oauth2-server-grant-type-apple/dist/index.cjs

Apple grant type for @node-oauth/oauth2-server

Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
let _node_oauth_oauth2_server = require("@node-oauth/oauth2-server");
let jose = require("jose");
//#region src/verify-token.ts
const JWKS = (0, jose.createRemoteJWKSet)(new URL("https://appleid.apple.com/auth/keys"));
const ISSUER = "https://appleid.apple.com";
const verifyToken = async ({ token, audience }) => {
	const { payload } = await (0, jose.jwtVerify)(token, JWKS, {
		algorithms: ["RS256"],
		issuer: ISSUER,
		audience
	});
	return payload;
};
//#endregion
//#region src/apple-grant-type.ts
var AppleGrantType = class extends _node_oauth_oauth2_server.AbstractGrantType {
	constructor(options) {
		super(options);
		this.appIds = [];
		if (!options.model) throw new _node_oauth_oauth2_server.InvalidArgumentError("Missing parameter: `model`");
		if (!options.model.getUserWithApple) throw new _node_oauth_oauth2_server.InvalidArgumentError("Invalid argument: model does not implement `getUserWithApple()`");
		if (!options.model.saveToken) throw new _node_oauth_oauth2_server.InvalidArgumentError("Invalid argument: model does not implement `saveToken()`");
		this.model = options.model;
		const appId = this.model.appleGrantType?.appId;
		if (appId) this.appIds = Array.isArray(appId) ? appId : [appId];
		if (this.appIds.length === 0) throw new _node_oauth_oauth2_server.InvalidArgumentError("Invalid argument: Apple valid appId must be provided in options");
		this.handle = this.handle.bind(this);
		this.getUser = this.getUser.bind(this);
		this.saveToken = this.saveToken.bind(this);
	}
	async handle(request, client) {
		if (!request) throw new _node_oauth_oauth2_server.InvalidArgumentError("Missing parameter: `request`");
		if (!client) throw new _node_oauth_oauth2_server.InvalidArgumentError("Missing parameter: `client`");
		const scope = this.getScope(request);
		const user = await this.getUser(request);
		return await this.saveToken(user, client, scope);
	}
	async getUser(request) {
		const token = request.body.apple_token;
		const name = request.body.name;
		if (!token) throw new _node_oauth_oauth2_server.InvalidRequestError("Missing parameter: `apple_token`");
		let data;
		try {
			data = await verifyToken({
				token,
				audience: this.appIds
			});
		} catch {
			throw new _node_oauth_oauth2_server.InvalidTokenError("Apple id token is invalid or expired");
		}
		return await this.model.getUserWithApple({
			name,
			...data
		});
	}
	async saveToken(user, client, scope) {
		const validatedScope = await this.validateScope(user, client, scope);
		const accessToken = await this.generateAccessToken(client, user, scope);
		const refreshToken = await this.generateRefreshToken(client, user, scope);
		const token = {
			accessToken,
			accessTokenExpiresAt: this.getAccessTokenExpiresAt(),
			refreshToken,
			refreshTokenExpiresAt: this.getRefreshTokenExpiresAt(),
			scope: validatedScope || [],
			user: { id: user.id },
			client
		};
		return await this.model.saveToken(token, client, user);
	}
};
//#endregion
exports.AppleGrantType = AppleGrantType;
exports.verifyToken = verifyToken;

//# sourceMappingURL=index.cjs.map