@sphereon/ssi-express-support 0.37.1-next.5 → 0.37.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sphereon/ssi-express-support",
-  "version": "0.37.1-next.5+14e4bec8",
+  "version": "0.37.1",
   "source": "src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -23,7 +23,7 @@
     "start:energyshr": "cross-env ENVIRONMENT=EnergySHR NODE_ENV=energyshr node --experimental-specifier-resolution=node --loader ts-node/esm __tests__/index.ts"
   },
   "dependencies": {
-    "@sphereon/ssi-types": "0.37.1-next.5+14e4bec8",
+    "@sphereon/ssi-types": "0.37.1",
     "body-parser": "^1.20.2",
     "casbin": "^5.30.0",
     "cookie-session": "^2.1.0",
@@ -51,15 +51,20 @@
     "@types/passport": "^1.0.16",
     "@types/passport-azure-ad": "^4.3.6",
     "@types/passport-http-bearer": "^1.0.41",
+    "@types/passport-jwt": "^4.0.1",
     "@types/qs": "^6.9.15",
     "cross-env": "^7.0.3",
     "jose": "^4.15.9",
+    "jwks-rsa": "^3.2.2",
+    "passport-jwt": "^4.0.1",
     "typescript": "5.8.3"
   },
   "peerDependencies": {
     "@noble/hashes": "1.6.1",
+    "jwks-rsa": "^3.2.2",
     "passport-azure-ad": "^4.3.5",
-    "passport-http-bearer": "^1.0.1"
+    "passport-http-bearer": "^1.0.1",
+    "passport-jwt": "^4.0.1"
   },
   "peerDependenciesMeta": {
     "passport-http-bearer": {
@@ -70,6 +75,12 @@
     },
     "passport-azure-ad": {
       "optional": true
+    },
+    "jwks-rsa": {
+      "optional": true
+    },
+    "passport-jwt": {
+      "optional": true
     }
   },
   "files": [
@@ -89,5 +100,5 @@
     "SSI",
     "Agent"
   ],
-  "gitHead": "14e4bec846cf7534ab57d0f51bf480427933c132"
+  "gitHead": "f77778193dc9235727d306be0449c5bf05b63cbe"
 }

package/src/index.ts

@@ -1,4 +1,5 @@
 export * from './entra-id-auth'
+export * from './oidc-bearer-auth'
 export * from './static-bearer-auth'
 export * from './auth-utils'
 export * from './express-builders'

package/src/oidc-bearer-auth.ts

@@ -0,0 +1,148 @@
+import passport from 'passport'
+
+export type OIDCAlgorithm = 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'PS256' | 'PS384' | 'PS512'
+
+export interface IOIDCBearerOptions {
+  issuer: string
+  audience?: string | string[]
+  jwksUri?: string
+  algorithms?: OIDCAlgorithm[]
+}
+
+export interface IOIDCTokenPayload {
+  /** Issuer identifier */
+  iss?: string
+  /** Subject identifier */
+  sub?: string
+  /** Audience(s) */
+  aud?: string | string[]
+  /** Expiration time */
+  exp?: number
+  /** Not before */
+  nbf?: number
+  /** Issued at */
+  iat?: number
+  /** JWT ID */
+  jti?: string
+  /** Authorized party */
+  azp?: string
+  /** Scope */
+  scope?: string
+  /** Client ID */
+  client_id?: string
+  /** Additional claims */
+  [key: string]: unknown
+}
+
+export class OIDCBearerAuth {
+  private readonly strategy: string
+  private options: Partial<IOIDCBearerOptions> = {}
+
+  public static init(strategy: string) {
+    return new OIDCBearerAuth(strategy)
+  }
+
+  private constructor(strategy: string) {
+    this.strategy = strategy
+  }
+
+  public withIssuer(issuer: string): this {
+    this.options = { ...this.options, issuer }
+    return this
+  }
+
+  public withAudience(audience: string | string[]): this {
+    this.options = { ...this.options, audience }
+    return this
+  }
+
+  public withJwksUri(jwksUri: string): this {
+    this.options = { ...this.options, jwksUri }
+    return this
+  }
+
+  public withAlgorithms(algorithms: OIDCAlgorithm[]): this {
+    this.options = { ...this.options, algorithms }
+    return this
+  }
+
+  public withOptions(options: Partial<IOIDCBearerOptions>): this {
+    this.options = { ...this.options, ...options }
+    return this
+  }
+
+  async connectPassport(): Promise<void> {
+    const { issuer, audience, algorithms } = this.options
+
+    if (!issuer) {
+      return Promise.reject(new Error('No issuer supplied for OIDC Bearer Auth'))
+    }
+
+    let jwksUri = this.options.jwksUri
+    if (!jwksUri) {
+      jwksUri = await this.discoverJwksUri(issuer)
+    }
+
+    try {
+      const [passportJwt, jwksRsa] = await Promise.all([import('passport-jwt'), import('jwks-rsa')])
+
+      const { Strategy: JwtStrategy, ExtractJwt } = passportJwt
+      const { passportJwtSecret } = jwksRsa
+
+      const jwtOptions = {
+        jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+        secretOrKeyProvider: passportJwtSecret({
+          cache: true,
+          rateLimit: true,
+          jwksRequestsPerMinute: 5,
+          jwksUri,
+        }),
+        issuer,
+        audience,
+        algorithms: algorithms ?? (['RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512'] as OIDCAlgorithm[]),
+      }
+
+      passport.use(
+        this.strategy,
+        new JwtStrategy(jwtOptions, (payload: IOIDCTokenPayload, done: (error: any, user?: any, info?: any) => void) => {
+          if (payload) {
+            return done(null, payload)
+          }
+          return done('Bearer token not found or incorrect', null)
+        })
+      )
+    } catch (error) {
+      console.error('Failed to initialize OIDC Bearer Auth:', error)
+      return Promise.reject(
+        new Error(
+          'Could not create JWT bearer strategy. Did you include "passport-jwt" and "jwks-rsa" dependencies in package.json?',
+          { cause: error }
+        )
+      )
+    }
+  }
+
+  private async discoverJwksUri(issuer: string): Promise<string> {
+    const wellKnownUrl = `${issuer}${issuer.endsWith('/') ? '' : '/'}.well-known/openid-configuration`
+
+    try {
+      const response = await fetch(wellKnownUrl)
+      if (!response.ok) {
+        return Promise.reject(
+          new Error(`Failed to fetch OIDC configuration from ${wellKnownUrl}: ${response.status} ${response.statusText}`)
+        )
+      }
+
+      const config = (await response.json()) as { jwks_uri?: string }
+      if (!config.jwks_uri) {
+        return Promise.reject(new Error(`OIDC configuration at ${wellKnownUrl} does not contain jwks_uri`))
+      }
+
+      return config.jwks_uri
+    } catch (error) {
+      return Promise.reject(
+        new Error(`Failed to discover JWKS URI from OIDC configuration at ${wellKnownUrl}`, { cause: error })
+      )
+    }
+  }
+}