@atproto/jwk-jose 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+# @atproto/jwk-jose
+
+## 0.1.0
+
+### Minor Changes
+
+- [#2482](https://github.com/bluesky-social/atproto/pull/2482) [`a8d6c1123`](https://github.com/bluesky-social/atproto/commit/a8d6c112359f5c4c0cfbe2df63443ed275f2a646) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add OAuth provider capability & support for DPoP signed tokens
+
+### Patch Changes
+
+- Updated dependencies [[`a8d6c1123`](https://github.com/bluesky-social/atproto/commit/a8d6c112359f5c4c0cfbe2df63443ed275f2a646)]:
+  - @atproto/jwk@0.1.0

package/LICENSE.txt

@@ -0,0 +1,7 @@
+Dual MIT/Apache-2.0 License
+
+Copyright (c) 2022-2024 Bluesky PBC, and Contributors
+
+Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './jose-key.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./jose-key.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA6B"}

package/dist/jose-key.d.ts

@@ -0,0 +1,23 @@
+import { type GenerateKeyPairOptions, type GenerateKeyPairResult, type KeyLike } from 'jose';
+import { Jwk, JwtHeader, JwtPayload, Key, SignedJwt, VerifyOptions, VerifyPayload, VerifyResult } from '@atproto/jwk';
+export type Importable = string | KeyLike | Jwk;
+export type { GenerateKeyPairOptions, GenerateKeyPairResult };
+export declare class JoseKey extends Key {
+    #private;
+    protected getKey(): Promise<KeyLike | Uint8Array>;
+    createJwt(header: JwtHeader, payload: JwtPayload): Promise<`${string}.${string}.${string}`>;
+    verifyJwt<P extends VerifyPayload = JwtPayload, C extends string = string>(token: SignedJwt, options?: VerifyOptions<C>): Promise<VerifyResult<P, C>>;
+    static generateKeyPair(allowedAlgos?: readonly string[], options?: GenerateKeyPairOptions): Promise<GenerateKeyPairResult<KeyLike>>;
+    static generate(allowedAlgos?: string[], kid?: string, options?: Omit<GenerateKeyPairOptions, 'extractable'>): Promise<JoseKey>;
+    static fromImportable(input: Importable, kid?: string): Promise<JoseKey>;
+    /**
+     * @see {@link exportJWK}
+     */
+    static fromKeyLike(keyLike: KeyLike | Uint8Array, kid?: string, alg?: string): Promise<JoseKey>;
+    /**
+     * @see {@link importPKCS8}
+     */
+    static fromPKCS8(pem: string, alg: string, kid?: string): Promise<JoseKey>;
+    static fromJWK(input: string | Record<string, unknown>, inputKid?: string): Promise<JoseKey>;
+}
+//# sourceMappingURL=jose-key.d.ts.map

package/dist/jose-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose-key.d.ts","sourceRoot":"","sources":["../src/jose-key.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAG1B,KAAK,OAAO,EACb,MAAM,MAAM,CAAA;AAGb,OAAO,EACL,GAAG,EAGH,SAAS,EACT,UAAU,EACV,GAAG,EACH,SAAS,EACT,aAAa,EACb,aAAa,EACb,YAAY,EAEb,MAAM,cAAc,CAAA;AAGrB,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,GAAG,CAAA;AAE/C,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,CAAA;AAE7D,qBAAa,OAAQ,SAAQ,GAAG;;cAGd,MAAM;IAQhB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU;IAmBhD,SAAS,CACb,CAAC,SAAS,aAAa,GAAG,UAAU,EACpC,CAAC,SAAS,MAAM,GAAG,MAAM,EACzB,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;WAkB/D,eAAe,CAC1B,YAAY,GAAE,SAAS,MAAM,EAAc,EAC3C,OAAO,CAAC,EAAE,sBAAsB;WAoBrB,QAAQ,CACnB,YAAY,GAAE,MAAM,EAAc,EAClC,GAAG,CAAC,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,aAAa,CAAC;WAS1C,cAAc,CACzB,KAAK,EAAE,UAAU,EACjB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IA8BnB;;OAEG;WACU,WAAW,CACtB,OAAO,EAAE,OAAO,GAAG,UAAU,EAC7B,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IASnB;;OAEG;WACU,SAAS,CACpB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;WAKN,OAAO,CAClB,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;CASpB"}

package/dist/jose-key.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JoseKey = void 0;
+const jwk_1 = require("@atproto/jwk");
+const jose_1 = require("jose");
+const errors_1 = require("jose/errors");
+const jwk_2 = require("@atproto/jwk");
+const util_1 = require("./util");
+class JoseKey extends jwk_2.Key {
+    #keyObj;
+    async getKey() {
+        try {
+            return (this.#keyObj ||= await (0, jose_1.importJWK)(this.jwk));
+        }
+        catch (cause) {
+            throw new jwk_2.JwkError('Failed to import JWK', undefined, { cause });
+        }
+    }
+    async createJwt(header, payload) {
+        if (header.kid && header.kid !== this.kid) {
+            throw new jwk_2.JwtCreateError(`Invalid "kid" (${header.kid}) used to sign with key "${this.kid}"`);
+        }
+        if (!header.alg || !this.algorithms.includes(header.alg)) {
+            throw new jwk_2.JwtCreateError(`Invalid "alg" (${header.alg}) used to sign with key "${this.kid}"`);
+        }
+        const keyObj = await this.getKey();
+        return new jose_1.SignJWT(payload)
+            .setProtectedHeader({ ...header, kid: this.kid })
+            .sign(keyObj);
+    }
+    async verifyJwt(token, options) {
+        try {
+            const keyObj = await this.getKey();
+            const result = await (0, jose_1.jwtVerify)(token, keyObj, {
+                ...options,
+                algorithms: this.algorithms,
+            });
+            return result;
+        }
+        catch (error) {
+            if (error instanceof errors_1.JOSEError) {
+                throw new jwk_1.JwtVerifyError(error.message, error.code, { cause: error });
+            }
+            else {
+                throw jwk_1.JwtVerifyError.from(error);
+            }
+        }
+    }
+    static async generateKeyPair(allowedAlgos = ['ES256'], options) {
+        if (!allowedAlgos.length) {
+            throw new jwk_2.JwkError('No algorithms provided for key generation');
+        }
+        const errors = [];
+        for (const alg of allowedAlgos) {
+            try {
+                return await (0, jose_1.generateKeyPair)(alg, options);
+            }
+            catch (err) {
+                errors.push(err);
+            }
+        }
+        throw new jwk_2.JwkError('Failed to generate key pair', undefined, {
+            cause: new AggregateError(errors, 'None of the algorithms worked'),
+        });
+    }
+    static async generate(allowedAlgos = ['ES256'], kid, options) {
+        const kp = await this.generateKeyPair(allowedAlgos, {
+            ...options,
+            extractable: true,
+        });
+        return this.fromImportable(kp.privateKey, kid);
+    }
+    static async fromImportable(input, kid) {
+        if (typeof input === 'string') {
+            // PKCS8
+            if (input.startsWith('-----')) {
+                // The "alg" is only needed in WebCrypto (NodeJS will be fine)
+                return this.fromPKCS8(input, '', kid);
+            }
+            // Jwk (string)
+            if (input.startsWith('{')) {
+                return this.fromJWK(input, kid);
+            }
+            throw new jwk_2.JwkError('Invalid input');
+        }
+        if (typeof input === 'object') {
+            // Jwk
+            if ('kty' in input || 'alg' in input) {
+                return this.fromJWK(input, kid);
+            }
+            // KeyLike
+            if (!kid)
+                throw new jwk_2.JwkError('Missing "kid" for KeyLike key');
+            return this.fromKeyLike(input, kid);
+        }
+        throw new jwk_2.JwkError('Invalid input');
+    }
+    /**
+     * @see {@link exportJWK}
+     */
+    static async fromKeyLike(keyLike, kid, alg) {
+        const jwk = await (0, jose_1.exportJWK)(keyLike);
+        if (alg) {
+            if (!jwk.alg)
+                jwk.alg = alg;
+            else if (jwk.alg !== alg)
+                throw new jwk_2.JwkError('Invalid "alg" in JWK');
+        }
+        return this.fromJWK(jwk, kid);
+    }
+    /**
+     * @see {@link importPKCS8}
+     */
+    static async fromPKCS8(pem, alg, kid) {
+        const keyLike = await (0, jose_1.importPKCS8)(pem, alg, { extractable: true });
+        return this.fromKeyLike(keyLike, kid);
+    }
+    static async fromJWK(input, inputKid) {
+        const jwk = typeof input === 'string' ? JSON.parse(input) : input;
+        if (!jwk || typeof jwk !== 'object')
+            throw new jwk_2.JwkError('Invalid JWK');
+        const kid = (0, util_1.either)(jwk.kid, inputKid);
+        const use = jwk.use || 'sig';
+        return new JoseKey(jwk_2.jwkValidator.parse({ ...jwk, kid, use }));
+    }
+}
+exports.JoseKey = JoseKey;
+//# sourceMappingURL=jose-key.js.map

package/dist/jose-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose-key.js","sourceRoot":"","sources":["../src/jose-key.ts"],"names":[],"mappings":";;;AAAA,sCAA6C;AAC7C,+BAYa;AACb,wCAAuC;AAEvC,sCAYqB;AACrB,iCAA+B;AAM/B,MAAa,OAAQ,SAAQ,SAAG;IAC9B,OAAO,CAAuB;IAEpB,KAAK,CAAC,MAAM;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM,IAAA,gBAAS,EAAC,IAAI,CAAC,GAAU,CAAC,CAAC,CAAA;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,cAAQ,CAAC,sBAAsB,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAiB,EAAE,OAAmB;QACpD,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,oBAAc,CACtB,kBAAkB,MAAM,CAAC,GAAG,4BAA4B,IAAI,CAAC,GAAG,GAAG,CACpE,CAAA;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,oBAAc,CACtB,kBAAkB,MAAM,CAAC,GAAG,4BAA4B,IAAI,CAAC,GAAG,GAAG,CACpE,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QAClC,OAAO,IAAI,cAAO,CAAC,OAAO,CAAC;aACxB,kBAAkB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAChD,IAAI,CAAC,MAAM,CAAuB,CAAA;IACvC,CAAC;IAED,KAAK,CAAC,SAAS,CAGb,KAAgB,EAAE,OAA0B;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;YAClC,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,MAAM,EAAE;gBAC5C,GAAG,OAAO;gBACV,UAAU,EAAE,IAAI,CAAC,UAAU;aACR,CAAC,CAAA;YAEtB,OAAO,MAA4B,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,oBAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;YACvE,CAAC;iBAAM,CAAC;gBACN,MAAM,oBAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,eAAkC,CAAC,OAAO,CAAC,EAC3C,OAAgC;QAEhC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,cAAQ,CAAC,2CAA2C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,MAAM,GAAc,EAAE,CAAA;QAC5B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,MAAM,IAAA,sBAAe,EAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,cAAQ,CAAC,6BAA6B,EAAE,SAAS,EAAE;YAC3D,KAAK,EAAE,IAAI,cAAc,CAAC,MAAM,EAAE,+BAA+B,CAAC;SACnE,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CACnB,eAAyB,CAAC,OAAO,CAAC,EAClC,GAAY,EACZ,OAAqD;QAErD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE;YAClD,GAAG,OAAO;YACV,WAAW,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,KAAiB,EACjB,GAAY;QAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ;YACR,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,8DAA8D;gBAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YACvC,CAAC;YAED,eAAe;YACf,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,IAAI,cAAQ,CAAC,eAAe,CAAC,CAAA;QACrC,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM;YACN,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACjC,CAAC;YAED,UAAU;YACV,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,cAAQ,CAAC,+BAA+B,CAAC,CAAA;YAC7D,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,IAAI,cAAQ,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAAW,CACtB,OAA6B,EAC7B,GAAY,EACZ,GAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,OAAO,CAAC,CAAA;QACpC,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAA;iBACtB,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;gBAAE,MAAM,IAAI,cAAQ,CAAC,sBAAsB,CAAC,CAAA;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,GAAW,EACX,GAAW,EACX,GAAY;QAEZ,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAW,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QAClE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,KAAuC,EACvC,QAAiB;QAEjB,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACjE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,cAAQ,CAAC,aAAa,CAAC,CAAA;QAEtE,MAAM,GAAG,GAAG,IAAA,aAAM,EAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,KAAK,CAAA;QAE5B,OAAO,IAAI,OAAO,CAAC,kBAAY,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAC9D,CAAC;CACF;AA9JD,0BA8JC"}

package/dist/util.d.ts

@@ -0,0 +1,2 @@
+export declare function either<T extends string | number | boolean>(a?: T, b?: T): T | undefined;
+//# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,GAAG,OAAO,EACxD,CAAC,CAAC,EAAE,CAAC,EACL,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,GAAG,SAAS,CAKf"}

package/dist/util.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.either = void 0;
+function either(a, b) {
+    if (a != null && b != null && a !== b) {
+        throw new TypeError(`Expected "${b}", got "${a}"`);
+    }
+    return a ?? b ?? undefined;
+}
+exports.either = either;
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AAAA,SAAgB,MAAM,CACpB,CAAK,EACL,CAAK;IAEL,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAA;AAC5B,CAAC;AARD,wBAQC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@atproto/jwk-jose",
+  "version": "0.1.0",
+  "license": "MIT",
+  "description": "`jose` based implementation of @atproto/jwk Key's",
+  "keywords": [
+    "atproto",
+    "jwk",
+    "jose"
+  ],
+  "homepage": "https://atproto.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bluesky-social/atproto",
+    "directory": "packages/oauth/jwk-jose"
+  },
+  "type": "commonjs",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "jose": "^5.2.0",
+    "@atproto/jwk": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.3"
+  },
+  "scripts": {
+    "build": "tsc --build tsconfig.json"
+  }
+}

package/src/index.ts

@@ -0,0 +1 @@
+export * from './jose-key.js'

package/src/jose-key.ts

@@ -0,0 +1,194 @@
+import { JwtVerifyError } from '@atproto/jwk'
+import {
+  SignJWT,
+  exportJWK,
+  generateKeyPair,
+  importJWK,
+  importPKCS8,
+  jwtVerify,
+  type GenerateKeyPairOptions,
+  type GenerateKeyPairResult,
+  type JWK,
+  type JWTVerifyOptions,
+  type KeyLike,
+} from 'jose'
+import { JOSEError } from 'jose/errors'
+
+import {
+  Jwk,
+  JwkError,
+  JwtCreateError,
+  JwtHeader,
+  JwtPayload,
+  Key,
+  SignedJwt,
+  VerifyOptions,
+  VerifyPayload,
+  VerifyResult,
+  jwkValidator,
+} from '@atproto/jwk'
+import { either } from './util'
+
+export type Importable = string | KeyLike | Jwk
+
+export type { GenerateKeyPairOptions, GenerateKeyPairResult }
+
+export class JoseKey extends Key {
+  #keyObj?: KeyLike | Uint8Array
+
+  protected async getKey() {
+    try {
+      return (this.#keyObj ||= await importJWK(this.jwk as JWK))
+    } catch (cause) {
+      throw new JwkError('Failed to import JWK', undefined, { cause })
+    }
+  }
+
+  async createJwt(header: JwtHeader, payload: JwtPayload) {
+    if (header.kid && header.kid !== this.kid) {
+      throw new JwtCreateError(
+        `Invalid "kid" (${header.kid}) used to sign with key "${this.kid}"`,
+      )
+    }
+
+    if (!header.alg || !this.algorithms.includes(header.alg)) {
+      throw new JwtCreateError(
+        `Invalid "alg" (${header.alg}) used to sign with key "${this.kid}"`,
+      )
+    }
+
+    const keyObj = await this.getKey()
+    return new SignJWT(payload)
+      .setProtectedHeader({ ...header, kid: this.kid })
+      .sign(keyObj) as Promise<SignedJwt>
+  }
+
+  async verifyJwt<
+    P extends VerifyPayload = JwtPayload,
+    C extends string = string,
+  >(token: SignedJwt, options?: VerifyOptions<C>): Promise<VerifyResult<P, C>> {
+    try {
+      const keyObj = await this.getKey()
+      const result = await jwtVerify(token, keyObj, {
+        ...options,
+        algorithms: this.algorithms,
+      } as JWTVerifyOptions)
+
+      return result as VerifyResult<P, C>
+    } catch (error) {
+      if (error instanceof JOSEError) {
+        throw new JwtVerifyError(error.message, error.code, { cause: error })
+      } else {
+        throw JwtVerifyError.from(error)
+      }
+    }
+  }
+
+  static async generateKeyPair(
+    allowedAlgos: readonly string[] = ['ES256'],
+    options?: GenerateKeyPairOptions,
+  ) {
+    if (!allowedAlgos.length) {
+      throw new JwkError('No algorithms provided for key generation')
+    }
+
+    const errors: unknown[] = []
+    for (const alg of allowedAlgos) {
+      try {
+        return await generateKeyPair(alg, options)
+      } catch (err) {
+        errors.push(err)
+      }
+    }
+
+    throw new JwkError('Failed to generate key pair', undefined, {
+      cause: new AggregateError(errors, 'None of the algorithms worked'),
+    })
+  }
+
+  static async generate(
+    allowedAlgos: string[] = ['ES256'],
+    kid?: string,
+    options?: Omit<GenerateKeyPairOptions, 'extractable'>,
+  ) {
+    const kp = await this.generateKeyPair(allowedAlgos, {
+      ...options,
+      extractable: true,
+    })
+    return this.fromImportable(kp.privateKey, kid)
+  }
+
+  static async fromImportable(
+    input: Importable,
+    kid?: string,
+  ): Promise<JoseKey> {
+    if (typeof input === 'string') {
+      // PKCS8
+      if (input.startsWith('-----')) {
+        // The "alg" is only needed in WebCrypto (NodeJS will be fine)
+        return this.fromPKCS8(input, '', kid)
+      }
+
+      // Jwk (string)
+      if (input.startsWith('{')) {
+        return this.fromJWK(input, kid)
+      }
+
+      throw new JwkError('Invalid input')
+    }
+
+    if (typeof input === 'object') {
+      // Jwk
+      if ('kty' in input || 'alg' in input) {
+        return this.fromJWK(input, kid)
+      }
+
+      // KeyLike
+      if (!kid) throw new JwkError('Missing "kid" for KeyLike key')
+      return this.fromKeyLike(input, kid)
+    }
+
+    throw new JwkError('Invalid input')
+  }
+
+  /**
+   * @see {@link exportJWK}
+   */
+  static async fromKeyLike(
+    keyLike: KeyLike | Uint8Array,
+    kid?: string,
+    alg?: string,
+  ): Promise<JoseKey> {
+    const jwk = await exportJWK(keyLike)
+    if (alg) {
+      if (!jwk.alg) jwk.alg = alg
+      else if (jwk.alg !== alg) throw new JwkError('Invalid "alg" in JWK')
+    }
+    return this.fromJWK(jwk, kid)
+  }
+
+  /**
+   * @see {@link importPKCS8}
+   */
+  static async fromPKCS8(
+    pem: string,
+    alg: string,
+    kid?: string,
+  ): Promise<JoseKey> {
+    const keyLike = await importPKCS8(pem, alg, { extractable: true })
+    return this.fromKeyLike(keyLike, kid)
+  }
+
+  static async fromJWK(
+    input: string | Record<string, unknown>,
+    inputKid?: string,
+  ): Promise<JoseKey> {
+    const jwk = typeof input === 'string' ? JSON.parse(input) : input
+    if (!jwk || typeof jwk !== 'object') throw new JwkError('Invalid JWK')
+
+    const kid = either(jwk.kid, inputKid)
+    const use = jwk.use || 'sig'
+
+    return new JoseKey(jwkValidator.parse({ ...jwk, kid, use }))
+  }
+}

package/src/util.ts

@@ -0,0 +1,9 @@
+export function either<T extends string | number | boolean>(
+  a?: T,
+  b?: T,
+): T | undefined {
+  if (a != null && b != null && a !== b) {
+    throw new TypeError(`Expected "${b}", got "${a}"`)
+  }
+  return a ?? b ?? undefined
+}

package/tsconfig.build.json

@@ -0,0 +1,8 @@
+{
+  "extends": ["../../../tsconfig/nodenext.json"],
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

package/tsconfig.json

@@ -0,0 +1,4 @@
+{
+  "include": [],
+  "references": [{ "path": "./tsconfig.build.json" }]
+}