@tmaguire/azure-ad-verify-token/dist/verify.js

Verify JWT issued by the Microsoft Identity Platform (including Azure AD B2C).

import jwt from 'jsonwebtoken';
import fetch from 'node-fetch';
import getPem from 'rsa-pem-from-mod-exp';
import { getItem, setDeferredItem, setItem, removeItem } from './cache.js';
/**
 * Get public key.
 *
 * @param jwksUri Json web key set URI.
 * @param kid Public key to get.
 */
function getPublicKey(jwksUri, kid) {
    let item = getItem(kid);
    if (item) {
        return item.result;
    }
    // immediately defer to prevent duplicate calls to get jwks
    setDeferredItem(kid);
    let foundPem = false;
    return fetch(jwksUri)
        .then((res) => res.json())
        .then((res) => {
        res.keys.forEach((key) => {
            const existing = getItem(key.kid);
            const pem = getPem(key.n, key.e);
            if (existing && existing.done) {
                // deferred item
                existing.done(pem);
                foundPem = true;
            }
            else {
                setItem(key.kid, pem);
            }
        });
        item = getItem(kid);
        if (!foundPem) {
            item.error('public key not found');
            removeItem(kid);
        }
        return item.result;
    });
}
/**
 * Verify token.
 *
 * @param token Token to verify.
 * @param options Configuration options.
 */
export function verify(token, options) {
    const { jwksUri, audience, issuer } = options;
    // eslint-disable-next-line @typescript-eslint/no-explicit-any
    let decoded;
    let kid;
    try {
        decoded = jwt.decode(token, { complete: true, json: true });
        kid = decoded.header.kid;
        if (!kid) {
            throw new Error('kid missing from token header');
        }
    }
    catch {
        return Promise.reject('invalid token');
    }
    return getPublicKey(jwksUri, kid).then((key) => jwt.verify(token, key, {
        algorithms: ['RS256'],
        audience,
        issuer,
    }));
}
//# sourceMappingURL=verify.js.map