Setu-TS
    Preparing search index...

    Interface TrustedIssuer

    An identity provider whose access tokens this application accepts.

    A token is routed to the entry whose issuer equals its iss claim exactly, then verified against that issuer's published key set. audience is required: without it a token the same provider minted for a different API would be accepted.

    0.8.0

    interface TrustedIssuer {
        algorithms?: readonly IssuerAlgorithm[];
        audience: string;
        clockToleranceSec?: number;
        issuer: string;
        keys: IssuerKeySource;
        keySet?: {
            fetchTimeoutMs?: number;
            maxStaleMs?: number;
            minRefreshIntervalMs?: number;
            ttlMs?: number;
        };
        name: string;
        toPrincipal(
            claims: Readonly<Record<string, unknown>>,
        ): IPrincipal | Promise<IPrincipal | null> | null;
    }
    Index
    algorithms? audience clockToleranceSec? issuer keys keySet? name
    toPrincipal
    algorithms?: readonly IssuerAlgorithm[]

    Algorithm allowlist. Defaults to all five supported algorithms.

    audience: string

    Audience that must appear in the token's aud claim.

    clockToleranceSec?: number

    Clock tolerance for exp/nbf/iat, in seconds, 0–300. Default 30.

    issuer: string

    Exact iss value this entry accepts.

    keys: IssuerKeySource

    Key-set source.

    keySet?: {
        fetchTimeoutMs?: number;
        maxStaleMs?: number;
        minRefreshIntervalMs?: number;
        ttlMs?: number;
    }

    Key-set cache timings, in milliseconds, each a finite positive number: ttlMs (default 10 minutes) before a refetch, minRefreshIntervalMs (default 60 s) between fetch attempts, fetchTimeoutMs (default 5 s, at most 2147483647) per fetch, and maxStaleMs (default 24 hours) that the last good set stays usable after it was last confirmed while fetches fail.

    name: string

    Unique name, used in health output and logs.

    • Maps the verified claims to a principal. Return null to leave the request anonymous. The plugin never guesses where a provider puts roles.

      sub is unique only within its issuer. Whenever this issuer is not the application's only identity source — another issuer, a self-issued jwt (whose strategy also maps sub to the id), an API key, a session, or a custom strategy — namespace the id (for example `${claims.iss}|${claims.sub}`). Namespacing this side alone is not enough when another source can produce an id of the same form (a self-issued sub or a username a user chooses, say): namespace every source (for example `local|${id}`), or keep the other sources' ids free of the separator.

      Parameters

      • claims: Readonly<Record<string, unknown>>

      Returns IPrincipal | Promise<IPrincipal | null> | null

    Settings
    Member Visibility

    On This Page
    Properties
    Methods