diff --git a/package.json b/package.json index 76f793d..4dd8ac1 100644 --- a/package.json +++ b/package.json @@ -60,7 +60,7 @@ "typescript": "^4.9.4" }, "dependencies": { - "jose": "^4.11.2", + "@tsndr/cloudflare-worker-jwt": "^2.5.2", "superstruct": "^1.0.3" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2ddf954..b14b875 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,9 +5,9 @@ settings: excludeLinksFromLockfile: false dependencies: - jose: - specifier: ^4.11.2 - version: 4.11.2 + '@tsndr/cloudflare-worker-jwt': + specifier: ^2.5.2 + version: 2.5.3 superstruct: specifier: ^1.0.3 version: 1.0.3 @@ -571,6 +571,10 @@ packages: playwright-core: 1.29.2 dev: true + /@tsndr/cloudflare-worker-jwt@2.5.3: + resolution: {integrity: sha512-zbdvjRG86y/ObiBgTJrzBC39t2FcaeGwB6AV7VO4LvHKJNyZvLYRbKT68eaoJhnJldyHhs7yZ69neRVdUd9knA==} + dev: false + /@types/is-ci@3.0.0: resolution: {integrity: sha512-Q0Op0hdWbYd1iahB+IFNQcWXFq4O0Q5MwQP7uN0souuQ4rPg1vEYcnIOfr1gY+M+6rc8FGoRaBO1mOOvL29sEQ==} dependencies: @@ -1823,10 +1827,6 @@ packages: resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==} dev: true - /jose@4.11.2: - resolution: {integrity: sha512-njj0VL2TsIxCtgzhO+9RRobBvws4oYyCM8TpvoUQwl/MbIM3NFJRR9+e6x0sS5xXaP1t6OCBkaBME98OV9zU5A==} - dev: false - /js-sdsl@4.2.0: resolution: {integrity: sha512-dyBIzQBDkCqCu+0upx25Y2jGdbTGxE9fshMsCdK0ViOongpV+n5tXRcZY9v7CaVQ79AGS9KA1KHtojxiM7aXSQ==} dev: true diff --git a/src/init.ts b/src/init.ts index 6703d96..f924730 100644 --- a/src/init.ts +++ b/src/init.ts @@ -1,9 +1,9 @@ -import * as jose from 'jose'; +import { sign } from '@tsndr/cloudflare-worker-jwt'; import type * as Firestore from './types'; import { FIRESTORE_ENDPOINT } from './utils'; -const alg = 'RS256'; +const algorithm = 'RS256'; const aud = `${FIRESTORE_ENDPOINT}/`; /** @@ -27,19 +27,20 @@ export const init = async ({ uid: string; claims?: Record; }): Promise => { - const sign_key = await jose.importPKCS8(private_key.replace(/\\n/g, '\n'), alg); - - const jwt = await new jose.SignJWT({ - aud, - uid, - claims, - sub: client_email, - iss: client_email, - }) - .setProtectedHeader({ alg, kid: private_key_id }) - .setIssuedAt() - .setExpirationTime('1h') - .sign(sign_key); + const jwt = await sign( + { + aud, + uid, + claims, + sub: client_email, + iss: client_email, + iat: Math.floor(Date.now() / 1000), + exp: Math.floor(Date.now() / 1000) + 3600, + ...claims, + }, + private_key, + { algorithm, header: { kid: private_key_id } } + ); return { project_id,