|
1 | 1 | import { decode } from 'jsonwebtoken' |
2 | 2 |
|
3 | 3 | export interface ITokenContent { |
4 | | - [key: string]: any, |
| 4 | + [key: string]: any |
5 | 5 |
|
6 | | - /** |
| 6 | + /** |
7 | 7 | * Authorization server’s identifier |
8 | 8 | */ |
9 | | - iss: string, |
| 9 | + iss: string |
10 | 10 |
|
11 | | - /** |
| 11 | + /** |
12 | 12 | * User’s identifier |
13 | 13 | */ |
14 | | - sub: string, |
| 14 | + sub: string |
15 | 15 |
|
16 | | - /** |
| 16 | + /** |
17 | 17 | * Client’s identifier |
18 | 18 | */ |
19 | | - aud: string | string[], |
| 19 | + aud: string | string[] |
20 | 20 |
|
21 | | - /** |
| 21 | + /** |
22 | 22 | * Expiration time of the ID token |
23 | 23 | */ |
24 | | - exp: number, |
| 24 | + exp: number |
25 | 25 |
|
26 | | - /** |
| 26 | + /** |
27 | 27 | * Time at which JWT was issued |
28 | 28 | */ |
29 | | - iat: number, |
30 | | - |
31 | | - family_name?: string, |
32 | | - given_name?: string, |
33 | | - name?: string, |
34 | | - email?: string, |
35 | | - preferred_username?: string, |
36 | | - email_verified?: boolean, |
| 29 | + iat: number |
37 | 30 |
|
| 31 | + family_name?: string |
| 32 | + given_name?: string |
| 33 | + name?: string |
| 34 | + email?: string |
| 35 | + preferred_username?: string |
| 36 | + email_verified?: boolean |
38 | 37 |
|
39 | 38 | } |
40 | 39 |
|
41 | 40 | export class Token { |
42 | | - public readonly token: string |
43 | | - public readonly content: ITokenContent |
44 | | - |
45 | | - constructor(token: string) { |
46 | | - this.token = token |
47 | | - const jwtPayload = decode(this.token, {json: true}); |
48 | | - if ( |
49 | | - jwtPayload !== null && |
50 | | - jwtPayload.iss !== undefined && |
51 | | - jwtPayload.sub !== undefined && |
52 | | - jwtPayload.aud !== undefined && |
53 | | - jwtPayload.exp !== undefined && |
54 | | - jwtPayload.iat !== undefined |
55 | | - ) { |
56 | | - this.content = { |
57 | | - ...jwtPayload, |
58 | | - iss: jwtPayload.iss, |
59 | | - sub: jwtPayload.sub, |
60 | | - aud: jwtPayload.aud, |
61 | | - exp: jwtPayload.exp, |
62 | | - iat: jwtPayload.iat, |
63 | | - } |
64 | | - } else { |
65 | | - throw new Error('Invalid token'); |
66 | | - } |
67 | | - } |
| 41 | + public readonly token: string |
| 42 | + public readonly content: ITokenContent |
68 | 43 |
|
69 | | - isExpired(): boolean { |
70 | | - return (this.content.exp * 1000) <= Date.now() |
| 44 | + constructor (token: string) { |
| 45 | + this.token = token |
| 46 | + const payload = decode(this.token, { json: true }) |
| 47 | + if ( |
| 48 | + payload?.iss !== undefined && |
| 49 | + payload?.sub !== undefined && |
| 50 | + payload?.aud !== undefined && |
| 51 | + payload?.exp !== undefined && |
| 52 | + payload?.iat !== undefined |
| 53 | + ) { |
| 54 | + this.content = { |
| 55 | + ...payload, |
| 56 | + iss: payload.iss, |
| 57 | + sub: payload.sub, |
| 58 | + aud: payload.aud, |
| 59 | + exp: payload.exp, |
| 60 | + iat: payload.iat |
| 61 | + } |
| 62 | + } else { |
| 63 | + throw new Error('Invalid token') |
71 | 64 | } |
| 65 | + } |
72 | 66 |
|
73 | | - hasApplicationRole(appName: string, roleName: string): boolean { |
74 | | - const appRoles = this.content.resource_access[appName] |
75 | | - if (appRoles == null) { |
76 | | - return false |
77 | | - } |
| 67 | + isExpired (): boolean { |
| 68 | + return (this.content.exp * 1000) <= Date.now() |
| 69 | + } |
78 | 70 |
|
79 | | - return (appRoles.roles.indexOf(roleName) >= 0) |
| 71 | + hasApplicationRole (appName: string, roleName: string): boolean { |
| 72 | + const appRoles = this.content.resource_access[appName] |
| 73 | + if (appRoles == null) { |
| 74 | + return false |
80 | 75 | } |
81 | 76 |
|
82 | | - hasRealmRole(roleName: string): boolean { |
83 | | - return (this.content.realm_access.roles.indexOf(roleName) >= 0) |
84 | | - } |
| 77 | + return (appRoles.roles.indexOf(roleName) >= 0) |
| 78 | + } |
| 79 | + |
| 80 | + hasRealmRole (roleName: string): boolean { |
| 81 | + return (this.content.realm_access.roles.indexOf(roleName) >= 0) |
| 82 | + } |
85 | 83 | } |
0 commit comments