jwt-bearer-client-auth/dist/generate.js

Create and verify JWT bearer client assertions from the OAuth-JWT-bearer RFC

"use strict";
/**
 * @license
 * Copyright 2015-2022 Open Ag Data Alliance
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.generate = void 0;
const pem_jwk_1 = require("pem-jwk");
const jsonwebtoken_1 = require("jsonwebtoken");
const certs_1 = require("@oada/certs");
/**
 * Ensure all required claims are present
 */
function checkClaims({ key, issuer, clientId, tokenEndpoint, expiresIn, }) {
    // Ensure the required claims are present
    if (!certs_1.jwksUtils.isJWK(key)) {
        throw new TypeError('key must be a JWK');
    }
    if (typeof issuer !== 'string') {
        throw new TypeError('issuer must be a string');
    }
    if (typeof clientId !== 'string') {
        throw new TypeError('clientId must be a string');
    }
    if (typeof tokenEndpoint !== 'string') {
        throw new TypeError('tokenEndpoint must be a string');
    }
    if (typeof expiresIn !== 'number') {
        throw new TypeError('expiresIn must be a number');
    }
}
async function generate({ key, issuer, clientId, tokenEndpoint, expiresIn, payload = {}, options: { header = {}, ...options } = {}, }) {
    checkClaims({ key, issuer, clientId, tokenEndpoint, expiresIn });
    // Build JWT options
    const jwtOptions = {
        ...options,
        algorithm: 'RS256',
        issuer,
        subject: clientId,
        audience: tokenEndpoint,
        expiresIn,
        // @ts-expect-error IDEK
        header: {
            // Add keyId if its available
            kid: key.kid,
            ...header,
        },
    };
    const pem = key.kty === 'PEM' ? key.pem : (0, pem_jwk_1.jwk2pem)(key);
    return (0, jsonwebtoken_1.sign)(payload, pem, jwtOptions);
}
exports.generate = generate;
//# sourceMappingURL=generate.js.map