@venizia/ignis 0.2.0-48 → 0.2.0-49
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +118 -158
- package/dist/base/applications/server.d.ts +2 -0
- package/dist/base/applications/server.d.ts.map +1 -1
- package/dist/base/applications/server.js +9 -0
- package/dist/base/applications/server.js.map +1 -1
- package/dist/base/middlewares/request-spy/request-spy.middleware.d.ts +1 -1
- package/dist/base/middlewares/request-spy/request-spy.middleware.d.ts.map +1 -1
- package/dist/base/middlewares/request-spy/request-spy.middleware.js +11 -3
- package/dist/base/middlewares/request-spy/request-spy.middleware.js.map +1 -1
- package/dist/components/auth/authenticate/component.d.ts +5 -0
- package/dist/components/auth/authenticate/component.d.ts.map +1 -1
- package/dist/components/auth/authenticate/component.js +23 -0
- package/dist/components/auth/authenticate/component.js.map +1 -1
- package/dist/components/auth/authenticate/controllers/jwks/definitions.d.ts +40 -20
- package/dist/components/auth/authenticate/controllers/jwks/definitions.d.ts.map +1 -1
- package/dist/components/auth/authenticate/controllers/service-certs/definitions.d.ts +40 -20
- package/dist/components/auth/authenticate/controllers/service-certs/definitions.d.ts.map +1 -1
- package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts +2 -2
- package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts.map +1 -1
- package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js +12 -8
- package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js.map +1 -1
- package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.d.ts +1 -1
- package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.d.ts.map +1 -1
- package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.js +5 -3
- package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.js.map +1 -1
- package/dist/components/auth/authenticate/services/bearer/jws.service.d.ts +1 -2
- package/dist/components/auth/authenticate/services/bearer/jws.service.d.ts.map +1 -1
- package/dist/components/auth/authenticate/services/bearer/jws.service.js +5 -3
- package/dist/components/auth/authenticate/services/bearer/jws.service.js.map +1 -1
- package/dist/components/auth/authenticate/services/jose-loader.d.ts +16 -0
- package/dist/components/auth/authenticate/services/jose-loader.d.ts.map +1 -0
- package/dist/components/auth/authenticate/services/jose-loader.js +25 -0
- package/dist/components/auth/authenticate/services/jose-loader.js.map +1 -0
- package/dist/components/auth/authenticate/services/service/signer.service.d.ts.map +1 -1
- package/dist/components/auth/authenticate/services/service/signer.service.js +8 -5
- package/dist/components/auth/authenticate/services/service/signer.service.js.map +1 -1
- package/dist/components/auth/authenticate/services/service/verifier.service.d.ts.map +1 -1
- package/dist/components/auth/authenticate/services/service/verifier.service.js +10 -9
- package/dist/components/auth/authenticate/services/service/verifier.service.js.map +1 -1
- package/dist/components/static-asset/controller/base.definition.d.ts.map +1 -1
- package/dist/components/static-asset/controller/base.definition.js +1 -2
- package/dist/components/static-asset/controller/base.definition.js.map +1 -1
- package/dist/connectors/postgres/drivers/postgres-js.d.mts +3 -0
- package/dist/connectors/postgres/drivers/postgres-js.d.mts.map +1 -0
- package/dist/connectors/postgres/drivers/postgres-js.mjs +3 -0
- package/dist/connectors/postgres/drivers/postgres-js.mjs.map +1 -0
- package/package.json +9 -8
|
@@ -4,6 +4,46 @@ export declare const RouteConfigs: {
|
|
|
4
4
|
readonly path: "/";
|
|
5
5
|
readonly method: "get";
|
|
6
6
|
readonly responses: {
|
|
7
|
+
'4XX': {
|
|
8
|
+
description: string;
|
|
9
|
+
content: {
|
|
10
|
+
"application/json": {
|
|
11
|
+
schema: z.ZodObject<{
|
|
12
|
+
statusCode: z.ZodOptional<z.ZodNumber>;
|
|
13
|
+
message: z.ZodString;
|
|
14
|
+
normalized: z.ZodOptional<z.ZodObject<{
|
|
15
|
+
text: z.ZodString;
|
|
16
|
+
code: z.ZodString;
|
|
17
|
+
args: z.ZodRecord<z.ZodString, z.ZodAny>;
|
|
18
|
+
}, z.core.$strip>>;
|
|
19
|
+
extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
20
|
+
requestId: z.ZodOptional<z.ZodString>;
|
|
21
|
+
details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
22
|
+
}, z.core.$strip>;
|
|
23
|
+
};
|
|
24
|
+
};
|
|
25
|
+
required: boolean | undefined;
|
|
26
|
+
};
|
|
27
|
+
'5XX': {
|
|
28
|
+
description: string;
|
|
29
|
+
content: {
|
|
30
|
+
"application/json": {
|
|
31
|
+
schema: z.ZodObject<{
|
|
32
|
+
statusCode: z.ZodOptional<z.ZodNumber>;
|
|
33
|
+
message: z.ZodString;
|
|
34
|
+
normalized: z.ZodOptional<z.ZodObject<{
|
|
35
|
+
text: z.ZodString;
|
|
36
|
+
code: z.ZodString;
|
|
37
|
+
args: z.ZodRecord<z.ZodString, z.ZodAny>;
|
|
38
|
+
}, z.core.$strip>>;
|
|
39
|
+
extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
40
|
+
requestId: z.ZodOptional<z.ZodString>;
|
|
41
|
+
details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
42
|
+
}, z.core.$strip>;
|
|
43
|
+
};
|
|
44
|
+
};
|
|
45
|
+
required: boolean | undefined;
|
|
46
|
+
};
|
|
7
47
|
200: {
|
|
8
48
|
description: string;
|
|
9
49
|
content: {
|
|
@@ -46,26 +86,6 @@ export declare const RouteConfigs: {
|
|
|
46
86
|
};
|
|
47
87
|
required: boolean | undefined;
|
|
48
88
|
};
|
|
49
|
-
"4xx | 5xx": {
|
|
50
|
-
description: string;
|
|
51
|
-
content: {
|
|
52
|
-
"application/json": {
|
|
53
|
-
schema: z.ZodObject<{
|
|
54
|
-
statusCode: z.ZodOptional<z.ZodNumber>;
|
|
55
|
-
message: z.ZodString;
|
|
56
|
-
normalized: z.ZodOptional<z.ZodObject<{
|
|
57
|
-
text: z.ZodString;
|
|
58
|
-
code: z.ZodString;
|
|
59
|
-
args: z.ZodRecord<z.ZodString, z.ZodAny>;
|
|
60
|
-
}, z.core.$strip>>;
|
|
61
|
-
extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
62
|
-
requestId: z.ZodOptional<z.ZodString>;
|
|
63
|
-
details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
64
|
-
}, z.core.$strip>;
|
|
65
|
-
};
|
|
66
|
-
};
|
|
67
|
-
required: boolean | undefined;
|
|
68
|
-
};
|
|
69
89
|
};
|
|
70
90
|
};
|
|
71
91
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/jwks/definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAGtC,eAAO,MAAM,YAAY
|
|
1
|
+
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/jwks/definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAGtC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Bf,CAAC"}
|
|
@@ -11,6 +11,46 @@ export declare const ServiceCertsRouteConfigs: {
|
|
|
11
11
|
readonly path: "/";
|
|
12
12
|
readonly method: "get";
|
|
13
13
|
readonly responses: {
|
|
14
|
+
'4XX': {
|
|
15
|
+
description: string;
|
|
16
|
+
content: {
|
|
17
|
+
"application/json": {
|
|
18
|
+
schema: z.ZodObject<{
|
|
19
|
+
statusCode: z.ZodOptional<z.ZodNumber>;
|
|
20
|
+
message: z.ZodString;
|
|
21
|
+
normalized: z.ZodOptional<z.ZodObject<{
|
|
22
|
+
text: z.ZodString;
|
|
23
|
+
code: z.ZodString;
|
|
24
|
+
args: z.ZodRecord<z.ZodString, z.ZodAny>;
|
|
25
|
+
}, z.core.$strip>>;
|
|
26
|
+
extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
27
|
+
requestId: z.ZodOptional<z.ZodString>;
|
|
28
|
+
details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
29
|
+
}, z.core.$strip>;
|
|
30
|
+
};
|
|
31
|
+
};
|
|
32
|
+
required: boolean | undefined;
|
|
33
|
+
};
|
|
34
|
+
'5XX': {
|
|
35
|
+
description: string;
|
|
36
|
+
content: {
|
|
37
|
+
"application/json": {
|
|
38
|
+
schema: z.ZodObject<{
|
|
39
|
+
statusCode: z.ZodOptional<z.ZodNumber>;
|
|
40
|
+
message: z.ZodString;
|
|
41
|
+
normalized: z.ZodOptional<z.ZodObject<{
|
|
42
|
+
text: z.ZodString;
|
|
43
|
+
code: z.ZodString;
|
|
44
|
+
args: z.ZodRecord<z.ZodString, z.ZodAny>;
|
|
45
|
+
}, z.core.$strip>>;
|
|
46
|
+
extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
47
|
+
requestId: z.ZodOptional<z.ZodString>;
|
|
48
|
+
details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
49
|
+
}, z.core.$strip>;
|
|
50
|
+
};
|
|
51
|
+
};
|
|
52
|
+
required: boolean | undefined;
|
|
53
|
+
};
|
|
14
54
|
200: {
|
|
15
55
|
description: string;
|
|
16
56
|
content: {
|
|
@@ -47,26 +87,6 @@ export declare const ServiceCertsRouteConfigs: {
|
|
|
47
87
|
};
|
|
48
88
|
required: boolean | undefined;
|
|
49
89
|
};
|
|
50
|
-
"4xx | 5xx": {
|
|
51
|
-
description: string;
|
|
52
|
-
content: {
|
|
53
|
-
"application/json": {
|
|
54
|
-
schema: z.ZodObject<{
|
|
55
|
-
statusCode: z.ZodOptional<z.ZodNumber>;
|
|
56
|
-
message: z.ZodString;
|
|
57
|
-
normalized: z.ZodOptional<z.ZodObject<{
|
|
58
|
-
text: z.ZodString;
|
|
59
|
-
code: z.ZodString;
|
|
60
|
-
args: z.ZodRecord<z.ZodString, z.ZodAny>;
|
|
61
|
-
}, z.core.$strip>>;
|
|
62
|
-
extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
63
|
-
requestId: z.ZodOptional<z.ZodString>;
|
|
64
|
-
details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
65
|
-
}, z.core.$strip>;
|
|
66
|
-
};
|
|
67
|
-
};
|
|
68
|
-
required: boolean | undefined;
|
|
69
|
-
};
|
|
70
90
|
};
|
|
71
91
|
};
|
|
72
92
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB
|
|
1
|
+
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsB3B,CAAC"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { TNullable, ValueOrPromise } from '@venizia/ignis-helpers/common';
|
|
2
2
|
import { IJWKSIssuerOptions, IJWTIssueClaims, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
|
|
3
3
|
import { Env } from 'hono';
|
|
4
|
-
import { CryptoKey, JWK
|
|
4
|
+
import type { CryptoKey, JWK } from 'jose';
|
|
5
5
|
import { AbstractJWKSTokenService } from './abstract.service';
|
|
6
6
|
export declare class JWKSIssuerTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {
|
|
7
7
|
protected options: IJWKSIssuerOptions;
|
|
@@ -50,7 +50,7 @@ export declare class JWKSIssuerTokenService<E extends Env = Env> extends Abstrac
|
|
|
50
50
|
payload: IJWTTokenPayload;
|
|
51
51
|
getTokenExpiresFn: TGetTokenExpiresFn;
|
|
52
52
|
claims?: IJWTIssueClaims;
|
|
53
|
-
}): Promise<SignJWT>;
|
|
53
|
+
}): Promise<import("jose", { with: { "resolution-mode": "import" } }).SignJWT>;
|
|
54
54
|
protected getSigningKey(): ValueOrPromise<Uint8Array | CryptoKey>;
|
|
55
55
|
protected getDefaultTokenExpiresFn(): TGetTokenExpiresFn;
|
|
56
56
|
getJWKS(): {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAEL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAIhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,
|
|
1
|
+
{"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAEL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAIhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAG3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,sBAAsB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAOxF,SAAS,CAAC,OAAO,EAAE,kBAAkB;IANvC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC/D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC9D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAIlC,OAAO,EAAE,kBAAkB;cAad,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAmCpC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAAE;;;;IA0B5E;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,IAAI;cAcnC,gBAAgB,CAAC,IAAI,EAAE;QACrC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KAClC;;;;cAwDwB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAkBkB,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;cAQvD,wBAAwB,IAAI,kBAAkB;IAIjE,OAAO,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE;IAWpB,YAAY,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;CAI/C"}
|
|
@@ -17,8 +17,8 @@ exports.JWKSIssuerTokenService = void 0;
|
|
|
17
17
|
const common_1 = require("@venizia/ignis-helpers/common");
|
|
18
18
|
const core_1 = require("@venizia/ignis-helpers/core");
|
|
19
19
|
const ignis_kernel_1 = require("@venizia/ignis-kernel");
|
|
20
|
-
const jose_1 = require("jose");
|
|
21
20
|
const promises_1 = require("node:fs/promises");
|
|
21
|
+
const jose_loader_1 = require("../../jose-loader");
|
|
22
22
|
const abstract_service_1 = require("./abstract.service");
|
|
23
23
|
let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenService extends abstract_service_1.AbstractJWKSTokenService {
|
|
24
24
|
constructor(options) {
|
|
@@ -41,7 +41,8 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
|
|
|
41
41
|
const built = await this.parseKeyMaterial({ raw, algorithm, keys });
|
|
42
42
|
this.privateKey = built.priv;
|
|
43
43
|
this.publicKey = built.pub;
|
|
44
|
-
const
|
|
44
|
+
const { exportJWK } = await jose_loader_1.JoseLoader.load();
|
|
45
|
+
const publicJWK = await exportJWK(this.publicKey);
|
|
45
46
|
// Belt and braces. `assertPublicJWK` already refused a private JWK on the way IN, but this is
|
|
46
47
|
// the exact object an unauthenticated `/certs` serves - the last place to notice a signing key
|
|
47
48
|
// about to be published, whatever route the material took to get here.
|
|
@@ -117,10 +118,11 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
|
|
|
117
118
|
message: '[JWKSIssuerTokenService] Invalid raw.pub key!',
|
|
118
119
|
});
|
|
119
120
|
}
|
|
121
|
+
const { importJWK, importPKCS8, importSPKI } = await jose_loader_1.JoseLoader.load();
|
|
120
122
|
switch (keys.format) {
|
|
121
123
|
case ignis_kernel_1.JWKSKeyFormats.PEM: {
|
|
122
|
-
const priv = await
|
|
123
|
-
const pub = await
|
|
124
|
+
const priv = await importPKCS8(raw.priv, algorithm);
|
|
125
|
+
const pub = await importSPKI(raw.pub, algorithm);
|
|
124
126
|
return { priv, pub };
|
|
125
127
|
}
|
|
126
128
|
case ignis_kernel_1.JWKSKeyFormats.JWK: {
|
|
@@ -130,8 +132,8 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
|
|
|
130
132
|
pub: JSON.parse(raw.pub),
|
|
131
133
|
};
|
|
132
134
|
this.assertPublicJWK({ jwk: parsed.pub });
|
|
133
|
-
const priv = await
|
|
134
|
-
const pub = await
|
|
135
|
+
const priv = await importJWK(parsed.priv, algorithm);
|
|
136
|
+
const pub = await importJWK(parsed.pub, algorithm);
|
|
135
137
|
return { priv, pub };
|
|
136
138
|
}
|
|
137
139
|
catch (error) {
|
|
@@ -154,15 +156,17 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
|
|
|
154
156
|
}
|
|
155
157
|
async doVerify(token) {
|
|
156
158
|
await this.ensureInitialized();
|
|
157
|
-
const
|
|
159
|
+
const { jwtVerify } = await jose_loader_1.JoseLoader.load();
|
|
160
|
+
const result = await jwtVerify(token, this.publicKey, this.options.verify);
|
|
158
161
|
return this.decryptPayload({ result });
|
|
159
162
|
}
|
|
160
163
|
async getSigner(opts) {
|
|
161
164
|
await this.ensureInitialized();
|
|
165
|
+
const { SignJWT } = await jose_loader_1.JoseLoader.load();
|
|
162
166
|
const now = Math.floor(Date.now() / 1000);
|
|
163
167
|
const expiresIn = await opts.getTokenExpiresFn();
|
|
164
168
|
const encryptedPayload = this.encryptPayload(opts.payload);
|
|
165
|
-
const signer = new
|
|
169
|
+
const signer = new SignJWT({ ...encryptedPayload })
|
|
166
170
|
.setProtectedHeader({ alg: this.options.algorithm, kid: this.options.kid })
|
|
167
171
|
.setIssuedAt()
|
|
168
172
|
.setExpirationTime(now + expiresIn)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAgF;AAChF,sDAAuD;AACvD,wDAS+B;
|
|
1
|
+
{"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAgF;AAChF,sDAAuD;AACvD,wDAS+B;AAG/B,+CAA4C;AAC5C,mDAA+C;AAC/C,yDAA8D;AAE9D,IAAa,sBAAsB,8BAAnC,MAAa,sBAA4C,SAAQ,2CAA2B;IAK1F,YAEE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAoB;QAN7B,eAAU,GAAsC,IAAI,CAAC;QACrD,cAAS,GAAsC,IAAI,CAAC;QACpD,SAAI,GAA2B,IAAI,CAAC;QAQ5C,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;QAEnD,8FAA8F;QAC9F,+FAA+F;QAC/F,uEAAuE;QACvE,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC;QAC1B,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CACH,6DAA6D,EAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACN,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,IAA0C;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpC,IAAA,mBAAQ,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC/B,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,eAAe,CAAC,IAAkB;QAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAU,CAAC;QAExE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACrM,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAIhC;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAEvE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAQ;wBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAQ;qBAChC,CAAC;oBAEF,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;oBAE1C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM;yBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;yBAC/B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACxD,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAmB,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;aAChD,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC1E,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAK,CAAC;IACpB,CAAC;CACF,CAAA;AAhOY,wDAAsB;iCAAtB,sBAAsB;IAM9B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAN7C,sBAAsB,CAgOlC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { IJWKSVerifierOptions, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
|
|
2
2
|
import { Env } from 'hono';
|
|
3
|
-
import { createRemoteJWKSet, SignJWT } from 'jose';
|
|
3
|
+
import type { createRemoteJWKSet, SignJWT } from 'jose';
|
|
4
4
|
import { AbstractJWKSTokenService } from './abstract.service';
|
|
5
5
|
export declare class JWKSVerifierTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {
|
|
6
6
|
protected options: IJWKSVerifierOptions;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,EAEhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EAAE,kBAAkB,
|
|
1
|
+
{"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,oBAAoB,EACpB,gBAAgB,EAEhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,wBAAwB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAK1F,SAAS,CAAC,OAAO,EAAE,oBAAoB;IAJzC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,GAAG,IAAI,CAAQ;gBAIhE,OAAO,EAAE,oBAAoB;cAWhB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAe3B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAW5D,SAAS,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;KACvC,GAAG,OAAO,CAAC,OAAO,CAAC;cAOD,aAAa,IAAI,KAAK;cAOtB,wBAAwB,IAAI,KAAK;CAMrD"}
|
|
@@ -17,7 +17,7 @@ exports.JWKSVerifierTokenService = void 0;
|
|
|
17
17
|
const common_1 = require("@venizia/ignis-helpers/common");
|
|
18
18
|
const core_1 = require("@venizia/ignis-helpers/core");
|
|
19
19
|
const ignis_kernel_1 = require("@venizia/ignis-kernel");
|
|
20
|
-
const
|
|
20
|
+
const jose_loader_1 = require("../../jose-loader");
|
|
21
21
|
const abstract_service_1 = require("./abstract.service");
|
|
22
22
|
let JWKSVerifierTokenService = JWKSVerifierTokenService_1 = class JWKSVerifierTokenService extends abstract_service_1.AbstractJWKSTokenService {
|
|
23
23
|
constructor(options) {
|
|
@@ -32,8 +32,9 @@ let JWKSVerifierTokenService = JWKSVerifierTokenService_1 = class JWKSVerifierTo
|
|
|
32
32
|
});
|
|
33
33
|
}
|
|
34
34
|
async initialize() {
|
|
35
|
+
const { createRemoteJWKSet } = await jose_loader_1.JoseLoader.load();
|
|
35
36
|
const jwksUrl = new URL(this.options.jwksUrl);
|
|
36
|
-
this.jwksVerifier =
|
|
37
|
+
this.jwksVerifier = createRemoteJWKSet(jwksUrl, {
|
|
37
38
|
cacheMaxAge: this.options.cacheTtlMs ?? 43_200_000,
|
|
38
39
|
cooldownDuration: this.options.cooldownMs ?? 30_000,
|
|
39
40
|
});
|
|
@@ -44,7 +45,8 @@ let JWKSVerifierTokenService = JWKSVerifierTokenService_1 = class JWKSVerifierTo
|
|
|
44
45
|
}
|
|
45
46
|
async doVerify(token) {
|
|
46
47
|
await this.ensureInitialized();
|
|
47
|
-
const
|
|
48
|
+
const { jwtVerify } = await jose_loader_1.JoseLoader.load();
|
|
49
|
+
const result = await jwtVerify(token, this.jwksVerifier, this.options.verify);
|
|
48
50
|
return this.decryptPayload({ result });
|
|
49
51
|
}
|
|
50
52
|
async getSigner(_opts) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqD;AACrD,sDAAuD;AACvD,wDAM+B;
|
|
1
|
+
{"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqD;AACrD,sDAAuD;AACvD,wDAM+B;AAG/B,mDAA+C;AAC/C,yDAA8D;AAE9D,IAAa,wBAAwB,gCAArC,MAAa,wBAA8C,SAAQ,2CAA2B;IAG5F,YAEE,OAAuC;QAEvC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAsB;QAJ/B,iBAAY,GAAiD,IAAI,CAAC;QAO1E,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE;YAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,UAAU;YAClD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,KAGxB;QACC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,aAAa;QAC9B,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,wBAAwB;QACzC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjEY,4DAAwB;mCAAxB,wBAAwB;IAIhC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAJ7C,wBAAwB,CAiEpC"}
|
|
@@ -1,7 +1,6 @@
|
|
|
1
1
|
import { ValueOrPromise } from '@venizia/ignis-helpers/common';
|
|
2
2
|
import { IJWSTokenServiceOptions, IJWTIssueClaims, IJWTTokenPayload, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
|
|
3
3
|
import { Env } from 'hono';
|
|
4
|
-
import { SignJWT } from 'jose';
|
|
5
4
|
import { AbstractBearerTokenService } from './abstract.service';
|
|
6
5
|
/** Symmetric JWT (JWS) token service with optional AES-encrypted payloads. */
|
|
7
6
|
export declare class JWSTokenService<E extends Env = Env> extends AbstractBearerTokenService<E> {
|
|
@@ -13,7 +12,7 @@ export declare class JWSTokenService<E extends Env = Env> extends AbstractBearer
|
|
|
13
12
|
payload: IJWTTokenPayload;
|
|
14
13
|
getTokenExpiresFn: TGetTokenExpiresFn;
|
|
15
14
|
claims?: IJWTIssueClaims;
|
|
16
|
-
}): Promise<SignJWT>;
|
|
15
|
+
}): Promise<import("jose", { with: { "resolution-mode": "import" } }).SignJWT>;
|
|
17
16
|
protected getSigningKey(): ValueOrPromise<Uint8Array>;
|
|
18
17
|
protected getDefaultTokenExpiresFn(): TGetTokenExpiresFn;
|
|
19
18
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jws.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAEL,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAEhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"jws.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAEL,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAEhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,8EAA8E;AAC9E,qBAAa,eAAe,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,0BAA0B,CAAC,CAAC,CAAC;IAKnF,SAAS,CAAC,OAAO,EAAE,uBAAuB;IAJ5C,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;gBAIpB,OAAO,EAAE,uBAAuB;cA8BnB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAgBkB,aAAa,IAAI,cAAc,CAAC,UAAU,CAAC;cAQ3C,wBAAwB,IAAI,kBAAkB;CAGlE"}
|
|
@@ -17,7 +17,7 @@ exports.JWSTokenService = void 0;
|
|
|
17
17
|
const common_1 = require("@venizia/ignis-helpers/common");
|
|
18
18
|
const core_1 = require("@venizia/ignis-helpers/core");
|
|
19
19
|
const ignis_kernel_1 = require("@venizia/ignis-kernel");
|
|
20
|
-
const
|
|
20
|
+
const jose_loader_1 = require("../jose-loader");
|
|
21
21
|
const abstract_service_1 = require("./abstract.service");
|
|
22
22
|
/** Symmetric JWT (JWS) token service with optional AES-encrypted payloads. */
|
|
23
23
|
let JWSTokenService = JWSTokenService_1 = class JWSTokenService extends abstract_service_1.AbstractBearerTokenService {
|
|
@@ -47,14 +47,16 @@ let JWSTokenService = JWSTokenService_1 = class JWSTokenService extends abstract
|
|
|
47
47
|
this.jwtSecret = new TextEncoder().encode(this.options.jwtSecret);
|
|
48
48
|
}
|
|
49
49
|
async doVerify(token) {
|
|
50
|
-
const
|
|
50
|
+
const { jwtVerify } = await jose_loader_1.JoseLoader.load();
|
|
51
|
+
const decodedToken = await jwtVerify(token, this.jwtSecret, this.options.verify);
|
|
51
52
|
return this.decryptPayload({ result: decodedToken });
|
|
52
53
|
}
|
|
53
54
|
async getSigner(opts) {
|
|
55
|
+
const { SignJWT } = await jose_loader_1.JoseLoader.load();
|
|
54
56
|
const now = Math.floor(Date.now() / 1000);
|
|
55
57
|
const expiresIn = await opts.getTokenExpiresFn();
|
|
56
58
|
const encryptedPayload = this.encryptPayload(opts.payload);
|
|
57
|
-
const signer = new
|
|
59
|
+
const signer = new SignJWT(Object.assign({}, encryptedPayload))
|
|
58
60
|
.setProtectedHeader({ alg: this.options.headerAlgorithm ?? 'HS256' })
|
|
59
61
|
.setIssuedAt()
|
|
60
62
|
.setExpirationTime(now + expiresIn)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jws.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqE;AACrE,sDAAuD;AACvD,wDAO+B;AAE/B
|
|
1
|
+
{"version":3,"file":"jws.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqE;AACrE,sDAAuD;AACvD,wDAO+B;AAE/B,gDAA4C;AAC5C,yDAAgE;AAEhE,8EAA8E;AAC9E,IAAa,eAAe,uBAA5B,MAAa,eAAqC,SAAQ,6CAA6B;IAGrF,YAEY,OAAgC;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAF7B,YAAO,GAAP,OAAO,CAAyB;QAI1C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAExF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY;YACZ,iBAAiB;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,SAAS,CAClC,KAAK,EACL,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;aAC5D,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,EAAE,CAAC;aACpE,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;CACF,CAAA;AA5EY,0CAAe;0BAAf,eAAe;IAIvB,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC,CAAA;;GAJ5C,eAAe,CA4E3B"}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
type TJoseModule = typeof import('jose');
|
|
2
|
+
/**
|
|
3
|
+
* Loads `jose` for the auth services, once per process.
|
|
4
|
+
*
|
|
5
|
+
* `jose` is ESM-only and this package is CommonJS. A top-level `require('jose')` runs while the
|
|
6
|
+
* application is still loading, and under Bun it fails with `require() async module ... is
|
|
7
|
+
* unsupported` whenever the application imports `jose` itself. `import()` waits for that load
|
|
8
|
+
* instead of racing it. A string literal, so a bundler still packs `jose` into a compiled binary.
|
|
9
|
+
*/
|
|
10
|
+
export declare class JoseLoader {
|
|
11
|
+
private static importer;
|
|
12
|
+
private static module;
|
|
13
|
+
static load(): Promise<TJoseModule>;
|
|
14
|
+
}
|
|
15
|
+
export {};
|
|
16
|
+
//# sourceMappingURL=jose-loader.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"jose-loader.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/jose-loader.ts"],"names":[],"mappings":"AAAA,KAAK,WAAW,GAAG,cAAc,MAAM,CAAC,CAAC;AAEzC;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAoD;IAC3E,OAAO,CAAC,MAAM,CAAC,MAAM,CAAqC;IAE1D,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC;CAQpC"}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.JoseLoader = void 0;
|
|
4
|
+
/**
|
|
5
|
+
* Loads `jose` for the auth services, once per process.
|
|
6
|
+
*
|
|
7
|
+
* `jose` is ESM-only and this package is CommonJS. A top-level `require('jose')` runs while the
|
|
8
|
+
* application is still loading, and under Bun it fails with `require() async module ... is
|
|
9
|
+
* unsupported` whenever the application imports `jose` itself. `import()` waits for that load
|
|
10
|
+
* instead of racing it. A string literal, so a bundler still packs `jose` into a compiled binary.
|
|
11
|
+
*/
|
|
12
|
+
class JoseLoader {
|
|
13
|
+
static { this.importer = () => import('jose'); }
|
|
14
|
+
static { this.module = null; }
|
|
15
|
+
static load() {
|
|
16
|
+
// A failed load is dropped, so the next call imports again instead of failing for good.
|
|
17
|
+
JoseLoader.module ??= JoseLoader.importer().catch((error) => {
|
|
18
|
+
JoseLoader.module = null;
|
|
19
|
+
throw error;
|
|
20
|
+
});
|
|
21
|
+
return JoseLoader.module;
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
exports.JoseLoader = JoseLoader;
|
|
25
|
+
//# sourceMappingURL=jose-loader.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"jose-loader.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/jose-loader.ts"],"names":[],"mappings":";;;AAEA;;;;;;;GAOG;AACH,MAAa,UAAU;aACN,aAAQ,GAA+B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAC5D,WAAM,GAAgC,IAAI,CAAC;IAE1D,MAAM,CAAC,IAAI;QACT,wFAAwF;QACxF,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnE,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;;AAXH,gCAYC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signer.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"signer.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,KAAK,EAAa,GAAG,EAAE,MAAM,MAAM,CAAC;AAK3C;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAU1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEhC;IAEH,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAkB;gBAIZ,OAAO,EAAE,mBAAmB;IAK/C,SAAS,IAAI,OAAO;IAIpB,wGAAwG;IACxG,QAAQ,IAAI,MAAM;IAKlB;;;;;;OAMG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBrF;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;YA0BjC,iBAAiB;YAWjB,OAAO;IAiBrB,OAAO,CAAC,aAAa;CAUtB"}
|
|
@@ -18,9 +18,9 @@ const metadata_1 = require("../../../../../base/metadata");
|
|
|
18
18
|
const ignis_kernel_1 = require("@venizia/ignis-kernel");
|
|
19
19
|
const core_1 = require("@venizia/ignis-helpers/core");
|
|
20
20
|
const common_1 = require("@venizia/ignis-helpers/common");
|
|
21
|
-
const jose_1 = require("jose");
|
|
22
21
|
const promises_1 = require("node:fs/promises");
|
|
23
22
|
const ignis_kernel_2 = require("@venizia/ignis-kernel");
|
|
23
|
+
const jose_loader_1 = require("../jose-loader");
|
|
24
24
|
/**
|
|
25
25
|
* Mints the outgoing assertion, and publishes the public half for callees to verify against.
|
|
26
26
|
*
|
|
@@ -53,9 +53,10 @@ let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class Serv
|
|
|
53
53
|
async sign(opts) {
|
|
54
54
|
const { method, path, audience } = opts;
|
|
55
55
|
this.assertEnabled();
|
|
56
|
+
const { SignJWT } = await jose_loader_1.JoseLoader.load();
|
|
56
57
|
const now = Math.floor(Date.now() / 1000);
|
|
57
58
|
const lifetime = this.options.signLifetimeSeconds ?? ignis_kernel_1.ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;
|
|
58
|
-
return new
|
|
59
|
+
return new SignJWT({ htm: method.toUpperCase(), htu: path })
|
|
59
60
|
.setProtectedHeader({
|
|
60
61
|
alg: ignis_kernel_1.ServiceAssertion.ALGORITHM,
|
|
61
62
|
kid: this.getKeyId(),
|
|
@@ -82,9 +83,10 @@ let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class Serv
|
|
|
82
83
|
return this.jwks;
|
|
83
84
|
}
|
|
84
85
|
this.assertEnabled();
|
|
86
|
+
const { exportJWK, importSPKI } = await jose_loader_1.JoseLoader.load();
|
|
85
87
|
const raw = await this.readKey({ source: this.options.keys.public });
|
|
86
|
-
const publicKey = await
|
|
87
|
-
const jwk = await
|
|
88
|
+
const publicKey = await importSPKI(raw, ignis_kernel_1.ServiceAssertion.ALGORITHM);
|
|
89
|
+
const jwk = await exportJWK(publicKey);
|
|
88
90
|
if (jwk.d !== undefined) {
|
|
89
91
|
throw (0, core_1.getError)({
|
|
90
92
|
statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
|
|
@@ -100,8 +102,9 @@ let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class Serv
|
|
|
100
102
|
if (this.privateKey) {
|
|
101
103
|
return this.privateKey;
|
|
102
104
|
}
|
|
105
|
+
const { importPKCS8 } = await jose_loader_1.JoseLoader.load();
|
|
103
106
|
const raw = await this.readKey({ source: this.options.keys.private });
|
|
104
|
-
this.privateKey = await
|
|
107
|
+
this.privateKey = await importPKCS8(raw, ignis_kernel_1.ServiceAssertion.ALGORITHM);
|
|
105
108
|
return this.privateKey;
|
|
106
109
|
}
|
|
107
110
|
async readKey(opts) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAA+F;AAE/F,sDAA2E;AAC3E,0DAAqD;
|
|
1
|
+
{"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAA+F;AAE/F,sDAA2E;AAC3E,0DAAqD;AAErD,+CAA4C;AAC5C,wDAAuE;AACvE,gDAA4C;AAE5C;;;;;GAKG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BAA8B,SAAQ,0BAAW;IAQ5D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAqB;QAT9B,uBAAkB,GAAG,IAAI,yBAAkB,CAAC;YAC3D,KAAK,EAAE,+BAA6B,CAAC,IAAI;SAC1C,CAAC,CAAC;IAUH,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,+BAAgB,CAAC,iBAAiB,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAwD;QACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAExC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,+BAAgB,CAAC,6BAA6B,CAAC;QAErF,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aACzD,kBAAkB,CAAC;YAClB,GAAG,EAAE,+BAAgB,CAAC,SAAS;YAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpB,GAAG,EAAE,+BAAgB,CAAC,GAAG;SAC1B,CAAC;aACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC7B,WAAW,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;aACxC,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC;aACjC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,0GAA0G;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,+BAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC;QAE9C,IAAI,MAAM,KAAK,6BAAc,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,eAAe,6BAAc,CAAC,GAAG,oCAAoC,MAAM,EAAE;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,6BAAc,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,iFAAiF;SACjI,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjIY,sEAA6B;wCAA7B,6BAA6B;IASrC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GAThD,6BAA6B,CAiIzC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,WAAW,EAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA2B,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,WAAW,EAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA2B,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAO1F;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,WAAW;IAS5D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;gBAIxC,OAAO,EAAE,mBAAmB;IAK/C;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAahG;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,aAAa;YAyCP,SAAS;IAwDvB,OAAO,CAAC,oBAAoB;CAoB7B"}
|
|
@@ -17,7 +17,7 @@ exports.ServiceAssertionVerifierService = void 0;
|
|
|
17
17
|
const metadata_1 = require("../../../../../base/metadata");
|
|
18
18
|
const ignis_kernel_1 = require("@venizia/ignis-kernel");
|
|
19
19
|
const core_1 = require("@venizia/ignis-helpers/core");
|
|
20
|
-
const
|
|
20
|
+
const jose_loader_1 = require("../jose-loader");
|
|
21
21
|
/**
|
|
22
22
|
* Verifies an incoming service assertion against the CALLER's own JWKS.
|
|
23
23
|
*
|
|
@@ -42,9 +42,10 @@ let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class
|
|
|
42
42
|
*/
|
|
43
43
|
async verify(opts) {
|
|
44
44
|
const { token, method, path } = opts;
|
|
45
|
-
const
|
|
46
|
-
const
|
|
47
|
-
const
|
|
45
|
+
const jose = await jose_loader_1.JoseLoader.load();
|
|
46
|
+
const issuer = this.readIssuer({ token, jose });
|
|
47
|
+
const keySet = this.resolveKeySet({ issuer, jose });
|
|
48
|
+
const payload = await this.runVerify({ token, issuer, keySet, jose });
|
|
48
49
|
this.assertRequestBinding({ payload, method, path });
|
|
49
50
|
return { issuer };
|
|
50
51
|
}
|
|
@@ -56,7 +57,7 @@ let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class
|
|
|
56
57
|
readIssuer(opts) {
|
|
57
58
|
let issuer;
|
|
58
59
|
try {
|
|
59
|
-
({ iss: issuer } =
|
|
60
|
+
({ iss: issuer } = opts.jose.decodeJwt(opts.token));
|
|
60
61
|
}
|
|
61
62
|
catch (error) {
|
|
62
63
|
this.logger.for(this.readIssuer.name).warn('Undecodable assertion | error: %s', error);
|
|
@@ -72,7 +73,7 @@ let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class
|
|
|
72
73
|
return issuer;
|
|
73
74
|
}
|
|
74
75
|
resolveKeySet(opts) {
|
|
75
|
-
const { issuer } = opts;
|
|
76
|
+
const { issuer, jose } = opts;
|
|
76
77
|
const cached = this.keySets.get(issuer);
|
|
77
78
|
if (cached) {
|
|
78
79
|
return cached;
|
|
@@ -93,7 +94,7 @@ let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class
|
|
|
93
94
|
callerOverride: typeof entry === 'string' ? undefined : entry.acceptMaxAgeSeconds,
|
|
94
95
|
serviceDefault: this.options.acceptMaxAgeSeconds,
|
|
95
96
|
}));
|
|
96
|
-
const keySet =
|
|
97
|
+
const keySet = jose.createRemoteJWKSet(new URL(jwksUrl), {
|
|
97
98
|
cacheMaxAge: this.options.jwks?.cacheMaxAgeMs ?? ignis_kernel_1.ServiceAssertion.DEFAULT_JWKS_CACHE_MAX_AGE_MS,
|
|
98
99
|
cooldownDuration: this.options.jwks?.cooldownMs ?? ignis_kernel_1.ServiceAssertion.DEFAULT_JWKS_COOLDOWN_MS,
|
|
99
100
|
});
|
|
@@ -101,7 +102,7 @@ let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class
|
|
|
101
102
|
return keySet;
|
|
102
103
|
}
|
|
103
104
|
async runVerify(opts) {
|
|
104
|
-
const { token, issuer, keySet } = opts;
|
|
105
|
+
const { token, issuer, keySet, jose } = opts;
|
|
105
106
|
// Resolved when the key set was, so a per-caller override is already folded in.
|
|
106
107
|
const maxTokenAge = this.acceptMaxAges.get(issuer) ??
|
|
107
108
|
ignis_kernel_1.ServiceAssertion.resolveAcceptMaxAge({
|
|
@@ -109,7 +110,7 @@ let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class
|
|
|
109
110
|
});
|
|
110
111
|
const clockTolerance = this.options.clockToleranceSeconds ?? ignis_kernel_1.ServiceAssertion.DEFAULT_CLOCK_TOLERANCE_SECONDS;
|
|
111
112
|
try {
|
|
112
|
-
const { payload } = await
|
|
113
|
+
const { payload } = await jose.jwtVerify(token, keySet, {
|
|
113
114
|
algorithms: [ignis_kernel_1.ServiceAssertion.ALGORITHM],
|
|
114
115
|
typ: ignis_kernel_1.ServiceAssertion.TYP,
|
|
115
116
|
issuer,
|