sprint-es 0.0.46 → 0.0.48
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -7,12 +7,12 @@ const decodeBase64Url = (str) => Buffer.from(str, "base64url").toString("utf8");
|
|
|
7
7
|
const ALGORITHM = "ES256";
|
|
8
8
|
const ENCRYPTION_ALGORITHM = "aes-256-gcm";
|
|
9
9
|
function generateKeyPair() {
|
|
10
|
-
const { publicKey, privateKey } = crypto.generateKeyPairSync("ec", {
|
|
10
|
+
const { publicKey: publicKey2, privateKey: privateKey2 } = crypto.generateKeyPairSync("ec", {
|
|
11
11
|
namedCurve: "prime256v1",
|
|
12
12
|
publicKeyEncoding: { type: "spki", format: "pem" },
|
|
13
13
|
privateKeyEncoding: { type: "pkcs8", format: "pem" }
|
|
14
14
|
});
|
|
15
|
-
return { publicKey, privateKey };
|
|
15
|
+
return { publicKey: publicKey2, privateKey: privateKey2 };
|
|
16
16
|
}
|
|
17
17
|
function parseExpiry(expiresIn) {
|
|
18
18
|
if (typeof expiresIn === "number") return expiresIn;
|
|
@@ -55,7 +55,7 @@ function decryptPayload(data, secret) {
|
|
|
55
55
|
decipher.setAuthTag(tag);
|
|
56
56
|
return decipher.update(ciphertext).toString("utf8") + decipher.final("utf8");
|
|
57
57
|
}
|
|
58
|
-
function sign(payload,
|
|
58
|
+
function sign(payload, privateKey2, options = {}) {
|
|
59
59
|
const header = { alg: ALGORITHM, typ: "JWT" };
|
|
60
60
|
const claims = buildClaims(payload, options);
|
|
61
61
|
const encodedHeader = base64UrlEncode(Buffer.from(JSON.stringify(header)));
|
|
@@ -63,17 +63,17 @@ function sign(payload, privateKey, options = {}) {
|
|
|
63
63
|
const signingInput = `${encodedHeader}.${encodedPayload}`;
|
|
64
64
|
const signer = crypto.createSign("SHA256");
|
|
65
65
|
signer.update(signingInput);
|
|
66
|
-
const signature = signer.sign(
|
|
66
|
+
const signature = signer.sign(privateKey2);
|
|
67
67
|
return `${signingInput}.${base64UrlEncode(signature)}`;
|
|
68
68
|
}
|
|
69
|
-
function verify(token,
|
|
69
|
+
function verify(token, publicKey2) {
|
|
70
70
|
try {
|
|
71
71
|
const parts = token.split(".");
|
|
72
72
|
if (parts.length !== 3) return null;
|
|
73
73
|
const [encodedHeader, encodedPayload, encodedSignature] = parts;
|
|
74
74
|
const verifier = crypto.createVerify("SHA256");
|
|
75
75
|
verifier.update(`${encodedHeader}.${encodedPayload}`);
|
|
76
|
-
const isValid = verifier.verify(
|
|
76
|
+
const isValid = verifier.verify(publicKey2, base64UrlDecode(encodedSignature));
|
|
77
77
|
if (!isValid) return null;
|
|
78
78
|
const payload = JSON.parse(decodeBase64Url(encodedPayload));
|
|
79
79
|
const now = Math.floor(Date.now() / 1e3);
|
|
@@ -83,39 +83,39 @@ function verify(token, publicKey) {
|
|
|
83
83
|
return null;
|
|
84
84
|
}
|
|
85
85
|
}
|
|
86
|
-
function signEncrypted(payload,
|
|
87
|
-
const encrypted = encryptPayload(JSON.stringify(payload),
|
|
88
|
-
return `sprx_${sign({ enc: encrypted },
|
|
86
|
+
function signEncrypted(payload, privateKey2, encryptionSecret2, options = {}) {
|
|
87
|
+
const encrypted = encryptPayload(JSON.stringify(payload), encryptionSecret2);
|
|
88
|
+
return `sprx_${sign({ enc: encrypted }, privateKey2, options).slice(2)}`;
|
|
89
89
|
}
|
|
90
|
-
function verifyEncrypted(token,
|
|
90
|
+
function verifyEncrypted(token, publicKey2, encryptionSecret2) {
|
|
91
91
|
if (!token.startsWith("sprx_")) return null;
|
|
92
|
-
const verified = verify(`ey${token.slice(5)}`,
|
|
92
|
+
const verified = verify(`ey${token.slice(5)}`, publicKey2);
|
|
93
93
|
if (!verified?.enc || typeof verified.enc !== "string") return null;
|
|
94
94
|
try {
|
|
95
|
-
return JSON.parse(decryptPayload(verified.enc,
|
|
95
|
+
return JSON.parse(decryptPayload(verified.enc, encryptionSecret2));
|
|
96
96
|
} catch {
|
|
97
97
|
return null;
|
|
98
98
|
}
|
|
99
99
|
}
|
|
100
|
-
function createTokenPair(payload,
|
|
101
|
-
const accessToken = sign(payload,
|
|
100
|
+
function createTokenPair(payload, privateKey2, options = {}) {
|
|
101
|
+
const accessToken = sign(payload, privateKey2, options);
|
|
102
102
|
const refreshToken = sign(
|
|
103
103
|
{ sub: payload.sub ?? payload.id, type: "refresh" },
|
|
104
|
-
|
|
104
|
+
privateKey2,
|
|
105
105
|
{ expiresIn: "7d", issuer: options.issuer }
|
|
106
106
|
);
|
|
107
107
|
return { accessToken, refreshToken };
|
|
108
108
|
}
|
|
109
|
-
function verifyTokenPair(accessToken, refreshToken,
|
|
109
|
+
function verifyTokenPair(accessToken, refreshToken, publicKey2) {
|
|
110
110
|
return {
|
|
111
|
-
accessToken: verify(accessToken,
|
|
112
|
-
refreshToken: verify(refreshToken,
|
|
111
|
+
accessToken: verify(accessToken, publicKey2),
|
|
112
|
+
refreshToken: verify(refreshToken, publicKey2)
|
|
113
113
|
};
|
|
114
114
|
}
|
|
115
|
+
let publicKey = process.env.JWT_PUBLIC_KEY;
|
|
116
|
+
let privateKey = process.env.JWT_PRIVATE_KEY;
|
|
117
|
+
let encryptionSecret = process.env.JWT_ENCRYPTION_SECRET;
|
|
115
118
|
function getJwtFromEnv() {
|
|
116
|
-
let publicKey = process.env.JWT_PUBLIC_KEY;
|
|
117
|
-
let privateKey = process.env.JWT_PRIVATE_KEY;
|
|
118
|
-
let encryptionSecret = process.env.JWT_ENCRYPTION_SECRET;
|
|
119
119
|
if (!publicKey || !privateKey || !encryptionSecret) throw new Error("JWT keys not configured. Run 'npm run generate:keys' and add the keys to your .env file.");
|
|
120
120
|
const normalize = (k) => k.replace(/^['"]|['"]$/g, "").replace(/\\n/g, "\n");
|
|
121
121
|
return { publicKey: normalize(publicKey), privateKey: normalize(privateKey), encryptionSecret };
|
|
@@ -5,12 +5,12 @@ const decodeBase64Url = (str) => Buffer.from(str, "base64url").toString("utf8");
|
|
|
5
5
|
const ALGORITHM = "ES256";
|
|
6
6
|
const ENCRYPTION_ALGORITHM = "aes-256-gcm";
|
|
7
7
|
function generateKeyPair() {
|
|
8
|
-
const { publicKey, privateKey } = crypto__default.generateKeyPairSync("ec", {
|
|
8
|
+
const { publicKey: publicKey2, privateKey: privateKey2 } = crypto__default.generateKeyPairSync("ec", {
|
|
9
9
|
namedCurve: "prime256v1",
|
|
10
10
|
publicKeyEncoding: { type: "spki", format: "pem" },
|
|
11
11
|
privateKeyEncoding: { type: "pkcs8", format: "pem" }
|
|
12
12
|
});
|
|
13
|
-
return { publicKey, privateKey };
|
|
13
|
+
return { publicKey: publicKey2, privateKey: privateKey2 };
|
|
14
14
|
}
|
|
15
15
|
function parseExpiry(expiresIn) {
|
|
16
16
|
if (typeof expiresIn === "number") return expiresIn;
|
|
@@ -53,7 +53,7 @@ function decryptPayload(data, secret) {
|
|
|
53
53
|
decipher.setAuthTag(tag);
|
|
54
54
|
return decipher.update(ciphertext).toString("utf8") + decipher.final("utf8");
|
|
55
55
|
}
|
|
56
|
-
function sign(payload,
|
|
56
|
+
function sign(payload, privateKey2, options = {}) {
|
|
57
57
|
const header = { alg: ALGORITHM, typ: "JWT" };
|
|
58
58
|
const claims = buildClaims(payload, options);
|
|
59
59
|
const encodedHeader = base64UrlEncode(Buffer.from(JSON.stringify(header)));
|
|
@@ -61,17 +61,17 @@ function sign(payload, privateKey, options = {}) {
|
|
|
61
61
|
const signingInput = `${encodedHeader}.${encodedPayload}`;
|
|
62
62
|
const signer = crypto__default.createSign("SHA256");
|
|
63
63
|
signer.update(signingInput);
|
|
64
|
-
const signature = signer.sign(
|
|
64
|
+
const signature = signer.sign(privateKey2);
|
|
65
65
|
return `${signingInput}.${base64UrlEncode(signature)}`;
|
|
66
66
|
}
|
|
67
|
-
function verify(token,
|
|
67
|
+
function verify(token, publicKey2) {
|
|
68
68
|
try {
|
|
69
69
|
const parts = token.split(".");
|
|
70
70
|
if (parts.length !== 3) return null;
|
|
71
71
|
const [encodedHeader, encodedPayload, encodedSignature] = parts;
|
|
72
72
|
const verifier = crypto__default.createVerify("SHA256");
|
|
73
73
|
verifier.update(`${encodedHeader}.${encodedPayload}`);
|
|
74
|
-
const isValid = verifier.verify(
|
|
74
|
+
const isValid = verifier.verify(publicKey2, base64UrlDecode(encodedSignature));
|
|
75
75
|
if (!isValid) return null;
|
|
76
76
|
const payload = JSON.parse(decodeBase64Url(encodedPayload));
|
|
77
77
|
const now = Math.floor(Date.now() / 1e3);
|
|
@@ -81,39 +81,39 @@ function verify(token, publicKey) {
|
|
|
81
81
|
return null;
|
|
82
82
|
}
|
|
83
83
|
}
|
|
84
|
-
function signEncrypted(payload,
|
|
85
|
-
const encrypted = encryptPayload(JSON.stringify(payload),
|
|
86
|
-
return `sprx_${sign({ enc: encrypted },
|
|
84
|
+
function signEncrypted(payload, privateKey2, encryptionSecret2, options = {}) {
|
|
85
|
+
const encrypted = encryptPayload(JSON.stringify(payload), encryptionSecret2);
|
|
86
|
+
return `sprx_${sign({ enc: encrypted }, privateKey2, options).slice(2)}`;
|
|
87
87
|
}
|
|
88
|
-
function verifyEncrypted(token,
|
|
88
|
+
function verifyEncrypted(token, publicKey2, encryptionSecret2) {
|
|
89
89
|
if (!token.startsWith("sprx_")) return null;
|
|
90
|
-
const verified = verify(`ey${token.slice(5)}`,
|
|
90
|
+
const verified = verify(`ey${token.slice(5)}`, publicKey2);
|
|
91
91
|
if (!verified?.enc || typeof verified.enc !== "string") return null;
|
|
92
92
|
try {
|
|
93
|
-
return JSON.parse(decryptPayload(verified.enc,
|
|
93
|
+
return JSON.parse(decryptPayload(verified.enc, encryptionSecret2));
|
|
94
94
|
} catch {
|
|
95
95
|
return null;
|
|
96
96
|
}
|
|
97
97
|
}
|
|
98
|
-
function createTokenPair(payload,
|
|
99
|
-
const accessToken = sign(payload,
|
|
98
|
+
function createTokenPair(payload, privateKey2, options = {}) {
|
|
99
|
+
const accessToken = sign(payload, privateKey2, options);
|
|
100
100
|
const refreshToken = sign(
|
|
101
101
|
{ sub: payload.sub ?? payload.id, type: "refresh" },
|
|
102
|
-
|
|
102
|
+
privateKey2,
|
|
103
103
|
{ expiresIn: "7d", issuer: options.issuer }
|
|
104
104
|
);
|
|
105
105
|
return { accessToken, refreshToken };
|
|
106
106
|
}
|
|
107
|
-
function verifyTokenPair(accessToken, refreshToken,
|
|
107
|
+
function verifyTokenPair(accessToken, refreshToken, publicKey2) {
|
|
108
108
|
return {
|
|
109
|
-
accessToken: verify(accessToken,
|
|
110
|
-
refreshToken: verify(refreshToken,
|
|
109
|
+
accessToken: verify(accessToken, publicKey2),
|
|
110
|
+
refreshToken: verify(refreshToken, publicKey2)
|
|
111
111
|
};
|
|
112
112
|
}
|
|
113
|
+
let publicKey = process.env.JWT_PUBLIC_KEY;
|
|
114
|
+
let privateKey = process.env.JWT_PRIVATE_KEY;
|
|
115
|
+
let encryptionSecret = process.env.JWT_ENCRYPTION_SECRET;
|
|
113
116
|
function getJwtFromEnv() {
|
|
114
|
-
let publicKey = process.env.JWT_PUBLIC_KEY;
|
|
115
|
-
let privateKey = process.env.JWT_PRIVATE_KEY;
|
|
116
|
-
let encryptionSecret = process.env.JWT_ENCRYPTION_SECRET;
|
|
117
117
|
if (!publicKey || !privateKey || !encryptionSecret) throw new Error("JWT keys not configured. Run 'npm run generate:keys' and add the keys to your .env file.");
|
|
118
118
|
const normalize = (k) => k.replace(/^['"]|['"]$/g, "").replace(/\\n/g, "\n");
|
|
119
119
|
return { publicKey: normalize(publicKey), privateKey: normalize(privateKey), encryptionSecret };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/jwt/index.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,UAAU;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,OAAO;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACtB;AAID,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAwDD,wBAAgB,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,GAAG,MAAM,CAa9F;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAoB1E;AAMD,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,GAAG,MAAM,CAGjI;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAU7G;AAID,wBAAgB,eAAe,CAC3B,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,UAAe,GACzB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQ/C;AAED,wBAAgB,eAAe,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAClB;IAAE,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,CAKrE;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/modules/jwt/index.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,UAAU;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,OAAO;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACtB;AAID,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAwDD,wBAAgB,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,GAAG,MAAM,CAa9F;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAoB1E;AAMD,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,GAAG,MAAM,CAGjI;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAU7G;AAID,wBAAgB,eAAe,CAC3B,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,UAAe,GACzB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQ/C;AAED,wBAAgB,eAAe,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAClB;IAAE,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,UAAU,GAAG,IAAI,CAAA;CAAE,CAKrE;AAOD,wBAAgB,aAAa,IAAI;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAKnG"}
|