Cognito の JWT を TypeScript で検証する方法 - async / await で

ソースコード

こんな感じになる。

import * as Console from 'console';
import { promisify } from 'util';

import jwt, { JwtHeader, TokenExpiredError } from 'jsonwebtoken';
import jwksClient from 'jwks-rsa';

const AWS_REGION = process.env.AWS_REGION!;
const USER_POOL_ID = process.env.USER_POOL_ID!;

const getPublicKey = async (kid: string) => {
  const client = jwksClient({
    jwksUri: `https://cognito-idp.${AWS_REGION}.amazonaws.com/${USER_POOL_ID}/.well-known/jwks.json`,
  });
  const getPubKey = promisify(client.getSigningKey);
  const key = await getPubKey(kid);
  return key.getPublicKey();
};

export const verify = async (token: string): Promise<boolean> => {
  try {
    const decodedToken = jwt.decode(token, { complete: true }) as {
      header: JwtHeader;
    } | null;
    if (!decodedToken) {
      throw new Error('failed to decode token');
    } else if (!decodedToken.header.kid) {
      throw new Error('not found kid');
    }

    const publicKey = await getPublicKey(decodedToken.header.kid);
    jwt.verify(token, publicKey);

    return true;
  } catch (e) {
    Console.error('e', JSON.stringify(e, undefined, 2));

    if (e instanceof TokenExpiredError) {
      // アクセストークン切れの場合と処理を分ける場合、何かを書く
    }

    return false;
  }
};