asyavee/medusa-store
1
0 Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

feat(): Add support for jwt asymetric keys (#12813)

Browse Source 
* feat(): Add support for jwt asymetric keys

* Create early-chefs-chew.md

* fix unit tests

* Add verify options support

* feedback

* fix unit tests
This commit is contained in:
Adrien de Peretti authored and GitHub committed 2025-06-25 10:29:32 +02:00
1 parent a833c3c98c
commit d517dbd66a
23 files changed
+813 -43
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/core/core-flows/src/auth/workflows/generate-reset-password-token.ts
+4 -1
View File
@@ -9,6 +9,7 @@ import {
WorkflowResponse,
} from "@medusajs/framework/workflows-sdk"
import { emitEventStep, useRemoteQueryStep } from "../../common"
import { ProjectConfigOptions } from "@medusajs/framework/types"
/**
* This workflow generates a reset password token for a user. It's used by the
@@ -45,7 +46,8 @@ export const generateResetPasswordTokenWorkflow = createWorkflow(
entityId: string
actorType: string
provider: string
secret: string
secret: ProjectConfigOptions["http"]["jwtSecret"]
jwtOptions?: ProjectConfigOptions["http"]["jwtOptions"]
}) => {
const providerIdentities = useRemoteQueryStep({
entry_point: "provider_identity",
@@ -79,6 +81,7 @@ export const generateResetPasswordTokenWorkflow = createWorkflow(
{
secret: input.secret,
expiresIn: "15m",
jwtOptions: input.jwtOptions,
}
)
packages/core/framework/src/config/config.ts
+14
View File
@@ -80,7 +80,21 @@ export class ConfigManager {
http.storeCors = http.storeCors ?? ""
http.adminCors = http.adminCors ?? ""
http.jwtOptions ??= {}
http.jwtOptions.expiresIn = http.jwtExpiresIn
http.jwtSecret = http?.jwtSecret ?? process.env.JWT_SECRET
http.jwtPublicKey = http?.jwtPublicKey ?? process.env.JWT_PUBLIC_KEY
if (
http?.jwtPublicKey &&
((http.jwtVerifyOptions && !http.jwtVerifyOptions.algorithms?.length) ||
(http.jwtOptions && !http.jwtOptions.algorithm))
) {
this.rejectErrors(
`JWT public key is provided but no algorithm is set in the 'jwtVerifyOptions' or 'jwtOptions' if 'jwtVerifyOptions' is not provided. It means that the algorithm will be inferred from the public key which can lead to missmatch and invalid algorithm errors.`
)
}
if (!http.jwtSecret) {
this.rejectErrors(
packages/core/framework/src/http/middlewares/authenticate-middleware.ts
+26 -5
View File
@@ -1,7 +1,13 @@
import { ApiKeyDTO, IApiKeyModuleService } from "@medusajs/types"
import { ContainerRegistrationKeys, Modules } from "@medusajs/utils"
import { NextFunction, RequestHandler } from "express"
import { JwtPayload, verify } from "jsonwebtoken"
import type {
JwtPayload,
Secret,
SignOptions,
VerifyOptions,
} from "jsonwebtoken"
import { verify } from "jsonwebtoken"
import { ConfigModule } from "../../config"
import {
AuthContext,
@@ -76,7 +82,9 @@ export const authenticate = (
req.headers.authorization,
http.jwtSecret!,
authTypes,
actorTypes
actorTypes,
http.jwtPublicKey,
http.jwtVerifyOptions ?? http.jwtOptions
)
}
@@ -172,9 +180,11 @@ const getAuthContextFromSession = (
export const getAuthContextFromJwtToken = (
authHeader: string | undefined,
jwtSecret: string,
jwtSecret: Secret,
authTypes: AuthType[],
actorTypes: string[]
actorTypes: string[],
jwtPublicKey?: Secret,
jwtOptions?: VerifyOptions | SignOptions
): AuthContext | null => {
if (!authTypes.includes(BEARER_AUTH)) {
return null
@@ -195,7 +205,18 @@ export const getAuthContextFromJwtToken = (
// get config jwt secret
// verify token and set authUser
try {
const verified = verify(token, jwtSecret) as JwtPayload
const options = { ...jwtOptions } as VerifyOptions & SignOptions
if (!options.algorithms && options.algorithm) {
options.algorithms = [options.algorithm]
delete options.algorithm
}
const verified = verify(
token,
jwtPublicKey ?? jwtSecret!,
options
) as JwtPayload
if (isActorTypePermitted(actorTypes, verified.actor_type)) {
return verified as AuthContext
}
packages/core/types/package.json
+1
View File
@@ -35,6 +35,7 @@
"bignumber.js": "^9.1.2"
},
"devDependencies": {
"@types/jsonwebtoken": "^8.5.9",
"awilix": "^8.0.1",
"expect-type": "^0.20.0",
"ioredis": "^5.4.1",
packages/core/types/src/common/config-module.ts
+65 -1
View File
@@ -2,6 +2,7 @@ import {
ExternalModuleDeclaration,
InternalModuleDeclaration,
} from "../modules-sdk"
import type { SignOptions, Secret, VerifyOptions } from "jsonwebtoken"
import type { RedisOptions } from "ioredis"
import { ConnectionOptions } from "node:tls"
@@ -505,7 +506,70 @@ export type ProjectConfigOptions = {
* })
* ```
*/
jwtSecret?: string
jwtSecret?: Secret
/**
* The public key used to verify the JWT token in combination with the JWT secret and the JWT options.
* Only used when the JWT secret is a secret key for asymetric validation.
*
* @example
* ```js title="medusa-config.ts"
* module.exports = defineConfig({
* projectConfig: {
* http: {
* jwtPublicKey: "public-key"
* }
* // ...
* },
* // ...
* })
* ```
*/
jwtPublicKey?: Secret
/**
* Options for the JWT token when using asymetric signing private/public key. Will be used for validation if `jwtVerifyOptions` is not provided.
*
* @example
* ```js title="medusa-config.ts"
* module.exports = defineConfig({
* projectConfig: {
* http: {
* jwtOptions: {
* algorithm: "RS256",
* expiresIn: "1h",
* issuer: "medusa",
* keyid: "medusa",
* }
* }
* // ...
* },
* // ...
* })
* ```
*/
jwtOptions?: SignOptions
/**
* Options for the JWT token when using asymetric validation private/public key.
*
* @example
* ```js title="medusa-config.ts"
* module.exports = defineConfig({
* projectConfig: {
* http: {
* jwtVerifyOptions: {
* // ...
* }
* }
* // ...
* },
* // ...
* })
* ```
*/
jwtVerifyOptions?: VerifyOptions
/**
* The expiration time for the JWT token. Its format is based off the [ms package](https://github.com/vercel/ms).
*
packages/core/utils/src/auth/token.ts
+11 -5
View File
@@ -1,21 +1,27 @@
import jwt from "jsonwebtoken"
import jwt, { type Secret, type SignOptions } from "jsonwebtoken"
import { MedusaError } from "../common"
export const generateJwtToken = (
tokenPayload: Record<string, unknown>,
jwtConfig: {
secret: string | undefined
expiresIn: string | undefined
secret?: Secret
expiresIn?: number | string
jwtOptions?: SignOptions
}
) => {
if (!jwtConfig.secret || !jwtConfig.expiresIn) {
if (
!jwtConfig.secret ||
(!jwtConfig.expiresIn && !jwtConfig.jwtOptions?.expiresIn)
) {
throw new MedusaError(
MedusaError.Types.INVALID_ARGUMENT,
"JWT secret and expiresIn must be provided when generating a token"
)
}
const expiresIn = jwtConfig.expiresIn ?? jwtConfig.jwtOptions?.expiresIn
return jwt.sign(tokenPayload, jwtConfig.secret, {
expiresIn: jwtConfig.expiresIn,
...jwtConfig.jwtOptions,
expiresIn,
})
}
packages/core/utils/src/common/__tests__/define-config.spec.ts
+40
View File
@@ -117,7 +117,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -132,6 +135,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -277,7 +281,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -292,6 +299,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -445,7 +453,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -460,6 +471,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -614,7 +626,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -629,6 +644,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -771,7 +787,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -786,6 +805,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:3000",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -931,7 +951,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -946,6 +969,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:3000",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -1119,7 +1143,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -1139,6 +1166,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -1314,7 +1342,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -1334,6 +1365,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -1525,7 +1557,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -1545,6 +1580,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
@@ -1708,7 +1744,10 @@ describe("defineConfig", function () {
},
"user": {
"options": {
"jwt_options": undefined,
"jwt_public_key": undefined,
"jwt_secret": "supersecret",
"jwt_verify_options": undefined,
},
"resolve": "@medusajs/medusa/user",
},
@@ -1723,6 +1762,7 @@ describe("defineConfig", function () {
"adminCors": "http://localhost:3000",
"authCors": "http://localhost:7000,http://localhost:7001,http://localhost:5173",
"cookieSecret": "supersecret",
"jwtPublicKey": undefined,
"jwtSecret": "supersecret",
"restrictedFields": {
"store": [
packages/core/utils/src/common/define-config.ts
+11 -4
View File
@@ -48,7 +48,7 @@ export function defineConfig(config: InputConfig = {}): ConfigModule {
const projectConfig = normalizeProjectConfig(config.projectConfig, options)
const adminConfig = normalizeAdminConfig(config.admin)
const modules = resolveModules(config.modules, options)
const modules = resolveModules(config.modules, options, config.projectConfig)
return {
projectConfig,
@@ -132,7 +132,8 @@ export function transformModules(
*/
function resolveModules(
configModules: InputConfig["modules"],
{ isCloud }: { isCloud: boolean }
{ isCloud }: { isCloud: boolean },
projectConfig: InputConfig["projectConfig"]
): Exclude<ConfigModule["modules"], undefined> {
const sharedModules = [
{ resolve: MODULE_PACKAGE_NAMES[Modules.STOCK_LOCATION] },
@@ -166,7 +167,10 @@ function resolveModules(
{
resolve: MODULE_PACKAGE_NAMES[Modules.USER],
options: {
jwt_secret: process.env.JWT_SECRET ?? DEFAULT_SECRET,
jwt_secret: projectConfig?.http?.jwtSecret ?? DEFAULT_SECRET,
jwt_options: projectConfig?.http?.jwtOptions,
jwt_verify_options: projectConfig?.http?.jwtVerifyOptions,
jwt_public_key: projectConfig?.http?.jwtPublicKey,
},
},
{
@@ -318,7 +322,7 @@ function normalizeProjectConfig(
* The defaults to use for the project config. They are shallow merged
* with the user defined config.
*/
return {
const config = {
...(isCloud ? { redisUrl: process.env.REDIS_URL } : {}),
databaseUrl: process.env.DATABASE_URL || DEFAULT_DATABASE_URL,
http: {
@@ -326,6 +330,7 @@ function normalizeProjectConfig(
adminCors: process.env.ADMIN_CORS || DEFAULT_ADMIN_CORS,
authCors: process.env.AUTH_CORS || DEFAULT_ADMIN_CORS,
jwtSecret: process.env.JWT_SECRET || DEFAULT_SECRET,
jwtPublicKey: process.env.JWT_PUBLIC_KEY,
cookieSecret: process.env.COOKIE_SECRET || DEFAULT_SECRET,
restrictedFields: {
store: DEFAULT_STORE_RESTRICTED_FIELDS,
@@ -375,6 +380,8 @@ function normalizeProjectConfig(
},
...restOfProjectConfig,
} satisfies ConfigModule["projectConfig"]
return config
}
function normalizeAdminConfig(