@schemavaults/jwt 0.7.32 → 0.7.34

package/dist/JwksAccessProofToken/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const JWKS_ACCESS_PROOF_TOKEN_MAX_AGE = "60s";
+export declare const JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS: readonly string[];

package/dist/JwksAccessProofToken/constants.js

@@ -0,0 +1,18 @@
+// JWKS access assertions are short-lived, single-use credentials: resource
+// servers mint a fresh one immediately before each request to the auth
+// server. Verification rejects assertions whose `iat` is older than this
+// window (jose `maxTokenAge`), and the mint side uses the same value for
+// `exp` so a token's self-declared lifetime matches the acceptance window.
+export const JWKS_ACCESS_PROOF_TOKEN_MAX_AGE = "60s";
+// Claims every JWKS access assertion must carry. Verification rejects
+// tokens missing any of these (jose `requiredClaims`), so assertions minted
+// without `jti`/`iat` cannot be accepted — and therefore cannot be replayed
+// past the auth server's jti tracking.
+export const JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS = [
+    "exp",
+    "iat",
+    "jti",
+    "aud",
+    "iss",
+];
+//# sourceMappingURL=constants.js.map

package/dist/JwksAccessProofToken/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/constants.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAErD,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,uCAAuC;AACvC,MAAM,CAAC,MAAM,uCAAuC,GAAsB;IACxE,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;CACN,CAAC"}

package/dist/JwksAccessProofToken/createJwksAccessProofToken.js

@@ -1,21 +1,26 @@
 import { sign_verify_alg } from "../jwt";
 import { apiServerIdSchema, SCHEMAVAULTS_AUTH_APP_DEFINITION, SCHEMAVAULTS_AUTH_SERVER, } from "@schemavaults/app-definitions";
 import { SignJWT } from "jose";
+import { JWKS_ACCESS_PROOF_TOKEN_MAX_AGE } from "./constants";
 export async function createJwksAccessProofToken({ api_server_id, private_key, }) {
-    if (!apiServerIdSchema.safeParse(api_server_id)) {
+    if (!apiServerIdSchema.safeParse(api_server_id).success) {
         throw new TypeError("Invalid API server ID!");
     }
     if (api_server_id === SCHEMAVAULTS_AUTH_SERVER.api_server_id) {
         throw new Error(`'${SCHEMAVAULTS_AUTH_SERVER.api_server_id}' does not use JWKS access proof tokens`);
     }
+    // The auth server requires exp, iat, jti, aud, and iss claims, and treats
+    // each jti as single-use, so mint a fresh assertion for every request.
     const token_builder = new SignJWT({
         api_server_id,
     })
         .setSubject(api_server_id)
         .setIssuer(api_server_id)
         .setAudience(SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id)
+        .setJti(crypto.randomUUID())
+        .setIssuedAt()
         .setNotBefore(new Date(Date.now() - 1))
-        .setExpirationTime("2 min")
+        .setExpirationTime(JWKS_ACCESS_PROOF_TOKEN_MAX_AGE)
         .setProtectedHeader({
         alg: sign_verify_alg,
     });

package/dist/JwksAccessProofToken/createJwksAccessProofToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"createJwksAccessProofToken.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/createJwksAccessProofToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAEL,iBAAiB,EACjB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAO/B,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,aAAa,EACb,WAAW,GACiB;IAC5B,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,aAAa,KAAK,wBAAwB,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,IAAI,wBAAwB,CAAC,aAAa,yCAAyC,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC;QAChC,aAAa;KACd,CAAC;SACC,UAAU,CAAC,aAAa,CAAC;SACzB,SAAS,CAAC,aAAa,CAAC;SACxB,WAAW,CAAC,gCAAgC,CAAC,MAAM,CAAC;SACpD,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;SACtC,iBAAiB,CAAC,OAAO,CAAC;SAC1B,kBAAkB,CAAC;QAClB,GAAG,EAAE,eAAe;KACrB,CAAC,CAAC;IAEL,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,eAAe,0BAA0B,CAAC"}
+{"version":3,"file":"createJwksAccessProofToken.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/createJwksAccessProofToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAEL,iBAAiB,EACjB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAO9D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,aAAa,EACb,WAAW,GACiB;IAC5B,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,aAAa,KAAK,wBAAwB,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,IAAI,wBAAwB,CAAC,aAAa,yCAAyC,CACpF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC;QAChC,aAAa;KACd,CAAC;SACC,UAAU,CAAC,aAAa,CAAC;SACzB,SAAS,CAAC,aAAa,CAAC;SACxB,WAAW,CAAC,gCAAgC,CAAC,MAAM,CAAC;SACpD,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;SACtC,iBAAiB,CAAC,+BAA+B,CAAC;SAClD,kBAAkB,CAAC;QAClB,GAAG,EAAE,eAAe;KACrB,CAAC,CAAC;IAEL,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,eAAe,0BAA0B,CAAC"}

package/dist/JwksAccessProofToken/index.d.ts

@@ -1,2 +1,3 @@
 export { verifyJwksAccessProofToken } from "./verifyJwksAccessProofToken";
 export { createJwksAccessProofToken } from "./createJwksAccessProofToken";
+export { JWKS_ACCESS_PROOF_TOKEN_MAX_AGE, JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS, } from "./constants";

package/dist/JwksAccessProofToken/index.js

@@ -1,3 +1,4 @@
 export { verifyJwksAccessProofToken } from "./verifyJwksAccessProofToken";
 export { createJwksAccessProofToken } from "./createJwksAccessProofToken";
+export { JWKS_ACCESS_PROOF_TOKEN_MAX_AGE, JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS, } from "./constants";
 //# sourceMappingURL=index.js.map

package/dist/JwksAccessProofToken/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACL,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,aAAa,CAAC"}

package/dist/JwksAccessProofToken/verifyJwksAccessProofToken.js

@@ -1,11 +1,12 @@
 import { apiServerIdSchema, SCHEMAVAULTS_AUTH_APP_DEFINITION, SCHEMAVAULTS_AUTH_SERVER, } from "@schemavaults/app-definitions";
 import { jwtVerify } from "jose";
 import signVerifyAlg, { sign_verify_alg } from "../jwt/sign_verify_alg";
+import { JWKS_ACCESS_PROOF_TOKEN_MAX_AGE, JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS, } from "./constants";
 export async function verifyJwksAccessProofToken({ token, api_server_id, public_key, }) {
     if (typeof token !== "string") {
         throw new TypeError("Expected token to verify to be a string!");
     }
-    if (!apiServerIdSchema.safeParse(api_server_id)) {
+    if (!apiServerIdSchema.safeParse(api_server_id).success) {
         throw new TypeError("Invalid API server ID!");
     }
     if (api_server_id === SCHEMAVAULTS_AUTH_SERVER.api_server_id) {
@@ -16,6 +17,8 @@ export async function verifyJwksAccessProofToken({ token, api_server_id, public_
         issuer: api_server_id,
         subject: api_server_id,
         algorithms: [signVerifyAlg],
+        maxTokenAge: JWKS_ACCESS_PROOF_TOKEN_MAX_AGE,
+        requiredClaims: [...JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS],
     });
     if (payload.payload.aud !== SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id) {
         return false;

package/dist/JwksAccessProofToken/verifyJwksAccessProofToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyJwksAccessProofToken.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/verifyJwksAccessProofToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EACjB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,aAAa,EAAE,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQvE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,KAAK,EACL,aAAa,EACb,UAAU,GACkB;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,aAAa,KAAK,wBAAwB,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,IAAI,wBAAwB,CAAC,aAAa,yCAAyC,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE;QACjD,QAAQ,EAAE,gCAAgC,CAAC,MAAM;QACjD,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,CAAC,aAAa,CAAC;KAC5B,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,gCAAgC,CAAC,MAAM,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,aAAa;QACrC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,aAAa,EACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe,0BAA0B,CAAC"}
+{"version":3,"file":"verifyJwksAccessProofToken.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/verifyJwksAccessProofToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EACjB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,aAAa,EAAE,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,aAAa,CAAC;AAQrB,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,KAAK,EACL,aAAa,EACb,UAAU,GACkB;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,aAAa,KAAK,wBAAwB,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,IAAI,wBAAwB,CAAC,aAAa,yCAAyC,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE;QACjD,QAAQ,EAAE,gCAAgC,CAAC,MAAM;QACjD,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,CAAC,aAAa,CAAC;QAC3B,WAAW,EAAE,+BAA+B;QAC5C,cAAc,EAAE,CAAC,GAAG,uCAAuC,CAAC;KAC7D,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,gCAAgC,CAAC,MAAM,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,aAAa;QACrC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,aAAa,EACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe,0BAA0B,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
 export * from "./jwt";
 export type * from "./jwt";
-export { createJwksAccessProofToken, verifyJwksAccessProofToken, } from "./JwksAccessProofToken";
+export { createJwksAccessProofToken, verifyJwksAccessProofToken, JWKS_ACCESS_PROOF_TOKEN_MAX_AGE, JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS, } from "./JwksAccessProofToken";
 export { isValidBase64UrlEncoding } from "./utils/isValidBase64UrlEncoding";

package/dist/index.js

@@ -1,5 +1,5 @@
 // @schemavaults/jwt - index.ts
 export * from "./jwt";
-export { createJwksAccessProofToken, verifyJwksAccessProofToken, } from "./JwksAccessProofToken";
+export { createJwksAccessProofToken, verifyJwksAccessProofToken, JWKS_ACCESS_PROOF_TOKEN_MAX_AGE, JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS, } from "./JwksAccessProofToken";
 export { isValidBase64UrlEncoding } from "./utils/isValidBase64UrlEncoding";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,cAAc,OAAO,CAAC;AAGtB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,cAAc,OAAO,CAAC;AAGtB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/jwt",
   "description": "Utility functions for authentication and authorization for use from the auth server or a resource server",
-  "version": "0.7.32",
+  "version": "0.7.34",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -16,7 +16,7 @@
   "dependencies": {
     "zod": "3.25.8",
     "jose": "6.1.3",
-    "@schemavaults/auth-common": "0.13.1",
+    "@schemavaults/auth-common": "0.13.2",
     "@schemavaults/app-definitions": "0.7.1"
   },
   "scripts": {