atlassian-connect-auth
Version:
Helper for handling webhooks from Atlassian products
44 lines (43 loc) • 1.7 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.verifyQueryStringHash = void 0;
const AuthError_1 = require("./AuthError");
const types_1 = require("./types");
/**
* Verifies the Query String Hash value provided in a Connect JWT against an incoming request to make sure it is not
* tainted.
*/
function verifyQueryStringHash({ queryStringHashType = 'computed', connectJwt, computeQueryStringHashFunction, }) {
if (queryStringHashType === 'skip') {
return;
}
if (!connectJwt.qsh) {
throw new AuthError_1.AuthError('JWT did not contain the Query String Hash (QSH) claim', {
code: AuthError_1.AuthErrorCode.MISSING_QSH,
connectJwt,
});
}
// Check context QSH
const isContext = queryStringHashType === 'context';
if ((isContext || queryStringHashType === 'any') && connectJwt.qsh === types_1.ContextQsh) {
return;
}
// Check computed hash
let requestComputedQsh = isContext ? 'context' : 'skipped';
if (queryStringHashType === 'computed' || queryStringHashType === 'any') {
requestComputedQsh = computeQueryStringHashFunction();
if (connectJwt.qsh === requestComputedQsh) {
return;
}
}
// Error if no match
throw new AuthError_1.AuthError('Invalid QSH', {
code: AuthError_1.AuthErrorCode.INVALID_QSH,
qshInfo: {
computed: requestComputedQsh || /* istanbul ignore next: ignore fallback */ 'empty',
received: connectJwt.qsh || /* istanbul ignore next: ignore fallback */ 'empty',
},
connectJwt,
});
}
exports.verifyQueryStringHash = verifyQueryStringHash;