@tidecloak/verify 0.14.3-staging → 0.14.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/cjs/TideJWT.js +25 -6
  2. package/dist/esm/TideJWT.js +25 -6
  3. package/dist/types/TideJWT.d.ts +33 -2
  4. package/dist/types/TideJWT.d.ts.map +1 -1
  5. package/package.json +1 -1
package/dist/cjs/TideJWT.js CHANGED
@@ -9,6 +9,24 @@ const jose_1 = require("jose");
9
9
  * for keys that omit an `alg`). Override via `config.tokenSignatureAlgorithms`.
10
10
  */
11
11
  const DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512", "EdDSA"];
12
+ /**
13
+ * Decoded claims of a verified TideCloak access token.
14
+ *
15
+ * Standard OIDC/JWT claims are present alongside the Tide-specific claims
16
+ * injected by the TideCloak protocol mappers (`tideuserkey`, `vuid`). The
17
+ * index signature keeps arbitrary additional claims accessible (typed as
18
+ * `unknown`) so this type never has to be exhaustive.
19
+ *
20
+ * @typedef {Object.<string, unknown> & {
21
+ * tideuserkey?: string,
22
+ * vuid?: string,
23
+ * sub?: string,
24
+ * iss?: string,
25
+ * azp?: string,
26
+ * realm_access?: { roles?: string[] },
27
+ * resource_access?: Object.<string, { roles?: string[] }>
28
+ * }} TideTokenClaims
29
+ */
12
30
  /**
13
31
  * Verify a TideCloak-issued JWT on the server side using your imported config object.
14
32
  *
@@ -17,10 +35,11 @@ const DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512", "EdDSA"];
17
35
  * (number of seconds, or a jose duration string) to tune verification.
18
36
  * @param {string} token - access token to verify.
19
37
  * @param {string[]} [allowedRoles] - Array of Tidecloak realm or client roles; user must have at least one.
20
- * @returns {Promise<object|null>} - The token payload if valid and role-check passes, otherwise null.
38
+ * @returns {Promise<TideTokenClaims|null>} - The token claims if valid and role-check passes, otherwise null.
21
39
  */
22
40
  async function verifyTideCloakToken(config, token, allowedRoles = []) {
23
- var _a, _b, _c, _d;
41
+ var _a, _b, _c;
42
+ var _d;
24
43
  try {
25
44
  // Ensure token is provided
26
45
  if (!token) {
@@ -46,7 +65,7 @@ async function verifyTideCloakToken(config, token, allowedRoles = []) {
46
65
  const { payload } = await (0, jose_1.jwtVerify)(token, jwkSet, {
47
66
  issuer,
48
67
  algorithms,
49
- clockTolerance: (_a = config.clockTolerance) !== null && _a !== void 0 ? _a : "5s",
68
+ clockTolerance: (_d = config.clockTolerance) !== null && _d !== void 0 ? _d : "5s",
50
69
  });
51
70
  // Verify authorized party (client). Only enforced when a `resource` (client id)
52
71
  // is configured; without this guard an undefined client would reject every token.
@@ -55,8 +74,8 @@ async function verifyTideCloakToken(config, token, allowedRoles = []) {
55
74
  throw new Error(`AZP mismatch: expected '${client}', got '${payload.azp}'`);
56
75
  }
57
76
  // Gather all user roles from realm and client roles for the specified resource from the config.
58
- const realmRoles = ((_b = payload.realm_access) === null || _b === void 0 ? void 0 : _b.roles) || [];
59
- const clientRoles = ((_d = (_c = payload.resource_access) === null || _c === void 0 ? void 0 : _c[client]) === null || _d === void 0 ? void 0 : _d.roles) || [];
77
+ const realmRoles = ((_a = payload.realm_access) === null || _a === void 0 ? void 0 : _a.roles) || [];
78
+ const clientRoles = ((_c = (_b = payload.resource_access) === null || _b === void 0 ? void 0 : _b[client]) === null || _c === void 0 ? void 0 : _c.roles) || [];
60
79
  const allRoles = new Set([...realmRoles, ...clientRoles]);
61
80
  // If allowedRoles specified, ensure at least one match
62
81
  if (allowedRoles.length > 0) {
@@ -65,7 +84,7 @@ async function verifyTideCloakToken(config, token, allowedRoles = []) {
65
84
  throw new Error(`Role match failed: user roles [${[...allRoles].join(", ")}] do not include any of [${allowedRoles.join(", ")}]`);
66
85
  }
67
86
  }
68
- return payload;
87
+ return /** @type {TideTokenClaims} */ (payload);
69
88
  }
70
89
  catch (err) {
71
90
  // Log only the message (not the error object, which can echo token-derived
package/dist/esm/TideJWT.js CHANGED
@@ -6,6 +6,24 @@ import { jwtVerify, createLocalJWKSet, createRemoteJWKSet } from "jose";
6
6
  * for keys that omit an `alg`). Override via `config.tokenSignatureAlgorithms`.
7
7
  */
8
8
  const DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512", "EdDSA"];
9
+ /**
10
+ * Decoded claims of a verified TideCloak access token.
11
+ *
12
+ * Standard OIDC/JWT claims are present alongside the Tide-specific claims
13
+ * injected by the TideCloak protocol mappers (`tideuserkey`, `vuid`). The
14
+ * index signature keeps arbitrary additional claims accessible (typed as
15
+ * `unknown`) so this type never has to be exhaustive.
16
+ *
17
+ * @typedef {Object.<string, unknown> & {
18
+ * tideuserkey?: string,
19
+ * vuid?: string,
20
+ * sub?: string,
21
+ * iss?: string,
22
+ * azp?: string,
23
+ * realm_access?: { roles?: string[] },
24
+ * resource_access?: Object.<string, { roles?: string[] }>
25
+ * }} TideTokenClaims
26
+ */
9
27
  /**
10
28
  * Verify a TideCloak-issued JWT on the server side using your imported config object.
11
29
  *
@@ -14,10 +32,11 @@ const DEFAULT_ALLOWED_ALGORITHMS = ["ES256", "ES384", "ES512", "EdDSA"];
14
32
  * (number of seconds, or a jose duration string) to tune verification.
15
33
  * @param {string} token - access token to verify.
16
34
  * @param {string[]} [allowedRoles] - Array of Tidecloak realm or client roles; user must have at least one.
17
- * @returns {Promise<object|null>} - The token payload if valid and role-check passes, otherwise null.
35
+ * @returns {Promise<TideTokenClaims|null>} - The token claims if valid and role-check passes, otherwise null.
18
36
  */
19
37
  export async function verifyTideCloakToken(config, token, allowedRoles = []) {
20
- var _a, _b, _c, _d;
38
+ var _a, _b, _c;
39
+ var _d;
21
40
  try {
22
41
  // Ensure token is provided
23
42
  if (!token) {
@@ -43,7 +62,7 @@ export async function verifyTideCloakToken(config, token, allowedRoles = []) {
43
62
  const { payload } = await jwtVerify(token, jwkSet, {
44
63
  issuer,
45
64
  algorithms,
46
- clockTolerance: (_a = config.clockTolerance) !== null && _a !== void 0 ? _a : "5s",
65
+ clockTolerance: (_d = config.clockTolerance) !== null && _d !== void 0 ? _d : "5s",
47
66
  });
48
67
  // Verify authorized party (client). Only enforced when a `resource` (client id)
49
68
  // is configured; without this guard an undefined client would reject every token.
@@ -52,8 +71,8 @@ export async function verifyTideCloakToken(config, token, allowedRoles = []) {
52
71
  throw new Error(`AZP mismatch: expected '${client}', got '${payload.azp}'`);
53
72
  }
54
73
  // Gather all user roles from realm and client roles for the specified resource from the config.
55
- const realmRoles = ((_b = payload.realm_access) === null || _b === void 0 ? void 0 : _b.roles) || [];
56
- const clientRoles = ((_d = (_c = payload.resource_access) === null || _c === void 0 ? void 0 : _c[client]) === null || _d === void 0 ? void 0 : _d.roles) || [];
74
+ const realmRoles = ((_a = payload.realm_access) === null || _a === void 0 ? void 0 : _a.roles) || [];
75
+ const clientRoles = ((_c = (_b = payload.resource_access) === null || _b === void 0 ? void 0 : _b[client]) === null || _c === void 0 ? void 0 : _c.roles) || [];
57
76
  const allRoles = new Set([...realmRoles, ...clientRoles]);
58
77
  // If allowedRoles specified, ensure at least one match
59
78
  if (allowedRoles.length > 0) {
@@ -62,7 +81,7 @@ export async function verifyTideCloakToken(config, token, allowedRoles = []) {
62
81
  throw new Error(`Role match failed: user roles [${[...allRoles].join(", ")}] do not include any of [${allowedRoles.join(", ")}]`);
63
82
  }
64
83
  }
65
- return payload;
84
+ return /** @type {TideTokenClaims} */ (payload);
66
85
  }
67
86
  catch (err) {
68
87
  // Log only the message (not the error object, which can echo token-derived
package/dist/types/TideJWT.d.ts CHANGED
@@ -1,3 +1,34 @@
1
+ export type TideTokenClaims = Object<string, unknown> & {
2
+ tideuserkey?: string;
3
+ vuid?: string;
4
+ sub?: string;
5
+ iss?: string;
6
+ azp?: string;
7
+ realm_access?: {
8
+ roles?: string[];
9
+ };
10
+ resource_access?: Record<string, {
11
+ roles?: string[];
12
+ }>;
13
+ };
14
+ /**
15
+ * Decoded claims of a verified TideCloak access token.
16
+ *
17
+ * Standard OIDC/JWT claims are present alongside the Tide-specific claims
18
+ * injected by the TideCloak protocol mappers (`tideuserkey`, `vuid`). The
19
+ * index signature keeps arbitrary additional claims accessible (typed as
20
+ * `unknown`) so this type never has to be exhaustive.
21
+ *
22
+ * @typedef {Object.<string, unknown> & {
23
+ * tideuserkey?: string,
24
+ * vuid?: string,
25
+ * sub?: string,
26
+ * iss?: string,
27
+ * azp?: string,
28
+ * realm_access?: { roles?: string[] },
29
+ * resource_access?: Object.<string, { roles?: string[] }>
30
+ * }} TideTokenClaims
31
+ */
1
32
  /**
2
33
  * Verify a TideCloak-issued JWT on the server side using your imported config object.
3
34
  *
@@ -6,7 +37,7 @@
6
37
  * (number of seconds, or a jose duration string) to tune verification.
7
38
  * @param {string} token - access token to verify.
8
39
  * @param {string[]} [allowedRoles] - Array of Tidecloak realm or client roles; user must have at least one.
9
- * @returns {Promise<object|null>} - The token payload if valid and role-check passes, otherwise null.
40
+ * @returns {Promise<TideTokenClaims|null>} - The token claims if valid and role-check passes, otherwise null.
10
41
  */
11
- export function verifyTideCloakToken(config: object, token: string, allowedRoles?: string[]): Promise<object | null>;
42
+ export declare function verifyTideCloakToken(config: object, token: string, allowedRoles?: string[]): Promise<TideTokenClaims | null>;
12
43
  //# sourceMappingURL=TideJWT.d.ts.map
package/dist/types/TideJWT.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"TideJWT.d.ts","sourceRoot":"","sources":["../../src/TideJWT.js"],"names":[],"mappings":"AAUA;;;;;;;;;GASG;AACH,6CAPW,MAAM,SAGN,MAAM,iBACN,MAAM,EAAE,GACN,OAAO,CAAC,MAAM,GAAC,IAAI,CAAC,CAmEhC"}
1
+ {"version":3,"file":"TideJWT.d.ts","sourceRoot":"","sources":["../../src/TideJWT.js"],"names":[],"mappings":"AAkBG,YAQG,eAAe,GARR,MAAM,CAAE,MAAM,EAAE,OAAO,CAAC,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACpC,eAAe,CAAC;gBAA4B,MAAM,EAAE;OAAG;CACxD,CAAiB;AAhBrB;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAPtC,MAOsC,EAAE,KAAK,EAJ7C,MAI6C,EAAE,YAAY,AAHnE,CACA,EADQ,MAAM,EAG0D,GAF9D,OAAO,CAAC,eAAe,GAAC,IAAI,CAAC,CAmEzC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@tidecloak/verify",
3
- "version": "0.14.3-staging",
3
+ "version": "0.14.6",
4
4
  "description": "A lightweight utility for server-side verification of TideCloak-issued JSON Web Tokens (JWTs).",
5
5
  "main": "./dist/cjs/TideJWT.js",
6
6
  "module": "./dist/esm/TideJWT.js",