paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 35 Packages Projects Releases Wiki Activity

Address review comments around algorithm being used, typescript ignore

Browse Source
This commit is contained in:
Jonah Back
2021-01-18 14:09:23 -08:00
parent 1f275fe31a
commit dfce32b356
2 changed files with 16 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/auth-backend/package.json
+1 -7
View File
@@ -18,13 +18,7 @@
},
"jest": {
"moduleNameMapper": {
"jose/jwt/sign": "<rootDir>/../node_modules/jose/dist/node/cjs/jwt/sign",
"jose/jwt/verify": "<rootDir>/../node_modules/jose/dist/node/cjs/jwt/verify",
"jose/jwk/from_key_like": "<rootDir>/../node_modules/jose/dist/node/cjs/jwk/from_key_like",
"jose/jwk/parse": "<rootDir>/../node_modules/jose/dist/node/cjs/jwk/parse",
"jose/util/base64url": "<rootDir>/../node_modules/jose/dist/node/cjs/util/base64url",
"jose/util/decode_protected_header": "<rootDir>/../node_modules/jose/dist/node/cjs/util/decode_protected_header",
"jose/util/generate_secret": "<rootDir>/../node_modules/jose/dist/node/cjs/util/generate_secret"
"^jose/(.*)$": "<rootDir>/../node_modules/jose/dist/node/cjs/$1"
}
},
"keywords": [
plugins/auth-backend/src/identity/TokenFactory.ts
+15 -12
View File
@@ -18,7 +18,7 @@ import moment from 'moment';
import { TokenIssuer, TokenParams, KeyStore, AnyJWK } from './types';
import parseJwk, { JWK } from 'jose/jwk/parse';
import SignJWT from 'jose/jwt/sign';
import generateSecret from 'jose/util/generate_secret';
import generateKeyPair from 'jose/util/generate_key_pair';
import fromKeyLike from 'jose/jwk/from_key_like';
import { Logger } from 'winston';
import { v4 as uuid } from 'uuid';
@@ -129,12 +129,20 @@ export class TokenFactory implements TokenIssuer {
const promise = (async () => {
// This generates a new signing key to be used to sign tokens until the next key rotation
const key = await generateSecret('HS256');
const key = await generateKeyPair('ES256');
const kid = uuid();
const jwk = await fromKeyLike(key);
jwk.kid = kid;
jwk.alg = 'HS256';
const jwk = await fromKeyLike(key.privateKey);
// @ts-ignore https://github.com/microsoft/TypeScript/issues/13195 -
// JOSE Library provides optional for most fields - and TS does not distinguish between missing/undefined.
// Because AnyJWK requires keys to have type "string", this throws a TypeError - though in practice, if the field
// is undefined, JOSE will not send it back as key.
const storedJwk: AnyJWK = {
...jwk,
alg: 'ES256',
kid: kid,
use: 'sig',
};
// We're not allowed to use the key until it has been successfully stored
// TODO: some token verification implementations aggressively cache the list of keys, and
// don't attempt to fetch new ones even if they encounter an unknown kid. Therefore we
@@ -142,14 +150,9 @@ export class TokenFactory implements TokenIssuer {
// the new one. This also needs to be implemented cross-service though, meaning new services
// that boot up need to be able to grab an existing key to use for signing.
this.logger.info(`Created new signing key ${jwk.kid}`);
await this.keyStore.addKey({
// @ts-ignore
use: 'sig',
...jwk,
});
await this.keyStore.addKey(storedJwk);
// At this point we are allowed to start using the new key
return jwk;
return storedJwk;
})();
this.privateKeyPromise = promise;