talk/secrets.js

const { JWT_SECRETS, JWT_SECRET, JWT_ALG } = require('./config');

const debug = require('debug')('talk:secrets');
const jwt = require('./services/jwt');

if (JWT_SECRETS) {
  if (!Array.isArray(JWT_SECRETS)) {
    throw new Error(
      'TALK_JWT_SECRETS must be a JSON array in the form [{"kid": kid, ["secret": secret | "private": private, "public": public]}, ...]'
    );
  }

  if (JWT_SECRETS.length === 0) {
    throw new Error(
      'TALK_JWT_SECRETS must be a JSON array with non zero length'
    );
  }

  // Wrap a multi-secret around the available secrets.
  module.exports.jwt = new jwt.MultiSecret(
    JWT_SECRETS.map(secret => {
      if (!('kid' in secret)) {
        throw new Error(
          "when multiple keys are specified, kid's must be specified"
        );
      }

      if (typeof secret.kid !== 'string' || secret.kid.length === 0) {
        throw new Error('kid must be a unique string');
      }

      // HMAC secrets do not have public/private keys.
      if (JWT_ALG.startsWith('HS')) {
        return new jwt.SharedSecret(secret, JWT_ALG);
      }

      if (!('public' in secret)) {
        throw new Error(
          'all symetric keys must provide a PEM encoded public key'
        );
      }

      return new jwt.AsymmetricSecret(secret, JWT_ALG);
    })
  );

  debug(
    `loaded ${JWT_SECRETS.length} ${
      JWT_ALG.startsWith('HS') ? 'shared' : 'asymmetric'
    } secrets`
  );
} else if (JWT_SECRET) {
  if (JWT_ALG.startsWith('HS')) {
    module.exports.jwt = new jwt.SharedSecret(
      {
        secret: JWT_SECRET,
      },
      JWT_ALG
    );
  } else {
    module.exports.jwt = new jwt.AsymmetricSecret(
      JSON.parse(JWT_SECRET),
      JWT_ALG
    );
  }

  debug(
    `loaded a ${JWT_ALG.startsWith('HS') ? 'shared' : 'asymmetric'} secret`
  );
}