@t4h.framework/jwks 0.7.6 → 0.7.8

package/.ai/skills/framework-jwks/SKILL.md

@@ -1,276 +1,108 @@
 ---
 name: framework-jwks
 description: >-
-  JWKS-backed authorization for T4H Framework workflows and apps. Use when
-  importing @t4h.framework/jwks, wiring JWKSAuthorization on Workflow or App,
-  validating RS256 JWTs against a JWKS endpoint, verifying detached signatures
-  with kid/algorithm/signatureFormat, configuring issuer/audience checks, or
-  implementing the @t4h.framework/jwks/authorize runtime handler. Requires
-  @t4h.framework/core. Package path: framework/packages/jwks.
+  Verifies RS256 JWTs and detached public-key signatures against a JWKS
+  endpoint with @t4h.framework/jwks. Use when a T4H Framework workflow or App
+  needs JWKSAuthorization, when an async activity such as webhook() declares
+  auth { type: 'jwt' } or auth { type: 'jwks' } for its callbacks, or when the
+  user mentions a JWKS URL, .well-known/jwks.json, kid, issuer, audience,
+  JWKSAlgorithm, a bearer JWT (Google Pub/Sub push, Cloud Tasks) or a signature
+  verified with a key published in a JWKS.
 ---
 
 # @t4h.framework/jwks
 
-JWKS-backed **Authorization** for workflows and apps. Exposes `JWKSAuthorization` (core manifest) and a default runtime handler at `@t4h.framework/jwks/authorize` that fetches signing keys from a JWKS URL and verifies credentials.
+The package has two uses. Pick the one that matches the task:
 
-**Peer dependency:** `@t4h.framework/core` (same major line).
+- **Protect a workflow or an `App`**: `new JWKSAuthorization(context)`.
+- **Verify the callbacks of an async activity**: declare
+  `auth: { type: 'jwt', … }` or `auth: { type: 'jwks', … }` on the activity
+  (for `webhook()`, see the **framework-webhook** skill). The host verifies
+  each callback with `@t4h.framework/jwks/callback`. You do not import it.
 
-**Node:** `>=22`.
+## Protect a workflow or an App
 
-Package path: `framework/packages/jwks`. See [README.md](../../../README.md) for overview (field names below match **source**, not older README examples that mention `value`).
-
----
-
-## Imports
-
-| Entry | Purpose |
-|-------|---------|
-| `@t4h.framework/jwks` | `JWKSAuthorization`, `JWKSAuthorizationContext`, `JWKSAuthorizationManifest`, `JWKSAlgorithm`, re-exports authorize module |
-| `@t4h.framework/jwks/authorize` | Default async handler: `(context) => Promise<boolean>` |
-| `@t4h.framework/jwks/callback` | Default export `jwksCallback`: `(auth, delivery) => Promise<boolean>`, the authorizer hosts pass to the core `AsyncActivityCallback.authorize` for `jwt` (bearer JWT) and `jwks` (detached signature over the body, key resolved by `kid` from a JWKS URL) |
-
-```typescript
-import {
-  JWKSAuthorization,
-  type JWKSAuthorizationContext,
-  JWKSAlgorithm,
-} from '@t4h.framework/jwks'
-```
-
-Do **not** assume OIDC discovery, env-variable mapping, or `credentialSource` helpers—this package does not read HTTP headers or env. Your app or hosting layer supplies `signature`, `rawPayload`, and `url`.
-
----
-
-## Wiring authorization (core)
-
-`JWKSAuthorization` extends core `Authorization`. Attach to a **Workflow** or **App**; `toManifest()` registers the handler module for the platform.
+The handler picks the path from `signature`: a value that decodes as a JWT
+takes the JWT path, any other value takes the raw-payload path.
 
 ```typescript
-import { App, Workflow } from '@t4h.framework/core'
 import { JWKSAuthorization } from '@t4h.framework/jwks'
 
-const authorization = new JWKSAuthorization({
+export const authorization = new JWKSAuthorization({
   url: 'https://auth.example.com/.well-known/jwks.json',
-  signature: '<credential-from-runtime>',
-  rawPayload: '<payload-or-same-as-jwt>',
+  signature: '<jwt-from-the-request>',
+  rawPayload: '',
+  issuer: 'https://auth.example.com/',
   audience: 'https://api.example.com',
 })
-
-const workflow = new Workflow(
-  { id: 'protected/v1', authorization },
-  async () => ({ ok: true }),
-)
-
-const app = new App({
-  id: 'my-app',
-  workflows: [workflow],
-  authorization, // optional app-level default
-})
 ```
 
-Manifest shape (from tests):
-
-```typescript
-{
-  pathToModule: '@t4h.framework/jwks/authorize',
-  context: {
-    url: string
-    signature: string
-    rawPayload: string
-    issuer?: string
-    audience?: string
-    kid?: string
-    algorithm?: string
-    signatureFormat?: string
-  },
-}
-```
-
-Optional manifest fields are still present as `undefined` when omitted (`toManifest` copies all keys).
-
----
-
-## Context: `JWKSAuthorizationContext`
+Attach it to the `authorization` option of a `Workflow` or an `App`. For a
+detached signature, give the signed bytes in `rawPayload` and set `kid`,
+`algorithm` and `signatureFormat`.
 
-| Field | Required | Description |
-|-------|----------|-------------|
-| `url` | Yes | JWKS document URL (`jwks-rsa` `jwksUri`). |
-| `signature` | Yes | Credential to verify: JWT string, or detached signature for non-JWT path. Empty string → handler returns `false`. |
-| `rawPayload` | Yes | Payload bytes as string for non-JWT verification; for JWT path, tests pass the same string as `signature` (handler only uses `signature` on JWT path). |
-| `issuer` | No | When set, passed to `jwt.verify` as expected `iss`. Mismatch **rejects** (throws). |
-| `audience` | No | When set, passed to `jwt.verify` as expected `aud`. |
-| `kid` | Conditional | Required when `signature` is **not** a decodable JWT (non-JWT path). |
-| `algorithm` | Conditional | Non-JWT path: **enum key** on `JWKSAlgorithm` (e.g. `RS256`), not the Node crypto string. |
-| `signatureFormat` | Conditional | Non-JWT path: encoding for the signature buffer (`hex`, `base64`, etc.—`BinaryToTextEncoding`). |
-
----
-
-## Runtime handler (`@t4h.framework/jwks/authorize`)
-
-Default export:
-
-```typescript
-(options: JWKSAuthorizationContext) => Promise<boolean>
-```
-
-Behavior (from `jwks-authorize.ts` and tests):
-
-1. If `signature` is falsy → **`false`** (no throw).
-2. Build `JwksClient({ jwksUri: options.url })`.
-3. `jwt.decode(signature, { complete: true })`:
-   - **Decoded (JWT path)** → `validateJwt(signature, client, { issuer, audience })`.
-   - **Not decoded (non-JWT path)** → require `kid`, `algorithm`, `signatureFormat`; else **throw** with fixed messages (see below).
-
-### JWT path (`validateJwt`)
-
-- Algorithm must be **RS256** (`decoded.header.alg === 'RS256'`); otherwise **`false`** (e.g. HS256 tokens return `false`, not throw).
-- Header must include **`kid`**; used to `getSigningKey(kid)` from JWKS.
-- **`exp` enforced** (`ignoreExpiration: false`). Expired or wrong signing key → **`jwt.verify` rejects** (promise rejection / throw from handler).
-- Optional `issuer` / `audience` from context applied when present.
-
-### Non-JWT path
-
-Uses Node `crypto.createVerify` with public key from JWKS:
+## Verify async activity callbacks
 
 ```typescript
-authorizer.update(options.rawPayload)
-authorizer.verify(signingKey, options.signature, signatureFormat)
-```
-
-Throws if any required field is missing:
-
-| Missing | Error message |
-|---------|----------------|
-| `kid` | `KID is required for payload verification` |
-| `algorithm` | `Algorithm is required for payload verification` |
-| `signatureFormat` | `Signature format is required for payload verification` |
-
-`algorithm` must be a **key** of `JWKSAlgorithm`:
-
-```typescript
-export enum JWKSAlgorithm {
-  RS256 = 'RSA-SHA256',
-  RS384 = 'RSA-SHA384',
-  RS512 = 'RSA-SHA512',
-  PS256 = 'RSA-PSS-SHA256',
-  PS384 = 'RSA-PSS-SHA384',
-  PS512 = 'RSA-PSS-SHA512',
-  ES256 = 'ECDSA-SHA256',
-  ES384 = 'ECDSA-SHA384',
-  ES512 = 'ECDSA-SHA512',
+auth: {
+  type: ('jwt', jwksUri, issuer, audience)
 }
 ```
 
-Handler uses `JWKSAlgorithm[algorithm]` as the `createVerify` algorithm name. Pass `algorithm: 'RS256'`, not `'RSA-SHA256'`.
-
-Returns **`true`** on successful verification, **`false`** when verification fails (non-JWT invalid signature).
-
----
-
-## Examples
-
-### RS256 JWT (typical API Bearer token)
-
-```typescript
-import { JWKSAuthorization } from '@t4h.framework/jwks'
-
-const authorization = new JWKSAuthorization({
-  url: 'https://id.example.com/.well-known/jwks.json',
-  signature: bearerToken, // without "Bearer " prefix if your layer strips it
-  rawPayload: bearerToken,
-  issuer: 'https://issuer.example.com',
-  audience: 'my-api',
-})
-```
-
-Token must be signed RS256 with `kid` in header. Platform invokes `@t4h.framework/jwks/authorize` with manifest `context` when the protected workflow runs.
-
-### Detached signature (non-JWT)
-
-```typescript
-new JWKSAuthorization({
-  url: 'https://id.example.com/jwks',
-  signature: detachedSignatureHex,
-  rawPayload: canonicalPayloadString,
-  kid: 'key-1',
-  algorithm: 'RS256',
-  signatureFormat: 'hex',
-})
-```
-
-If `signature` accidentally looks like a JWT to `jwt.decode`, the JWT path runs instead—structure payloads accordingly.
-
----
-
-## Return values vs errors
-
-| Situation | Result |
-|-----------|--------|
-| Empty `signature` | `false` |
-| Valid RS256 JWT, matching JWKS key | `true` |
-| JWT wrong alg (e.g. HS256), no `kid`, undecodable token | `false` |
-| Expired JWT, issuer mismatch, signature mismatch | **Rejected** (throw from `jwt.verify`) |
-| Non-JWT missing `kid` / `algorithm` / `signatureFormat` | **Throw** (configuration error) |
-| Non-JWT verify fails | `false` |
-
-Design callers so manifest context is complete **before** the handler runs; missing non-JWT fields are programmer errors, not silent denials.
-
----
-
-## Testing the handler locally
-
-Unit tests mock `jwks-rsa` and use real RSA key pairs + `jsonwebtoken`:
-
 ```typescript
-import jwks from '@t4h.framework/jwks/authorize'
-import jwt from 'jsonwebtoken'
-
-// Valid JWT
-const token = jwt.sign({ sub: 'user-1' }, privateKeyPem, {
+auth: {
+  type: 'jwks',
+  jwksUri: 'https://partner.example.com/.well-known/jwks.json',
+  header: 'x-signature',
+  kidHeader: 'x-key-id',
   algorithm: 'RS256',
-  keyid: 'kid-1',
-  expiresIn: '1h',
-})
-
-await expect(
-  jwks({
-    url: 'https://example.com/jwks',
-    signature: token,
-    rawPayload: token,
-  }),
-).resolves.toBe(true)
+  signatureFormat: 'base64',
+  timestampHeader: 'x-timestamp',
+  toleranceInSeconds: 300,
+  signedPayload: '{timestamp}.{body}',
+}
 ```
 
-Test files: `src/__tests__/jwks-authorize.spec.ts`, `src/helpers/__tests__/validateJwt.spec.ts`, `src/models/__tests__/JWKSAuthorization.spec.ts`.
-
-`JWKSAuthorization` tests only assert `toManifest()` shape—handler tests cover verification behavior.
-
----
-
-## Dependencies (implementation)
-
-- **`jwks-rsa`** — `JwksClient`, `getSigningKey(kid)`, `getPublicKey()`.
-- **`jsonwebtoken`** — decode/verify on JWT path.
-
----
-
-## What this package does not do
-
-- No built-in OIDC discovery or `JWKS_ISSUER` env mapping.
-- No HTTP header / query / env extraction for credentials.
-- JWT path supports **RS256 only** (not RS384/ES256 via JWT path—those enum values apply to non-JWT `createVerify` only).
-- Does not define **Claims** or **Activities**—only **Authorization** manifests for core `Workflow` / `App`.
-
-For workflow orchestration and claims use **framework-core**; for the `TestWorkflowEnvironment` testing harness use **framework-workflow-testing**.
-
----
-
-## Quick checklist for agents
-
-1. Add `@t4h.framework/jwks` and peer `@t4h.framework/core`.
-2. Build `JWKSAuthorizationContext` with `url`, `signature`, `rawPayload` at minimum.
-3. Attach `new JWKSAuthorization(context)` to `Workflow` and/or `App` `authorization` option.
-4. JWT: ensure RS256 + `kid`; optional `issuer` / `audience`.
-5. Non-JWT: set `kid`, `algorithm` (`JWKSAlgorithm` key), `signatureFormat`.
-6. Expect `false` for deny, throws for misconfiguration or JWT verify failures (expired, wrong iss).
-7. Do not reference APIs absent from `src/` and tests.
+On `jwks`, each of `kid`, `algorithm` and `signatureFormat` is a fixed value or
+a `*Header` name. A fixed value wins. `signatureFormat` defaults to `'hex'`.
+
+## Traps
+
+- The field is `signature`. There is no `value` field.
+- The JWT path accepts only RS256 tokens with a `kid` in the header. HS256 or
+  ES256 tokens give `false`.
+- On the JWT path `rawPayload` is not used. Pass `''`.
+- `algorithm` is a `JWKSAlgorithm` KEY such as `'RS256'`, not the Node name
+  `'RSA-SHA256'`. Today only `RS256`, `RS384` and `RS512` verify; the `PS*` and
+  `ES*` keys throw `Invalid digest`.
+- A detached signature that happens to decode as a JWT takes the JWT path.
+- `JWKSAuthorization`: a denied raw-payload signature gives `false`, but an
+  expired JWT, an `issuer` or `audience` mismatch, a bad JWT signature or a
+  missing `kid`/`algorithm`/`signatureFormat` THROWS. On a callback each error
+  becomes a refusal.
+- Always set `issuer` and `audience` for a JWT. Without them a token minted for
+  another service passes.
+- Callback timestamps: all digits with 13 or more digits are milliseconds,
+  fewer are seconds. Other strings go through `Date.parse`.
+- The package does not read HTTP headers or env, and has no OIDC discovery. For
+  a token from an OIDC provider, see **framework-oidc**.
+
+## Test
+
+The handler fetches keys over HTTP from `url`. Serve a JWKS from a local HTTP
+server in the test (export the public key with
+`publicKey.export({ format: 'jwk' })` and add `kid`), sign a token with
+`jsonwebtoken` (`algorithm: 'RS256'`, `keyid`), and call the default export of
+`@t4h.framework/jwks/authorize`.
+
+## Related skills
+
+- **framework-hmac**: shared-secret signatures.
+- **framework-webhook**: wait for a partner callback that uses this `auth`.
+
+## Reference
+
+- Guide: <https://tech4humans-brasil.github.io/framework/jwks/>
+- Types: `node_modules/@t4h.framework/jwks/dist/jwks.d.ts`
+- Callback `auth` types: `AsyncActivityCallbackAuthJwt` and
+  `AsyncActivityCallbackAuthJwks` in `node_modules/@t4h.framework/core/dist/`

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @t4h.framework/jwks
 
+## 0.7.8
+
+### Patch Changes
+
+- [#257](https://github.com/tech4humans-brasil/framework/pull/257) [`586bfb4`](https://github.com/tech4humans-brasil/framework/commit/586bfb4663f4a478527ee0c8db360603f034d615) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The jwks README is now short and links to the site. The site page now describes the `jwt` and `jwks` callback `auth`, the results and errors, and says that only the `RS*` keys verify a detached signature.
+
+## 0.7.7
+
+### Patch Changes
+
+- [#243](https://github.com/tech4humans-brasil/framework/pull/243) [`0ffd663`](https://github.com/tech4humans-brasil/framework/commit/0ffd663ce8369edd7b54206cb3216568ad1de471) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The README examples read each value from `environments`, an `EnvDesign` in `src/constants/environments.ts`, and pass each credential as a `Secret`. They no longer use `process.env`, the raw `env` from the core or a literal in a `Secret` field. The jwks README describes the real context fields (`signature`, `rawPayload`) and says that a token that `jwt.verify` rejects throws.
+
+- [#240](https://github.com/tech4humans-brasil/framework/pull/240) [`0606115`](https://github.com/tech4humans-brasil/framework/commit/0606115e2e0baa994e9f0ed3559ee54ecac88e44) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The skills do not repeat a rule that a lint rule, `tsc` or a runtime error already enforces. Each such rule is now one line that names the gate. The examples that broke a gate (`process.env`, `as any`, an inline secret, an `EnvDesign` in a workflow file, `ref.output` before `wait()`) are correct now.
+
+- [#228](https://github.com/tech4humans-brasil/framework/pull/228) [`d29e1ab`](https://github.com/tech4humans-brasil/framework/commit/d29e1ab29a039b13c3e4b075472bd615566ae75e) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Uses exact types and `unknown` in place of `any`, and checks external data with guards.
+  - harness: the fix-issues prompt lists each sensor as `- checkTypes: PASS`. Before, it printed `- 0: [object Object]`.
+  - hmac: an algorithm name such as `constructor` throws `Unsupported algorithm`.
+  - oidc: a discovery response with no `introspection_endpoint`, or a null introspection body, throws a clear error.
+  - `HttpRequestActivity.toOutput` takes `HttpRequestActivityOutput` in place of `any`.
+
 ## 0.7.6
 
 ## 0.7.5

package/README.md

@@ -1,73 +1,31 @@
 # @t4h.framework/jwks
 
-JWKS-backed authorization for the T4H Framework. It exposes a core `Authorization` manifest and a runtime handler that validates credentials against keys from a JWKS endpoint.
+JWKS authorization for the T4H Framework. It verifies an RS256 JWT, or a
+detached signature over a raw payload, against the public keys of a JWKS
+endpoint, for a workflow, an app or the callbacks of an async activity.
 
-## Peer dependency
+## Install
 
-Requires `@t4h.framework/core` (same major line as this package).
-
-## Exports
-
-| Entry            | Purpose |
-|------------------|---------|
-| `@t4h.framework/jwks` | `JWKSAuthorization`, `JWKSAuthorizationContext`, and related types |
-| `@t4h.framework/jwks/authorize` | Default async handler invoked by the runtime with the manifest context |
-| `@t4h.framework/jwks/callback` | Default export `jwksCallback`: the `jwt` (bearer JWT) and `jwks` (detached signature verified with a JWKS key) callback authorizer for the core `AsyncActivityCallback.authorize` |
-
-## `JWKSAuthorization`
-
-Subclass of [`Authorization`](https://github.com/tech4humans-brasil/framework/tree/main/packages/core) from core. `toManifest()` points the runtime at `@t4h.framework/jwks/authorize` and passes a `JWKSAuthorizationContext`.
-
-Construct it with a full `JWKSAuthorizationContext` (including `url` and `value`). How you obtain `value`—headers, query, env, or runtime injection—is up to your app and deployment pipeline; this package does not read HTTP or env by itself.
-
-## Context: `JWKSAuthorizationContext`
-
-| Field | Required | Description |
-|-------|----------|-------------|
-| `url` | Yes | JWKS document URL (`jwks-rsa` `jwksUri`). |
-| `value` | Yes | Credential to verify (Bearer token, raw payload, etc., depending on your app). Empty string yields `false`. |
-| `issuer` | No | If set, passed to JWT verification as expected `iss`. |
-| `audience` | No | If set, passed to JWT verification as expected `aud`. |
-| `kid` | Conditional | Required when `value` is **not** a decodable JWT (see below). |
-| `algorithm` | Conditional | Same as `kid` for non-JWT `value`. |
-| `signatureFormat` | Conditional | Same as `kid` for non-JWT `value` (encoding for the signature buffer, e.g. `hex` or `base64`). |
-
-There is no built-in OIDC discovery (`JWKS_ISSUER`), no environment-variable mapping in this package, and no `credentialSource` helper—you choose where `value` comes from in your application or hosting layer.
-
-## Runtime handler (`jwks/authorize`)
-
-The default export is an async function:
-
-```ts
-(options: JWKSAuthorizationContext) => Promise<boolean>
+```bash
+npm install @t4h.framework/jwks @t4h.framework/core
 ```
 
-- Returns `false` if `value` is missing or verification fails.
-- Returns `true` if verification succeeds.
-
-### JWT path
-
-If `value` decodes as a JWT (`jsonwebtoken` `decode` with `complete: true` succeeds), verification uses `validateJwt` ([source](https://github.com/tech4humans-brasil/framework/blob/main/packages/jwks/src/helpers/validateJwt.ts)):
-
-- Algorithm **RS256** only (`alg` in the header must be `RS256`).
-- Header must include `kid` (used to fetch the signing key from JWKS).
-- `exp` is enforced (token must not be expired).
-- Optional `issuer` and `audience` from the context are applied when present.
-
-### Non-JWT path
-
-If `value` is not treated as a JWT by the decoder, the handler expects `kid`, `algorithm`, and `signatureFormat` on the context. If any of these are missing, it **throws** with a clear error. It loads the public key from JWKS by `kid` and verifies using Node’s `crypto.createVerify`.
-
-## Example
+## Usage
 
 ```typescript
 import { JWKSAuthorization } from '@t4h.framework/jwks'
 
 const authorization = new JWKSAuthorization({
   url: 'https://auth.example.com/.well-known/jwks.json',
-  value: '<token-or-payload-from-runtime>',
+  signature: '<jwt-from-the-request>',
+  rawPayload: '',
+  issuer: 'https://auth.example.com/',
   audience: 'https://api.example.com',
 })
 ```
 
-Wire `authorization` on an `App` or `Workflow` per the core package. The platform loads `@t4h.framework/jwks/authorize` with the manifest context when a protected workflow runs.
+Attach `authorization` to a `Workflow` or an `App`.
+
+## Documentation
+
+<https://tech4humans-brasil.github.io/framework/jwks/>

package/dist/helpers/validateJwt.js

@@ -9,7 +9,7 @@ export async function validateJwt(token, client, options) {
         return false;
     const key = await client.getSigningKey(decoded.header.kid);
     const publicKey = key.getPublicKey();
-    const isValid = await jwt.verify(token, publicKey, {
+    const isValid = jwt.verify(token, publicKey, {
         algorithms: ['RS256'],
         ignoreExpiration: false,
         issuer: options?.issuer,

package/dist/helpers/validateJwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateJwt.js","sourceRoot":"","sources":["../../src/helpers/validateJwt.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAQ9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,MAAkB,EAClB,OAA4B;IAE5B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAE1D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;IAEpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;QACjD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,gBAAgB,EAAE,KAAK;QACvB,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;KAC5B,CAAC,CAAA;IAEF,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAA;AACpC,CAAC"}
+{"version":3,"file":"validateJwt.js","sourceRoot":"","sources":["../../src/helpers/validateJwt.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAQ9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,MAAkB,EAClB,OAA4B;IAE5B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAE1D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;IAEpC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;QAC3C,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,gBAAgB,EAAE,KAAK;QACvB,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;KAC5B,CAAC,CAAA;IAEF,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAA;AACpC,CAAC"}

package/dist/jwks-callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwks-callback.d.ts","sourceRoot":"","sources":["../src/jwks-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EAClC,MAAM,qBAAqB,CAAA;AAyG5B,wBAA8B,YAAY,CACxC,IAAI,EAAE,4BAA4B,GAAG,6BAA6B,EAClE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,GACvC,OAAO,CAAC,OAAO,CAAC,CAIlB"}
+{"version":3,"file":"jwks-callback.d.ts","sourceRoot":"","sources":["../src/jwks-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EAClC,MAAM,qBAAqB,CAAA;AA+G5B,wBAA8B,YAAY,CACxC,IAAI,EAAE,4BAA4B,GAAG,6BAA6B,EAClE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,GACvC,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/jwks-callback.js

@@ -1,14 +1,18 @@
 import { AsyncActivityCallback, } from '@t4h.framework/core';
 import jwks from './jwks-authorize.js';
+function toEpochMilliseconds(timestamp) {
+    if (!/^\d+$/.test(timestamp))
+        return Date.parse(timestamp);
+    const isAlreadyInMilliseconds = timestamp.length >= 13;
+    if (isAlreadyInMilliseconds)
+        return Number(timestamp);
+    return Number(timestamp) * 1000;
+}
 function isWithinTolerance(timestamp, toleranceInSeconds) {
     const value = timestamp.trim();
     if (!value)
         return false;
-    const signedAt = /^\d+$/.test(value)
-        ? value.length >= 13
-            ? Number(value)
-            : Number(value) * 1000
-        : Date.parse(value);
+    const signedAt = toEpochMilliseconds(value);
     if (Number.isNaN(signedAt))
         return false;
     return Math.abs(Date.now() - signedAt) / 1000 <= toleranceInSeconds;

package/dist/jwks-callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwks-callback.js","sourceRoot":"","sources":["../src/jwks-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,IAAI,MAAM,qBAAqB,CAAA;AAEtC,SAAS,iBAAiB,CAAC,SAAiB,EAAE,kBAA0B;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAE9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE;YAClB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI;QACxB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAErB,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAA;AACrE,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAsC,EACtC,KAAyB,EACzB,MAA0B;IAE1B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAkC,EAClC,QAAwC;IAExC,MAAM,KAAK,GAAG,qBAAqB,CAAC,cAAc,CAChD,QAAQ,CAAC,OAAO,EAChB,IAAI,CAAC,MAAM,CACZ,CAAA;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAmC,EACnC,QAAwC;IAExC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAA;IAE5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEvE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe;QACpC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC;QAChE,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAEpD,IACE,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC;QAE5D,OAAO,KAAK,CAAA;IAEd,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC;SAChD,UAAU,CAAC,aAAa,EAAE,SAAS,IAAI,EAAE,CAAC;SAC1C,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAEzC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS;YACT,UAAU;YACV,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC;YACzD,SAAS,EAAE,iBAAiB,CAC1B,OAAO,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,eAAe,CACrB;YACD,eAAe,EACb,iBAAiB,CACf,OAAO,EACP,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,qBAAqB,CAC3B,IAAI,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CACxC,IAAkE,EAClE,QAAwC;IAExC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAExE,OAAO,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAClC,CAAC"}
+{"version":3,"file":"jwks-callback.js","sourceRoot":"","sources":["../src/jwks-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,IAAI,MAAM,qBAAqB,CAAA;AAEtC,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAE1D,MAAM,uBAAuB,GAAG,SAAS,CAAC,MAAM,IAAI,EAAE,CAAA;IAEtD,IAAI,uBAAuB;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;IAErD,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB,EAAE,kBAA0B;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAE9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAE3C,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAA;AACrE,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAsC,EACtC,KAAyB,EACzB,MAA0B;IAE1B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAkC,EAClC,QAAwC;IAExC,MAAM,KAAK,GAAG,qBAAqB,CAAC,cAAc,CAChD,QAAQ,CAAC,OAAO,EAChB,IAAI,CAAC,MAAM,CACZ,CAAA;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAmC,EACnC,QAAwC;IAExC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAA;IAE5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEvE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe;QACpC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC;QAChE,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAEpD,IACE,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC;QAE5D,OAAO,KAAK,CAAA;IAEd,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC;SAChD,UAAU,CAAC,aAAa,EAAE,SAAS,IAAI,EAAE,CAAC;SAC1C,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAEzC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS;YACT,UAAU;YACV,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC;YACzD,SAAS,EAAE,iBAAiB,CAC1B,OAAO,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,eAAe,CACrB;YACD,eAAe,EACb,iBAAiB,CACf,OAAO,EACP,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,qBAAqB,CAC3B,IAAI,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CACxC,IAAkE,EAClE,QAAwC;IAExC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAExE,OAAO,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAClC,CAAC"}

package/dist/models/JWKSAuthorization.d.ts

@@ -8,7 +8,7 @@ export type JWKSAuthorizationContext = {
     audience?: string;
     kid?: string;
     algorithm?: string;
-    signatureFormat?: BinaryToTextEncoding | string;
+    signatureFormat?: BinaryToTextEncoding | (string & {});
 };
 export type JWKSAuthorizationManifest = AuthorizationManifest<JWKSAuthorizationContext>;
 export declare class JWKSAuthorization extends Authorization<JWKSAuthorizationContext> {

package/dist/models/JWKSAuthorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JWKSAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/JWKSAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAe/C"}
+{"version":3,"file":"JWKSAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/JWKSAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;CACvD,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAe/C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/jwks",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "JWKS module for the T4H Framework authorization",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/jwks",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -36,12 +36,14 @@
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
     "check-types": "tsc --noEmit",
+    "check-package": "publint --strict && attw --pack . --profile esm-only",
+    "lint": "eslint . --max-warnings 0",
     "prepublishOnly": "yarn build",
     "test": "vitest run",
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@t4h.framework/core": "^0.19.0",
+    "@t4h.framework/core": "^0.21.0",
     "@types/jsonwebtoken": "^9",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"