Throw TokenInvalidError for invalid tokens

Wrap the jose errors

Author: mvantellingen

.changeset/rude-snails-tease.md

@@ -0,0 +1,5 @@
+---
+"@labdigital/federated-token": minor
+---
+
+Throw TokenInvalidError for invalid tokens

src/sign.test.ts

@@ -79,4 +79,22 @@ describe("Strings", async () => {
 			iss: "exampleIssuer",
 		});
 	});
+
+	test("JWT Decrypt with invalid ISS", async () => {
+		const payload = {
+			foo: "bar",
+		};
+		const invalidSigner = new TokenSigner({
+			...signOptions,
+			issuer: "invalidIssuer",
+		});
+
+		const exp = Math.floor(Date.now() / 1000) + 60 * 60 * 24 * 90;
+		const token = await invalidSigner.encryptJWT(payload, exp);
+		expect(token).toBeDefined();
+
+		expect(() => signer.decryptJWT(token)).rejects.toThrowError(
+			`unexpected "iss" claim value`
+		);
+	});
 });

src/sign.ts

@@ -1,5 +1,9 @@
 import * as jose from "jose";
-import { PublicFederatedToken } from "jwt";
+import {
+	PublicFederatedToken,
+	TokenExpiredError,
+	TokenInvalidError,
+} from "./jwt";
 import { KeyObject } from "node:crypto";
 
 type TokenSignerOptions = {
@@ -70,15 +74,28 @@ export class TokenSigner {
 	}
 
 	async verifyJWT(value: string) {
-		return await jose.jwtVerify(
-			value,
-			this._signKeys.getKeyFunction.bind(this._signKeys),
-			{
-				algorithms: ["HS256"],
-				audience: this.config.audience,
-				issuer: this.config.issuer,
+		try {
+			return await jose.jwtVerify(
+				value,
+				this._signKeys.getKeyFunction.bind(this._signKeys),
+				{
+					algorithms: ["HS256"],
+					audience: this.config.audience,
+					issuer: this.config.issuer,
+				}
+			);
+		} catch (e) {
+			if (e instanceof jose.errors.JWTClaimValidationFailed) {
+				throw new TokenExpiredError(e.message);
 			}
-		);
+			if (e instanceof jose.errors.JWTExpired) {
+				throw new TokenExpiredError(e.message);
+			}
+			if (e instanceof Error) {
+				throw new TokenInvalidError(e.message);
+			}
+			throw e;
+		}
 	}
 
 	// For refresh token, encrypt the token (JWE)
@@ -96,14 +113,21 @@ export class TokenSigner {
 	}
 
 	async decryptJWT(jwt: string) {
-		return await jose.jwtDecrypt(
-			jwt,
-			this._encryptKeys.getKeyFunction.bind(this._encryptKeys),
-			{
-				audience: this.config.audience,
-				issuer: this.config.issuer,
+		try {
+			return await jose.jwtDecrypt(
+				jwt,
+				this._encryptKeys.getKeyFunction.bind(this._encryptKeys),
+				{
+					audience: this.config.audience,
+					issuer: this.config.issuer,
+				}
+			);
+		} catch (e) {
+			if (e instanceof jose.errors.JWTClaimValidationFailed) {
+				throw new TokenExpiredError(e.message);
 			}
-		);
+			throw new TokenInvalidError();
+		}
 	}
 }