fixup! feat: add JWT bearer authorization grant (RFC 7523)

Author: dhensby

lib/grant-types/jwt-bearer-grant-type.js

@@ -36,7 +36,7 @@ const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
  *   - `getJWTBearerIssuer(issuer)` → `{ audience, jwks | jwksUri | secret }` (or
  *     falsy for an untrusted issuer) — the verification key material and the
  *     expected `aud`.
- *   - `getJWTBearerUser({ issuer, subject, client, scope, jti, exp })` → the
+ *   - `getJWTBearerUser({ issuer, subject, client, scope, jti, assertionId, exp })` → the
  *     authorized user (or falsy to deny). Replay (`jti`) can be enforced here.
  *
  * @example
@@ -162,22 +162,33 @@ class JwtBearerGrantType extends AbstractGrantType {
    * Resolve the verification key for the issuer (HMAC secret or asymmetric JWKS).
    */
   async getKey(issuerData, header) {
+    const hasSecret = typeof issuerData.secret === 'string' && issuerData.secret.length > 0;
+    const hasJwks = !!issuerData.jwks || !!issuerData.jwksUri;
+
+    // No key material at all is a server-side misconfiguration of the issuer.
+    if (!hasSecret && !hasJwks) {
+      throw new ServerError('Server error: issuer has no key material for assertion verification');
+    }
+
     if (isHmac(header.alg)) {
-      if (typeof issuerData.secret !== 'string' || issuerData.secret.length === 0) {
-        throw new ServerError('Server error: issuer has no secret for HMAC assertion verification');
+      // The issuer has key material, just not for this algorithm family — that
+      // makes the assertion unverifiable against this issuer, i.e. the client's
+      // fault, not the server's.
+      if (!hasSecret) {
+        throw new InvalidGrantError('Invalid grant: assertion algorithm does not match the issuer key material');
       }
       return new TextEncoder().encode(issuerData.secret);
     }
 
-    if (issuerData.jwks) {
-      return createLocalJWKSet(issuerData.jwks);
+    if (!hasJwks) {
+      throw new InvalidGrantError('Invalid grant: assertion algorithm does not match the issuer key material');
     }
 
-    if (issuerData.jwksUri) {
-      return getRemoteJwks(issuerData.jwksUri);
+    if (issuerData.jwks) {
+      return createLocalJWKSet(issuerData.jwks);
     }
 
-    throw new ServerError('Server error: issuer has no keys for assertion verification');
+    return getRemoteJwks(issuerData.jwksUri);
   }
 
   /**

test/integration/grant-types/jwt-bearer-grant-type_test.js

@@ -333,7 +333,7 @@ describe('JWT bearer authorization grant integration', function () {
       );
     });
 
-    it('throws server_error when the issuer has no HMAC secret', async function () {
+    it('throws server_error when the issuer has no key material (HMAC alg)', async function () {
       await grant
         .getKey({}, { alg: 'HS256' })
         .then(() => {
@@ -342,14 +342,32 @@ describe('JWT bearer authorization grant integration', function () {
         .catch((e) => e.name.should.equal('server_error'));
     });
 
-    it('throws server_error when the issuer has no keys', async function () {
+    it('throws server_error when the issuer has no key material (asymmetric alg)', async function () {
       await grant
         .getKey({}, { alg: 'RS256' })
         .then(() => {
           throw new Error('should throw');
         })
         .catch((e) => e.name.should.equal('server_error'));
     });
+
+    it('rejects (invalid_grant) an HS256 assertion when the issuer is asymmetric-only', async function () {
+      await grant
+        .getKey({ jwks: { keys: [] } }, { alg: 'HS256' })
+        .then(() => {
+          throw new Error('should throw');
+        })
+        .catch((e) => e.name.should.equal('invalid_grant'));
+    });
+
+    it('rejects (invalid_grant) an RS256 assertion when the issuer is HMAC-only', async function () {
+      await grant
+        .getKey({ secret: 'shhh' }, { alg: 'RS256' })
+        .then(() => {
+          throw new Error('should throw');
+        })
+        .catch((e) => e.name.should.equal('invalid_grant'));
+    });
   });
 
   describe('constructor and argument guards', function () {