|
1 | 1 | import { decode } from 'jsonwebtoken' |
2 | 2 |
|
| 3 | +export interface ITokenContent { |
| 4 | + [key: string]: any, |
| 5 | + |
| 6 | + /** |
| 7 | + * Authorization server’s identifier |
| 8 | + */ |
| 9 | + iss: string, |
| 10 | + |
| 11 | + /** |
| 12 | + * User’s identifier |
| 13 | + */ |
| 14 | + sub: string, |
| 15 | + |
| 16 | + /** |
| 17 | + * Client’s identifier |
| 18 | + */ |
| 19 | + aud: string | string[], |
| 20 | + |
| 21 | + /** |
| 22 | + * Expiration time of the ID token |
| 23 | + */ |
| 24 | + exp: number, |
| 25 | + |
| 26 | + /** |
| 27 | + * Time at which JWT was issued |
| 28 | + */ |
| 29 | + iat: number, |
| 30 | + |
| 31 | + family_name?: string, |
| 32 | + given_name?: string, |
| 33 | + name?: string, |
| 34 | + email?: string, |
| 35 | + preferred_username?: string, |
| 36 | + email_verified?: boolean, |
| 37 | + |
| 38 | + |
| 39 | +} |
| 40 | + |
3 | 41 | export class Token { |
4 | | - private readonly token: string |
5 | | - private readonly content: any |
6 | | - |
7 | | - constructor (token: string) { |
8 | | - this.token = token |
9 | | - this.content = decode(this.token) |
10 | | - } |
11 | | - |
12 | | - isExpired (): boolean { |
13 | | - return (this.content.exp * 1000) <= Date.now() |
14 | | - } |
15 | | - |
16 | | - hasApplicationRole (appName: string, roleName: string): boolean { |
17 | | - const appRoles = this.content.resource_access[appName] |
18 | | - if (appRoles == null) { |
19 | | - return false |
| 42 | + public readonly token: string |
| 43 | + public readonly content: ITokenContent |
| 44 | + |
| 45 | + constructor(token: string) { |
| 46 | + this.token = token |
| 47 | + const jwtPayload = decode(this.token, {json: true}); |
| 48 | + if ( |
| 49 | + jwtPayload !== null && |
| 50 | + jwtPayload.iss !== undefined && |
| 51 | + jwtPayload.sub !== undefined && |
| 52 | + jwtPayload.aud !== undefined && |
| 53 | + jwtPayload.exp !== undefined && |
| 54 | + jwtPayload.iat !== undefined |
| 55 | + ) { |
| 56 | + this.content = { |
| 57 | + ...jwtPayload, |
| 58 | + iss: jwtPayload.iss, |
| 59 | + sub: jwtPayload.sub, |
| 60 | + aud: jwtPayload.aud, |
| 61 | + exp: jwtPayload.exp, |
| 62 | + iat: jwtPayload.iat, |
| 63 | + } |
| 64 | + } else { |
| 65 | + throw new Error('Invalid token'); |
| 66 | + } |
| 67 | + } |
| 68 | + |
| 69 | + isExpired(): boolean { |
| 70 | + return (this.content.exp * 1000) <= Date.now() |
20 | 71 | } |
21 | 72 |
|
22 | | - return (appRoles.roles.indexOf(roleName) >= 0) |
23 | | - } |
| 73 | + hasApplicationRole(appName: string, roleName: string): boolean { |
| 74 | + const appRoles = this.content.resource_access[appName] |
| 75 | + if (appRoles == null) { |
| 76 | + return false |
| 77 | + } |
| 78 | + |
| 79 | + return (appRoles.roles.indexOf(roleName) >= 0) |
| 80 | + } |
24 | 81 |
|
25 | | - hasRealmRole (roleName: string): boolean { |
26 | | - return (this.content.realm_access.roles.indexOf(roleName) >= 0) |
27 | | - } |
| 82 | + hasRealmRole(roleName: string): boolean { |
| 83 | + return (this.content.realm_access.roles.indexOf(roleName) >= 0) |
| 84 | + } |
28 | 85 | } |
0 commit comments