[{"_1":2,"_170":-5,"_171":-5},"loaderData",{"_3":4,"_92":93},"root",{"_5":6,"_35":36,"_65":66},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20,"_34":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","isTeamOrgMember","ENV",{"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","5c349ef9e7d7333839a0634dd567aae2d49623a6","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_67":68},"__internal_clerk_state",{"_69":70,"_71":46,"_72":73,"_74":73,"_75":20,"_76":73,"_77":73,"_78":73,"_79":73,"_80":81,"_90":20,"_91":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_82":20,"_19":20,"_83":73,"_84":85,"_86":73,"_87":46,"_88":20,"_89":73},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_94":95,"_96":97,"_98":99,"_100":101,"_149":150,"_167":168,"_169":-5},"handle","postpostscript","name","jwksUtils","path","main.tsx","project",{"_102":103,"_96":97,"_104":105,"_106":-5,"_107":108,"_109":110,"_111":-5,"_112":-5,"_12":113,"_114":-5,"_115":108,"_116":-5,"_117":-5,"_118":32,"_14":119,"_120":121,"_122":121,"_123":124,"_125":124,"_126":124,"_127":121,"_128":121,"_23":129,"_132":133,"_135":136,"_148":20},"id","3d4e23e6-2760-11f0-86ff-569c3dd06744","createdAt",["D",1746195474734],"deletedAt","legacyEnvVars",true,"privacy","public","description","imageUrl","4bfb99a9-2008-40e0-bacb-7c7d84227cee","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","1073b191-f665-405d-9530-545465c93575","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_94":95,"_130":131},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvdXBsb2FkZWQvaW1nXzJjdlhaRXl0WXVNSlhZcWU0ckI2c1BOMjNhQSJ9","org",{"_94":95,"_134":131,"_12":113},"avatar","branch",{"_137":138,"_96":44,"_102":139,"_140":103,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":97,"_147":95},"version",31,"3d4f078e-2760-11f0-86ff-569c3dd06744","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_102":151,"_96":99,"_152":153,"_154":-5,"_155":139,"_156":138,"_157":108,"_104":158,"_137":159,"_160":161,"_162":163,"_164":20,"_165":-5,"_98":166},"3dfc3da0-2760-11f0-86ff-569c3dd06744","fileId","3d516826-2760-11f0-86ff-569c3dd06744","parentId","branchId","branchVersion","latest",["D",1709771729827],30,"fileType","script","content","import * as jose from \"https://deno.land/x/jose@v5.2.2/index.ts\";\nimport type { MaybePromise } from \"https://esm.town/v/postpostscript/typeUtils\";\nexport type { JWK, JWTPayload } from \"https://deno.land/x/jose@v5.2.2/index.ts\";\nimport { getValEndpointFromName, getValNameFromUrl } from \"https://esm.town/v/postpostscript/meta\";\nimport { trackUse } from \"https://esm.town/v/postpostscript/trackUse\";\n\nexport type JWTCustomClaims = Record;\n\nexport type JWTVerifyOptions = jose.JWTVerifyOptions & {\n custom?: Record | ((payload: jose.JWTPayload) => MaybePromise>);\n customClaimVerifiers?: Record;\n};\n\nexport type JWTCustomClaimVerifier = (payload: jose.JWTPayload, claim: unknown) => MaybePromise;\n\nexport function createVerifyMethod(keys: () => MaybePromise) {\n return async function verify(\n token: string,\n options: JWTVerifyOptions,\n ) {\n const publicKey = await jose.importJWK((await keys())[0]);\n const { payload } = await jose.jwtVerify(token, publicKey, options);\n const customClaims = options.custom && (\n options.custom instanceof Function\n ? await options.custom(payload)\n : options.custom\n );\n await verifyCustomClaims(payload, customClaims || {}, options.customClaimVerifiers ?? defaultCustomClaimVerifiers);\n return payload;\n };\n}\n\nexport function createGenerateMethod(keys: () => MaybePromise) {\n return async function generate(payload: any, exp?: string | number | Date) {\n const _keys = await keys();\n const privateKey = await jose.importJWK(_keys[0]);\n\n let jwt = new jose.SignJWT({\n jti: crypto.randomUUID(),\n ...payload,\n })\n .setProtectedHeader({ alg: _keys[0].alg })\n .setIssuedAt();\n\n if (exp) {\n jwt = jwt.setExpirationTime(exp);\n }\n\n return jwt.sign(privateKey);\n };\n}\n\nexport async function verifyThirdParty(\n token: string,\n options: JWTVerifyOptions = {},\n) {\n const payload = decode(token);\n const author = payload.iss?.match(/^@(\\w+)\\/\\w+$/)?.[1];\n if (!author) {\n throw new Error(\"issuer does not match the format `@handle/name`\");\n }\n if (payload.exp && payload.exp < (new Date().getTime() / 1000)) {\n throw new Error(\"token has expired\");\n }\n const url = getValEndpointFromName(`@${author}/jwks`);\n const method = createVerifyMethod(() => {\n return fetch(url)\n .then(res => res.json())\n .then(({ keys }) => keys);\n });\n return method(token, options);\n}\n\nexport function decode(token: string) {\n return jose.decodeJwt(token);\n}\n\nexport const defaultCustomClaimVerifiers: Record = {\n scope(payload, claimValue) {\n const scopes = claimValue instanceof Array\n ? claimValue\n : [claimValue];\n const payloadScopes = typeof payload.scope === \"string\"\n ? payload.scope.split(\" \")\n : payload.scope;\n if (!(payloadScopes instanceof Array)) {\n return false;\n }\n const payloadScopesSet = new Set(payloadScopes);\n return scopes.every(scope => payloadScopesSet.has(scope));\n },\n\n async maxUses(payload, claimValue) {\n if (typeof claimValue !== \"number\") {\n throw new Error(\"option custom.maxUses must be a number\");\n }\n if (!payload.jti) {\n throw new Error(\"payload `jti` is not set\");\n }\n await trackUse({\n value: payload.jti,\n max: claimValue,\n delete_after: payload.exp,\n });\n return true;\n },\n};\n\nexport class JWTCustomClaimVerificationFailed extends Error {\n failures: Record;\n\n constructor(message: string, failures: Record, options: ErrorOptions = {}) {\n super(message, options);\n this.failures = failures;\n }\n}\n\nexport async function verifyCustomClaims(\n payload,\n customClaims: Record,\n customClaimVerifiers = defaultCustomClaimVerifiers,\n) {\n const failures: {\n [key in keyof typeof customClaims]: string | Error | undefined;\n } = {};\n const results = await Promise.all(\n Object.entries(customClaims).map(async ([key, value]) => {\n if (!(key in customClaimVerifiers)) {\n failures[key] = `custom claim \"${key}\" does not have a verifier defined`;\n return false;\n }\n try {\n const res = await customClaimVerifiers[key](payload, value);\n if (!res) {\n failures[key] = `custom claim \"${key}\" verification failed for an undisclosed reason`;\n }\n return res;\n } catch (e) {\n failures[key] = e;\n }\n return false;\n }),\n );\n if (results.every(Boolean)) {\n return true;\n }\n const failedKeys = Object.keys(failures);\n throw new JWTCustomClaimVerificationFailed(`claim verifications failed: ${JSON.stringify(failedKeys)}`, failures);\n}","deleted","label",[99],"permalink","https://www.val.town/x/postpostscript/jwksUtils/code/main.tsx","extension","actionData","errors"]