@shipfox/api-auth 2.0.0

package/dist/core/runner-session-token.js

@@ -0,0 +1,37 @@
+import { RUNNER_SESSION_TOKEN_AUDIENCE, runnerSessionTokenClaimsSchema } from '@shipfox/api-auth-dto';
+import { signHs256, verifyHs256 } from '@shipfox/node-jwt';
+import { config } from '#config.js';
+import { recordTokenIssued, recordTokenVerified } from '#metrics/index.js';
+export async function issueRunnerSessionToken(claims) {
+    const token = await signHs256({
+        payload: {
+            runnerSessionId: claims.runnerSessionId,
+            workspaceId: claims.workspaceId,
+            scope: claims.scope,
+            labels: claims.labels,
+            maxClaims: claims.maxClaims
+        },
+        secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,
+        expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,
+        audience: RUNNER_SESSION_TOKEN_AUDIENCE
+    });
+    recordTokenIssued('runner_session');
+    return token;
+}
+/** Returns the claims on success, or `null` for any invalid input — never throws. */ export async function verifyRunnerSessionToken(token) {
+    try {
+        const claims = await verifyHs256({
+            token,
+            secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,
+            schema: runnerSessionTokenClaimsSchema,
+            audience: RUNNER_SESSION_TOKEN_AUDIENCE
+        });
+        recordTokenVerified('runner_session', 'ok');
+        return claims;
+    } catch  {
+        recordTokenVerified('runner_session', 'rejected');
+        return null;
+    }
+}
+
+//# sourceMappingURL=runner-session-token.js.map

package/dist/core/runner-session-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n    },\n    secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input — never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","secret","AUTH_RUNNER_SESSION_TOKEN_SECRET","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;QAC7B;QACAC,QAAQZ,OAAOa,gCAAgC;QAC/CC,WAAWd,OAAOe,oCAAoC;QACtDC,UAAUpB;IACZ;IACAK,kBAAkB;IAClB,OAAOI;AACT;AAEA,mFAAmF,GACnF,OAAO,eAAeY,yBACpBZ,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAO,QAAQZ,OAAOa,gCAAgC;YAC/CK,QAAQrB;YACRmB,UAAUpB;QACZ;QACAM,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}