search

auth0 / node-jwks-rsa

A library to retrieve RSA public keys from a JWKS (JSON Web Key Set) endpoint.
MIT License
836 stars 236 forks source link

Types for JwksClient.getSigningKey still allows callbacks #353

Closed tstackhouse closed 1 year ago

tstackhouse commented 1 year ago

Describe the problem

When 2.0.0 was released, getSigningKey was updated to no longer allow callbacks and be purely promise/async based, however even in 3.0.1 the type declaration for getSigningKey allows for the callback form, therefore it will not flag a TypeScript error upon upgrading from versions < 2.0.0.

What was the expected behavior?

Provided typings accurately reflect the available behaviour of the library.

Reproduction

  1. Call getSigningKey using a version of the library < 2.0.0
  2. Upgrade to any version >= 2.0.0
  3. TypeScript compilation/IDEs do not report anything wrong, but code will fail at runtime

Environment

adamjmcgrath commented 1 year ago

Hi @tstackhouse - thanks for raising this

Callback support was added back to getSigningKey in 2.0.1 (see https://github.com/auth0/node-jwks-rsa/blob/master/CHANGELOG.md#201---2021-03-12)

You can test this yourself doing

$ node -e "new (require('jwks-rsa').JwksClient)({}).getSigningKey(null, () => {console.log('callback fired');})"
callback fired
tstackhouse commented 1 year ago

I see! I missed that. That said, at least in the master branch, it seems like the callback form of getSigningKey is not present in the code: https://github.com/auth0/node-jwks-rsa/blob/master/src/JwksClient.js#L52-L67

I retract my statement, I see that it was added back via a callbackify style wrapper. Ignore me :sweat_smile: It's probably still good that I refactored our usage to be async/await anyway as part of my version bumping :smile: