feat: handle CWT Id (cti) claim

readme.md

@@ -32,7 +32,7 @@ This is a Node library for generating and validating Common Access Tokens (CTA-5
 | Audience (`aud`)                                          | Yes      |
 | Expiration (`exp`)                                        | Yes      |
 | Not Before (`nbf`)                                        | Yes      |
-| CWT ID (`cti`)                                            | No       |
+| CWT ID (`cti`)                                            | Yes      |
 | Common Access Token Replay (`catreplay`)                  | No       |
 | Common Access Token Probability of Rejection (`catpor`)   | No       |
 | Common Access Token Version (`catv`)                      | No       |
@@ -191,13 +191,13 @@ const base64encoded = await generator.generate(
     aud: 'coap://light.example.com',
     exp: 1444064944,
     nbf: 1443944944,
-    iat: 1443944944,
-    cti: '0b71'
+    iat: 1443944944
   },
   {
     type: 'mac',
     alg: 'HS256',
-    kid: 'Symmetric256'
+    kid: 'Symmetric256',
+    generateCwtId: true // automatically generate a random CWT Id (cti) claim (default: false)
   }
 );
 ```

src/index.test.ts

@@ -305,4 +305,42 @@ describe('CAT claims', () => {
       })
     ).rejects.toThrow(UriNotAllowedError);
   });
+
+  test('can provide CWT Id claim', async () => {
+    const base64encoded = await generator.generate(
+      {
+        iss: 'eyevinn',
+        cti: 'a47019af6305d3652a918ae356cc2ca2'
+      },
+      {
+        type: 'mac',
+        alg: 'HS256',
+        kid: 'Symmetric256'
+      }
+    );
+    const cat = await validator.validate(base64encoded!, 'mac', {
+      issuer: 'eyevinn'
+    });
+    expect(cat).toBeDefined();
+    expect(cat!.claims.cti).toEqual('a47019af6305d3652a918ae356cc2ca2');
+  });
+
+  test('can auto generate a CWT Id claim', async () => {
+    const base64encoded = await generator.generate(
+      {
+        iss: 'eyevinn'
+      },
+      {
+        type: 'mac',
+        alg: 'HS256',
+        kid: 'Symmetric256',
+        generateCwtId: true
+      }
+    );
+    const cat = await validator.validate(base64encoded!, 'mac', {
+      issuer: 'eyevinn'
+    });
+    expect(cat).toBeDefined();
+    expect(cat!.claims.cti).toBeDefined();
+  });
 });

src/index.ts

@@ -1,3 +1,4 @@
+import crypto from 'crypto';
 import { CommonAccessToken, CommonAccessTokenFactory } from './cat';
 import { KeyNotFoundError } from './errors';
 
@@ -17,6 +18,7 @@ export interface CatGenerateOptions {
   type: CatValidationTypes;
   alg: string;
   kid: string;
+  generateCwtId?: boolean;
 }
 
 /**
@@ -123,6 +125,9 @@ export class CAT {
     claims: { [key: string]: string | number | Map<number, any> },
     opts?: CatGenerateOptions
   ) {
+    if (opts?.generateCwtId) {
+      claims['cti'] = crypto.randomBytes(16).toString('hex');
+    }
     const cat = new CommonAccessToken(claims);
     if (opts && opts.type == 'mac') {
       const key = this.keys[opts.kid];