nestjs-keycloak-auth 1.0.0

package/dist/services/keycloak-multitenant.service.js

@@ -0,0 +1,161 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakMultiTenantService = void 0;
+const errors_1 = require("../errors");
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../constants");
+/**
+ * Stores resolved tenant configurations for multi-tenant scenarios.
+ */
+let KeycloakMultiTenantService = class KeycloakMultiTenantService {
+    constructor(keycloakOpts) {
+        this.keycloakOpts = keycloakOpts;
+        this.configs = new Map();
+    }
+    /**
+    * Clears the cached tenant configurations.
+    */
+    clear() {
+        this.configs.clear();
+    }
+    /**
+    * Retrieves a resolved tenant config based on the realm provided.
+    * @param realm the realm to retrieve from
+    * @param request the request instance, defaults to undefined
+    * @returns the resolved tenant configuration
+    */
+    get(realm_1) {
+        return __awaiter(this, arguments, void 0, function* (realm, request = undefined) {
+            var _a, _b, _c, _d;
+            if (typeof this.keycloakOpts === 'string') {
+                throw new errors_1.KeycloakConfigError('Keycloak configuration is a configuration path. This should not happen after module load.');
+            }
+            if (this.keycloakOpts.multiTenant === null ||
+                this.keycloakOpts.multiTenant === undefined) {
+                throw new errors_1.KeycloakConfigError('Multi tenant is not defined yet multi tenant service is being called.');
+            }
+            // Check if existing — return early before resolving
+            if (this.configs.has(realm) &&
+                !this.keycloakOpts.multiTenant.resolveAlways) {
+                return this.configs.get(realm);
+            }
+            const authServerUrl = yield this.resolveAuthServerUrl(realm, request);
+            const secret = yield this.resolveSecret(realm, request);
+            const clientId = yield this.resolveClientId(realm, request);
+            const realmUrl = `${authServerUrl.replace(/\/$/, '')}/realms/${realm}`;
+            const realmAdminUrl = `${authServerUrl.replace(/\/$/, '')}/admin/realms/${realm}`;
+            const isPublic = typeof this.keycloakOpts !== 'string' &&
+                !!((_b = (_a = this.keycloakOpts['public-client']) !== null && _a !== void 0 ? _a : this.keycloakOpts.public) !== null && _b !== void 0 ? _b : false);
+            const bearerOnly = typeof this.keycloakOpts !== 'string' &&
+                !!((_d = (_c = this.keycloakOpts['bearer-only']) !== null && _c !== void 0 ? _c : this.keycloakOpts.bearerOnly) !== null && _d !== void 0 ? _d : false);
+            const config = {
+                authServerUrl,
+                realm,
+                clientId,
+                secret,
+                realmUrl,
+                realmAdminUrl,
+                isPublic,
+                bearerOnly,
+            };
+            this.configs.set(realm, config);
+            return config;
+        });
+    }
+    resolveAuthServerUrl(realm_1) {
+        return __awaiter(this, arguments, void 0, function* (realm, request = undefined) {
+            if (typeof this.keycloakOpts === 'string') {
+                throw new errors_1.KeycloakConfigError('Keycloak configuration is a configuration path. This should not happen after module load.');
+            }
+            if (this.keycloakOpts.multiTenant === null ||
+                this.keycloakOpts.multiTenant === undefined) {
+                throw new errors_1.KeycloakConfigError('Multi tenant is not defined yet multi tenant service is being called.');
+            }
+            // If no realm auth server url resolver is defined, return defaults
+            if (!this.keycloakOpts.multiTenant.realmAuthServerUrlResolver) {
+                return (this.keycloakOpts.authServerUrl ||
+                    this.keycloakOpts['auth-server-url'] ||
+                    this.keycloakOpts.serverUrl ||
+                    this.keycloakOpts['server-url']);
+            }
+            // Resolve realm authServerUrl
+            const authServerUrl = yield this.keycloakOpts.multiTenant.realmAuthServerUrlResolver(realm, request);
+            // Override auth server url
+            // Order of priority: resolved realm auth server url > provided auth server url
+            return (authServerUrl ||
+                this.keycloakOpts.authServerUrl ||
+                this.keycloakOpts['auth-server-url'] ||
+                this.keycloakOpts.serverUrl ||
+                this.keycloakOpts['server-url']);
+        });
+    }
+    resolveClientId(realm_1) {
+        return __awaiter(this, arguments, void 0, function* (realm, request = undefined) {
+            if (typeof this.keycloakOpts === 'string') {
+                throw new errors_1.KeycloakConfigError('Keycloak configuration is a configuration path. This should not happen after module load.');
+            }
+            if (this.keycloakOpts.multiTenant === null ||
+                this.keycloakOpts.multiTenant === undefined) {
+                throw new errors_1.KeycloakConfigError('Multi tenant is not defined yet multi tenant service is being called.');
+            }
+            // If no realm client-id resolver is defined, return defaults
+            if (!this.keycloakOpts.multiTenant.realmClientIdResolver) {
+                return this.keycloakOpts.clientId || this.keycloakOpts['client-id'];
+            }
+            // Resolve realm client-id
+            const realmClientId = yield this.keycloakOpts.multiTenant.realmClientIdResolver(realm, request);
+            // Override client-id
+            // Order of priority: resolved realm client-id > default global client-id
+            return (realmClientId ||
+                this.keycloakOpts.clientId ||
+                this.keycloakOpts['client-id']);
+        });
+    }
+    resolveSecret(realm_1) {
+        return __awaiter(this, arguments, void 0, function* (realm, request = undefined) {
+            if (typeof this.keycloakOpts === 'string') {
+                throw new errors_1.KeycloakConfigError('Keycloak configuration is a configuration path. This should not happen after module load.');
+            }
+            if (this.keycloakOpts.multiTenant === null ||
+                this.keycloakOpts.multiTenant === undefined) {
+                throw new errors_1.KeycloakConfigError('Multi tenant is not defined yet multi tenant service is being called.');
+            }
+            // If no realm secret resolver is defined, return defaults
+            if (!this.keycloakOpts.multiTenant.realmSecretResolver) {
+                return this.keycloakOpts.secret;
+            }
+            // Resolve realm secret
+            const realmSecret = yield this.keycloakOpts.multiTenant.realmSecretResolver(realm, request);
+            // Override secret
+            // Order of priority: resolved realm secret > default global secret
+            return realmSecret || this.keycloakOpts.secret;
+        });
+    }
+};
+exports.KeycloakMultiTenantService = KeycloakMultiTenantService;
+exports.KeycloakMultiTenantService = KeycloakMultiTenantService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], KeycloakMultiTenantService);

package/dist/services/keycloak-url.service.d.ts

@@ -0,0 +1,12 @@
+import { KeycloakAuthConfig } from '../interface/keycloak-auth-options.interface';
+/**
+ * Service for generating Keycloak endpoint URLs.
+ */
+export declare class KeycloakUrlService {
+    private readonly keycloakOpts;
+    constructor(keycloakOpts: KeycloakAuthConfig);
+    /**
+    * Get the realm admin API base URL.
+    */
+    realmAdminUrl(): string;
+}

package/dist/services/keycloak-url.service.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakUrlService = void 0;
+const constants_1 = require("../constants");
+const common_1 = require("@nestjs/common");
+/**
+ * Service for generating Keycloak endpoint URLs.
+ */
+let KeycloakUrlService = class KeycloakUrlService {
+    constructor(keycloakOpts) {
+        this.keycloakOpts = keycloakOpts;
+    }
+    /**
+    * Get the realm admin API base URL.
+    */
+    realmAdminUrl() {
+        const authServerUrl = (this.keycloakOpts.authServerUrl ||
+            this.keycloakOpts['auth-server-url'] ||
+            this.keycloakOpts.serverUrl ||
+            this.keycloakOpts['server-url'] ||
+            '').replace(/\/+$/, '');
+        const realm = this.keycloakOpts.realm || '';
+        return `${authServerUrl}/admin/realms/${realm}`;
+    }
+};
+exports.KeycloakUrlService = KeycloakUrlService;
+exports.KeycloakUrlService = KeycloakUrlService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], KeycloakUrlService);

package/dist/services/oidc-discovery.service.d.ts

@@ -0,0 +1,24 @@
+import { HttpService } from '@nestjs/axios';
+import { OidcEndpoints } from '../interface/oidc.interface';
+export { OidcEndpoints };
+/**
+ * Fetches and caches OIDC discovery metadata per realm.
+ * Endpoints are resolved from {realmUrl}/.well-known/openid-configuration
+ * instead of being hardcoded.
+ */
+export declare class OidcDiscoveryService {
+    private readonly httpService;
+    private readonly logger;
+    private readonly cache;
+    private readonly cacheTtlMs;
+    constructor(httpService: HttpService);
+    /**
+    * Get the discovered OIDC endpoints for a realm URL.
+    * Results are cached for 5 minutes per realm.
+    */
+    getEndpoints(realmUrl: string): Promise<OidcEndpoints>;
+    /**
+    * Clear all cached discovery metadata.
+    */
+    clearCache(): void;
+}

package/dist/services/oidc-discovery.service.js

@@ -0,0 +1,86 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var OidcDiscoveryService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcDiscoveryService = void 0;
+const rxjs_1 = require("rxjs");
+const axios_1 = require("@nestjs/axios");
+const common_1 = require("@nestjs/common");
+/**
+ * Fetches and caches OIDC discovery metadata per realm.
+ * Endpoints are resolved from {realmUrl}/.well-known/openid-configuration
+ * instead of being hardcoded.
+ */
+let OidcDiscoveryService = OidcDiscoveryService_1 = class OidcDiscoveryService {
+    constructor(httpService) {
+        this.httpService = httpService;
+        this.logger = new common_1.Logger(OidcDiscoveryService_1.name);
+        this.cache = new Map();
+        this.cacheTtlMs = 300000; // 5 minutes
+    }
+    /**
+    * Get the discovered OIDC endpoints for a realm URL.
+    * Results are cached for 5 minutes per realm.
+    */
+    getEndpoints(realmUrl) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const cached = this.cache.get(realmUrl);
+            if (cached && Date.now() - cached.fetchedAt < this.cacheTtlMs) {
+                return cached.endpoints;
+            }
+            const discoveryUrl = `${realmUrl}/.well-known/openid-configuration`;
+            this.logger.verbose(`Fetching OIDC discovery from ${discoveryUrl}`);
+            const { data } = yield (0, rxjs_1.firstValueFrom)(this.httpService.request({
+                url: discoveryUrl,
+                method: 'GET',
+                headers: {
+                    Accept: 'application/json',
+                    'X-Client': 'nestjs-keycloak-auth',
+                },
+                timeout: 10000,
+            }));
+            const endpoints = {
+                jwks_uri: data.jwks_uri ||
+                    `${realmUrl}/protocol/openid-connect/certs`,
+                token_endpoint: data.token_endpoint ||
+                    `${realmUrl}/protocol/openid-connect/token`,
+                introspection_endpoint: data.introspection_endpoint ||
+                    `${realmUrl}/protocol/openid-connect/token/introspect`,
+                userinfo_endpoint: data.userinfo_endpoint ||
+                    `${realmUrl}/protocol/openid-connect/userinfo`,
+                end_session_endpoint: data.end_session_endpoint ||
+                    `${realmUrl}/protocol/openid-connect/logout`,
+            };
+            this.cache.set(realmUrl, { endpoints, fetchedAt: Date.now() });
+            return endpoints;
+        });
+    }
+    /**
+    * Clear all cached discovery metadata.
+    */
+    clearCache() {
+        this.cache.clear();
+    }
+};
+exports.OidcDiscoveryService = OidcDiscoveryService;
+exports.OidcDiscoveryService = OidcDiscoveryService = OidcDiscoveryService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [axios_1.HttpService])
+], OidcDiscoveryService);

package/dist/services/token-validation.service.d.ts

@@ -0,0 +1,29 @@
+import { JwksCacheService } from './jwks-cache.service';
+import { KeycloakHttpService } from './keycloak-http.service';
+import { KeycloakAuthConfig } from '../interface/keycloak-auth-options.interface';
+export declare class TokenValidationService {
+    private readonly keycloakOpts;
+    private readonly keycloakHttp;
+    private readonly jwksCache;
+    private readonly logger;
+    private readonly publicKey;
+    private _notBefore;
+    private readonly notBeforeByRealm;
+    constructor(keycloakOpts: KeycloakAuthConfig, keycloakHttp: KeycloakHttpService, jwksCache: JwksCacheService);
+    get notBefore(): number;
+    set notBefore(value: number);
+    getNotBefore(realmUrl?: string): number;
+    setNotBefore(value: number, realmUrl?: string): void;
+    /**
+    * Validate a token online via the Keycloak introspection endpoint.
+    */
+    validateOnline(jwt: string, realmUrl: string, clientId: string, secret: string): Promise<boolean>;
+    private static readonly ALLOWED_ALGS;
+    /**
+    * Validate a token offline by verifying signature via JWKS and checking
+    * expiry, type, notBefore, issuer, audience, azp, and signature.
+    * Matches keycloak-connect's GrantManager.validateToken() logic.
+    */
+    validateOffline(jwt: string, realmUrl: string, clientId?: string, expectedType?: string): Promise<boolean>;
+    private verifySignature;
+}

package/dist/services/token-validation.service.js

@@ -0,0 +1,215 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var TokenValidationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenValidationService = void 0;
+const crypto = __importStar(require("crypto"));
+const jwks_cache_service_1 = require("./jwks-cache.service");
+const constants_1 = require("../constants");
+const keycloak_token_1 = require("../token/keycloak-token");
+const keycloak_http_service_1 = require("./keycloak-http.service");
+const common_1 = require("@nestjs/common");
+let TokenValidationService = TokenValidationService_1 = class TokenValidationService {
+    constructor(keycloakOpts, keycloakHttp, jwksCache) {
+        var _a;
+        this.keycloakOpts = keycloakOpts;
+        this.keycloakHttp = keycloakHttp;
+        this.jwksCache = jwksCache;
+        this.logger = new common_1.Logger(TokenValidationService_1.name);
+        this._notBefore = 0;
+        this.notBeforeByRealm = new Map();
+        // Format static realm public key if provided (matches keycloak-connect config.js)
+        const plainKey = (_a = this.keycloakOpts.realmPublicKey) !== null && _a !== void 0 ? _a : this.keycloakOpts['realm-public-key'];
+        if (plainKey) {
+            let pem = '-----BEGIN PUBLIC KEY-----\n';
+            for (let i = 0; i < plainKey.length; i += 64) {
+                pem += plainKey.substring(i, i + 64) + '\n';
+            }
+            pem += '-----END PUBLIC KEY-----';
+            this.publicKey = pem;
+        }
+    }
+    get notBefore() {
+        return this._notBefore;
+    }
+    set notBefore(value) {
+        this._notBefore = value;
+    }
+    getNotBefore(realmUrl) {
+        var _a;
+        if (!realmUrl) {
+            return this._notBefore;
+        }
+        return (_a = this.notBeforeByRealm.get(realmUrl)) !== null && _a !== void 0 ? _a : this._notBefore;
+    }
+    setNotBefore(value, realmUrl) {
+        if (!realmUrl) {
+            this._notBefore = value;
+            return;
+        }
+        this.notBeforeByRealm.set(realmUrl, value);
+    }
+    /**
+    * Validate a token online via the Keycloak introspection endpoint.
+    */
+    validateOnline(jwt, realmUrl, clientId, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const result = yield this.keycloakHttp.introspectToken(realmUrl, clientId, secret, jwt);
+                return result.active === true;
+            }
+            catch (ex) {
+                this.logger.warn(`Online token validation failed: ${ex}`);
+                return false;
+            }
+        });
+    }
+    /**
+    * Validate a token offline by verifying signature via JWKS and checking
+    * expiry, type, notBefore, issuer, audience, azp, and signature.
+    * Matches keycloak-connect's GrantManager.validateToken() logic.
+    */
+    validateOffline(jwt_1, realmUrl_1, clientId_1) {
+        return __awaiter(this, arguments, void 0, function* (jwt, realmUrl, clientId, expectedType = 'Bearer') {
+            var _a, _b;
+            try {
+                const token = new keycloak_token_1.KeycloakToken(jwt);
+                // Check token exists and is parseable (signed portion present)
+                if (!token.signed) {
+                    this.logger.verbose('invalid token (not signed)');
+                    return false;
+                }
+                // Check expiry
+                if (token.isExpired()) {
+                    this.logger.verbose('invalid token (expired)');
+                    return false;
+                }
+                // Check token type matches expected
+                if (token.content.typ !== expectedType) {
+                    this.logger.verbose(`invalid token (wrong type): expected ${expectedType}, got ${token.content.typ}`);
+                    return false;
+                }
+                // Check notBefore policy (stale token)
+                const realmNotBefore = this.getNotBefore(realmUrl);
+                if (token.content.iat < realmNotBefore) {
+                    this.logger.verbose(`invalid token (stale token): iat ${token.content.iat} < notBefore ${realmNotBefore}`);
+                    return false;
+                }
+                // Check issuer matches realm URL
+                if (token.content.iss !== realmUrl) {
+                    this.logger.verbose(`invalid token (wrong ISS): ${token.content.iss} !== ${realmUrl}`);
+                    return false;
+                }
+                // Audience and azp checks (matches keycloak-connect logic)
+                const audienceData = Array.isArray(token.content.aud)
+                    ? token.content.aud
+                    : [token.content.aud];
+                // Bearer tokens only check audience if verifyTokenAudience is enabled
+                const verifyAudience = (_b = (_a = this.keycloakOpts.verifyTokenAudience) !== null && _a !== void 0 ? _a : this.keycloakOpts['verify-token-audience']) !== null && _b !== void 0 ? _b : false;
+                if (verifyAudience && clientId && !audienceData.includes(clientId)) {
+                    this.logger.verbose(`invalid token (wrong audience): ${JSON.stringify(token.content.aud)} does not include ${clientId}`);
+                    return false;
+                }
+                // Verify algorithm is on the allowlist (prevent algorithm confusion attacks)
+                const alg = token.header.alg || 'RS256';
+                if (!TokenValidationService_1.ALLOWED_ALGS.has(alg)) {
+                    this.logger.verbose(`invalid token (unsupported alg): ${alg}`);
+                    return false;
+                }
+                if (this.publicKey) {
+                    // Use static public key if configured
+                    if (!this.verifySignature(token.signed, token.signature, this.publicKey, alg)) {
+                        this.logger.verbose('invalid token (signature)');
+                        return false;
+                    }
+                    return true;
+                }
+                // Otherwise use JWKS rotation
+                const kid = token.header.kid;
+                if (!kid) {
+                    this.logger.warn('Token has no kid in header');
+                    return false;
+                }
+                const key = yield this.jwksCache.getKey(realmUrl, kid);
+                if (!this.verifySignature(token.signed, token.signature, key, alg)) {
+                    this.logger.verbose('invalid token (public key signature)');
+                    return false;
+                }
+                return true;
+            }
+            catch (ex) {
+                this.logger.warn(`Offline token validation failed: ${ex}`);
+                return false;
+            }
+        });
+    }
+    verifySignature(signed, signature, key, jwtAlg) {
+        const hashMap = {
+            RS256: 'SHA256', RS384: 'SHA384', RS512: 'SHA512',
+            ES256: 'SHA256', ES384: 'SHA384', ES512: 'SHA512',
+            PS256: 'SHA256', PS384: 'SHA384', PS512: 'SHA512',
+        };
+        const hash = hashMap[jwtAlg] || 'SHA256';
+        const keyObj = typeof key === 'string' ? crypto.createPublicKey(key) : key;
+        if (jwtAlg.startsWith('PS')) {
+            return crypto.verify(hash, Buffer.from(signed), { key: keyObj, padding: crypto.constants.RSA_PKCS1_PSS_PADDING }, signature);
+        }
+        // crypto.verify() auto-detects key type (RSA vs EC) from the KeyObject
+        return crypto.verify(hash, Buffer.from(signed), keyObj, signature);
+    }
+};
+exports.TokenValidationService = TokenValidationService;
+TokenValidationService.ALLOWED_ALGS = new Set([
+    'RS256', 'RS384', 'RS512',
+    'ES256', 'ES384', 'ES512',
+    'PS256', 'PS384', 'PS512',
+]);
+exports.TokenValidationService = TokenValidationService = TokenValidationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __metadata("design:paramtypes", [Object, keycloak_http_service_1.KeycloakHttpService,
+        jwks_cache_service_1.JwksCacheService])
+], TokenValidationService);

package/dist/token/keycloak-grant.d.ts

@@ -0,0 +1,24 @@
+import { KeycloakToken } from './keycloak-token';
+/**
+ * Represents a Keycloak grant containing an access token.
+ */
+export declare class KeycloakGrant {
+    access_token: KeycloakToken | undefined;
+    token_type: string | undefined;
+    expires_in: number | undefined;
+    __raw: string | undefined;
+    constructor(grant: Partial<KeycloakGrant>);
+    /**
+    * Update this grant in-place given data in another grant.
+    */
+    update(grant: Partial<KeycloakGrant>): void;
+    /**
+    * Returns the raw String of the grant, if available.
+    */
+    toString(): string | undefined;
+    /**
+    * Determine if this grant is expired/out-of-date.
+    * Determination is made based upon the expiration status of the access_token.
+    */
+    isExpired(): boolean;
+}

package/dist/token/keycloak-grant.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakGrant = void 0;
+/**
+ * Represents a Keycloak grant containing an access token.
+ */
+class KeycloakGrant {
+    constructor(grant) {
+        this.update(grant);
+    }
+    /**
+    * Update this grant in-place given data in another grant.
+    */
+    update(grant) {
+        this.access_token = grant.access_token;
+        this.token_type = grant.token_type;
+        this.expires_in = grant.expires_in;
+        this.__raw = grant.__raw;
+    }
+    /**
+    * Returns the raw String of the grant, if available.
+    */
+    toString() {
+        return this.__raw;
+    }
+    /**
+    * Determine if this grant is expired/out-of-date.
+    * Determination is made based upon the expiration status of the access_token.
+    */
+    isExpired() {
+        if (!this.access_token) {
+            return true;
+        }
+        return this.access_token.isExpired();
+    }
+}
+exports.KeycloakGrant = KeycloakGrant;