@stryker-mutator/dashboard-common 0.20.6 → 0.20.7

package/dist/src/crypto.d.ts

@@ -0,0 +1,26 @@
+import type { JWTPayload } from 'jose';
+/**
+ * @param secret The secret to derive from, `JWT_SECRET` in practice.
+ * @param purpose Names what the key is for, e.g. `'auth-token'`.
+ */
+export declare function deriveKey(secret: string, purpose: string): Promise<Uint8Array>;
+/**
+ * Creates and reads the authentication tokens handed out to the frontend.
+ *
+ * These are encrypted JWTs (JWE, RFC 7516) rather than signed ones, because they carry the user's
+ * GitHub access token.
+ *
+ * @note This module deliberately isn't re-exported from the package index, it relies on
+ * `node:crypto` and would end up in the frontend bundle.
+ */
+export declare class AuthTokenCodec {
+    #private;
+    /**
+     * @param secret The secret to derive the encryption key from, `JWT_SECRET` in practice. A key is
+     * derived rather than used as-is, because the same secret also signs the OAuth session cookie.
+     */
+    constructor(secret: string);
+    create(claims: JWTPayload): Promise<string>;
+    read<T>(token: string): Promise<T>;
+}
+//# sourceMappingURL=crypto.d.ts.map

package/dist/src/crypto.js

@@ -0,0 +1,57 @@
+import { hkdf as hkdfCallback } from 'node:crypto';
+import { promisify } from 'node:util';
+import { EncryptJWT, jwtDecrypt } from 'jose';
+const hkdf = promisify(hkdfCallback);
+const KEY_LENGTH = 32;
+/**
+ * @param secret The secret to derive from, `JWT_SECRET` in practice.
+ * @param purpose Names what the key is for, e.g. `'auth-token'`.
+ */
+export async function deriveKey(secret, purpose) {
+    return new Uint8Array(await hkdf('sha256', secret, '', purpose, KEY_LENGTH));
+}
+const KEY_MANAGEMENT_ALGORITHM = 'dir';
+const CONTENT_ENCRYPTION_ALGORITHM = 'A256GCM';
+/** The purpose the encryption key is derived for. */
+const KEY_INFO = 'auth-token';
+const ISSUER = 'stryker';
+const AUDIENCE = 'stryker';
+const EXPIRATION_TIME = '30m';
+/**
+ * Creates and reads the authentication tokens handed out to the frontend.
+ *
+ * These are encrypted JWTs (JWE, RFC 7516) rather than signed ones, because they carry the user's
+ * GitHub access token.
+ *
+ * @note This module deliberately isn't re-exported from the package index, it relies on
+ * `node:crypto` and would end up in the frontend bundle.
+ */
+export class AuthTokenCodec {
+    #key;
+    /**
+     * @param secret The secret to derive the encryption key from, `JWT_SECRET` in practice. A key is
+     * derived rather than used as-is, because the same secret also signs the OAuth session cookie.
+     */
+    constructor(secret) {
+        this.#key = deriveKey(secret, KEY_INFO);
+    }
+    async create(claims) {
+        return new EncryptJWT(claims)
+            .setProtectedHeader({ alg: KEY_MANAGEMENT_ALGORITHM, enc: CONTENT_ENCRYPTION_ALGORITHM })
+            .setIssuedAt()
+            .setIssuer(ISSUER)
+            .setAudience(AUDIENCE)
+            .setExpirationTime(EXPIRATION_TIME)
+            .encrypt(await this.#key);
+    }
+    async read(token) {
+        const { payload } = await jwtDecrypt(token, await this.#key, {
+            issuer: ISSUER,
+            audience: AUDIENCE,
+            keyManagementAlgorithms: [KEY_MANAGEMENT_ALGORITHM],
+            contentEncryptionAlgorithms: [CONTENT_ENCRYPTION_ALGORITHM],
+        });
+        return payload;
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stryker-mutator/dashboard-common",
-  "version": "0.20.6",
+  "version": "0.20.7",
   "type": "module",
   "description": "This package contains common utilities to be shared between the different dashboard components.",
   "scripts": {
@@ -20,11 +20,13 @@
   "main": "dist/src/index.js",
   "exports": {
     ".": "./dist/src/index.js",
+    "./crypto": "./dist/src/crypto.js",
     "./package.json": "./package.json"
   },
   "license": "Apache-2.0",
   "dependencies": {
+    "jose": "6.2.8",
     "mutation-testing-report-schema": "3.9.0"
   },
-  "gitHead": "53b9ecc0488216773b479e8eeb1301056474ee1b"
+  "gitHead": "619f1930a7f36026245db7c553b80fccbb955345"
 }