التأكد من الـ JWT صح: التوقيع والـ claims والـ scopes

import { call, cases } from "./tokens.js";

for (const [name, method, token] of await cases()) {
  const r = await call(method, token);
  console.log(String(r.status).padEnd(4), name.padEnd(42), r.body.slice(0, 60));
}

$ node issuer.js & I=$!; node server.js & S=$!; sleep 1; node attack.js; kill $I $S
IdP: http://localhost:4000
API: http://localhost:3000
200  token سليم، GET                            [{"id":1,"owner":"user-7","item":"كتاب"}]
401  من غير token                               {"error":"مفيش token"}
200  alg none و sub=admin                       [{"id":2,"owner":"admin","item":"سيرفر"}]
200  token متعدّل sub=admin                     [{"id":2,"owner":"admin","item":"سيرفر"}]
200  aud=billing-api                            [{"id":1,"owner":"user-7","item":"كتاب"}]
200  خلص من دقيقتين                             [{"id":1,"owner":"user-7","item":"كتاب"}]
200  خلص من عشر ثواني (clock skew)              [{"id":1,"owner":"user-7","item":"كتاب"}]
200  id_token بدل access token                  [{"id":1,"owner":"user-7","item":"كتاب"}]
201  scope=orders:read بيعمل POST               {"id":3,"owner":"user-7","item":"قلم"}
201  scope=orders:read orders:write بيعمل POST  {"id":4,"owner":"user-7","item":"قلم"}

// الـ Resource Server: الـ API اللي بيقبل الـ access tokens
import express from "express";
import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";

const app = express();
app.use(express.json());
const orders = [
  { id: 1, owner: "user-7", item: "كتاب" },
  { id: 2, owner: "admin", item: "سيرفر" },
];

const JWKS = createRemoteJWKSet(new URL("http://localhost:4000/jwks"));

const requireAuth = async (req, res, next) => {
  const [scheme, token] = (req.get("authorization") ?? "").split(" ");
  if (scheme !== "Bearer" || !token) {
    res.set("WWW-Authenticate", 'Bearer realm="orders-api"');
    return res.status(401).json({ error: "محتاج token" });
  }
  try {
    const { payload } = await jwtVerify(token, JWKS, {
      issuer: "http://localhost:4000",
      audience: "orders-api",
      algorithms: ["ES256"],
      typ: "at+jwt",
      clockTolerance: 30,
      requiredClaims: ["sub", "exp", "iat"],
    });
    req.user = { sub: payload.sub, scopes: new Set(String(payload.scope ?? "").split(" ")) };
    next();
  } catch (e) {
    console.log("رفضنا:", e.code ?? e.message);
    res.set("WWW-Authenticate", 'Bearer realm="orders-api", error="invalid_token"');
    res.status(401).json({ error: "token مش صالح" });
  }
};

const requireScope = (scope) => (req, res, next) => {
  if (req.user.scopes.has(scope)) return next();
  res.set("WWW-Authenticate", `Bearer realm="orders-api", error="insufficient_scope", scope="${scope}"`);
  res.status(403).json({ error: `محتاج ${scope}` });
};

app.get("/orders", requireAuth, (req, res) => res.json(orders.filter((o) => o.owner === req.user.sub)));
app.post("/orders", requireAuth, requireScope("orders:write"), (req, res) => {
  const o = { id: orders.length + 1, owner: req.user.sub, item: req.body.item };
  orders.push(o);
  res.status(201).json(o);
});

app.listen(3000, () => console.log("API: http://localhost:3000"));

$ node issuer.js & I=$!; node server.js & S=$!; sleep 1; node attack.js; kill $I $S
IdP: http://localhost:4000
API: http://localhost:3000
200  token سليم، GET                            [{"id":1,"owner":"user-7","item":"كتاب"}]
401  من غير token                               {"error":"محتاج token"}
رفضنا: ERR_JOSE_ALG_NOT_ALLOWED
401  alg none و sub=admin                       {"error":"token مش صالح"}
رفضنا: ERR_JWS_SIGNATURE_VERIFICATION_FAILED
401  token متعدّل sub=admin                     {"error":"token مش صالح"}
رفضنا: ERR_JWT_CLAIM_VALIDATION_FAILED
401  aud=billing-api                            {"error":"token مش صالح"}
رفضنا: ERR_JWT_EXPIRED
401  خلص من دقيقتين                             {"error":"token مش صالح"}
200  خلص من عشر ثواني (clock skew)              [{"id":1,"owner":"user-7","item":"كتاب"}]
رفضنا: ERR_JWT_CLAIM_VALIDATION_FAILED
401  id_token بدل access token                  {"error":"token مش صالح"}
403  scope=orders:read بيعمل POST               {"error":"محتاج orders:write"}
201  scope=orders:read orders:write بيعمل POST  {"id":3,"owner":"user-7","item":"قلم"}

// الـ Authorization Server (مختصر): بينشر الـ public key، وبيطلّع tokens للتجربة
import express from "express";
import { generateKeyPair, exportJWK, SignJWT } from "jose";

const ISSUER = "http://localhost:4000";
const { publicKey, privateKey } = await generateKeyPair("ES256");
const jwk = { ...(await exportJWK(publicKey)), kid: "k1", alg: "ES256", use: "sig" };

const app = express();
app.use(express.json());
app.get("/jwks", (req, res) => res.json({ keys: [jwk] }));

// للتجربة بس: بيطلّع أي token احنا عايزينه (في الحقيقة ده /token بعد login)
app.post("/mint", async (req, res) => {
  const { sub = "user-7", aud = "orders-api", scope = "orders:read", expIn = 300, typ = "at+jwt" } = req.body;
  const now = Math.floor(Date.now() / 1000);
  const token = await new SignJWT({ scope, client_id: "my-backend" })
    .setProtectedHeader({ alg: "ES256", kid: "k1", typ })
    .setIssuer(ISSUER)
    .setAudience(aud)
    .setSubject(sub)
    .setIssuedAt(now)
    .setExpirationTime(now + expIn)
    .sign(privateKey);
  res.json({ token });
});

app.listen(4000, () => console.log("IdP: http://localhost:4000"));

// أدوات التجربة: tokens سليمة من الـ IdP، وtokens مزوّرة
export const mint = async (claims = {}) => {
  const r = await fetch("http://localhost:4000/mint", {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify(claims),
  });
  return (await r.json()).token;
};
const b64 = (o) => Buffer.from(JSON.stringify(o)).toString("base64url");
const part = (t, i) => JSON.parse(Buffer.from(t.split(".")[i], "base64url"));

// alg none: من غير توقيع خالص
export const forgeNone = (payload) => `${b64({ alg: "none", typ: "at+jwt" })}.${b64(payload)}.`;
// نفس التوقيع، بس غيّرنا الـ payload
export const tamper = (t, changes) => {
  const [h, , s] = t.split(".");
  return `${h}.${b64({ ...part(t, 1), ...changes })}.${s}`;
};

export const call = async (method, token) => {
  const headers = { "content-type": "application/json" };
  if (token) headers.authorization = `Bearer ${token}`;
  const r = await fetch("http://localhost:3000/orders", {
    method,
    headers,
    body: method === "POST" ? JSON.stringify({ item: "قلم" }) : undefined,
  });
  return { status: r.status, www: r.headers.get("www-authenticate"), body: await r.text() };
};

export const cases = async () => {
  const ok = await mint();
  return [
    ["token سليم، GET", "GET", ok, 200],
    ["من غير token", "GET", undefined, 401],
    ["alg none و sub=admin", "GET", forgeNone({ sub: "admin", aud: "orders-api", scope: "orders:write" }), 401],
    ["token متعدّل sub=admin", "GET", tamper(ok, { sub: "admin" }), 401],
    ["aud=billing-api", "GET", await mint({ aud: "billing-api" }), 401],
    ["خلص من دقيقتين", "GET", await mint({ expIn: -120 }), 401],
    ["خلص من عشر ثواني (clock skew)", "GET", await mint({ expIn: -10 }), 200],
    ["id_token بدل access token", "GET", await mint({ typ: "JWT" }), 401],
    ["scope=orders:read بيعمل POST", "POST", ok, 403],
    ["scope=orders:read orders:write بيعمل POST", "POST", await mint({ scope: "orders:read orders:write" }), 201],
  ];
};

import { call, cases } from "./tokens.js";
let ok = 0, all = 0;
for (const [name, method, token, want] of await cases()) {
  const r = await call(method, token);
  all++;
  const pass = r.status === want;
  if (pass) ok++;
  console.log(pass ? "✅" : "❌", name.padEnd(42), r.status, pass ? "" : `(المفروض ${want})`);
}
const noScope = await call("POST", (await cases())[0][2]);
const www1 = noScope.www ?? "";
all++; if (/insufficient_scope/.test(www1) && /scope="orders:write"/.test(www1)) ok++;
console.log(/insufficient_scope/.test(www1) ? "✅" : "❌", "WWW-Authenticate في الـ 403:", www1);
const bad = await call("GET", "abc.def.ghi");
all++; if (/invalid_token/.test(bad.www ?? "")) ok++;
console.log(/invalid_token/.test(bad.www ?? "") ? "✅" : "❌", "WWW-Authenticate في الـ 401:", bad.www);
console.log(`\n${ok}/${all} نجحوا`);