Function verifyToken

packages/infra/src/internal/auth.ts:202–231

(resolveConfig: Effect.Effect<ResolvedConfig, InvalidRequestError | InvalidTokenError>)

const verifyToken =
  (resolveConfig: Effect.Effect<ResolvedConfig, InvalidRequestError | InvalidTokenError>) => (token: string) =>
    resolveConfig.pipe(
      Effect.flatMap((config) => {
        const options = {
          clockTolerance: config.clockTolerance,
          ...(config.tokenSigningAlg ? { algorithms: [config.tokenSigningAlg] } : {}),
          ...(config.audience !== undefined ? { audience: config.audience } : {}),
          ...(config.issuer !== undefined ? { issuer: config.issuer } : {}),
          ...(config.maxTokenAge !== undefined ? { maxTokenAge: config.maxTokenAge } : {})
        }
        const verified = config.keyType === "jwks"
          ? Effect.tryPromise({
            try: () => jwtVerify(token, config.key, options).then(({ protectedHeader }) => ({ protectedHeader })),
            catch: (error) => new InvalidTokenError(getErrorMessage(error))
          })
          : Effect.tryPromise({
            try: () => jwtVerify(token, config.key, options).then(({ protectedHeader }) => ({ protectedHeader })),
            catch: (error) => new InvalidTokenError(getErrorMessage(error))
          })

        return verified.pipe(
          Effect.flatMap(({ protectedHeader }) => {
            const typ = protectedHeader.typ?.toLowerCase().replace(/^application\//, "")
            return config.strict && typ !== "at+jwt"
              ? Effect.fail(new InvalidTokenError("Unexpected 'typ' value"))
              : Effect.void
          })
        )
      })
    )

export const checkJWTI = (config: Config) => {
  const resolveConfig = makeResolveConfig(config)