eve-hub 0.13.1 → 0.13.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # eve-hub
 
+## 0.13.2
+
+### Patch Changes
+
+- The hub-oidc helper verifies a token from another OIDC issuer (`verifyIssuerToken`).
+
 ## 0.13.1
 
 ### Patch Changes

package/hub-oidc.d.mts

@@ -1,4 +1,5 @@
 export type TeamClaims = { iss: string; owner_id: string; project_id?: string; environment?: string; user_id?: string; exp: number; [claim: string]: unknown };
 export function looksLikeJwt(token: string | null | undefined): boolean;
+export function verifyIssuerToken(token: string, options: { iss: string; jwksUrl?: string; audience?: string; fetchImpl?: typeof fetch; now?: number }): Promise<Record<string, unknown> | undefined>;
 export function verifyTeamToken(token: string, own: string, options?: { fetchImpl?: typeof fetch; now?: number; audience?: string }): Promise<TeamClaims | undefined>;
 export function isHubRequest(request: Request, own: () => Promise<string>, options?: { env?: Record<string, string | undefined>; fetchImpl?: typeof fetch; now?: number }): Promise<boolean>;

package/hub-oidc.mjs

@@ -12,15 +12,26 @@ import { isBotToken } from "./bot-token.mjs";
 const keySets = new WeakMap();
 // Not a bad token but the keys that could not be read (a timeout, a non-200 answer, an unreadable key set): an outage, so it throws.
 const KEY_FETCH_FAILED = new Set([errors.JWKSTimeout.code, errors.JWKSInvalid.code, errors.JOSEError.code]);
-function keysOf(iss, fetchImpl) {
+function keysOf(iss, fetchImpl, jwksUrl = `${iss}/.well-known/jwks.json`) {
   if (!keySets.has(fetchImpl)) keySets.set(fetchImpl, new Map());
   const sets = keySets.get(fetchImpl);
-  if (!sets.has(iss)) sets.set(iss, createRemoteJWKSet(new URL(`${iss}/.well-known/jwks.json`), { [customFetch]: fetchImpl, cooldownDuration: 30_000, cacheMaxAge: 60 * 60_000 }));
+  if (!sets.has(iss)) sets.set(iss, createRemoteJWKSet(new URL(jwksUrl), { [customFetch]: fetchImpl, cooldownDuration: 30_000, cacheMaxAge: 60 * 60_000 }));
   return sets.get(iss);
 }
 
 export const looksLikeJwt = (token) => /^[\w-]+\.[\w-]+\.[\w-]*$/.test(String(token ?? ""));
 
+/** The verified claims of `token` when `iss` (keys at `jwksUrl`) signed it for `audience`; undefined for any other token, a throw when the keys can't be read. */
+export async function verifyIssuerToken(token, { iss, jwksUrl, audience, fetchImpl = fetch, now = Date.now() }) {
+  try {
+    const { payload } = await jwtVerify(token, keysOf(iss, fetchImpl, jwksUrl), { issuer: iss, audience, algorithms: ["RS256"], requiredClaims: ["exp"], currentDate: new Date(now) });
+    return payload;
+  } catch (error) {
+    if (error instanceof errors.JOSEError && !KEY_FETCH_FAILED.has(error.code)) return undefined;
+    throw error;
+  }
+}
+
 /**
  * The verified claims of `token`, or undefined for any token that is not the checker's team's.
  * `own` is the checker's own token (its `iss` and `owner_id` say which team to trust). With `audience`, the token's `aud` must be it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eve-hub",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "license": "Apache-2.0",
   "description": "Bot-side code shared by every hub agent: registry tools, the roster hook, the eve channel, the host sandbox and browser, and model helpers.",
   "type": "module",