@atproto/jwk 0.5.0 → 0.7.0-next.0

package/src/keyset.ts

@@ -6,37 +6,35 @@ import {
   JwtCreateError,
   JwtVerifyError,
 } from './errors.js'
-import { Jwk } from './jwk.js'
-import { Jwks, JwksPub } from './jwks.js'
+import { PrivateKeyUsage } from './jwk.js'
+import { JwksPub } from './jwks.js'
 import { unsafeDecodeJwt } from './jwt-decode.js'
 import { VerifyOptions, VerifyResult } from './jwt-verify.js'
 import { JwtHeader, JwtPayload, SignedJwt } from './jwt.js'
-import { Key } from './key.js'
+import { ActivityCheckOptions, Key, KeyMatchOptions } from './key.js'
 import {
-  DeepReadonly,
   Override,
-  UnReadonly,
   cachedGetter,
   isDefined,
   matchesAny,
   preferredOrderCmp,
 } from './util.js'
 
-export type JwtSignHeader = Override<JwtHeader, Pick<KeySearch, 'alg' | 'kid'>>
+export type { ActivityCheckOptions, KeyMatchOptions }
+export type FindKeyOptions = KeyMatchOptions & ActivityCheckOptions
+
+export type JwtSignHeader = Override<
+  JwtHeader,
+  Pick<FindKeyOptions, 'alg' | 'kid'>
+>
 
 export type JwtPayloadGetter<P = JwtPayload> = (
   header: JwtHeader,
   key: Key,
 ) => P | PromiseLike<P>
 
-export type KeySearch = {
-  use?: 'sig' | 'enc'
-  kid?: string | string[]
-  alg?: string | string[]
-}
-
-const extractPrivateJwk = (key: Key): Jwk | undefined => key.privateJwk
-const extractPublicJwk = (key: Key): Jwk | undefined => key.publicJwk
+const extractPrivateJwk = (key: Key) => key.privateJwk
+const extractPublicJwk = (key: Key) => key.publicJwk
 
 export class Keyset<K extends Key = Key> implements Iterable<K> {
   private readonly keys: readonly K[]
@@ -67,15 +65,15 @@ export class Keyset<K extends Key = Key> implements Iterable<K> {
   ) {
     const keys: K[] = []
 
-    const kids = new Set<string>()
+    const keyIds = new Set<string>()
     for (const key of iterable) {
       if (!key) continue
 
       keys.push(key)
 
       if (key.kid) {
-        if (kids.has(key.kid)) throw new JwkError(`Duplicate key: ${key.kid}`)
-        else kids.add(key.kid)
+        if (keyIds.has(key.kid)) throw new JwkError(`Duplicate key: ${key.kid}`)
+        else keyIds.add(key.kid)
       }
     }
 
@@ -101,66 +99,67 @@ export class Keyset<K extends Key = Key> implements Iterable<K> {
   }
 
   @cachedGetter
-  get publicJwks(): DeepReadonly<JwksPub> {
-    return {
-      keys: Array.from(this, extractPublicJwk).filter(isDefined),
-    }
+  get publicJwks() {
+    return Object.freeze({
+      keys: Object.freeze(Array.from(this, extractPublicJwk).filter(isDefined)),
+    })
   }
 
   @cachedGetter
-  get privateJwks(): DeepReadonly<Jwks> {
-    return {
-      keys: Array.from(this, extractPrivateJwk).filter(isDefined),
-    }
+  get privateJwks() {
+    return Object.freeze({
+      keys: Object.freeze(
+        Array.from(this, extractPrivateJwk).filter(isDefined),
+      ),
+    })
   }
 
   has(kid: string): boolean {
     return this.keys.some((key) => key.kid === kid)
   }
 
-  get(search: KeySearch): K {
-    for (const key of this.list(search)) {
-      return key
-    }
+  get(options: FindKeyOptions): K {
+    const key = this.find(options)
+    if (key) return key
 
     throw new JwkError(
-      `Key not found ${search.kid || search.alg || '<unknown>'}`,
+      `Key not found ${options.kid ?? options.alg ?? options.usage ?? '<unknown>'}`,
       ERR_JWK_NOT_FOUND,
     )
   }
 
-  *list(search: KeySearch): Generator<K> {
-    // Optimization: Empty string or empty array will not match any key
-    if (search.kid?.length === 0) return
-    if (search.alg?.length === 0) return
-
-    for (const key of this) {
-      if (search.use && key.use !== search.use) continue
+  find(options: FindKeyOptions): K | undefined {
+    for (const key of this.list(options)) {
+      return key
+    }
 
-      if (Array.isArray(search.kid)) {
-        if (!key.kid || !search.kid.includes(key.kid)) continue
-      } else if (search.kid) {
-        if (key.kid !== search.kid) continue
-      }
+    return undefined
+  }
 
-      if (Array.isArray(search.alg)) {
-        if (!search.alg.some((a) => key.algorithms.includes(a))) continue
-      } else if (typeof search.alg === 'string') {
-        if (!key.algorithms.includes(search.alg)) continue
+  *list<O extends FindKeyOptions>(options: O) {
+    for (const key of this) {
+      if (key.isActive(options) && key.matches(options)) {
+        yield key
       }
-
-      yield key
     }
   }
 
-  findPrivateKey({ kid, alg, use }: KeySearch): { key: Key; alg: string } {
+  findPrivateKey({
+    kid,
+    alg,
+    usage,
+    ...options
+  }: FindKeyOptions & { usage: PrivateKeyUsage }): {
+    key: Key
+    alg: string
+  } {
     const matchingKeys: Key[] = []
 
-    for (const key of this.list({ kid, alg, use })) {
-      // Not a private key
-      if (!key.isPrivate) continue
+    // Allow the loop bellow to return early when a single "alg" is provided
+    if (Array.isArray(alg) && alg.length === 1) alg = alg[0]
 
-      // Skip negotiation if a specific "alg" was provided
+    for (const key of this.list({ ...options, kid, alg, usage })) {
+      // Skip negotiation if a single "alg" was provided
       if (typeof alg === 'string') return { key, alg }
 
       matchingKeys.push(key)
@@ -188,7 +187,7 @@ export class Keyset<K extends Key = Key> implements Iterable<K> {
     }
 
     throw new JwkError(
-      `No private key found for ${kid || alg || use || '<unknown>'}`,
+      `No private key found for ${kid || alg || usage}`,
       ERR_JWK_NOT_FOUND,
     )
   }
@@ -205,7 +204,8 @@ export class Keyset<K extends Key = Key> implements Iterable<K> {
       const { key, alg } = this.findPrivateKey({
         alg: sAlg,
         kid: sKid,
-        use: 'sig',
+        usage: 'sign',
+        allowRevoked: false, // For explicitness (default value is false)
       })
       const protectedHeader = { ...header, alg, kid: key.kid }
 
@@ -221,14 +221,14 @@ export class Keyset<K extends Key = Key> implements Iterable<K> {
 
   async verifyJwt<C extends string = never>(
     token: SignedJwt,
-    options?: VerifyOptions<C>,
+    options?: ActivityCheckOptions & VerifyOptions<C>,
   ): Promise<VerifyResult<C> & { key: K }> {
     const { header } = unsafeDecodeJwt(token)
     const { kid, alg } = header
 
     const errors: unknown[] = []
 
-    for (const key of this.list({ kid, alg })) {
+    for (const key of this.list({ ...options, kid, alg, usage: 'verify' })) {
       try {
         const result = await key.verifyJwt<C>(token, options)
         return { ...result, key }
@@ -247,8 +247,8 @@ export class Keyset<K extends Key = Key> implements Iterable<K> {
     }
   }
 
-  toJSON(): JwksPub {
-    // Make a copy to prevent mutation of the original keyset
-    return structuredClone(this.publicJwks) as UnReadonly<JwksPub>
+  toJSON() {
+    // Make a copy to allow mutation of the result
+    return structuredClone(this.publicJwks) as JwksPub
   }
 }

package/src/util.ts

@@ -1,7 +1,6 @@
 import { base64url } from 'multiformats/bases/base64'
 import { RefinementCtx, ZodIssueCode } from 'zod'
 
-// eslint-disable-next-line @typescript-eslint/ban-types
 export type Simplify<T> = { [K in keyof T]: T[K] } & {}
 export type Override<T, V> = Simplify<V & Omit<T, keyof V>>
 
@@ -13,24 +12,6 @@ export type RequiredKey<T, K extends keyof T = never> = Simplify<
   }
 >
 
-// eslint-disable-next-line @typescript-eslint/ban-types
-export type DeepReadonly<T> = T extends Function
-  ? T
-  : T extends object
-    ? { readonly [K in keyof T]: DeepReadonly<T[K]> }
-    : T extends readonly (infer U)[]
-      ? readonly DeepReadonly<U>[]
-      : T
-
-// eslint-disable-next-line @typescript-eslint/ban-types
-export type UnReadonly<T> = T extends Function
-  ? T
-  : T extends object
-    ? { -readonly [K in keyof T]: UnReadonly<T[K]> }
-    : T extends readonly (infer U)[]
-      ? UnReadonly<U>[]
-      : T
-
 export const isDefined = <T>(i: T | undefined): i is T => i !== undefined
 
 export const preferredOrderCmp =
@@ -44,6 +25,7 @@ export const preferredOrderCmp =
     return aIdx - bIdx
   }
 
+/* eslint-disable @typescript-eslint/no-unused-vars -- `v` is used at runtime in the returned type guards; v8 false-positive */
 export function matchesAny<T extends string | number | symbol | boolean>(
   value: null | undefined | T | readonly T[],
 ): (v: unknown) => v is T {
@@ -53,6 +35,7 @@ export function matchesAny<T extends string | number | symbol | boolean>(
       ? (v): v is T => value.includes(v)
       : (v): v is T => v === value
 }
+/* eslint-enable @typescript-eslint/no-unused-vars */
 
 /**
  * Decorator to cache the result of a getter on a class instance.
@@ -197,3 +180,9 @@ export const segmentedStringRefinementFactory = <C extends number>(
     return true
   }
 }
+
+export function isLastOccurrence<
+  T extends number | boolean | string | null | undefined | symbol | bigint,
+>(v: T, i: number, arr: readonly T[]): boolean {
+  return arr.indexOf(v, i + 1) === -1
+}

package/tsconfig.build.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/alg.ts","./src/errors.ts","./src/index.ts","./src/jwk.ts","./src/jwks.ts","./src/jwt-decode.ts","./src/jwt-verify.ts","./src/jwt.ts","./src/key.ts","./src/keyset.ts","./src/util.ts"],"version":"5.8.2"}
+{"root":["./src/alg.ts","./src/errors.ts","./src/index.ts","./src/jwk.ts","./src/jwks.ts","./src/jwt-decode.ts","./src/jwt-verify.ts","./src/jwt.ts","./src/key.ts","./src/keyset.ts","./src/util.ts"],"version":"6.0.3"}