snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

packages/jwt/CHANGELOG.md

@@ -0,0 +1,53 @@
+# @rocket.chat/jwt
+
+## 0.2.1
+
+### Patch Changes
+
+- ([#38989](https://github.com/RocketChat/Rocket.Chat/pull/38989)) chore(eslint): Upgrades ESLint and its configuration
+
+## 0.2.1-rc.0
+
+### Patch Changes
+
+- ([#38989](https://github.com/RocketChat/Rocket.Chat/pull/38989)) chore(eslint): Upgrades ESLint and its configuration
+
+## 0.2.0
+
+### Minor Changes
+
+- ([#37091](https://github.com/RocketChat/Rocket.Chat/pull/37091)) Adds Attribute Based Access Control (ABAC) for private channels & private teams.
+
+## 0.2.0-rc.0
+
+### Minor Changes
+
+- ([#37091](https://github.com/RocketChat/Rocket.Chat/pull/37091)) Adds Attribute Based Access Control (ABAC) for private channels & private teams.
+
+## 0.1.1
+
+### Patch Changes
+
+- ([#31138](https://github.com/RocketChat/Rocket.Chat/pull/31138)) feat(uikit): Move `@rocket.chat/ui-kit` package to the main monorepo
+
+## 0.1.1-rc.0
+
+### Patch Changes
+
+- b223cbde14: feat(uikit): Move `@rocket.chat/ui-kit` package to the main monorepo
+
+## 0.1.0
+
+### Minor Changes
+
+- 5f81a0f3cb: Implemented the License library, it is used to handle the functionality like expiration date, modules, limits, etc.
+  Also added a version v3 of the license, which contains an extended list of features.
+  v2 is still supported, since we convert it to v3 on the fly.
+
+## 0.1.0-rc.0
+
+### Minor Changes
+
+- 5f81a0f3cb: Implemented the License library, it is used to handle the functionality like expiration date, modules, limits, etc.
+  Also added a version v3 of the license, which contains an extended list of features.
+  v2 is still supported, since we convert it to v3 on the fly.

packages/jwt/__tests__/jwt.spec.ts

@@ -0,0 +1,93 @@
+import { generateKeyPair, exportPKCS8, exportSPKI } from 'jose';
+
+import { sign, verify } from '../src/index';
+
+it('should sign and verify a jwt with RS256', async () => {
+	const { publicKey, privateKey } = await generateKeyPair('RS256');
+	const spki = await exportSPKI(publicKey);
+	const pkcs8 = await exportPKCS8(privateKey);
+
+	const licenseV3 = {
+		information: {
+			id: '64d28d096400df50b6ace670',
+			autoRenew: true,
+			createdAt: '2023-08-08T18:44:25.719+0000',
+			visualExpiration: '2024-09-08T18:44:25.719+0000',
+			notifyAdminsAt: '2024-09-01T18:44:25.719+0000',
+			notifyUsersAt: '2024-09-05T18:44:25.719+0000',
+			trial: false,
+			offline: false,
+			grantedBy: { method: 'manual', seller: 'john.rocketseed@rocket.chat' },
+			grantedTo: { name: 'Alice Clientseed', company: 'Client', email: 'alice.clientseed@client.com' },
+			legalText: "This license can't be used for reselling",
+			notes: 'Plan Premium',
+			tags: [{ name: 'Enterprise', color: '#CCCCCC' }],
+		},
+		validation: {
+			serverUrls: [{ value: 'https://localhost:3000', type: 'url' }],
+			serverVersions: [{ value: '6.4' }],
+			cloudWorkspaceId: 'alks-a9sj0diba09shdiasodjha9s0diha9s9duabsiuhdai0sdh0a9hs09da09s8d09a80s9d8',
+			serverUniqueId: '64d28d096400df50b6ace670',
+			validUntil: '2024-09-18T18:44:25.719+0000',
+			validFrom: '2024-07-08T18:44:25.719+0000',
+			installationAllowedUntil: '2024-07-09T18:44:25.719+0000',
+			legalTextAgreement: { type: 'accepted', acceptedVia: 'cloud' },
+			statisticsReport: { required: true, allowedStaleInDays: 5 },
+		},
+		grantedModules: [
+			{ module: 'auditing' },
+			{ module: 'canned-responses' },
+			{ module: 'ldap-enterprise' },
+			{ module: 'livechat-enterprise' },
+			{ module: 'voip-enterprise' },
+			{ module: 'omnichannel-mobile-enterprise' },
+			{ module: 'engagement-dashboard' },
+			{ module: 'push-privacy' },
+			{ module: 'scalability' },
+			{ module: 'teams-mention' },
+			{ module: 'saml-enterprise' },
+			{ module: 'oauth-enterprise' },
+			{ module: 'device-management' },
+			{ module: 'federation' },
+			{ module: 'videoconference-enterprise' },
+			{ module: 'message-read-receipt' },
+			{ module: 'outlook-calendar' },
+			{ module: 'unlimited-presence' },
+			{ module: 'outbound-messaging' },
+			{ module: 'abac' },
+		],
+		limits: {
+			activeUsers: [
+				{ max: 500, behavior: 'start_fair_policy' },
+				{ max: 1000, behavior: 'prevent_action' },
+				{ max: 1100, behavior: 'invalidate_license' },
+			],
+			guestUsers: [
+				{ max: 200, behavior: 'start_fair_policy' },
+				{ max: 400, behavior: 'prevent_action' },
+				{ max: 500, behavior: 'invalidate_license' },
+			],
+			roomsPerGuest: [
+				{ max: 5, behavior: 'start_fair_policy' },
+				{ max: 10, behavior: 'prevent_action' },
+			],
+			privateApps: [
+				{ max: 5, behavior: 'start_fair_policy' },
+				{ max: 10, behavior: 'prevent_action' },
+				{ max: 11, behavior: 'invalidate_license' },
+			],
+			marketplaceApps: [
+				{ max: 5, behavior: 'start_fair_policy' },
+				{ max: 10, behavior: 'prevent_action' },
+				{ max: 11, behavior: 'invalidate_license' },
+			],
+		},
+		cloudMeta: { lastStatisticId: '64d28d096400df50b6ace671' },
+	};
+
+	const token = await sign(licenseV3, pkcs8);
+	const [payload, protectedHeader] = await verify(token, spki);
+
+	expect(protectedHeader).toEqual({ alg: 'RS256', typ: 'JWT' });
+	expect(payload).toEqual(licenseV3);
+});

packages/jwt/jest.config.ts

@@ -0,0 +1,6 @@
+import server from '@rocket.chat/jest-presets/server';
+import type { Config } from 'jest';
+
+export default {
+	preset: server.preset,
+} satisfies Config;

packages/jwt/package.json

@@ -0,0 +1,36 @@
+{
+	"name": "@rocket.chat/jwt",
+	"version": "0.2.1",
+	"private": true,
+	"main": "./dist/index.js",
+	"typings": "./dist/index.d.ts",
+	"files": [
+		"/dist"
+	],
+	"scripts": {
+		"build": "rm -rf dist && tsc",
+		"dev": "tsc --watch --preserveWatchOutput",
+		"lint": "eslint .",
+		"lint:fix": "eslint --fix .",
+		"test": "jest",
+		"testunit": "jest",
+		"typecheck": "tsc --noEmit"
+	},
+	"dependencies": {
+		"jose": "^4.15.9"
+	},
+	"devDependencies": {
+		"@rocket.chat/jest-presets": "workspace:~",
+		"@rocket.chat/tsconfig": "workspace:*",
+		"@types/jest": "~30.0.0",
+		"eslint": "~9.39.5",
+		"jest": "~30.2.0",
+		"typescript": "~5.9.3"
+	},
+	"volta": {
+		"extends": "../../package.json"
+	},
+	"installConfig": {
+		"hoistingLimits": "workspaces"
+	}
+}

packages/jwt/src/index.ts

@@ -0,0 +1,29 @@
+import { SignJWT, importPKCS8, jwtVerify, importSPKI, generateKeyPair, exportSPKI, exportPKCS8 } from 'jose';
+import type { JWTPayload } from 'jose';
+
+export async function sign(keyObject: object, pkcs8: string, alg = 'RS256') {
+	const privateKey = await importPKCS8(pkcs8, alg);
+
+	const token = await new SignJWT(keyObject as JWTPayload).setProtectedHeader({ alg, typ: 'JWT' }).sign(privateKey);
+
+	return token;
+}
+
+export async function verify(jwt: string, spki: string, alg = 'RS256') {
+	const publicKey = await importSPKI(spki, alg);
+
+	const { payload, protectedHeader } = await jwtVerify(jwt, publicKey, {});
+
+	return [payload, protectedHeader];
+}
+
+export async function getPairs(): Promise<[string, string]> {
+	if (process.env.NODE_ENV !== 'test') {
+		throw new Error('This function should only be used in tests');
+	}
+	const { publicKey, privateKey } = await generateKeyPair('RS256');
+	const spki = await exportSPKI(publicKey);
+	const pkcs8 = await exportPKCS8(privateKey);
+
+	return [spki, pkcs8];
+}

packages/jwt/tsconfig.json

@@ -0,0 +1,10 @@
+{
+	"extends": "@rocket.chat/tsconfig/server.json",
+	"compilerOptions": {
+		"declaration": true,
+		"module": "commonjs",
+		"rootDir": "./src",
+		"outDir": "./dist"
+	},
+	"include": ["./src/**/*"]
+}