eve/dist/src/channel/auth/jwt-ecdsa.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{importJWK,importSPKI,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#channel/auth/token-claims.js";const importedJwtPublicKeyCache=new Map;async function authenticateJwtEcdsaStrategy(e){let t;try{t=await getImportedJwtPublicKey(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to import JWT ECDSA public key. ${e instanceof Error?e.message:`Unknown key import failure.`}`}}try{let n=await jwtVerify(e.token,t,{algorithms:[e.strategy.algorithm],audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});return typeof n.payload.sub!=`string`||n.payload.sub.length===0?{kind:`not-authenticated`}:areTokenClaimMatchersSatisfied(n.payload,e.strategy)?{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`jwt-ecdsa`,payload:n.payload,principalType:`service`})}:{kind:`caller-not-allowed`}}catch{return{kind:`not-authenticated`}}}async function getImportedJwtPublicKey(e){let t=`${e.algorithm}:${e.publicKey}`,n=importedJwtPublicKeyCache.get(t);if(n!==void 0)return await n;let r=importJwtPublicKey(e.publicKey,e.algorithm).catch(e=>{throw importedJwtPublicKeyCache.delete(t),e});return importedJwtPublicKeyCache.set(t,r),await r}async function importJwtPublicKey(e,t){let n=e.trim();return n.startsWith(`{`)?await importJWK(JSON.parse(n),t):await importSPKI(n,t)}export{authenticateJwtEcdsaStrategy};