feat: verify oidc bearer tokens and jit-provision users

backend/libs/auth/src/oidc-discovery.service.ts

@@ -0,0 +1,45 @@
+import { Inject, Injectable, OnModuleInit } from '@nestjs/common';
+import { createRemoteJWKSet } from 'jose';
+import type { JWTVerifyGetKey } from 'jose';
+import { APP_ENVIRONMENT } from '../../configuration/src';
+import type { AppEnvironment } from '../../configuration/src';
+
+interface OidcDiscoveryDocument {
+  jwks_uri: string;
+}
+
+@Injectable()
+export class OidcDiscoveryService implements OnModuleInit {
+  private verificationKeySet: JWTVerifyGetKey | undefined;
+
+  constructor(
+    @Inject(APP_ENVIRONMENT) private readonly environment: AppEnvironment,
+  ) {}
+
+  async onModuleInit(): Promise<void> {
+    const issuer = this.environment.oidcIssuer.replace(/\/$/, '');
+    const response = await fetch(`${issuer}/.well-known/openid-configuration`);
+    if (!response.ok) {
+      throw new Error(
+        `Failed to fetch OIDC discovery document: HTTP ${response.status}`,
+      );
+    }
+    const document = (await response.json()) as OidcDiscoveryDocument;
+    this.verificationKeySet = createRemoteJWKSet(new URL(document.jwks_uri));
+  }
+
+  getIssuer(): string {
+    return this.environment.oidcIssuer;
+  }
+
+  getAudience(): string {
+    return this.environment.oidcAudience;
+  }
+
+  getVerificationKeySet(): JWTVerifyGetKey {
+    if (!this.verificationKeySet) {
+      throw new Error('OIDC discovery has not completed yet');
+    }
+    return this.verificationKeySet;
+  }
+}