Update jose to 4.6.0

Signed-off-by: Andy Caruso <macaruso@gmail.com>

plugins/auth-node/src/IdentityClient.test.ts

@@ -15,11 +15,16 @@
  */
 
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
-import { JSONWebKey, JWK, JWS, JWT } from 'jose';
+import {
+  SignJWT,
+  generateKeyPair,
+  decodeProtectedHeader,
+  exportJWK,
+} from 'jose';
 import { rest } from 'msw';
 import { setupServer } from 'msw/node';
-import { v4 as uuid } from 'uuid';
 import { IdentityClient } from './IdentityClient';
+import { v4 as uuid } from 'uuid';
 
 interface AnyJWK extends Record<string, string> {
   use: 'sig';
@@ -45,12 +50,11 @@ class FakeTokenFactory {
       ent?: string[];
     };
   }): Promise<string> {
-    const key = await JWK.generate('EC', 'P-256', {
-      use: 'sig',
-      kid: uuid(),
-      alg: 'ES256',
-    });
-    this.keys.push(key.toJWK(false) as unknown as AnyJWK);
+    const pair = await generateKeyPair('ES256');
+    const publicKey = await exportJWK(pair.publicKey);
+    const kid = uuid();
+    publicKey.kid = kid;
+    this.keys.push(publicKey as AnyJWK);
 
     const iss = this.options.issuer;
     const sub = params.claims.sub;
@@ -59,10 +63,14 @@ class FakeTokenFactory {
     const iat = Math.floor(Date.now() / 1000);
     const exp = iat + this.options.keyDurationSeconds;
 
-    return JWS.sign({ iss, sub, aud, iat, exp, ent }, key, {
-      alg: key.alg,
-      kid: key.kid,
-    });
+    return new SignJWT({ iss, sub, aud, iat, exp, ent, kid })
+      .setProtectedHeader({ alg: 'ES256', ent: ent, kid: kid })
+      .setIssuer(iss)
+      .setAudience(aud)
+      .setSubject(sub)
+      .setIssuedAt(iat)
+      .setExpirationTime(exp)
+      .sign(pair.privateKey);
   }
 
   async listPublicKeys(): Promise<{ keys: AnyJWK[] }> {
@@ -71,10 +79,8 @@ class FakeTokenFactory {
 }
 
 function jwtKid(jwt: string): string {
-  const { header } = JWT.decode(jwt, { complete: true }) as {
-    header: { kid: string };
-  };
-  return header.kid;
+  const header = decodeProtectedHeader(jwt);
+  return header.kid ?? '';
 }
 
 const server = setupServer();
@@ -98,7 +104,7 @@ describe('IdentityClient', () => {
   afterEach(() => server.resetHandlers());
 
   beforeEach(() => {
-    client = IdentityClient.create({ discovery, issuer: mockBaseUrl });
+    client = IdentityClient.create({ discovery, issuer: mockBaseUrl }, 0);
     factory = new FakeTokenFactory({
       issuer: mockBaseUrl,
       keyDurationSeconds,
@@ -118,13 +124,6 @@ describe('IdentityClient', () => {
       );
     });
 
-    it('should use the correct endpoint', async () => {
-      await factory.issueToken({ claims: { sub: 'foo' } });
-      const keys = await factory.listPublicKeys();
-      const response = await (client as any).listPublicKeys();
-      expect(response).toEqual(keys);
-    });
-
     it('should throw on undefined header', async () => {
       return expect(async () => {
         await client.authenticate(undefined);
@@ -186,7 +185,7 @@ describe('IdentityClient', () => {
 
     it('should accept token from new key', async () => {
       const fixedTime = Date.now();
-      jest
+      const spy = jest
         .spyOn(Date, 'now')
         .mockImplementation(() => fixedTime - keyDurationSeconds * 1000 * 2);
       const token1 = await factory.issueToken({ claims: { sub: 'foo1' } });
@@ -197,7 +196,7 @@ describe('IdentityClient', () => {
         // Ignore thrown error
       }
       // Move forward in time where the signing key has been rotated
-      jest.spyOn(Date, 'now').mockImplementation(() => fixedTime);
+      spy.mockRestore();
       const token = await factory.issueToken({ claims: { sub: 'foo' } });
       const response = await client.authenticate(token);
       expect(response).toEqual({
@@ -232,33 +231,9 @@ describe('IdentityClient', () => {
   });
 
   describe('listPublicKeys', () => {
-    const defaultServiceResponse: {
-      keys: JSONWebKey[];
-    } = {
-      keys: [
-        {
-          crv: 'P-256',
-          x: 'JWy80Goa-8C3oaeDLnk0ANVPPMfI9T3u_T5T7W2b_ls',
-          y: 'Ge6jAhCDW1PFBfme2RA5ZsXN0cESiCwW29LMRPX5wkw',
-          kty: 'EC',
-          kid: 'kid-a',
-          alg: 'ES256',
-          use: 'sig',
-        },
-      ],
-    };
-
-    beforeEach(() => {
-      server.use(
-        rest.get(`${mockBaseUrl}/.well-known/jwks.json`, (_, res, ctx) => {
-          return res(ctx.json(defaultServiceResponse));
-        }),
-      );
-    });
-
     it('should use the correct endpoint', async () => {
-      const response = await (client as any).listPublicKeys();
-      expect(response).toEqual(defaultServiceResponse);
+      const url = (client as any).endpoint as URL;
+      expect(url.toString()).toMatch(`${mockBaseUrl}/.well-known/jwks.json`);
     });
   });
 });

plugins/auth-node/src/IdentityClient.ts

@@ -16,12 +16,15 @@
 
 import { PluginEndpointDiscovery } from '@backstage/backend-common';
 import { AuthenticationError } from '@backstage/errors';
-import { JSONWebKey, JWK, JWKS, JWT } from 'jose';
-import fetch from 'node-fetch';
+import {
+  createRemoteJWKSet,
+  jwtVerify,
+  FlattenedJWSInput,
+  JWSHeaderParameters,
+} from 'jose';
+import { GetKeyFunction } from 'jose/dist/types/types';
 import { BackstageIdentityResponse } from './types';
 
-const CLOCK_MARGIN_S = 10;
-
 /**
  * An identity client to interact with auth-backend and authenticate Backstage
  * tokens
@@ -32,27 +35,37 @@ const CLOCK_MARGIN_S = 10;
 export class IdentityClient {
   private readonly discovery: PluginEndpointDiscovery;
   private readonly issuer: string;
-  private keyStore: JWKS.KeyStore;
-  private keyStoreUpdated: number;
+  private keyStore?: GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;
+  private endpoint?: URL;
 
   /**
    * Create a new {@link IdentityClient} instance.
    */
-  static create(options: {
-    discovery: PluginEndpointDiscovery;
-    issuer: string;
-  }): IdentityClient {
-    return new IdentityClient(options);
+  static create(
+    options: {
+      discovery: PluginEndpointDiscovery;
+      issuer: string;
+    },
+    cooldownMs = 30000,
+  ): IdentityClient {
+    return new IdentityClient(options, cooldownMs);
   }
 
-  private constructor(options: {
-    discovery: PluginEndpointDiscovery;
-    issuer: string;
-  }) {
+  private constructor(
+    options: {
+      discovery: PluginEndpointDiscovery;
+      issuer: string;
+    },
+    cooldownMs: number,
+  ) {
     this.discovery = options.discovery;
     this.issuer = options.issuer;
-    this.keyStore = new JWKS.KeyStore();
-    this.keyStoreUpdated = 0;
+    this.discovery.getBaseUrl('auth').then(url => {
+      this.endpoint = new URL(`${url}/.well-known/jwks.json`);
+      this.keyStore = createRemoteJWKSet(this.endpoint, {
+        cooldownDuration: cooldownMs,
+      });
+    });
   }
 
   /**
@@ -67,91 +80,34 @@ export class IdentityClient {
     if (!token) {
       throw new AuthenticationError('No token specified');
     }
-    // Get signing key matching token
-    const key = await this.getKey(token);
-    if (!key) {
-      throw new AuthenticationError('No signing key matching token found');
-    }
     // Verify token claims and signature
     // Note: Claims must match those set by TokenFactory when issuing tokens
     // Note: verify throws if verification fails
-    const decoded = JWT.IdToken.verify(token, key, {
+    if (!this.keyStore) {
+      throw new AuthenticationError('No keystore exists');
+    }
+    const decoded = await jwtVerify(token, this.keyStore, {
       algorithms: ['ES256'],
       audience: 'backstage',
       issuer: this.issuer,
-    }) as { sub: string; ent: string[] };
+    });
     // Verified, return the matching user as BackstageIdentity
     // TODO: Settle internal user format/properties
-    if (!decoded.sub) {
+    if (!decoded.payload.sub) {
       throw new AuthenticationError('No user sub found in token');
     }
 
     const user: BackstageIdentityResponse = {
+      id: decoded.payload.sub,
       token,
       identity: {
         type: 'user',
-        userEntityRef: decoded.sub,
-        ownershipEntityRefs: decoded.ent ?? [],
+        userEntityRef: decoded.payload.sub,
+        ownershipEntityRefs: decoded.payload.ent
+          ? [decoded.payload.ent as string]
+          : [],
       },
     };
     return user;
   }
-
-  /**
-   * Returns the public signing key matching the given jwt token,
-   * or null if no matching key was found
-   */
-  private async getKey(rawJwtToken: string): Promise<JWK.Key | null> {
-    const { header, payload } = JWT.decode(rawJwtToken, {
-      complete: true,
-    }) as {
-      header: { kid: string };
-      payload: { iat: number };
-    };
-
-    // Refresh public keys if needed
-    // Add a small margin in case clocks are out of sync
-    const keyStoreHasKey = !!this.keyStore.get({ kid: header.kid });
-    const issuedAfterLastRefresh =
-      payload?.iat && payload.iat > this.keyStoreUpdated - CLOCK_MARGIN_S;
-    if (!keyStoreHasKey && issuedAfterLastRefresh) {
-      await this.refreshKeyStore();
-    }
-
-    return this.keyStore.get({ kid: header.kid });
-  }
-
-  /**
-   * Lists public part of keys used to sign Backstage Identity tokens
-   */
-  private async listPublicKeys(): Promise<{
-    keys: JSONWebKey[];
-  }> {
-    const url = `${await this.discovery.getBaseUrl(
-      'auth',
-    )}/.well-known/jwks.json`;
-    const response = await fetch(url);
-
-    if (!response.ok) {
-      const payload = await response.text();
-      const message = `Request failed with ${response.status} ${response.statusText}, ${payload}`;
-      throw new Error(message);
-    }
-
-    const publicKeys: { keys: JSONWebKey[] } = await response.json();
-
-    return publicKeys;
-  }
-
-  /**
-   * Fetches public keys and caches them locally
-   */
-  private async refreshKeyStore(): Promise<void> {
-    const now = Date.now() / 1000;
-    const publicKeys = await this.listPublicKeys();
-    this.keyStore = JWKS.asKeyStore({
-      keys: publicKeys.keys.map(key => key as JSONWebKey),
-    });
-    this.keyStoreUpdated = now;
-  }
 }