@tree-house/authentication/dist/lib/sso-authentication.js

Tree House Authentication

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.getKey = exports.authenticateSso = void 0;
const openid_client_1 = require("openid-client");
const jwksClient = require("jwks-rsa");
const jwt_authentication_1 = require("./jwt-authentication");
async function authenticateSso(token) {
    if (token === '')
        throw new Error('SSO token is empty.');
    const { header, payload } = (0, jwt_authentication_1.decodeJwt)(token, { complete: true });
    const { metadata } = await openid_client_1.Issuer.discover(payload.iss);
    const secret = await getKey(metadata.jwks_uri, header.kid);
    const options = {
        issuer: payload.iss,
        algorithms: [header.alg],
        aud: payload.aud,
        expiresIn: payload.exp,
        secretOrKey: secret,
    };
    return (0, jwt_authentication_1.verifyJwt)(token, options);
}
exports.authenticateSso = authenticateSso;
async function getKey(jwksUri, token) {
    const client = jwksClient({
        jwksUri,
    });
    const key = await client.getSigningKey(token);
    const signingKey = key.getPublicKey();
    return signingKey;
}
exports.getKey = getKey;