@thinkingcat/auth-utils 2.0.5 → 2.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/core/jwt.d.ts +1 -1
- package/dist/core/jwt.js +17 -9
- package/package.json +1 -1
package/dist/core/jwt.d.ts
CHANGED
|
@@ -15,7 +15,7 @@ export declare function extractRoleFromPayload(payload: JWTPayload, serviceId: s
|
|
|
15
15
|
*/
|
|
16
16
|
export declare function createNextAuthJWT(payload: JWTPayload, serviceId: string): JWT;
|
|
17
17
|
/**
|
|
18
|
-
* NextAuth JWT를 인코딩된 세션 토큰으로 변환
|
|
18
|
+
* NextAuth JWT를 인코딩된 세션 토큰으로 변환 (HKDF 기반 암호화 적용)
|
|
19
19
|
*/
|
|
20
20
|
export declare function encodeNextAuthToken(jwt: JWT, secret: string, maxAge?: number): Promise<string>;
|
|
21
21
|
/**
|
package/dist/core/jwt.js
CHANGED
|
@@ -41,7 +41,6 @@ exports.isTokenExpired = isTokenExpired;
|
|
|
41
41
|
exports.isValidToken = isValidToken;
|
|
42
42
|
const jose_1 = require("jose");
|
|
43
43
|
const logger_js_1 = require("../utils/logger.js");
|
|
44
|
-
const crypto_js_1 = require("../utils/crypto.js");
|
|
45
44
|
/**
|
|
46
45
|
* 토큰 검증 및 디코딩
|
|
47
46
|
*/
|
|
@@ -116,7 +115,7 @@ function createNextAuthJWT(payload, serviceId) {
|
|
|
116
115
|
return jwt;
|
|
117
116
|
}
|
|
118
117
|
/**
|
|
119
|
-
* NextAuth JWT를 인코딩된 세션 토큰으로 변환
|
|
118
|
+
* NextAuth JWT를 인코딩된 세션 토큰으로 변환 (HKDF 기반 암호화 적용)
|
|
120
119
|
*/
|
|
121
120
|
async function encodeNextAuthToken(jwt, secret, maxAge = 30 * 24 * 60 * 60) {
|
|
122
121
|
try {
|
|
@@ -130,14 +129,23 @@ async function encodeNextAuthToken(jwt, secret, maxAge = 30 * 24 * 60 * 60) {
|
|
|
130
129
|
return encoded;
|
|
131
130
|
}
|
|
132
131
|
catch (error) {
|
|
133
|
-
(0, logger_js_1.debugLog)('encodeNextAuthToken', 'NextAuth encode failed, using jose EncryptJWT fallback', error);
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
for (let i = 0; i < 32; i++) {
|
|
137
|
-
keyBytes[i] = parseInt(secretHash.slice(i * 2, i * 2 + 2), 16);
|
|
138
|
-
}
|
|
132
|
+
(0, logger_js_1.debugLog)('encodeNextAuthToken', 'NextAuth encode failed, using jose EncryptJWT fallback with HKDF', error);
|
|
133
|
+
// NextAuth.js의 표준 HKDF 키 유도 방식 구현
|
|
134
|
+
// https://github.com/nextauthjs/next-auth/blob/main/packages/next-auth/src/jwt/index.ts
|
|
139
135
|
const now = Math.floor(Date.now() / 1000);
|
|
140
136
|
try {
|
|
137
|
+
// Web Crypto API를 이용한 HKDF 구현
|
|
138
|
+
const encoder = new TextEncoder();
|
|
139
|
+
const secretKey = await crypto.subtle.importKey('raw', encoder.encode(secret), 'HKDF', false, ['deriveKey']);
|
|
140
|
+
const derivedKey = await crypto.subtle.deriveKey({
|
|
141
|
+
name: 'HKDF',
|
|
142
|
+
hash: 'SHA-256',
|
|
143
|
+
salt: encoder.encode(''),
|
|
144
|
+
info: encoder.encode('NextAuth.js Generated Encryption Key'),
|
|
145
|
+
}, secretKey, { name: 'AES-GCM', length: 256 }, true, ['encrypt']);
|
|
146
|
+
// 유도된 키를 Uint8Array로 변환
|
|
147
|
+
const exportedKey = await crypto.subtle.exportKey('raw', derivedKey);
|
|
148
|
+
const keyBytes = new Uint8Array(exportedKey);
|
|
141
149
|
const token = await new jose_1.EncryptJWT(jwt)
|
|
142
150
|
.setProtectedHeader({
|
|
143
151
|
alg: 'dir',
|
|
@@ -150,7 +158,7 @@ async function encodeNextAuthToken(jwt, secret, maxAge = 30 * 24 * 60 * 60) {
|
|
|
150
158
|
return token;
|
|
151
159
|
}
|
|
152
160
|
catch (encryptError) {
|
|
153
|
-
(0, logger_js_1.debugError)('encodeNextAuthToken', 'EncryptJWT
|
|
161
|
+
(0, logger_js_1.debugError)('encodeNextAuthToken', 'HKDF EncryptJWT failed:', encryptError);
|
|
154
162
|
throw new Error(`Failed to encode NextAuth token: ${error instanceof Error ? error.message : String(error)}`);
|
|
155
163
|
}
|
|
156
164
|
}
|