
|
+
// userinfo `sub` that differs from the id_token's).
|
|
57
|
+
.setSubject(formatOidcSubClaim(auth_server_app_id, user.uid))
|
|
53
58
|
.setAudience(client_id)
|
|
54
59
|
// jose defaults to the current unix time in SECONDS; do not pass
|
|
55
60
|
// Date.now() here (milliseconds) like sign.ts does for the internal
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generate_id_token.js","sourceRoot":"","sources":["../../src/jwt/generate_id_token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAkB,MAAM,MAAM,CAAC;AAC/C,OAAO,EACL,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"generate_id_token.js","sourceRoot":"","sources":["../../src/jwt/generate_id_token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAkB,MAAM,MAAM,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAiB,MAAM,2BAA2B,CAAC;AAE9E,OAAO,gBAAgB,MAAM,mBAAmB,CAAC;AACjD,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAa,CAAC;AAoC7C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,IAAI,EACJ,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,EACR,WAAW,EACX,eAAe,GAAG,gBAAgB,CAAC,WAAW,CAAC,EAC/C,kBAAkB,GAAG,kBAAkB,EAAE,GAClB;IACvB,IAAI,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAW,QAAQ,CAAC,SAAS,CAAC;IAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,mBAAmB,GAA8B,QAAQ,CAAC,WAAW,CAAC;IAC5E,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAc,MAAM,mBAAmB,CAAC;IAEzD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,CAAC;IAED,MAAM,QAAQ,GAAW,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;SAC/C,kBAAkB,CAAC;QAClB,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,GAAG,SAAS,eAAe;KACjC,CAAC;SACD,SAAS,CAAC,eAAe,CAAC;QAC3B,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,oDAAoD;SACnD,UAAU,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;SAC5D,WAAW,CAAC,SAAS,CAAC;QACvB,iEAAiE;QACjE,oEAAoE;QACpE,6DAA6D;SAC5D,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,eAAe,GAAG,CAAC;SACxC,IAAI,CAAC,WAAW,CAAC,CAAC;IAErB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,eAAe,eAAe,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@schemavaults/jwt",
|
|
3
3
|
"description": "Utility functions for authentication and authorization for use from the auth server or a resource server",
|
|
4
|
-
"version": "0.
|
|
4
|
+
"version": "0.12.0",
|
|
5
5
|
"license": "UNLICENSED",
|
|
6
6
|
"private": false,
|
|
7
7
|
"repository": {
|
|
@@ -16,8 +16,8 @@
|
|
|
16
16
|
"dependencies": {
|
|
17
17
|
"zod": "3.25.8",
|
|
18
18
|
"jose": "6.1.3",
|
|
19
|
-
"@schemavaults/auth-common": "0.
|
|
20
|
-
"@schemavaults/app-definitions": "0.
|
|
19
|
+
"@schemavaults/auth-common": "0.24.0",
|
|
20
|
+
"@schemavaults/app-definitions": "0.12.0"
|
|
21
21
|
},
|
|
22
22
|
"scripts": {
|
|
23
23
|
"build": "tsc --project tsconfig.json && tsc-alias --project tsconfig.json",
|