@stackframe/stack-shared 2.5.30 → 2.5.31

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @stackframe/stack-shared
 
+## 2.5.31
+
+### Patch Changes
+
+- JWKS
+  - @stackframe/stack-sc@2.5.31
+
 ## 2.5.30
 
 ### Patch Changes

package/dist/utils/jwt.d.ts

@@ -1,3 +1,21 @@
 import * as jose from "jose";
-export declare function encryptJWT(payload: any, expirationTime?: string): Promise<string>;
-export declare function decryptJWT(jwt: string): Promise<jose.JWTPayload>;
+export declare function signJWT(issuer: string, payload: any, expirationTime?: string): Promise<string>;
+export declare function verifyJWT(issuer: string, jwt: string): Promise<jose.JWTPayload>;
+export declare function getPrivateJwk(): Promise<{
+    kty: string;
+    crv: string;
+    d: string;
+    x: string;
+    y: string;
+}>;
+export declare function getPublicJwkSet(): Promise<{
+    keys: Pick<{
+        kty: string;
+        crv: string;
+        d: string;
+        x: string;
+        y: string;
+    }, "kty" | "crv" | "x" | "y">[];
+}>;
+export declare function encryptJWE(payload: any, expirationTime?: string): Promise<string>;
+export declare function decryptJWE(jwt: string): Promise<jose.JWTPayload>;

package/dist/utils/jwt.js

@@ -1,14 +1,56 @@
 import * as jose from "jose";
 import { getEnvVariable } from "./env";
+import elliptic from "elliptic";
+import { globalVar } from "./globals";
+import { encodeBase64 } from "./bytes";
+import { pick } from "./objects";
 const STACK_SERVER_SECRET = jose.base64url.decode(getEnvVariable("STACK_SERVER_SECRET"));
-export async function encryptJWT(payload, expirationTime = "5m") {
+export async function signJWT(issuer, payload, expirationTime = "5m") {
+    const privateJwk = await jose.importJWK(await getPrivateJwk());
+    return await new jose.SignJWT(payload)
+        .setProtectedHeader({ alg: "ES256" })
+        .setIssuer(issuer)
+        .setIssuedAt()
+        .setExpirationTime(expirationTime)
+        .sign(privateJwk);
+}
+export async function verifyJWT(issuer, jwt) {
+    const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet());
+    const verified = await jose.jwtVerify(jwt, jwkSet, {
+        issuer,
+    });
+    return verified.payload;
+}
+export async function getPrivateJwk() {
+    const secretHash = await globalVar.crypto.subtle.digest("SHA-256", STACK_SERVER_SECRET);
+    const priv = new Uint8Array(secretHash);
+    const ec = new elliptic.ec('p256');
+    const key = ec.keyFromPrivate(priv);
+    const publicKey = key.getPublic();
+    return {
+        kty: 'EC',
+        crv: 'P-256',
+        d: encodeBase64(priv),
+        x: encodeBase64(publicKey.getX().toBuffer()),
+        y: encodeBase64(publicKey.getY().toBuffer()),
+    };
+}
+export async function getPublicJwkSet() {
+    const privateJwk = await getPrivateJwk();
+    const jwk = pick(privateJwk, ["kty", "crv", "x", "y"]);
+    return {
+        keys: [jwk]
+    };
+}
+export async function encryptJWE(payload, expirationTime = "5m") {
     return await new jose.EncryptJWT(payload)
         .setProtectedHeader({ alg: "dir", enc: "A128CBC-HS256" })
+        .setIssuer("stack")
         .setIssuedAt()
         .setExpirationTime(expirationTime)
         .encrypt(STACK_SERVER_SECRET);
 }
-export async function decryptJWT(jwt) {
+export async function decryptJWE(jwt) {
     if (!jwt) {
         throw new Error("Provided JWT is empty");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackframe/stack-shared",
-  "version": "2.5.30",
+  "version": "2.5.31",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -33,18 +33,20 @@
   },
   "dependencies": {
     "bcrypt": "^5.1.1",
+    "elliptic": "^6.5.7",
     "jose": "^5.2.2",
     "oauth4webapi": "^2.10.3",
     "uuid": "^9.0.1",
-    "@stackframe/stack-sc": "2.5.30"
+    "@stackframe/stack-sc": "2.5.31"
   },
   "devDependencies": {
-    "rimraf": "^5.0.5",
     "@types/bcrypt": "^5.0.2",
+    "@types/elliptic": "^6.4.18",
     "@types/react": "^18.2.66",
     "@types/uuid": "^9.0.8",
     "next": "^14.1.0",
-    "react": "^18.2.0"
+    "react": "^18.2.0",
+    "rimraf": "^5.0.5"
   },
   "scripts": {
     "build": "tsc",