Update jose to 4.6.0

Signed-off-by: Andy Caruso <macaruso@gmail.com>

plugins/auth-backend/package.json

@@ -51,7 +51,7 @@
     "express-session": "^1.17.1",
     "fs-extra": "10.0.1",
     "google-auth-library": "^7.6.1",
-    "jose": "^1.27.1",
+    "jose": "^4.6.0",
     "jwt-decode": "^3.1.0",
     "knex": "^1.0.2",
     "lodash": "^4.17.21",
@@ -91,6 +91,9 @@
     "msw": "^0.35.0",
     "supertest": "^6.1.3"
   },
+  "jest": {
+    "testEnvironment": "node"
+  },
   "files": [
     "dist",
     "migrations",

plugins/auth-backend/src/identity/TokenFactory.test.ts

@@ -17,16 +17,14 @@
 import { MemoryKeyStore } from './MemoryKeyStore';
 import { TokenFactory } from './TokenFactory';
 import { getVoidLogger } from '@backstage/backend-common';
-import { JWKS, JSONWebKey, JWT } from 'jose';
+import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from 'jose';
 import { stringifyEntityRef } from '@backstage/catalog-model';
 
 const logger = getVoidLogger();
 
 function jwtKid(jwt: string): string {
-  const { header } = JWT.decode(jwt, { complete: true }) as {
-    header: { kid: string };
-  };
-  return header.kid;
+  const header = decodeProtectedHeader(jwt);
+  return header.kid ?? '';
 }
 
 const entityRef = stringifyEntityRef({
@@ -49,22 +47,19 @@ describe('TokenFactory', () => {
     const token = await factory.issueToken({ claims: { sub: entityRef } });
 
     const { keys } = await factory.listPublicKeys();
-    const keyStore = JWKS.asKeyStore({
-      keys: keys.map(key => key as JSONWebKey),
-    });
+    const keyStore = createLocalJWKSet({ keys: keys });
 
-    const payload = JWT.verify(token, keyStore) as object & {
-      iat: number;
-      exp: number;
-    };
-    expect(payload).toEqual({
+    const verifyResult = await jwtVerify(token, keyStore);
+    expect(verifyResult.payload).toEqual({
       iss: 'my-issuer',
       aud: 'backstage',
       sub: entityRef,
       iat: expect.any(Number),
       exp: expect.any(Number),
     });
-    expect(payload.exp).toBe(payload.iat + keyDurationSeconds);
+    expect(verifyResult.payload.exp).toBe(
+      verifyResult.payload.iat! + keyDurationSeconds,
+    );
   });
 
   it('should generate new signing keys when the current one expires', async () => {

plugins/auth-backend/src/identity/TokenFactory.ts

@@ -15,7 +15,7 @@
  */
 
 import { TokenIssuer, TokenParams, KeyStore, AnyJWK } from './types';
-import { JSONWebKey, JWK, JWS } from 'jose';
+import { exportJWK, generateKeyPair, importJWK, JWK, SignJWT } from 'jose';
 import { Logger } from 'winston';
 import { v4 as uuid } from 'uuid';
 import { DateTime } from 'luxon';
@@ -52,9 +52,10 @@ export class TokenFactory implements TokenIssuer {
   private readonly logger: Logger;
   private readonly keyStore: KeyStore;
   private readonly keyDurationSeconds: number;
+  private readonly alg = 'ES256';
 
   private keyExpiry?: Date;
-  private privateKeyPromise?: Promise<JSONWebKey>;
+  private privateKeyPromise?: Promise<JWK>;
 
   constructor(options: Options) {
     this.issuer = options.issuer;
@@ -84,10 +85,14 @@ export class TokenFactory implements TokenIssuer {
 
     this.logger.info(`Issuing token for ${sub}, with entities ${ent ?? []}`);
 
-    return JWS.sign({ iss, sub, aud, iat, exp, ent }, key, {
-      alg: key.alg,
-      kid: key.kid,
-    });
+    return new SignJWT({ iss, sub, aud, iat, exp })
+      .setProtectedHeader({ alg: this.alg, kid: key.kid })
+      .setIssuer(iss)
+      .setAudience(aud)
+      .setSubject(sub)
+      .setIssuedAt(iat)
+      .setExpirationTime(exp)
+      .sign(await importJWK(key));
   }
 
   // This will be called by other services that want to verify ID tokens.
@@ -127,7 +132,7 @@ export class TokenFactory implements TokenIssuer {
     return { keys: validKeys.map(({ key }) => key) };
   }
 
-  private async getKey(): Promise<JSONWebKey> {
+  private async getKey(): Promise<JWK> {
     // Make sure that we only generate one key at a time
     if (this.privateKeyPromise) {
       if (
@@ -147,11 +152,11 @@ export class TokenFactory implements TokenIssuer {
       .toJSDate();
     const promise = (async () => {
       // This generates a new signing key to be used to sign tokens until the next key rotation
-      const key = await JWK.generate('EC', 'P-256', {
-        use: 'sig',
-        kid: uuid(),
-        alg: 'ES256',
-      });
+      const key = await generateKeyPair(this.alg);
+      const publicKey = await exportJWK(key.publicKey);
+      const privateKey = await exportJWK(key.privateKey);
+      publicKey.kid = privateKey.kid = uuid();
+      publicKey.alg = privateKey.alg = this.alg;
 
       // We're not allowed to use the key until it has been successfully stored
       // TODO: some token verification implementations aggressively cache the list of keys, and
@@ -159,11 +164,11 @@ export class TokenFactory implements TokenIssuer {
       //       may want to keep using the existing key for some period of time until we switch to
       //       the new one. This also needs to be implemented cross-service though, meaning new services
       //       that boot up need to be able to grab an existing key to use for signing.
-      this.logger.info(`Created new signing key ${key.kid}`);
-      await this.keyStore.addKey(key.toJWK(false) as unknown as AnyJWK);
+      this.logger.info(`Created new signing key ${publicKey.kid}`);
+      await this.keyStore.addKey(publicKey as AnyJWK);
 
       // At this point we are allowed to start using the new key
-      return key as JSONWebKey;
+      return privateKey;
     })();
 
     this.privateKeyPromise = promise;

plugins/auth-backend/src/providers/aws-alb/provider.test.ts

@@ -15,7 +15,7 @@
  */
 
 import express from 'express';
-import { JWT } from 'jose';
+import { jwtVerify } from 'jose';
 import {
   ALB_ACCESS_TOKEN_HEADER,
   ALB_JWT_HEADER,
@@ -25,7 +25,7 @@ import { makeProfileInfo } from '../../lib/passport';
 import { AuthResolverContext } from '../types';
 import { AuthenticationError } from '@backstage/errors';
 
-const jwtMock = JWT as jest.Mocked<any>;
+const jwtMock = jwtVerify as jest.Mocked<any>;
 
 const mockKey = async () => {
   return `-----BEGIN PUBLIC KEY-----
@@ -116,7 +116,7 @@ describe('AwsAlbAuthProvider', () => {
         },
       });
 
-      jwtMock.verify.mockReturnValueOnce(mockClaims);
+      jwtMock.mockReturnValueOnce(Promise.resolve({ payload: mockClaims }));
 
       await provider.refresh(mockRequest, mockResponse);
 
@@ -193,7 +193,7 @@ describe('AwsAlbAuthProvider', () => {
         },
       });
 
-      jwtMock.verify.mockImplementationOnce(() => {
+      jwtMock.mockImplementationOnce(() => {
         throw new Error('bad JWT');
       });
 
@@ -215,7 +215,7 @@ describe('AwsAlbAuthProvider', () => {
         },
       });
 
-      jwtMock.verify.mockReturnValueOnce({});
+      jwtMock.mockReturnValueOnce({});
 
       await expect(provider.refresh(mockRequest, mockResponse)).rejects.toThrow(
         AuthenticationError,
@@ -235,7 +235,7 @@ describe('AwsAlbAuthProvider', () => {
         },
       });
 
-      jwtMock.verify.mockReturnValueOnce({
+      jwtMock.mockReturnValueOnce({
         iss: 'INVALID_ISSUE_URL',
       });
 
@@ -257,7 +257,7 @@ describe('AwsAlbAuthProvider', () => {
         },
       });
 
-      jwtMock.verify.mockReturnValueOnce(mockClaims);
+      jwtMock.mockReturnValueOnce(mockClaims);
 
       await expect(provider.refresh(mockRequest, mockResponse)).rejects.toThrow(
         AuthenticationError,
@@ -277,7 +277,7 @@ describe('AwsAlbAuthProvider', () => {
         },
       });
 
-      jwtMock.verify.mockReturnValueOnce(mockClaims);
+      jwtMock.mockReturnValueOnce(mockClaims);
 
       await expect(provider.refresh(mockRequest, mockResponse)).rejects.toThrow(
         AuthenticationError,

plugins/auth-backend/src/providers/aws-alb/provider.ts

@@ -26,7 +26,7 @@ import fetch from 'node-fetch';
 import * as crypto from 'crypto';
 import { KeyObject } from 'crypto';
 import NodeCache from 'node-cache';
-import { JWT } from 'jose';
+import { JWTHeaderParameters, jwtVerify } from 'jose';
 import { Profile as PassportProfile } from 'passport';
 import { makeProfileInfo } from '../../lib/passport';
 import { AuthenticationError } from '@backstage/errors';
@@ -144,9 +144,8 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
     }
 
     try {
-      const headers = getJWTHeaders(jwt);
-      const key = await this.getKey(headers.kid);
-      const claims = JWT.verify(jwt, key) as AwsAlbClaims;
+      const verifyResult = await jwtVerify(jwt, this.getKey);
+      const claims = verifyResult.payload as AwsAlbClaims;
 
       if (this.issuer && claims.iss !== this.issuer) {
         throw new AuthenticationError('Issuer mismatch on JWT token');
@@ -195,18 +194,24 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
     };
   }
 
-  async getKey(keyId: string): Promise<KeyObject> {
-    const optionalCacheKey = this.keyCache.get<KeyObject>(keyId);
+  async getKey(header: JWTHeaderParameters): Promise<KeyObject> {
+    if (!header.kid) {
+      throw new AuthenticationError('No key id was specified in header');
+    }
+    const optionalCacheKey = this.keyCache.get<KeyObject>(header.kid);
     if (optionalCacheKey) {
       return crypto.createPublicKey(optionalCacheKey);
     }
-    const keyText = await fetch(
+    const keyText: string = await fetch(
       `https://public-keys.auth.elb.${encodeURIComponent(
         this.region,
-      )}.amazonaws.com/${encodeURIComponent(keyId)}`,
+      )}.amazonaws.com/${encodeURIComponent(header.kid)}`,
     ).then(response => response.text());
     const keyValue = crypto.createPublicKey(keyText);
-    this.keyCache.set(keyId, keyValue.export({ format: 'pem', type: 'spki' }));
+    this.keyCache.set(
+      header.kid,
+      keyValue.export({ format: 'pem', type: 'spki' }),
+    );
     return keyValue;
   }
 }

plugins/auth-backend/src/providers/oauth2-proxy/provider.test.ts

@@ -15,15 +15,13 @@
  */
 
 jest.mock('jose', () => ({
-  JWT: {
-    decode: jest.fn(),
-  },
+  decodeJwt: jest.fn(),
 }));
 jest.mock('@backstage/catalog-client');
 
 import { AuthenticationError } from '@backstage/errors';
 import express from 'express';
-import { JWT } from 'jose';
+import * as jose from 'jose';
 import { Logger } from 'winston';
 import { AuthHandler, AuthResolverContext, SignInResolver } from '../types';
 import {
@@ -45,12 +43,14 @@ describe('Oauth2ProxyAuthProvider', () => {
   let authHandler: jest.MockedFunction<AuthHandler<OAuth2ProxyResult<any>>>;
   let mockResponse: jest.Mocked<express.Response>;
   let mockRequest: jest.Mocked<express.Request>;
-  let JWTMock: jest.Mocked<typeof JWT>;
+  let mockJwtDecode: jest.MockedFunction<typeof jose.decodeJwt>;
 
   beforeEach(() => {
     jest.resetAllMocks();
 
-    JWTMock = JWT as jest.Mocked<typeof JWT>;
+    mockJwtDecode = jose.decodeJwt as jest.MockedFunction<
+      typeof jose.decodeJwt
+    >;
     authHandler = jest.fn();
     signInResolver = jest.fn();
     logger = { error: jest.fn() } as unknown as jest.Mocked<Logger>;
@@ -120,7 +120,7 @@ describe('Oauth2ProxyAuthProvider', () => {
       await provider.refresh(mockRequest, mockResponse);
 
       expect(mockRequest.header).toBeCalledWith(OAUTH2_PROXY_JWT_HEADER);
-      expect(JWTMock.decode).toHaveBeenCalledWith('token');
+      expect(mockJwtDecode).toHaveBeenCalledWith('token');
       expect(mockResponse.json).toHaveBeenCalled();
     });
 
@@ -136,7 +136,7 @@ describe('Oauth2ProxyAuthProvider', () => {
         token: mockToken,
       });
       authHandler.mockResolvedValue({ profile: profile });
-      JWTMock.decode.mockReturnValue(decodedToken as any);
+      mockJwtDecode.mockReturnValue(decodedToken as any);
 
       await provider.refresh(mockRequest, mockResponse);
 
@@ -191,7 +191,7 @@ describe('Oauth2ProxyAuthProvider', () => {
       await handler.refresh!(mockRequest, mockResponse);
 
       expect(mockRequest.header).toBeCalledWith(OAUTH2_PROXY_JWT_HEADER);
-      expect(JWTMock.decode).toHaveBeenCalledWith('token');
+      expect(mockJwtDecode).toHaveBeenCalledWith('token');
       expect(mockResponse.json).toHaveBeenCalled();
     });
   });

plugins/auth-backend/src/providers/oauth2-proxy/provider.ts

@@ -24,7 +24,7 @@ import {
   AuthResponse,
   AuthResolverContext,
 } from '../types';
-import { JWT } from 'jose';
+import { decodeJwt } from 'jose';
 import { prepareBackstageIdentityResponse } from '../prepareBackstageIdentityResponse';
 import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
 
@@ -142,7 +142,7 @@ export class Oauth2ProxyAuthProvider<JWTPayload>
       );
     }
 
-    const decodedJWT = JWT.decode(jwt) as unknown as JWTPayload;
+    const decodedJWT = decodeJwt(jwt) as unknown as JWTPayload;
 
     return {
       fullProfile: decodedJWT,

plugins/auth-backend/src/providers/oidc/provider.test.ts

@@ -18,7 +18,7 @@ import { Config, ConfigReader } from '@backstage/config';
 import { setupRequestMockHandlers } from '@backstage/backend-test-utils';
 import express from 'express';
 import { Session } from 'express-session';
-import { JWK, JWT } from 'jose';
+import { UnsecuredJWT } from 'jose';
 import { rest } from 'msw';
 import { setupServer } from 'msw/node';
 import { ClientMetadata, IssuerMetadata } from 'openid-client';
@@ -90,13 +90,18 @@ describe('OidcAuthProvider', () => {
   });
 
   it('OidcAuthProvider#handler successfully invokes the oidc endpoints', async () => {
-    const jwt = {
-      sub: 'alice',
-      iss: 'https://oidc.test',
-      iat: Date.now(),
-      aud: clientMetadata.clientId,
-      exp: Date.now() + 10000,
-    };
+    const sub = 'alice';
+    const iss = 'https://oidc.test';
+    const iat = Date.now();
+    const aud = clientMetadata.clientId;
+    const exp = Date.now() + 10000;
+    const jwt = await new UnsecuredJWT({ iss, sub, aud, iat, exp })
+      .setIssuer(iss)
+      .setAudience(aud)
+      .setSubject(sub)
+      .setIssuedAt(iat)
+      .setExpirationTime(exp)
+      .encode();
     const requestSequence: Array<string> = [];
 
     // The array of expected requests executed by the provider handler
@@ -114,7 +119,7 @@ describe('OidcAuthProvider', () => {
         method: 'post',
         url: 'https://oidc.test/as/token.oauth2',
         payload: {
-          id_token: JWT.sign(jwt, JWK.None),
+          id_token: jwt,
           access_token: 'test',
           authorization_signed_response_alg: 'HS256',
         },

plugins/auth-node/package.json

@@ -25,8 +25,9 @@
   "dependencies": {
     "@backstage/backend-common": "^0.13.2-next.1",
     "@backstage/config": "^1.0.0",
+    "@backstage/catalog-model": "^0.13.0",
     "@backstage/errors": "^1.0.0",
-    "jose": "^1.27.1",
+    "jose": "^4.6.0",
     "node-fetch": "^2.6.7",
     "winston": "^3.2.1"
   },
@@ -35,6 +36,9 @@
     "msw": "^0.35.0",
     "uuid": "^8.0.0"
   },
+  "jest": {
+    "testEnvironment": "node"
+  },
   "files": [
     "dist"
   ]

plugins/auth-node/src/IdentityClient.test.ts

@@ -15,11 +15,16 @@
  */
 
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
-import { JSONWebKey, JWK, JWS, JWT } from 'jose';
+import {
+  SignJWT,
+  generateKeyPair,
+  decodeProtectedHeader,
+  exportJWK,
+} from 'jose';
 import { rest } from 'msw';
 import { setupServer } from 'msw/node';
-import { v4 as uuid } from 'uuid';
 import { IdentityClient } from './IdentityClient';
+import { v4 as uuid } from 'uuid';
 
 interface AnyJWK extends Record<string, string> {
   use: 'sig';
@@ -45,12 +50,11 @@ class FakeTokenFactory {
       ent?: string[];
     };
   }): Promise<string> {
-    const key = await JWK.generate('EC', 'P-256', {
-      use: 'sig',
-      kid: uuid(),
-      alg: 'ES256',
-    });
-    this.keys.push(key.toJWK(false) as unknown as AnyJWK);
+    const pair = await generateKeyPair('ES256');
+    const publicKey = await exportJWK(pair.publicKey);
+    const kid = uuid();
+    publicKey.kid = kid;
+    this.keys.push(publicKey as AnyJWK);
 
     const iss = this.options.issuer;
     const sub = params.claims.sub;
@@ -59,10 +63,14 @@ class FakeTokenFactory {
     const iat = Math.floor(Date.now() / 1000);
     const exp = iat + this.options.keyDurationSeconds;
 
-    return JWS.sign({ iss, sub, aud, iat, exp, ent }, key, {
-      alg: key.alg,
-      kid: key.kid,
-    });
+    return new SignJWT({ iss, sub, aud, iat, exp, ent, kid })
+      .setProtectedHeader({ alg: 'ES256', ent: ent, kid: kid })
+      .setIssuer(iss)
+      .setAudience(aud)
+      .setSubject(sub)
+      .setIssuedAt(iat)
+      .setExpirationTime(exp)
+      .sign(pair.privateKey);
   }
 
   async listPublicKeys(): Promise<{ keys: AnyJWK[] }> {
@@ -71,10 +79,8 @@ class FakeTokenFactory {
 }
 
 function jwtKid(jwt: string): string {
-  const { header } = JWT.decode(jwt, { complete: true }) as {
-    header: { kid: string };
-  };
-  return header.kid;
+  const header = decodeProtectedHeader(jwt);
+  return header.kid ?? '';
 }
 
 const server = setupServer();
@@ -98,7 +104,7 @@ describe('IdentityClient', () => {
   afterEach(() => server.resetHandlers());
 
   beforeEach(() => {
-    client = IdentityClient.create({ discovery, issuer: mockBaseUrl });
+    client = IdentityClient.create({ discovery, issuer: mockBaseUrl }, 0);
     factory = new FakeTokenFactory({
       issuer: mockBaseUrl,
       keyDurationSeconds,
@@ -118,13 +124,6 @@ describe('IdentityClient', () => {
       );
     });
 
-    it('should use the correct endpoint', async () => {
-      await factory.issueToken({ claims: { sub: 'foo' } });
-      const keys = await factory.listPublicKeys();
-      const response = await (client as any).listPublicKeys();
-      expect(response).toEqual(keys);
-    });
-
     it('should throw on undefined header', async () => {
       return expect(async () => {
         await client.authenticate(undefined);
@@ -186,7 +185,7 @@ describe('IdentityClient', () => {
 
     it('should accept token from new key', async () => {
       const fixedTime = Date.now();
-      jest
+      const spy = jest
         .spyOn(Date, 'now')
         .mockImplementation(() => fixedTime - keyDurationSeconds * 1000 * 2);
       const token1 = await factory.issueToken({ claims: { sub: 'foo1' } });
@@ -197,7 +196,7 @@ describe('IdentityClient', () => {
         // Ignore thrown error
       }
       // Move forward in time where the signing key has been rotated
-      jest.spyOn(Date, 'now').mockImplementation(() => fixedTime);
+      spy.mockRestore();
       const token = await factory.issueToken({ claims: { sub: 'foo' } });
       const response = await client.authenticate(token);
       expect(response).toEqual({
@@ -232,33 +231,9 @@ describe('IdentityClient', () => {
   });
 
   describe('listPublicKeys', () => {
-    const defaultServiceResponse: {
-      keys: JSONWebKey[];
-    } = {
-      keys: [
-        {
-          crv: 'P-256',
-          x: 'JWy80Goa-8C3oaeDLnk0ANVPPMfI9T3u_T5T7W2b_ls',
-          y: 'Ge6jAhCDW1PFBfme2RA5ZsXN0cESiCwW29LMRPX5wkw',
-          kty: 'EC',
-          kid: 'kid-a',
-          alg: 'ES256',
-          use: 'sig',
-        },
-      ],
-    };
-
-    beforeEach(() => {
-      server.use(
-        rest.get(`${mockBaseUrl}/.well-known/jwks.json`, (_, res, ctx) => {
-          return res(ctx.json(defaultServiceResponse));
-        }),
-      );
-    });
-
     it('should use the correct endpoint', async () => {
-      const response = await (client as any).listPublicKeys();
-      expect(response).toEqual(defaultServiceResponse);
+      const url = (client as any).endpoint as URL;
+      expect(url.toString()).toMatch(`${mockBaseUrl}/.well-known/jwks.json`);
     });
   });
 });

plugins/auth-node/src/IdentityClient.ts

@@ -16,12 +16,15 @@
 
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
 import { AuthenticationError } from '@backstage/errors';
-import { JSONWebKey, JWK, JWKS, JWT } from 'jose';
-import fetch from 'node-fetch';
+import {
+  createRemoteJWKSet,
+  jwtVerify,
+  FlattenedJWSInput,
+  JWSHeaderParameters,
+} from 'jose';
+import { GetKeyFunction } from 'jose/dist/types/types';
 import { BackstageIdentityResponse } from './types';
 
-const CLOCK_MARGIN_S = 10;
-
 /**
  * An identity client to interact with auth-backend and authenticate Backstage
  * tokens
@@ -32,27 +35,37 @@ const CLOCK_MARGIN_S = 10;
 export class IdentityClient {
   private readonly discovery: PluginEndpointDiscovery;
   private readonly issuer: string;
-  private keyStore: JWKS.KeyStore;
-  private keyStoreUpdated: number;
+  private keyStore?: GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;
+  private endpoint?: URL;
 
   /**
    * Create a new {@link IdentityClient} instance.
    */
-  static create(options: {
-    discovery: PluginEndpointDiscovery;
-    issuer: string;
-  }): IdentityClient {
-    return new IdentityClient(options);
+  static create(
+    options: {
+      discovery: PluginEndpointDiscovery;
+      issuer: string;
+    },
+    cooldownMs = 30000,
+  ): IdentityClient {
+    return new IdentityClient(options, cooldownMs);
   }
 
-  private constructor(options: {
-    discovery: PluginEndpointDiscovery;
-    issuer: string;
-  }) {
+  private constructor(
+    options: {
+      discovery: PluginEndpointDiscovery;
+      issuer: string;
+    },
+    cooldownMs: number,
+  ) {
     this.discovery = options.discovery;
     this.issuer = options.issuer;
-    this.keyStore = new JWKS.KeyStore();
-    this.keyStoreUpdated = 0;
+    this.discovery.getBaseUrl('auth').then(url => {
+      this.endpoint = new URL(`${url}/.well-known/jwks.json`);
+      this.keyStore = createRemoteJWKSet(this.endpoint, {
+        cooldownDuration: cooldownMs,
+      });
+    });
   }
 
   /**
@@ -67,91 +80,34 @@ export class IdentityClient {
     if (!token) {
       throw new AuthenticationError('No token specified');
     }
-    // Get signing key matching token
-    const key = await this.getKey(token);
-    if (!key) {
-      throw new AuthenticationError('No signing key matching token found');
-    }
     // Verify token claims and signature
     // Note: Claims must match those set by TokenFactory when issuing tokens
     // Note: verify throws if verification fails
-    const decoded = JWT.IdToken.verify(token, key, {
+    if (!this.keyStore) {
+      throw new AuthenticationError('No keystore exists');
+    }
+    const decoded = await jwtVerify(token, this.keyStore, {
       algorithms: ['ES256'],
       audience: 'backstage',
       issuer: this.issuer,
-    }) as { sub: string; ent: string[] };
+    });
     // Verified, return the matching user as BackstageIdentity
     // TODO: Settle internal user format/properties
-    if (!decoded.sub) {
+    if (!decoded.payload.sub) {
       throw new AuthenticationError('No user sub found in token');
     }
 
     const user: BackstageIdentityResponse = {
+      id: decoded.payload.sub,
       token,
       identity: {
         type: 'user',
-        userEntityRef: decoded.sub,
-        ownershipEntityRefs: decoded.ent ?? [],
+        userEntityRef: decoded.payload.sub,
+        ownershipEntityRefs: decoded.payload.ent
+          ? [decoded.payload.ent as string]
+          : [],
       },
     };
     return user;
   }
-
-  /**
-   * Returns the public signing key matching the given jwt token,
-   * or null if no matching key was found
-   */
-  private async getKey(rawJwtToken: string): Promise<JWK.Key | null> {
-    const { header, payload } = JWT.decode(rawJwtToken, {
-      complete: true,
-    }) as {
-      header: { kid: string };
-      payload: { iat: number };
-    };
-
-    // Refresh public keys if needed
-    // Add a small margin in case clocks are out of sync
-    const keyStoreHasKey = !!this.keyStore.get({ kid: header.kid });
-    const issuedAfterLastRefresh =
-      payload?.iat && payload.iat > this.keyStoreUpdated - CLOCK_MARGIN_S;
-    if (!keyStoreHasKey && issuedAfterLastRefresh) {
-      await this.refreshKeyStore();
-    }
-
-    return this.keyStore.get({ kid: header.kid });
-  }
-
-  /**
-   * Lists public part of keys used to sign Backstage Identity tokens
-   */
-  private async listPublicKeys(): Promise<{
-    keys: JSONWebKey[];
-  }> {
-    const url = `${await this.discovery.getBaseUrl(
-      'auth',
-    )}/.well-known/jwks.json`;
-    const response = await fetch(url);
-
-    if (!response.ok) {
-      const payload = await response.text();
-      const message = `Request failed with ${response.status} ${response.statusText}, ${payload}`;
-      throw new Error(message);
-    }
-
-    const publicKeys: { keys: JSONWebKey[] } = await response.json();
-
-    return publicKeys;
-  }
-
-  /**
-   * Fetches public keys and caches them locally
-   */
-  private async refreshKeyStore(): Promise<void> {
-    const now = Date.now() / 1000;
-    const publicKeys = await this.listPublicKeys();
-    this.keyStore = JWKS.asKeyStore({
-      keys: publicKeys.keys.map(key => key as JSONWebKey),
-    });
-    this.keyStoreUpdated = now;
-  }
 }

plugins/permission-node/package.json

@@ -49,6 +49,9 @@
     "msw": "^0.35.0",
     "supertest": "^6.1.3"
   },
+  "jest": {
+    "testEnvironment": "node"
+  },
   "files": [
     "dist"
   ]

plugins/search-backend/src/service/standaloneServer.ts

@@ -43,7 +43,7 @@ export async function startStandaloneServer(
   const searchEngine = new LunrSearchEngine({ logger });
   const indexBuilder = new IndexBuilder({ logger, searchEngine });
   const discovery = SingleHostDiscovery.fromConfig(config);
-  const tokenManager = ServerTokenManager.fromConfig(config, {
+  const tokenManager = await ServerTokenManager.fromConfig(config, {
     logger,
   });
   const permissions = ServerPermissionClient.fromConfig(config, {