@vercel/oidc 3.5.0 → 3.6.1

package/docs/functions/verifyVercelOidcToken.md

@@ -0,0 +1,57 @@
+[**@vercel/oidc**](../README.md)
+
+---
+
+# Function: verifyVercelOidcToken()
+
+> **verifyVercelOidcToken**\<`PayloadType`\>(`token`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`JWTVerifyResult`\<`PayloadType`\>\>
+
+Defined in: [packages/oidc/src/verify-vercel-oidc-token.ts:53](https://github.com/vercel/vercel/blob/main/packages/oidc/src/verify-vercel-oidc-token.ts#L53)
+
+Verifies a Vercel OIDC token against Vercel's remote JWKS.
+
+The issuer must be `https://oidc.vercel.com` or start with
+`https://oidc.vercel.com/`. The JWKS is always
+`https://oidc.vercel.com/.well-known/jwks`.
+
+Options:
+
+- `issuer`: Expected `iss` claim verified by Jose. The verified issuer must
+  still be `https://oidc.vercel.com` or start with
+  `https://oidc.vercel.com/`.
+- `projectId`: Expected `project_id` claim or claims. Defaults to
+  `process.env.VERCEL_PROJECT_ID`. Pass an array to allow any matching
+  project ID. Pass `'*'` to allow any project ID. When `projectId` is `'*'`,
+  either `ownerId` or `audience` is required.
+- `environment`: Expected `environment` claim or claims. Defaults to
+  `process.env.VERCEL_TARGET_ENV || process.env.VERCEL_ENV`. Pass an array
+  to allow any matching environment. Pass `'*'` to allow any environment.
+- `ownerId`: Expected `owner_id` claim. When omitted, the claim is not
+  checked.
+- Any other Jose JWT verification option.
+
+## Type Parameters
+
+### PayloadType
+
+`PayloadType` = [`VercelOidcPayload`](../type-aliases/VercelOidcPayload.md)
+
+## Parameters
+
+### token
+
+`string`
+
+The Vercel OIDC token to verify.
+
+### options?
+
+`object` & `JWTVerifyOptions`
+
+Optional Jose JWT verification options.
+
+## Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`JWTVerifyResult`\<`PayloadType`\>\>
+
+Jose's verified JWT result.

package/docs/type-aliases/VercelOidcPayload.md

@@ -0,0 +1,39 @@
+[**@vercel/oidc**](../README.md)
+
+---
+
+# Type Alias: VercelOidcPayload
+
+> **VercelOidcPayload** = `JWTPayload` & `object`
+
+Defined in: [packages/oidc/src/verify-vercel-oidc-token.ts:16](https://github.com/vercel/vercel/blob/main/packages/oidc/src/verify-vercel-oidc-token.ts#L16)
+
+## Type Declaration
+
+### aud
+
+> **aud**: `string`
+
+### environment
+
+> **environment**: `string`
+
+### external_sub?
+
+> `optional` **external_sub?**: `string`
+
+### iss
+
+> **iss**: `string`
+
+### owner_id
+
+> **owner_id**: `string`
+
+### project_id
+
+> **project_id**: `string`
+
+### sub
+
+> **sub**: `string`

package/package.json

@@ -18,7 +18,7 @@
       "require": "./dist/index.js"
     }
   },
-  "version": "3.5.0",
+  "version": "3.6.1",
   "repository": {
     "directory": "packages/oidc",
     "type": "git",
@@ -27,6 +27,11 @@
   "bugs": {
     "url": "https://github.com/vercel/vercel/issues"
   },
+  "dependencies": {
+    "jose": "^5.9.6",
+    "@vercel/cli-config": "0.2.0",
+    "@vercel/cli-exec": "0.1.1"
+  },
   "devDependencies": {
     "prettier": "3.8.3",
     "tinyspawn": "1.3.1",

package/dist/auth-config.d.ts

@@ -1,30 +0,0 @@
-/**
- * Auth configuration stored in ~/.../com.vercel.cli/auth.json
- */
-export interface AuthConfig {
-    /** An `access_token` obtained using the OAuth Device Authorization flow. */
-    token?: string;
-    /** A `refresh_token` obtained using the OAuth Device Authorization flow. */
-    refreshToken?: string;
-    /**
-     * The absolute time (seconds) when the token expires.
-     * Used to optimistically check if the token is still valid.
-     */
-    expiresAt?: number;
-    /** Whether to skip writing this config to disk. */
-    skipWrite?: boolean;
-}
-/**
- * Read the auth config from disk
- * Returns null if the file doesn't exist or cannot be read
- */
-export declare function readAuthConfig(): AuthConfig | null;
-/**
- * Write the auth config to disk with proper permissions
- */
-export declare function writeAuthConfig(config: AuthConfig): void;
-/**
- * Check if an access token is valid (not expired)
- * Copied from packages/cli/src/util/client.ts:72-81
- */
-export declare function isValidAccessToken(authConfig: AuthConfig, expirationBufferMs?: number): boolean;

package/dist/auth-config.js

@@ -1,85 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var auth_config_exports = {};
-__export(auth_config_exports, {
-  isValidAccessToken: () => isValidAccessToken,
-  readAuthConfig: () => readAuthConfig,
-  writeAuthConfig: () => writeAuthConfig
-});
-module.exports = __toCommonJS(auth_config_exports);
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
-var import_token_util = require("./token-util");
-function getAuthConfigPath() {
-  const dataDir = (0, import_token_util.getVercelDataDir)();
-  if (!dataDir) {
-    throw new Error(
-      `Unable to find Vercel CLI data directory. Your platform: ${process.platform}. Supported: darwin, linux, win32.`
-    );
-  }
-  return path.join(dataDir, "auth.json");
-}
-function readAuthConfig() {
-  try {
-    const authPath = getAuthConfigPath();
-    if (!fs.existsSync(authPath)) {
-      return null;
-    }
-    const content = fs.readFileSync(authPath, "utf8");
-    if (!content) {
-      return null;
-    }
-    return JSON.parse(content);
-  } catch (_error) {
-    return null;
-  }
-}
-function writeAuthConfig(config) {
-  const authPath = getAuthConfigPath();
-  const authDir = path.dirname(authPath);
-  if (!fs.existsSync(authDir)) {
-    fs.mkdirSync(authDir, { mode: 504, recursive: true });
-  }
-  fs.writeFileSync(authPath, JSON.stringify(config, null, 2), { mode: 384 });
-}
-function isValidAccessToken(authConfig, expirationBufferMs = 0) {
-  if (!authConfig.token)
-    return false;
-  if (typeof authConfig.expiresAt !== "number")
-    return true;
-  const nowInSeconds = Math.floor(Date.now() / 1e3);
-  const bufferInSeconds = expirationBufferMs / 1e3;
-  return authConfig.expiresAt >= nowInSeconds + bufferInSeconds;
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  isValidAccessToken,
-  readAuthConfig,
-  writeAuthConfig
-});