@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/api/vendor_modules/aws-jwt-verify/asn1.d.ts

@@ -0,0 +1,20 @@
+/// <reference types="node" />
+/**
+ * Transform an RSA public key, which is a pair of modulus (n) and exponent (e),
+ *  into a buffer per ASN.1 spec (DER-encoding)
+ *
+ * @param n - The modulus of the public key as buffer
+ * @param e - The exponent of the public key as buffer
+ * @returns The buffer, which is the public key encoded per ASN.1 spec (DER-encoding)
+ */
+export declare function constructPublicKeyInDerFormat(n: Buffer, e: Buffer): Buffer;
+/**
+ * Decode an ASN.1 DER-encoded public key, into its modulus (n) and exponent (e)
+ *
+ * @param publicKey - The ASN.1 DER-encoded public key
+ * @returns Object with modulus (n) and exponent (e)
+ */
+export declare function deconstructPublicKeyInDerFormat(publicKey: Buffer): {
+    n: Buffer;
+    e: Buffer;
+};

package/assets/api/vendor_modules/aws-jwt-verify/assert.d.ts

@@ -0,0 +1,41 @@
+import { AssertionErrorConstructor } from "./error.js";
+/**
+ * Assert value is a non-empty string and equal to the expected value,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check
+ * @param expected - The expected value
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ */
+export declare function assertStringEquals<T extends string>(name: string, actual: unknown, expected: T, errorConstructor?: AssertionErrorConstructor): asserts actual is T;
+/**
+ * Assert value is a non-empty string and is indeed one of the expected values,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check
+ * @param expected - The array of expected values. For your convenience you can provide
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ * a string here as well, which will mean an array with just that string
+ */
+export declare function assertStringArrayContainsString<T extends string | Readonly<string[]>>(name: string, actual: unknown, expected: T, errorConstructor?: AssertionErrorConstructor): asserts actual is T extends Readonly<string[]> ? T[number] : T;
+/**
+ * Assert value is an array of strings, where at least one of the strings is indeed one of the expected values,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check, must be an array of strings, or a single string (which will be treated
+ * as an array with just that string)
+ * @param expected - The array of expected values. For your convenience you can provide
+ * a string here as well, which will mean an array with just that string
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ */
+export declare function assertStringArraysOverlap(name: string, actual: unknown, expected: string | Readonly<string[]>, errorConstructor?: AssertionErrorConstructor): asserts actual is string | Readonly<string[]>;
+/**
+ * Assert value is not a promise, or throw an error otherwise
+ *
+ * @param actual - The value to check
+ * @param errorFactory - Function that returns the error to be thrown
+ */
+export declare function assertIsNotPromise(actual: unknown, errorFactory: () => Error): void;

package/assets/api/vendor_modules/aws-jwt-verify/cognito-verifier.d.ts

@@ -0,0 +1,183 @@
+import { JwtRsaVerifierBase, JwtRsaVerifierProperties } from "./jwt-rsa.js";
+import { JwksCache, Jwks, Jwk } from "./jwk.js";
+import { JwtHeader, JwtPayload, CognitoIdOrAccessTokenPayload } from "./jwt-model.js";
+import { Properties } from "./typing-util.js";
+export interface CognitoVerifyProperties {
+    /**
+     * The client ID that you expect to be present on the JWT
+     * (In the ID token's aud claim, or the Access token's client_id claim).
+     * If you provide a string array, that means at least one of those client IDs
+     * must be present on the JWT.
+     * Pass null explicitly to not check the JWT's client ID--if you know what you're doing
+     */
+    clientId: string | string[] | null;
+    /**
+     * The token use that you expect to be present in the JWT's token_use claim.
+     * Usually you are verifying either Access token (common) or ID token (less common).
+     * Pass null explicitly to not check the JWT's token use--if you know what you're doing
+     */
+    tokenUse: "id" | "access" | null;
+    /**
+     * The group that you expect to be present in the JWT's "cognito:groups" claim.
+     * If you provide a string array, that means at least one of those groups
+     * must be present in the JWT's "cognito:groups" claim.
+     */
+    groups?: string | string[] | null;
+    /**
+     * The scope that you expect to be present in the JWT's scope claim.
+     * If you provide a string array, that means at least one of those scopes
+     * must be present in the JWT's scope claim.
+     */
+    scope?: string | string[] | null;
+    /**
+     * The number of seconds after expiration (exp claim) or before not-before (nbf claim) that you will allow
+     * (use this to account for clock differences between systems)
+     */
+    graceSeconds?: number;
+    /**
+     * Your custom function with checks. It will be called, at the end of the verification,
+     * after standard verifcation checks have all passed.
+     * Throw an error in this function if you want to reject the JWT for whatever reason you deem fit.
+     * Your function will be called with a properties object that contains:
+     * - the decoded JWT header
+     * - the decoded JWT payload
+     * - the JWK that was used to verify the JWT's signature
+     */
+    customJwtCheck?: (props: {
+        header: JwtHeader;
+        payload: JwtPayload;
+        jwk: Jwk;
+    }) => Promise<void> | void;
+    /**
+     * If you want to peek inside the invalid JWT when verification fails, set `includeRawJwtInErrors` to true.
+     * Then, if an error is thrown during verification of the invalid JWT (e.g. the JWT is invalid because it is expired),
+     * the Error object will include a property `rawJwt`, with the raw decoded contents of the **invalid** JWT.
+     * The `rawJwt` will only be included in the Error object, if the JWT's signature can at least be verified.
+     */
+    includeRawJwtInErrors?: boolean;
+}
+/** Type for Cognito JWT verifier properties, for a single User Pool */
+export type CognitoJwtVerifierProperties = {
+    /** The User Pool whose JWTs you want to verify */
+    userPoolId: string;
+} & Partial<CognitoVerifyProperties>;
+/**
+ * Type for Cognito JWT verifier properties, when multiple User Pools are used in the verifier.
+ * In this case, you should be explicit in mapping `clientId` to User Pool.
+ */
+export type CognitoJwtVerifierMultiProperties = {
+    /** The User Pool whose JWTs you want to verify */
+    userPoolId: string;
+} & CognitoVerifyProperties;
+/**
+ * Cognito JWT Verifier for a single user pool
+ */
+export type CognitoJwtVerifierSingleUserPool<T extends CognitoJwtVerifierProperties> = CognitoJwtVerifier<Properties<CognitoVerifyProperties, T>, T & JwtRsaVerifierProperties<CognitoVerifyProperties> & {
+    userPoolId: string;
+    audience: null;
+}, false>;
+/**
+ * Cognito JWT Verifier for multiple user pools
+ */
+export type CognitoJwtVerifierMultiUserPool<T extends CognitoJwtVerifierMultiProperties> = CognitoJwtVerifier<Properties<CognitoVerifyProperties, T>, T & JwtRsaVerifierProperties<CognitoVerifyProperties> & {
+    userPoolId: string;
+    audience: null;
+}, true>;
+/**
+ * Parameters used for verification of a JWT.
+ * The first parameter is the JWT, which is (of course) mandatory.
+ * The second parameter is an object with specific properties to use during verification.
+ * The second parameter is only mandatory if its mandatory members (e.g. client_id) were not
+ *  yet provided at verifier level. In that case, they must now be provided.
+ */
+type CognitoVerifyParameters<SpecificVerifyProperties> = {
+    [key: string]: never;
+} extends SpecificVerifyProperties ? [jwt: string, props?: SpecificVerifyProperties] : [jwt: string, props: SpecificVerifyProperties];
+/**
+ * Validate claims of a decoded Cognito JWT.
+ * This function throws an error in case there's any validation issue.
+ *
+ * @param payload - The JSON parsed payload of the Cognito JWT
+ * @param options - Validation options
+ * @param options.groups - The cognito groups, of which at least one must be present in the JWT's cognito:groups claim
+ * @param options.tokenUse - The required token use of the JWT: "id" or "access"
+ * @param options.clientId - The required clientId of the JWT. May be an array of string, of which at least one must match
+ * @returns void
+ */
+export declare function validateCognitoJwtFields(payload: JwtPayload, options: {
+    groups?: string | string[] | null;
+    tokenUse?: "id" | "access" | null;
+    clientId?: string | string[] | null;
+}): void;
+/**
+ * Class representing a verifier for JWTs signed by Amazon Cognito
+ */
+export declare class CognitoJwtVerifier<SpecificVerifyProperties extends Partial<CognitoVerifyProperties>, IssuerConfig extends JwtRsaVerifierProperties<SpecificVerifyProperties> & {
+    userPoolId: string;
+    audience: null;
+}, MultiIssuer extends boolean> extends JwtRsaVerifierBase<SpecificVerifyProperties, IssuerConfig, MultiIssuer> {
+    private constructor();
+    /**
+     * Parse a User Pool ID, to extract the issuer and JWKS URI
+     *
+     * @param userPoolId The User Pool ID
+     * @returns The issuer and JWKS URI for the User Pool
+     */
+    static parseUserPoolId(userPoolId: string): {
+        issuer: string;
+        jwksUri: string;
+    };
+    /**
+     * Create a Cognito JWT verifier for a single User Pool
+     *
+     * @param verifyProperties The verification properties for your User Pool
+     * @param additionalProperties Additional properties
+     * @param additionalProperties.jwksCache Overriding JWKS cache that you want to use
+     * @returns An Cognito JWT Verifier instance, that you can use to verify Cognito signed JWTs with
+     */
+    static create<T extends CognitoJwtVerifierProperties>(verifyProperties: T & Partial<CognitoJwtVerifierProperties>, additionalProperties?: {
+        jwksCache: JwksCache;
+    }): CognitoJwtVerifierSingleUserPool<T>;
+    /**
+     * Create a Cognito JWT verifier for multiple User Pools
+     *
+     * @param verifyProperties An array of verification properties, one for each User Pool
+     * @param additionalProperties Additional properties
+     * @param additionalProperties.jwksCache Overriding JWKS cache that you want to use
+     * @returns An Cognito JWT Verifier instance, that you can use to verify Cognito signed JWTs with
+     */
+    static create<T extends CognitoJwtVerifierMultiProperties>(props: (T & Partial<CognitoJwtVerifierMultiProperties>)[], additionalProperties?: {
+        jwksCache: JwksCache;
+    }): CognitoJwtVerifierMultiUserPool<T>;
+    /**
+     * Verify (synchronously) a JWT that is signed by Amazon Cognito.
+     *
+     * @param jwt The JWT, as string
+     * @param props Verification properties
+     * @returns The payload of the JWT––if the JWT is valid, otherwise an error is thrown
+     */
+    verifySync<T extends SpecificVerifyProperties>(...[jwt, properties]: CognitoVerifyParameters<SpecificVerifyProperties>): CognitoIdOrAccessTokenPayload<IssuerConfig, T>;
+    /**
+     * Verify (asynchronously) a JWT that is signed by Amazon Cognito.
+     * This call is asynchronous, and the JWKS will be fetched from the JWKS uri,
+     * in case it is not yet available in the cache.
+     *
+     * @param jwt The JWT, as string
+     * @param props Verification properties
+     * @returns Promise that resolves to the payload of the JWT––if the JWT is valid, otherwise the promise rejects
+     */
+    verify<T extends SpecificVerifyProperties>(...[jwt, properties]: CognitoVerifyParameters<SpecificVerifyProperties>): Promise<CognitoIdOrAccessTokenPayload<IssuerConfig, T>>;
+    /**
+     * This method loads a JWKS that you provide, into the JWKS cache, so that it is
+     * available for JWT verification. Use this method to speed up the first JWT verification
+     * (when the JWKS would otherwise have to be downloaded from the JWKS uri), or to provide the JWKS
+     * in case the JwtVerifier does not have internet access to download the JWKS
+     *
+     * @param jwks The JWKS
+     * @param userPoolId The userPoolId for which you want to cache the JWKS
+     *  Supply this field, if you instantiated the CognitoJwtVerifier with multiple userPoolIds
+     * @returns void
+     */
+    cacheJwks(...[jwks, userPoolId]: MultiIssuer extends false ? [jwks: Jwks, userPoolId?: string] : [jwks: Jwks, userPoolId: string]): void;
+}
+export {};

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/asn1.js

@@ -0,0 +1,301 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utility to encode RSA public keys (a pair of modulus (n) and exponent (e)) into DER-encoding, per ASN.1 specification.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deconstructPublicKeyInDerFormat = exports.constructPublicKeyInDerFormat = void 0;
+const error_js_1 = require("./error.js");
+/** Enum with possible values for supported ASN.1 classes */
+var Asn1Class;
+(function (Asn1Class) {
+    Asn1Class[Asn1Class["Universal"] = 0] = "Universal";
+})(Asn1Class || (Asn1Class = {}));
+/** Enum with possible values for supported ASN.1 encodings */
+var Asn1Encoding;
+(function (Asn1Encoding) {
+    Asn1Encoding[Asn1Encoding["Primitive"] = 0] = "Primitive";
+    Asn1Encoding[Asn1Encoding["Constructed"] = 1] = "Constructed";
+})(Asn1Encoding || (Asn1Encoding = {}));
+/** Enum with possible values for supported ASN.1 tags */
+var Asn1Tag;
+(function (Asn1Tag) {
+    Asn1Tag[Asn1Tag["BitString"] = 3] = "BitString";
+    Asn1Tag[Asn1Tag["ObjectIdentifier"] = 6] = "ObjectIdentifier";
+    Asn1Tag[Asn1Tag["Sequence"] = 16] = "Sequence";
+    Asn1Tag[Asn1Tag["Null"] = 5] = "Null";
+    Asn1Tag[Asn1Tag["Integer"] = 2] = "Integer";
+})(Asn1Tag || (Asn1Tag = {}));
+/**
+ * Encode an ASN.1 identifier per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.1.2
+ *
+ * @param identifier - The ASN.1 identifier
+ * @returns The buffer
+ */
+function encodeIdentifier(identifier) {
+    const identifierAsNumber = (identifier.class << 7) |
+        (identifier.primitiveOrConstructed << 5) |
+        identifier.tag;
+    return Buffer.from([identifierAsNumber]);
+}
+/**
+ * Encode the length of an ASN.1 type per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.1.3
+ *
+ * @param length - The length of the ASN.1 type
+ * @returns The buffer
+ */
+function encodeLength(length) {
+    if (length < 128) {
+        return Buffer.from([length]);
+    }
+    const integers = [];
+    while (length > 0) {
+        integers.push(length % 256);
+        length = length >> 8;
+    }
+    integers.reverse();
+    return Buffer.from([128 | integers.length, ...integers]);
+}
+/**
+ * Encode a buffer (that represents a positive integer) as integer per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.3
+ *
+ * @param buffer - The buffer that represents a positive integer
+ * @returns The buffer
+ */
+function encodeBufferAsPositiveInteger(buffer) {
+    if (buffer[0] >> 7) {
+        // MSB is 1, add leading zero to indicate positive number
+        buffer = Buffer.concat([Buffer.from([0]), buffer]);
+    }
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Primitive,
+            tag: Asn1Tag.Integer,
+        }),
+        encodeLength(buffer.length),
+        buffer,
+    ]);
+}
+/**
+ * Encode an object identifier (a string such as "1.2.840.113549.1.1.1") per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.19
+ *
+ * @param oid - The object identifier to encode
+ * @returns The buffer
+ */
+function encodeObjectIdentifier(oid) {
+    const oidComponents = oid.split(".").map((i) => parseInt(i));
+    const firstSubidentifier = oidComponents[0] * 40 + oidComponents[1];
+    const subsequentSubidentifiers = oidComponents
+        .slice(2)
+        .reduce((expanded, component) => {
+        const bytes = [];
+        do {
+            bytes.push(component % 128);
+            component = component >> 7;
+        } while (component);
+        return expanded.concat(bytes.map((b, index) => (index ? b + 128 : b)).reverse());
+    }, []);
+    const oidBuffer = Buffer.from([
+        firstSubidentifier,
+        ...subsequentSubidentifiers,
+    ]);
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Primitive,
+            tag: Asn1Tag.ObjectIdentifier,
+        }),
+        encodeLength(oidBuffer.length),
+        oidBuffer,
+    ]);
+}
+/**
+ * Encode a buffer as bit string per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.6
+ *
+ * @param buffer - The buffer to encode
+ * @returns The buffer
+ */
+function encodeBufferAsBitString(buffer) {
+    const bitString = Buffer.concat([Buffer.from([0]), buffer]);
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Primitive,
+            tag: Asn1Tag.BitString,
+        }),
+        encodeLength(bitString.length),
+        bitString,
+    ]);
+}
+/**
+ * Encode a sequence of DER-encoded items per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.9
+ *
+ * @param sequenceItems - The sequence of DER-encoded items
+ * @returns The buffer
+ */
+function encodeSequence(sequenceItems) {
+    const concatenated = Buffer.concat(sequenceItems);
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Constructed,
+            tag: Asn1Tag.Sequence,
+        }),
+        encodeLength(concatenated.length),
+        concatenated,
+    ]);
+}
+/**
+ * Encode null per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.8
+ *
+ * @returns The buffer
+ */
+function encodeNull() {
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Primitive,
+            tag: Asn1Tag.Null,
+        }),
+        encodeLength(0),
+    ]);
+}
+/**
+ * RSA encryption object identifier constant
+ *
+ * From: https://tools.ietf.org/html/rfc8017
+ *
+ * pkcs-1    OBJECT IDENTIFIER ::= {
+ *     iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1
+ * }
+ *
+ * -- When rsaEncryption is used in an AlgorithmIdentifier,
+ * -- the parameters MUST be present and MUST be NULL.
+ * --
+ * rsaEncryption    OBJECT IDENTIFIER ::= { pkcs-1 1 }
+ *
+ * See also: http://www.oid-info.com/get/1.2.840.113549.1.1.1
+ */
+const ALGORITHM_RSA_ENCRYPTION = encodeSequence([
+    encodeObjectIdentifier("1.2.840.113549.1.1.1"),
+    encodeNull(), // parameters
+]);
+/**
+ * Transform an RSA public key, which is a pair of modulus (n) and exponent (e),
+ *  into a buffer per ASN.1 spec (DER-encoding)
+ *
+ * @param n - The modulus of the public key as buffer
+ * @param e - The exponent of the public key as buffer
+ * @returns The buffer, which is the public key encoded per ASN.1 spec (DER-encoding)
+ */
+function constructPublicKeyInDerFormat(n, e) {
+    return encodeSequence([
+        ALGORITHM_RSA_ENCRYPTION,
+        encodeBufferAsBitString(encodeSequence([
+            encodeBufferAsPositiveInteger(n),
+            encodeBufferAsPositiveInteger(e),
+        ])),
+    ]);
+}
+exports.constructPublicKeyInDerFormat = constructPublicKeyInDerFormat;
+/**
+ * Decode an ASN.1 identifier (a number) into its parts: class, primitiveOrConstructed, tag
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.1.2
+ *
+ * @param identifier - The identifier
+ * @returns An object with properties class, primitiveOrConstructed, tag
+ */
+function decodeIdentifier(identifier) {
+    if (identifier >> 3 === 0b11111) {
+        throw new error_js_1.Asn1DecodingError("Decoding of identifier with tag > 30 not implemented");
+    }
+    return {
+        class: identifier >> 6,
+        primitiveOrConstructed: (identifier >> 5) & 0b001,
+        tag: identifier & 0b11111, // bit 1-5
+    };
+}
+/**
+ * Decode an ASN.1 block of length value combinations,
+ * and return the length and byte range of the first length value combination.
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.1.3 - 8.1.5
+ *
+ * @param blockOfLengthValues - The ASN.1 length value
+ * @returns The length and byte range of the first included length value
+ */
+function decodeLengthValue(blockOfLengthValues) {
+    if (!(blockOfLengthValues[0] & 0b10000000)) {
+        return {
+            length: blockOfLengthValues[0],
+            firstByteOffset: 1,
+            lastByteOffset: 1 + blockOfLengthValues[0],
+        };
+    }
+    const nrLengthOctets = blockOfLengthValues[0] & 0b01111111;
+    const length = Buffer.from(blockOfLengthValues.subarray(1, 1 + 1 + nrLengthOctets)).readUIntBE(0, nrLengthOctets);
+    return {
+        length,
+        firstByteOffset: 1 + nrLengthOctets,
+        lastByteOffset: 1 + nrLengthOctets + length,
+    };
+}
+/**
+ * Decode an ASN.1 sequence into its constituent parts, each part being an identifier-length-value triplet
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.9
+ *
+ * @param sequenceValue - The ASN.1 sequence value
+ * @returns Array of identifier-length-value triplets
+ */
+function decodeSequence(sequence) {
+    const { tag } = decodeIdentifier(sequence[0]);
+    if (tag !== Asn1Tag.Sequence) {
+        throw new error_js_1.Asn1DecodingError(`Expected a sequence to decode, but got tag ${tag}`);
+    }
+    const { firstByteOffset, lastByteOffset } = decodeLengthValue(sequence.subarray(1));
+    const sequenceValue = sequence.subarray(1 + firstByteOffset, 1 + 1 + lastByteOffset);
+    const parts = [];
+    let offset = 0;
+    while (offset < sequenceValue.length) {
+        // Silence false postive: accessing an octet in a Buffer at a particular index
+        // is to be done with index operator: [index]
+        // eslint-disable-next-line security/detect-object-injection
+        const identifier = decodeIdentifier(sequenceValue[offset]);
+        const next = decodeLengthValue(sequenceValue.subarray(offset + 1));
+        const value = sequenceValue.subarray(offset + 1 + next.firstByteOffset, offset + 1 + next.lastByteOffset);
+        parts.push({ identifier, length: next.length, value });
+        offset += 1 + next.lastByteOffset;
+    }
+    return parts;
+}
+/**
+ * Decode an ASN.1 sequence that is wrapped in a bit string
+ * (Which is the way RSA public keys are encoded in ASN.1 DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.6 and 8.9
+ *
+ * @param bitStringValue - The ASN.1 bit string value
+ * @returns Array of identifier-length-value triplets
+ */
+function decodeBitStringWrappedSequenceValue(bitStringValue) {
+    const wrappedSequence = bitStringValue.subarray(1);
+    return decodeSequence(wrappedSequence);
+}
+/**
+ * Decode an ASN.1 DER-encoded public key, into its modulus (n) and exponent (e)
+ *
+ * @param publicKey - The ASN.1 DER-encoded public key
+ * @returns Object with modulus (n) and exponent (e)
+ */
+function deconstructPublicKeyInDerFormat(publicKey) {
+    const [, pubkeyinfo] = decodeSequence(publicKey);
+    const [n, e] = decodeBitStringWrappedSequenceValue(pubkeyinfo.value);
+    return { n: n.value, e: e.value };
+}
+exports.deconstructPublicKeyInDerFormat = deconstructPublicKeyInDerFormat;

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/assert.js

@@ -0,0 +1,108 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utilities to assert that supplied values match with expected values
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertIsNotPromise = exports.assertStringArraysOverlap = exports.assertStringArrayContainsString = exports.assertStringEquals = void 0;
+const error_js_1 = require("./error.js");
+/**
+ * Assert value is a non-empty string and equal to the expected value,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check
+ * @param expected - The expected value
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ */
+function assertStringEquals(name, actual, expected, errorConstructor = error_js_1.FailedAssertionError) {
+    if (!actual) {
+        throw new errorConstructor(`Missing ${name}. Expected: ${expected}`, actual, expected);
+    }
+    if (typeof actual !== "string") {
+        throw new errorConstructor(`${name} is not of type string`, actual, expected);
+    }
+    if (expected !== actual) {
+        throw new errorConstructor(`${name} not allowed: ${actual}. Expected: ${expected}`, actual, expected);
+    }
+}
+exports.assertStringEquals = assertStringEquals;
+/**
+ * Assert value is a non-empty string and is indeed one of the expected values,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check
+ * @param expected - The array of expected values. For your convenience you can provide
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ * a string here as well, which will mean an array with just that string
+ */
+function assertStringArrayContainsString(name, actual, expected, errorConstructor = error_js_1.FailedAssertionError) {
+    if (!actual) {
+        throw new errorConstructor(`Missing ${name}. ${expectationMessage(expected)}`, actual, expected);
+    }
+    if (typeof actual !== "string") {
+        throw new errorConstructor(`${name} is not of type string`, actual, expected);
+    }
+    return assertStringArraysOverlap(name, actual, expected, errorConstructor);
+}
+exports.assertStringArrayContainsString = assertStringArrayContainsString;
+/**
+ * Assert value is an array of strings, where at least one of the strings is indeed one of the expected values,
+ * or throw an error otherwise
+ *
+ * @param name - Name for the value being checked
+ * @param actual - The value to check, must be an array of strings, or a single string (which will be treated
+ * as an array with just that string)
+ * @param expected - The array of expected values. For your convenience you can provide
+ * a string here as well, which will mean an array with just that string
+ * @param errorConstructor - Constructor for the concrete error to be thrown
+ */
+function assertStringArraysOverlap(name, actual, expected, errorConstructor = error_js_1.FailedAssertionError) {
+    if (!actual) {
+        throw new errorConstructor(`Missing ${name}. ${expectationMessage(expected)}`, actual, expected);
+    }
+    const expectedAsSet = new Set(Array.isArray(expected) ? expected : [expected]);
+    if (typeof actual === "string") {
+        actual = [actual];
+    }
+    if (!Array.isArray(actual)) {
+        throw new errorConstructor(`${name} is not an array`, actual, expected);
+    }
+    const overlaps = actual.some((actualItem) => {
+        if (typeof actualItem !== "string") {
+            throw new errorConstructor(`${name} includes elements that are not of type string`, actual, expected);
+        }
+        return expectedAsSet.has(actualItem);
+    });
+    if (!overlaps) {
+        throw new errorConstructor(`${name} not allowed: ${actual.join(", ")}. ${expectationMessage(expected)}`, actual, expected);
+    }
+}
+exports.assertStringArraysOverlap = assertStringArraysOverlap;
+/**
+ * Get a nicely readable message regarding an expectation
+ *
+ * @param expected - The expected value.
+ */
+function expectationMessage(expected) {
+    if (Array.isArray(expected)) {
+        if (expected.length > 1) {
+            return `Expected one of: ${expected.join(", ")}`;
+        }
+        return `Expected: ${expected[0]}`;
+    }
+    return `Expected: ${expected}`;
+}
+/**
+ * Assert value is not a promise, or throw an error otherwise
+ *
+ * @param actual - The value to check
+ * @param errorFactory - Function that returns the error to be thrown
+ */
+function assertIsNotPromise(actual, errorFactory) {
+    if (actual && typeof actual.then === "function") {
+        throw errorFactory();
+    }
+}
+exports.assertIsNotPromise = assertIsNotPromise;