feat: support for remote JWKS

src/index.ts

@@ -9,11 +9,13 @@ import {
 import {
 	SignJWT,
 	jwtVerify,
+	decodeProtectedHeader,
 	type CryptoKey,
 	type JWK,
 	type KeyObject,
 	type JoseHeaderParameters,
-	type JWTVerifyOptions
+	type JWTVerifyOptions,
+	type JWTVerifyGetKey
 } from 'jose'
 
 import { Type as t } from '@sinclair/typebox'
@@ -157,54 +159,84 @@ export interface JWTHeaderParameters extends JoseHeaderParameters {
 	crit?: string[]
 }
 
-export interface JWTOption<
+type BaseJWTOption<Name extends string | undefined, Schema extends TSchema | undefined> =
+	JWTHeaderParameters & JWTPayloadInput & {
+		/**
+		 * Name to decorate method as
+		 *
+		 * ---
+		 * @example
+		 * For example, `jwt` will decorate Context with `Context.jwt`
+		 *
+		 * ```typescript
+		 * app
+		 *     .decorate({
+		 *         name: 'myJWTNamespace',
+		 *         secret: process.env.JWT_SECRETS
+		 *     })
+		 *     .get('/sign/:name', ({ myJWTNamespace, params }) => {
+		 *         return myJWTNamespace.sign(params)
+		 *     })
+		 * ```
+		 */
+		name?: Name
+		/**
+		 * Type strict validation for JWT payload
+		 */
+		schema?: Schema
+	}
+
+export type JWTOption<
 	Name extends string | undefined = 'jwt',
 	Schema extends TSchema | undefined = undefined
-> extends JWTHeaderParameters,
-		JWTPayloadInput {
-	/**
-	 * Name to decorate method as
-	 *
-	 * ---
-	 * @example
-	 * For example, `jwt` will decorate Context with `Context.jwt`
-	 *
-	 * ```typescript
-	 * app
-	 *     .decorate({
-	 *         name: 'myJWTNamespace',
-	 *         secret: process.env.JWT_SECRETS
-	 *     })
-	 *     .get('/sign/:name', ({ myJWTNamespace, params }) => {
-	 *         return myJWTNamespace.sign(params)
-	 *     })
-	 * ```
-	 */
-	name?: Name
-	/**
-	 * JWT Secret
-	 */
-	secret: string | Uint8Array | CryptoKey | JWK | KeyObject
-	/**
-	 * Type strict validation for JWT payload
-	 */
-	schema?: Schema
-}
+> =
+	| (BaseJWTOption<Name, Schema> & {
+		/**
+		 * JWT Secret
+		 */
+		secret: string | Uint8Array | CryptoKey | JWK | KeyObject
+		/**
+		 * Remote JWKS
+		 * Use jose's `createRemoteJWKSet(new URL(...))` to create the JWKS function
+		 */
+		remoteJwks?: JWTVerifyGetKey
+	})
+	| (BaseJWTOption<Name, Schema> & {
+		/**
+		 * JWT Secret
+		 */
+		secret?: string | Uint8Array | CryptoKey | JWK | KeyObject
+		/**
+		 * Remote JWKS
+		 * Use jose's `createRemoteJWKSet(new URL(...))` to create the JWKS function
+		 */
+		remoteJwks: JWTVerifyGetKey
+	})
+
+	const ASYMMETRIC_VERIFICATION_ALGS = [
+	'RS256','RS384','RS512',
+	'PS256','PS384','PS512',
+	'ES256','ES384','ES512',
+	'EdDSA'
+	]
 
 export const jwt = <
 	const Name extends string = 'jwt',
 	const Schema extends TSchema | undefined = undefined
 >({
 	name = 'jwt' as Name,
 	secret,
+	remoteJwks,
 	schema,
 	...defaultValues
 }: // End JWT Payload
 JWTOption<Name, Schema>) => {
-	if (!secret) throw new Error("Secret can't be empty")
+	if (!secret && !remoteJwks) throw new Error ('Either "secret" or "remoteJwks" must be provided')
 
-	const key =
-		typeof secret === 'string' ? new TextEncoder().encode(secret) : secret
+	let jwtDecoration: any = {}
+	const key = secret
+		? (typeof secret === 'string' ? new TextEncoder().encode(secret) : secret)
+		: undefined
 
 	const validator = schema
 		? getSchemaValidator(
@@ -228,19 +260,49 @@ JWTOption<Name, Schema>) => {
 			)
 		: undefined
 
-	return new Elysia({
-		name: '@elysiajs/jwt',
-		seed: {
-			name,
-			secret,
-			schema,
-			...defaultValues
-		}
-	}).decorate(name as Name extends string ? Name : 'jwt', {
-		sign(
+	jwtDecoration.verify = async (
+			jwt?: string,
+			options?: JWTVerifyOptions
+		): Promise<
+			| (UnwrapSchema<Schema, ClaimType> &
+					Omit<JWTPayloadSpec, keyof UnwrapSchema<Schema, {}>>)
+			| false
+		> => {
+			if (!jwt) return false
+
+			try {
+				const { alg } = decodeProtectedHeader(jwt)
+				const isSymmetric = typeof alg === 'string' && alg.startsWith('HS')
+				const remoteOnly = remoteJwks && !key
+				if (isSymmetric && remoteOnly) throw new Error('HS* algorithm requires a local secret')
+				// Prefer local secret for HS*; prefer remote for asymmetric algs when available
+				let payload
+				if (remoteJwks && !isSymmetric) {
+					payload = (await jwtVerify(jwt, remoteJwks,
+						!options?.algorithms
+							? { ...options, algorithms: ASYMMETRIC_VERIFICATION_ALGS }
+							: options)
+					).payload
+				} else {
+					payload = (await jwtVerify(jwt, (key as Exclude<typeof key, undefined>), options)).payload
+				}
+				const data = payload as UnwrapSchema<Schema, ClaimType> &
+					Omit<JWTPayloadSpec, keyof UnwrapSchema<Schema, {}>>
+
+				if (validator && !validator.Check(data))
+					throw new ValidationError('JWT', validator, data)
+
+				return data
+			} catch (_) {
+				return false
+			}
+	}
+
+	if (secret) {
+		jwtDecoration.sign = (
 			signValue: Omit<UnwrapSchema<Schema, ClaimType>, NormalizedClaim> &
 				JWTPayloadInput
-		) {
+		) => {
 			const { nbf, exp, iat, ...data } = signValue
 
 			/**
@@ -359,34 +421,20 @@ JWTOption<Name, Schema>) => {
 				jwt = jwt.setIssuedAt(new Date())
 			}
 
-			return jwt.sign(key)
-		},
-		async verify(
-			jwt?: string,
-			options?: JWTVerifyOptions
-		): Promise<
-			| (UnwrapSchema<Schema, ClaimType> &
-					Omit<JWTPayloadSpec, keyof UnwrapSchema<Schema, {}>>)
-			| false
-		> {
-			if (!jwt) return false
-
-			try {
-				const data: any = (
-					await (options
-						? jwtVerify(jwt, key, options)
-						: jwtVerify(jwt, key))
-				).payload
-
-				if (validator && !validator.Check(data))
-					throw new ValidationError('JWT', validator, data)
+			return jwt.sign((key as Exclude<typeof key, undefined>) )
+		}
+	}
 
-				return data
-			} catch (_) {
-				return false
-			}
+	return new Elysia({
+		name: '@elysiajs/jwt',
+		seed: {
+			name,
+			secret,
+			remoteJwks,
+			schema,
+			...defaultValues
 		}
-	})
+	}).decorate(name as Name extends string ? Name : 'jwt', jwtDecoration)
 }
 
 export default jwt