lib/Tvm.js
/**
   * Validates the Adobe I/O API Gateway service signature token.
   * The validation is performed online against IMS. Valid token are cached for 5 minutes.
   *
   * @param {object} params request params
   * @returns {joi.ValidationResult} joi
   * @memberof Tvm
   * @private
   */
Validates the Adobe I/O API Gateway service signature token.
The validation is performed online against IMS. Valid token are cached for 5 minutes.

@param {object} params request params
@returns {joi.ValidationResult} joi
@memberof Tvm
@private
Validates the Adobe I / O API Gateway service signature token . The validation is performed online against IMS . Valid token are cached for 5 minutes . @param { object } params request params @returns { joi . ValidationResult } joi @memberof Tvm @private
async _validateAdobeIOApiGwServiceToken (params) {
    const REQUIRED_HEADER = 'x-gw-ims-authorization'
    const REQUIRED_SCOPES = ['openid', 'AdobeID', 'system']
    const REQUIRED_CLIENT_ID = 'AnsApiPlatform1'
    const imsEnv = params.imsEnv || 'prod'
    const token = this._extractTokenFromHeader(params, REQUIRED_HEADER, 'Bearer ')
    const cacheKey = imsEnv + token
    if (validApiGWTokensCache.get(cacheKey)) {
      return
    }
    const ims = new Ims(imsEnv)
    const res = await ims.validateToken(token)
    if (!res.valid) {
      throw new Error('invalid IMS token')
    }
    if (res.token.client_id !== REQUIRED_CLIENT_ID) {
      throw new Error(`token client_id '${res.token.client_id}' is not allowed`)
    }
    const scopes = res.token.scope.split(',')
    const missing = []
    REQUIRED_SCOPES.forEach(rs => {
      if (!scopes.includes(rs)) {
        missing.push(rs)
      }
    })
    if (missing.length > 0) {
      throw new Error(`token is missing required scopes '${missing.toString()}'`)
    }
    validApiGWTokensCache.set(cacheKey, true)
  }
async _validateAdobeIOApiGwServiceToken ( params ) { const REQUIRED_HEADER = 'x-gw-ims-authorization' const REQUIRED_SCOPES = [ 'openid' , 'AdobeID' , 'system' ] const REQUIRED_CLIENT_ID = 'AnsApiPlatform1' const imsEnv = params . imsEnv || 'prod' const token = this . _extractTokenFromHeader ( params , REQUIRED_HEADER , 'Bearer ' ) const cacheKey = imsEnv + token if ( validApiGWTokensCache . get ( cacheKey ) ) { return } const ims = new Ims ( imsEnv ) const res = await ims . validateToken ( token ) if ( ! res . valid ) { throw new Error ( 'invalid IMS token' ) } if ( res . token . client_id !== REQUIRED_CLIENT_ID ) { throw new Error ( ` ${ res . token . client_id } ` ) } const scopes = res . token . scope . split ( ',' ) const missing = [ ] REQUIRED_SCOPES . forEach ( rs => { if ( ! scopes . includes ( rs ) ) { missing . push ( rs ) } } ) if ( missing . length > 0 ) { throw new Error ( ` ${ missing . toString ( ) } ` ) } validApiGWTokensCache . set ( cacheKey , true ) }
Validates the Adobe I/O API Gateway service signature token.
Validates the Adobe I / O API Gateway service signature token .
// constants // ims env // attempt to extract Bearer token from header // if the token is in the valid cache, no need to check // validation // 1. check if the token is valid // 2. check client id // 3. check scopes // if the token is valid, cache it