@webiny/api-core 0.0.0-unstable.6844005670 → 0.0.0-unstable.7be00a75a9

package/idp/JwtAuthenticator.js

@@ -1,58 +1,46 @@
-import jwt from "jsonwebtoken";
+import jsonwebtoken from "jsonwebtoken";
 import { Authenticator } from "../features/security/authentication/Authenticator/abstractions.js";
 import { JwtIdentityProvider } from "./abstractions.js";
 import { isJwt } from "../features/security/utils/isJwt.js";
 class JwtAuthenticatorImpl {
-  constructor(providers) {
-    this.providers = providers;
-  }
-  async authenticate(token) {
-    if (!isJwt(token)) {
-      return null;
+    constructor(providers){
+        this.providers = providers;
     }
-
-    // Decode JWT to get payload
-    const decoded = jwt.decode(token, {
-      complete: true
-    });
-    if (!decoded || typeof decoded === "string") {
-      return null;
-    }
-    if (typeof decoded.payload === "string") {
-      return null;
-    }
-
-    // TODO: validate expiration claim and exit early if expired
-
-    for (const provider of this.providers) {
-      // Check if provider is applicable
-      if (provider.isApplicable(decoded.payload)) {
-        // Use provider to get identity
-        const identity = await provider.getIdentity(token, decoded);
-        if (identity) {
-          // We treat all IDP identities as external by default.
-          const isExternal = identity.profile?.external ?? true;
-          return {
-            ...identity,
-            type: identity.type ?? "admin",
-            profile: {
-              ...(identity.profile ?? {}),
-              external: isExternal
+    async authenticate(token) {
+        if (!isJwt(token)) return null;
+        const decoded = jsonwebtoken.decode(token, {
+            complete: true
+        });
+        if (!decoded || "string" == typeof decoded) return null;
+        if ("string" == typeof decoded.payload) return null;
+        for (const provider of this.providers)if (provider.isApplicable(decoded.payload)) {
+            const identity = await provider.getIdentity(token, decoded);
+            if (identity) {
+                const isExternal = identity.profile?.external ?? true;
+                return {
+                    ...identity,
+                    type: identity.type ?? "admin",
+                    profile: {
+                        ...identity.profile ?? {},
+                        external: isExternal
+                    }
+                };
             }
-          };
         }
-      }
+        return null;
     }
-
-    // No applicable provider found
-    return null;
-  }
 }
-export const JwtAuthenticator = Authenticator.createImplementation({
-  implementation: JwtAuthenticatorImpl,
-  dependencies: [[JwtIdentityProvider, {
-    multiple: true
-  }]]
+const JwtAuthenticator = Authenticator.createImplementation({
+    implementation: JwtAuthenticatorImpl,
+    dependencies: [
+        [
+            JwtIdentityProvider,
+            {
+                multiple: true
+            }
+        ]
+    ]
 });
+export { JwtAuthenticator };
 
 //# sourceMappingURL=JwtAuthenticator.js.map

package/idp/JwtAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"names":["jwt","Authenticator","JwtIdentityProvider","isJwt","JwtAuthenticatorImpl","constructor","providers","authenticate","token","decoded","decode","complete","payload","provider","isApplicable","identity","getIdentity","isExternal","profile","external","type","JwtAuthenticator","createImplementation","implementation","dependencies","multiple"],"sources":["JwtAuthenticator.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { Authenticator } from \"~/features/security/authentication/Authenticator/abstractions.js\";\nimport { IdentityProvider, JwtIdentityProvider } from \"./abstractions.js\";\nimport { isJwt } from \"~/features/security/utils/isJwt.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\n\nclass JwtAuthenticatorImpl implements Authenticator.Interface {\n    constructor(private providers: JwtIdentityProvider.Interface[]) {}\n\n    async authenticate(token: string): Promise<IdentityData | null> {\n        if (!isJwt(token)) {\n            return null;\n        }\n\n        // Decode JWT to get payload\n        const decoded = jwt.decode(token, { complete: true });\n        if (!decoded || typeof decoded === \"string\") {\n            return null;\n        }\n\n        if (typeof decoded.payload === \"string\") {\n            return null;\n        }\n\n        // TODO: validate expiration claim and exit early if expired\n\n        for (const provider of this.providers) {\n            // Check if provider is applicable\n            if (provider.isApplicable(decoded.payload as IdentityProvider.JwtPayload)) {\n                // Use provider to get identity\n                const identity = await provider.getIdentity(\n                    token,\n                    decoded as JwtIdentityProvider.Jwt\n                );\n\n                if (identity) {\n                    // We treat all IDP identities as external by default.\n                    const isExternal = identity.profile?.external ?? true;\n                    return {\n                        ...identity,\n                        type: identity.type ?? \"admin\",\n                        profile: {\n                            ...(identity.profile ?? {}),\n                            external: isExternal\n                        }\n                    };\n                }\n            }\n        }\n\n        // No applicable provider found\n        return null;\n    }\n}\n\nexport const JwtAuthenticator = Authenticator.createImplementation({\n    implementation: JwtAuthenticatorImpl,\n    dependencies: [[JwtIdentityProvider, { multiple: true }]]\n});\n"],"mappings":"AAAA,OAAOA,GAAG,MAAM,cAAc;AAC9B,SAASC,aAAa;AACtB,SAA2BC,mBAAmB;AAC9C,SAASC,KAAK;AAGd,MAAMC,oBAAoB,CAAoC;EAC1DC,WAAWA,CAASC,SAA0C,EAAE;IAAA,KAA5CA,SAA0C,GAA1CA,SAA0C;EAAG;EAEjE,MAAMC,YAAYA,CAACC,KAAa,EAAgC;IAC5D,IAAI,CAACL,KAAK,CAACK,KAAK,CAAC,EAAE;MACf,OAAO,IAAI;IACf;;IAEA;IACA,MAAMC,OAAO,GAAGT,GAAG,CAACU,MAAM,CAACF,KAAK,EAAE;MAAEG,QAAQ,EAAE;IAAK,CAAC,CAAC;IACrD,IAAI,CAACF,OAAO,IAAI,OAAOA,OAAO,KAAK,QAAQ,EAAE;MACzC,OAAO,IAAI;IACf;IAEA,IAAI,OAAOA,OAAO,CAACG,OAAO,KAAK,QAAQ,EAAE;MACrC,OAAO,IAAI;IACf;;IAEA;;IAEA,KAAK,MAAMC,QAAQ,IAAI,IAAI,CAACP,SAAS,EAAE;MACnC;MACA,IAAIO,QAAQ,CAACC,YAAY,CAACL,OAAO,CAACG,OAAsC,CAAC,EAAE;QACvE;QACA,MAAMG,QAAQ,GAAG,MAAMF,QAAQ,CAACG,WAAW,CACvCR,KAAK,EACLC,OACJ,CAAC;QAED,IAAIM,QAAQ,EAAE;UACV;UACA,MAAME,UAAU,GAAGF,QAAQ,CAACG,OAAO,EAAEC,QAAQ,IAAI,IAAI;UACrD,OAAO;YACH,GAAGJ,QAAQ;YACXK,IAAI,EAAEL,QAAQ,CAACK,IAAI,IAAI,OAAO;YAC9BF,OAAO,EAAE;cACL,IAAIH,QAAQ,CAACG,OAAO,IAAI,CAAC,CAAC,CAAC;cAC3BC,QAAQ,EAAEF;YACd;UACJ,CAAC;QACL;MACJ;IACJ;;IAEA;IACA,OAAO,IAAI;EACf;AACJ;AAEA,OAAO,MAAMI,gBAAgB,GAAGpB,aAAa,CAACqB,oBAAoB,CAAC;EAC/DC,cAAc,EAAEnB,oBAAoB;EACpCoB,YAAY,EAAE,CAAC,CAACtB,mBAAmB,EAAE;IAAEuB,QAAQ,EAAE;EAAK,CAAC,CAAC;AAC5D,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"idp/JwtAuthenticator.js","sources":["../../src/idp/JwtAuthenticator.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { Authenticator } from \"~/features/security/authentication/Authenticator/abstractions.js\";\nimport { IdentityProvider, JwtIdentityProvider } from \"./abstractions.js\";\nimport { isJwt } from \"~/features/security/utils/isJwt.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\n\nclass JwtAuthenticatorImpl implements Authenticator.Interface {\n    constructor(private providers: JwtIdentityProvider.Interface[]) {}\n\n    async authenticate(token: string): Promise<IdentityData | null> {\n        if (!isJwt(token)) {\n            return null;\n        }\n\n        // Decode JWT to get payload\n        const decoded = jwt.decode(token, { complete: true });\n        if (!decoded || typeof decoded === \"string\") {\n            return null;\n        }\n\n        if (typeof decoded.payload === \"string\") {\n            return null;\n        }\n\n        // TODO: validate expiration claim and exit early if expired\n\n        for (const provider of this.providers) {\n            // Check if provider is applicable\n            if (provider.isApplicable(decoded.payload as IdentityProvider.JwtPayload)) {\n                // Use provider to get identity\n                const identity = await provider.getIdentity(\n                    token,\n                    decoded as JwtIdentityProvider.Jwt\n                );\n\n                if (identity) {\n                    // We treat all IDP identities as external by default.\n                    const isExternal = identity.profile?.external ?? true;\n                    return {\n                        ...identity,\n                        type: identity.type ?? \"admin\",\n                        profile: {\n                            ...(identity.profile ?? {}),\n                            external: isExternal\n                        }\n                    };\n                }\n            }\n        }\n\n        // No applicable provider found\n        return null;\n    }\n}\n\nexport const JwtAuthenticator = Authenticator.createImplementation({\n    implementation: JwtAuthenticatorImpl,\n    dependencies: [[JwtIdentityProvider, { multiple: true }]]\n});\n"],"names":["JwtAuthenticatorImpl","providers","token","isJwt","decoded","jwt","provider","identity","isExternal","JwtAuthenticator","Authenticator","JwtIdentityProvider"],"mappings":";;;;AAMA,MAAMA;IACF,YAAoBC,SAA0C,CAAE;aAA5CA,SAAS,GAATA;IAA6C;IAEjE,MAAM,aAAaC,KAAa,EAAgC;QAC5D,IAAI,CAACC,MAAMD,QACP,OAAO;QAIX,MAAME,UAAUC,aAAAA,MAAU,CAACH,OAAO;YAAE,UAAU;QAAK;QACnD,IAAI,CAACE,WAAW,AAAmB,YAAnB,OAAOA,SACnB,OAAO;QAGX,IAAI,AAA2B,YAA3B,OAAOA,QAAQ,OAAO,EACtB,OAAO;QAKX,KAAK,MAAME,YAAY,IAAI,CAAC,SAAS,CAEjC,IAAIA,SAAS,YAAY,CAACF,QAAQ,OAAO,GAAkC;YAEvE,MAAMG,WAAW,MAAMD,SAAS,WAAW,CACvCJ,OACAE;YAGJ,IAAIG,UAAU;gBAEV,MAAMC,aAAaD,SAAS,OAAO,EAAE,YAAY;gBACjD,OAAO;oBACH,GAAGA,QAAQ;oBACX,MAAMA,SAAS,IAAI,IAAI;oBACvB,SAAS;wBACL,GAAIA,SAAS,OAAO,IAAI,CAAC,CAAC;wBAC1B,UAAUC;oBACd;gBACJ;YACJ;QACJ;QAIJ,OAAO;IACX;AACJ;AAEO,MAAMC,mBAAmBC,cAAc,oBAAoB,CAAC;IAC/D,gBAAgBV;IAChB,cAAc;QAAC;YAACW;YAAqB;gBAAE,UAAU;YAAK;SAAE;KAAC;AAC7D"}

package/idp/OidcJwtIdentityProvider.js

@@ -1,90 +1,63 @@
 import { verifyJwtUsingJwk } from "../features/security/utils/verifyJwtUsingJwk.js";
 import { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from "./abstractions.js";
 class OidcJwtIdentityProviderImpl {
-  constructor(oidcIdentityProviders, jwksCache) {
-    this.oidcIdentityProviders = oidcIdentityProviders;
-    this.jwksCache = jwksCache;
-  }
-  isApplicable(token) {
-    return this.oidcIdentityProviders.some(provider => provider.isApplicable(token));
-  }
-  async getIdentity(token, jwt) {
-    const {
-      header,
-      payload
-    } = jwt;
-    const provider = this.getApplicableProvider(payload);
-    if (!provider) {
-      return null;
+    constructor(oidcIdentityProviders, jwksCache){
+        this.oidcIdentityProviders = oidcIdentityProviders;
+        this.jwksCache = jwksCache;
+    }
+    isApplicable(token) {
+        return this.oidcIdentityProviders.some((provider)=>provider.isApplicable(token));
+    }
+    async getIdentity(token, jwt) {
+        const { header, payload } = jwt;
+        const provider = this.getApplicableProvider(payload);
+        if (!provider) return null;
+        const verifiedPayload = await this.verifyToken(provider, token, header);
+        if (!verifiedPayload) return null;
+        const providerIdentity = await provider.getIdentity(verifiedPayload);
+        const identity = {
+            ...providerIdentity,
+            type: providerIdentity.type ?? "admin"
+        };
+        const context = identity.context ?? {
+            canAccessTenant: true,
+            defaultTenantId: "root"
+        };
+        if (void 0 === context.canAccessTenant) context.canAccessTenant = true;
+        if (void 0 === context.defaultTenantId) context.defaultTenantId = "root";
+        identity.context = context;
+        return identity;
+    }
+    getApplicableProvider(payload) {
+        return this.oidcIdentityProviders.find((provider)=>provider.isApplicable(payload));
+    }
+    async verifyToken(provider, token, header) {
+        let verifiedPayload;
+        if ("function" == typeof provider.verifyToken) {
+            const result = await provider.verifyToken(token);
+            if (result) return result;
+            return null;
+        }
+        const jwks = await this.jwksCache.getKeys(provider.issuer);
+        const jwk = jwks.find((key)=>key.kid === header.kid);
+        if (!jwk) return null;
+        if (!verifiedPayload) verifiedPayload = await verifyJwtUsingJwk(token, jwk);
+        if (provider.verifyTokenClaims) await provider.verifyTokenClaims(verifiedPayload);
+        return verifiedPayload;
     }
-    const verifiedPayload = await this.verifyToken(provider, token, header);
-    if (!verifiedPayload) {
-      return null;
-    }
-
-    // Call config.getIdentity to get IdentityData
-    const providerIdentity = await provider.getIdentity(verifiedPayload);
-    const identity = {
-      ...providerIdentity,
-      type: providerIdentity.type ?? "admin"
-    };
-
-    // Handle default values
-    const context = identity.context ?? {
-      canAccessTenant: true,
-      defaultTenantId: "root"
-    };
-    if (context.canAccessTenant === undefined) {
-      context.canAccessTenant = true;
-    }
-    if (context.defaultTenantId === undefined) {
-      context.defaultTenantId = "root";
-    }
-    identity.context = context;
-    return identity;
-  }
-  getApplicableProvider(payload) {
-    return this.oidcIdentityProviders.find(provider => provider.isApplicable(payload));
-  }
-  async verifyToken(provider, token, header) {
-    // If the implementation specifies a custom verification function, use it.
-    let verifiedPayload;
-    if (typeof provider.verifyToken === "function") {
-      // Use custom verification
-      const result = await provider.verifyToken(token);
-      if (result) {
-        return result;
-      }
-      return null;
-    }
-
-    // Otherwise, continue with OIDC best practices, using JWKs.
-
-    // Fetch JWKs from cache
-    const jwks = await this.jwksCache.getKeys(provider.issuer);
-
-    // Find matching JWK using header.kid
-    const jwk = jwks.find(key => key.kid === header.kid);
-    if (!jwk) {
-      return null;
-    }
-    if (!verifiedPayload) {
-      // Default JWK verification
-      verifiedPayload = await verifyJwtUsingJwk(token, jwk);
-    }
-
-    // Call verifyTokenClaims if provided
-    if (provider.verifyTokenClaims) {
-      await provider.verifyTokenClaims(verifiedPayload);
-    }
-    return verifiedPayload;
-  }
 }
-export const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({
-  implementation: OidcJwtIdentityProviderImpl,
-  dependencies: [[OidcIdentityProvider, {
-    multiple: true
-  }], JwkCache]
+const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({
+    implementation: OidcJwtIdentityProviderImpl,
+    dependencies: [
+        [
+            OidcIdentityProvider,
+            {
+                multiple: true
+            }
+        ],
+        JwkCache
+    ]
 });
+export { OidcJwtIdentityProvider };
 
 //# sourceMappingURL=OidcJwtIdentityProvider.js.map

package/idp/OidcJwtIdentityProvider.js.map

@@ -1 +1 @@
-{"version":3,"names":["verifyJwtUsingJwk","JwkCache","JwtIdentityProvider","OidcIdentityProvider","OidcJwtIdentityProviderImpl","constructor","oidcIdentityProviders","jwksCache","isApplicable","token","some","provider","getIdentity","jwt","header","payload","getApplicableProvider","verifiedPayload","verifyToken","providerIdentity","identity","type","context","canAccessTenant","defaultTenantId","undefined","find","result","jwks","getKeys","issuer","jwk","key","kid","verifyTokenClaims","OidcJwtIdentityProvider","createImplementation","implementation","dependencies","multiple"],"sources":["OidcJwtIdentityProvider.ts"],"sourcesContent":["import { verifyJwtUsingJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from \"./abstractions.js\";\n\nclass OidcJwtIdentityProviderImpl implements JwtIdentityProvider.Interface {\n    constructor(\n        private oidcIdentityProviders: OidcIdentityProvider.Interface[],\n        private jwksCache: JwkCache.Interface\n    ) {}\n\n    isApplicable(token: JwtIdentityProvider.JwtPayload): boolean {\n        return this.oidcIdentityProviders.some(provider => provider.isApplicable(token));\n    }\n\n    async getIdentity(token: string, jwt: JwtIdentityProvider.Jwt): Promise<IdentityData | null> {\n        const { header, payload } = jwt;\n\n        const provider = this.getApplicableProvider(payload);\n\n        if (!provider) {\n            return null;\n        }\n\n        const verifiedPayload = await this.verifyToken(provider, token, header);\n\n        if (!verifiedPayload) {\n            return null;\n        }\n\n        // Call config.getIdentity to get IdentityData\n        const providerIdentity = await provider.getIdentity(verifiedPayload);\n\n        const identity: IdentityData = {\n            ...providerIdentity,\n            type: providerIdentity.type ?? \"admin\"\n        };\n\n        // Handle default values\n        const context = identity.context ?? { canAccessTenant: true, defaultTenantId: \"root\" };\n        if (context.canAccessTenant === undefined) {\n            context.canAccessTenant = true;\n        }\n        if (context.defaultTenantId === undefined) {\n            context.defaultTenantId = \"root\";\n        }\n\n        identity.context = context;\n\n        return identity;\n    }\n\n    private getApplicableProvider(\n        payload: JwtIdentityProvider.JwtPayload\n    ): OidcIdentityProvider.Interface | undefined {\n        return this.oidcIdentityProviders.find(provider => provider.isApplicable(payload));\n    }\n\n    private async verifyToken(\n        provider: OidcIdentityProvider.Interface,\n        token: string,\n        header: JwtIdentityProvider.JwtHeader\n    ) {\n        // If the implementation specifies a custom verification function, use it.\n        let verifiedPayload: JwtIdentityProvider.JwtPayload | undefined;\n        if (typeof provider.verifyToken === \"function\") {\n            // Use custom verification\n            const result = await provider.verifyToken(token);\n            if (result) {\n                return result;\n            }\n            return null;\n        }\n\n        // Otherwise, continue with OIDC best practices, using JWKs.\n\n        // Fetch JWKs from cache\n        const jwks = await this.jwksCache.getKeys(provider.issuer);\n\n        // Find matching JWK using header.kid\n        const jwk = jwks.find(key => key.kid === header.kid);\n        if (!jwk) {\n            return null;\n        }\n\n        if (!verifiedPayload) {\n            // Default JWK verification\n            verifiedPayload = await verifyJwtUsingJwk(token, jwk);\n        }\n\n        // Call verifyTokenClaims if provided\n        if (provider.verifyTokenClaims) {\n            await provider.verifyTokenClaims(verifiedPayload);\n        }\n\n        return verifiedPayload;\n    }\n}\n\nexport const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({\n    implementation: OidcJwtIdentityProviderImpl,\n    dependencies: [[OidcIdentityProvider, { multiple: true }], JwkCache]\n});\n"],"mappings":"AAAA,SAASA,iBAAiB;AAE1B,SAASC,QAAQ,EAAEC,mBAAmB,EAAEC,oBAAoB;AAE5D,MAAMC,2BAA2B,CAA0C;EACvEC,WAAWA,CACCC,qBAAuD,EACvDC,SAA6B,EACvC;IAAA,KAFUD,qBAAuD,GAAvDA,qBAAuD;IAAA,KACvDC,SAA6B,GAA7BA,SAA6B;EACtC;EAEHC,YAAYA,CAACC,KAAqC,EAAW;IACzD,OAAO,IAAI,CAACH,qBAAqB,CAACI,IAAI,CAACC,QAAQ,IAAIA,QAAQ,CAACH,YAAY,CAACC,KAAK,CAAC,CAAC;EACpF;EAEA,MAAMG,WAAWA,CAACH,KAAa,EAAEI,GAA4B,EAAgC;IACzF,MAAM;MAAEC,MAAM;MAAEC;IAAQ,CAAC,GAAGF,GAAG;IAE/B,MAAMF,QAAQ,GAAG,IAAI,CAACK,qBAAqB,CAACD,OAAO,CAAC;IAEpD,IAAI,CAACJ,QAAQ,EAAE;MACX,OAAO,IAAI;IACf;IAEA,MAAMM,eAAe,GAAG,MAAM,IAAI,CAACC,WAAW,CAACP,QAAQ,EAAEF,KAAK,EAAEK,MAAM,CAAC;IAEvE,IAAI,CAACG,eAAe,EAAE;MAClB,OAAO,IAAI;IACf;;IAEA;IACA,MAAME,gBAAgB,GAAG,MAAMR,QAAQ,CAACC,WAAW,CAACK,eAAe,CAAC;IAEpE,MAAMG,QAAsB,GAAG;MAC3B,GAAGD,gBAAgB;MACnBE,IAAI,EAAEF,gBAAgB,CAACE,IAAI,IAAI;IACnC,CAAC;;IAED;IACA,MAAMC,OAAO,GAAGF,QAAQ,CAACE,OAAO,IAAI;MAAEC,eAAe,EAAE,IAAI;MAAEC,eAAe,EAAE;IAAO,CAAC;IACtF,IAAIF,OAAO,CAACC,eAAe,KAAKE,SAAS,EAAE;MACvCH,OAAO,CAACC,eAAe,GAAG,IAAI;IAClC;IACA,IAAID,OAAO,CAACE,eAAe,KAAKC,SAAS,EAAE;MACvCH,OAAO,CAACE,eAAe,GAAG,MAAM;IACpC;IAEAJ,QAAQ,CAACE,OAAO,GAAGA,OAAO;IAE1B,OAAOF,QAAQ;EACnB;EAEQJ,qBAAqBA,CACzBD,OAAuC,EACG;IAC1C,OAAO,IAAI,CAACT,qBAAqB,CAACoB,IAAI,CAACf,QAAQ,IAAIA,QAAQ,CAACH,YAAY,CAACO,OAAO,CAAC,CAAC;EACtF;EAEA,MAAcG,WAAWA,CACrBP,QAAwC,EACxCF,KAAa,EACbK,MAAqC,EACvC;IACE;IACA,IAAIG,eAA2D;IAC/D,IAAI,OAAON,QAAQ,CAACO,WAAW,KAAK,UAAU,EAAE;MAC5C;MACA,MAAMS,MAAM,GAAG,MAAMhB,QAAQ,CAACO,WAAW,CAACT,KAAK,CAAC;MAChD,IAAIkB,MAAM,EAAE;QACR,OAAOA,MAAM;MACjB;MACA,OAAO,IAAI;IACf;;IAEA;;IAEA;IACA,MAAMC,IAAI,GAAG,MAAM,IAAI,CAACrB,SAAS,CAACsB,OAAO,CAAClB,QAAQ,CAACmB,MAAM,CAAC;;IAE1D;IACA,MAAMC,GAAG,GAAGH,IAAI,CAACF,IAAI,CAACM,GAAG,IAAIA,GAAG,CAACC,GAAG,KAAKnB,MAAM,CAACmB,GAAG,CAAC;IACpD,IAAI,CAACF,GAAG,EAAE;MACN,OAAO,IAAI;IACf;IAEA,IAAI,CAACd,eAAe,EAAE;MAClB;MACAA,eAAe,GAAG,MAAMjB,iBAAiB,CAACS,KAAK,EAAEsB,GAAG,CAAC;IACzD;;IAEA;IACA,IAAIpB,QAAQ,CAACuB,iBAAiB,EAAE;MAC5B,MAAMvB,QAAQ,CAACuB,iBAAiB,CAACjB,eAAe,CAAC;IACrD;IAEA,OAAOA,eAAe;EAC1B;AACJ;AAEA,OAAO,MAAMkB,uBAAuB,GAAGjC,mBAAmB,CAACkC,oBAAoB,CAAC;EAC5EC,cAAc,EAAEjC,2BAA2B;EAC3CkC,YAAY,EAAE,CAAC,CAACnC,oBAAoB,EAAE;IAAEoC,QAAQ,EAAE;EAAK,CAAC,CAAC,EAAEtC,QAAQ;AACvE,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"idp/OidcJwtIdentityProvider.js","sources":["../../src/idp/OidcJwtIdentityProvider.ts"],"sourcesContent":["import { verifyJwtUsingJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from \"./abstractions.js\";\n\nclass OidcJwtIdentityProviderImpl implements JwtIdentityProvider.Interface {\n    constructor(\n        private oidcIdentityProviders: OidcIdentityProvider.Interface[],\n        private jwksCache: JwkCache.Interface\n    ) {}\n\n    isApplicable(token: JwtIdentityProvider.JwtPayload): boolean {\n        return this.oidcIdentityProviders.some(provider => provider.isApplicable(token));\n    }\n\n    async getIdentity(token: string, jwt: JwtIdentityProvider.Jwt): Promise<IdentityData | null> {\n        const { header, payload } = jwt;\n\n        const provider = this.getApplicableProvider(payload);\n\n        if (!provider) {\n            return null;\n        }\n\n        const verifiedPayload = await this.verifyToken(provider, token, header);\n\n        if (!verifiedPayload) {\n            return null;\n        }\n\n        // Call config.getIdentity to get IdentityData\n        const providerIdentity = await provider.getIdentity(verifiedPayload);\n\n        const identity: IdentityData = {\n            ...providerIdentity,\n            type: providerIdentity.type ?? \"admin\"\n        };\n\n        // Handle default values\n        const context = identity.context ?? { canAccessTenant: true, defaultTenantId: \"root\" };\n        if (context.canAccessTenant === undefined) {\n            context.canAccessTenant = true;\n        }\n        if (context.defaultTenantId === undefined) {\n            context.defaultTenantId = \"root\";\n        }\n\n        identity.context = context;\n\n        return identity;\n    }\n\n    private getApplicableProvider(\n        payload: JwtIdentityProvider.JwtPayload\n    ): OidcIdentityProvider.Interface | undefined {\n        return this.oidcIdentityProviders.find(provider => provider.isApplicable(payload));\n    }\n\n    private async verifyToken(\n        provider: OidcIdentityProvider.Interface,\n        token: string,\n        header: JwtIdentityProvider.JwtHeader\n    ) {\n        // If the implementation specifies a custom verification function, use it.\n        let verifiedPayload: JwtIdentityProvider.JwtPayload | undefined;\n        if (typeof provider.verifyToken === \"function\") {\n            // Use custom verification\n            const result = await provider.verifyToken(token);\n            if (result) {\n                return result;\n            }\n            return null;\n        }\n\n        // Otherwise, continue with OIDC best practices, using JWKs.\n\n        // Fetch JWKs from cache\n        const jwks = await this.jwksCache.getKeys(provider.issuer);\n\n        // Find matching JWK using header.kid\n        const jwk = jwks.find(key => key.kid === header.kid);\n        if (!jwk) {\n            return null;\n        }\n\n        if (!verifiedPayload) {\n            // Default JWK verification\n            verifiedPayload = await verifyJwtUsingJwk(token, jwk);\n        }\n\n        // Call verifyTokenClaims if provided\n        if (provider.verifyTokenClaims) {\n            await provider.verifyTokenClaims(verifiedPayload);\n        }\n\n        return verifiedPayload;\n    }\n}\n\nexport const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({\n    implementation: OidcJwtIdentityProviderImpl,\n    dependencies: [[OidcIdentityProvider, { multiple: true }], JwkCache]\n});\n"],"names":["OidcJwtIdentityProviderImpl","oidcIdentityProviders","jwksCache","token","provider","jwt","header","payload","verifiedPayload","providerIdentity","identity","context","undefined","result","jwks","jwk","key","verifyJwtUsingJwk","OidcJwtIdentityProvider","JwtIdentityProvider","OidcIdentityProvider","JwkCache"],"mappings":";;AAIA,MAAMA;IACF,YACYC,qBAAuD,EACvDC,SAA6B,CACvC;aAFUD,qBAAqB,GAArBA;aACAC,SAAS,GAATA;IACT;IAEH,aAAaC,KAAqC,EAAW;QACzD,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAACC,CAAAA,WAAYA,SAAS,YAAY,CAACD;IAC7E;IAEA,MAAM,YAAYA,KAAa,EAAEE,GAA4B,EAAgC;QACzF,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGF;QAE5B,MAAMD,WAAW,IAAI,CAAC,qBAAqB,CAACG;QAE5C,IAAI,CAACH,UACD,OAAO;QAGX,MAAMI,kBAAkB,MAAM,IAAI,CAAC,WAAW,CAACJ,UAAUD,OAAOG;QAEhE,IAAI,CAACE,iBACD,OAAO;QAIX,MAAMC,mBAAmB,MAAML,SAAS,WAAW,CAACI;QAEpD,MAAME,WAAyB;YAC3B,GAAGD,gBAAgB;YACnB,MAAMA,iBAAiB,IAAI,IAAI;QACnC;QAGA,MAAME,UAAUD,SAAS,OAAO,IAAI;YAAE,iBAAiB;YAAM,iBAAiB;QAAO;QACrF,IAAIC,AAA4BC,WAA5BD,QAAQ,eAAe,EACvBA,QAAQ,eAAe,GAAG;QAE9B,IAAIA,AAA4BC,WAA5BD,QAAQ,eAAe,EACvBA,QAAQ,eAAe,GAAG;QAG9BD,SAAS,OAAO,GAAGC;QAEnB,OAAOD;IACX;IAEQ,sBACJH,OAAuC,EACG;QAC1C,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAACH,CAAAA,WAAYA,SAAS,YAAY,CAACG;IAC7E;IAEA,MAAc,YACVH,QAAwC,EACxCD,KAAa,EACbG,MAAqC,EACvC;QAEE,IAAIE;QACJ,IAAI,AAAgC,cAAhC,OAAOJ,SAAS,WAAW,EAAiB;YAE5C,MAAMS,SAAS,MAAMT,SAAS,WAAW,CAACD;YAC1C,IAAIU,QACA,OAAOA;YAEX,OAAO;QACX;QAKA,MAAMC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACV,SAAS,MAAM;QAGzD,MAAMW,MAAMD,KAAK,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,KAAKV,OAAO,GAAG;QACnD,IAAI,CAACS,KACD,OAAO;QAGX,IAAI,CAACP,iBAEDA,kBAAkB,MAAMS,kBAAkBd,OAAOY;QAIrD,IAAIX,SAAS,iBAAiB,EAC1B,MAAMA,SAAS,iBAAiB,CAACI;QAGrC,OAAOA;IACX;AACJ;AAEO,MAAMU,0BAA0BC,oBAAoB,oBAAoB,CAAC;IAC5E,gBAAgBnB;IAChB,cAAc;QAAC;YAACoB;YAAsB;gBAAE,UAAU;YAAK;SAAE;QAAEC;KAAS;AACxE"}

package/idp/abstractions.d.ts

@@ -19,6 +19,7 @@ export interface IIdentityProvider {
     isApplicable(token: string): boolean;
     getIdentity(token: string): Promise<IProviderIdentityData | null>;
 }
+/** Generic identity provider for token-based authentication. */
 export declare const IdentityProvider: import("@webiny/di").Abstraction<IIdentityProvider>;
 export declare namespace IdentityProvider {
     type Interface = IIdentityProvider;
@@ -29,6 +30,7 @@ export interface IJwtIdentityProvider {
     isApplicable(token: IJwtPayload): boolean;
     getIdentity(token: string, jwt: IJwt): Promise<IProviderIdentityData | null>;
 }
+/** JWT-specific identity provider for token validation. */
 export declare const JwtIdentityProvider: import("@webiny/di").Abstraction<IJwtIdentityProvider>;
 export declare namespace JwtIdentityProvider {
     type Interface = IJwtIdentityProvider;
@@ -45,6 +47,7 @@ export interface IOidcIdentityProvider {
     verifyToken?(token: string): Promise<IJwtPayload | undefined>;
     verifyTokenClaims?(token: IJwtPayload): Promise<void>;
 }
+/** OIDC-compliant identity provider with issuer validation. */
 export declare const OidcIdentityProvider: import("@webiny/di").Abstraction<IOidcIdentityProvider>;
 export declare namespace OidcIdentityProvider {
     type Interface = IOidcIdentityProvider;
@@ -54,6 +57,7 @@ export declare namespace OidcIdentityProvider {
 interface IJwkCache {
     getKeys(issuer: string): Promise<IJwk[]>;
 }
+/** Cache for JSON Web Keys used in JWT verification. */
 export declare const JwkCache: import("@webiny/di").Abstraction<IJwkCache>;
 export declare namespace JwkCache {
     type Interface = IJwkCache;

package/idp/abstractions.js

@@ -1,13 +1,8 @@
 import { createAbstraction } from "@webiny/feature/api";
-
-// Generic Idp Provider
-
-export const IdentityProvider = createAbstraction("IdentityProvider");
-export const JwtIdentityProvider = createAbstraction("JwtIdentityProvider");
-
-// OIDC Provider
-
-export const OidcIdentityProvider = createAbstraction("OidcIdentityProvider");
-export const JwkCache = createAbstraction("JwkCache");
+const IdentityProvider = createAbstraction("IdentityProvider");
+const JwtIdentityProvider = createAbstraction("JwtIdentityProvider");
+const OidcIdentityProvider = createAbstraction("OidcIdentityProvider");
+const JwkCache = createAbstraction("JwkCache");
+export { IdentityProvider, JwkCache, JwtIdentityProvider, OidcIdentityProvider };
 
 //# sourceMappingURL=abstractions.js.map

package/idp/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","IdentityProvider","JwtIdentityProvider","OidcIdentityProvider","JwkCache"],"sources":["abstractions.ts"],"sourcesContent":["import type { JwtPayload as IJwtPayload, JwtHeader as IJwtHeader } from \"jsonwebtoken\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport type { IdentityData as IIdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport type { Jwk as IJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\n\nexport type IJwt = {\n    header: IJwtHeader;\n    payload: IJwtPayload;\n};\n\nexport type OptionalExternal<T> = Omit<T, \"external\"> & { external?: boolean };\n\nexport type IProviderIdentityData = Omit<IIdentityData, \"type\" | \"profile\"> & {\n    /**\n     * Defaults to `admin` it omitted.\n     */\n    type?: string;\n    profile?: OptionalExternal<NonNullable<IIdentityData[\"profile\"]>>;\n};\n\n// Generic Idp Provider\nexport interface IIdentityProvider {\n    isApplicable(token: string): boolean;\n    getIdentity(token: string): Promise<IProviderIdentityData | null>;\n}\n\nexport const IdentityProvider = createAbstraction<IIdentityProvider>(\"IdentityProvider\");\n\nexport namespace IdentityProvider {\n    export type Interface = IIdentityProvider;\n    export type IdentityData = IProviderIdentityData;\n    export type JwtPayload = IJwtPayload;\n}\n\nexport interface IJwtIdentityProvider {\n    isApplicable(token: IJwtPayload): boolean;\n    getIdentity(token: string, jwt: IJwt): Promise<IProviderIdentityData | null>;\n}\n\nexport const JwtIdentityProvider = createAbstraction<IJwtIdentityProvider>(\"JwtIdentityProvider\");\n\nexport namespace JwtIdentityProvider {\n    export type Interface = IJwtIdentityProvider;\n    export type Jwt = IJwt;\n    export type JwtPayload = IJwtPayload;\n    export type JwtHeader = IJwtHeader;\n    export type IdentityData = IProviderIdentityData;\n}\n\n// OIDC Provider\nexport interface IOidcIdentityProvider {\n    issuer: string;\n    clientId: string;\n    isApplicable(token: IJwtPayload): boolean;\n    getIdentity(jwt: IJwtPayload): Promise<IProviderIdentityData>;\n    verifyToken?(token: string): Promise<IJwtPayload | undefined>;\n    verifyTokenClaims?(token: IJwtPayload): Promise<void>;\n}\n\nexport const OidcIdentityProvider =\n    createAbstraction<IOidcIdentityProvider>(\"OidcIdentityProvider\");\n\nexport namespace OidcIdentityProvider {\n    export type Interface = IOidcIdentityProvider;\n    export type JwtPayload = IJwtPayload;\n    export type IdentityData = IProviderIdentityData;\n}\n\ninterface IJwkCache {\n    getKeys(issuer: string): Promise<IJwk[]>;\n}\n\nexport const JwkCache = createAbstraction<IJwkCache>(\"JwkCache\");\nexport namespace JwkCache {\n    export type Interface = IJwkCache;\n    export type Jwk = IJwk;\n}\n"],"mappings":"AACA,SAASA,iBAAiB,QAAQ,qBAAqB;;AAmBvD;;AAMA,OAAO,MAAMC,gBAAgB,GAAGD,iBAAiB,CAAoB,kBAAkB,CAAC;AAaxF,OAAO,MAAME,mBAAmB,GAAGF,iBAAiB,CAAuB,qBAAqB,CAAC;;AAUjG;;AAUA,OAAO,MAAMG,oBAAoB,GAC7BH,iBAAiB,CAAwB,sBAAsB,CAAC;AAYpE,OAAO,MAAMI,QAAQ,GAAGJ,iBAAiB,CAAY,UAAU,CAAC","ignoreList":[]}
+{"version":3,"file":"idp/abstractions.js","sources":["../../src/idp/abstractions.ts"],"sourcesContent":["import type { JwtPayload as IJwtPayload, JwtHeader as IJwtHeader } from \"jsonwebtoken\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport type { IdentityData as IIdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport type { Jwk as IJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\n\nexport type IJwt = {\n    header: IJwtHeader;\n    payload: IJwtPayload;\n};\n\nexport type OptionalExternal<T> = Omit<T, \"external\"> & { external?: boolean };\n\nexport type IProviderIdentityData = Omit<IIdentityData, \"type\" | \"profile\"> & {\n    /**\n     * Defaults to `admin` it omitted.\n     */\n    type?: string;\n    profile?: OptionalExternal<NonNullable<IIdentityData[\"profile\"]>>;\n};\n\n// Generic Idp Provider\nexport interface IIdentityProvider {\n    isApplicable(token: string): boolean;\n    getIdentity(token: string): Promise<IProviderIdentityData | null>;\n}\n\n/** Generic identity provider for token-based authentication. */\nexport const IdentityProvider = createAbstraction<IIdentityProvider>(\"IdentityProvider\");\n\nexport namespace IdentityProvider {\n    export type Interface = IIdentityProvider;\n    export type IdentityData = IProviderIdentityData;\n    export type JwtPayload = IJwtPayload;\n}\n\nexport interface IJwtIdentityProvider {\n    isApplicable(token: IJwtPayload): boolean;\n    getIdentity(token: string, jwt: IJwt): Promise<IProviderIdentityData | null>;\n}\n\n/** JWT-specific identity provider for token validation. */\nexport const JwtIdentityProvider = createAbstraction<IJwtIdentityProvider>(\"JwtIdentityProvider\");\n\nexport namespace JwtIdentityProvider {\n    export type Interface = IJwtIdentityProvider;\n    export type Jwt = IJwt;\n    export type JwtPayload = IJwtPayload;\n    export type JwtHeader = IJwtHeader;\n    export type IdentityData = IProviderIdentityData;\n}\n\n// OIDC Provider\nexport interface IOidcIdentityProvider {\n    issuer: string;\n    clientId: string;\n    isApplicable(token: IJwtPayload): boolean;\n    getIdentity(jwt: IJwtPayload): Promise<IProviderIdentityData>;\n    verifyToken?(token: string): Promise<IJwtPayload | undefined>;\n    verifyTokenClaims?(token: IJwtPayload): Promise<void>;\n}\n\n/** OIDC-compliant identity provider with issuer validation. */\nexport const OidcIdentityProvider =\n    createAbstraction<IOidcIdentityProvider>(\"OidcIdentityProvider\");\n\nexport namespace OidcIdentityProvider {\n    export type Interface = IOidcIdentityProvider;\n    export type JwtPayload = IJwtPayload;\n    export type IdentityData = IProviderIdentityData;\n}\n\ninterface IJwkCache {\n    getKeys(issuer: string): Promise<IJwk[]>;\n}\n\n/** Cache for JSON Web Keys used in JWT verification. */\nexport const JwkCache = createAbstraction<IJwkCache>(\"JwkCache\");\nexport namespace JwkCache {\n    export type Interface = IJwkCache;\n    export type Jwk = IJwk;\n}\n"],"names":["IdentityProvider","createAbstraction","JwtIdentityProvider","OidcIdentityProvider","JwkCache"],"mappings":";AA2BO,MAAMA,mBAAmBC,kBAAqC;AAc9D,MAAMC,sBAAsBD,kBAAwC;AAqBpE,MAAME,uBACTF,kBAAyC;AAatC,MAAMG,WAAWH,kBAA6B"}

package/idp/feature.d.ts

@@ -1 +1,4 @@
-export declare const IdpAuthenticatorFeature: import("@webiny/feature/api/createFeature.js").FeatureDefinition<unknown>;
+export declare const IdpAuthenticatorFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/idp/feature.js

@@ -3,13 +3,14 @@ import { JwtAuthenticator } from "./JwtAuthenticator.js";
 import { JwkCache } from "./abstractions.js";
 import { JwksCache } from "./JwksCache.js";
 import { OidcJwtIdentityProvider } from "./OidcJwtIdentityProvider.js";
-export const IdpAuthenticatorFeature = createFeature({
-  name: "IdpAuthenticator",
-  register(container) {
-    container.register(JwtAuthenticator);
-    container.register(OidcJwtIdentityProvider);
-    container.registerInstance(JwkCache, new JwksCache());
-  }
+const IdpAuthenticatorFeature = createFeature({
+    name: "IdpAuthenticator",
+    register (container) {
+        container.register(JwtAuthenticator);
+        container.register(OidcJwtIdentityProvider);
+        container.registerInstance(JwkCache, new JwksCache());
+    }
 });
+export { IdpAuthenticatorFeature };
 
 //# sourceMappingURL=feature.js.map

package/idp/feature.js.map

@@ -1 +1 @@
-{"version":3,"names":["createFeature","JwtAuthenticator","JwkCache","JwksCache","OidcJwtIdentityProvider","IdpAuthenticatorFeature","name","register","container","registerInstance"],"sources":["feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { JwtAuthenticator } from \"./JwtAuthenticator.js\";\nimport { JwkCache } from \"./abstractions.js\";\nimport { JwksCache } from \"./JwksCache.js\";\nimport { OidcJwtIdentityProvider } from \"~/idp/OidcJwtIdentityProvider.js\";\n\nexport const IdpAuthenticatorFeature = createFeature({\n    name: \"IdpAuthenticator\",\n    register(container) {\n        container.register(JwtAuthenticator);\n        container.register(OidcJwtIdentityProvider);\n        container.registerInstance(JwkCache, new JwksCache());\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AACnD,SAASC,gBAAgB;AACzB,SAASC,QAAQ;AACjB,SAASC,SAAS;AAClB,SAASC,uBAAuB;AAEhC,OAAO,MAAMC,uBAAuB,GAAGL,aAAa,CAAC;EACjDM,IAAI,EAAE,kBAAkB;EACxBC,QAAQA,CAACC,SAAS,EAAE;IAChBA,SAAS,CAACD,QAAQ,CAACN,gBAAgB,CAAC;IACpCO,SAAS,CAACD,QAAQ,CAACH,uBAAuB,CAAC;IAC3CI,SAAS,CAACC,gBAAgB,CAACP,QAAQ,EAAE,IAAIC,SAAS,CAAC,CAAC,CAAC;EACzD;AACJ,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"idp/feature.js","sources":["../../src/idp/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { JwtAuthenticator } from \"./JwtAuthenticator.js\";\nimport { JwkCache } from \"./abstractions.js\";\nimport { JwksCache } from \"./JwksCache.js\";\nimport { OidcJwtIdentityProvider } from \"~/idp/OidcJwtIdentityProvider.js\";\n\nexport const IdpAuthenticatorFeature = createFeature({\n    name: \"IdpAuthenticator\",\n    register(container) {\n        container.register(JwtAuthenticator);\n        container.register(OidcJwtIdentityProvider);\n        container.registerInstance(JwkCache, new JwksCache());\n    }\n});\n"],"names":["IdpAuthenticatorFeature","createFeature","container","JwtAuthenticator","OidcJwtIdentityProvider","JwkCache","JwksCache"],"mappings":";;;;;AAMO,MAAMA,0BAA0BC,cAAc;IACjD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE;QACnBF,UAAU,gBAAgB,CAACG,UAAU,IAAIC;IAC7C;AACJ"}

package/idp/index.js

@@ -1,3 +1 @@
-export { IdentityProvider, OidcIdentityProvider, JwtIdentityProvider } from "./abstractions.js";
-
-//# sourceMappingURL=index.js.map
+export { IdentityProvider, JwtIdentityProvider, OidcIdentityProvider } from "./abstractions.js";

package/idp/types.js

@@ -1,3 +0,0 @@
-export {};
-
-//# sourceMappingURL=types.js.map

package/index.js

@@ -1,3 +1 @@
 export { createApiCore } from "./createApiCore.js";
-
-//# sourceMappingURL=index.js.map