eve/dist/src/runtime/governance/auth/jwt-hmac.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{createSecretKey}from"node:crypto";import{jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#runtime/governance/auth/token-claims.js";async function authenticateJwtHmacStrategy(e){try{let t=await jwtVerify(e.token,createSecretKey(Buffer.from(e.strategy.secret,`utf8`)),{algorithms:[e.strategy.algorithm],audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});return typeof t.payload.sub!=`string`||t.payload.sub.length===0?{kind:`not-authenticated`}:areTokenClaimMatchersSatisfied(t.payload,e.strategy)?{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`jwt-hmac`,payload:t.payload,principalType:`service`})}:{kind:`caller-not-allowed`}}catch{return{kind:`not-authenticated`}}}export{authenticateJwtHmacStrategy};