feat(): Add support for jwt asymetric keys (#12813)

* feat(): Add support for jwt asymetric keys

* Create early-chefs-chew.md

* fix unit tests

* Add verify options support

* feedback

* fix unit tests

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/callback/route.ts

@@ -38,8 +38,9 @@ export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
     const token = generateJwtTokenForAuthIdentity(
       { authIdentity, actorType: actor_type },
       {
-        secret: http.jwtSecret,
+        secret: http.jwtSecret!,
         expiresIn: http.jwtExpiresIn,
+        options: http.jwtOptions,
       }
     )
 

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/register/route.ts

@@ -41,8 +41,9 @@ export const POST = async (req: MedusaRequest, res: MedusaResponse) => {
         actorType: actor_type,
       },
       {
-        secret: http.jwtSecret,
+        secret: http.jwtSecret!,
         expiresIn: http.jwtExpiresIn,
+        options: http.jwtOptions,
       }
     )
 

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/reset-password/route.ts

@@ -22,7 +22,8 @@ export const POST = async (
       entityId: identifier,
       actorType: actor_type,
       provider: auth_provider,
-      secret: http.jwtSecret as string,
+      secret: http.jwtSecret!,
+      jwtOptions: http.jwtOptions,
     },
     throwOnError: false, // we don't want to throw on error to avoid leaking information about non-existing identities
   })

packages/medusa/src/api/auth/[actor_type]/[auth_provider]/route.ts

@@ -45,8 +45,9 @@ export const GET = async (req: MedusaRequest, res: MedusaResponse) => {
         actorType: actor_type,
       },
       {
-        secret: http.jwtSecret,
+        secret: http.jwtSecret!,
         expiresIn: http.jwtExpiresIn,
+        options: http.jwtOptions,
       }
     )
 

packages/medusa/src/api/auth/token/refresh/route.ts

@@ -26,8 +26,9 @@ export const POST = async (
   const token = generateJwtTokenForAuthIdentity(
     { authIdentity, actorType: req.auth_context.actor_type },
     {
-      secret: http.jwtSecret,
+      secret: http.jwtSecret!,
       expiresIn: http.jwtExpiresIn,
+      options: http.jwtOptions,
     }
   )
 

packages/medusa/src/api/auth/utils/generate-jwt-token.ts

@@ -1,5 +1,9 @@
-import { AuthIdentityDTO } from "@medusajs/framework/types"
+import {
+  AuthIdentityDTO,
+  ProjectConfigOptions,
+} from "@medusajs/framework/types"
 import { generateJwtToken } from "@medusajs/framework/utils"
+import { type Secret } from "jsonwebtoken"
 
 export function generateJwtTokenForAuthIdentity(
   {
@@ -9,8 +13,14 @@ export function generateJwtTokenForAuthIdentity(
   {
     secret,
     expiresIn,
-  }: { secret: string | undefined; expiresIn: string | undefined }
+    options,
+  }: {
+    secret: Secret
+    expiresIn: string | undefined
+    options?: ProjectConfigOptions["http"]["jwtOptions"]
+  }
 ) {
+  const expiresIn_ = expiresIn ?? options?.expiresIn
   const entityIdKey = `${actorType}_id`
   const entityId = authIdentity?.app_metadata?.[entityIdKey] as
     | string
@@ -27,7 +37,8 @@ export function generateJwtTokenForAuthIdentity(
     },
     {
       secret,
-      expiresIn,
+      expiresIn: expiresIn_,
+      jwtOptions: options,
     }
   )
 }

packages/medusa/src/api/auth/utils/validate-token.ts

@@ -30,16 +30,17 @@ export const validateToken = () => {
 
     const req_ = req as AuthenticatedMedusaRequest
 
-    // @ts-ignore
     const { http } = req_.scope.resolve<ConfigModule>(
       ContainerRegistrationKeys.CONFIG_MODULE
     ).projectConfig
 
     const token = getAuthContextFromJwtToken(
       req.headers.authorization,
-      http.jwtSecret as string,
+      http.jwtSecret!,
       ["bearer"],
-      [actor_type]
+      [actor_type],
+      http.jwtPublicKey,
+      http.jwtVerifyOptions ?? http.jwtOptions
     ) as UpdateProviderJwtPayload | null
 
     const errorObject = new MedusaError(