npm - @venizia/ignis - Versions diffs - 0.2.0-1 → 0.2.0-3 - Mend

@venizia/ignis 0.2.0-1 → 0.2.0-3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (91) hide show

package/dist/components/auth/authenticate/services/bearer/abstract.service.js CHANGED Viewed

@@ -1,11 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AbstractBearerTokenService = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const common_1 = require("@venizia/ignis-helpers/common");
 const ignis_helpers_1 = require("@venizia/ignis-helpers");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
+const common_1 = require("@venizia/ignis-helpers/common");
+const core_1 = require("@venizia/ignis-helpers/core");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
 /** Abstract base for Bearer-token services (JWS, JWKS) with optional AES payload encryption. */
 class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
     constructor() {
@@ -13,6 +12,8 @@ class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
         this.aes = null;
         this.applicationSecret = null;
         this.fieldCodecs = new Map();
+        /** Configured `iss` / `aud`. Authoritative over anything the payload carries. */
+        this.signOptions = null;
     }
     /** Standard JWT fields that are never encrypted. */
     static { this.JWT_COMMON_FIELDS = new Set([
@@ -26,7 +27,8 @@ class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
     ]); }
     /** Configures AES payload encryption and field codecs. Both aesAlgorithm and applicationSecret required to activate encryption. */
     configurePayloadEncryption(opts) {
-        const { aesAlgorithm = 'aes-256-cbc', applicationSecret, fieldCodecs, cipher } = opts;
+        const { aesAlgorithm = 'aes-256-cbc', applicationSecret, fieldCodecs, cipher, sign } = opts;
+        this.signOptions = sign ?? null;
         if (fieldCodecs) {
             for (const codec of fieldCodecs) {
                 this.fieldCodecs.set(codec.key, codec);
@@ -43,20 +45,20 @@ class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
         const authHeaderValue = request.header('Authorization');
         if (!authHeaderValue) {
             throw (0, core_1.getError)({
-                error: ignis_kernel_2.AuthenticationErrors.HEADER_MISSING,
+                error: ignis_kernel_1.AuthenticationErrors.HEADER_MISSING,
                 message: 'Unauthorized user! Missing authorization header',
             });
         }
-        if (!authHeaderValue.startsWith(ignis_kernel_2.Authentication.TYPE_BEARER)) {
+        if (!authHeaderValue.startsWith(ignis_kernel_1.Authentication.TYPE_BEARER)) {
             throw (0, core_1.getError)({
-                error: ignis_kernel_2.AuthenticationErrors.SCHEME_INVALID,
+                error: ignis_kernel_1.AuthenticationErrors.SCHEME_INVALID,
                 message: 'Unauthorized user! Invalid schema of request token!',
             });
         }
         const parts = authHeaderValue.split(' ');
         if (parts.length !== 2) {
             throw (0, core_1.getError)({
-                error: ignis_kernel_2.AuthenticationErrors.HEADER_MALFORMED,
+                error: ignis_kernel_1.AuthenticationErrors.HEADER_MALFORMED,
                 message: `Authorization header value is invalid format. It must follow the pattern: 'Bearer xx.yy.zz' where xx.yy.zz is a valid JWT token.`,
             });
         }
@@ -68,7 +70,7 @@ class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
         if (!token) {
             this.logger.for(this.verify.name).error('Missing token for validating request!');
             throw (0, core_1.getError)({
-                error: ignis_kernel_2.AuthenticationErrors.TOKEN_MISSING,
+                error: ignis_kernel_1.AuthenticationErrors.TOKEN_MISSING,
                 message: '[verify] Invalid request token!',
             });
         }
@@ -78,7 +80,7 @@ class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
         catch (error) {
             // No log here - `cause` carries the reason (JWTExpired, signature mismatch) to the error handler, which logs the request once. An expired token is the caller's problem, hence `warn`.
             throw (0, core_1.getError)({
-                error: ignis_kernel_2.AuthenticationErrors.TOKEN_INVALID,
+                error: ignis_kernel_1.AuthenticationErrors.TOKEN_INVALID,
                 message: '[verify] Invalid or expired token',
                 logLevel: 'warn',
                 cause: error,
@@ -86,14 +88,14 @@ class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
         }
     }
     async generate(opts) {
-        const { payload, getTokenExpiresFn = this.getDefaultTokenExpiresFn() } = opts;
+        const { payload, claims, getTokenExpiresFn = this.getDefaultTokenExpiresFn() } = opts;
         if (!payload) {
             throw (0, core_1.getError)({
-                error: ignis_kernel_2.AuthenticationErrors.TOKEN_PAYLOAD_INVALID,
+                error: ignis_kernel_1.AuthenticationErrors.TOKEN_PAYLOAD_INVALID,
                 message: '[generate] Invalid token payload!',
             });
         }
-        const signer = await this.getSigner({ payload, getTokenExpiresFn });
+        const signer = await this.getSigner({ payload, getTokenExpiresFn, claims });
         try {
             const rs = await signer.sign(await this.getSigningKey());
             return rs;
@@ -150,6 +152,43 @@ class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
         }
         return JSON.parse(value);
     }
+    /**
+     * Stamps the configured `iss` / `aud` onto a signer, plus any per-token claims the caller passed.
+     *
+     * The configured value is AUTHORITATIVE. `iss` and `aud` are in `JWT_COMMON_FIELDS`, so they ride
+     * through the AES envelope in the clear and an application-shaped payload can carry them - an
+     * issuer identity any payload could overwrite would not be an identity. A conflicting payload
+     * claim is overwritten and reported.
+     *
+     * Per-token audience is an explicit argument rather than a smuggled payload key, so the caller
+     * that legitimately needs one says so.
+     */
+    applySignClaims(opts) {
+        const { signer, payload, claims } = opts;
+        const configured = this.signOptions;
+        const issuer = claims?.issuer ?? configured?.issuer;
+        const audience = claims?.audience ?? configured?.audience;
+        const logger = this.logger.for(this.applySignClaims.name);
+        if (issuer !== undefined) {
+            if (payload.iss !== undefined && payload.iss !== issuer) {
+                logger.warn('Payload iss overridden by the configured issuer | payload: %s | configured: %s', payload.iss, issuer);
+            }
+            signer.setIssuer(issuer);
+        }
+        if (audience !== undefined) {
+            if (payload.aud !== undefined) {
+                logger.warn('Payload aud overridden | payload: %j | applied: %j', payload.aud, audience);
+            }
+            signer.setAudience(audience);
+        }
+        if (claims?.subject !== undefined) {
+            signer.setSubject(claims.subject);
+        }
+        if (claims?.jwtId !== undefined) {
+            signer.setJti(claims.jwtId);
+        }
+        return signer;
+    }
     decryptPayload(opts) {
         const { payload, protectedHeader } = opts.result;
         if (!this.aes || !this.applicationSecret) {

package/dist/components/auth/authenticate/services/bearer/abstract.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"abstract.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/abstract.service.ts"],"names":[],"mappings":";;;AACA,~~wDAAoD~~;~~AAGpD~~,~~sDAAuD;AACvD,~~0DAAqD;AACrD,~~0DAA6C~~;~~AAQ7C~~,~~wDAA6E~~;~~AAE7E~~,gGAAgG;AAChG,MAAsB,0BAAgD,SAAQ,0BAAW;IAAzF;;QAYY,QAAG,GAA0B,IAAI,CAAC;QAClC,sBAAiB,GAAkB,IAAI,CAAC;QACxC,gBAAW,GAAoC,IAAI,GAAG,EAAE,CAAC;~~IAgNrE~~,CAAC;~~IA7NC~~,oDAAoD;aACpC,sBAAiB,GAAG,IAAI,GAAG,CAAmB;QAC5D,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;KACN,CAAC,AAR+B,CAQ9B;~~IAMH~~,mIAAmI;IACzH,0BAA0B,CAAC,~~IAMpC~~;QACC,MAAM,EAAE,YAAY,GAAG,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;~~QAEtF~~,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,MAAM,IAAI,mBAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,kBAAkB,CAAC,OAA4B;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAE5B,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,6BAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,gBAAgB;gBAC5C,OAAO,EAAE,kIAAkI;aAC5I,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqC;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjF,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uLAAuL;YACvL,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,mCAAmC;gBAC5C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,~~IAGd~~;QACC,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,IAAI,CAAC;~~QAE9E~~,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,qBAAqB;gBACjD,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;~~QAEpE~~,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAES,cAAc,CAAC,IAAiC;QACxD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,OAAyB;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,GAA2B,EAAE,CAAC;QAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAE3B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,uEAAuE;YACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAEvD,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAClC,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAES,gBAAgB,CAAC,IAAoC;QAC7D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,cAAc,CAAC,IAAmD;QAChE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAA2B,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;aAC7B,KAAK,CAAC,sCAAsC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,EAAE,GAAQ,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;;~~AAlNH~~,~~gEA8NC~~"}
1	+ {"version":3,"file":"abstract.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/abstract.service.ts"],"names":[],"mappings":";;;AACA,0DAA6C;AAE7C,0DAAqD;AACrD,sDAAuD;AASvD,wDAA0F;AAI1F,gGAAgG;AAChG,MAAsB,0BAAgD,SAAQ,0BAAW;IAAzF;;QAYY,QAAG,GAA0B,IAAI,CAAC;QAClC,sBAAiB,GAAkB,IAAI,CAAC;QACxC,gBAAW,GAAoC,IAAI,GAAG,EAAE,CAAC;QAEnE,iFAAiF;QACvE,gBAAW,GAA2B,IAAI,CAAC;IA6QvD,CAAC;IA7RC,oDAAoD;aACpC,sBAAiB,GAAG,IAAI,GAAG,CAAmB;QAC5D,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;KACN,CAAC,AAR+B,CAQ9B;IASH,mIAAmI;IACzH,0BAA0B,CAAC,IAOpC;QACC,MAAM,EAAE,YAAY,GAAG,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE5F,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,IAAI,CAAC;QAEhC,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,MAAM,IAAI,mBAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,kBAAkB,CAAC,OAA4B;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAE5B,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,6BAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,gBAAgB;gBAC5C,OAAO,EAAE,kIAAkI;aAC5I,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqC;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjF,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uLAAuL;YACvL,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,mCAAmC;gBAC5C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAKd;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,IAAI,CAAC;QAEtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,qBAAqB;gBACjD,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAES,cAAc,CAAC,IAAiC;QACxD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,OAAyB;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,GAA2B,EAAE,CAAC;QAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAE3B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,uEAAuE;YACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAEvD,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAClC,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAES,gBAAgB,CAAC,IAAoC;QAC7D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACO,eAAe,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC;QAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CACT,gFAAgF,EAChF,OAAO,CAAC,GAAG,EACX,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC3F,CAAC;YAED,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CAAC,IAAmD;QAChE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAA2B,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;aAC7B,KAAK,CAAC,sCAAsC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,EAAE,GAAQ,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;;AAjRH,gEA8RC"}

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import { TNullable, ValueOrPromise } from '@venizia/ignis-helpers/common';
+import { IJWKSIssuerOptions, IJWTIssueClaims, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
 import { Env } from 'hono';
 import { CryptoKey, JWK, SignJWT } from 'jose';
-import { IJWKSIssuerOptions, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
 import { AbstractJWKSTokenService } from './abstract.service';
 export declare class JWKSIssuerTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {
     protected options: IJWKSIssuerOptions;
@@ -18,6 +18,22 @@ export declare class JWKSIssuerTokenService<E extends Env = Env> extends Abstrac
         priv: string;
         pub: string;
     }>;
+    /**
+     * Refuses a JWK carrying private material where a PUBLIC key is expected.
+     *
+     * The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The
+     * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked
+     * `"ext": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the
+     * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the
+     * round trip returns `d`; without it, export throws. So the only thing standing between a
+     * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.
+     *
+     * Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT
+     * members are the rest of an RSA private key.
+     */
+    protected assertPublicJWK(opts: {
+        jwk: JWK;
+    }): void;
     protected parseKeyMaterial(opts: {
         raw: {
             priv: string;
@@ -33,6 +49,7 @@ export declare class JWKSIssuerTokenService<E extends Env = Env> extends Abstrac
     getSigner(opts: {
         payload: IJWTTokenPayload;
         getTokenExpiresFn: TGetTokenExpiresFn;
+        claims?: IJWTIssueClaims;
     }): Promise<SignJWT>;
     protected getSigningKey(): ValueOrPromise<Uint8Array | CryptoKey>;
     protected getDefaultTokenExpiresFn(): TGetTokenExpiresFn;

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"~~AAEA~~,OAAO,EAAQ,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;~~AAChF~~,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EACL,SAAS,EAKT,GAAG,EAEH,OAAO,EACR,MAAM,MAAM,CAAC;AAEd,OAAO,~~EAEL,kBAAkB,EAClB,gBAAgB,EAGhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,~~EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,sBAAsB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAOxF,SAAS,CAAC,OAAO,EAAE,kBAAkB;IANvC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC/D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC9D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAIlC,OAAO,EAAE,kBAAkB;~~cAYd~~,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;~~cA4BpC~~,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAAE;;;;~~cA0B5D~~,gBAAgB,CAAC,IAAI,EAAE;QACrC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KAClC;;;;~~cAoDwB~~,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;~~KACvC~~;~~cAekB~~,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;cAQvD,wBAAwB,IAAI,kBAAkB;IAIjE,OAAO,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE;IAWpB,YAAY,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;CAI/C"}
1	+ {"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAEL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAIhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EACL,SAAS,EAKT,GAAG,EAEH,OAAO,EACR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,sBAAsB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAOxF,SAAS,CAAC,OAAO,EAAE,kBAAkB;IANvC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC/D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC9D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAIlC,OAAO,EAAE,kBAAkB;cAad,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAkCpC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAAE;;;;IA0B5E;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,IAAI;cAcnC,gBAAgB,CAAC,IAAI,EAAE;QACrC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KAClC;;;;cAsDwB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAiBkB,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;cAQvD,wBAAwB,IAAI,kBAAkB;IAIjE,OAAO,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE;IAWpB,YAAY,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;CAI/C"}

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js CHANGED Viewed

@@ -14,12 +14,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 var JWKSIssuerTokenService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JWKSIssuerTokenService = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
 const common_1 = require("@venizia/ignis-helpers/common");
+const core_1 = require("@venizia/ignis-helpers/core");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
 const jose_1 = require("jose");
 const promises_1 = require("node:fs/promises");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
 const abstract_service_1 = require("./abstract.service");
 let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenService extends abstract_service_1.AbstractJWKSTokenService {
     constructor(options) {
@@ -33,6 +32,7 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
             applicationSecret: this.options.applicationSecret,
             fieldCodecs: this.options.fieldCodecs,
             cipher: this.options.cipher,
+            sign: this.options.sign,
         });
     }
     async initialize() {
@@ -42,6 +42,10 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
         this.privateKey = built.priv;
         this.publicKey = built.pub;
         const publicJWK = await (0, jose_1.exportJWK)(this.publicKey);
+        // Belt and braces. `assertPublicJWK` already refused a private JWK on the way IN, but this is
+        // the exact object an unauthenticated `/certs` serves - the last place to notice a signing key
+        // about to be published, whatever route the material took to get here.
+        this.assertPublicJWK({ jwk: publicJWK });
         publicJWK.kid = this.options.kid;
         publicJWK.alg = algorithm;
         publicJWK.use = 'sig';
@@ -54,14 +58,14 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
     async resolveKeyContent(opts) {
         const { keys } = opts;
         switch (keys.driver) {
-            case ignis_kernel_2.JWKSKeyDrivers.FILE: {
+            case ignis_kernel_1.JWKSKeyDrivers.FILE: {
                 const [priv, pub] = await Promise.all([
                     (0, promises_1.readFile)(keys.private, 'utf-8'),
                     (0, promises_1.readFile)(keys.public, 'utf-8'),
                 ]);
                 return { priv, pub };
             }
-            case ignis_kernel_2.JWKSKeyDrivers.TEXT: {
+            case ignis_kernel_1.JWKSKeyDrivers.TEXT: {
                 return {
                     priv: keys.private,
                     pub: keys.public,
@@ -75,6 +79,30 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
             }
         }
     }
+    /**
+     * Refuses a JWK carrying private material where a PUBLIC key is expected.
+     *
+     * The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The
+     * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked
+     * `"ext": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the
+     * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the
+     * round trip returns `d`; without it, export throws. So the only thing standing between a
+     * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.
+     *
+     * Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT
+     * members are the rest of an RSA private key.
+     */
+    assertPublicJWK(opts) {
+        const PRIVATE_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'k'];
+        const present = PRIVATE_MEMBERS.filter(member => opts.jwk[member] !== undefined);
+        if (present.length === 0) {
+            return;
+        }
+        throw (0, core_1.getError)({
+            statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
+            message: `[JWKSIssuerTokenService] The public key material carries PRIVATE members (${present.join(', ')}) | this key would be published at the JWKS endpoint | pass the public half in keys.public`,
+        });
+    }
     async parseKeyMaterial(opts) {
         const { raw, algorithm, keys } = opts;
         if (!raw.priv) {
@@ -90,17 +118,18 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
             });
         }
         switch (keys.format) {
-            case ignis_kernel_2.JWKSKeyFormats.PEM: {
+            case ignis_kernel_1.JWKSKeyFormats.PEM: {
                 const priv = await (0, jose_1.importPKCS8)(raw.priv, algorithm);
                 const pub = await (0, jose_1.importSPKI)(raw.pub, algorithm);
                 return { priv, pub };
             }
-            case ignis_kernel_2.JWKSKeyFormats.JWK: {
+            case ignis_kernel_1.JWKSKeyFormats.JWK: {
                 try {
                     const parsed = {
                         priv: JSON.parse(raw.priv),
                         pub: JSON.parse(raw.pub),
                     };
+                    this.assertPublicJWK({ jwk: parsed.pub });
                     const priv = await (0, jose_1.importJWK)(parsed.priv, algorithm);
                     const pub = await (0, jose_1.importJWK)(parsed.pub, algorithm);
                     return { priv, pub };
@@ -125,7 +154,7 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
     }
     async doVerify(token) {
         await this.ensureInitialized();
-        const result = await (0, jose_1.jwtVerify)(token, this.publicKey);
+        const result = await (0, jose_1.jwtVerify)(token, this.publicKey, this.options.verify);
         return this.decryptPayload({ result });
     }
     async getSigner(opts) {
@@ -133,11 +162,12 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
         const now = Math.floor(Date.now() / 1000);
         const expiresIn = await opts.getTokenExpiresFn();
         const encryptedPayload = this.encryptPayload(opts.payload);
-        return new jose_1.SignJWT({ ...encryptedPayload })
+        const signer = new jose_1.SignJWT({ ...encryptedPayload })
             .setProtectedHeader({ alg: this.options.algorithm, kid: this.options.kid })
             .setIssuedAt()
             .setExpirationTime(now + expiresIn)
             .setNotBefore(now);
+        return this.applySignClaims({ signer, payload: encryptedPayload, claims: opts.claims });
     }
     getSigningKey() {
         if (!this.privateKey) {
@@ -164,7 +194,7 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
 };
 exports.JWKSIssuerTokenService = JWKSIssuerTokenService;
 exports.JWKSIssuerTokenService = JWKSIssuerTokenService = JWKSIssuerTokenService_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_2.AuthenticateBindingKeys.JWKS_OPTIONS })),
+    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.JWKS_OPTIONS })),
     __metadata("design:paramtypes", [Object])
 ], JWKSIssuerTokenService);
 //# sourceMappingURL=issuer.service.js.map

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,~~wDAA+C~~;~~AAC/C~~,sDAAuD;AACvD,~~0DAAgF~~;~~AAEhF~~,+BASc;AACd,+CAA4C;AAC5C,~~wDAO+B;AAC/B,~~yDAA8D;AAE9D,IAAa,sBAAsB,8BAAnC,MAAa,sBAA4C,SAAQ,2CAA2B;IAK1F,YAEE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAoB;QAN7B,eAAU,GAAsC,IAAI,CAAC;QACrD,cAAS,GAAsC,IAAI,CAAC;QACpD,SAAI,GAA2B,IAAI,CAAC;QAQ5C,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;~~SAC5B~~,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;QAE3B,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAS,EAAC,IAAI,CAAC,SAAU,CAAC,CAAC;~~QACnD~~,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC;QAC1B,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CACH,6DAA6D,EAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACN,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,IAA0C;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpC,IAAA,mBAAQ,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC/B,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAIhC;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,IAAA,kBAAW,EAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAQ;wBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAQ;qBAChC,CAAC;oBAEF,MAAM,IAAI,GAAG,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM;yBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;yBAC/B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACxD,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAmB,KAAK,EAAE,IAAI,CAAC,SAAU,CAAC,CAAC;~~QACzE~~,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,~~IAGxB~~;QACC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,~~OAAO~~,IAAI,cAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;~~aACxC~~,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC1E,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;~~IACvB~~,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAK,CAAC;IACpB,CAAC;CACF,CAAA;~~AApLY~~,wDAAsB;iCAAtB,sBAAsB;IAM9B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAN7C,sBAAsB,~~CAoLlC~~"}
1	+ {"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAgF;AAChF,sDAAuD;AACvD,wDAS+B;AAE/B,+BASc;AACd,+CAA4C;AAC5C,yDAA8D;AAE9D,IAAa,sBAAsB,8BAAnC,MAAa,sBAA4C,SAAQ,2CAA2B;IAK1F,YAEE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAoB;QAN7B,eAAU,GAAsC,IAAI,CAAC;QACrD,cAAS,GAAsC,IAAI,CAAC;QACpD,SAAI,GAA2B,IAAI,CAAC;QAQ5C,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;QAE3B,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAS,EAAC,IAAI,CAAC,SAAU,CAAC,CAAC;QAEnD,8FAA8F;QAC9F,+FAA+F;QAC/F,uEAAuE;QACvE,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC;QAC1B,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CACH,6DAA6D,EAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACN,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,IAA0C;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpC,IAAA,mBAAQ,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC/B,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,eAAe,CAAC,IAAkB;QAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAU,CAAC;QAExE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACrM,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAIhC;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,IAAA,kBAAW,EAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAQ;wBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAQ;qBAChC,CAAC;oBAEF,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;oBAE1C,MAAM,IAAI,GAAG,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM;yBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;yBAC/B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACxD,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAmB,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,cAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;aAChD,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC1E,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAK,CAAC;IACpB,CAAC;CACF,CAAA;AA3NY,wDAAsB;iCAAtB,sBAAsB;IAM9B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAN7C,sBAAsB,CA2NlC"}

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
+import { IJWKSVerifierOptions, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
 import { Env } from 'hono';
 import { createRemoteJWKSet, SignJWT } from 'jose';
-import { IJWKSVerifierOptions, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
 import { AbstractJWKSTokenService } from './abstract.service';
 export declare class JWKSVerifierTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {
     protected options: IJWKSVerifierOptions;

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":"~~AAGA~~,OAAO,~~EAAE~~,~~GAAG~~,~~EAAE~~,~~MAAM~~,MAAM,CAAC;~~AAC3B~~,OAAO,EAAE,~~kBAAkB~~,~~EAAa,OAAO,~~EAAE,MAAM,MAAM,CAAC;~~AAC9D~~,OAAO,~~EAEL~~,~~oBAAoB~~,~~EACpB~~,~~gBAAgB~~,~~EAChB~~,~~kBAAkB~~,~~EACnB,~~MAAM,~~uBAAuB,~~CAAC;~~AAC/B~~,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,wBAAwB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAK1F,SAAS,CAAC,OAAO,EAAE,oBAAoB;IAJzC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,GAAG,IAAI,CAAQ;gBAIhE,OAAO,EAAE,oBAAoB;cAWhB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAc3B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;~~IAM5D~~,SAAS,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;KACvC,GAAG,OAAO,CAAC,OAAO,CAAC;cAOD,aAAa,IAAI,KAAK;cAOtB,wBAAwB,IAAI,KAAK;CAMrD"}
1	+ {"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,EAEhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAa,OAAO,EAAE,MAAM,MAAM,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,wBAAwB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAK1F,SAAS,CAAC,OAAO,EAAE,oBAAoB;IAJzC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,GAAG,IAAI,CAAQ;gBAIhE,OAAO,EAAE,oBAAoB;cAWhB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAc3B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU5D,SAAS,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;KACvC,GAAG,OAAO,CAAC,OAAO,CAAC;cAOD,aAAa,IAAI,KAAK;cAOtB,wBAAwB,IAAI,KAAK;CAMrD"}

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.js CHANGED Viewed

@@ -14,11 +14,10 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 var JWKSVerifierTokenService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JWKSVerifierTokenService = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
 const common_1 = require("@venizia/ignis-helpers/common");
+const core_1 = require("@venizia/ignis-helpers/core");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
 const jose_1 = require("jose");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
 const abstract_service_1 = require("./abstract.service");
 let JWKSVerifierTokenService = JWKSVerifierTokenService_1 = class JWKSVerifierTokenService extends abstract_service_1.AbstractJWKSTokenService {
     constructor(options) {
@@ -45,7 +44,7 @@ let JWKSVerifierTokenService = JWKSVerifierTokenService_1 = class JWKSVerifierTo
     }
     async doVerify(token) {
         await this.ensureInitialized();
-        const result = await (0, jose_1.jwtVerify)(token, this.jwksVerifier);
+        const result = await (0, jose_1.jwtVerify)(token, this.jwksVerifier, this.options.verify);
         return this.decryptPayload({ result });
     }
     async getSigner(_opts) {
@@ -69,7 +68,7 @@ let JWKSVerifierTokenService = JWKSVerifierTokenService_1 = class JWKSVerifierTo
 };
 exports.JWKSVerifierTokenService = JWKSVerifierTokenService;
 exports.JWKSVerifierTokenService = JWKSVerifierTokenService = JWKSVerifierTokenService_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_2.AuthenticateBindingKeys.JWKS_OPTIONS })),
+    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.JWKS_OPTIONS })),
     __metadata("design:paramtypes", [Object])
 ], JWKSVerifierTokenService);
 //# sourceMappingURL=verifier.service.js.map

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,~~wDAA+C~~;~~AAC/C~~,sDAAuD;AACvD,~~0DAAqD~~;~~AAErD~~,+BAA8D;AAC9D,~~wDAK+B;AAC/B,~~yDAA8D;AAE9D,IAAa,wBAAwB,gCAArC,MAAa,wBAA8C,SAAQ,2CAA2B;IAG5F,YAEE,OAAuC;QAEvC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAsB;QAJ/B,iBAAY,GAAiD,IAAI,CAAC;QAO1E,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;YAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,UAAU;YAClD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,~~EAAmB~~,KAAK,~~EAAE~~,IAAI,CAAC,YAAa,CAAC,CAAC;~~QAC5E~~,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,KAGxB;QACC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,aAAa;QAC9B,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,wBAAwB;QACzC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;~~AA3DY~~,4DAAwB;mCAAxB,wBAAwB;IAIhC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAJ7C,wBAAwB,~~CA2DpC~~"}
1	+ {"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqD;AACrD,sDAAuD;AACvD,wDAM+B;AAE/B,+BAA8D;AAC9D,yDAA8D;AAE9D,IAAa,wBAAwB,gCAArC,MAAa,wBAA8C,SAAQ,2CAA2B;IAG5F,YAEE,OAAuC;QAEvC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAsB;QAJ/B,iBAAY,GAAiD,IAAI,CAAC;QAO1E,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;YAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,UAAU;YAClD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAC5B,KAAK,EACL,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,KAGxB;QACC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,aAAa;QAC9B,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,wBAAwB;QACzC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/DY,4DAAwB;mCAAxB,wBAAwB;IAIhC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAJ7C,wBAAwB,CA+DpC"}

package/dist/components/auth/authenticate/services/bearer/jws.service.d.ts CHANGED Viewed

@@ -1,7 +1,7 @@
 import { ValueOrPromise } from '@venizia/ignis-helpers/common';
+import { IJWSTokenServiceOptions, IJWTIssueClaims, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
 import { Env } from 'hono';
 import { SignJWT } from 'jose';
-import { IJWSTokenServiceOptions, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
 import { AbstractBearerTokenService } from './abstract.service';
 /** Symmetric JWT (JWS) token service with optional AES-encrypted payloads. */
 export declare class JWSTokenService<E extends Env = Env> extends AbstractBearerTokenService<E> {
@@ -12,6 +12,7 @@ export declare class JWSTokenService<E extends Env = Env> extends AbstractBearer
     getSigner(opts: {
         payload: IJWTTokenPayload;
         getTokenExpiresFn: TGetTokenExpiresFn;
+        claims?: IJWTIssueClaims;
     }): Promise<SignJWT>;
     protected getSigningKey(): ValueOrPromise<Uint8Array>;
     protected getDefaultTokenExpiresFn(): TGetTokenExpiresFn;

package/dist/components/auth/authenticate/services/bearer/jws.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jws.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":"~~AAEA~~,OAAO,EAAQ,cAAc,EAAE,MAAM,+BAA+B,CAAC;~~AACrE~~,OAAO,~~EAAE~~,~~GAAG~~,~~EAAE~~,~~MAAM~~,MAAM,CAAC;~~AAC3B~~,OAAO,~~EAAa~~,~~OAAO~~,EAAE,MAAM,MAAM,CAAC;~~AAC1C~~,OAAO,~~EAEL~~,~~uBAAuB~~,~~EACvB~~,~~gBAAgB~~,~~EAChB,kBAAkB,EACnB,~~MAAM,~~uBAAuB,~~CAAC;~~AAC/B~~,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,8EAA8E;AAC9E,qBAAa,eAAe,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,0BAA0B,CAAC,CAAC,CAAC;IAKnF,SAAS,CAAC,OAAO,EAAE,uBAAuB;IAJ5C,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;gBAIpB,OAAO,EAAE,uBAAuB;~~cA6BnB~~,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;~~IAK5D~~,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;~~KACvC~~;~~cAakB~~,aAAa,IAAI,cAAc,CAAC,UAAU,CAAC;cAQ3C,wBAAwB,IAAI,kBAAkB;CAGlE"}
1	+ {"version":3,"file":"jws.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAEL,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAEhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EAAa,OAAO,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,8EAA8E;AAC9E,qBAAa,eAAe,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,0BAA0B,CAAC,CAAC,CAAC;IAKnF,SAAS,CAAC,OAAO,EAAE,uBAAuB;IAJ5C,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;gBAIpB,OAAO,EAAE,uBAAuB;cA8BnB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAS5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAekB,aAAa,IAAI,cAAc,CAAC,UAAU,CAAC;cAQ3C,wBAAwB,IAAI,kBAAkB;CAGlE"}

package/dist/components/auth/authenticate/services/bearer/jws.service.js CHANGED Viewed

@@ -14,11 +14,10 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 var JWSTokenService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JWSTokenService = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
 const common_1 = require("@venizia/ignis-helpers/common");
+const core_1 = require("@venizia/ignis-helpers/core");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
 const jose_1 = require("jose");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
 const abstract_service_1 = require("./abstract.service");
 /** Symmetric JWT (JWS) token service with optional AES-encrypted payloads. */
 let JWSTokenService = JWSTokenService_1 = class JWSTokenService extends abstract_service_1.AbstractBearerTokenService {
@@ -43,22 +42,24 @@ let JWSTokenService = JWSTokenService_1 = class JWSTokenService extends abstract
             applicationSecret,
             fieldCodecs: options.fieldCodecs,
             cipher: options.cipher,
+            sign: options.sign,
         });
         this.jwtSecret = new TextEncoder().encode(this.options.jwtSecret);
     }
     async doVerify(token) {
-        const decodedToken = await (0, jose_1.jwtVerify)(token, this.jwtSecret, {});
+        const decodedToken = await (0, jose_1.jwtVerify)(token, this.jwtSecret, this.options.verify);
         return this.decryptPayload({ result: decodedToken });
     }
     async getSigner(opts) {
         const now = Math.floor(Date.now() / 1000);
         const expiresIn = await opts.getTokenExpiresFn();
         const encryptedPayload = this.encryptPayload(opts.payload);
-        return new jose_1.SignJWT(Object.assign({}, encryptedPayload))
+        const signer = new jose_1.SignJWT(Object.assign({}, encryptedPayload))
             .setProtectedHeader({ alg: this.options.headerAlgorithm ?? 'HS256' })
             .setIssuedAt()
             .setExpirationTime(now + expiresIn)
             .setNotBefore(now);
+        return this.applySignClaims({ signer, payload: encryptedPayload, claims: opts.claims });
     }
     getSigningKey() {
         if (!this.jwtSecret) {
@@ -72,7 +73,7 @@ let JWSTokenService = JWSTokenService_1 = class JWSTokenService extends abstract
 };
 exports.JWSTokenService = JWSTokenService;
 exports.JWSTokenService = JWSTokenService = JWSTokenService_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_2.AuthenticateBindingKeys.JWT_OPTIONS })),
+    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.JWT_OPTIONS })),
     __metadata("design:paramtypes", [Object])
 ], JWSTokenService);
 //# sourceMappingURL=jws.service.js.map

package/dist/components/auth/authenticate/services/bearer/jws.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jws.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,~~wDAA+C~~;~~AAC/C~~,sDAAuD;AACvD,~~0DAAqE~~;~~AAErE~~,+BAA0C;AAC1C,~~wDAK+B;AAC/B,~~yDAAgE;AAEhE,8EAA8E;AAC9E,IAAa,eAAe,uBAA5B,MAAa,eAAqC,SAAQ,6CAA6B;IAGrF,YAEY,OAAgC;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAF7B,YAAO,GAAP,OAAO,CAAyB;QAI1C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAExF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY;YACZ,iBAAiB;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;~~SACvB~~,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,YAAY,GAAG,MAAM,IAAA,gBAAS,~~EAAmB~~,KAAK,~~EAAE~~,IAAI,CAAC,SAAS,~~EAAE~~,~~EAAE~~,CAAC,CAAC;~~QAClF~~,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,~~IAGxB~~;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,~~OAAO~~,IAAI,cAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;~~aACpD~~,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,EAAE,CAAC;aACpE,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;~~IACvB~~,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;CACF,CAAA;~~AAlEY~~,0CAAe;0BAAf,eAAe;IAIvB,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC,CAAA;;GAJ5C,eAAe,~~CAkE3B~~"}
1	+ {"version":3,"file":"jws.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqE;AACrE,sDAAuD;AACvD,wDAO+B;AAE/B,+BAA0C;AAC1C,yDAAgE;AAEhE,8EAA8E;AAC9E,IAAa,eAAe,uBAA5B,MAAa,eAAqC,SAAQ,6CAA6B;IAGrF,YAEY,OAAgC;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAF7B,YAAO,GAAP,OAAO,CAAyB;QAI1C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAExF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY;YACZ,iBAAiB;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,YAAY,GAAG,MAAM,IAAA,gBAAS,EAClC,KAAK,EACL,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,cAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;aAC5D,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,EAAE,CAAC;aACpE,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;CACF,CAAA;AA1EY,0CAAe;0BAAf,eAAe;IAIvB,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC,CAAA;;GAJ5C,eAAe,CA0E3B"}

package/dist/components/auth/authenticate/services/index.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 export * from './basic';
 export * from './bearer';
+export * from './service';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC"}

package/dist/components/auth/authenticate/services/index.js CHANGED Viewed

@@ -16,4 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./basic"), exports);
 __exportStar(require("./bearer"), exports);
+__exportStar(require("./service"), exports);
 //# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B"}

package/dist/components/auth/authenticate/services/service/index.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+export * from './signer.service';
+export * from './verifier.service';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/service/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC"}

package/dist/components/auth/authenticate/services/service/index.js ADDED Viewed

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./signer.service"), exports);
+__exportStar(require("./verifier.service"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/service/index.js.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,qDAAmC"}