BC-8019 Switch to asymmetric signing of JWT

apps/server/src/infra/auth-guard/mapper/index.ts

@@ -1,2 +1,3 @@
 export * from './current-user.factory';
 export * from './jwt.factory';
+export * from './jwt-strategy-options.factory';

apps/server/src/infra/auth-guard/mapper/jwt-strategy-options.factory.ts

@@ -0,0 +1,24 @@
+import { ConfigService } from '@nestjs/config';
+import { JwtFromRequestFunction, StrategyOptions } from 'passport-jwt';
+import { AuthGuardConfig } from '../auth-guard.config';
+
+export class JwtStrategyOptionsFactory {
+	static build(
+		jwtFromRequestFunction: JwtFromRequestFunction,
+		configService: ConfigService<AuthGuardConfig>
+	): StrategyOptions {
+		const publicKey = configService.get<string>('JWT_PUBLIC_KEY');
+		const algorithm = configService.getOrThrow<string>('JWT_SIGNING_ALGORITHM');
+
+		const options = {
+			jwtFromRequest: jwtFromRequestFunction,
+			secretOrKey: publicKey,
+			ignoreExpiration: false,
+			algorithms: [algorithm],
+			issuer: configService.get<string>('SC_DOMAIN'),
+			audience: configService.get<string>('SC_DOMAIN'),
+		};
+
+		return options;
+	}
+}

apps/server/src/infra/auth-guard/strategy/jwt.strategy.ts

@@ -2,30 +2,21 @@ import { Injectable, UnauthorizedException } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { PassportStrategy } from '@nestjs/passport';
 import { extractJwtFromHeader } from '@shared/common';
-import { Algorithm } from 'jsonwebtoken';
 import { Strategy } from 'passport-jwt';
 import { JwtValidationAdapter } from '../adapter';
 import { AuthGuardConfig } from '../auth-guard.config';
 import { ICurrentUser, JwtPayload } from '../interface';
-import { CurrentUserBuilder } from '../mapper';
+import { CurrentUserBuilder, JwtStrategyOptionsFactory } from '../mapper';
 
 @Injectable()
 export class JwtStrategy extends PassportStrategy(Strategy) {
 	constructor(
 		private readonly jwtValidationAdapter: JwtValidationAdapter,
 		configService: ConfigService<AuthGuardConfig>
 	) {
-		const publicKey = configService.get<string>('JWT_PUBLIC_KEY');
-		const algorithm = configService.get<Algorithm>('JWT_SIGNING_ALGORITHM');
+		const strategyOptions = JwtStrategyOptionsFactory.build(extractJwtFromHeader, configService);
 
-		super({
-			jwtFromRequest: extractJwtFromHeader,
-			ignoreExpiration: false,
-			secretOrKey: publicKey,
-			algorithms: [algorithm],
-			issuer: configService.get<string>('SC_DOMAIN'),
-			audience: configService.get<string>('SC_DOMAIN'),
-		});
+		super(strategyOptions);
 	}
 
 	async validate(payload: JwtPayload): Promise<ICurrentUser> {

apps/server/src/infra/auth-guard/strategy/ws-jwt.strategy.ts

@@ -3,29 +3,21 @@ import { ConfigService } from '@nestjs/config';
 import { PassportStrategy } from '@nestjs/passport';
 import { WsException } from '@nestjs/websockets';
 import { JwtExtractor } from '@shared/common';
-import { ExtractJwt, Strategy } from 'passport-jwt';
+import { Strategy } from 'passport-jwt';
 import { JwtValidationAdapter } from '../adapter';
 import { AuthGuardConfig } from '../auth-guard.config';
 import { ICurrentUser, JwtPayload, StrategyType } from '../interface';
-import { CurrentUserBuilder } from '../mapper';
+import { CurrentUserBuilder, JwtStrategyOptionsFactory } from '../mapper';
 
 @Injectable()
 export class WsJwtStrategy extends PassportStrategy(Strategy, StrategyType.WS_JWT) {
 	constructor(
 		private readonly jwtValidationAdapter: JwtValidationAdapter,
 		configService: ConfigService<AuthGuardConfig>
 	) {
-		const publicKey = configService.get<string>('JWT_PUBLIC_KEY');
-		const algorithm = configService.get<Algorithm>('JWT_SIGNING_ALGORITHM');
+		const strategyOptions = JwtStrategyOptionsFactory.build(JwtExtractor.fromCookie('jwt'), configService);
 
-		super({
-			jwtFromRequest: ExtractJwt.fromExtractors([JwtExtractor.fromCookie('jwt')]),
-			ignoreExpiration: false,
-			secretOrKey: publicKey,
-			algorithms: [algorithm],
-			issuer: configService.get<string>('SC_DOMAIN'),
-			audience: configService.get<string>('SC_DOMAIN'),
-		});
+		super(strategyOptions);
 	}
 
 	async validate(payload: JwtPayload): Promise<ICurrentUser> {