eslint-plugin-jwt-security 2.3.0 → 2.3.2

package/src/rules/require-issuer-validation/require-issuer-validation.test.ts

@@ -1,68 +0,0 @@
-/**
- * Tests for require-issuer-validation rule
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { requireIssuerValidation } from './index';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('require-issuer-validation', () => {
-  describe('Valid Code', () => {
-    ruleTester.run('valid - with issuer', requireIssuerValidation, {
-      valid: [
-        { code: `jwt.verify(token, secret, { issuer: 'https://auth.example.com' });` },
-        { code: `jwt.verify(token, secret, { iss: 'auth.example.com' });` },
-        { code: `jwt.verify(token, secret, { issuer: 'auth', algorithms: ['RS256'] });` },
-        { code: `jwt.sign(payload, secret);` }, // sign not checked
-        // Only one argument - edge case
-        { code: `jwt.verify(token);` },
-        // jwtVerify with issuer
-        { code: `jwtVerify(token, key, { issuer: 'https://auth.example.com' });` },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code', () => {
-    ruleTester.run('invalid - missing issuer', requireIssuerValidation, {
-      valid: [],
-      invalid: [
-        {
-          code: `jwt.verify(token, secret);`,
-          errors: [{ messageId: 'missingIssuerValidation' }],
-        },
-        {
-          code: `jwt.verify(token, secret, {});`,
-          errors: [{ messageId: 'missingIssuerValidation' }],
-        },
-        {
-          code: `jwt.verify(token, secret, { algorithms: ['RS256'] });`,
-          errors: [{ messageId: 'missingIssuerValidation' }],
-        },
-        // jwtVerify without issuer
-        {
-          code: `jwtVerify(token, key);`,
-          errors: [{ messageId: 'missingIssuerValidation' }],
-        },
-        // jwtVerify with empty options
-        {
-          code: `jwtVerify(token, key, {});`,
-          errors: [{ messageId: 'missingIssuerValidation' }],
-        },
-      ],
-    });
-  });
-});

package/src/rules/require-max-age/index.ts

@@ -1,117 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * ESLint Rule: require-max-age
- *
- * Mandates maxAge option in JWT verify operations to enforce token freshness.
- * This prevents the "Back to the Future" replay attack where tokens are
- * captured and replayed months or years later.
- *
- * CWE-294: Authentication Bypass by Capture-replay
- *
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- * @see LightSEC 2025 - "JWT Back to the future: On the (ab)use of JWTs"
- */
-import type { TSESLint, TSESTree } from '@interlace/eslint-devkit';
-import { createRule, formatLLMMessage, MessageIcons } from '@interlace/eslint-devkit';
-import { isVerifyOperation, getOptionsArgument, hasOption } from '../../utils';
-import type { JwtRuleOptions } from '../../types';
-
-type MessageIds = 'missingMaxAge';
-
-type RuleOptions = [JwtRuleOptions?];
-
-export const requireMaxAge = createRule<RuleOptions, MessageIds>({
-  name: 'require-max-age',
-  meta: {
-    type: 'problem',
-    docs: {
-      url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-max-age.md',
-      description:
-        'Require maxAge option in verify operations to enforce token freshness',
-      cwe: 'CWE-294',
-      cvss: 5,
-    },
-    fixable: undefined,
-    hasSuggestions: false,
-    messages: {
-      missingMaxAge: formatLLMMessage({
-        icon: MessageIcons.SECURITY,
-        issueName: 'Missing Token Age Validation',
-        cwe: 'CWE-294',
-        description:
-          'Without maxAge, tokens can be replayed long after issuance (Back to the Future attack)',
-        severity: 'MEDIUM',
-        fix: 'Add maxAge option: { maxAge: "1h" } to limit token lifetime',
-        documentationLink: 'https://securitypattern.com/post/jwt-back-to-the-future',
-      }),
-    },
-    schema: [
-      {
-        type: 'object',
-        properties: {
-          trustedSanitizers: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          trustedAnnotations: {
-            type: 'array',
-            items: { type: 'string' },
-            default: [],
-          },
-          strictMode: {
-            type: 'boolean',
-            default: false,
-          },
-        },
-        additionalProperties: false,
-      },
-    ],
-  },
-  defaultOptions: [
-    {
-      trustedSanitizers: [],
-      trustedAnnotations: [],
-      strictMode: false,
-    },
-  ],
-  create(context: TSESLint.RuleContext<MessageIds, RuleOptions>) {
-    return {
-      CallExpression(node: TSESTree.CallExpression) {
-        if (!isVerifyOperation(node)) {
-          return;
-        }
-
-        if (node.arguments.length < 2) {
-          return;
-        }
-
-        const optionsArg = getOptionsArgument(node, 2);
-
-        // No options at all
-        if (!optionsArg) {
-          context.report({
-            node,
-            messageId: 'missingMaxAge',
-          });
-          return;
-        }
-
-        // Check for maxAge option
-        if (!hasOption(optionsArg, 'maxAge') && !hasOption(optionsArg, 'clockTolerance')) {
-          context.report({
-            node: optionsArg,
-            messageId: 'missingMaxAge',
-          });
-        }
-      },
-    };
-  },
-});
-
-export default requireMaxAge;

package/src/rules/require-max-age/require-max-age.test.ts

@@ -1,69 +0,0 @@
-/**
- * Tests for require-max-age rule
- * Security: LightSEC 2025 - Replay Attack Prevention
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import { requireMaxAge } from './index';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-describe('require-max-age', () => {
-  describe('Valid Code', () => {
-    ruleTester.run('valid - with maxAge', requireMaxAge, {
-      valid: [
-        { code: `jwt.verify(token, secret, { maxAge: '1h' });` },
-        { code: `jwt.verify(token, secret, { maxAge: 3600 });` },
-        { code: `jwt.verify(token, secret, { clockTolerance: 30 });` },
-        { code: `jwt.sign(payload, secret);` }, // sign not checked
-        // Only one argument - edge case
-        { code: `jwt.verify(token);` },
-        // jwtVerify with maxAge
-        { code: `jwtVerify(token, key, { maxAge: '24h' });` },
-      ],
-      invalid: [],
-    });
-  });
-
-  describe('Invalid Code', () => {
-    ruleTester.run('invalid - missing maxAge', requireMaxAge, {
-      valid: [],
-      invalid: [
-        {
-          code: `jwt.verify(token, secret);`,
-          errors: [{ messageId: 'missingMaxAge' }],
-        },
-        {
-          code: `jwt.verify(token, secret, {});`,
-          errors: [{ messageId: 'missingMaxAge' }],
-        },
-        {
-          code: `jwt.verify(token, secret, { algorithms: ['RS256'] });`,
-          errors: [{ messageId: 'missingMaxAge' }],
-        },
-        // jwtVerify without maxAge
-        {
-          code: `jwtVerify(token, key);`,
-          errors: [{ messageId: 'missingMaxAge' }],
-        },
-        // verifyJWT without maxAge
-        {
-          code: `verifyJWT(token, key, { algorithms: ['RS256'] });`,
-          errors: [{ messageId: 'missingMaxAge' }],
-        },
-      ],
-    });
-  });
-});

package/src/tests/coverage-dual-layer.test.ts

@@ -1,323 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * Dual-layer coverage tests — closes the remaining uncovered branches.
- *
- * Layer 1: RuleTester fixtures through the real parser.
- * Layer 2: raw unit tests — helpers called as plain functions, plus
- *          createWithMockContext (from @interlace/eslint-devkit) invoking
- *          rule listeners directly with synthetic AST nodes for
- *          parser-unreachable branches.
- */
-import { RuleTester } from '@typescript-eslint/rule-tester';
-import { describe, it, expect, afterAll } from 'vitest';
-import parser from '@typescript-eslint/parser';
-import type { TSESTree } from '@interlace/eslint-devkit';
-import { createWithMockContext } from '@interlace/eslint-devkit';
-import { noAlgorithmConfusion } from '../rules/no-algorithm-confusion';
-import { noAlgorithmNone } from '../rules/no-algorithm-none';
-import { noDecodeWithoutVerify } from '../rules/no-decode-without-verify';
-import { noHardcodedSecret } from '../rules/no-hardcoded-secret';
-import { noSensitivePayload } from '../rules/no-sensitive-payload';
-import { noWeakSecret } from '../rules/no-weak-secret';
-import { extractAlgorithms } from '../utils';
-
-RuleTester.afterAll = afterAll;
-RuleTester.it = it;
-RuleTester.itOnly = it.only;
-RuleTester.describe = describe;
-
-const ruleTester = new RuleTester({
-  languageOptions: {
-    parser,
-    ecmaVersion: 2022,
-    sourceType: 'module',
-  },
-});
-
-// ---------------------------------------------------------------------------
-// Layer 1 — no-algorithm-confusion: property-loop guards (spread + computed
-// key before the `algorithms` entry) still land the report on the right node.
-// ---------------------------------------------------------------------------
-describe('coverage: no-algorithm-confusion property-loop guards', () => {
-  ruleTester.run('spread and computed props before algorithms', noAlgorithmConfusion, {
-    valid: [],
-    invalid: [
-      {
-        // SpreadElement (prop.type !== 'Property') and computed key
-        // (prop.key.type !== 'Identifier') are skipped; the report fires on
-        // the `algorithms` property value.
-        code: `jwt.verify(token, publicKey, { ...baseOpts, ['audit']: true, algorithms: ['HS256'] });`,
-        errors: [{ messageId: 'algorithmConfusion' }],
-      },
-    ],
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Layer 1 — no-algorithm-none: the isDecodeCall() detector.
-// ---------------------------------------------------------------------------
-describe('coverage: no-algorithm-none decode detection', () => {
-  ruleTester.run('isDecodeCall branches', noAlgorithmNone, {
-    valid: [
-      // object name is neither `jwt` nor `jsonwebtoken` -> not a decode call
-      { code: `myParser.decode(data);` },
-      // callee object is itself a MemberExpression -> returns false
-      { code: `api.jwt.decode(token);` },
-      // computed property (Literal, not Identifier) -> returns false
-      { code: `jwt["decode"](token);` },
-    ],
-    invalid: [
-      // jwt.decode() is flagged as equivalent to algorithm:"none"
-      {
-        code: `jwt.decode(token);`,
-        errors: [{ messageId: 'decodeWithoutVerify' }],
-      },
-      // jsonwebtoken.decode() — second operand of the name check
-      {
-        code: `jsonwebtoken.decode(token);`,
-        errors: [{ messageId: 'decodeWithoutVerify' }],
-      },
-    ],
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Layer 1 — no-decode-without-verify: safe-annotation suppression (previously
-// hidden behind c8-ignore; a plain leading comment through the real parser
-// exercises hasSafeAnnotation for both the jwt.decode and jwt_decode paths).
-// ---------------------------------------------------------------------------
-describe('coverage: no-decode-without-verify safe annotations', () => {
-  ruleTester.run('trusted annotations suppress the report', noDecodeWithoutVerify, {
-    valid: [
-      {
-        // custom trustedAnnotations option suppresses the jwt.decode report
-        code: `// @decoded-header-only
-const header = jwt.decode(token);`,
-        options: [{ trustedAnnotations: ['@decoded-header-only'] }],
-      },
-      {
-        // built-in devkit SAFE_ANNOTATIONS ('@verified') suppresses jwt_decode
-        code: `/* @verified-separately */
-const payload = jwt_decode(token);`,
-      },
-    ],
-    invalid: [
-      // Unrelated leading comment does NOT suppress — annotation walk runs
-      // and falls through to the report.
-      {
-        code: `// TODO: refactor later
-const payload = jwt.decode(token);`,
-        errors: [{ messageId: 'decodeWithoutVerify' }],
-      },
-      {
-        code: `// just a note
-const payload = jwt_decode(token);`,
-        errors: [{ messageId: 'jwtDecodeLibrary' }],
-      },
-    ],
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Layer 1 — no-hardcoded-secret: resolveConstLiteralValue() through the real
-// scope manager.
-// ---------------------------------------------------------------------------
-describe('coverage: no-hardcoded-secret const-literal resolution', () => {
-  ruleTester.run('single-frame const indirection', noHardcodedSecret, {
-    valid: [
-      // `let` binding is never resolved (kind !== 'const') -> treated safe
-      { code: `let MUTABLE_SECRET = 'abc'; jwt.sign(payload, MUTABLE_SECRET);` },
-      // function parameter: def.type is 'Parameter', not 'Variable' -> safe
-      { code: `function issue(SECRET) { return jwt.sign(payload, SECRET); }` },
-      // unresolved global identifier: no def at all -> safe
-      { code: `jwt.sign(payload, GLOBAL_SECRET);` },
-      // for-of const has no initializer: `def.node.init ?? null` -> null -> safe
-      { code: `for (const SECRET of secretList) { jwt.sign(payload, SECRET); }` },
-      // const resolved to a non-literal initializer (call) -> safe
-      { code: `const KEY = loadKey(); jwt.sign(payload, KEY);` },
-      // non-identifier, non-literal secret arg: resolveConstLiteralValue()
-      // gets a non-Identifier node via isHardcodedStringOrResolvedConst -> null
-      { code: `jwt.sign(payload, [42]);` },
-    ],
-    invalid: [
-      // const-hidden string literal is resolved and flagged
-      {
-        code: `const SECRET = 'my-hardcoded-secret'; jwt.sign(payload, SECRET);`,
-        errors: [{ messageId: 'hardcodedSecret' }],
-      },
-      // const-hidden expressionless template literal is resolved and flagged
-      {
-        code: 'const SECRET = `template-secret`; jwt.sign(payload, SECRET);',
-        errors: [{ messageId: 'hardcodedSecret' }],
-      },
-    ],
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Layer 1 — no-sensitive-payload: property-loop guards.
-// ---------------------------------------------------------------------------
-describe('coverage: no-sensitive-payload property-loop guards', () => {
-  ruleTester.run('spread and non-identifier keys are skipped', noSensitivePayload, {
-    valid: [
-      // SpreadElement (prop.type !== 'Property') and string-literal key
-      // (prop.key.type !== 'Identifier') are both skipped without reporting.
-      {
-        code: `jwt.sign({ ...claims, 'display-name': name, role: 'admin' }, process.env.JWT_SECRET);`,
-      },
-    ],
-    invalid: [],
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Layer 1 — no-weak-secret: template-literal arms + missing-secret guard.
-// ---------------------------------------------------------------------------
-describe('coverage: no-weak-secret template literals and arg guard', () => {
-  ruleTester.run('template secret arms', noWeakSecret, {
-    valid: [
-      // sign() with a single argument: secret check is skipped entirely
-      { code: `jwt.sign(payload);` },
-      // strong 34-char template literal: neither weak pattern nor short
-      { code: 'jwt.sign(payload, `ThisIsAVeryStrongSecretThatIs32Ch+`);' },
-    ],
-    invalid: [
-      // known weak pattern in a template literal (left arm true)
-      {
-        code: 'jwt.sign(payload, `secret`);',
-        errors: [{ messageId: 'weakSecret' }],
-      },
-      // short but not a known pattern (left arm false, right arm true)
-      {
-        code: 'jwt.sign(payload, `xy9z`);',
-        errors: [{ messageId: 'weakSecret' }],
-      },
-    ],
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Layer 2 — utils.extractAlgorithms: sparse-array holes and non-string
-// elements inside the algorithms array are skipped.
-// ---------------------------------------------------------------------------
-describe('coverage (unit): extractAlgorithms skips holes and non-strings', () => {
-  it('ignores null elements and non-string literals', () => {
-    const optionsNode = {
-      type: 'ObjectExpression',
-      properties: [
-        {
-          type: 'Property',
-          key: { type: 'Identifier', name: 'algorithms' },
-          value: {
-            type: 'ArrayExpression',
-            elements: [
-              null, // sparse-array hole
-              { type: 'Literal', value: 42 }, // non-string literal
-              { type: 'Literal', value: 'RS256' },
-            ],
-          },
-        },
-      ],
-    } as unknown as TSESTree.ObjectExpression;
-
-    expect(extractAlgorithms(optionsNode)).toEqual(['RS256']);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Layer 2 — no-hardcoded-secret: parser-unreachable guards inside
-// resolveConstLiteralValue(). A real ESLint context always exposes
-// sourceCode.getScope, and a scope-manager 'Variable' def always hangs off a
-// VariableDeclaration parent — these defensive branches need a mock context
-// and synthetic scope objects.
-// ---------------------------------------------------------------------------
-describe('coverage (unit): no-hardcoded-secret defensive scope guards', () => {
-  const makeSignCall = (
-    secretArg: Record<string, unknown>,
-  ): TSESTree.CallExpression =>
-    ({
-      type: 'CallExpression',
-      callee: {
-        type: 'MemberExpression',
-        object: { type: 'Identifier', name: 'jwt' },
-        property: { type: 'Identifier', name: 'sign' },
-        computed: false,
-      },
-      arguments: [{ type: 'ObjectExpression', properties: [] }, secretArg],
-    }) as unknown as TSESTree.CallExpression;
-
-  it('treats the secret as unresolvable when sourceCode.getScope is absent', () => {
-    const { listeners, reports, context } = createWithMockContext(noHardcodedSecret);
-    (context.sourceCode as { getScope?: unknown }).getScope = undefined;
-
-    const secretId = { type: 'Identifier', name: 'SECRET' };
-    (listeners.CallExpression as (n: TSESTree.CallExpression) => void)(
-      makeSignCall(secretId),
-    );
-
-    // getScope?.() -> undefined -> ?? null -> early null: identifier cannot
-    // be resolved to a literal, so it is treated as a safe key source.
-    expect(reports).toHaveLength(0);
-  });
-
-  it('returns null when the resolved def has no parent declaration', () => {
-    const { listeners, reports, context } = createWithMockContext(noHardcodedSecret);
-    const secretId = { type: 'Identifier', name: 'SECRET' };
-    const scope = {
-      variables: [],
-      childScopes: [],
-      references: [
-        {
-          identifier: secretId,
-          resolved: {
-            defs: [{ type: 'Variable', parent: undefined, node: {} }],
-          },
-        },
-      ],
-    };
-    (context.sourceCode as { getScope?: unknown }).getScope = () => scope;
-
-    (listeners.CallExpression as (n: TSESTree.CallExpression) => void)(
-      makeSignCall(secretId),
-    );
-
-    // decl?.type is undefined -> not a VariableDeclaration -> null -> safe.
-    expect(reports).toHaveLength(0);
-  });
-
-  it('returns null when the def parent is not a VariableDeclaration', () => {
-    const { listeners, reports, context } = createWithMockContext(noHardcodedSecret);
-    const secretId = { type: 'Identifier', name: 'SECRET' };
-    const scope = {
-      variables: [],
-      childScopes: [],
-      references: [
-        {
-          identifier: secretId,
-          resolved: {
-            defs: [
-              {
-                type: 'Variable',
-                parent: { type: 'ExpressionStatement' },
-                node: { init: { type: 'Literal', value: 'x' } },
-              },
-            ],
-          },
-        },
-      ],
-    };
-    (context.sourceCode as { getScope?: unknown }).getScope = () => scope;
-
-    (listeners.CallExpression as (n: TSESTree.CallExpression) => void)(
-      makeSignCall(secretId),
-    );
-
-    // parent.type mismatch -> null -> identifier treated as safe key source.
-    expect(reports).toHaveLength(0);
-  });
-});

package/src/types/index.ts

@@ -1,107 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * eslint-plugin-jwt-security Type Exports
- *
- * Barrel file that exports all JWT security rule Options types.
- */
-
-import type { SecurityRuleOptions } from '@interlace/eslint-devkit';
-
-// Base options interface for JWT rules
-export interface JwtRuleOptions extends SecurityRuleOptions {
-  /** JWT libraries to consider for detection. Default: all supported libraries */
-  targetLibraries?: Array<
-    | 'jsonwebtoken'
-    | 'jose'
-    | 'express-jwt'
-    | '@nestjs/jwt'
-    | 'jwks-rsa'
-    | 'jwt-decode'
-  >;
-}
-
-// Rule-specific options
-export interface NoAlgorithmNoneOptions extends JwtRuleOptions {
-  /** Allow 'none' algorithm in test files. Default: false */
-  allowInTests?: boolean;
-}
-
-export interface NoAlgorithmConfusionOptions extends JwtRuleOptions {
-  /** Symmetric algorithms that should not be used with public keys */
-  symmetricAlgorithms?: string[];
-}
-
-export interface RequireAlgorithmWhitelistOptions extends JwtRuleOptions {
-  /** Recommended algorithms to suggest. Default: ['RS256', 'ES256'] */
-  recommendedAlgorithms?: string[];
-}
-
-export interface NoDecodeWithoutVerifyOptions extends JwtRuleOptions {
-  /** Allow decode() for header inspection before verify. Default: false */
-  allowHeaderInspection?: boolean;
-}
-
-export interface NoWeakSecretOptions extends JwtRuleOptions {
-  /** Minimum secret length in characters. Default: 32 (256 bits) */
-  minSecretLength?: number;
-}
-
-export interface RequireExpirationOptions extends JwtRuleOptions {
-  /** Maximum allowed expiration time in seconds. Default: 86400 (24 hours) */
-  maxExpirationSeconds?: number;
-}
-
-export interface RequireIssuerValidationOptions extends JwtRuleOptions {
-  /** Known valid issuers to suggest. Default: [] */
-  knownIssuers?: string[];
-}
-
-export interface RequireAudienceValidationOptions extends JwtRuleOptions {
-  /** Known valid audiences to suggest. Default: [] */
-  knownAudiences?: string[];
-}
-
-export interface NoSensitivePayloadOptions extends JwtRuleOptions {
-  /** Additional field names to flag as sensitive. Default: [] */
-  additionalSensitiveFields?: string[];
-}
-
-export interface NoHardcodedSecretOptions extends JwtRuleOptions {
-  /** Patterns that indicate environment variable usage (safe). Default: process.env */
-  envPatterns?: string[];
-}
-
-export interface RequireJwksValidationOptions extends JwtRuleOptions {
-  /** Require cache configuration. Default: true */
-  requireCache?: boolean;
-  /** Require rate limiting. Default: true */
-  requireRateLimit?: boolean;
-}
-
-export interface NoInsecureKidOptions extends JwtRuleOptions {
-  /** Allow custom KID validation functions. Default: [] */
-  trustedKidValidators?: string[];
-}
-
-/**
- * Combined type for all JWT rule options
- */
-export type AllJwtRulesOptions = {
-  'no-algorithm-none'?: NoAlgorithmNoneOptions;
-  'no-algorithm-confusion'?: NoAlgorithmConfusionOptions;
-  'require-algorithm-whitelist'?: RequireAlgorithmWhitelistOptions;
-  'no-decode-without-verify'?: NoDecodeWithoutVerifyOptions;
-  'no-weak-secret'?: NoWeakSecretOptions;
-  'require-expiration'?: RequireExpirationOptions;
-  'require-issuer-validation'?: RequireIssuerValidationOptions;
-  'require-audience-validation'?: RequireAudienceValidationOptions;
-  'no-sensitive-payload'?: NoSensitivePayloadOptions;
-  'no-hardcoded-secret'?: NoHardcodedSecretOptions;
-  'require-jwks-validation'?: RequireJwksValidationOptions;
-  'no-insecure-kid'?: NoInsecureKidOptions;
-};