@curity/jwt-validation/index.d.ts

Curity JWT Validation library

export = JWTValidator;

declare class JWTValidator {
    /**
     * 
     * @param issuer Allowed issuer value or values
     * @param audience Allowed audience value or values
     * @param algorithms Array of allowed signing algorithms
     * @param publicKey The public key or a method for retrieving one
     */
    constructor(issuer: string | string[], audience: string | string[], algorithms: string[], publicKey: JWTValidator.PublicKeySettings);

    /**
     * Decode the given JWT and verify its signature and claims
     * @param jwtString The JWT to be verified
     * @param options Options for the verification step
     * 
     * @returns Map of claims from the payload part of the JWT.
     */
    verifyJWT(jwtString: string, options: JWTValidator.VerifyJWTOptions): Promise<JWTValidator.JWTPayload>;
}

declare namespace JWTValidator {
    // export function strToUint8Array
    export interface VerifyJWTOptions {        
        /** Pass the access token value if you want to validate the at_hash claim */
        accessToken?: string,
        /** Pass the value of the state parameter to validate the s_hash claim */
        state?: string,
        /** Pass the hashed value of nonce parameter to validate nonce */
        nonce?: string,
        /** If true then the exp claim will not be verified. Defaults to false */
        ignoreExpiration?: boolean,
        /** If true then the nbf claim will not be verified. Defaults to false */
        ignoreNotBefore?: boolean,
        /** Allowed clock skew for time-based claims, in seconds. Defaults to 0 */
        clockTolerance?: number,
        /** If provided then the sub claim must match this value */
        subject?: string,
        /** If provided then the jti claim must match this value */
        jti?: string,
        /** Pass the value of the authorization code parameter to validate the c_hash claim */
        code?: string
    }

    export interface JWTPayload {
        [key: string]: string | object
    }

    /** 
     * The public key for validating JWTs or a method of obtaining one.
     * 
     * For 'jwks_uri' value, JWK will be retrieved from the given JWKS URI.
     * For 'issuer' value, JWK will be retrieved from metadata using the issuer claim to compute metadata endpoint.
     * For 'metadata_url' value, JWK will be retrieved from the given metadata URL.
     * For 'raw' value, you can provide HMAC secret keys in raw format.
     * 
     * */
    export interface PublicKeySettings {
        format: 'issuer' | 'jwk' | 'jwks_uri' | 'pem' | 'metadata_url' | 'raw',
        value: string | null
    }
}