wwenj / sign-in-with-apple-for-node Goto Github PK

const getAppleIDPublicKey = async (kid) => {
  const url = new URL(ENDPOINT_URL);
  url.pathname = '/auth/keys';

  const data = await request({ url: url.toString(), method: 'GET' });
  const keys = JSON.parse(data).keys;
  const key = keys.find(k => k.kid === kid);

  const pubKey = new NodeRSA();
  pubKey.importKey({ n: Buffer.from(key.n, 'base64'), e: Buffer.from(key.e, 'base64') }, 'components-public');
  return pubKey.exportKey(['public']);
};

const verifyIdToken = async (idToken, clientID) => {
  const decodedToken = jwt.decode(idToken, { complete: true });
  const applePublicKey = await getAppleIDPublicKey(decodedToken.header.kid);
  const jwtClaims = jwt.verify(idToken, applePublicKey, { algorithms: 'RS256' });

  if (jwtClaims.iss !== TOKEN_ISSUER) throw new Error('id token not issued by correct OpenID provider - expected: ' + TOKEN_ISSUER + ' | from: ' + jwtClaims.iss);
  if (clientID !== undefined && jwtClaims.aud !== clientID) throw new Error('aud parameter does not include this client - is: ' + jwtClaims.aud + '| expected: ' + clientID);
  if (jwtClaims.exp < (Date.now() / 1000)) throw new Error('id token has expired');

  return jwtClaims;
};