eve
Version:
Filesystem-first framework for durable backend AI agents that run anywhere.
1 lines • 1.71 kB
JavaScript
const STANDARD_PROJECTED_CLAIM_KEYS=new Set([`aud`,`exp`,`iat`,`iss`,`jti`,`nbf`,`sub`]);function normalizeJwtClaims(e){let t={};for(let[n,r]of Object.entries(e)){if(typeof r==`string`){t[n]=r;continue}Array.isArray(r)&&r.every(e=>typeof e==`string`)&&(t[n]=Object.freeze([...r]))}return Object.freeze(t)}function createJwtAttributeProjection(t){let n=normalizeJwtClaims(t);return Object.freeze(Object.fromEntries(Object.entries(n).filter(([t])=>!STANDARD_PROJECTED_CLAIM_KEYS.has(t))))}function areTokenClaimMatchersSatisfied(e,t){let n=normalizeJwtClaims(e);if(t.subjects!==void 0){let n=typeof e.sub==`string`?e.sub:null;if(n===null||!t.subjects.some(e=>matchesWildcardPattern(e,n)))return!1}return t.claims===void 0?!0:Object.entries(t.claims).every(([e,t])=>{let r=n[e];return r===void 0?!1:typeof r==`string`?t.includes(r):r.some(e=>t.includes(e))})}function createJwtAuthenticatedCallerPrincipal(e){let t=readFirstStringClaim(e.payload,[...e.issuerClaims??[],`iss`]),n=e.subjectClaim??`sub`,r=readFirstStringClaim(e.payload,[n]);if(t===void 0||r===void 0)throw Error(`Expected verified JWT payloads to include string iss and ${n} claims.`);let i=normalizeJwtClaims(e.payload);return{attributes:createJwtAttributeProjection(e.payload),authenticator:e.authenticator,claims:i,issuer:t,principalId:`${t}:${r}`,principalType:e.principalType,subject:r}}function readFirstStringClaim(e,t){for(let n of t){let t=e[n];if(typeof t==`string`&&t.length>0)return t}}function matchesWildcardPattern(e,t){if(!e.includes(`*`))return e===t;let n=e.replaceAll(/[.+?^${}()|[\]\\]/g,`\\$&`).replaceAll(`*`,`.*`);return RegExp(`^${n}$`).test(t)}export{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal};