nestjs-keycloak-auth 1.1.0 → 1.1.1

package/README.md

@@ -64,6 +64,7 @@ KeycloakAuthModule.register({
   policyEnforcement: PolicyEnforcementMode.PERMISSIVE, // optional
   tokenValidation: TokenValidation.ONLINE, // optional
   backchannelLogoutTtlMs: 24 * 60 * 60 * 1000, // optional, defaults to 24 hours
+  clockSkewSec: 5, // optional, defaults to 0; used by OFFLINE expiration checks
 });
 ```
 
@@ -100,6 +101,7 @@ export class KeycloakConfigService implements KeycloakAuthOptionsFactory {
       policyEnforcement: PolicyEnforcementMode.PERMISSIVE,
       tokenValidation: TokenValidation.ONLINE,
       backchannelLogoutTtlMs: 24 * 60 * 60 * 1000,
+      clockSkewSec: 5,
     };
   }
 }
@@ -348,13 +350,14 @@ Current test setup uses Jest + ts-jest and is configured to enforce 100% global
 
 ### Nest Keycloak Options
 
-| Option            | Description                                                                | Required | Default    |
-| ----------------- | -------------------------------------------------------------------------- | -------- | ---------- |
-| policyEnforcement | Sets the policy enforcement mode                                           | no       | PERMISSIVE |
-| tokenValidation   | Sets the token validation method                                           | no       | ONLINE     |
-| multiTenant       | Sets options for [multi-tenant configuration](#multi-tenant-configuration) | no       | -          |
-| roleMerge         | Sets the merge mode for `@Roles` decorator                                | no       | OVERRIDE   |
-| backchannelLogoutTtlMs | TTL for in-memory back-channel logout revocation entries in milliseconds | no | 86400000 |
+| Option                 | Description                                                              | Required | Default    |
+| ---------------------- | ------------------------------------------------------------------------ | -------- | ---------- |
+| policyEnforcement      | Sets the policy enforcement mode                                         | no       | PERMISSIVE |
+| tokenValidation        | Sets the token validation method                                         | no       | ONLINE     |
+| multiTenant            | Sets options for multi-tenant configuration                              | no       | -          |
+| roleMerge              | Sets the merge mode for `@Roles` decorator                               | no       | OVERRIDE   |
+| backchannelLogoutTtlMs | TTL for in-memory back-channel logout revocation entries in milliseconds | no       | 86400000   |
+| clockSkewSec           | Allowed clock skew for OFFLINE token expiration checks in seconds        | no       | 0          |
 
 ### Common Keycloak Config Fields
 

package/dist/interface/keycloak-auth-options.interface.d.ts

@@ -50,6 +50,11 @@ export interface NestKeycloakConfig {
      * Defaults to 24 hours.
      */
     backchannelLogoutTtlMs?: number;
+    /**
+     * Allowed clock skew for OFFLINE token expiration checks in seconds.
+     * Defaults to 0.
+     */
+    clockSkewSec?: number;
 }
 /**
  * Keycloak Connect options.

package/dist/services/token-validation.service.d.ts

@@ -26,4 +26,5 @@ export declare class TokenValidationService {
     */
     validateOffline(jwt: string, realmUrl: string, clientId?: string, expectedType?: string): Promise<boolean>;
     private verifySignature;
+    private getClockSkewSec;
 }

package/dist/services/token-validation.service.js

@@ -123,7 +123,7 @@ let TokenValidationService = TokenValidationService_1 = class TokenValidationSer
                     return false;
                 }
                 // Check expiry
-                if (token.isExpired()) {
+                if (token.isExpired(this.getClockSkewSec())) {
                     this.logger.verbose('invalid token (expired)');
                     return false;
                 }
@@ -200,6 +200,12 @@ let TokenValidationService = TokenValidationService_1 = class TokenValidationSer
         // crypto.verify() auto-detects key type (RSA vs EC) from the KeyObject
         return crypto.verify(hash, Buffer.from(signed), keyObj, signature);
     }
+    getClockSkewSec() {
+        const clockSkewSec = this.keycloakOpts.clockSkewSec;
+        return typeof clockSkewSec === 'number' && Number.isFinite(clockSkewSec) && clockSkewSec > 0
+            ? clockSkewSec
+            : 0;
+    }
 };
 exports.TokenValidationService = TokenValidationService;
 TokenValidationService.ALLOWED_ALGS = new Set([

package/dist/token/keycloak-token.d.ts

@@ -49,7 +49,7 @@ export declare class KeycloakToken {
     * Check if the token is expired.
     * Matches keycloak-connect's behavior: exp=0 is considered expired.
     */
-    isExpired(): boolean;
+    isExpired(clockSkewSec?: number): boolean;
     /**
     * Get the raw JWT string.
     */

package/dist/token/keycloak-token.js

@@ -92,8 +92,8 @@ class KeycloakToken {
     * Check if the token is expired.
     * Matches keycloak-connect's behavior: exp=0 is considered expired.
     */
-    isExpired() {
-        return this.content.exp * 1000 < Date.now();
+    isExpired(clockSkewSec = 0) {
+        return (this.content.exp + clockSkewSec) * 1000 < Date.now();
     }
     /**
     * Get the raw JWT string.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nestjs-keycloak-auth",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Keycloak authentication and authorization module for NestJS",
   "author": "B. Joshua Adedigba",
   "contributors": [