refactor: replace fast-jwt with jose

Author: qoomon

server/deployments/cloudflare/.gitignore

@@ -0,0 +1,2 @@
+/dist/
+/.wrangler

server/deployments/cloudflare/wrangler.toml

@@ -9,7 +9,6 @@ preview_urls = false
 [observability]
 enabled = true
 
-
 [vars]
 GITHUB_APP_ID = "225539"
 GITHUB_ACTIONS_TOKEN_ALLOWED_AUDIENCE ="github-actions-access-token.qoomon.workers.dev"

server/package-lock.json

@@ -14,13 +14,11 @@
   "dependencies": {
     "@aws-sdk/client-lambda": "^3.971.0",
     "@aws-sdk/client-secrets-manager": "^3.972.0",
-
     "@hono/node-server": "^1.19.9",
     "@octokit/auth-app": "^8.1.2",
     "@octokit/rest": "^22.0.1",
-    "fast-jwt": "^6.1.0",
-    "get-jwks": "^11.0.3",
     "hono": "^4.11.4",
+    "jose": "^6.1.3",
     "pino": "^10.2.1",
     "yaml": "^2.8.2",
     "zod": "^4.3.5"

server/package.json

@@ -44,11 +44,14 @@ export function appInit(prepare?: (app: Hono) => void) {
 
   // --- handle access token request -----------------------------------------------------------------------------------
   app.post('/access_tokens',
-      tokenAuthenticator<GitHubActionsJwtPayload>({
-        allowedIss: 'https://token.actions.githubusercontent.com',
-        allowedAud: config.githubActionsTokenVerifier.allowedAud,
-        allowedSub: config.githubActionsTokenVerifier.allowedSub,
-      }),
+      tokenAuthenticator<GitHubActionsJwtPayload>(
+          new URL('https://token.actions.githubusercontent.com/.well-known/jwks'),
+          {
+            issuer: 'https://token.actions.githubusercontent.com',
+            audience: config.githubActionsTokenVerifier.allowedAud,
+            subjects: config.githubActionsTokenVerifier.allowedSub,
+          },
+      ),
       async (context) => {
         const callerIdentity = context.var.token;
         logger.info({

server/src/app.ts

@@ -291,4 +291,5 @@ export type GitHubActionsJwtPayload = {
   run_number: string, // e.g. "107",
   run_attempt: string, // e.g. "4",
   runner_environment: string, // e.g. "github-hosted",
-} & Record<string, string>;
+  [key: string]: string,
+};

server/src/common/github-utils.ts

@@ -4,11 +4,11 @@ import {HTTPException} from 'hono/http-exception';
 import type {StatusCode, UnofficialStatusCode} from 'hono/utils/http-status';
 import {createMiddleware} from 'hono/factory';
 import {ZodType} from 'zod';
-import {createVerifier, KeyFetcher, TokenError, VerifierOptions,} from 'fast-jwt';
 import {formatZodIssue, JsonTransformer} from './zod-utils.js';
 import {Status, StatusPhrases} from './http-utils.js';
-import {buildJwksKeyFetcher} from './jwt-utils.js';
 import {indent} from './common-utils.js';
+import {createRemoteJWKSet, jwtVerify, JWTVerifyOptions} from 'jose';
+import {JOSEError} from 'jose/errors';
 
 /**
  * Creates a NotFoundHandler that responses with JSON
@@ -94,14 +94,15 @@ export async function parseJsonBody<T extends ZodType>(req: HonoRequest, schema:
 
 /**
  * Creates a middleware that verifies a token and sets the token payload as 'token' context variable
+ * @param jwksUrl - URL of the JWKS
  * @param options - fast-jwt createVerifier options
  * @return middleware
  */
 export function tokenAuthenticator<T extends object>(
-    options: Partial<VerifierOptions & { key?: KeyFetcher }>,
+    jwksUrl: URL,
+    options: JWTVerifyOptions & { subjects?: RegExp[] },
 ) {
-  options.key ??= buildJwksKeyFetcher({providerDiscovery: true});
-  const verifier = createVerifier(options);
+  const jwkSet = createRemoteJWKSet(jwksUrl);
 
   return createMiddleware<{ Variables: { token: T } }>(async (context, next) => {
     const authorizationHeaderValue = context.req.header().authorization;
@@ -118,23 +119,25 @@ export function tokenAuthenticator<T extends object>(
       });
     }
 
-    const tokenPayload = await verifier(tokenValue)
-        .catch((error) => {
-          console.log(`FUCK verifier error`, {
-            error: error.message,
-            code: error.code,
-            originalError: error.originalError?.message,
-            stack: JSON.stringify(error.originalError?.stack),
-          }); // TODO remove debug log
-          if (error instanceof TokenError) {
-            throw new HTTPException(Status.UNAUTHORIZED, {
-              message: error.message,
-            });
-          }
-          throw error;
+    const token = await jwtVerify(tokenValue,
+        jwkSet, options,
+    ).catch((error) => {
+      if (error instanceof JOSEError) {
+        throw new HTTPException(Status.UNAUTHORIZED, {
+          message: 'Invalid token: ' + error.message,
         });
+      }
+      throw error;
+    });
+
+    if (options.subjects && !options.subjects
+        .some((subject) => subject.test(token.payload.sub ?? ''))) {
+      throw new HTTPException(Status.UNAUTHORIZED, {
+        message: `Invalid Token: unexpected "sub" claim value`,
+      });
+    }
 
-    context.set('token', tokenPayload as T);
+    context.set('token', token.payload as T);
 
     await next();
   });

server/src/common/hono-utils.ts

@@ -1,7 +1,6 @@
 import pino from "pino";
 import asyncHooks from "node:async_hooks";
 import process from "process";
-import * as crypto from 'node:crypto';
 
 type Bindings = Record<string, unknown>;
 const asyncBindings = new asyncHooks.AsyncLocalStorage<{