@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/jwt.js

@@ -0,0 +1,161 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateJwtFields = exports.decomposeUnverifiedJwt = void 0;
+const assert_js_1 = require("./assert.js");
+const safe_json_parse_js_1 = require("./safe-json-parse.js");
+const error_js_1 = require("./error.js");
+const _node_web_compat_1 = require("#node-web-compat");
+/**
+ * Assert that the argument is a valid JWT header object.
+ * Throws an error in case it is not.
+ *
+ * @param header
+ * @returns void
+ */
+function assertJwtHeader(header) {
+    if (!(0, safe_json_parse_js_1.isJsonObject)(header)) {
+        throw new error_js_1.JwtParseError("JWT header is not an object");
+    }
+    if (header.alg !== undefined && typeof header.alg !== "string") {
+        throw new error_js_1.JwtParseError("JWT header alg claim is not a string");
+    }
+    if (header.kid !== undefined && typeof header.kid !== "string") {
+        throw new error_js_1.JwtParseError("JWT header kid claim is not a string");
+    }
+}
+/**
+ * Assert that the argument is a valid JWT payload object.
+ * Throws an error in case it is not.
+ *
+ * @param payload
+ * @returns void
+ */
+function assertJwtPayload(payload) {
+    if (!(0, safe_json_parse_js_1.isJsonObject)(payload)) {
+        throw new error_js_1.JwtParseError("JWT payload is not an object");
+    }
+    if (payload.exp !== undefined && !Number.isFinite(payload.exp)) {
+        throw new error_js_1.JwtParseError("JWT payload exp claim is not a number");
+    }
+    if (payload.iss !== undefined && typeof payload.iss !== "string") {
+        throw new error_js_1.JwtParseError("JWT payload iss claim is not a string");
+    }
+    if (payload.sub !== undefined && typeof payload.sub !== "string") {
+        throw new error_js_1.JwtParseError("JWT payload sub claim is not a string");
+    }
+    if (payload.aud !== undefined &&
+        typeof payload.aud !== "string" &&
+        (!Array.isArray(payload.aud) ||
+            payload.aud.some((aud) => typeof aud !== "string"))) {
+        throw new error_js_1.JwtParseError("JWT payload aud claim is not a string or array of strings");
+    }
+    if (payload.nbf !== undefined && !Number.isFinite(payload.nbf)) {
+        throw new error_js_1.JwtParseError("JWT payload nbf claim is not a number");
+    }
+    if (payload.iat !== undefined && !Number.isFinite(payload.iat)) {
+        throw new error_js_1.JwtParseError("JWT payload iat claim is not a number");
+    }
+    if (payload.scope !== undefined && typeof payload.scope !== "string") {
+        throw new error_js_1.JwtParseError("JWT payload scope claim is not a string");
+    }
+    if (payload.jti !== undefined && typeof payload.jti !== "string") {
+        throw new error_js_1.JwtParseError("JWT payload jti claim is not a string");
+    }
+}
+/**
+ * Sanity check, decompose and JSON parse a JWT string into its constituent, and yet unverified, parts:
+ * - header object
+ * - payload object
+ * - signature string
+ *
+ * This function does NOT verify a JWT, do not trust the returned payload and header!
+ *
+ * For most use cases, you would not want to call this function directly yourself, rather you
+ * would call verify() with the JWT, which would call this function (and others) for you.
+ *
+ * @param jwt The JWT (as string)
+ * @returns the decomposed, and yet unverified, JWT
+ */
+function decomposeUnverifiedJwt(jwt) {
+    // Sanity checks on JWT
+    if (!jwt) {
+        throw new error_js_1.JwtParseError("Empty JWT");
+    }
+    if (typeof jwt !== "string") {
+        throw new error_js_1.JwtParseError("JWT is not a string");
+    }
+    if (!jwt.match(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)) {
+        throw new error_js_1.JwtParseError("JWT string does not consist of exactly 3 parts (header, payload, signature)");
+    }
+    const [headerB64, payloadB64, signatureB64] = jwt.split(".");
+    // B64 decode header and payload
+    const [headerString, payloadString] = [headerB64, payloadB64].map(_node_web_compat_1.nodeWebCompat.parseB64UrlString);
+    // Parse header
+    let header;
+    try {
+        header = (0, safe_json_parse_js_1.safeJsonParse)(headerString);
+    }
+    catch (err) {
+        throw new error_js_1.JwtParseError("Invalid JWT. Header is not a valid JSON object", err);
+    }
+    assertJwtHeader(header);
+    // parse payload
+    let payload;
+    try {
+        payload = (0, safe_json_parse_js_1.safeJsonParse)(payloadString);
+    }
+    catch (err) {
+        throw new error_js_1.JwtParseError("Invalid JWT. Payload is not a valid JSON object", err);
+    }
+    assertJwtPayload(payload);
+    return {
+        header,
+        headerB64,
+        payload,
+        payloadB64,
+        signatureB64,
+    };
+}
+exports.decomposeUnverifiedJwt = decomposeUnverifiedJwt;
+/**
+ * Validate JWT payload fields. Throws an error in case there's any validation issue.
+ *
+ * @param payload The (JSON parsed) JWT payload
+ * @param options The options to use during validation
+ * @returns void
+ */
+function validateJwtFields(payload, options) {
+    // Check expiry
+    if (payload.exp !== undefined) {
+        if (payload.exp + (options.graceSeconds ?? 0) < Date.now() / 1000) {
+            throw new error_js_1.JwtExpiredError(`Token expired at ${new Date(payload.exp * 1000).toISOString()}`, payload.exp);
+        }
+    }
+    // Check not before
+    if (payload.nbf !== undefined) {
+        if (payload.nbf - (options.graceSeconds ?? 0) > Date.now() / 1000) {
+            throw new error_js_1.JwtNotBeforeError(`Token can't be used before ${new Date(payload.nbf * 1000).toISOString()}`, payload.nbf);
+        }
+    }
+    // Check JWT issuer
+    if (options.issuer !== null) {
+        if (options.issuer === undefined) {
+            throw new error_js_1.ParameterValidationError("issuer must be provided or set to null explicitly");
+        }
+        (0, assert_js_1.assertStringArrayContainsString)("Issuer", payload.iss, options.issuer, error_js_1.JwtInvalidIssuerError);
+    }
+    // Check audience
+    if (options.audience !== null) {
+        if (options.audience === undefined) {
+            throw new error_js_1.ParameterValidationError("audience must be provided or set to null explicitly");
+        }
+        (0, assert_js_1.assertStringArraysOverlap)("Audience", payload.aud, options.audience, error_js_1.JwtInvalidAudienceError);
+    }
+    // Check scope
+    if (options.scope != null) {
+        (0, assert_js_1.assertStringArraysOverlap)("Scope", payload.scope?.split(" "), options.scope, error_js_1.JwtInvalidScopeError);
+    }
+}
+exports.validateJwtFields = validateJwtFields;

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/node-web-compat-node.js

@@ -0,0 +1,48 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Node.js implementations for the node-web-compatibility layer
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeWebCompat = void 0;
+const crypto_1 = require("crypto");
+const asn1_js_1 = require("./asn1.js");
+const https_node_js_1 = require("./https-node.js");
+/**
+ * Enum to map supported JWT signature algorithms with OpenSSL message digest algorithm names
+ */
+var JwtSignatureAlgorithms;
+(function (JwtSignatureAlgorithms) {
+    JwtSignatureAlgorithms["RS256"] = "RSA-SHA256";
+    JwtSignatureAlgorithms["RS384"] = "RSA-SHA384";
+    JwtSignatureAlgorithms["RS512"] = "RSA-SHA512";
+})(JwtSignatureAlgorithms || (JwtSignatureAlgorithms = {}));
+exports.nodeWebCompat = {
+    fetchJson: https_node_js_1.fetchJson,
+    transformJwkToKeyObjectSync: (jwk) => (0, crypto_1.createPublicKey)({
+        key: (0, asn1_js_1.constructPublicKeyInDerFormat)(Buffer.from(jwk.n, "base64"), Buffer.from(jwk.e, "base64")),
+        format: "der",
+        type: "spki",
+    }),
+    transformJwkToKeyObjectAsync: async (jwk) => (0, crypto_1.createPublicKey)({
+        key: (0, asn1_js_1.constructPublicKeyInDerFormat)(Buffer.from(jwk.n, "base64"), Buffer.from(jwk.e, "base64")),
+        format: "der",
+        type: "spki",
+    }),
+    parseB64UrlString: (b64) => Buffer.from(b64, "base64").toString("utf8"),
+    verifySignatureSync: ({ alg, keyObject, jwsSigningInput, signature }) => 
+    // eslint-disable-next-line security/detect-object-injection
+    (0, crypto_1.createVerify)(JwtSignatureAlgorithms[alg])
+        .update(jwsSigningInput)
+        .verify(keyObject, signature, "base64"),
+    verifySignatureAsync: async ({ alg, keyObject, jwsSigningInput, signature, }) => 
+    // eslint-disable-next-line security/detect-object-injection
+    (0, crypto_1.createVerify)(JwtSignatureAlgorithms[alg])
+        .update(jwsSigningInput)
+        .verify(keyObject, signature, "base64"),
+    defaultFetchTimeouts: {
+        socketIdle: 500,
+        response: 1500,
+    },
+    setTimeoutUnref: (...args) => setTimeout(...args).unref(),
+};

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/node-web-compat-web.js

@@ -0,0 +1,78 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Web implementations for the node-web-compatibility layer
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeWebCompat = void 0;
+const error_js_1 = require("./error.js");
+const https_common_js_1 = require("./https-common.js");
+const safe_json_parse_js_1 = require("./safe-json-parse.js");
+/**
+ * Enum to map supported JWT signature algorithms with WebCrypto message digest algorithm names
+ */
+var JwtSignatureAlgorithmsWebCrypto;
+(function (JwtSignatureAlgorithmsWebCrypto) {
+    JwtSignatureAlgorithmsWebCrypto["RS256"] = "SHA-256";
+    JwtSignatureAlgorithmsWebCrypto["RS384"] = "SHA-384";
+    JwtSignatureAlgorithmsWebCrypto["RS512"] = "SHA-512";
+})(JwtSignatureAlgorithmsWebCrypto || (JwtSignatureAlgorithmsWebCrypto = {}));
+exports.nodeWebCompat = {
+    fetchJson: async (uri, requestOptions, data) => {
+        const responseTimeout = Number(requestOptions?.["responseTimeout"]);
+        if (responseTimeout) {
+            const abort = new AbortController();
+            setTimeout(() => 
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            abort.abort(new error_js_1.FetchError(uri, `Response time-out (after ${responseTimeout} ms.)`)), responseTimeout);
+            requestOptions = { signal: abort.signal, ...requestOptions };
+        }
+        const response = await fetch(uri, { ...requestOptions, body: data });
+        (0, https_common_js_1.validateHttpsJsonResponse)(uri, response.status, response.headers.get("content-type") ?? undefined);
+        return response.text().then((text) => (0, safe_json_parse_js_1.safeJsonParse)(text));
+    },
+    defaultFetchTimeouts: {
+        response: 3000,
+    },
+    transformJwkToKeyObjectSync: () => {
+        throw new error_js_1.NotSupportedError("Synchronously transforming a JWK into a key object is not supported in the browser");
+    },
+    transformJwkToKeyObjectAsync: (jwk, jwtHeaderAlg) => {
+        const alg = jwk.alg ?? jwtHeaderAlg;
+        if (!alg) {
+            throw new error_js_1.JwtInvalidSignatureAlgorithmError("Missing alg on both JWK and JWT header", alg);
+        }
+        return crypto.subtle.importKey("jwk", jwk, {
+            name: "RSASSA-PKCS1-v1_5",
+            // eslint-disable-next-line security/detect-object-injection
+            hash: JwtSignatureAlgorithmsWebCrypto[alg],
+        }, false, ["verify"]);
+    },
+    verifySignatureSync: () => {
+        throw new error_js_1.NotSupportedError("Synchronously verifying a JWT signature is not supported in the browser");
+    },
+    verifySignatureAsync: ({ jwsSigningInput, keyObject, signature }) => crypto.subtle.verify({
+        name: "RSASSA-PKCS1-v1_5",
+    }, keyObject, bufferFromBase64url(signature), new TextEncoder().encode(jwsSigningInput)),
+    parseB64UrlString: (b64) => new TextDecoder().decode(bufferFromBase64url(b64)),
+    setTimeoutUnref: setTimeout.bind(undefined),
+};
+const bufferFromBase64url = (function () {
+    const map = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+        .split("")
+        .reduce((acc, char, index) => Object.assign(acc, { [char.charCodeAt(0)]: index }), {});
+    return function (base64url) {
+        const paddingLength = base64url.match(/^.+?(=?=?)$/)[1].length;
+        let first, second, third, fourth;
+        return base64url.match(/.{1,4}/g).reduce((acc, chunk, index) => {
+            first = map[chunk.charCodeAt(0)];
+            second = map[chunk.charCodeAt(1)];
+            third = map[chunk.charCodeAt(2)];
+            fourth = map[chunk.charCodeAt(3)];
+            acc[3 * index] = (first << 2) | (second >> 4);
+            acc[3 * index + 1] = ((second & 0b1111) << 4) | (third >> 2);
+            acc[3 * index + 2] = ((third & 0b11) << 6) | fourth;
+            return acc;
+        }, new Uint8Array((base64url.length * 3) / 4 - paddingLength));
+    };
+})();

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/node-web-compat.js

@@ -0,0 +1,11 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// To make this library work in both Node.js and Web, some functions require specific code,
+// e.g. in Node.js we can use the "crypto" module, whereas in Web we need to use SubtleCrypto.
+// This file contains an interface that the specific Node.js and Web implementations must implement.
+//
+// At runtime, either the Node.js or Web implementation is actually loaded. This works because the
+// package.json specifies "#node-web-compat" as a subpath import, with conditions pointing to the right implementation (for Node.js or Web)
+Object.defineProperty(exports, "__esModule", { value: true });

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/package.json

@@ -0,0 +1 @@
+{"name":"aws-jwt-verify","version":"4.0.1","type":"commonjs","imports":{"#node-web-compat":{"browser":"./node-web-compat-web.js","default":"./node-web-compat-node.js"}}}

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/safe-json-parse.js

@@ -0,0 +1,34 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utility to parse JSON safely
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeJsonParse = exports.isJsonObject = void 0;
+/**
+ * Check if a piece of JSON is a JSON object, and not e.g. a mere string or null
+ *
+ * @param j - the JSON
+ */
+function isJsonObject(j) {
+    // It is not enough to check that `typeof j === "object"`
+    // because in JS `typeof null` is also "object", and so is `typeof []`.
+    // So we need to check that j is an object, and not null, and not an array
+    return typeof j === "object" && !Array.isArray(j) && j !== null;
+}
+exports.isJsonObject = isJsonObject;
+/**
+ * Parse a string as JSON, while removing __proto__ and constructor, so JS prototype pollution is prevented
+ *
+ * @param s - the string to JSON parse
+ */
+function safeJsonParse(s) {
+    return JSON.parse(s, (_, value) => {
+        if (typeof value === "object" && !Array.isArray(value) && value !== null) {
+            delete value.__proto__;
+            delete value.constructor;
+        }
+        return value;
+    });
+}
+exports.safeJsonParse = safeJsonParse;

package/assets/api/vendor_modules/aws-jwt-verify/dist/cjs/typing-util.js

@@ -0,0 +1,6 @@
+"use strict";
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utilities for creating special TypeScript types
+Object.defineProperty(exports, "__esModule", { value: true });

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/asn1.js

@@ -0,0 +1,296 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utility to encode RSA public keys (a pair of modulus (n) and exponent (e)) into DER-encoding, per ASN.1 specification.
+import { Asn1DecodingError } from "./error.js";
+/** Enum with possible values for supported ASN.1 classes */
+var Asn1Class;
+(function (Asn1Class) {
+    Asn1Class[Asn1Class["Universal"] = 0] = "Universal";
+})(Asn1Class || (Asn1Class = {}));
+/** Enum with possible values for supported ASN.1 encodings */
+var Asn1Encoding;
+(function (Asn1Encoding) {
+    Asn1Encoding[Asn1Encoding["Primitive"] = 0] = "Primitive";
+    Asn1Encoding[Asn1Encoding["Constructed"] = 1] = "Constructed";
+})(Asn1Encoding || (Asn1Encoding = {}));
+/** Enum with possible values for supported ASN.1 tags */
+var Asn1Tag;
+(function (Asn1Tag) {
+    Asn1Tag[Asn1Tag["BitString"] = 3] = "BitString";
+    Asn1Tag[Asn1Tag["ObjectIdentifier"] = 6] = "ObjectIdentifier";
+    Asn1Tag[Asn1Tag["Sequence"] = 16] = "Sequence";
+    Asn1Tag[Asn1Tag["Null"] = 5] = "Null";
+    Asn1Tag[Asn1Tag["Integer"] = 2] = "Integer";
+})(Asn1Tag || (Asn1Tag = {}));
+/**
+ * Encode an ASN.1 identifier per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.1.2
+ *
+ * @param identifier - The ASN.1 identifier
+ * @returns The buffer
+ */
+function encodeIdentifier(identifier) {
+    const identifierAsNumber = (identifier.class << 7) |
+        (identifier.primitiveOrConstructed << 5) |
+        identifier.tag;
+    return Buffer.from([identifierAsNumber]);
+}
+/**
+ * Encode the length of an ASN.1 type per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.1.3
+ *
+ * @param length - The length of the ASN.1 type
+ * @returns The buffer
+ */
+function encodeLength(length) {
+    if (length < 128) {
+        return Buffer.from([length]);
+    }
+    const integers = [];
+    while (length > 0) {
+        integers.push(length % 256);
+        length = length >> 8;
+    }
+    integers.reverse();
+    return Buffer.from([128 | integers.length, ...integers]);
+}
+/**
+ * Encode a buffer (that represents a positive integer) as integer per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.3
+ *
+ * @param buffer - The buffer that represents a positive integer
+ * @returns The buffer
+ */
+function encodeBufferAsPositiveInteger(buffer) {
+    if (buffer[0] >> 7) {
+        // MSB is 1, add leading zero to indicate positive number
+        buffer = Buffer.concat([Buffer.from([0]), buffer]);
+    }
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Primitive,
+            tag: Asn1Tag.Integer,
+        }),
+        encodeLength(buffer.length),
+        buffer,
+    ]);
+}
+/**
+ * Encode an object identifier (a string such as "1.2.840.113549.1.1.1") per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.19
+ *
+ * @param oid - The object identifier to encode
+ * @returns The buffer
+ */
+function encodeObjectIdentifier(oid) {
+    const oidComponents = oid.split(".").map((i) => parseInt(i));
+    const firstSubidentifier = oidComponents[0] * 40 + oidComponents[1];
+    const subsequentSubidentifiers = oidComponents
+        .slice(2)
+        .reduce((expanded, component) => {
+        const bytes = [];
+        do {
+            bytes.push(component % 128);
+            component = component >> 7;
+        } while (component);
+        return expanded.concat(bytes.map((b, index) => (index ? b + 128 : b)).reverse());
+    }, []);
+    const oidBuffer = Buffer.from([
+        firstSubidentifier,
+        ...subsequentSubidentifiers,
+    ]);
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Primitive,
+            tag: Asn1Tag.ObjectIdentifier,
+        }),
+        encodeLength(oidBuffer.length),
+        oidBuffer,
+    ]);
+}
+/**
+ * Encode a buffer as bit string per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.6
+ *
+ * @param buffer - The buffer to encode
+ * @returns The buffer
+ */
+function encodeBufferAsBitString(buffer) {
+    const bitString = Buffer.concat([Buffer.from([0]), buffer]);
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Primitive,
+            tag: Asn1Tag.BitString,
+        }),
+        encodeLength(bitString.length),
+        bitString,
+    ]);
+}
+/**
+ * Encode a sequence of DER-encoded items per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.9
+ *
+ * @param sequenceItems - The sequence of DER-encoded items
+ * @returns The buffer
+ */
+function encodeSequence(sequenceItems) {
+    const concatenated = Buffer.concat(sequenceItems);
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Constructed,
+            tag: Asn1Tag.Sequence,
+        }),
+        encodeLength(concatenated.length),
+        concatenated,
+    ]);
+}
+/**
+ * Encode null per ASN.1 spec (DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.8
+ *
+ * @returns The buffer
+ */
+function encodeNull() {
+    return Buffer.concat([
+        encodeIdentifier({
+            class: Asn1Class.Universal,
+            primitiveOrConstructed: Asn1Encoding.Primitive,
+            tag: Asn1Tag.Null,
+        }),
+        encodeLength(0),
+    ]);
+}
+/**
+ * RSA encryption object identifier constant
+ *
+ * From: https://tools.ietf.org/html/rfc8017
+ *
+ * pkcs-1    OBJECT IDENTIFIER ::= {
+ *     iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) 1
+ * }
+ *
+ * -- When rsaEncryption is used in an AlgorithmIdentifier,
+ * -- the parameters MUST be present and MUST be NULL.
+ * --
+ * rsaEncryption    OBJECT IDENTIFIER ::= { pkcs-1 1 }
+ *
+ * See also: http://www.oid-info.com/get/1.2.840.113549.1.1.1
+ */
+const ALGORITHM_RSA_ENCRYPTION = encodeSequence([
+    encodeObjectIdentifier("1.2.840.113549.1.1.1"),
+    encodeNull(), // parameters
+]);
+/**
+ * Transform an RSA public key, which is a pair of modulus (n) and exponent (e),
+ *  into a buffer per ASN.1 spec (DER-encoding)
+ *
+ * @param n - The modulus of the public key as buffer
+ * @param e - The exponent of the public key as buffer
+ * @returns The buffer, which is the public key encoded per ASN.1 spec (DER-encoding)
+ */
+export function constructPublicKeyInDerFormat(n, e) {
+    return encodeSequence([
+        ALGORITHM_RSA_ENCRYPTION,
+        encodeBufferAsBitString(encodeSequence([
+            encodeBufferAsPositiveInteger(n),
+            encodeBufferAsPositiveInteger(e),
+        ])),
+    ]);
+}
+/**
+ * Decode an ASN.1 identifier (a number) into its parts: class, primitiveOrConstructed, tag
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.1.2
+ *
+ * @param identifier - The identifier
+ * @returns An object with properties class, primitiveOrConstructed, tag
+ */
+function decodeIdentifier(identifier) {
+    if (identifier >> 3 === 0b11111) {
+        throw new Asn1DecodingError("Decoding of identifier with tag > 30 not implemented");
+    }
+    return {
+        class: identifier >> 6,
+        primitiveOrConstructed: (identifier >> 5) & 0b001,
+        tag: identifier & 0b11111, // bit 1-5
+    };
+}
+/**
+ * Decode an ASN.1 block of length value combinations,
+ * and return the length and byte range of the first length value combination.
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.1.3 - 8.1.5
+ *
+ * @param blockOfLengthValues - The ASN.1 length value
+ * @returns The length and byte range of the first included length value
+ */
+function decodeLengthValue(blockOfLengthValues) {
+    if (!(blockOfLengthValues[0] & 0b10000000)) {
+        return {
+            length: blockOfLengthValues[0],
+            firstByteOffset: 1,
+            lastByteOffset: 1 + blockOfLengthValues[0],
+        };
+    }
+    const nrLengthOctets = blockOfLengthValues[0] & 0b01111111;
+    const length = Buffer.from(blockOfLengthValues.subarray(1, 1 + 1 + nrLengthOctets)).readUIntBE(0, nrLengthOctets);
+    return {
+        length,
+        firstByteOffset: 1 + nrLengthOctets,
+        lastByteOffset: 1 + nrLengthOctets + length,
+    };
+}
+/**
+ * Decode an ASN.1 sequence into its constituent parts, each part being an identifier-length-value triplet
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.9
+ *
+ * @param sequenceValue - The ASN.1 sequence value
+ * @returns Array of identifier-length-value triplets
+ */
+function decodeSequence(sequence) {
+    const { tag } = decodeIdentifier(sequence[0]);
+    if (tag !== Asn1Tag.Sequence) {
+        throw new Asn1DecodingError(`Expected a sequence to decode, but got tag ${tag}`);
+    }
+    const { firstByteOffset, lastByteOffset } = decodeLengthValue(sequence.subarray(1));
+    const sequenceValue = sequence.subarray(1 + firstByteOffset, 1 + 1 + lastByteOffset);
+    const parts = [];
+    let offset = 0;
+    while (offset < sequenceValue.length) {
+        // Silence false postive: accessing an octet in a Buffer at a particular index
+        // is to be done with index operator: [index]
+        // eslint-disable-next-line security/detect-object-injection
+        const identifier = decodeIdentifier(sequenceValue[offset]);
+        const next = decodeLengthValue(sequenceValue.subarray(offset + 1));
+        const value = sequenceValue.subarray(offset + 1 + next.firstByteOffset, offset + 1 + next.lastByteOffset);
+        parts.push({ identifier, length: next.length, value });
+        offset += 1 + next.lastByteOffset;
+    }
+    return parts;
+}
+/**
+ * Decode an ASN.1 sequence that is wrapped in a bit string
+ * (Which is the way RSA public keys are encoded in ASN.1 DER-encoding)
+ * See https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf chapter 8.6 and 8.9
+ *
+ * @param bitStringValue - The ASN.1 bit string value
+ * @returns Array of identifier-length-value triplets
+ */
+function decodeBitStringWrappedSequenceValue(bitStringValue) {
+    const wrappedSequence = bitStringValue.subarray(1);
+    return decodeSequence(wrappedSequence);
+}
+/**
+ * Decode an ASN.1 DER-encoded public key, into its modulus (n) and exponent (e)
+ *
+ * @param publicKey - The ASN.1 DER-encoded public key
+ * @returns Object with modulus (n) and exponent (e)
+ */
+export function deconstructPublicKeyInDerFormat(publicKey) {
+    const [, pubkeyinfo] = decodeSequence(publicKey);
+    const [n, e] = decodeBitStringWrappedSequenceValue(pubkeyinfo.value);
+    return { n: n.value, e: e.value };
+}