@backstage/backend-defaults/dist/entrypoints/auth/external/jwks.cjs.js

Backend defaults used by Backstage backend apps

'use strict';

var jose = require('jose');
var helpers = require('./helpers.cjs.js');

class JWKSHandler {
  #entries = [];
  add(config) {
    if (!config.getString("options.url").match(/^\S+$/)) {
      throw new Error(
        "Illegal JWKS URL, must be a set of non-space characters"
      );
    }
    const algorithms = helpers.readStringOrStringArrayFromConfig(
      config,
      "options.algorithm"
    );
    const issuers = helpers.readStringOrStringArrayFromConfig(config, "options.issuer");
    const audiences = helpers.readStringOrStringArrayFromConfig(
      config,
      "options.audience"
    );
    const subjectPrefix = config.getOptionalString("options.subjectPrefix");
    const url = new URL(config.getString("options.url"));
    const jwks = jose.createRemoteJWKSet(url);
    const allAccessRestrictions = helpers.readAccessRestrictionsFromConfig(config);
    this.#entries.push({
      algorithms,
      audiences,
      issuers,
      jwks,
      subjectPrefix,
      url,
      allAccessRestrictions
    });
  }
  async verifyToken(token) {
    for (const entry of this.#entries) {
      try {
        const {
          payload: { sub }
        } = await jose.jwtVerify(token, entry.jwks, {
          algorithms: entry.algorithms,
          issuer: entry.issuers,
          audience: entry.audiences
        });
        if (sub) {
          const prefix = entry.subjectPrefix ? `external:${entry.subjectPrefix}:` : "external:";
          return {
            subject: `${prefix}${sub}`,
            allAccessRestrictions: entry.allAccessRestrictions
          };
        }
      } catch {
        continue;
      }
    }
    return void 0;
  }
}

exports.JWKSHandler = JWKSHandler;
//# sourceMappingURL=jwks.cjs.js.map