feat: return claim on http validation (#8)

Author: birme

src/cat.ts

@@ -85,6 +85,9 @@ const CWT_TAG = 61;
 export type CommonAccessTokenClaims = {
   [key: string]: string | number | Map<number, any>;
 };
+export type CommonAccessTokenDict = {
+  [key: string]: string | number | { [key: string]: any };
+};
 export type CommonAccessTokenValue =
   | string
   | number
@@ -272,14 +275,20 @@ export class CommonAccessToken {
     return this.payload.get(theKey);
   }
 
-  get claims() {
-    const result: { [key: string]: string | number } = {};
+  get claims(): CommonAccessTokenDict {
+    const result: CommonAccessTokenDict = {};
     this.payload.forEach((value, param) => {
       const key = labelsToClaim[param] ? labelsToClaim[param] : param;
-      const theValue = claimTransformReverse[key]
-        ? claimTransformReverse[key](value as Buffer)
-        : (value as string | number);
-      result[key] = theValue;
+      if (key === 'catu') {
+        result[key] = CommonAccessTokenUri.fromMap(
+          value as Map<number, any>
+        ).toDict();
+      } else {
+        const theValue = claimTransformReverse[key]
+          ? claimTransformReverse[key](value as Buffer)
+          : (value as string | number);
+        result[key] = theValue;
+      }
     });
     return result;
   }

src/catu.ts

@@ -228,6 +228,19 @@ export class CommonAccessTokenUri {
     return true;
   }
 
+  toDict() {
+    const result: { [key: string]: any } = {};
+    this.catuMap.forEach((uriPartMap, uriPart) => {
+      const part = labelsToUriPart[uriPart];
+      const match: { [key: string]: any } = {};
+      uriPartMap.forEach((value, matchType) => {
+        match[labelsToMatch[matchType]] = value;
+      });
+      result[part] = match;
+    });
+    return result;
+  }
+
   get payload() {
     return this.catuMap;
   }

src/validators/http.test.ts

@@ -267,4 +267,49 @@ describe('HTTP Request CAT Validator', () => {
     });
     expect(result.status).toBe(200);
   });
+
+  test('can get parsed claims from token', async () => {
+    const token =
+      '2D3RhEOhAQW5AAFhNExTeW1tZXRyaWMyNTZYO9kBA6IBZ2V5ZXZpbm4ZATjZAQOjANkBA6EAZWh0dHBzA9kBA6EBaC9jb250ZW50CNkBA6EAZS5tM3U4WCCD42NQN46M44nvyg4eD4tKUo2+spMlXhtOHW3IiUFiXg==';
+    const httpValidator = new HttpValidator({
+      keys: [
+        {
+          kid: 'Symmetric256',
+          key: Buffer.from(
+            '403697de87af64611c1d32a05dab0fe1fcb715a86ab435f1ec99192d79569388',
+            'hex'
+          )
+        }
+      ],
+      issuer: 'eyevinn'
+    });
+    const result = await httpValidator.validateCloudFrontRequest({
+      clientIp: 'dummy',
+      method: 'GET',
+      uri: '/content/path/file.m3u8',
+      querystring: '',
+      headers: {
+        'cta-common-access-token': [
+          {
+            value: token
+          }
+        ],
+        host: [
+          {
+            key: 'Host',
+            value: 'example.com'
+          }
+        ]
+      }
+    });
+    expect(result.status).toBe(200);
+    expect(result.claims).toEqual({
+      iss: 'eyevinn',
+      catu: {
+        scheme: { 'exact-match': 'https' },
+        path: { 'prefix-match': '/content' },
+        extension: { 'exact-match': '.m3u8' }
+      }
+    });
+  });
 });

src/validators/http.ts

@@ -8,6 +8,7 @@ import {
   UriNotAllowedError
 } from '../errors';
 import { CloudFrontRequest } from 'aws-lambda';
+import { CommonAccessTokenDict } from '../cat';
 
 interface HttpValidatorKey {
   kid: string;
@@ -24,6 +25,7 @@ export interface HttpValidatorOptions {
 export interface HttpResponse {
   status: number;
   message?: string;
+  claims?: CommonAccessTokenDict;
 }
 
 export class NoTokenFoundError extends Error {
@@ -53,7 +55,7 @@ export class NoTokenFoundError extends Error {
  *    request,
  *    'Symmetric256'
  *  );
- *  // { status: 200, message: 'info' }
+ *  // { status: 200, message: 'info', claims: { iss: 'eyevinn' } }
  */
 export class HttpValidator {
   private keys: { [key: string]: Buffer } = {};
@@ -109,12 +111,12 @@ export class HttpValidator {
         ? request.headers['cta-common-access-token'][0]
         : request.headers['cta-common-access-token'];
       try {
-        await validator.validate(token, 'mac', {
+        const cat = await validator.validate(token, 'mac', {
           issuer: this.opts.issuer,
           audience: this.opts.audience,
           url
         });
-        return { status: 200 };
+        return { status: 200, claims: cat?.claims };
       } catch (err) {
         if (
           err instanceof InvalidIssuerError ||