import * as jose from "https://deno.land/x/jose@v5.2.2/index.ts"; import type { MaybePromise } from "https://esm.town/v/postpostscript/typeUtils"; export type { JWK, JWTPayload } from "https://deno.land/x/jose@v5.2.2/index.ts"; import { getValEndpointFromName, getValNameFromUrl } from "https://esm.town/v/postpostscript/meta"; import { trackUse } from "https://esm.town/v/postpostscript/trackUse"; export type JWTCustomClaims = Record; export type JWTVerifyOptions = jose.JWTVerifyOptions & { custom?: Record | ((payload: jose.JWTPayload) => MaybePromise>); customClaimVerifiers?: Record; }; export type JWTCustomClaimVerifier = (payload: jose.JWTPayload, claim: unknown) => MaybePromise; export function createVerifyMethod(keys: () => MaybePromise) { return async function verify( token: string, options: JWTVerifyOptions, ) { const publicKey = await jose.importJWK((await keys())[0]); const { payload } = await jose.jwtVerify(token, publicKey, options); const customClaims = options.custom && ( options.custom instanceof Function ? await options.custom(payload) : options.custom ); await verifyCustomClaims(payload, customClaims || {}, options.customClaimVerifiers ?? defaultCustomClaimVerifiers); return payload; }; } export function createGenerateMethod(keys: () => MaybePromise) { return async function generate(payload: any, exp?: string | number | Date) { const _keys = await keys(); const privateKey = await jose.importJWK(_keys[0]); let jwt = new jose.SignJWT({ jti: crypto.randomUUID(), ...payload, }) .setProtectedHeader({ alg: _keys[0].alg }) .setIssuedAt(); if (exp) { jwt = jwt.setExpirationTime(exp); } return jwt.sign(privateKey); }; } export async function verifyThirdParty( token: string, options: JWTVerifyOptions = {}, ) { const payload = decode(token); const author = payload.iss?.match(/^@(\w+)\/\w+$/)?.[1]; if (!author) { throw new Error("issuer does not match the format `@handle/name`"); } if (payload.exp && payload.exp < (new Date().getTime() / 1000)) { throw new Error("token has expired"); } const url = getValEndpointFromName(`@${author}/jwks`); const method = createVerifyMethod(() => { return fetch(url) .then(res => res.json()) .then(({ keys }) => keys); }); return method(token, options); } export function decode(token: string) { return jose.decodeJwt(token); } export const defaultCustomClaimVerifiers: Record = { scope(payload, claimValue) { const scopes = claimValue instanceof Array ? claimValue : [claimValue]; const payloadScopes = typeof payload.scope === "string" ? payload.scope.split(" ") : payload.scope; if (!(payloadScopes instanceof Array)) { return false; } const payloadScopesSet = new Set(payloadScopes); return scopes.every(scope => payloadScopesSet.has(scope)); }, async maxUses(payload, claimValue) { if (typeof claimValue !== "number") { throw new Error("option custom.maxUses must be a number"); } if (!payload.jti) { throw new Error("payload `jti` is not set"); } await trackUse({ value: payload.jti, max: claimValue, delete_after: payload.exp, }); return true; }, }; export class JWTCustomClaimVerificationFailed extends Error { failures: Record; constructor(message: string, failures: Record, options: ErrorOptions = {}) { super(message, options); this.failures = failures; } } export async function verifyCustomClaims( payload, customClaims: Record, customClaimVerifiers = defaultCustomClaimVerifiers, ) { const failures: { [key in keyof typeof customClaims]: string | Error | undefined; } = {}; const results = await Promise.all( Object.entries(customClaims).map(async ([key, value]) => { if (!(key in customClaimVerifiers)) { failures[key] = `custom claim "${key}" does not have a verifier defined`; return false; } try { const res = await customClaimVerifiers[key](payload, value); if (!res) { failures[key] = `custom claim "${key}" verification failed for an undisclosed reason`; } return res; } catch (e) { failures[key] = e; } return false; }), ); if (results.every(Boolean)) { return true; } const failedKeys = Object.keys(failures); throw new JWTCustomClaimVerificationFailed(`claim verifications failed: ${JSON.stringify(failedKeys)}`, failures); }