@theoptimalpartner/jwt-auth-validator
Version:
JWT token validation package with offline JWKS validation and Redis-based token revocation support
207 lines • 9.22 kB
JavaScript
export { JWTValidator } from './jwt-validator.js';
export { JWKSService } from './jwks-service.js';
export { RedisService } from './redis-service.js';
export { TokenBlacklistService } from './token-blacklist-service.js';
export { ApiKeyValidator } from './api-key-validator.js';
export { UserDataService } from './user-data-service.js';
export { SSMService } from './ssm-service.js';
export * from './types.js';
export * from './cognito-utils.js';
export * from './error-utils.js';
import { JWTValidator } from './jwt-validator.js';
import { JWKSService } from './jwks-service.js';
import { SSMService } from './ssm-service.js';
import * as fs from 'fs';
import * as path from 'path';
export async function createCognitoValidatorAsync(region, userPoolId, clientId, clientSecret, redisConfig, enableApiKeyValidation, enableUserDataRetrieval) {
const finalClientSecret = clientSecret || process.env.COGNITO_CLIENT_SECRET;
const jwksConfig = JWKSService.createCognitoConfig(region, userPoolId, clientId, finalClientSecret);
const config = {
jwks: jwksConfig,
enableRedisBlacklist: true,
enableApiKeyValidation: enableApiKeyValidation || false,
enableUserDataRetrieval: enableUserDataRetrieval || false,
forceSecureValidation: true,
userData: enableUserDataRetrieval ? {
includeApplications: true,
includeOrganizations: true,
includeRoles: true,
includeEffectivePermissions: false,
cacheTimeout: 300,
} : undefined,
};
const host = redisConfig?.host || process.env.REDIS_HOST || 'localhost';
const port = redisConfig?.port || parseInt(process.env.REDIS_PORT || '6379');
const password = redisConfig?.password || process.env.REDIS_PASSWORD || undefined;
const useTLS = redisConfig?.tls !== undefined
? redisConfig.tls
: process.env.REDIS_TLS === 'true';
const caCertPath = redisConfig?.caCertPath || process.env.REDIS_CA_CERT_PATH;
const caCertName = redisConfig?.caCertName || process.env.REDIS_CA_CERT_NAME;
config.redis = {
host,
port,
};
if (password) {
config.redis.password = password;
}
if (useTLS) {
config.redis.tls = {
rejectUnauthorized: process.env.REDIS_REJECT_UNAUTHORIZED !== 'false',
servername: host,
minVersion: 'TLSv1.2',
maxVersion: 'TLSv1.3',
};
try {
let caCert;
if (process.env.REDIS_CA_CERT) {
caCert = process.env.REDIS_CA_CERT;
}
else if (caCertPath && caCertName) {
try {
console.log(`🔍 Attempting to load certificate from SSM: /${caCertPath}/${caCertName}`);
caCert = await SSMService.getCACertificate(caCertPath, caCertName);
}
catch {
console.log('📁 SSM failed, trying filesystem...');
const certPath = path.join(caCertPath, caCertName);
if (fs.existsSync(certPath)) {
caCert = fs.readFileSync(certPath);
console.log('✅ Certificate loaded from filesystem');
}
}
}
else if (process.env.REDIS_CA_CERT_PARAMETER) {
caCert = await SSMService.getParameter(process.env.REDIS_CA_CERT_PARAMETER);
}
else if (process.env.REDIS_CA_CERT_FILE) {
const certFilePath = process.env.REDIS_CA_CERT_FILE;
if (fs.existsSync(certFilePath)) {
caCert = fs.readFileSync(certFilePath);
}
}
if (caCert) {
config.redis.tls.ca = caCert;
console.log('✅ Redis CA certificate loaded successfully');
}
else if (caCertPath || caCertName || process.env.REDIS_CA_CERT_FILE || process.env.REDIS_CA_CERT_PARAMETER) {
console.warn('⚠️ Redis CA certificate path provided but certificate not found or not accessible');
}
if (process.env.REDIS_CLIENT_CERT) {
config.redis.tls.cert = process.env.REDIS_CLIENT_CERT;
}
else if (process.env.REDIS_CLIENT_CERT_FILE) {
const certFilePath = process.env.REDIS_CLIENT_CERT_FILE;
if (fs.existsSync(certFilePath)) {
config.redis.tls.cert = fs.readFileSync(certFilePath);
}
}
if (process.env.REDIS_CLIENT_KEY) {
config.redis.tls.key = process.env.REDIS_CLIENT_KEY;
}
else if (process.env.REDIS_CLIENT_KEY_FILE) {
const keyFilePath = process.env.REDIS_CLIENT_KEY_FILE;
if (fs.existsSync(keyFilePath)) {
config.redis.tls.key = fs.readFileSync(keyFilePath);
}
}
}
catch (error) {
console.warn('Failed to load Redis TLS certificates:', error);
}
}
return new JWTValidator(config);
}
export function createCognitoValidator(region, userPoolId, clientId, clientSecret, redisConfig, enableApiKeyValidation, enableUserDataRetrieval) {
const finalClientSecret = clientSecret || process.env.COGNITO_CLIENT_SECRET;
const jwksConfig = JWKSService.createCognitoConfig(region, userPoolId, clientId, finalClientSecret);
const config = {
jwks: jwksConfig,
enableRedisBlacklist: true,
enableApiKeyValidation: enableApiKeyValidation || false,
enableUserDataRetrieval: enableUserDataRetrieval || false,
forceSecureValidation: true,
userData: enableUserDataRetrieval ? {
includeApplications: true,
includeOrganizations: true,
includeRoles: true,
includeEffectivePermissions: false,
cacheTimeout: 300,
} : undefined,
};
const host = redisConfig?.host || process.env.REDIS_HOST || 'localhost';
const port = redisConfig?.port || parseInt(process.env.REDIS_PORT || '6379');
const password = redisConfig?.password || process.env.REDIS_PASSWORD || undefined;
const useTLS = redisConfig?.tls !== undefined
? redisConfig.tls
: process.env.REDIS_TLS === 'true';
const caCertPath = redisConfig?.caCertPath || process.env.REDIS_CA_CERT_PATH;
const caCertName = redisConfig?.caCertName || process.env.REDIS_CA_CERT_NAME;
config.redis = {
host,
port,
};
if (password) {
config.redis.password = password;
}
if (useTLS) {
config.redis.tls = {
rejectUnauthorized: process.env.REDIS_REJECT_UNAUTHORIZED !== 'false',
servername: host,
minVersion: 'TLSv1.2',
maxVersion: 'TLSv1.3',
};
try {
let caCert;
if (process.env.REDIS_CA_CERT) {
caCert = process.env.REDIS_CA_CERT;
}
else if (caCertPath && caCertName) {
const certPath = path.join(caCertPath, caCertName);
if (fs.existsSync(certPath)) {
caCert = fs.readFileSync(certPath);
console.log('✅ Certificate loaded from filesystem');
}
else {
console.warn('⚠️ Certificate file not found. For SSM support, use createCognitoValidatorAsync()');
}
}
else if (process.env.REDIS_CA_CERT_FILE) {
const certFilePath = process.env.REDIS_CA_CERT_FILE;
if (fs.existsSync(certFilePath)) {
caCert = fs.readFileSync(certFilePath);
}
}
if (caCert) {
config.redis.tls.ca = caCert;
console.log('✅ Redis CA certificate loaded successfully');
}
else if (caCertPath || caCertName || process.env.REDIS_CA_CERT_FILE) {
console.warn('⚠️ Redis CA certificate path provided but certificate not found or not accessible');
}
if (process.env.REDIS_CLIENT_CERT) {
config.redis.tls.cert = process.env.REDIS_CLIENT_CERT;
}
else if (process.env.REDIS_CLIENT_CERT_FILE) {
const certFilePath = process.env.REDIS_CLIENT_CERT_FILE;
if (fs.existsSync(certFilePath)) {
config.redis.tls.cert = fs.readFileSync(certFilePath);
}
}
if (process.env.REDIS_CLIENT_KEY) {
config.redis.tls.key = process.env.REDIS_CLIENT_KEY;
}
else if (process.env.REDIS_CLIENT_KEY_FILE) {
const keyFilePath = process.env.REDIS_CLIENT_KEY_FILE;
if (fs.existsSync(keyFilePath)) {
config.redis.tls.key = fs.readFileSync(keyFilePath);
}
}
}
catch (error) {
console.warn('Failed to load Redis TLS certificates:', error);
}
}
return new JWTValidator(config);
}
//# sourceMappingURL=index.js.map