nest-azure-ad-jwt-validator
Version:
Nest Azure Active Directory JWT Token Validator
169 lines • 7.7 kB
JavaScript
"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
var AzureTokenValidationService_1;
Object.defineProperty(exports, "__esModule", { value: true });
exports.AzureTokenValidationService = void 0;
const models_1 = require("../models");
const common_1 = require("@nestjs/common");
const os_1 = require("os");
const axios_1 = require("@nestjs/axios");
const module_config_1 = require("../module-config");
const jsonwebtoken_1 = require("jsonwebtoken");
let AzureTokenValidationService = AzureTokenValidationService_1 = class AzureTokenValidationService {
constructor(httpService, options) {
this.httpService = httpService;
this.options = options;
this.logger = new common_1.Logger(AzureTokenValidationService_1.name);
}
isTokenValid(accessToken) {
return __awaiter(this, void 0, void 0, function* () {
let isServiceToken = false;
const user = yield this.extractUserFromToken(accessToken);
let isTokenValid = !!user;
if (!isTokenValid) {
isServiceToken = true;
isTokenValid = this.validateServiceToken(accessToken);
}
return [isTokenValid, user, isServiceToken];
});
}
getAzureUserFromToken(accessToken) {
return __awaiter(this, void 0, void 0, function* () {
return yield this.extractUserFromToken(accessToken);
});
}
extractUserFromToken(accessToken) {
return __awaiter(this, void 0, void 0, function* () {
const keys = (yield this.getAzureKeys()).keys;
let tokenHeader;
try {
tokenHeader = this.getTokenHeader(accessToken);
if (!tokenHeader) {
return null;
}
}
catch (err) {
if (this.options.enableDebugLogs) {
this.logger.warn(`Unable to extract Header from AccessToken: ${accessToken} for issue ${err.toString()}`);
}
return null;
}
const key = keys.find((x) => x.kid === tokenHeader.kid);
if (!key) {
this.logger.error(`Unable to find Public Signing key matching Token Header kid(KeyId): ${tokenHeader.kid}`);
return null;
}
const publicKey = `-----BEGIN CERTIFICATE-----${os_1.EOL}${key.x5c[0]}${os_1.EOL}-----END CERTIFICATE-----`;
try {
const payload = this.verifyToken(accessToken, publicKey);
const user = new models_1.AzureAdUser(payload);
const matchingTenantApp = this.options.apps.some((a) => (`api://${a.audienceId}` === user.audience ||
a.audienceId === user.audience ||
a.audienceId === user.appId) &&
a.tenantId === user.tenant);
return matchingTenantApp ? user : null;
}
catch (err) {
this.logger.error(`Unable to validate accessToken for reason ${err.toString()}`);
return null;
}
});
}
extractRolesFromToken(accessToken) {
return __awaiter(this, void 0, void 0, function* () {
const keys = (yield this.getAzureKeys()).keys;
let tokenHeader;
try {
tokenHeader = this.getTokenHeader(accessToken);
if (!tokenHeader) {
return null;
}
}
catch (err) {
this.logger.error(`Unable to extract Header from AccessToken: ${accessToken} for issue ${err.toString()}`);
return null;
}
const key = keys.find((x) => x.kid === tokenHeader.kid);
if (!key) {
this.logger.error(`Unable to find Public Signing key matching Token Header kid(KeyId): ${tokenHeader.kid}`);
return null;
}
const publicKey = `-----BEGIN CERTIFICATE-----${os_1.EOL}${key.x5c[0]}${os_1.EOL}-----END CERTIFICATE-----`;
try {
const payload = this.verifyToken(accessToken, publicKey);
const user = new models_1.AzureAdUser(payload);
if (user.roles) {
return user;
}
return null;
}
catch (err) {
this.logger.error(`Unable to validate accessToken for reason ${err.toString()}`);
return null;
}
});
}
getAzureKeys() {
return __awaiter(this, void 0, void 0, function* () {
return (yield this.httpService
.get('https://login.microsoftonline.com/common/discovery/keys')
.toPromise()).data;
});
}
verifyToken(accessToken, key) {
const data = (0, jsonwebtoken_1.verify)(accessToken, key);
return data;
}
getTokenHeader(accessToken) {
if (!accessToken.includes('.')) {
this.logger.debug('Processing as service token, not as access token.');
return null;
}
const tokenPart = accessToken.slice(0, accessToken.indexOf('.'));
const buffer = Buffer.from(tokenPart, 'base64');
const decodedToken = buffer.toString('utf8');
try {
return JSON.parse(decodedToken);
}
catch (ex) {
this.logger.debug('Processing as service token, not as access token.');
return null;
}
}
validateServiceToken(token) {
if (this.options.enableDebugLogs) {
this.logger.debug('Attempting to validate service token...');
}
if (this.options.serviceTokens.includes(token)) {
return true;
}
if (this.options.enableDebugLogs) {
this.logger.warn('Could not validate service token.');
}
return false;
}
};
AzureTokenValidationService = AzureTokenValidationService_1 = __decorate([
(0, common_1.Injectable)(),
__metadata("design:paramtypes", [axios_1.HttpService,
module_config_1.NestAzureAdJwtValidatorModuleOptions])
], AzureTokenValidationService);
exports.AzureTokenValidationService = AzureTokenValidationService;
//# sourceMappingURL=azure-token-validation.service.js.map