Function makeResolveConfig

packages/infra/src/internal/auth.ts:145–199

(config: Config)

}

const makeResolveConfig = (config: Config) => {
  let cached: Promise<ResolvedConfig> | undefined

  return Effect.tryPromise({
    try: () => {
      if (!cached) {
        cached = (async (): Promise<ResolvedConfig> => {
          const discovery = config.issuerBaseURL
            ? await fetchDiscoveryDocumentPromise(config.issuerBaseURL)
            : undefined

          const issuer = config.issuer ?? discovery?.issuer
          const jwksUri = config.jwksUri ?? discovery?.jwksUri
          const secret = config.secret
          const base = {
            audience: normalizeAudience(config.audience),
            clockTolerance: config.clockTolerance ?? 5,
            issuer,
            maxTokenAge: config.maxTokenAge,
            strict: config.strict ?? false,
            tokenSigningAlg: config.tokenSigningAlg
          } satisfies ResolvedConfigBase

          if (!issuer && !secret) {
            throw new InvalidRequestError("JWT config requires 'issuer', 'issuerBaseURL', or 'secret'")
          }

          if (!secret) {
            if (!jwksUri) {
              throw new InvalidRequestError("JWT config requires 'jwksUri', 'issuerBaseURL', or 'secret'")
            }

            return {
              ...base,
              key: createRemoteJWKSet(new URL(jwksUri)),
              keyType: "jwks"
            }
          }

          return {
            ...base,
            key: new TextEncoder().encode(secret),
            keyType: "secret"
          }
        })()
      }

      return cached
    },
    catch: (error) =>
      error instanceof InvalidRequestError || error instanceof InvalidTokenError
        ? error
        : new InvalidTokenError(getErrorMessage(error))
  })
}

const verifyToken =
  (resolveConfig: Effect.Effect<ResolvedConfig, InvalidRequestError | InvalidTokenError>) => (token: string) =>