serverless-offline 10.2.0 → 10.2.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "dedicatedTo": "Blue, a great migrating bird.",
   "name": "serverless-offline",
-  "version": "10.2.0",
+  "version": "10.2.1",
   "description": "Emulate AWS λ and API Gateway locally when developing your Serverless project",
   "license": "MIT",
   "exports": {
@@ -92,10 +92,10 @@
     "execa": "^6.1.0",
     "fs-extra": "^10.1.0",
     "java-invoke-local": "0.0.6",
+    "jose": "^4.9.3",
     "js-string-escape": "^1.0.1",
     "jsonpath-plus": "^7.2.0",
     "jsonschema": "^1.4.1",
-    "jsonwebtoken": "^8.5.1",
     "jszip": "^3.10.1",
     "luxon": "^3.0.3",
     "node-fetch": "^3.2.10",

package/src/ServerlessOffline.js

@@ -65,9 +65,9 @@ export default class ServerlessOffline {
     const { httpEvents, lambdas, scheduleEvents, webSocketEvents } =
       this.#getEvents()
 
-    // if (lambdas.length > 0) {
-    await this.#createLambda(lambdas)
-    // }
+    if (lambdas.length > 0) {
+      await this.#createLambda(lambdas)
+    }
 
     const eventModules = []
 

package/src/events/http/HttpServer.js

@@ -440,7 +440,7 @@ export default class HttpServer {
             !this.#apiKeysValues.has(apiKey)
           ) {
             log.debug(
-              `Method ${method} of function ${functionKey} token ${apiKey} not valid`,
+              `Method '${method}' of function '${functionKey}' token '${apiKey}' not valid.`,
             )
 
             return errorResponse()
@@ -452,15 +452,18 @@ export default class HttpServer {
         ) {
           const { usageIdentifierKey } = request.auth.credentials
 
-          if (usageIdentifierKey !== this.#options.apiKey) {
+          if (
+            usageIdentifierKey !== this.#options.apiKey &&
+            !this.#apiKeysValues.has(usageIdentifierKey)
+          ) {
             log.debug(
-              `Method ${method} of function ${functionKey} token ${usageIdentifierKey} not valid`,
+              `Method '${method}' of function '${functionKey}' token '${usageIdentifierKey}' not valid.`,
             )
 
             return errorResponse()
           }
         } else {
-          log.debug(`Missing x-api-key on private function ${functionKey}`)
+          log.debug(`Missing 'x-api-key' on private function '${functionKey}'.`)
 
           return errorResponse()
         }

package/src/events/http/createJWTAuthScheme.js

@@ -1,6 +1,6 @@
 import Boom from '@hapi/boom'
 import { log } from '@serverless/utils/log.js'
-import { decode } from 'jsonwebtoken'
+import { decodeJwt } from 'jose'
 
 const { isArray } = Array
 
@@ -35,18 +35,14 @@ export default function createAuthScheme(jwtOptions) {
       }
 
       try {
-        const decoded = decode(jwtToken, { complete: true })
-        if (!decoded) {
-          return Boom.unauthorized('JWT not decoded')
-        }
+        const claims = decodeJwt(jwtToken)
 
-        const expirationDate = new Date(decoded.payload.exp * 1000)
+        const expirationDate = new Date(claims.exp * 1000)
         if (expirationDate.valueOf() < Date.now()) {
           return Boom.unauthorized('JWT Token expired')
         }
 
-        const { aud, iss, scope } = decoded.payload
-        const clientId = decoded.payload.client_id
+        const { aud, iss, scope, client_id: clientId } = claims
         if (iss !== jwtOptions.issuerUrl) {
           log.notice(`JWT Token not from correct issuer url`)
 
@@ -91,7 +87,7 @@ export default function createAuthScheme(jwtOptions) {
         // return resolve(
         return h.authenticated({
           credentials: {
-            claims: decoded.payload,
+            claims,
             scopes,
           },
         })

package/src/events/http/lambda-events/LambdaProxyIntegrationEvent.js

@@ -1,7 +1,7 @@
 import { Buffer } from 'node:buffer'
 import { env } from 'node:process'
 import { log } from '@serverless/utils/log.js'
-import { decode } from 'jsonwebtoken'
+import { decodeJwt } from 'jose'
 import {
   createUniqueId,
   formatToClfTime,
@@ -122,8 +122,8 @@ export default class LambdaProxyIntegrationEvent {
 
     if (token) {
       try {
-        claims = decode(token) || undefined
-        if (claims && claims.scope) {
+        claims = decodeJwt(token)
+        if (claims.scope) {
           scopes = claims.scope.split(' ')
           // In AWS HTTP Api the scope property is removed from the decoded JWT
           // I'm leaving this property because I'm not sure how all of the authorizers

package/src/events/http/lambda-events/LambdaProxyIntegrationEventV2.js

@@ -1,7 +1,7 @@
 import { Buffer } from 'node:buffer'
 import { env } from 'node:process'
 import { log } from '@serverless/utils/log.js'
-import { decode } from 'jsonwebtoken'
+import { decodeJwt } from 'jose'
 import {
   formatToClfTime,
   lowerCaseKeys,
@@ -105,8 +105,8 @@ export default class LambdaProxyIntegrationEventV2 {
 
     if (token) {
       try {
-        claims = decode(token) || undefined
-        if (claims && claims.scope) {
+        claims = decodeJwt(token)
+        if (claims.scope) {
           scopes = claims.scope.split(' ')
           // In AWS HTTP Api the scope property is removed from the decoded JWT
           // I'm leaving this property because I'm not sure how all of the authorizers

package/src/events/http/lambda-events/VelocityContext.js

@@ -1,7 +1,7 @@
 import { Buffer } from 'node:buffer'
 import { env } from 'node:process'
 import jsEscapeString from 'js-string-escape'
-import { decode } from 'jsonwebtoken'
+import { decodeJwt } from 'jose'
 import {
   createUniqueId,
   isPlainObject,
@@ -83,10 +83,7 @@ export default class VelocityContext {
 
     if (token) {
       try {
-        const claims = decode(token) || undefined
-        if (claims) {
-          assign(authorizer, { claims })
-        }
+        assign(authorizer, { claims: decodeJwt(token) })
       } catch {
         // Nothing
       }

package/src/events/websocket/HttpServer.js

@@ -30,7 +30,7 @@ export default class HttpServer {
   }
 
   async createServer() {
-    const { host, websocketPort, httpsProtocol } = this.#options
+    const { host, httpsProtocol, websocketPort } = this.#options
 
     const serverOptions = {
       host,