@kilterset/auth0-actions-testing/dist/mock/api/redirect.js

Test and develop Auth0 Actions or Okta CIC Actions locally.

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.redirectMock = redirectMock;
const assert_1 = require("assert");
const hs256_1 = require("../../jwt/hs256");
function redirectMock(flow, { now: nowValue, request, user }) {
    const now = new Date(nowValue || Date.now());
    const state = {
        target: null,
    };
    const build = (api) => ({
        encodeToken: ({ expiresInSeconds, payload, secret, }) => {
            expiresInSeconds = expiresInSeconds !== null && expiresInSeconds !== void 0 ? expiresInSeconds : 900;
            const claims = Object.assign({ iss: request.hostname, iat: Math.floor(now.getTime() / 1000), exp: Math.floor((now.getTime() + expiresInSeconds * 1000) / 1000), sub: user.user_id, ip: request.ip }, payload);
            return (0, hs256_1.encodeHS256JWT)({ secret, claims });
        },
        sendUserTo: (urlString, options) => {
            const url = new URL(urlString);
            if (options === null || options === void 0 ? void 0 : options.query) {
                for (const [key, value] of Object.entries(options.query)) {
                    url.searchParams.append(key, value);
                }
            }
            const queryParams = Object.fromEntries(url.searchParams.entries());
            state.target = { url, queryParams };
            return api;
        },
        validateToken: ({ tokenParameterName, secret }) => {
            var _a;
            tokenParameterName = tokenParameterName !== null && tokenParameterName !== void 0 ? tokenParameterName : "session_token";
            const params = Object.assign(Object.assign({}, request.query), request.body);
            const tokenValue = params[tokenParameterName];
            (0, assert_1.ok)(tokenParameterName in params, `There is no parameter called '${tokenParameterName}' available in either the POST body or query string.`);
            const [rawHeader, rawClaims, signature] = String(tokenValue).split(".");
            const verify = (condition, message) => {
                (0, assert_1.ok)(condition, `The session token is invalid: ${message}`);
            };
            const [header, claims] = [rawHeader, rawClaims].map((part) => JSON.parse(Buffer.from(part, "base64url").toString()));
            verify(claims.state === params.state, "State in the token does not match the /continue state.");
            const expectedSignature = (0, hs256_1.signHS256)({
                secret,
                body: `${rawHeader}.${rawClaims}`,
            });
            verify(signature === expectedSignature, "Failed signature validation");
            const expectedClaims = ["sub", "iss", "exp", "iat"];
            for (const claim of expectedClaims) {
                verify(claim in claims, "Missing or invalid standard claims");
            }
            verify(((_a = header.typ) === null || _a === void 0 ? void 0 : _a.toUpperCase()) === "JWT", "Unexpected token payload type");
            verify(claims.sub === user.user_id, "The sub claim does not match the user_id.");
            verify(claims.exp > Math.floor(now.getTime() / 1000), "Token has expired.");
            return claims;
        },
    });
    return { state, build };
}
//# sourceMappingURL=redirect.js.map