@schemavaults/jwt 0.7.34 → 0.8.4

package/dist/JwksAccessProofToken/createJwksAccessProofToken.d.ts

@@ -1,7 +1,8 @@
 import { type ApiServerId } from "@schemavaults/app-definitions";
 export interface ICreateJwksAccessProofToken {
     api_server_id: ApiServerId;
+    auth_server_url: string;
     private_key: CryptoKey;
 }
-export declare function createJwksAccessProofToken({ api_server_id, private_key, }: ICreateJwksAccessProofToken): Promise<string>;
+export declare function createJwksAccessProofToken({ api_server_id, auth_server_url, private_key, }: ICreateJwksAccessProofToken): Promise<string>;
 export default createJwksAccessProofToken;

package/dist/JwksAccessProofToken/createJwksAccessProofToken.js

@@ -1,13 +1,13 @@
 import { sign_verify_alg } from "../jwt";
-import { apiServerIdSchema, SCHEMAVAULTS_AUTH_APP_DEFINITION, SCHEMAVAULTS_AUTH_SERVER, } from "@schemavaults/app-definitions";
+import { apiServerIdSchema, } from "@schemavaults/app-definitions";
 import { SignJWT } from "jose";
 import { JWKS_ACCESS_PROOF_TOKEN_MAX_AGE } from "./constants";
-export async function createJwksAccessProofToken({ api_server_id, private_key, }) {
+export async function createJwksAccessProofToken({ api_server_id, auth_server_url, private_key, }) {
     if (!apiServerIdSchema.safeParse(api_server_id).success) {
         throw new TypeError("Invalid API server ID!");
     }
-    if (api_server_id === SCHEMAVAULTS_AUTH_SERVER.api_server_id) {
-        throw new Error(`'${SCHEMAVAULTS_AUTH_SERVER.api_server_id}' does not use JWKS access proof tokens`);
+    if (api_server_id === auth_server_url) {
+        throw new Error(`'${auth_server_url}' does not use JWKS access proof tokens`);
     }
     // The auth server requires exp, iat, jti, aud, and iss claims, and treats
     // each jti as single-use, so mint a fresh assertion for every request.
@@ -16,7 +16,7 @@ export async function createJwksAccessProofToken({ api_server_id, private_key, }
     })
         .setSubject(api_server_id)
         .setIssuer(api_server_id)
-        .setAudience(SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id)
+        .setAudience(auth_server_url)
         .setJti(crypto.randomUUID())
         .setIssuedAt()
         .setNotBefore(new Date(Date.now() - 1))

package/dist/JwksAccessProofToken/createJwksAccessProofToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"createJwksAccessProofToken.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/createJwksAccessProofToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAEL,iBAAiB,EACjB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAO9D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,aAAa,EACb,WAAW,GACiB;IAC5B,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,aAAa,KAAK,wBAAwB,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,IAAI,wBAAwB,CAAC,aAAa,yCAAyC,CACpF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC;QAChC,aAAa;KACd,CAAC;SACC,UAAU,CAAC,aAAa,CAAC;SACzB,SAAS,CAAC,aAAa,CAAC;SACxB,WAAW,CAAC,gCAAgC,CAAC,MAAM,CAAC;SACpD,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;SACtC,iBAAiB,CAAC,+BAA+B,CAAC;SAClD,kBAAkB,CAAC;QAClB,GAAG,EAAE,eAAe;KACrB,CAAC,CAAC;IAEL,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,eAAe,0BAA0B,CAAC"}
+{"version":3,"file":"createJwksAccessProofToken.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/createJwksAccessProofToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AACxC,OAAO,EAEL,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAQ9D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,aAAa,EACb,eAAe,EACf,WAAW,GACiB;IAC5B,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,IAAI,eAAe,yCAAyC,CAC7D,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC;QAChC,aAAa;KACd,CAAC;SACC,UAAU,CAAC,aAAa,CAAC;SACzB,SAAS,CAAC,aAAa,CAAC;SACxB,WAAW,CAAC,eAAe,CAAC;SAC5B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;SACtC,iBAAiB,CAAC,+BAA+B,CAAC;SAClD,kBAAkB,CAAC;QAClB,GAAG,EAAE,eAAe;KACrB,CAAC,CAAC;IAEL,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,eAAe,0BAA0B,CAAC"}

package/dist/JwksAccessProofToken/verifyJwksAccessProofToken.d.ts

@@ -2,7 +2,8 @@ import { type ApiServerId } from "@schemavaults/app-definitions";
 export interface IVerifyJwksAccessProofToken {
     token: string;
     api_server_id: ApiServerId;
+    auth_server_url: string;
     public_key: CryptoKey;
 }
-export declare function verifyJwksAccessProofToken({ token, api_server_id, public_key, }: IVerifyJwksAccessProofToken): Promise<boolean>;
+export declare function verifyJwksAccessProofToken({ token, api_server_id, auth_server_url, public_key, }: IVerifyJwksAccessProofToken): Promise<boolean>;
 export default verifyJwksAccessProofToken;

package/dist/JwksAccessProofToken/verifyJwksAccessProofToken.js

@@ -1,26 +1,26 @@
-import { apiServerIdSchema, SCHEMAVAULTS_AUTH_APP_DEFINITION, SCHEMAVAULTS_AUTH_SERVER, } from "@schemavaults/app-definitions";
+import { apiServerIdSchema, } from "@schemavaults/app-definitions";
 import { jwtVerify } from "jose";
 import signVerifyAlg, { sign_verify_alg } from "../jwt/sign_verify_alg";
 import { JWKS_ACCESS_PROOF_TOKEN_MAX_AGE, JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS, } from "./constants";
-export async function verifyJwksAccessProofToken({ token, api_server_id, public_key, }) {
+export async function verifyJwksAccessProofToken({ token, api_server_id, auth_server_url, public_key, }) {
     if (typeof token !== "string") {
         throw new TypeError("Expected token to verify to be a string!");
     }
     if (!apiServerIdSchema.safeParse(api_server_id).success) {
         throw new TypeError("Invalid API server ID!");
     }
-    if (api_server_id === SCHEMAVAULTS_AUTH_SERVER.api_server_id) {
-        throw new Error(`'${SCHEMAVAULTS_AUTH_SERVER.api_server_id}' does not use JWKS access proof tokens`);
+    if (api_server_id === auth_server_url) {
+        throw new Error(`'${auth_server_url}' does not use JWKS access proof tokens`);
     }
     const payload = await jwtVerify(token, public_key, {
-        audience: SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id,
+        audience: auth_server_url,
         issuer: api_server_id,
         subject: api_server_id,
         algorithms: [signVerifyAlg],
         maxTokenAge: JWKS_ACCESS_PROOF_TOKEN_MAX_AGE,
         requiredClaims: [...JWKS_ACCESS_PROOF_TOKEN_REQUIRED_CLAIMS],
     });
-    if (payload.payload.aud !== SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id) {
+    if (payload.payload.aud !== auth_server_url) {
         return false;
     }
     if (payload.payload.sub !== api_server_id ||

package/dist/JwksAccessProofToken/verifyJwksAccessProofToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyJwksAccessProofToken.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/verifyJwksAccessProofToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EACjB,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,aAAa,EAAE,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,aAAa,CAAC;AAQrB,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,KAAK,EACL,aAAa,EACb,UAAU,GACkB;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,aAAa,KAAK,wBAAwB,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,IAAI,wBAAwB,CAAC,aAAa,yCAAyC,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE;QACjD,QAAQ,EAAE,gCAAgC,CAAC,MAAM;QACjD,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,CAAC,aAAa,CAAC;QAC3B,WAAW,EAAE,+BAA+B;QAC5C,cAAc,EAAE,CAAC,GAAG,uCAAuC,CAAC;KAC7D,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,gCAAgC,CAAC,MAAM,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,aAAa;QACrC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,aAAa,EACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe,0BAA0B,CAAC"}
+{"version":3,"file":"verifyJwksAccessProofToken.js","sourceRoot":"","sources":["../../src/JwksAccessProofToken/verifyJwksAccessProofToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,aAAa,EAAE,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,aAAa,CAAC;AASrB,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAC/C,KAAK,EACL,aAAa,EACb,eAAe,EACf,UAAU,GACkB;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,IAAI,eAAe,yCAAyC,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE;QACjD,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,CAAC,aAAa,CAAC;QAC3B,WAAW,EAAE,+BAA+B;QAC5C,cAAc,EAAE,CAAC,GAAG,uCAAuC,CAAC;KAC7D,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,aAAa;QACrC,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,aAAa,EACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe,0BAA0B,CAAC"}

package/dist/jwt/decode.d.ts

@@ -7,6 +7,7 @@ interface BaseDecodeJWTOptions<T extends AuthTokenTypes> {
     type: T;
     jwt: string;
     audience?: string;
+    auth_server_url?: string;
     env: SchemaVaultsAppEnvironment;
 }
 interface DecodeJWTWithAllKeysOptions<T extends AuthTokenTypes> extends BaseDecodeJWTOptions<T> {

package/dist/jwt/decode.js

@@ -1,14 +1,15 @@
 import { jwtDecrypt, decodeProtectedHeader, } from "jose";
-import { REFRESH_TOKEN_AUDIENCE } from "./aud";
-import { issuer } from "./iss";
+import getRefreshTokenAudience from "./get_refresh_token_audience";
 import { getExpiryDurationString } from "./expiry";
-import { jwtPayloadSchema } from "./payload_data";
-import { apiServerIdSchema, SCHEMAVAULTS_AUTH_APP_DEFINITION, schemaVaultsAppEnvironmentSchema, } from "@schemavaults/app-definitions";
+import { createJwtPayloadSchema } from "./payload_data";
+import { getAppEnvironment, getAuthServerUrl, schemaVaultsAppEnvironmentSchema, } from "@schemavaults/app-definitions";
+import { createAudienceSchema } from "@schemavaults/auth-common";
 import { verifyJWTSignature } from "./verify_signature";
+import { z } from "zod";
 import isValidUuid from "../utils/isValidUuid";
 import encryptDecryptAlgorithm from "./encrypt_decrypt_alg";
 export async function decodeJWT({ type, jwt, audience = type === "refresh"
-    ? SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id
+    ? getAuthServerUrl(getAppEnvironment())
     : undefined, ...opts }) {
     const environment = opts.env;
     if (!environment) {
@@ -43,16 +44,20 @@ export async function decodeJWT({ type, jwt, audience = type === "refresh"
     if (typeof jwt !== "string") {
         throw new Error("Invalid JWT; expected string");
     }
-    if (type === "refresh" &&
-        audience !== SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id) {
+    const auth_server_url = typeof opts.auth_server_url === "string"
+        ? opts.auth_server_url
+        : getAuthServerUrl(environment);
+    if (type === "refresh" && audience !== auth_server_url) {
         if (debug) {
             console.log("Invalid audience for refresh token: ", audience);
         }
-        throw new Error(`Invalid audience for refresh token; only '${SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id}' is valid.`);
+        throw new Error(`Invalid audience for refresh token!`, {
+            cause: `Only auth server URL ('${auth_server_url}') is valid.`,
+        });
     }
     let aud;
     if (type === "refresh") {
-        aud = REFRESH_TOKEN_AUDIENCE;
+        aud = getRefreshTokenAudience(environment);
     }
     else if (type === "access") {
         if (typeof audience !== "string") {
@@ -90,12 +95,14 @@ export async function decodeJWT({ type, jwt, audience = type === "refresh"
         }
         if (!decoded_header.aud ||
             typeof decoded_header.aud !== "string" ||
-            !apiServerIdSchema.safeParse(decoded_header.aud).success) {
+            !createAudienceSchema(z, environment).safeParse(decoded_header.aud)
+                .success) {
             throw new Error("Invalid audience in JWT header");
         }
-        if (type === "refresh" &&
-            decoded_header.aud !== SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id) {
-            throw new Error(`Invalid audience in JWT header; only '${SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id}' tokens are allowed here`);
+        if (type === "refresh" && decoded_header.aud !== auth_server_url) {
+            throw new Error(`Invalid audience in JWT header for refresh token`, {
+                cause: `Only server audience ('${auth_server_url}') tokens are allowed here`,
+            });
         }
         if (decoded_header.aud !== audience) {
             throw new Error(`Invalid audience in JWT header; only '${audience}' tokens are allowed here`);
@@ -132,7 +139,7 @@ export async function decodeJWT({ type, jwt, audience = type === "refresh"
     }
     const decoded = await jwtDecrypt(jwt, decryption_key, {
         audience: aud,
-        issuer,
+        issuer: auth_server_url,
         maxTokenAge,
         currentDate: decodeTime,
     });
@@ -148,6 +155,7 @@ export async function decodeJWT({ type, jwt, audience = type === "refresh"
     }
     const withoutJWTspecific = { ...decoded.payload };
     delete withoutJWTspecific.exp;
+    const jwtPayloadSchema = createJwtPayloadSchema(z, environment);
     const parsedPayload = await jwtPayloadSchema.safeParseAsync(withoutJWTspecific);
     if (!parsedPayload.success) {
         if (environment === "development") {
@@ -210,6 +218,7 @@ export async function decodeJWT({ type, jwt, audience = type === "refresh"
             sub,
             uid,
             env: environment,
+            auth_server_url,
             ...(payload.jti ? { jti: payload.jti } : {}),
         });
         if (!isValidSig) {

package/dist/jwt/decode.js.map

@@ -1 +1 @@
-{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../src/jwt/decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EACV,qBAAqB,GAEtB,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,sBAAsB,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAyB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAEhC,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAC9C,OAAO,uBAAuB,MAAM,uBAAuB,CAAC;AA2B5D,MAAM,CAAC,KAAK,UAAU,SAAS,CAA2B,EACxD,IAAI,EACJ,GAAG,EACH,QAAQ,GAAG,IAAI,KAAK,SAAS;IAC3B,CAAC,CAAC,gCAAgC,CAAC,MAAM;IACzC,CAAC,CAAC,SAAS,EACb,GAAG,IAAI,EACa;IACpB,MAAM,WAAW,GAA+B,IAAI,CAAC,GAAG,CAAC;IACzD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAY,WAAW,KAAK,aAAa,CAAC;IAErD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,IACE,IAAI,KAAK,SAAS;QAClB,QAAQ,KAAK,gCAAgC,CAAC,MAAM,EACpD,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,6CAA6C,gCAAgC,CAAC,MAAM,aAAa,CAClG,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,sBAAsB,CAAC;IAC/B,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,UAAU,GAAS,IAAI,IAAI,EAAE,CAAC;IAEpC,MAAM,WAAW,GAAW,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,wCAAwC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,GAAW,CAAC;IAChB,IAAI,kBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,cAAc,GAClB,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC;QACzB,IACE,CAAC,cAAc,CAAC,SAAS;YACzB,OAAO,cAAc,CAAC,SAAS,KAAK,QAAQ,EAC5C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,cAAc,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IACE,CAAC,cAAc,CAAC,GAAG;YACnB,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ;YACtC,CAAC,iBAAiB,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EACxD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,IACE,IAAI,KAAK,SAAS;YAClB,cAAc,CAAC,GAAG,KAAK,gCAAgC,CAAC,MAAM,EAC9D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yCAAyC,gCAAgC,CAAC,MAAM,2BAA2B,CAC5G,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,2BAA2B,CAC7E,CAAC;QACJ,CAAC;QACD,kBAAkB,GAAG,cAAc,CAAC,GAAG,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,KAAK,GAAG,SAAS,aAAa,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,cAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QACtD,CAAC;aAAM,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACpC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,wDAAwD,EAAE;YACxE,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAqB,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE;QACtE,QAAQ,EAAE,GAAG;QACb,MAAM;QACN,WAAW;QACX,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,GAAG,GAAuB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,kBAAkB,GAOpB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,OAAO,kBAAkB,CAAC,GAAG,CAAC;IAE9B,MAAM,aAAa,GACjB,MAAM,gBAAgB,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACtE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3C,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8BAA8B,aAAa,CAAC,KAAK,CAAC,MAAM;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACrB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAqB,aAAa,CAAC,IAAI,CAAC;IAErD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,cAAc,GAGhB,MAAM,gCAAgC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,WAAW,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAW,OAAO,CAAC,GAAG,CAAC;IACtC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,gBAA2B,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,gBAAgB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,CAAC;aAAM,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;YACtC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,2DAA2D,EAC3D,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,0DAA0D,EAC1D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAY,MAAM,kBAAkB,CAAC;YACnD,GAAG,EAAE,SAAS;YACd,gBAAgB;YAChB,SAAS;YACT,GAAG;YACH,GAAG;YACH,IAAI;YACJ,GAAG;YACH,GAAG;YACH,GAAG,EAAE,WAAW;YAChB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,CAAC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE;YACvE,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../src/jwt/decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EACV,qBAAqB,GAEtB,MAAM,MAAM,CAAC;AAEd,OAAO,uBAAuB,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAyB,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAEhB,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,CAAC,EAA4B,MAAM,KAAK,CAAC;AAClD,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAC9C,OAAO,uBAAuB,MAAM,uBAAuB,CAAC;AA4B5D,MAAM,CAAC,KAAK,UAAU,SAAS,CAA2B,EACxD,IAAI,EACJ,GAAG,EACH,QAAQ,GAAG,IAAI,KAAK,SAAS;IAC3B,CAAC,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,CAAC;IACvC,CAAC,CAAC,SAAS,EACb,GAAG,IAAI,EACa;IACpB,MAAM,WAAW,GAA+B,IAAI,CAAC,GAAG,CAAC;IACzD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAY,WAAW,KAAK,aAAa,CAAC;IAErD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,eAAe,GACnB,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;QACtC,CAAC,CAAC,IAAI,CAAC,eAAe;QACtB,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAEpC,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACvD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,EAAE;YACrD,KAAK,EAAE,0BAA0B,eAAe,cAAc;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,UAAU,GAAS,IAAI,IAAI,EAAE,CAAC;IAEpC,MAAM,WAAW,GAAW,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,wCAAwC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,GAAW,CAAC;IAChB,IAAI,kBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,cAAc,GAClB,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC;QACzB,IACE,CAAC,cAAc,CAAC,SAAS;YACzB,OAAO,cAAc,CAAC,SAAS,KAAK,QAAQ,EAC5C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,cAAc,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IACE,CAAC,cAAc,CAAC,GAAG;YACnB,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ;YACtC,CAAC,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC;iBAChE,OAAO,EACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,kDAAkD,EAAE;gBAClE,KAAK,EAAE,0BAA0B,eAAe,4BAA4B;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,cAAc,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,yCAAyC,QAAQ,2BAA2B,CAC7E,CAAC;QACJ,CAAC;QACD,kBAAkB,GAAG,cAAc,CAAC,GAAG,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,GAAG,KAAK,GAAG,SAAS,aAAa,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,KAAK,uBAAuB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,cAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QACtD,CAAC;aAAM,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACpC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,yDAAyD,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,wDAAwD,EAAE;YACxE,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAqB,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE;QACtE,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,eAAe;QACvB,WAAW;QACX,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,GAAG,GAAuB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,kBAAkB,GAOpB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,OAAO,kBAAkB,CAAC,GAAG,CAAC;IAE9B,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAEhE,MAAM,aAAa,GACjB,MAAM,gBAAgB,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACtE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3C,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,8BAA8B,aAAa,CAAC,KAAK,CAAC,MAAM;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACrB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAqB,aAAa,CAAC,IAAI,CAAC;IAErD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,cAAc,GAGhB,MAAM,gCAAgC,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,WAAW,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAW,OAAO,CAAC,GAAG,CAAC;IACtC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,CAAC;IAChC,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,gBAA2B,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,gBAAgB,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1D,CAAC;aAAM,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;YACtC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,2DAA2D,EAC3D,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,0DAA0D,EAC1D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAY,MAAM,kBAAkB,CAAC;YACnD,GAAG,EAAE,SAAS;YACd,gBAAgB;YAChB,SAAS;YACT,GAAG;YACH,GAAG;YACH,IAAI;YACJ,GAAG;YACH,GAAG;YACH,GAAG,EAAE,WAAW;YAChB,eAAe;YACf,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,CAAC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE;YACvE,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/jwt/generate.d.ts

@@ -8,6 +8,7 @@ interface BaseGenerateJWTOptions<T extends AuthTokenTypes> {
     iat: number;
     client_app_id: string;
     audience: string;
+    auth_server_url: string;
     env: SchemaVaultsAppEnvironment;
 }
 interface GenerateJWTWithAllKeysOptions<T extends AuthTokenTypes> extends BaseGenerateJWTOptions<T> {
@@ -26,5 +27,5 @@ export type GenerateJWTOptions<T extends AuthTokenTypes> = GenerateJWTWithAllKey
  * @param iat Current unix timestamp
  * @returns A JWT (AccessToken or RefreshToken object). The .token property contains the actual token as a string.
  */
-export declare function generateJWT<T extends AuthTokenTypes>({ type, user, iat, client_app_id, audience, ...opts }: GenerateJWTOptions<T>, refresh_token_audience?: "schemavaults-auth"): Promise<T extends "access" ? AccessToken : RefreshToken>;
+export declare function generateJWT<T extends AuthTokenTypes>({ type, user, iat, client_app_id, audience, auth_server_url, ...opts }: GenerateJWTOptions<T>, refresh_token_audience?: string): Promise<T extends "access" ? AccessToken : RefreshToken>;
 export {};

package/dist/jwt/generate.js

@@ -1,10 +1,11 @@
 import { EncryptJWT } from "jose";
 import { alg, enc } from "./encrypt_decrypt_alg";
-import { issuer } from "./iss";
-import { REFRESH_TOKEN_AUDIENCE } from "./aud";
+import getRefreshTokenAudience from "./get_refresh_token_audience";
 import { getExpiryDurationString, getExpiryTime } from "./expiry";
 import { signJWT } from "./sign";
-import { apiServerIdSchema, SCHEMAVAULTS_AUTH_APP_DEFINITION, } from "@schemavaults/app-definitions";
+import { apiServerIdSchema, getTokenAudienceForApiServerId, } from "@schemavaults/app-definitions";
+import { createAudienceSchema } from "@schemavaults/auth-common";
+import { z } from "zod";
 import isValidUuid from "../utils/isValidUuid";
 /**
  *
@@ -13,7 +14,7 @@ import isValidUuid from "../utils/isValidUuid";
  * @param iat Current unix timestamp
  * @returns A JWT (AccessToken or RefreshToken object). The .token property contains the actual token as a string.
  */
-export async function generateJWT({ type, user, iat, client_app_id, audience, ...opts }, refresh_token_audience = REFRESH_TOKEN_AUDIENCE) {
+export async function generateJWT({ type, user, iat, client_app_id, audience, auth_server_url, ...opts }, refresh_token_audience = getRefreshTokenAudience(opts.env)) {
     let keyset_id;
     try {
         if ("keyset_id" in opts) {
@@ -48,8 +49,8 @@ export async function generateJWT({ type, user, iat, client_app_id, audience, ..
         if (typeof audience !== "string") {
             throw new TypeError("An audience must be supplied for access tokens");
         }
-        if (!apiServerIdSchema.safeParse(audience).success) {
-            throw new TypeError("Invalid audience provided; not a valid API server ID!");
+        if (!createAudienceSchema(z, opts.env).safeParse(audience).success) {
+            throw new TypeError("Invalid audience provided; not a valid token audience!");
         }
         aud = audience;
     }
@@ -62,16 +63,21 @@ export async function generateJWT({ type, user, iat, client_app_id, audience, ..
             !apiServerIdSchema.safeParse(keyset_audience_id).success) {
             throw new TypeError("Invalid audience ID for JWT keyset; not a valid API server ID!");
         }
-        if (keyset_audience_id !== aud) {
-            throw new Error(`JWT keyset audience ID '${keyset_audience_id}' does not match requested token audience ID '${aud}'`);
+        // The keyset is stored/looked-up by the stable api server id (e.g. the
+        // auth server's own app id), but the token `aud` claim uses the token
+        // audience form (the auth server URL). Translate before comparing.
+        const keyset_token_audience = getTokenAudienceForApiServerId(keyset_audience_id, opts.env);
+        if (keyset_token_audience !== aud) {
+            throw new Error(`JWT keyset audience ID '${keyset_audience_id}' (token audience '${keyset_token_audience}') does not match requested token audience '${aud}'`);
         }
     }
     const email = user.email;
     const uid = user.uid;
     const env = opts.env;
-    if (type === "refresh" &&
-        audience !== SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id) {
-        throw new Error("Invalid audience for refresh token");
+    if (type === "refresh" && audience !== auth_server_url) {
+        throw new Error("Invalid audience for refresh token", {
+            cause: `Only auth server URL audience ('${auth_server_url}') is valid for refresh tokens.`,
+        });
     }
     const jti = crypto.randomUUID();
     let signing_key;
@@ -105,6 +111,7 @@ export async function generateJWT({ type, user, iat, client_app_id, audience, ..
             email,
             type,
             env,
+            auth_server_url,
             jti,
         });
     }
@@ -155,7 +162,7 @@ export async function generateJWT({ type, user, iat, client_app_id, audience, ..
             aud: audience,
         })
             .setIssuedAt(new Date(iat))
-            .setIssuer(issuer)
+            .setIssuer(auth_server_url)
             .setAudience(aud)
             .setExpirationTime(getExpiryDurationString(type))
             .setSubject(userData.uid)

package/dist/jwt/generate.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../src/jwt/generate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAkB,MAAM,MAAM,CAAC;AAElD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASlE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,gCAAgC,GAEjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,WAAW,MAAM,qBAAqB,CAAC;AA6B9C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAyB,EAC5E,sBAAsB,GAAG,sBAAsB;IAE/C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAa,IAAI,CAAC;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACtD,aAAa,QAAQ,oBAAoB,sBAAsB,IAAI,CACtE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,sBAAsB,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,IAAI,SAAS,CACjB,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,kBAAkB,GAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7D,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,CAAC,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,OAAO,EACxD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,KAAK,GAAG,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,2BAA2B,kBAAkB,iDAAiD,GAAG,GAAG,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAW,IAAI,CAAC,KAAK,CAAC;IACjC,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,CAAC;IAE7B,MAAM,GAAG,GAA+B,IAAI,CAAC,GAAG,CAAC;IAEjD,IACE,IAAI,KAAK,SAAS;QAClB,QAAQ,KAAK,gCAAgC,CAAC,MAAM,EACpD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAW,MAAM,CAAC,UAAU,EAAE,CAAC;IAExC,IAAI,WAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,mBAAmB,GACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,WAAW,GAAG,MAAM,mBAAmB,CAAC;QAC1C,CAAC;aAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC;YAClB,QAAQ;YACR,WAAW;YACX,SAAS;YACT,GAAG;YACH,GAAG;YACH,KAAK;YACL,IAAI;YACJ,GAAG;YACH,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,6DAA6D,EAC7D,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,cAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,sBAAsB,GAC1B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/B,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,cAAc,GAAG,MAAM,sBAAsB,CAAC;QAChD,CAAC;aAAM,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACpC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAA8B;YAClD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,KAAK;YAC5C,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG;YACH,GAAG;YACH,GAAG;SACJ,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC;aAC/C,kBAAkB,CAAC;YAClB,GAAG;YACH,GAAG;YACH,SAAS;YACT,GAAG,EAAE,GAAG,SAAS,aAAa;YAC9B,GAAG,EAAE,QAAyB;SAC/B,CAAC;aACD,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;aAC1B,SAAS,CAAC,MAAM,CAAC;aACjB,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;aAChD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;aACxB,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3B,MAAM,UAAU,GAAW,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEpD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAc;YAC3B,IAAI;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG;YACH,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,GAAG;YACV,GAAG;YACH,GAAG;SACJ,CAAC;QAEF,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CACjB,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,SAA4D,CAAC;IACtE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../src/jwt/generate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAkB,MAAM,MAAM,CAAC;AAElD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,uBAAuB,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASlE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,WAAW,MAAM,qBAAqB,CAAC;AA8B9C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EACE,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,aAAa,EACb,QAAQ,EACR,eAAe,EACf,GAAG,IAAI,EACe,EACxB,sBAAsB,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;IAE1D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAa,IAAI,CAAC;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACtD,aAAa,QAAQ,oBAAoB,sBAAsB,IAAI,CACtE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,sBAAsB,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;YACnE,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,kBAAkB,GAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7D,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,CAAC,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,OAAO,EACxD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,qBAAqB,GAAW,8BAA8B,CAClE,kBAAkB,EAClB,IAAI,CAAC,GAAG,CACT,CAAC;QACF,IAAI,qBAAqB,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,kBAAkB,sBAAsB,qBAAqB,+CAA+C,GAAG,GAAG,CAC9I,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAW,IAAI,CAAC,KAAK,CAAC;IACjC,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,CAAC;IAE7B,MAAM,GAAG,GAA+B,IAAI,CAAC,GAAG,CAAC;IAEjD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE;YACpD,KAAK,EAAE,mCAAmC,eAAe,iCAAiC;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAW,MAAM,CAAC,UAAU,EAAE,CAAC;IAExC,IAAI,WAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,mBAAmB,GACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,WAAW,GAAG,MAAM,mBAAmB,CAAC;QAC1C,CAAC;aAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC;YAClB,QAAQ;YACR,WAAW;YACX,SAAS;YACT,GAAG;YACH,GAAG;YACH,KAAK;YACL,IAAI;YACJ,GAAG;YACH,eAAe;YACf,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,6DAA6D,EAC7D,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,cAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,sBAAsB,GAC1B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/B,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,cAAc,GAAG,MAAM,sBAAsB,CAAC;QAChD,CAAC;aAAM,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACpC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAA8B;YAClD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,KAAK;YAC5C,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG;YACH,GAAG;YACH,GAAG;SACJ,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC;aAC/C,kBAAkB,CAAC;YAClB,GAAG;YACH,GAAG;YACH,SAAS;YACT,GAAG,EAAE,GAAG,SAAS,aAAa;YAC9B,GAAG,EAAE,QAAyB;SAC/B,CAAC;aACD,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;aAC1B,SAAS,CAAC,eAAe,CAAC;aAC1B,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;aAChD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;aACxB,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3B,MAAM,UAAU,GAAW,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEpD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAc;YAC3B,IAAI;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG;YACH,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,GAAG;YACV,GAAG;YACH,GAAG;SACJ,CAAC;QAEF,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CACjB,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,SAA4D,CAAC;IACtE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/jwt/get_audience_from_token.d.ts

@@ -1 +1,2 @@
-export default function getAudienceFromToken(token: string): string;
+import type { SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+export default function getAudienceFromToken(token: string, environment?: SchemaVaultsAppEnvironment): string;

package/dist/jwt/get_audience_from_token.js

@@ -1,12 +1,13 @@
-import { apiServerIdSchema } from "@schemavaults/app-definitions";
+import { createAudienceSchema } from "@schemavaults/auth-common";
 import { decodeProtectedHeader } from "jose";
-export default function getAudienceFromToken(token) {
+import { z } from "zod";
+export default function getAudienceFromToken(token, environment) {
     const headers = decodeProtectedHeader(token);
     if ("aud" in headers) {
         if (typeof headers.aud === "string" && headers.aud.length > 0) {
             const aud = headers.aud;
-            if (!apiServerIdSchema.safeParse(aud).success) {
-                throw new Error("Invalid token; 'aud' claim must be a valid API server ID");
+            if (!createAudienceSchema(z, environment).safeParse(aud).success) {
+                throw new Error("Invalid token; 'aud' claim must be a valid token audience");
             }
             return aud;
         }

package/dist/jwt/get_audience_from_token.js.map

@@ -1 +1 @@
-{"version":3,"file":"get_audience_from_token.js","sourceRoot":"","sources":["../../src/jwt/get_audience_from_token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAC;AAE7C,MAAM,CAAC,OAAO,UAAU,oBAAoB,CAAC,KAAa;IACxD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QACrB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,CAAC;YAChC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"get_audience_from_token.js","sourceRoot":"","sources":["../../src/jwt/get_audience_from_token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,OAAO,UAAU,oBAAoB,CAC1C,KAAa,EACb,WAAwC;IAExC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;QACrB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,CAAC;YAChC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/jwt/get_refresh_token_audience.d.ts

@@ -0,0 +1,2 @@
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+export default function getRefreshTokenAudience(environment?: SchemaVaultsAppEnvironment): string;

package/dist/jwt/get_refresh_token_audience.js

@@ -0,0 +1,5 @@
+import { getAppEnvironment, getAuthServerUrl, } from "@schemavaults/app-definitions";
+export default function getRefreshTokenAudience(environment = getAppEnvironment()) {
+    return getAuthServerUrl(environment);
+}
+//# sourceMappingURL=get_refresh_token_audience.js.map

package/dist/jwt/get_refresh_token_audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get_refresh_token_audience.js","sourceRoot":"","sources":["../../src/jwt/get_refresh_token_audience.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,OAAO,UAAU,uBAAuB,CAC7C,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,gBAAgB,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC"}

package/dist/jwt/jwt-factory.d.ts

@@ -15,9 +15,9 @@ export declare class JWT_Factory {
      */
     private readonly client_app_id;
     private readonly user;
-    private static readonly REFRESH_TOKEN_AUDIENCE;
-    private readonly jwt_keys;
     private readonly environment;
+    private readonly auth_server_url;
+    private readonly jwt_keys;
     private readonly user_organizations;
     constructor(opts: IJWT_Factory_Init_Options);
     private get uid();

package/dist/jwt/jwt-factory.js

@@ -1,7 +1,7 @@
-import { audienceRefSchema, organizationIdSchema, } from "@schemavaults/auth-common";
-import { appIdSchema, SCHEMAVAULTS_AUTH_APP_DEFINITION, schemaVaultsAppEnvironmentSchema, schemaVaultsAppEnvironments, } from "@schemavaults/app-definitions";
+import { z } from "zod";
+import { createAudienceSchema, organizationIdSchema, } from "@schemavaults/auth-common";
+import { appIdSchema, schemaVaultsAppEnvironmentSchema, schemaVaultsAppEnvironments, getAuthServerUrl, } from "@schemavaults/app-definitions";
 import { generateJWT } from "./generate";
-import { REFRESH_TOKEN_AUDIENCE } from "./aud";
 // This class is used to generate JWTs for a single user
 // Initialize the factory with a user ID, then call loadUserData() to load the user's data
 // Once the user's data is loaded, you can call refresh() or access() to generate a token
@@ -12,9 +12,9 @@ export class JWT_Factory {
      */
     client_app_id;
     user;
-    static REFRESH_TOKEN_AUDIENCE = REFRESH_TOKEN_AUDIENCE;
-    jwt_keys;
     environment;
+    auth_server_url;
+    jwt_keys;
     user_organizations;
     constructor(opts) {
         // Save user data
@@ -41,6 +41,7 @@ export class JWT_Factory {
             throw new TypeError("Invalid user organizations, expected 'user_organizations' field to be an array of valid organization IDs");
         }
         this.user_organizations = opts.user_organizations;
+        this.auth_server_url = getAuthServerUrl(this.environment);
     }
     get uid() {
         const user = this.user;
@@ -67,16 +68,15 @@ export class JWT_Factory {
         const iat = JWT_Factory.iat;
         if (type === "refresh") {
             // refresh tokens are always addressed to the auth server
-            if (aud !== SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id ||
-                aud !== REFRESH_TOKEN_AUDIENCE) {
-                throw new Error("Refresh tokens must have an audience directed at the SchemaVaults Auth platform");
+            if (aud !== this.auth_server_url) {
+                throw new Error("Refresh tokens must have an audience directed at the SchemaVaults Auth Server URL");
             }
         }
-        else if (aud === SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id) {
-            // Always allow audience to be the
+        else if (type === "access" && aud === this.auth_server_url) {
+            // Always allow audience to be the auth server
         }
         else {
-            const parsed_as_uuid_aud = await audienceRefSchema.safeParseAsync(aud);
+            const parsed_as_uuid_aud = await createAudienceSchema(z, this.environment).safeParseAsync(aud);
             if (!parsed_as_uuid_aud.success) {
                 throw new Error("Expected audience to reference a valid app, API, or FS server!");
             }
@@ -87,6 +87,7 @@ export class JWT_Factory {
             iat,
             audience: aud,
             client_app_id: this.client_app_id,
+            auth_server_url: this.auth_server_url,
             jwt_keys: this.jwt_keys,
             env: this.environment,
         };
@@ -94,8 +95,7 @@ export class JWT_Factory {
         return jwt;
     }
     async refresh() {
-        const REFRESH_TOKEN_AUDIENCE = JWT_Factory.REFRESH_TOKEN_AUDIENCE;
-        return await this.generate("refresh", REFRESH_TOKEN_AUDIENCE);
+        return await this.generate("refresh", this.auth_server_url);
     }
     async access(audience) {
         return await this.generate("access", audience);

package/dist/jwt/jwt-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-factory.js","sourceRoot":"","sources":["../../src/jwt/jwt-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,iBAAiB,EAEjB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EAEX,gCAAgC,EAEhC,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA2B,WAAW,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,OAAO,CAAC;AAW/C,wDAAwD;AACxD,0FAA0F;AAC1F,yFAAyF;AACzF,MAAM,OAAO,WAAW;IACtB;;;OAGG;IACc,aAAa,CAAQ;IACrB,IAAI,CAAW;IACxB,MAAM,CAAU,sBAAsB,GAAG,sBAAsB,CAAC;IACvD,QAAQ,CAAa;IACrB,WAAW,CAA6B;IACxC,kBAAkB,CAA4B;IAE/D,YAAmB,IAA+B;QAChD,iBAAiB;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEtB,oBAAoB;QACpB,MAAM,oBAAoB,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAE/C,WAAW;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,yDAAyD;QACzD,MAAM,sBAAsB,GAAG,gCAAgC,CAAC,SAAS,CACvE,IAAI,CAAC,WAAgD,CACtD,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,qEAAqE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAE/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;QACJ,CAAC;aAAM,IACL,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAC5B,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;YACxB,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAC/C,EACD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,0GAA0G,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACpD,CAAC;IAED,IAAY,GAAG;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kDAAkD,OAAO,IAAI,CAAC,GAAG,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvB,CAAC;IAEO,MAAM,KAAK,GAAG;QACpB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,IAAO,EACP,GAAW;QAEX,oCAAoC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,GAAG,GAAW,WAAW,CAAC,GAAG,CAAC;QAEpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,yDAAyD;YACzD,IACE,GAAG,KAAK,gCAAgC,CAAC,MAAM;gBAC/C,GAAG,KAAK,sBAAsB,EAC9B,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,KAAK,gCAAgC,CAAC,MAAM,EAAE,CAAC;YAC3D,kCAAkC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAoC;YAC5D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI;YACJ,GAAG;YACH,QAAQ,EAAE,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAA6B;YAC5C,GAAG,EAAE,IAAI,CAAC,WAAgD;SAC3D,CAAC;QAEF,MAAM,GAAG,GAAc,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAE/D,OAAO,GAAsD,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,MAAM,sBAAsB,GAAG,WAAW,CAAC,sBAAsB,CAAC;QAClE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,QAAgB;QAClC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,SAAmB;QAEnB,MAAM,YAAY,GAAgC,EAAE,CAAC;QAErD,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,CACvC,CAAC,QAAgB,EAAwB,EAAE;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChE,gBAAgB,CAAC,OAAO,CAAC,CAAC,YAAY,EAAQ,EAAE;YAC9C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,cAAc,CACzB,SAA6B,EAC7B,cAAwB;QAExB,MAAM,aAAa,GAAU,IAAI,CAAC,aAAa,CAAC;QAChD,IAAI,sBAAgC,CAAC;QAErC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAC/B,sBAAsB,GAAG,CAAC,SAAS,CAAoB,CAAC;aACrD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,sBAAsB,GAAG,SAAS,CAAC;QACrC,CAAC;;YACC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QAEJ,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;aACvE,IAAI,sBAAsB,CAAC,MAAM,GAAG,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,mBAAmB,GACvB,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAE9D,MAAM,qBAAqB,GAAwB;gBACjD,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,iCAAiC;gBAC1C,aAAa;gBACb,MAAM,EAAE;oBACN,OAAO,EAAE,MAAM,mBAAmB;oBAClC,MAAM,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,CAAC;iBAChE;gBACD,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;YACF,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC"}
+{"version":3,"file":"jwt-factory.js","sourceRoot":"","sources":["../../src/jwt/jwt-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAOL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EAGX,gCAAgC,EAChC,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA2B,WAAW,EAAE,MAAM,YAAY,CAAC;AAWlE,wDAAwD;AACxD,0FAA0F;AAC1F,yFAAyF;AACzF,MAAM,OAAO,WAAW;IACtB;;;OAGG;IACc,aAAa,CAAQ;IACrB,IAAI,CAAW;IACf,WAAW,CAA6B;IACxC,eAAe,CAAS;IACxB,QAAQ,CAAa;IACrB,kBAAkB,CAA4B;IAE/D,YAAmB,IAA+B;QAChD,iBAAiB;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEtB,oBAAoB;QACpB,MAAM,oBAAoB,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAE/C,WAAW;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,yDAAyD;QACzD,MAAM,sBAAsB,GAAG,gCAAgC,CAAC,SAAS,CACvE,IAAI,CAAC,WAAgD,CACtD,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,qEAAqE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAE/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;QACJ,CAAC;aAAM,IACL,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAC5B,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;YACxB,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAC/C,EACD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,0GAA0G,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAElD,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAED,IAAY,GAAG;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kDAAkD,OAAO,IAAI,CAAC,GAAG,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvB,CAAC;IAEO,MAAM,KAAK,GAAG;QACpB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,IAAO,EACP,GAAW;QAEX,oCAAoC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,GAAG,GAAW,WAAW,CAAC,GAAG,CAAC;QAEpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,yDAAyD;YACzD,IAAI,GAAG,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7D,8CAA8C;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,GAAG,MAAM,oBAAoB,CACnD,CAAC,EACD,IAAI,CAAC,WAAW,CACjB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAoC;YAC5D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI;YACJ,GAAG;YACH,QAAQ,EAAE,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,QAA6B;YAC5C,GAAG,EAAE,IAAI,CAAC,WAAgD;SAC3D,CAAC;QAEF,MAAM,GAAG,GAAc,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAE/D,OAAO,GAAsD,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,QAAgB;QAClC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,SAAmB;QAEnB,MAAM,YAAY,GAAgC,EAAE,CAAC;QAErD,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,CACvC,CAAC,QAAgB,EAAwB,EAAE;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChE,gBAAgB,CAAC,OAAO,CAAC,CAAC,YAAY,EAAQ,EAAE;YAC9C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,cAAc,CACzB,SAA6B,EAC7B,cAAwB;QAExB,MAAM,aAAa,GAAU,IAAI,CAAC,aAAa,CAAC;QAChD,IAAI,sBAAgC,CAAC;QAErC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAC/B,sBAAsB,GAAG,CAAC,SAAS,CAAoB,CAAC;aACrD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,sBAAsB,GAAG,SAAS,CAAC;QACrC,CAAC;;YACC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QAEJ,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;aACvE,IAAI,sBAAsB,CAAC,MAAM,GAAG,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,mBAAmB,GACvB,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAE9D,MAAM,qBAAqB,GAAwB;gBACjD,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,iCAAiC;gBAC1C,aAAa;gBACb,MAAM,EAAE;oBACN,OAAO,EAAE,MAAM,mBAAmB;oBAClC,MAAM,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,CAAC;iBAChE;gBACD,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;YACF,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF"}

package/dist/jwt/jwt_keys/JsonSerializedJwtKey.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 export declare const jsonSerializedJwtKeySchema: z.ZodEffects<z.ZodObject<{
-    audience_id: z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>;
+    audience_id: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
     keyset_id: z.ZodString;
     keyset_expiry: z.ZodOptional<z.ZodNumber>;
     value: z.ZodString;

package/dist/jwt/jwt_keys/generate_new_jwt_keyset.d.ts

@@ -1,3 +1,4 @@
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 import JWT_Keys from "./jwt_keys";
 /**
  * @name generateJwtSigningKeyPair
@@ -13,6 +14,7 @@ export declare function generateJwtSigningKeyPair(debug?: boolean): Promise<[pri
 export declare function generateJwtContentEncryptionKeyPair(debug?: boolean): Promise<[private_key: string, public_key: string]>;
 export interface IGenerateNewJwtKeySetOpts {
     audience_id: string;
+    environment: SchemaVaultsAppEnvironment;
     keyset_id?: string;
     keyset_expiry?: number;
     debug?: boolean;

package/dist/jwt/jwt_keys/generate_new_jwt_keyset.js

@@ -1,4 +1,4 @@
-import { apiServerIdSchema } from "@schemavaults/app-definitions";
+import { apiServerIdSchema, } from "@schemavaults/app-definitions";
 import ContentEncryptionKeyPairFactory from "./ContentEncryptionKeyPairFactory";
 import JWT_Keys from "./jwt_keys";
 import SigningKeyPairFactory from "./SigningKeyPairFactory";
@@ -37,10 +37,20 @@ export async function generateNewJwtKeySet(opts) {
     const debug = opts?.debug || false;
     const audience_id = opts.audience_id;
     if (typeof audience_id !== "string") {
-        throw new TypeError(`Invalid audience ID: '${audience_id}'. Should be a string.`);
+        throw new TypeError(`Invalid audience ID: '${audience_id}'`, {
+            cause: `Audience ID is not a string. Received type '${typeof audience_id}'.`,
+        });
     }
-    else if (!apiServerIdSchema.safeParse(audience_id).success) {
-        throw new TypeError(`Invalid audience ID: '${audience_id}'. Should be a valid API server ID.`);
+    // Keysets are stored and looked up by the stable api server id (e.g. the
+    // auth server's own app id, or a resource API server UUID).
+    // The URL only appears in token `aud` claims, derived from this id via getTokenAudienceForApiServerId().
+    const parsedAudience = apiServerIdSchema.safeParse(audience_id);
+    if (!parsedAudience.success) {
+        throw new TypeError(`Invalid audience ID: '${audience_id}'.` +
+            " " +
+            `Should be a valid API server ID.`, {
+            cause: parsedAudience.error,
+        });
     }
     if (typeof opts?.keyset_id === "string") {
         if (!isValidUuid(opts.keyset_id)) {

package/dist/jwt/jwt_keys/generate_new_jwt_keyset.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate_new_jwt_keyset.js","sourceRoot":"","sources":["../../../src/jwt/jwt_keys/generate_new_jwt_keyset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,+BAA+B,MAAM,mCAAmC,CAAC;AAChF,OAAO,QAAQ,MAAM,YAAY,CAAC;AAClC,OAAO,qBAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAiB,KAAK;IAEtB,MAAM,wBAAwB,GAAG,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAC3B,MAAM,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEjD,OAAO,CAAC,UAAU,EAAE,SAAS,CAG5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,QAAiB,KAAK;IAEtB,MAAM,oBAAoB,GAAG,IAAI,+BAA+B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE3E,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,uDAAuD,EAAE;YACnE,UAAU;YACV,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,EAAE,SAAS,CAG5B,CAAC;AACJ,CAAC;AASD,MAAM,6BAA6B,GAAW,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAElF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA+B;IAE/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAY,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC;IAE5C,MAAM,WAAW,GAAW,IAAI,CAAC,WAAW,CAAC;IAC7C,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CACjB,yBAAyB,WAAW,wBAAwB,CAC7D,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CACjB,yBAAyB,WAAW,qCAAqC,CAC1E,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,uBAAuB,IAAI,CAAC,SAAS,yCAAyC,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,MAAM,CACJ,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,EACnD,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,EAC9C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,mCAAmC,CAAC,KAAK,CAAC;QAC1C,yBAAyB,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IAEH,MAAM,SAAS,GACb,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7E,MAAM,aAAa,GACjB,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ;QACrC,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC;IACjD,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2BAA2B,aAAa,kCAAkC,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAa,IAAI,QAAQ,CAAC;QAC3C,WAAW;QACX,SAAS;QACT,aAAa;QACb,UAAU,EAAE;YACV,qCAAqC;YACrC,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,uBAAuB;YAC9B,QAAQ,EAAE,YAAY;YACtB,SAAS;YACT,WAAW;SACZ;QACD,UAAU,EAAE;YACV,4DAA4D;YAC5D,KAAK,EAAE,wBAAwB;YAC/B,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,YAAY;YACtB,SAAS;YACT,WAAW;SACZ;QACD,OAAO,EAAE;YACP,KAAK,EAAE,iBAAiB;YACxB,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS;YACnB,SAAS;YACT,WAAW;SACZ;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,wBAAwB;YAC/B,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,cAAc;YACxB,SAAS;YACT,WAAW;SACZ;QACD,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,eAAe,oBAAoB,CAAC"}
+{"version":3,"file":"generate_new_jwt_keyset.js","sourceRoot":"","sources":["../../../src/jwt/jwt_keys/generate_new_jwt_keyset.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AACvC,OAAO,+BAA+B,MAAM,mCAAmC,CAAC;AAChF,OAAO,QAAQ,MAAM,YAAY,CAAC;AAClC,OAAO,qBAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAiB,KAAK;IAEtB,MAAM,wBAAwB,GAAG,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAC3B,MAAM,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEjD,OAAO,CAAC,UAAU,EAAE,SAAS,CAG5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,QAAiB,KAAK;IAEtB,MAAM,oBAAoB,GAAG,IAAI,+BAA+B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE3E,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,uDAAuD,EAAE;YACnE,UAAU;YACV,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,EAAE,SAAS,CAG5B,CAAC;AACJ,CAAC;AAUD,MAAM,6BAA6B,GAAW,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAElF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA+B;IAE/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAY,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC;IAE5C,MAAM,WAAW,GAAW,IAAI,CAAC,WAAW,CAAC;IAC7C,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,yBAAyB,WAAW,GAAG,EAAE;YAC3D,KAAK,EAAE,+CAA+C,OAAO,WAAW,IAAI;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,4DAA4D;IAC5D,yGAAyG;IACzG,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,yBAAyB,WAAW,IAAI;YACtC,GAAG;YACH,kCAAkC,EACpC;YACE,KAAK,EAAE,cAAc,CAAC,KAAK;SAC5B,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,uBAAuB,IAAI,CAAC,SAAS,yCAAyC,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,MAAM,CACJ,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,EACnD,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,EAC9C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,mCAAmC,CAAC,KAAK,CAAC;QAC1C,yBAAyB,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IAEH,MAAM,SAAS,GACb,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7E,MAAM,aAAa,GACjB,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ;QACrC,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC;IACjD,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,2BAA2B,aAAa,kCAAkC,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAa,IAAI,QAAQ,CAAC;QAC3C,WAAW;QACX,SAAS;QACT,aAAa;QACb,UAAU,EAAE;YACV,qCAAqC;YACrC,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,uBAAuB;YAC9B,QAAQ,EAAE,YAAY;YACtB,SAAS;YACT,WAAW;SACZ;QACD,UAAU,EAAE;YACV,4DAA4D;YAC5D,KAAK,EAAE,wBAAwB;YAC/B,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,YAAY;YACtB,SAAS;YACT,WAAW;SACZ;QACD,OAAO,EAAE;YACP,KAAK,EAAE,iBAAiB;YACxB,aAAa,EAAE,SAAS;YACxB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS;YACnB,SAAS;YACT,WAAW;SACZ;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,wBAAwB;YAC/B,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,cAAc;YACxB,SAAS;YACT,WAAW;SACZ;QACD,cAAc,EAAE,IAAI;KACrB,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,eAAe,oBAAoB,CAAC"}

package/dist/jwt/payload_data.d.ts

@@ -1,20 +1,21 @@
-import { z } from "zod";
-export declare const jwtPayloadSchema: z.ZodEffects<z.ZodObject<{
-    sub: z.ZodString;
-    uid: z.ZodString;
-    email: z.ZodString;
-    email_verified: z.ZodBoolean;
-    aud: z.ZodUnion<[z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail", string>]>;
-    app: z.ZodUnion<readonly [z.ZodString, z.ZodEffects<z.ZodString, "schemavaults-registry" | "schemavaults-auth" | "schemavaults-mail" | "schemavaults-web" | "schemavaults-cli", string>]>;
-    admin: z.ZodBoolean;
-    disabled: z.ZodBoolean;
-    created_at: z.ZodEffects<z.ZodNumber, number, number>;
-    sig: z.ZodString;
-    iss: z.ZodLiteral<"schemavaults-auth">;
-    env: z.ZodEnum<["development", "staging", "test", "production"]>;
-    jti: z.ZodOptional<z.ZodString>;
-    iat: z.ZodNumber;
-}, "strict", z.ZodTypeAny, {
+import type { z as zod } from "zod";
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+export declare function createJwtPayloadSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodEffects<zod.ZodEffects<zod.ZodObject<{
+    sub: zod.ZodString;
+    uid: zod.ZodString;
+    email: zod.ZodString;
+    email_verified: zod.ZodBoolean;
+    aud: zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>;
+    app: zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>;
+    admin: zod.ZodBoolean;
+    disabled: zod.ZodBoolean;
+    created_at: zod.ZodEffects<zod.ZodNumber, number, number>;
+    sig: zod.ZodString;
+    iss: zod.ZodString;
+    env: zod.ZodEnum<["development", "staging", "test", "production"]>;
+    jti: zod.ZodOptional<zod.ZodString>;
+    iat: zod.ZodNumber;
+}, "strict", zod.ZodTypeAny, {
     sub: string;
     uid: string;
     email: string;
@@ -25,7 +26,7 @@ export declare const jwtPayloadSchema: z.ZodEffects<z.ZodObject<{
     disabled: boolean;
     created_at: number;
     sig: string;
-    iss: "schemavaults-auth";
+    iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
@@ -40,7 +41,7 @@ export declare const jwtPayloadSchema: z.ZodEffects<z.ZodObject<{
     disabled: boolean;
     created_at: number;
     sig: string;
-    iss: "schemavaults-auth";
+    iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
@@ -55,7 +56,7 @@ export declare const jwtPayloadSchema: z.ZodEffects<z.ZodObject<{
     disabled: boolean;
     created_at: number;
     sig: string;
-    iss: "schemavaults-auth";
+    iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
@@ -70,9 +71,39 @@ export declare const jwtPayloadSchema: z.ZodEffects<z.ZodObject<{
     disabled: boolean;
     created_at: number;
     sig: string;
-    iss: "schemavaults-auth";
+    iss: string;
+    env: "development" | "staging" | "test" | "production";
+    iat: number;
+    jti?: string | undefined;
+}>, {
+    sub: string;
+    uid: string;
+    email: string;
+    email_verified: boolean;
+    aud: string;
+    app: string;
+    admin: boolean;
+    disabled: boolean;
+    created_at: number;
+    sig: string;
+    iss: string;
+    env: "development" | "staging" | "test" | "production";
+    iat: number;
+    jti?: string | undefined;
+}, {
+    sub: string;
+    uid: string;
+    email: string;
+    email_verified: boolean;
+    aud: string;
+    app: string;
+    admin: boolean;
+    disabled: boolean;
+    created_at: number;
+    sig: string;
+    iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
 }>;
-export type CustomJWTPayload = z.infer<typeof jwtPayloadSchema>;
+export type CustomJWTPayload = zod.infer<ReturnType<typeof createJwtPayloadSchema>>;

package/dist/jwt/payload_data.js

@@ -1,46 +1,54 @@
-import { z } from "zod";
-import { REFRESH_TOKEN_AUDIENCE } from "./aud";
-import { appIdSchema, schemaVaultsAppEnvironmentSchema, } from "@schemavaults/app-definitions";
-import { audienceRefSchema } from "@schemavaults/auth-common";
+import { appIdSchema, getAppEnvironment, schemaVaultsAppEnvironmentSchema, } from "@schemavaults/app-definitions";
+import { createAudienceSchema } from "@schemavaults/auth-common";
 // Data to hold in the JWT
-export const jwtPayloadSchema = z
-    .object({
-    uid: z.string().uuid(),
-    sub: z.string().uuid(),
-    email: z.string().email(),
-    email_verified: z.boolean(),
-    aud: audienceRefSchema, // Backend resource API UUID, either auth server url or a registered api server's unique UUID
-    app: appIdSchema, // Frontend client app UUID, either auth server url or a registered app's unique UUID
-    admin: z.boolean(),
-    disabled: z.boolean(),
-    created_at: z.number().refine(
-    // What time the user was created at
-    (creation_time) => {
-        return (creation_time <= Date.now());
-    }, "Creation time must not be in the future"),
-    sig: z.string().min(32).max(4096),
-    iss: z.literal(REFRESH_TOKEN_AUDIENCE),
-    env: schemaVaultsAppEnvironmentSchema,
-    jti: z.string().uuid().optional(),
-    iat: z.number().nonnegative(), // unix seconds (jose's setIssuedAt output)
-})
-    .required({
-    uid: true,
-    sub: true,
-    email: true,
-    email_verified: true,
-    aud: true,
-    app: true,
-    admin: true,
-    disabled: true,
-    created_at: true,
-    sig: true,
-    iss: true,
-    env: true,
-    iat: true,
-})
-    .strict()
-    .refine((jwt_payload) => {
-    return jwt_payload.sub === jwt_payload.uid;
-}, "Token subject does not match user ID");
+export function createJwtPayloadSchema(z, environment = getAppEnvironment()) {
+    return z
+        .object({
+        uid: z.string().uuid(),
+        sub: z.string().uuid(),
+        email: z.string().email(),
+        email_verified: z.boolean(),
+        aud: createAudienceSchema(z, environment), // Backend resource API UUID, either auth server url or a registered api server's unique UUID
+        app: appIdSchema, // Frontend client app UUID, either auth server url or a registered app's unique UUID
+        admin: z.boolean(),
+        disabled: z.boolean(),
+        created_at: z.number().refine(
+        // What time the user was created at
+        (creation_time) => {
+            return (creation_time <= Date.now());
+        }, "Creation time must not be in the future"),
+        sig: z.string().min(32).max(4096),
+        iss: z.string().url(),
+        env: schemaVaultsAppEnvironmentSchema,
+        jti: z.string().uuid().optional(),
+        iat: z.number().nonnegative(), // unix seconds (jose's setIssuedAt output)
+    })
+        .required({
+        uid: true,
+        sub: true,
+        email: true,
+        email_verified: true,
+        aud: true,
+        app: true,
+        admin: true,
+        disabled: true,
+        created_at: true,
+        sig: true,
+        iss: true,
+        env: true,
+        iat: true,
+    })
+        .strict()
+        .refine((jwt_payload) => {
+        return jwt_payload.sub === jwt_payload.uid;
+    }, "Token subject does not match user ID")
+        .refine((jwt_payload) => {
+        if (jwt_payload.env === "production" || jwt_payload.env === "staging") {
+            if (!jwt_payload.iss.startsWith("https://")) {
+                return false;
+            }
+        }
+        return true;
+    }, "Issuer must use HTTPS in production or staging environments!");
+}
 //# sourceMappingURL=payload_data.js.map

package/dist/jwt/payload_data.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload_data.js","sourceRoot":"","sources":["../../src/jwt/payload_data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EACL,WAAW,EACX,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,0BAA0B;AAC1B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,GAAG,EAAE,iBAAiB,EAAE,6FAA6F;IACrH,GAAG,EAAE,WAAW,EAAE,qFAAqF;IACvG,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM;IAC3B,oCAAoC;IACpC,CAAC,aAAa,EAAW,EAAE;QACzB,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,CAAmB,CAAC;IACzD,CAAC,EACD,yCAAyC,CAC1C;IACD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACtC,GAAG,EAAE,gCAAgC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,2CAA2C;CAC3E,CAAC;KACD,QAAQ,CAAC;IACR,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,IAAI;IACX,cAAc,EAAE,IAAI;IACpB,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,IAAI;IACX,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,IAAI;IAChB,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,IAAI;CACV,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;IACtB,OAAO,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,CAAC;AAC7C,CAAC,EAAE,sCAAsC,CAAC,CAAC"}
+{"version":3,"file":"payload_data.js","sourceRoot":"","sources":["../../src/jwt/payload_data.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,iBAAiB,EAEjB,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,0BAA0B;AAC1B,MAAM,UAAU,sBAAsB,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC;SACL,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC3B,GAAG,EAAE,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,6FAA6F;QACxI,GAAG,EAAE,WAAW,EAAE,qFAAqF;QACvG,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM;QAC3B,oCAAoC;QACpC,CAAC,aAAa,EAAW,EAAE;YACzB,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,CAAmB,CAAC;QACzD,CAAC,EACD,yCAAyC,CAC1C;QACD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,gCAAgC;QACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,2CAA2C;KAC3E,CAAC;SACD,QAAQ,CAAC;QACR,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,IAAI;QACpB,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;QAChB,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;KACV,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QACtB,OAAO,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,CAAC;IAC7C,CAAC,EAAE,sCAAsC,CAAC;SACzC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QACtB,IAAI,WAAW,CAAC,GAAG,KAAK,YAAY,IAAI,WAAW,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACtE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,8DAA8D,CAAC,CAAC;AACvE,CAAC"}

package/dist/jwt/sign.d.ts

@@ -1,7 +1,7 @@
 import { type CryptoKey } from "jose";
 import JWT_Keys from "./jwt_keys";
 import type { AuthTokenTypes } from "@schemavaults/auth-common";
-import type { SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 interface BaseSignJSONWebTokenInputOptions<TokenType extends AuthTokenTypes> {
     iat: number;
     uid: string;
@@ -9,6 +9,7 @@ interface BaseSignJSONWebTokenInputOptions<TokenType extends AuthTokenTypes> {
     audience: string;
     type: TokenType;
     env: SchemaVaultsAppEnvironment;
+    auth_server_url?: string;
     jti?: string;
 }
 interface SignJSONWebTokenInputWithAllKeysOptions<TokenType extends AuthTokenTypes> extends BaseSignJSONWebTokenInputOptions<TokenType> {
@@ -19,5 +20,5 @@ interface SignJSONWebTokenInputWithSigningCryptoKeyOptions<TokenType extends Aut
     keyset_id: string;
 }
 export type SignJSONWebTokenInputOptions<TokenType extends AuthTokenTypes> = SignJSONWebTokenInputWithAllKeysOptions<TokenType> | SignJSONWebTokenInputWithSigningCryptoKeyOptions<TokenType>;
-export declare function signJWT<TokenType extends AuthTokenTypes>(opts: SignJSONWebTokenInputOptions<TokenType>): Promise<string>;
+export declare function signJWT<TokenType extends AuthTokenTypes>({ type, uid, env, auth_server_url, ...opts }: SignJSONWebTokenInputOptions<TokenType>): Promise<string>;
 export {};

package/dist/jwt/sign.js

@@ -1,17 +1,14 @@
 import { SignJWT } from "jose";
 import JWT_Keys from "./jwt_keys";
-import { issuer } from "./iss";
 import { getExpiryDurationString } from "./expiry";
+import { getAuthServerUrl, } from "@schemavaults/app-definitions";
 import signAndVerifyAlg from "./sign_verify_alg";
 import isValidUuid from "../utils/isValidUuid";
-export async function signJWT(opts) {
-    const type = opts.type;
-    const uid = opts.uid;
+export async function signJWT({ type, uid, env, auth_server_url = getAuthServerUrl(env), ...opts }) {
     const sub = uid;
     if (typeof uid !== "string" || typeof sub !== "string" || uid !== sub) {
         throw new Error("uid and sub must be defined and equal strings");
     }
-    const env = opts.env;
     let private_signing_key;
     let keyset_id;
     try {
@@ -36,8 +33,18 @@ export async function signJWT(opts) {
         console.error("Failed to load private signing key from key store or input options: ", e);
         throw new Error("Failed to load private signing key from key store or input options!");
     }
-    if (!isValidUuid(keyset_id)) {
-        throw new Error("Invalid keyset ID provided!");
+    if (typeof keyset_id !== "string") {
+        throw new TypeError("Invalid keyset ID provided!", {
+            cause: `'keyset_id' is not a string! Received type '${typeof keyset_id}'.`,
+        });
+    }
+    else if (!isValidUuid(keyset_id)) {
+        throw new TypeError("Invalid keyset ID provided!", {
+            cause: `'keyset_id' is not a valid UUID!`,
+        });
+    }
+    if (typeof auth_server_url !== "string" || auth_server_url.length === 0) {
+        throw new TypeError("Failed to resolve auth server URL to be used as 'iss' claim!");
     }
     const signaturePayload = {
         sub,
@@ -55,7 +62,7 @@ export async function signJWT(opts) {
         })
             .setAudience(opts.audience)
             .setIssuedAt(opts.iat)
-            .setIssuer(issuer)
+            .setIssuer(auth_server_url)
             .setExpirationTime(getExpiryDurationString(type))
             .sign(private_signing_key);
     }

package/dist/jwt/sign.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/jwt/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,OAAO,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,QAAQ,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAGnD,OAAO,gBAAgB,MAAM,mBAAmB,CAAC;AACjD,OAAO,WAAW,MAAM,qBAAqB,CAAC;AA6B9C,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAA6C;IAE7C,MAAM,IAAI,GAAc,IAAI,CAAC,IAAI,CAAC;IAClC,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,CAAC;IAC7B,MAAM,GAAG,GAAW,GAAG,CAAC;IAExB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAErB,IAAI,mBAA8B,CAAC;IACnC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,YAAY,QAAQ,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAa,IAAI,CAAC,QAAQ,CAAC;YACzC,MAAM,mBAAmB,GACvB,QAAQ,CAAC,WAAW,CAAC;YACvB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,mBAAmB,GAAG,MAAM,mBAAmB,CAAC;YAChD,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACjC,CAAC;aAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YACjC,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC;YACvC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,sEAAsE,EACtE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,gBAAgB,GAAe;QACnC,GAAG;QACH,GAAG;QACH,IAAI;QACJ,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;aACvC,kBAAkB,CAAC;YAClB,GAAG,EAAE,gBAAgB;YACrB,SAAS;YACT,GAAG,EAAE,GAAG,SAAS,eAAe,EAAE,kCAAkC;SACrE,CAAC;aACD,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;aACrB,SAAS,CAAC,MAAM,CAAC;aACjB,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;aAChD,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/jwt/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,OAAO,EAAE,MAAM,MAAM,CAAC;AAChE,OAAO,QAAQ,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAEnD,OAAO,EACL,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,gBAAgB,MAAM,mBAAmB,CAAC;AACjD,OAAO,WAAW,MAAM,qBAAqB,CAAC;AA8B9C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAmC,EAC9D,IAAI,EACJ,GAAG,EACH,GAAG,EACH,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,EACvC,GAAG,IAAI,EACiC;IACxC,MAAM,GAAG,GAAW,GAAG,CAAC;IAExB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,mBAA8B,CAAC;IACnC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,YAAY,QAAQ,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAa,IAAI,CAAC,QAAQ,CAAC;YACzC,MAAM,mBAAmB,GACvB,QAAQ,CAAC,WAAW,CAAC;YACvB,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,mBAAmB,GAAG,MAAM,mBAAmB,CAAC;YAChD,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACjC,CAAC;aAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YACjC,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC;YACvC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,sEAAsE,EACtE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE;YACjD,KAAK,EAAE,+CAA+C,OAAO,SAAS,IAAI;SAC3E,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE;YACjD,KAAK,EAAE,kCAAkC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CACjB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAe;QACnC,GAAG;QACH,GAAG;QACH,IAAI;QACJ,GAAG;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC;aACvC,kBAAkB,CAAC;YAClB,GAAG,EAAE,gBAAgB;YACrB,SAAS;YACT,GAAG,EAAE,GAAG,SAAS,eAAe,EAAE,kCAAkC;SACrE,CAAC;aACD,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;aACrB,SAAS,CAAC,eAAe,CAAC;aAC1B,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;aAChD,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}

package/dist/jwt/verify_signature.d.ts

@@ -1,7 +1,7 @@
 import { type CryptoKey } from "jose";
 import { JWT_Keys } from "./jwt_keys";
 import type { AuthTokenTypes } from "@schemavaults/auth-common";
-import type { SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 interface BaseVerifyJWTSignatureInputOptions<TokenType extends AuthTokenTypes> {
     jwt: string;
     aud: string;
@@ -10,6 +10,7 @@ interface BaseVerifyJWTSignatureInputOptions<TokenType extends AuthTokenTypes> {
     sub: string;
     uid: string;
     env: SchemaVaultsAppEnvironment;
+    auth_server_url?: string;
     jti?: string;
 }
 interface VerifyJWTSignatureInputWithAllKeysOptions<TokenType extends AuthTokenTypes> extends BaseVerifyJWTSignatureInputOptions<TokenType> {
@@ -20,5 +21,5 @@ interface VerifyJWTSignatureInputWithVerificationKeyOptions<TokenType extends Au
     keyset_id: string;
 }
 export type VerifyJWTSignatureInputOptions<TokenType extends AuthTokenTypes> = VerifyJWTSignatureInputWithAllKeysOptions<TokenType> | VerifyJWTSignatureInputWithVerificationKeyOptions<TokenType>;
-export declare function verifyJWTSignature<TokenType extends AuthTokenTypes>({ jwt, ...opts }: VerifyJWTSignatureInputOptions<TokenType>): Promise<boolean>;
+export declare function verifyJWTSignature<TokenType extends AuthTokenTypes>({ jwt, env, auth_server_url, ...opts }: VerifyJWTSignatureInputOptions<TokenType>): Promise<boolean>;
 export {};

package/dist/jwt/verify_signature.js

@@ -1,9 +1,9 @@
-import { jwtVerify, decodeProtectedHeader } from "jose";
+import { jwtVerify, decodeProtectedHeader, } from "jose";
 import { JWT_Keys } from "./jwt_keys";
-import { issuer } from "./iss";
+import { getAuthServerUrl, } from "@schemavaults/app-definitions";
 import isValidUuid from "../utils/isValidUuid";
-import signVerifyAlg from './sign_verify_alg';
-export async function verifyJWTSignature({ jwt, ...opts }) {
+import signVerifyAlg from "./sign_verify_alg";
+export async function verifyJWTSignature({ jwt, env, auth_server_url = getAuthServerUrl(env), ...opts }) {
     if (typeof opts.aud !== "string") {
         console.error("Did not receive an audience option!");
         return false;
@@ -38,11 +38,11 @@ export async function verifyJWTSignature({ jwt, ...opts }) {
     let kid;
     try {
         const header = decodeProtectedHeader(jwt);
-        if (!header.alg || typeof header.alg !== 'string') {
+        if (!header.alg || typeof header.alg !== "string") {
             throw new Error("Missing 'alg' claim in protected header!");
         }
         alg = header.alg;
-        if (!header.kid || typeof header.kid !== 'string') {
+        if (!header.kid || typeof header.kid !== "string") {
             throw new Error("Missing 'kid' claim in protected header!");
         }
         kid = header.kid;
@@ -60,20 +60,23 @@ export async function verifyJWTSignature({ jwt, ...opts }) {
     if (kid !== `${keyset_id}-verification`) {
         throw new Error("Invalid key id; mismatch between 'kid' in header and key ID associated with verification key!");
     }
+    if (typeof auth_server_url !== "string" || auth_server_url.length === 0) {
+        throw new TypeError("Missing 'auth_server_url' to use as 'iss' claim verifier!");
+    }
     try {
         const verify_result = await jwtVerify(jwt, verification_key, {
             audience: opts.aud,
-            issuer,
+            issuer: auth_server_url,
             subject: opts.sub,
-            algorithms: [signVerifyAlg]
+            algorithms: [signVerifyAlg],
         });
         if (verify_result.payload.aud !== opts.aud) {
             throw new Error("Decoded payload does not match input audience!");
         }
-        if (verify_result.payload.iss !== issuer) {
+        if (verify_result.payload.iss !== auth_server_url) {
             throw new Error("Unexpected 'iss' claim in signature token!");
         }
-        if (verify_result.payload.env !== opts.env) {
+        if (verify_result.payload.env !== env) {
             throw new Error("App environment mismatch!");
         }
         if (opts.jti && verify_result.payload.jti !== opts.jti) {

package/dist/jwt/verify_signature.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify_signature.js","sourceRoot":"","sources":["../../src/jwt/verify_signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,SAAS,EAAwC,qBAAqB,EAA6B,MAAM,MAAM,CAAC;AAC1I,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAG/B,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAC9C,OAAO,aAAa,MAAM,mBAAmB,CAAC;AAgC9C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAEtC,EACA,GAAG,EACH,GAAG,IAAI,EACmC;IAC1C,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,gBAA2B,CAAC;IAChC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,YAAY,QAAQ,EAAE,CAAC;YAC5D,MAAM,kBAAkB,GAAuB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC9E,gBAAgB,GAAG,MAAM,kBAAkB,CAAC;YAC5C,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;YACtC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACzC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,uEAAuE,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAA8B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjB,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,CAAC;IAED,IAAI,GAAG,KAAK,GAAG,SAAS,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAgC,MAAM,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE;YACxF,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,GAAG;YACjB,UAAU,EAAE,CAAC,aAAa,CAAC;SAC5B,CAAC,CAAC;QAEH,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"verify_signature.js","sourceRoot":"","sources":["../../src/jwt/verify_signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,SAAS,EAGT,qBAAqB,GAEtB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EACL,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAC9C,OAAO,aAAa,MAAM,mBAAmB,CAAC;AA+B9C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAmC,EACzE,GAAG,EACH,GAAG,EACH,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,EACvC,GAAG,IAAI,EACmC;IAC1C,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,gBAA2B,CAAC;IAChC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,YAAY,QAAQ,EAAE,CAAC;YAC5D,MAAM,kBAAkB,GACtB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACjC,gBAAgB,GAAG,MAAM,kBAAkB,CAAC;YAC5C,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;YACtC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACzC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,uEAAuE,EACvE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,GAA8B,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjB,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,KAAK,GAAG,SAAS,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CACjB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAgC,MAAM,SAAS,CAChE,GAAG,EACH,gBAAgB,EAChB;YACE,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,IAAI,CAAC,GAAG;YACjB,UAAU,EAAE,CAAC,aAAa,CAAC;SAC5B,CACF,CAAC;QAEF,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/jwt",
   "description": "Utility functions for authentication and authorization for use from the auth server or a resource server",
-  "version": "0.7.34",
+  "version": "0.8.4",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -16,8 +16,8 @@
   "dependencies": {
     "zod": "3.25.8",
     "jose": "6.1.3",
-    "@schemavaults/auth-common": "0.13.2",
-    "@schemavaults/app-definitions": "0.7.1"
+    "@schemavaults/auth-common": "0.16.1",
+    "@schemavaults/app-definitions": "0.10.0"
   },
   "scripts": {
     "build": "tsc --project tsconfig.json && tsc-alias --project tsconfig.json",

package/dist/jwt/aud.d.ts

@@ -1 +0,0 @@
-export declare const REFRESH_TOKEN_AUDIENCE: "schemavaults-auth";

package/dist/jwt/aud.js

@@ -1,3 +0,0 @@
-import { SCHEMAVAULTS_AUTH_APP_DEFINITION } from "@schemavaults/app-definitions";
-export const REFRESH_TOKEN_AUDIENCE = SCHEMAVAULTS_AUTH_APP_DEFINITION.app_id;
-//# sourceMappingURL=aud.js.map

package/dist/jwt/aud.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"aud.js","sourceRoot":"","sources":["../../src/jwt/aud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAEjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,gCAAgC,CAAC,MAAM,CAAC"}

package/dist/jwt/iss.d.ts

@@ -1 +0,0 @@
-export declare const issuer: "schemavaults-auth";

package/dist/jwt/iss.js

@@ -1,3 +0,0 @@
-import { REFRESH_TOKEN_AUDIENCE } from "./aud";
-export const issuer = REFRESH_TOKEN_AUDIENCE;
-//# sourceMappingURL=iss.js.map

package/dist/jwt/iss.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"iss.js","sourceRoot":"","sources":["../../src/jwt/iss.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,OAAO,CAAC;AAE/C,MAAM,CAAC,MAAM,MAAM,GAAG,sBAAsB,CAAC"}