Merge pull request #76 from Koosha-Owji/feat/migrate-jose-to-kinde-jwt-validator

coel · web-flow · commit 3acb2eb41782 · 2025-07-03T08:55:18.000+09:00
Feat/migrate jose to kinde jwt validator/decoder
diff --git a/lib/__tests__/mocks.ts b/lib/__tests__/mocks.ts
@@ -129,3 +129,24 @@ class ServerSessionManager implements SessionManager {
 export const sessionManager = new ServerSessionManager();
 
 global.fetch = fetchClient;
+
+// Mock @kinde/jwt-validator
+export const createJwtValidatorMock = () => ({
+  validateToken: vi.fn().mockImplementation(async ({ token, domain }) => {
+    if (!token) {
+      return { valid: false, message: 'Token is required' };
+    }
+
+    if (!domain) {
+      return { valid: false, message: 'Domain is required' };
+    }
+
+    const jwtParts = token.split('.');
+    if (jwtParts.length !== 3) {
+      return { valid: false, message: 'Invalid JWT format' };
+    }
+
+    // If it passes basic validation, return true (simplified for testing)
+    return { valid: true, message: 'Token is valid' };
+  }),
+});
diff --git a/lib/__tests__/sdk/oauth2-flows/AuthCodeWithPKCE.spec.ts b/lib/__tests__/sdk/oauth2-flows/AuthCodeWithPKCE.spec.ts
@@ -6,7 +6,7 @@ import { base64UrlEncode, sha256 } from '../../../sdk/utilities';
 import { AuthCodeWithPKCE } from '../../../sdk/oauth2-flows';
 import { getSDKHeader } from '../../../sdk/version';
 import * as mocks from '../../mocks';
-import { describe, it, expect, beforeAll, afterEach } from 'vitest';
+import { describe, it, expect, afterEach } from 'vitest';
 
 describe('AuthCodeWitPKCE', () => {
   const { sessionManager } = mocks;
@@ -17,11 +17,6 @@ describe('AuthCodeWitPKCE', () => {
     clientId: 'client-id',
   };
 
-  beforeAll(async () => {
-    const { publicKey } = await mocks.getKeys();
-    clientConfig.jwks = { keys: [publicKey] };
-  });
-
   describe('new AuthCodeWithPKCE', () => {
     it('can construct AuthCodeWithPKCE instance', () => {
       expect(() => new AuthCodeWithPKCE(clientConfig)).not.toThrowError();
diff --git a/lib/__tests__/sdk/oauth2-flows/AuthorizationCode.spec.ts b/lib/__tests__/sdk/oauth2-flows/AuthorizationCode.spec.ts
@@ -10,7 +10,7 @@ import {
 
 import { KindeSDKError, KindeSDKErrorCode } from '../../../sdk/exceptions';
 import { generateRandomString } from '../../../sdk/utilities';
-import { describe, it, expect, beforeAll, afterEach } from 'vitest';
+import { describe, it, expect, afterEach } from 'vitest';
 
 describe('AuthorizationCode', () => {
   const { sessionManager } = mocks;
@@ -22,11 +22,6 @@ describe('AuthorizationCode', () => {
     clientId: 'client-id',
   };
 
-  beforeAll(async () => {
-    const { publicKey } = await mocks.getKeys();
-    clientConfig.jwks = { keys: [publicKey] };
-  });
-
   describe('new AuthorizationCode', () => {
     it('can construct AuthorizationCode instance', () => {
       expect(
diff --git a/lib/__tests__/sdk/oauth2-flows/ClientCredentials.spec.ts b/lib/__tests__/sdk/oauth2-flows/ClientCredentials.spec.ts
@@ -1,4 +1,3 @@
-import { importJWK } from 'jose';
 import { ClientCredentials } from '../../../sdk/oauth2-flows/ClientCredentials';
 import { type ClientCredentialsOptions } from '../../../sdk/oauth2-flows/types';
 import {
@@ -32,14 +31,9 @@ describe('ClientCredentials', () => {
     let validationDetails: TokenValidationDetailsType;
 
     beforeAll(async () => {
-      const { publicKey } = await mocks.getKeys();
-
       validationDetails = {
         issuer: clientConfig.authDomain,
-        keyProvider: async () => await importJWK(publicKey, mocks.mockJwtAlg),
       };
-
-      clientConfig.jwks = { keys: [publicKey] };
     });
 
     const body = new URLSearchParams({
diff --git a/lib/__tests__/sdk/utilities/feature-flags.spec.ts b/lib/__tests__/sdk/utilities/feature-flags.spec.ts
@@ -7,20 +7,17 @@ import {
   getFlag,
   type TokenValidationDetailsType,
 } from '../../../sdk/utilities';
-import { importJWK } from 'jose';
 
 describe('feature-flags', () => {
   let mockAccessToken: Awaited<ReturnType<typeof mocks.getMockAccessToken>>;
   const { sessionManager } = mocks;
+  const authDomain = 'local-testing@kinde.com';
 
   let validationDetails: TokenValidationDetailsType;
 
   beforeAll(async () => {
-    const { publicKey } = await mocks.getKeys();
-
     validationDetails = {
-      issuer: '',
-      keyProvider: async () => await importJWK(publicKey, mocks.mockJwtAlg),
+      issuer: authDomain,
     };
   });
 
diff --git a/lib/__tests__/sdk/utilities/token-claims.spec.ts b/lib/__tests__/sdk/utilities/token-claims.spec.ts
@@ -8,25 +8,20 @@ import {
   getClaim,
   type TokenValidationDetailsType,
 } from '../../../sdk/utilities';
-import { importJWK } from 'jose';
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
 
 describe('token-claims', () => {
   let mockAccessToken: Awaited<ReturnType<typeof mocks.getMockAccessToken>>;
   let mockIdToken: Awaited<ReturnType<typeof mocks.getMockIdToken>>;
-  const authDomain = 'https://local-testing@kinde.com';
+  const authDomain = 'local-testing@kinde.com';
   const { sessionManager } = mocks;
 
   let validationDetails: TokenValidationDetailsType;
 
   beforeAll(async () => {
-    const { publicKey } = await mocks.getKeys();
-
     validationDetails = {
       issuer: authDomain,
-      keyProvider: async () => await importJWK(publicKey, mocks.mockJwtAlg),
     };
-
     mockAccessToken = await mocks.getMockAccessToken();
     mockIdToken = await mocks.getMockIdToken();
     await sessionManager.setSessionItem('access_token', mockAccessToken.token);
diff --git a/lib/__tests__/sdk/utilities/token-utils.spec.ts b/lib/__tests__/sdk/utilities/token-utils.spec.ts
@@ -10,19 +10,15 @@ import {
 } from '../../../sdk/utilities';
 
 import { KindeSDKError, KindeSDKErrorCode } from '../../../sdk/exceptions';
-import { importJWK } from 'jose';
 
 describe('token-utils', () => {
   const domain = 'local-testing@kinde.com';
   const { sessionManager } = mocks;
   let validationDetails: TokenValidationDetailsType;
 
   beforeAll(async () => {
-    const { publicKey } = await mocks.getKeys();
-
     validationDetails = {
       issuer: domain,
-      keyProvider: async () => await importJWK(publicKey, mocks.mockJwtAlg),
     };
   });
 
diff --git a/lib/sdk/clients/server/index.ts b/lib/sdk/clients/server/index.ts
@@ -1,5 +1,4 @@
 import createAuthCodeClient from './authorization-code.js';
-import { isNodeEnvironment } from '../../environment.js';
 import createCCClient from './client-credentials.js';
 import { GrantType } from '../../oauth2-flows/index.js';
 
@@ -30,10 +29,6 @@ export const createKindeServerClient = <G extends GrantType>(
   grantType: G,
   options: Options<G>
 ) => {
-  if (!isNodeEnvironment()) {
-    throw new Error('this method must be invoked in a node.js environment');
-  }
-
   switch (grantType) {
     case GrantType.AUTHORIZATION_CODE: {
       const clientOptions = options as ACClientOptions;
diff --git a/lib/sdk/oauth2-flows/AuthCodeAbstract.ts b/lib/sdk/oauth2-flows/AuthCodeAbstract.ts
@@ -11,8 +11,6 @@ import type {
   AuthorizationCodeOptions,
   AuthURLOptions,
 } from './types.js';
-import { createLocalJWKSet } from 'jose';
-import { getRemoteJwks } from '../utilities/remote-jwks-cache.js';
 import type { GeneratePortalUrlParams } from '@kinde/js-utils';
 
 /**
@@ -37,17 +35,9 @@ export abstract class AuthCodeAbstract {
     this.userProfileEndpoint = `${authDomain}/oauth2/v2/user_profile`;
     this.authorizationEndpoint = `${authDomain}/oauth2/auth`;
     this.tokenEndpoint = `${authDomain}/oauth2/token`;
-    const keyProvider = async () => {
-      const func =
-        config.jwks !== undefined
-          ? createLocalJWKSet(config.jwks)
-          : await getRemoteJwks(authDomain);
-      return await func({ alg: 'RS256' });
-    };
     this.tokenValidationDetails = {
       issuer: config.authDomain,
       audience: config.audience,
-      keyProvider,
     };
   }
 
diff --git a/lib/sdk/oauth2-flows/ClientCredentials.ts b/lib/sdk/oauth2-flows/ClientCredentials.ts
@@ -1,4 +1,3 @@
-import { createLocalJWKSet } from 'jose';
 import { type SessionManager } from '../session-managers/index.js';
 import * as utilities from '../utilities/index.js';
 import { getSDKHeader } from '../version.js';
@@ -8,7 +7,6 @@ import type {
   ClientCredentialsOptions,
   OAuth2CCTokenResponse,
 } from './types.js';
-import { getRemoteJwks } from '../utilities/remote-jwks-cache.js';
 
 /**
  * Class provides implementation for the client credentials OAuth2.0 flow.
@@ -24,17 +22,9 @@ export class ClientCredentials {
     this.logoutEndpoint = `${authDomain}/logout?redirect=${logoutRedirectURL ?? ''}`;
     this.tokenEndpoint = `${authDomain}/oauth2/token`;
     this.config = config;
-    const keyProvider = async () => {
-      const func =
-        config.jwks !== undefined
-          ? createLocalJWKSet(config.jwks)
-          : await getRemoteJwks(authDomain);
-      return await func({ alg: 'RS256' });
-    };
     this.tokenValidationDetails = {
       issuer: config.authDomain,
       audience: config.audience,
-      keyProvider,
     };
   }
 
diff --git a/lib/sdk/oauth2-flows/types.ts b/lib/sdk/oauth2-flows/types.ts
@@ -1,5 +1,3 @@
-import { type JSONWebKeySet } from 'jose';
-
 export enum GrantType {
   AUTHORIZATION_CODE = 'AUTHORIZATION_CODE',
   CLIENT_CREDENTIALS = 'CLIENT_CREDENTIALS',
@@ -36,7 +34,6 @@ export interface OAuth2FlowOptions {
   authDomain: string;
   audience?: string | string[];
   scope?: string;
-  jwks?: JSONWebKeySet;
 }
 
 export interface SDKHeaderOverrideOptions {
diff --git a/lib/sdk/utilities/remote-jwks-cache.ts b/lib/sdk/utilities/remote-jwks-cache.ts
diff --git a/lib/sdk/utilities/token-claims.ts b/lib/sdk/utilities/token-claims.ts
@@ -1,13 +1,16 @@
 import { type SessionManager } from '../session-managers/index.js';
-import { type TokenValidationDetailsType, type ClaimTokenType } from './types.js';
-import { jwtVerify } from 'jose';
+import { type ClaimTokenType, type TokenValidationDetailsType } from './types.js';
+import { jwtDecoder } from '@kinde/jwt-decoder';
+import { validateToken } from '@kinde/jwt-validator';
+import { isTokenExpired } from './token-utils.js';
 
 /**
  * Method extracts the provided claim from the provided token type in the
  * current session.
  * @param {SessionManager} sessionManager
  * @param {string} claim
  * @param {ClaimTokenType} type
+ * @param {TokenValidationDetailsType} validationDetails
  * @returns {unknown | null}
  */
 export const getClaimValue = async (
@@ -17,13 +20,22 @@ export const getClaimValue = async (
   validationDetails: TokenValidationDetailsType
 ): Promise<unknown | null> => {
   const token = (await sessionManager.getSessionItem(`${type}`)) as string;
-  const key = await validationDetails.keyProvider();
-  const decodedToken = await jwtVerify(
-    token,
-    key,
-    type === 'id_token' ? { currentDate: new Date(0) } : {}
-  );
-  const tokenPayload: Record<string, unknown> = decodedToken.payload;
+  if (type === 'access_token') {
+    const expired = await isTokenExpired(token, validationDetails);
+    if (expired) {
+      throw new Error('Access token expired');
+    }
+  } else {
+    // ID token - signature validation only
+    const validation = await validateToken({
+      token,
+      domain: validationDetails.issuer,
+    });
+    if (!validation.valid) {
+      throw new Error(validation.message);
+    }
+  }
+  const tokenPayload = jwtDecoder(token) as Record<string, unknown>;
   return tokenPayload[claim] ?? null;
 };
 
@@ -33,6 +45,7 @@ export const getClaimValue = async (
  * @param {SessionManager} sessionManager
  * @param {string} claim
  * @param {ClaimTokenType} type
+ * @param {TokenValidationDetailsType} validationDetails
  * @returns {{ name: string, value: unknown | null }}
  */
 export const getClaim = async (
@@ -53,6 +66,7 @@ export const getClaim = async (
  * present in the session.
  * @param {SessionManager} sessionManager
  * @param {string} name
+ * @param {TokenValidationDetailsType} validationDetails
  * @returns {{ orgCode: string | null, isGranted: boolean }}
  */
 export const getPermission = async (
@@ -79,6 +93,7 @@ export const getPermission = async (
 /**
  * Method extracts the organization code from the current session.
  * @param {SessionManager} sessionManager
+ * @param {TokenValidationDetailsType} validationDetails
  * @returns {{ orgCode: string | null }}
  */
 export const getOrganization = async (
@@ -97,25 +112,26 @@ export const getOrganization = async (
  * Method extracts all the permission and the organization code in the access
  * token in the current session.
  * @param {SessionManager} sessionManager
+ * @param {TokenValidationDetailsType} validationDetails
  * @returns {{ permissions: string[], orgCode: string | null }}
  */
 export const getPermissions = async (
   sessionManager: SessionManager,
   validationDetails: TokenValidationDetailsType
 ): Promise<{ permissions: string[]; orgCode: string | null }> => {
   const [permissions, orgCode] = await Promise.all([
-    (getClaimValue(
+    (await getClaimValue(
       sessionManager,
       'permissions',
       'access_token',
       validationDetails
-    ) ?? []) as Promise<string[]>,
-    getClaimValue(
+    )) as Promise<string[]>,
+    (await getClaimValue(
       sessionManager,
       'org_code',
       'access_token',
       validationDetails
-    ) as Promise<string | null>,
+    )) as Promise<string | null>,
   ]);
   return {
     permissions,
@@ -127,16 +143,17 @@ export const getPermissions = async (
  * Method extracts all organization codes from the id token in the current
  * session.
  * @param {SessionManager} sessionManager
+ * @param {TokenValidationDetailsType} validationDetails
  * @returns {{ orgCodes: string[] }}
  */
 export const getUserOrganizations = async (
   sessionManager: SessionManager,
   validationDetails: TokenValidationDetailsType
 ): Promise<{ orgCodes: string[] }> => ({
-  orgCodes: ((await getClaimValue(
+  orgCodes: (await getClaimValue(
     sessionManager,
     'org_codes',
     'id_token',
     validationDetails
-  )) ?? []) as string[],
+  )) as string[],
 });
diff --git a/lib/sdk/utilities/token-utils.ts b/lib/sdk/utilities/token-utils.ts
diff --git a/lib/sdk/utilities/types.ts b/lib/sdk/utilities/types.ts
diff --git a/package.json b/package.json
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/vitest.setup.ts b/vitest.setup.ts
