@atproto/jwk 0.5.0 → 0.7.0-next.0

package/dist/key.js

@@ -1,4 +1,3 @@
-"use strict";
 var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
     var useValue = arguments.length > 2;
     for (var i = 0; i < initializers.length; i++) {
@@ -33,102 +32,174 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Key = void 0;
-const alg_js_1 = require("./alg.js");
-const errors_js_1 = require("./errors.js");
-const jwk_js_1 = require("./jwk.js");
-const util_js_1 = require("./util.js");
-const jwkSchemaReadonly = jwk_js_1.jwkSchema.readonly();
+import { jwkAlgorithms } from './alg.js';
+import { PUBLIC_KEY_USAGE, hasSharedSecretJwk, isEncKeyUsage, isPrivateJwk, isPublicKeyUsage, isSigKeyUsage, jwkPubSchema, jwkSchema, } from './jwk.js';
+import { cachedGetter } from './util.js';
 let Key = (() => {
-    var _a;
     let _instanceExtraInitializers = [];
+    let _get_isPrivate_decorators;
+    let _get_isSymetric_decorators;
     let _get_publicJwk_decorators;
     let _get_bareJwk_decorators;
     let _get_algorithms_decorators;
-    return _a = class Key {
-            constructor(jwk) {
-                // @TODO "use" is actually only for public keys. We should allow missing
-                // "use" here and automatically add it to the exposed `publicJwk`
-                Object.defineProperty(this, "jwk", {
-                    enumerable: true,
-                    configurable: true,
-                    writable: true,
-                    value: (__runInitializers(this, _instanceExtraInitializers), jwk)
-                });
-                // A key should always be used either for signing or encryption.
-                if (!jwk.use)
-                    throw new errors_js_1.JwkError('Missing "use" Parameter value');
-            }
-            get isPrivate() {
-                const { jwk } = this;
-                if ('d' in jwk && jwk.d !== undefined)
-                    return true;
-                if ('k' in jwk && jwk.k !== undefined)
-                    return true;
-                return false;
-            }
-            get isSymetric() {
-                const { jwk } = this;
-                if ('k' in jwk && jwk.k !== undefined)
-                    return true;
+    return class Key {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
+            _get_isPrivate_decorators = [cachedGetter];
+            _get_isSymetric_decorators = [cachedGetter];
+            _get_publicJwk_decorators = [cachedGetter];
+            _get_bareJwk_decorators = [cachedGetter];
+            _get_algorithms_decorators = [cachedGetter];
+            __esDecorate(this, null, _get_isPrivate_decorators, { kind: "getter", name: "isPrivate", static: false, private: false, access: { has: obj => "isPrivate" in obj, get: obj => obj.isPrivate }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _get_isSymetric_decorators, { kind: "getter", name: "isSymetric", static: false, private: false, access: { has: obj => "isSymetric" in obj, get: obj => obj.isSymetric }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _get_publicJwk_decorators, { kind: "getter", name: "publicJwk", static: false, private: false, access: { has: obj => "publicJwk" in obj, get: obj => obj.publicJwk }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _get_bareJwk_decorators, { kind: "getter", name: "bareJwk", static: false, private: false, access: { has: obj => "bareJwk" in obj, get: obj => obj.bareJwk }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _get_algorithms_decorators, { kind: "getter", name: "algorithms", static: false, private: false, access: { has: obj => "algorithms" in obj, get: obj => obj.algorithms }, metadata: _metadata }, null, _instanceExtraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        constructor(jwk) {
+            this.jwk = (__runInitializers(this, _instanceExtraInitializers), jwk);
+        }
+        get isPrivate() {
+            return isPrivateJwk(this.jwk);
+        }
+        get isSymetric() {
+            return hasSharedSecretJwk(this.jwk);
+        }
+        get privateJwk() {
+            if (!this.isPrivate)
+                return undefined;
+            return this.jwk;
+        }
+        get publicJwk() {
+            if (this.isSymetric)
+                return undefined;
+            if (!this.isPrivate)
+                return this.jwk;
+            const validated = jwkPubSchema.safeParse({
+                ...this.jwk,
+                d: undefined,
+                k: undefined,
+                use: undefined,
+                key_ops: buildPublicKeyOps(this.keyOps) ?? PUBLIC_KEY_USAGE,
+            });
+            // One reason why the parsing might fail is if key_ops is empty. This check
+            // also allows to future proof the code (e.g if another type of private key
+            // is added that uses a different property than "d" or "k" to store its
+            // private value).
+            if (!validated.success)
+                return undefined;
+            return Object.freeze(validated.data);
+        }
+        get bareJwk() {
+            if (this.isSymetric)
+                return undefined;
+            const { kty, crv, e, n, x, y } = this.jwk;
+            return Object.freeze(jwkSchema.parse({ crv, e, kty, n, x, y }));
+        }
+        /**
+         * @note Only defined on public keys
+         */
+        get use() {
+            return this.jwk.use;
+        }
+        get keyOps() {
+            return this.jwk.key_ops;
+        }
+        /**
+         * The (forced) algorithm to use. If not provided, the key will be usable with
+         * any of the algorithms in {@link algorithms}.
+         *
+         * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1 | "alg" (Algorithm) Header Parameter Values for JWS}
+         */
+        get alg() {
+            return this.jwk.alg;
+        }
+        get kid() {
+            return this.jwk.kid;
+        }
+        get crv() {
+            return this.jwk.crv;
+        }
+        /**
+         * All the algorithms that this key can be used with. If `alg` is provided,
+         * this set will only contain that algorithm.
+         */
+        get algorithms() {
+            return Object.freeze(Array.from(jwkAlgorithms(this.jwk)));
+        }
+        get isRevoked() {
+            return this.jwk.revoked != null;
+        }
+        isActive(options) {
+            if (!options?.allowRevoked && this.isRevoked)
                 return false;
+            const tolerance = options?.clockTolerance ?? 0;
+            if (tolerance !== Infinity) {
+                const now = options?.currentDate?.getTime() ?? Date.now();
+                const { exp, nbf } = this.jwk;
+                if (nbf != null && !(now >= nbf * 1e3 - tolerance))
+                    return false;
+                if (exp != null && !(now < exp * 1e3 + tolerance))
+                    return false;
             }
-            get privateJwk() {
-                return this.isPrivate ? this.jwk : undefined;
-            }
-            get publicJwk() {
-                if (this.isSymetric)
-                    return undefined;
-                return jwkSchemaReadonly.parse({
-                    ...this.jwk,
-                    d: undefined,
-                    k: undefined,
-                });
-            }
-            get bareJwk() {
-                if (this.isSymetric)
-                    return undefined;
-                const { kty, crv, e, n, x, y } = this.jwk;
-                return jwkSchemaReadonly.parse({ crv, e, kty, n, x, y });
-            }
-            get use() {
-                return this.jwk.use;
-            }
-            /**
-             * The (forced) algorithm to use. If not provided, the key will be usable with
-             * any of the algorithms in {@link algorithms}.
-             *
-             * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1 | "alg" (Algorithm) Header Parameter Values for JWS}
-             */
-            get alg() {
-                return this.jwk.alg;
-            }
-            get kid() {
-                return this.jwk.kid;
+            return true;
+        }
+        matches(opts) {
+            if (opts.kid != null) {
+                const matchesKid = Array.isArray(opts.kid)
+                    ? this.kid != null && opts.kid.includes(this.kid)
+                    : this.kid === opts.kid;
+                if (!matchesKid)
+                    return false;
             }
-            get crv() {
-                return this.jwk.crv;
+            if (opts.alg != null) {
+                const matchesAlg = Array.isArray(opts.alg)
+                    ? opts.alg.some((a) => this.algorithms.includes(a))
+                    : this.algorithms.includes(opts.alg);
+                if (!matchesAlg)
+                    return false;
             }
-            /**
-             * All the algorithms that this key can be used with. If `alg` is provided,
-             * this set will only contain that algorithm.
-             */
-            get algorithms() {
-                return Object.freeze(Array.from((0, alg_js_1.jwkAlgorithms)(this.jwk)));
+            if (opts.usage != null) {
+                const matchesOps = this.keyOps == null ||
+                    this.keyOps.includes(opts.usage) ||
+                    // @NOTE Because this.jwk represents the private key (typically used for
+                    // private operations), the public counterpart operations are allowed.
+                    (opts.usage === 'verify' && this.keyOps.includes('sign')) ||
+                    (opts.usage === 'encrypt' && this.keyOps.includes('decrypt')) ||
+                    (opts.usage === 'wrapKey' && this.keyOps.includes('unwrapKey'));
+                if (!matchesOps)
+                    return false;
+                const matchesUse = this.use == null ||
+                    (this.use === 'sig' && isSigKeyUsage(opts.usage)) ||
+                    (this.use === 'enc' && isEncKeyUsage(opts.usage));
+                if (!matchesUse)
+                    return false;
+                // @NOTE This is only relevant when "key_ops" and "use" are undefined.
+                // This line also ensures that when "opts.usage" is a private key usage
+                // (e.g. "sign"), the key is indeed a private key.
+                const matchesKeyType = this.isPrivate || isPublicKeyUsage(opts.usage);
+                if (!matchesKeyType)
+                    return false;
             }
-        },
-        (() => {
-            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(null) : void 0;
-            _get_publicJwk_decorators = [util_js_1.cachedGetter];
-            _get_bareJwk_decorators = [util_js_1.cachedGetter];
-            _get_algorithms_decorators = [util_js_1.cachedGetter];
-            __esDecorate(_a, null, _get_publicJwk_decorators, { kind: "getter", name: "publicJwk", static: false, private: false, access: { has: obj => "publicJwk" in obj, get: obj => obj.publicJwk }, metadata: _metadata }, null, _instanceExtraInitializers);
-            __esDecorate(_a, null, _get_bareJwk_decorators, { kind: "getter", name: "bareJwk", static: false, private: false, access: { has: obj => "bareJwk" in obj, get: obj => obj.bareJwk }, metadata: _metadata }, null, _instanceExtraInitializers);
-            __esDecorate(_a, null, _get_algorithms_decorators, { kind: "getter", name: "algorithms", static: false, private: false, access: { has: obj => "algorithms" in obj, get: obj => obj.algorithms }, metadata: _metadata }, null, _instanceExtraInitializers);
-            if (_metadata) Object.defineProperty(_a, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
-        })(),
-        _a;
+            return true;
+        }
+    };
 })();
-exports.Key = Key;
+export { Key };
+function buildPublicKeyOps(keyUsages) {
+    if (keyUsages == null)
+        return undefined;
+    // https://datatracker.ietf.org/doc/html/rfc7517#section-4.3
+    // > Duplicate key operation values MUST NOT be present in the array.
+    const publicOps = new Set(keyUsages.filter(isPublicKeyUsage));
+    // @NOTE Translating private key usage into public key usage
+    if (keyUsages.includes('sign'))
+        publicOps.add('verify');
+    if (keyUsages.includes('decrypt'))
+        publicOps.add('encrypt');
+    if (keyUsages.includes('unwrapKey'))
+        publicOps.add('wrapKey');
+    return Array.from(publicOps);
+}
 //# sourceMappingURL=key.js.map

package/dist/key.js.map

@@ -1 +1 @@
-{"version":3,"file":"key.js","sourceRoot":"","sources":["../src/key.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qCAAwC;AACxC,2CAAsC;AACtC,qCAAyC;AAGzC,uCAAwC;AAExC,MAAM,iBAAiB,GAAG,kBAAS,CAAC,QAAQ,EAAE,CAAA;IAExB,GAAG;;;;;;sBAAH,GAAG;YACvB,YAA+B,GAAgB;gBAC7C,wEAAwE;gBACxE,iEAAiE;gBAFvD;;;;4BADQ,mDAAG,EACQ,GAAG;mBAAa;gBAI7C,gEAAgE;gBAChE,IAAI,CAAC,GAAG,CAAC,GAAG;oBAAE,MAAM,IAAI,oBAAQ,CAAC,+BAA+B,CAAC,CAAA;YACnE,CAAC;YAED,IAAI,SAAS;gBACX,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;gBACpB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;gBAClD,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;gBAClD,OAAO,KAAK,CAAA;YACd,CAAC;YAED,IAAI,UAAU;gBACZ,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;gBACpB,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAA;gBAClD,OAAO,KAAK,CAAA;YACd,CAAC;YAED,IAAI,UAAU;gBACZ,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YAC9C,CAAC;YAGD,IAAI,SAAS;gBAGX,IAAI,IAAI,CAAC,UAAU;oBAAE,OAAO,SAAS,CAAA;gBAErC,OAAO,iBAAiB,CAAC,KAAK,CAAC;oBAC7B,GAAG,IAAI,CAAC,GAAG;oBACX,CAAC,EAAE,SAAS;oBACZ,CAAC,EAAE,SAAS;iBACb,CAA+C,CAAA;YAClD,CAAC;YAGD,IAAI,OAAO;gBACT,IAAI,IAAI,CAAC,UAAU;oBAAE,OAAO,SAAS,CAAA;gBACrC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,GAAU,CAAA;gBAChD,OAAO,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAC1D,CAAC;YAED,IAAI,GAAG;gBACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAI,CAAA;YACtB,CAAC;YAED;;;;;eAKG;YACH,IAAI,GAAG;gBACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;YACrB,CAAC;YAED,IAAI,GAAG;gBACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;YACrB,CAAC;YAED,IAAI,GAAG;gBACL,OAAQ,IAAI,CAAC,GAAyD,CAAC,GAAG,CAAA;YAC5E,CAAC;YAED;;;eAGG;YAEH,IAAI,UAAU;gBACZ,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAA,sBAAa,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAC3D,CAAC;;;;yCAjDA,sBAAY;uCAaZ,sBAAY;0CAiCZ,sBAAY;YA7Cb,gLAAI,SAAS,6DAUZ;YAGD,0KAAI,OAAO,6DAIV;YA6BD,mLAAI,UAAU,6DAEb;;;;;AA3EmB,kBAAG"}
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../src/key.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAGL,gBAAgB,EAIhB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,GACV,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;IAclB,GAAG;;;;;;;iBAAH,GAAG;;;yCAGtB,YAAY;0CAKZ,YAAY;yCAWZ,YAAY;uCAsBZ,YAAY;0CAwCZ,YAAY;YA7Eb,kLAAI,SAAS,6DAEZ;YAGD,qLAAI,UAAU,6DAEb;YASD,kLAAI,SAAS,6DAmBZ;YAGD,4KAAI,OAAO,6DAIV;YAoCD,qLAAI,UAAU,6DAEb;;;QAnFD,YAAqB,GAAgB;YAAhB,QAAG,IADJ,mDAAG,EACF,GAAG,EAAa;QAAG,CAAC;QAGzC,IAAI,SAAS;YACX,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC;QAGD,IAAI,UAAU;YACZ,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrC,CAAC;QAED,IAAI,UAAU;YACZ,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAA;YAErC,OAAO,IAAI,CAAC,GAA2B,CAAA;QACzC,CAAC;QAGD,IAAI,SAAS;YACX,IAAI,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAA;YACrC,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,GAA0B,CAAA;YAE3D,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;gBACvC,GAAG,IAAI,CAAC,GAAG;gBACX,CAAC,EAAE,SAAS;gBACZ,CAAC,EAAE,SAAS;gBACZ,GAAG,EAAE,SAAS;gBACd,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,gBAAgB;aAC5D,CAAC,CAAA;YAEF,2EAA2E;YAC3E,2EAA2E;YAC3E,uEAAuE;YACvE,kBAAkB;YAClB,IAAI,CAAC,SAAS,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YAExC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QAGD,IAAI,OAAO;YACT,IAAI,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAA;YACrC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,GAAU,CAAA;YAChD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACjE,CAAC;QAED;;WAEG;QACH,IAAI,GAAG;YACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,IAAI,MAAM;YACR,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAA;QACzB,CAAC;QAED;;;;;WAKG;QACH,IAAI,GAAG;YACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,IAAI,GAAG;YACL,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,IAAI,GAAG;YACL,OAAQ,IAAI,CAAC,GAAyD,CAAC,GAAG,CAAA;QAC5E,CAAC;QAED;;;WAGG;QAEH,IAAI,UAAU;YACZ,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC3D,CAAC;QAED,IAAI,SAAS;YACX,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAA;QACjC,CAAC;QAED,QAAQ,CAAC,OAA8B;YACrC,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAA;YAE1D,MAAM,SAAS,GAAG,OAAO,EAAE,cAAc,IAAI,CAAC,CAAA;YAC9C,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,GAAG,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;gBACzD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAA;gBAE7B,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC;oBAAE,OAAO,KAAK,CAAA;gBAChE,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC;oBAAE,OAAO,KAAK,CAAA;YACjE,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,CAAC,IAAqB;YAC3B,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;oBACxC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;oBACjD,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAA;gBACzB,IAAI,CAAC,UAAU;oBAAE,OAAO,KAAK,CAAA;YAC/B,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;oBACxC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;oBACnD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACtC,IAAI,CAAC,UAAU;oBAAE,OAAO,KAAK,CAAA;YAC/B,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,IAAI,IAAI;oBACnB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;oBAChC,wEAAwE;oBACxE,sEAAsE;oBACtE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACzD,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;oBAC7D,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;gBACjE,IAAI,CAAC,UAAU;oBAAE,OAAO,KAAK,CAAA;gBAE7B,MAAM,UAAU,GACd,IAAI,CAAC,GAAG,IAAI,IAAI;oBAChB,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACjD,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBACnD,IAAI,CAAC,UAAU;oBAAE,OAAO,KAAK,CAAA;gBAE7B,sEAAsE;gBACtE,uEAAuE;gBACvE,kDAAkD;gBAClD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACrE,IAAI,CAAC,cAAc;oBAAE,OAAO,KAAK,CAAA;YACnC,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;;;SAjJmB,GAAG;AAmKzB,SAAS,iBAAiB,CACxB,SAA+B;IAE/B,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,SAAS,CAAA;IAEvC,4DAA4D;IAC5D,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAE7D,4DAA4D;IAC5D,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACvD,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC3D,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAE7D,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC9B,CAAC","sourcesContent":["import { jwkAlgorithms } from './alg.js'\nimport {\n  Jwk,\n  KeyUsage,\n  PUBLIC_KEY_USAGE,\n  PrivateJwk,\n  PublicJwk,\n  PublicKeyUsage,\n  hasSharedSecretJwk,\n  isEncKeyUsage,\n  isPrivateJwk,\n  isPublicKeyUsage,\n  isSigKeyUsage,\n  jwkPubSchema,\n  jwkSchema,\n} from './jwk.js'\nimport { VerifyOptions, VerifyResult } from './jwt-verify.js'\nimport { JwtHeader, JwtPayload, SignedJwt } from './jwt.js'\nimport { cachedGetter } from './util.js'\n\nexport type KeyMatchOptions = {\n  usage?: KeyUsage\n  kid?: string | string[]\n  alg?: string | string[]\n}\n\nexport type ActivityCheckOptions = {\n  allowRevoked?: boolean\n  clockTolerance?: number\n  currentDate?: Date\n}\n\nexport abstract class Key<J extends Jwk = Jwk> {\n  constructor(readonly jwk: Readonly<J>) {}\n\n  @cachedGetter\n  get isPrivate(): boolean {\n    return isPrivateJwk(this.jwk)\n  }\n\n  @cachedGetter\n  get isSymetric(): boolean {\n    return hasSharedSecretJwk(this.jwk)\n  }\n\n  get privateJwk(): Readonly<PrivateJwk> | undefined {\n    if (!this.isPrivate) return undefined\n\n    return this.jwk as Readonly<PrivateJwk>\n  }\n\n  @cachedGetter\n  get publicJwk(): Readonly<PublicJwk> | undefined {\n    if (this.isSymetric) return undefined\n    if (!this.isPrivate) return this.jwk as Readonly<PublicJwk>\n\n    const validated = jwkPubSchema.safeParse({\n      ...this.jwk,\n      d: undefined,\n      k: undefined,\n      use: undefined,\n      key_ops: buildPublicKeyOps(this.keyOps) ?? PUBLIC_KEY_USAGE,\n    })\n\n    // One reason why the parsing might fail is if key_ops is empty. This check\n    // also allows to future proof the code (e.g if another type of private key\n    // is added that uses a different property than \"d\" or \"k\" to store its\n    // private value).\n    if (!validated.success) return undefined\n\n    return Object.freeze(validated.data)\n  }\n\n  @cachedGetter\n  get bareJwk(): Readonly<Jwk> | undefined {\n    if (this.isSymetric) return undefined\n    const { kty, crv, e, n, x, y } = this.jwk as any\n    return Object.freeze(jwkSchema.parse({ crv, e, kty, n, x, y }))\n  }\n\n  /**\n   * @note Only defined on public keys\n   */\n  get use(): 'sig' | 'enc' | undefined {\n    return this.jwk.use\n  }\n\n  get keyOps(): readonly KeyUsage[] | undefined {\n    return this.jwk.key_ops\n  }\n\n  /**\n   * The (forced) algorithm to use. If not provided, the key will be usable with\n   * any of the algorithms in {@link algorithms}.\n   *\n   * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1 | \"alg\" (Algorithm) Header Parameter Values for JWS}\n   */\n  get alg() {\n    return this.jwk.alg\n  }\n\n  get kid() {\n    return this.jwk.kid\n  }\n\n  get crv() {\n    return (this.jwk as { crv: undefined } | Extract<J, { crv: unknown }>).crv\n  }\n\n  /**\n   * All the algorithms that this key can be used with. If `alg` is provided,\n   * this set will only contain that algorithm.\n   */\n  @cachedGetter\n  get algorithms(): readonly string[] {\n    return Object.freeze(Array.from(jwkAlgorithms(this.jwk)))\n  }\n\n  get isRevoked() {\n    return this.jwk.revoked != null\n  }\n\n  isActive(options?: ActivityCheckOptions) {\n    if (!options?.allowRevoked && this.isRevoked) return false\n\n    const tolerance = options?.clockTolerance ?? 0\n    if (tolerance !== Infinity) {\n      const now = options?.currentDate?.getTime() ?? Date.now()\n      const { exp, nbf } = this.jwk\n\n      if (nbf != null && !(now >= nbf * 1e3 - tolerance)) return false\n      if (exp != null && !(now < exp * 1e3 + tolerance)) return false\n    }\n\n    return true\n  }\n\n  matches(opts: KeyMatchOptions): boolean {\n    if (opts.kid != null) {\n      const matchesKid = Array.isArray(opts.kid)\n        ? this.kid != null && opts.kid.includes(this.kid)\n        : this.kid === opts.kid\n      if (!matchesKid) return false\n    }\n\n    if (opts.alg != null) {\n      const matchesAlg = Array.isArray(opts.alg)\n        ? opts.alg.some((a) => this.algorithms.includes(a))\n        : this.algorithms.includes(opts.alg)\n      if (!matchesAlg) return false\n    }\n\n    if (opts.usage != null) {\n      const matchesOps =\n        this.keyOps == null ||\n        this.keyOps.includes(opts.usage) ||\n        // @NOTE Because this.jwk represents the private key (typically used for\n        // private operations), the public counterpart operations are allowed.\n        (opts.usage === 'verify' && this.keyOps.includes('sign')) ||\n        (opts.usage === 'encrypt' && this.keyOps.includes('decrypt')) ||\n        (opts.usage === 'wrapKey' && this.keyOps.includes('unwrapKey'))\n      if (!matchesOps) return false\n\n      const matchesUse =\n        this.use == null ||\n        (this.use === 'sig' && isSigKeyUsage(opts.usage)) ||\n        (this.use === 'enc' && isEncKeyUsage(opts.usage))\n      if (!matchesUse) return false\n\n      // @NOTE This is only relevant when \"key_ops\" and \"use\" are undefined.\n      // This line also ensures that when \"opts.usage\" is a private key usage\n      // (e.g. \"sign\"), the key is indeed a private key.\n      const matchesKeyType = this.isPrivate || isPublicKeyUsage(opts.usage)\n      if (!matchesKeyType) return false\n    }\n\n    return true\n  }\n\n  /**\n   * Create a signed JWT\n   */\n  abstract createJwt(header: JwtHeader, payload: JwtPayload): Promise<SignedJwt>\n\n  /**\n   * Verify the signature, headers and payload of a JWT\n   *\n   * @throws {JwtVerifyError} if the JWT is invalid\n   */\n  abstract verifyJwt<C extends string = never>(\n    token: SignedJwt,\n    options?: VerifyOptions<C>,\n  ): Promise<VerifyResult<C>>\n}\n\nfunction buildPublicKeyOps(\n  keyUsages?: readonly KeyUsage[],\n): PublicKeyUsage[] | undefined {\n  if (keyUsages == null) return undefined\n\n  // https://datatracker.ietf.org/doc/html/rfc7517#section-4.3\n  // > Duplicate key operation values MUST NOT be present in the array.\n  const publicOps = new Set(keyUsages.filter(isPublicKeyUsage))\n\n  // @NOTE Translating private key usage into public key usage\n  if (keyUsages.includes('sign')) publicOps.add('verify')\n  if (keyUsages.includes('decrypt')) publicOps.add('encrypt')\n  if (keyUsages.includes('unwrapKey')) publicOps.add('wrapKey')\n\n  return Array.from(publicOps)\n}\n"]}