@stackframe/stack-shared 2.6.2 → 2.6.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @stackframe/stack-shared
 
+## 2.6.3
+
+### Patch Changes
+
+- Bugfixes
+  - @stackframe/stack-sc@2.6.3
+
 ## 2.6.2
 
 ### Patch Changes

package/dist/interface/crud/projects.d.ts

@@ -12,6 +12,7 @@ export declare const projectsCrudAdminReadSchema: import("yup").ObjectSchema<{
         sign_up_enabled: NonNullable<boolean | undefined>;
         credential_enabled: NonNullable<boolean | undefined>;
         magic_link_enabled: NonNullable<boolean | undefined>;
+        legacy_global_jwt_signing: NonNullable<boolean | undefined>;
         client_team_creation_enabled: NonNullable<boolean | undefined>;
         client_user_deletion_enabled: NonNullable<boolean | undefined>;
         oauth_providers: {
@@ -60,6 +61,7 @@ export declare const projectsCrudAdminReadSchema: import("yup").ObjectSchema<{
         sign_up_enabled: undefined;
         credential_enabled: undefined;
         magic_link_enabled: undefined;
+        legacy_global_jwt_signing: undefined;
         client_team_creation_enabled: undefined;
         client_user_deletion_enabled: undefined;
         oauth_providers: undefined;
@@ -113,6 +115,7 @@ export declare const projectsCrudAdminUpdateSchema: import("yup").ObjectSchema<{
         sign_up_enabled?: boolean | undefined;
         credential_enabled?: boolean | undefined;
         magic_link_enabled?: boolean | undefined;
+        legacy_global_jwt_signing?: false | undefined;
         client_team_creation_enabled?: boolean | undefined;
         client_user_deletion_enabled?: boolean | undefined;
         oauth_providers?: {
@@ -160,6 +163,7 @@ export declare const projectsCrudAdminCreateSchema: import("yup").ObjectSchema<{
         sign_up_enabled?: boolean | undefined;
         credential_enabled?: boolean | undefined;
         magic_link_enabled?: boolean | undefined;
+        legacy_global_jwt_signing?: false | undefined;
         client_team_creation_enabled?: boolean | undefined;
         client_user_deletion_enabled?: boolean | undefined;
         oauth_providers?: {
@@ -240,6 +244,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
             sign_up_enabled: NonNullable<boolean | undefined>;
             credential_enabled: NonNullable<boolean | undefined>;
             magic_link_enabled: NonNullable<boolean | undefined>;
+            legacy_global_jwt_signing: NonNullable<boolean | undefined>;
             client_team_creation_enabled: NonNullable<boolean | undefined>;
             client_user_deletion_enabled: NonNullable<boolean | undefined>;
             oauth_providers: {
@@ -288,6 +293,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
             sign_up_enabled: undefined;
             credential_enabled: undefined;
             magic_link_enabled: undefined;
+            legacy_global_jwt_signing: undefined;
             client_team_creation_enabled: undefined;
             client_user_deletion_enabled: undefined;
             oauth_providers: undefined;
@@ -316,6 +322,7 @@ export declare const projectsCrud: import("../../crud").CrudSchemaFromOptions<{
             sign_up_enabled?: boolean | undefined;
             credential_enabled?: boolean | undefined;
             magic_link_enabled?: boolean | undefined;
+            legacy_global_jwt_signing?: false | undefined;
             client_team_creation_enabled?: boolean | undefined;
             client_user_deletion_enabled?: boolean | undefined;
             oauth_providers?: {
@@ -393,6 +400,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
             sign_up_enabled: NonNullable<boolean | undefined>;
             credential_enabled: NonNullable<boolean | undefined>;
             magic_link_enabled: NonNullable<boolean | undefined>;
+            legacy_global_jwt_signing: NonNullable<boolean | undefined>;
             client_team_creation_enabled: NonNullable<boolean | undefined>;
             client_user_deletion_enabled: NonNullable<boolean | undefined>;
             oauth_providers: {
@@ -441,6 +449,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
             sign_up_enabled: undefined;
             credential_enabled: undefined;
             magic_link_enabled: undefined;
+            legacy_global_jwt_signing: undefined;
             client_team_creation_enabled: undefined;
             client_user_deletion_enabled: undefined;
             oauth_providers: undefined;
@@ -469,6 +478,7 @@ export declare const internalProjectsCrud: import("../../crud").CrudSchemaFromOp
             sign_up_enabled?: boolean | undefined;
             credential_enabled?: boolean | undefined;
             magic_link_enabled?: boolean | undefined;
+            legacy_global_jwt_signing?: false | undefined;
             client_team_creation_enabled?: boolean | undefined;
             client_user_deletion_enabled?: boolean | undefined;
             oauth_providers?: {

package/dist/interface/crud/projects.js

@@ -43,6 +43,8 @@ export const projectsCrudAdminReadSchema = yupObject({
         sign_up_enabled: schemaFields.projectSignUpEnabledSchema.required(),
         credential_enabled: schemaFields.projectCredentialEnabledSchema.required(),
         magic_link_enabled: schemaFields.projectMagicLinkEnabledSchema.required(),
+        // TODO: remove this
+        legacy_global_jwt_signing: schemaFields.yupBoolean().required(),
         client_team_creation_enabled: schemaFields.projectClientTeamCreationEnabledSchema.required(),
         client_user_deletion_enabled: schemaFields.projectClientUserDeletionEnabledSchema.required(),
         oauth_providers: yupArray(oauthProviderSchema.required()).required(),
@@ -76,6 +78,7 @@ export const projectsCrudAdminUpdateSchema = yupObject({
         magic_link_enabled: schemaFields.projectMagicLinkEnabledSchema.optional(),
         client_team_creation_enabled: schemaFields.projectClientTeamCreationEnabledSchema.optional(),
         client_user_deletion_enabled: schemaFields.projectClientUserDeletionEnabledSchema.optional(),
+        legacy_global_jwt_signing: schemaFields.yupBoolean().isFalse().optional(),
         allow_localhost: schemaFields.projectAllowLocalhostSchema.optional(),
         email_config: emailConfigSchema.optional().default(undefined),
         domains: yupArray(domainSchema.required()).optional().default(undefined),

package/dist/utils/jwt.d.ts

@@ -1,21 +1,36 @@
 import * as jose from "jose";
-export declare function signJWT(issuer: string, payload: any, expirationTime?: string): Promise<string>;
-export declare function verifyJWT(issuer: string, jwt: string): Promise<jose.JWTPayload>;
-export declare function getPrivateJwk(): Promise<{
+export declare function legacySignGlobalJWT(issuer: string, payload: any, expirationTime?: string): Promise<string>;
+export declare function legacyVerifyGlobalJWT(issuer: string, jwt: string): Promise<jose.JWTPayload>;
+export declare function signJWT(options: {
+    issuer: string;
+    audience: string;
+    payload: any;
+    expirationTime?: string;
+}): Promise<string>;
+export declare function verifyJWT(options: {
+    issuer: string;
+    jwt: string;
+}): Promise<jose.JWTPayload>;
+export declare function getPrivateJwk(secret: string): Promise<{
     kty: string;
     crv: string;
     d: string;
     x: string;
     y: string;
 }>;
-export declare function getPublicJwkSet(): Promise<{
-    keys: Pick<{
+export declare function getPublicJwkSet(secret: string): Promise<{
+    keys: {
+        kid: string;
+        x: string;
         kty: string;
         crv: string;
-        d: string;
-        x: string;
         y: string;
-    }, "x" | "kty" | "crv" | "y">[];
+    }[];
 }>;
-export declare function encryptJWE(payload: any, expirationTime?: string): Promise<string>;
-export declare function decryptJWE(jwt: string): Promise<jose.JWTPayload>;
+export declare function getPerAudienceSecret(options: {
+    audience: string;
+    secret: string;
+}): string;
+export declare function getKid(options: {
+    secret: string;
+}): string;

package/dist/utils/jwt.js

@@ -4,9 +4,18 @@ import { encodeBase64 } from "./bytes";
 import { getEnvVariable } from "./env";
 import { globalVar } from "./globals";
 import { pick } from "./objects";
-const STACK_SERVER_SECRET = jose.base64url.decode(getEnvVariable("STACK_SERVER_SECRET"));
-export async function signJWT(issuer, payload, expirationTime = "5m") {
-    const privateJwk = await jose.importJWK(await getPrivateJwk());
+import crypto from "crypto";
+import { JOSEError } from "jose/errors";
+const STACK_SERVER_SECRET = getEnvVariable("STACK_SERVER_SECRET");
+try {
+    jose.base64url.decode(STACK_SERVER_SECRET);
+}
+catch (e) {
+    throw new Error("STACK_SERVER_SECRET is not valid. Please use the generateKeys script to generate a new secret.");
+}
+// TODO: remove this after moving everyone to project specific JWTs
+export async function legacySignGlobalJWT(issuer, payload, expirationTime = "5m") {
+    const privateJwk = await jose.importJWK(await getPrivateJwk(STACK_SERVER_SECRET));
     return await new jose.SignJWT(payload)
         .setProtectedHeader({ alg: "ES256" })
         .setIssuer(issuer)
@@ -14,15 +23,36 @@ export async function signJWT(issuer, payload, expirationTime = "5m") {
         .setExpirationTime(expirationTime)
         .sign(privateJwk);
 }
-export async function verifyJWT(issuer, jwt) {
-    const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet());
-    const verified = await jose.jwtVerify(jwt, jwkSet, {
-        issuer,
-    });
+// TODO: remove this after moving everyone to project specific JWTs
+export async function legacyVerifyGlobalJWT(issuer, jwt) {
+    const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(STACK_SERVER_SECRET));
+    const verified = await jose.jwtVerify(jwt, jwkSet, { issuer });
     return verified.payload;
 }
-export async function getPrivateJwk() {
-    const secretHash = await globalVar.crypto.subtle.digest("SHA-256", STACK_SERVER_SECRET);
+export async function signJWT(options) {
+    const secret = getPerAudienceSecret({ audience: options.audience, secret: STACK_SERVER_SECRET });
+    const kid = getKid({ secret });
+    const privateJwk = await jose.importJWK(await getPrivateJwk(secret));
+    return await new jose.SignJWT(options.payload)
+        .setProtectedHeader({ alg: "ES256", kid })
+        .setIssuer(options.issuer)
+        .setIssuedAt()
+        .setAudience(options.audience)
+        .setExpirationTime(options.expirationTime || "5m")
+        .sign(privateJwk);
+}
+export async function verifyJWT(options) {
+    const audience = jose.decodeJwt(options.jwt).aud;
+    if (!audience || typeof audience !== "string") {
+        throw new JOSEError("Invalid JWT audience");
+    }
+    const secret = getPerAudienceSecret({ audience, secret: STACK_SERVER_SECRET });
+    const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(secret));
+    const verified = await jose.jwtVerify(options.jwt, jwkSet, { issuer: options.issuer });
+    return verified.payload;
+}
+export async function getPrivateJwk(secret) {
+    const secretHash = await globalVar.crypto.subtle.digest("SHA-256", jose.base64url.decode(secret));
     const priv = new Uint8Array(secretHash);
     const ec = new elliptic.ec('p256');
     const key = ec.keyFromPrivate(priv);
@@ -35,24 +65,23 @@ export async function getPrivateJwk() {
         y: encodeBase64(publicKey.getY().toBuffer()),
     };
 }
-export async function getPublicJwkSet() {
-    const privateJwk = await getPrivateJwk();
+export async function getPublicJwkSet(secret) {
+    const privateJwk = await getPrivateJwk(secret);
     const jwk = pick(privateJwk, ["kty", "crv", "x", "y"]);
     return {
-        keys: [jwk]
+        keys: [{ ...jwk, kid: getKid({ secret }) }],
     };
 }
-export async function encryptJWE(payload, expirationTime = "5m") {
-    return await new jose.EncryptJWT(payload)
-        .setProtectedHeader({ alg: "dir", enc: "A128CBC-HS256" })
-        .setIssuer("stack")
-        .setIssuedAt()
-        .setExpirationTime(expirationTime)
-        .encrypt(STACK_SERVER_SECRET);
+export function getPerAudienceSecret(options) {
+    return jose.base64url.encode(crypto
+        .createHash('sha256')
+        .update(JSON.stringify([options.secret, options.audience]))
+        .digest());
 }
-export async function decryptJWE(jwt) {
-    if (!jwt) {
-        throw new Error("Provided JWT is empty");
-    }
-    return (await jose.jwtDecrypt(jwt, STACK_SERVER_SECRET)).payload;
+;
+export function getKid(options) {
+    return jose.base64url.encode(crypto
+        .createHash('sha256')
+        .update(JSON.stringify([options.secret, "kid"]))
+        .digest()).slice(0, 12);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackframe/stack-shared",
-  "version": "2.6.2",
+  "version": "2.6.3",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -38,7 +38,7 @@
     "oauth4webapi": "^2.10.3",
     "semver": "^7.6.3",
     "uuid": "^9.0.1",
-    "@stackframe/stack-sc": "2.6.2"
+    "@stackframe/stack-sc": "2.6.3"
   },
   "devDependencies": {
     "@types/bcrypt": "^5.0.2",