@iwentsourcing/core 0.1.0

package/dist/authentication/jwk/jwk-key.d.ts

@@ -0,0 +1,71 @@
+import { TypeOf } from '../../typing/type-of.js';
+export declare const JwkEcKey: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    kty: "EC";
+    use: "sig" | "enc";
+    kid: string;
+    x5t: string | undefined;
+    alg: "ES256" | "ES384" | "ES512" | undefined;
+    crv: "P-256" | "P-384" | "P-521";
+    x: string;
+    y: string;
+    d: string | undefined;
+}>;
+export type JwkEcKey = TypeOf<typeof JwkEcKey>;
+export declare const JwkHmacKey: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    kty: "oct";
+    use: "sig" | "enc";
+    kid: string;
+    x5t: string | undefined;
+    alg: "HS256" | "HS384" | "HS512" | undefined;
+    k: string;
+}>;
+export type JwkHmacKey = TypeOf<typeof JwkHmacKey>;
+export declare const JwkRsaKey: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    kty: "RSA";
+    use: "sig" | "enc";
+    kid: string;
+    x5t: string | undefined;
+    alg: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "RSA-OAEP" | "RSA-OAEP-256" | undefined;
+    d: string | undefined;
+    n: string;
+    e: string;
+    p: string | undefined;
+    q: string | undefined;
+    dp: string | undefined;
+    dq: string | undefined;
+    qi: string | undefined;
+}>;
+export type JwkRsaKey = TypeOf<typeof JwkRsaKey>;
+export declare const JwkKey: import("../../typing/union-type-description.js").UnionTypeDescription<{
+    kty: "EC";
+    use: "sig" | "enc";
+    kid: string;
+    x5t: string | undefined;
+    alg: "ES256" | "ES384" | "ES512" | undefined;
+    crv: "P-256" | "P-384" | "P-521";
+    x: string;
+    y: string;
+    d: string | undefined;
+} | {
+    kty: "oct";
+    use: "sig" | "enc";
+    kid: string;
+    x5t: string | undefined;
+    alg: "HS256" | "HS384" | "HS512" | undefined;
+    k: string;
+} | {
+    kty: "RSA";
+    use: "sig" | "enc";
+    kid: string;
+    x5t: string | undefined;
+    alg: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "RSA-OAEP" | "RSA-OAEP-256" | undefined;
+    d: string | undefined;
+    n: string;
+    e: string;
+    p: string | undefined;
+    q: string | undefined;
+    dp: string | undefined;
+    dq: string | undefined;
+    qi: string | undefined;
+}>;
+export type JwkKey = TypeOf<typeof JwkKey>;

package/dist/authentication/jwk/jwk-key.js

@@ -0,0 +1,86 @@
+import { literal } from '../../typing/literal.js';
+import { object } from '../../typing/object.js';
+import { union } from '../../typing/union.js';
+import { string } from '../../typing/string.js';
+import { optional } from '../../typing/optional.js';
+export const JwkEcKey = object('JwkEcKey', {
+    kty: literal('EC'),
+    use: union('JwkKeyUse', [literal('sig'), literal('enc')]),
+    kid: string(),
+    // key_ops: optional(
+    //   union('JwkKeyOps', [
+    //     literal('sign'),
+    //     literal('verify'),
+    //     literal('encrypt'),
+    //     literal('decrypt'),
+    //     literal('decrypt'),
+    //   ]),
+    // ),
+    x5t: optional(string()),
+    // x5u: optional(string()),
+    // x5c: optional(string()),
+    // alg: optional(string()),
+    alg: optional(union('RSAAlg', [literal('ES256'), literal('ES384'), literal('ES512')])),
+    crv: union('ECCurve', [literal('P-256'), literal('P-384'), literal('P-521')]),
+    x: string(),
+    y: string(),
+    d: optional(string()),
+});
+export const JwkHmacKey = object('JwkHmacKey', {
+    kty: literal('oct'),
+    use: union('JwkKeyUse', [literal('sig'), literal('enc')]),
+    kid: string(),
+    alg: optional(union('HmacAlg', [literal('HS256'), literal('HS384'), literal('HS512')])),
+    // key_ops: optional(
+    //   union('JwkKeyOps', [
+    //     literal('sign'),
+    //     literal('verify'),
+    //     literal('encrypt'),
+    //     literal('decrypt'),
+    //     literal('decrypt'),
+    //   ]),
+    // ),
+    x5t: optional(string()),
+    // x5u: optional(string()),
+    // x5c: optional(string()),
+    // alg: optional(string()),
+    k: string(),
+});
+export const JwkRsaKey = object('JwkRsaKey', {
+    kty: literal('RSA'),
+    use: union('JwkKeyUse', [literal('sig'), literal('enc')]),
+    kid: string(),
+    n: string(),
+    e: string(),
+    alg: optional(union('RSAAlg', [
+        literal('RS256'),
+        literal('RS384'),
+        literal('RS512'),
+        literal('PS256'),
+        literal('PS384'),
+        literal('PS512'),
+        literal('RSA-OAEP'),
+        literal('RSA-OAEP-256'),
+    ])),
+    // key_ops: optional(
+    //   union('JwkKeyOps', [
+    //     literal('sign'),
+    //     literal('verify'),
+    //     literal('encrypt'),
+    //     literal('decrypt'),
+    //     literal('decrypt'),
+    //   ]),
+    // ),
+    x5t: optional(string()),
+    // x5u: optional(string()),
+    // x5c: optional(string()),
+    // alg: optional(string()),
+    d: optional(string()),
+    p: optional(string()),
+    q: optional(string()),
+    dp: optional(string()),
+    dq: optional(string()),
+    qi: optional(string()),
+});
+export const JwkKey = union('JwkKey', [JwkEcKey, JwkRsaKey, JwkHmacKey]);
+//# sourceMappingURL=jwk-key.js.map

package/dist/authentication/jwk/jwk-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk-key.js","sourceRoot":"","sources":["../../../src/authentication/jwk/jwk-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAGpD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE;IACzC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC;IAElB,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,GAAG,EAAE,MAAM,EAAE;IAEb,qBAAqB;IACrB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,QAAQ;IACR,KAAK;IACL,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAE3B,GAAG,EAAE,QAAQ,CACX,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CACxE;IAED,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC,EAAE,MAAM,EAAE;IACX,CAAC,EAAE,MAAM,EAAE;IACX,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,EAAE;IAC7C,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;IAEnB,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,GAAG,EAAE,MAAM,EAAE;IAEb,GAAG,EAAE,QAAQ,CACX,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CACzE;IACD,qBAAqB;IACrB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,QAAQ;IACR,KAAK;IACL,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAE3B,CAAC,EAAE,MAAM,EAAE;CACZ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE;IAC3C,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC;IAEnB,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,GAAG,EAAE,MAAM,EAAE;IACb,CAAC,EAAE,MAAM,EAAE;IACX,CAAC,EAAE,MAAM,EAAE;IAEX,GAAG,EAAE,QAAQ,CACX,KAAK,CAAC,QAAQ,EAAE;QACd,OAAO,CAAC,OAAO,CAAC;QAChB,OAAO,CAAC,OAAO,CAAC;QAChB,OAAO,CAAC,OAAO,CAAC;QAChB,OAAO,CAAC,OAAO,CAAC;QAChB,OAAO,CAAC,OAAO,CAAC;QAChB,OAAO,CAAC,OAAO,CAAC;QAChB,OAAO,CAAC,UAAU,CAAC;QACnB,OAAO,CAAC,cAAc,CAAC;KACxB,CAAC,CACH;IACD,qBAAqB;IACrB,yBAAyB;IACzB,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,QAAQ;IACR,KAAK;IACL,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAE3B,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrB,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACtB,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACtB,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC"}

package/dist/authentication/jwk/jwk-response.d.ts

@@ -0,0 +1,34 @@
+export declare const JwkResponse: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    keys: ({
+        kty: "EC";
+        use: "sig" | "enc";
+        kid: string;
+        x5t: string | undefined;
+        alg: "ES256" | "ES384" | "ES512" | undefined;
+        crv: "P-256" | "P-384" | "P-521";
+        x: string;
+        y: string;
+        d: string | undefined;
+    } | {
+        kty: "oct";
+        use: "sig" | "enc";
+        kid: string;
+        x5t: string | undefined;
+        alg: "HS256" | "HS384" | "HS512" | undefined;
+        k: string;
+    } | {
+        kty: "RSA";
+        use: "sig" | "enc";
+        kid: string;
+        x5t: string | undefined;
+        alg: "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "RSA-OAEP" | "RSA-OAEP-256" | undefined;
+        d: string | undefined;
+        n: string;
+        e: string;
+        p: string | undefined;
+        q: string | undefined;
+        dp: string | undefined;
+        dq: string | undefined;
+        qi: string | undefined;
+    })[];
+}>;

package/dist/authentication/jwk/jwk-response.js

@@ -0,0 +1,7 @@
+import { JwkKey } from './jwk-key.js';
+import { object } from '../../typing/object.js';
+import { array } from '../../typing/array.js';
+export const JwkResponse = object('JwkResponse', {
+    keys: array(JwkKey),
+});
+//# sourceMappingURL=jwk-response.js.map

package/dist/authentication/jwk/jwk-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk-response.js","sourceRoot":"","sources":["../../../src/authentication/jwk/jwk-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE;IAC/C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;CACpB,CAAC,CAAC"}

package/dist/authentication/jwk/jwk-store.d.ts

@@ -0,0 +1,4 @@
+import { JwkKey } from './jwk-key.js';
+export interface JwkStore {
+    get(kid: string, signal: AbortSignal): Promise<JwkKey>;
+}

package/dist/authentication/jwk/jwk-store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwk-store.js.map

package/dist/authentication/jwk/jwk-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk-store.js","sourceRoot":"","sources":["../../../src/authentication/jwk/jwk-store.ts"],"names":[],"mappings":""}

package/dist/authentication/jwk/jwk-verify.d.ts

@@ -0,0 +1,7 @@
+import { JwkKey } from './jwk-key.js';
+import { RuntimeEnv } from '../../environment/runtime-env.js';
+export declare function verifyJwkSignature(env: RuntimeEnv, jwt: {
+    signature: string;
+    payload: string;
+    header: string;
+}, key: JwkKey): Promise<boolean>;

package/dist/authentication/jwk/jwk-verify.js

@@ -0,0 +1,15 @@
+import { getJwkKeyAlgorithm, getJwkVerifyKey, } from './get-jwk-key-algorithm.js';
+import { base64ToUint8Array, stringToUint8Array } from './base64.js';
+export async function verifyJwkSignature(env, jwt, key) {
+    const alg = getJwkKeyAlgorithm(key);
+    const jsonWebKey = getJwkVerifyKey(key);
+    const cryptoKey = await env
+        .crypto()
+        .subtle.importKey('jwk', jsonWebKey, alg, false, ['verify']);
+    const messageAsUint8Array = base64ToUint8Array(jwt.signature);
+    const valid = await env
+        .crypto()
+        .subtle.verify(alg, cryptoKey, messageAsUint8Array, stringToUint8Array(`${jwt.header}.${jwt.payload}`));
+    return valid;
+}
+//# sourceMappingURL=jwk-verify.js.map

package/dist/authentication/jwk/jwk-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk-verify.js","sourceRoot":"","sources":["../../../src/authentication/jwk/jwk-verify.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGrE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAe,EACf,GAA2D,EAC3D,GAAW;IAEX,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,GAAG;SACxB,MAAM,EAAE;SACR,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/D,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAG,MAAM,GAAG;SACpB,MAAM,EAAE;SACR,MAAM,CAAC,MAAM,CACZ,GAAG,EACH,SAAS,EACT,mBAAmB,EACnB,kBAAkB,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CACnD,CAAC;IAEJ,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/authentication/jwk/jwk-verify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/authentication/jwk/jwk-verify.test.js

@@ -0,0 +1,145 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import { verifyJwkSignature } from './jwk-verify.js';
+import { createNodeEnv } from '../../node/create-node-env.js';
+describe('jwk-verify', () => {
+    const env = createNodeEnv();
+    const es256 = {
+        key: {
+            kty: 'EC',
+            kid: '1',
+            use: 'sig',
+            crv: 'P-256',
+            alg: undefined,
+            x: 'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU',
+            y: 'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0',
+            d: 'jpsQnnGQmL-YBIffH1136cspYG6-0iY7X1fCE9-E9LI',
+            x5t: undefined,
+        },
+        expectedHeader: 'eyJhbGciOiJFUzI1NiJ9',
+        expectedPayload: 'eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ',
+        expectedSignature: 'DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8ISlSApmWQxfKTUJqPP3-Kg6NU1Q',
+    };
+    const ec521 = {
+        key: {
+            kty: 'EC',
+            kid: '1',
+            use: 'sig',
+            crv: 'P-521',
+            alg: undefined,
+            x: 'AekpBQ8ST8a8VcfVOTNl353vSrDCLLJXmPk06wTjxrrjcBpXp5EOnYG_NjFZ6OvLFV1jSfS9tsz4qUxcWceqwQGk',
+            y: 'ADSmRA43Z1DSNx_RvcLI87cdL07l6jQyyBXMoxVg_l2Th-x3S1WDhjDly79ajL4Kkd0AZMaZmh9ubmf63e3kyMj2',
+            d: 'AY5pb7A0UFiB3RELSD64fTLOSV_jazdF7fLYyuTw8lOfRhWg6Y6rUrPAxerEzgdRhajnu0ferB0d53vM9mE15j2C',
+            x5t: undefined,
+        },
+        expectedHeader: 'eyJhbGciOiJFUzUxMiJ9',
+        expectedPayload: 'UGF5bG9hZA',
+        expectedSignature: 'AdwMgeerwtHoh-l192l60hp9wAHZFVJbLfD_UxMi70cwnZOYaRI1bKPWROc-mZZqwqT2SI-KGDKB34XO0aw_7XdtAG8GaSwFKdCAPZgoXD2YBJZCPEX3xKpRwcdOO8KpEHwJjyqOgzDO7iKvU8vcnwNrmxYbSW9ERBXukOXolLzeO_Jn',
+    };
+    const octHmac = {
+        key: {
+            kty: 'oct',
+            kid: '1',
+            use: 'sig',
+            alg: undefined,
+            k: 'AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow',
+            x5t: undefined,
+        },
+        expectedHeader: 'eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9',
+        expectedPayload: 'eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ',
+        expectedSignature: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+    };
+    const rsa256 = {
+        key: {
+            kty: 'RSA',
+            kid: '1',
+            use: 'sig',
+            alg: undefined,
+            n: 'ofgWCuLjybRlzo0tZWJjNiuSfb4p4fAkd_wWJcyQoTbji9k0l8W26mPddxHmfHQp-Vaw-4qPCJrcS2mJPMEzP1Pt0Bm4d4QlL-yRT-SFd2lZS-pCgNMsD1W_YpRPEwOWvG6b32690r2jZ47soMZo9wGzjb_7OMg0LOL-bSf63kpaSHSXndS5z5rexMdbBYUsLA9e-KXBdQOS-UTo7WTBEMa2R2CapHg665xsmtdVMTBQY4uDZlxvb3qCo5ZwKh9kG4LT6_I5IhlJH7aGhyxXFvUK-DWNmoudF8NAco9_h9iaGNj8q2ethFkMLs91kzk2PAcDTW9gb54h4FRWyuXpoQ',
+            e: 'AQAB',
+            d: 'Eq5xpGnNCivDflJsRQBXHx1hdR1k6Ulwe2JZD50LpXyWPEAeP88vLNO97IjlA7_GQ5sLKMgvfTeXZx9SE-7YwVol2NXOoAJe46sui395IW_GO-pWJ1O0BkTGoVEn2bKVRUCgu-GjBVaYLU6f3l9kJfFNS3E0QbVdxzubSu3Mkqzjkn439X0M_V51gfpRLI9JYanrC4D4qAdGcopV_0ZHHzQlBjudU2QvXt4ehNYTCBr6XCLQUShb1juUO1ZdiYoFaFQT5Tw8bGUl_x_jTj3ccPDVZFD9pIuhLhBOneufuBiB4cS98l2SR_RQyGWSeWjnczT0QU91p1DhOVRuOopznQ',
+            p: '4BzEEOtIpmVdVEZNCqS7baC4crd0pqnRH_5IB3jw3bcxGn6QLvnEtfdUdiYrqBdss1l58BQ3KhooKeQTa9AB0Hw_Py5PJdTJNPY8cQn7ouZ2KKDcmnPGBY5t7yLc1QlQ5xHdwW1VhvKn-nXqhJTBgIPgtldC-KDV5z-y2XDwGUc',
+            q: 'uQPEfgmVtjL0Uyyx88GZFF1fOunH3-7cepKmtH4pxhtCoHqpWmT8YAmZxaewHgHAjLYsp1ZSe7zFYHj7C6ul7TjeLQeZD_YwD66t62wDmpe_HlB-TnBA-njbglfIsRLtXlnDzQkv5dTltRJ11BKBBypeeF6689rjcJIDEz9RWdc',
+            dp: 'BwKfV3Akq5_MFZDFZCnW-wzl-CCo83WoZvnLQwCTeDv8uzluRSnm71I3QCLdhrqE2e9YkxvuxdBfpT_PI7Yz-FOKnu1R6HsJeDCjn12Sk3vmAktV2zb34MCdy7cpdTh_YVr7tss2u6vneTwrA86rZtu5Mbr1C1XsmvkxHQAdYo0',
+            dq: 'h_96-mK1R_7glhsum81dZxjTnYynPbZpHziZjeeHcXYsXaaMwkOlODsWa7I9xXDoRwbKgB719rrmI2oKr6N3Do9U0ajaHF-NKJnwgjMd2w9cjz3_-kyNlxAr2v4IKhGNpmM5iIgOS1VZnOZ68m6_pbLBSp3nssTdlqvd0tIiTHU',
+            qi: 'IYd7DHOhrWvxkwPQsRM2tOgrjbcrfvtQJipd-DlcxyVuuM9sQLdgjVk2oy26F0EmpScGLq2MowX7fhd_QJQ3ydy5cY7YIBi87w93IKLEdfnbJtoOPLUW0ITrJReOgo1cq9SbsxYawBgfp_gh6A5603k2-ZQwVK0JKSHuLFkuQ3U',
+            x5t: undefined,
+        },
+        expectedHeader: 'eyJhbGciOiJSUzI1NiJ9',
+        expectedPayload: 'eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ',
+        expectedSignature: 'cC4hiUPoj9Eetdgtv3hF80EGrhuB__dzERat0XF9g2VtQgr9PJbu3XOiZj5RZmh7AAuHIm4Bh-0Qc_lF5YKt_O8W2Fp5jujGbds9uJdbF9CUAr7t1dnZcAcQjbKBYNX4BAynRFdiuB--f_nZLgrnbyTyWzO75vRK5h6xBArLIARNPvkSjtQBMHlb1L07Qe7K0GarZRmB_eSN9383LcOLn6_dO--xi12jzDwusC-eOkHWEsqtFZESc6BfI7noOPqvhJ1phCnvWh6IeYI2w9QOYEUipUTI8np6LbgGY9Fs98rqVt5AXLIhWkWywlVmtVrBp0igcN_IoypGlUPQGe77Rw',
+    };
+    it('should verify ES256', async () => {
+        assert.equal(await verifyJwkSignature(env, {
+            signature: es256.expectedSignature,
+            payload: es256.expectedPayload,
+            header: es256.expectedHeader,
+        }, es256.key), true);
+        assert.equal(await verifyJwkSignature(env, {
+            signature: es256.expectedSignature,
+            payload: 'abc',
+            header: es256.expectedHeader,
+        }, es256.key), false);
+    });
+    // it('should sign ES256', async () => {
+    //   const newSignature = await signJwk(
+    //     env,
+    //     { payload: es256.expectedPayload, header: es256.expectedPayload },
+    //     es256.key,
+    //   );
+    //   assert.equal(newSignature, es256.expectedSignature);
+    // });
+    it('should verify ES512', async () => {
+        assert.equal(await verifyJwkSignature(env, {
+            signature: ec521.expectedSignature,
+            payload: ec521.expectedPayload,
+            header: ec521.expectedHeader,
+        }, ec521.key), true);
+        assert.equal(await verifyJwkSignature(env, {
+            signature: ec521.expectedSignature,
+            payload: 'abc',
+            header: ec521.expectedHeader,
+        }, ec521.key), false);
+    });
+    // it('should sign ES521', async () => {
+    //   const newSignature = await signJwk(
+    //     env,
+    //     { payload: ec521.expectedPayload, header: ec521.expectedHeader },
+    //     ec521.key,
+    //   );
+    //   assert.equal(newSignature, ec521.expectedSignature);
+    // });
+    it('should verify HS256', async () => {
+        assert.equal(await verifyJwkSignature(env, {
+            signature: octHmac.expectedSignature,
+            payload: octHmac.expectedPayload,
+            header: octHmac.expectedHeader,
+        }, octHmac.key), true);
+        assert.equal(await verifyJwkSignature(env, {
+            signature: octHmac.expectedSignature,
+            payload: 'abc',
+            header: octHmac.expectedHeader,
+        }, octHmac.key), false);
+    });
+    it('should verify RS256', async () => {
+        assert.equal(await verifyJwkSignature(env, {
+            signature: rsa256.expectedSignature,
+            payload: rsa256.expectedPayload,
+            header: rsa256.expectedHeader,
+        }, rsa256.key), true);
+        assert.equal(await verifyJwkSignature(env, {
+            signature: rsa256.expectedSignature,
+            payload: 'abc',
+            header: rsa256.expectedHeader,
+        }, rsa256.key), false);
+    });
+    // it('should sign RS256', async () => {
+    //   const newSignature = await signJwk(
+    //     env,
+    //     { payload: rsa256.expectedPayload, header: rsa256.expectedPayload },
+    //     rsa256.key,
+    //   );
+    //   assert.equal(newSignature, rsa256.expectedSignature);
+    // });
+});
+//# sourceMappingURL=jwk-verify.test.js.map

package/dist/authentication/jwk/jwk-verify.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk-verify.test.js","sourceRoot":"","sources":["../../../src/authentication/jwk/jwk-verify.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAE5B,MAAM,KAAK,GAAG;QACZ,GAAG,EAAE;YACH,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,6CAA6C;YAChD,CAAC,EAAE,6CAA6C;YAChD,CAAC,EAAE,6CAA6C;YAChD,GAAG,EAAE,SAAS;SACN;QACV,cAAc,EAAE,sBAAsB;QACtC,eAAe,EACb,gGAAgG;QAClG,iBAAiB,EACf,wFAAwF;KAC3F,CAAC;IAEF,MAAM,KAAK,GAAG;QACZ,GAAG,EAAE;YACH,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,0FAA0F;YAC7F,CAAC,EAAE,0FAA0F;YAC7F,CAAC,EAAE,0FAA0F;YAC7F,GAAG,EAAE,SAAS;SACN;QACV,cAAc,EAAE,sBAAsB;QACtC,eAAe,EAAE,YAAY;QAC7B,iBAAiB,EACf,kLAAkL;KACrL,CAAC;IAEF,MAAM,OAAO,GAAG;QACd,GAAG,EAAE;YACH,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wFAAwF;YAC3F,GAAG,EAAE,SAAS;SACN;QACV,cAAc,EAAE,0CAA0C;QAC1D,eAAe,EACb,gGAAgG;QAClG,iBAAiB,EAAE,6CAA6C;KACjE,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,GAAG,EAAE;YACH,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,SAAS;YACd,CAAC,EAAE,wVAAwV;YAC3V,CAAC,EAAE,MAAM;YACT,CAAC,EAAE,wVAAwV;YAC3V,CAAC,EAAE,6KAA6K;YAChL,CAAC,EAAE,6KAA6K;YAChL,EAAE,EAAE,6KAA6K;YACjL,EAAE,EAAE,6KAA6K;YACjL,EAAE,EAAE,6KAA6K;YACjL,GAAG,EAAE,SAAS;SACN;QACV,cAAc,EAAE,sBAAsB;QACtC,eAAe,EACb,gGAAgG;QAClG,iBAAiB,EACf,wVAAwV;KAC3V,CAAC;IAEF,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,CAAC,KAAK,CACV,MAAM,kBAAkB,CACtB,GAAG,EACH;YACE,SAAS,EAAE,KAAK,CAAC,iBAAiB;YAClC,OAAO,EAAE,KAAK,CAAC,eAAe;YAC9B,MAAM,EAAE,KAAK,CAAC,cAAc;SAC7B,EACD,KAAK,CAAC,GAAG,CACV,EACD,IAAI,CACL,CAAC;QACF,MAAM,CAAC,KAAK,CACV,MAAM,kBAAkB,CACtB,GAAG,EACH;YACE,SAAS,EAAE,KAAK,CAAC,iBAAiB;YAClC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK,CAAC,cAAc;SAC7B,EACD,KAAK,CAAC,GAAG,CACV,EACD,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,wCAAwC;IACxC,WAAW;IACX,yEAAyE;IACzE,iBAAiB;IACjB,OAAO;IACP,yDAAyD;IACzD,MAAM;IAEN,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,CAAC,KAAK,CACV,MAAM,kBAAkB,CACtB,GAAG,EACH;YACE,SAAS,EAAE,KAAK,CAAC,iBAAiB;YAClC,OAAO,EAAE,KAAK,CAAC,eAAe;YAC9B,MAAM,EAAE,KAAK,CAAC,cAAc;SAC7B,EACD,KAAK,CAAC,GAAG,CACV,EACD,IAAI,CACL,CAAC;QACF,MAAM,CAAC,KAAK,CACV,MAAM,kBAAkB,CACtB,GAAG,EACH;YACE,SAAS,EAAE,KAAK,CAAC,iBAAiB;YAClC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK,CAAC,cAAc;SAC7B,EACD,KAAK,CAAC,GAAG,CACV,EACD,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,wCAAwC;IACxC,WAAW;IACX,wEAAwE;IACxE,iBAAiB;IACjB,OAAO;IACP,yDAAyD;IACzD,MAAM;IAEN,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,CAAC,KAAK,CACV,MAAM,kBAAkB,CACtB,GAAG,EACH;YACE,SAAS,EAAE,OAAO,CAAC,iBAAiB;YACpC,OAAO,EAAE,OAAO,CAAC,eAAe;YAChC,MAAM,EAAE,OAAO,CAAC,cAAc;SAC/B,EACD,OAAO,CAAC,GAAG,CACZ,EACD,IAAI,CACL,CAAC;QACF,MAAM,CAAC,KAAK,CACV,MAAM,kBAAkB,CACtB,GAAG,EACH;YACE,SAAS,EAAE,OAAO,CAAC,iBAAiB;YACpC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,OAAO,CAAC,cAAc;SAC/B,EACD,OAAO,CAAC,GAAG,CACZ,EACD,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,CAAC,KAAK,CACV,MAAM,kBAAkB,CACtB,GAAG,EACH;YACE,SAAS,EAAE,MAAM,CAAC,iBAAiB;YACnC,OAAO,EAAE,MAAM,CAAC,eAAe;YAC/B,MAAM,EAAE,MAAM,CAAC,cAAc;SAC9B,EACD,MAAM,CAAC,GAAG,CACX,EACD,IAAI,CACL,CAAC;QACF,MAAM,CAAC,KAAK,CACV,MAAM,kBAAkB,CACtB,GAAG,EACH;YACE,SAAS,EAAE,MAAM,CAAC,iBAAiB;YACnC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM,CAAC,cAAc;SAC9B,EACD,MAAM,CAAC,GAAG,CACX,EACD,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,wCAAwC;IACxC,WAAW;IACX,2EAA2E;IAC3E,kBAAkB;IAClB,OAAO;IACP,0DAA0D;IAC1D,MAAM;AACR,CAAC,CAAC,CAAC"}

package/dist/authentication/jwk/signJwk.d.ts

@@ -0,0 +1,6 @@
+import { JwkKey } from './jwk-key.js';
+import { RuntimeEnv } from '../../environment/runtime-env.js';
+export declare function signJwk(env: RuntimeEnv, jwt: {
+    payload: string;
+    header: string;
+}, key: JwkKey): Promise<string>;

package/dist/authentication/jwk/signJwk.js

@@ -0,0 +1,18 @@
+import { getJwkKeyAlgorithm, getJwkSignKey } from './get-jwk-key-algorithm.js';
+import { uint8ToUrlBase64, stringToUint8Array } from './base64.js';
+export async function signJwk(env, jwt, key) {
+    const alg = getJwkKeyAlgorithm(key);
+    const jsonWebKey = getJwkSignKey(key);
+    const cryptoKey = await env
+        .crypto()
+        .subtle.importKey('jwk', jsonWebKey, alg, false, ['sign']);
+    const headerAndPayload = `${jwt.header}.${jwt.payload}`;
+    const messageAsUint8Array = stringToUint8Array(headerAndPayload);
+    const signature = await env
+        .crypto()
+        .subtle.sign(alg, cryptoKey, messageAsUint8Array);
+    const signArr = new Uint8Array(signature);
+    const base64Signature = uint8ToUrlBase64(signArr);
+    return base64Signature;
+}
+//# sourceMappingURL=signJwk.js.map

package/dist/authentication/jwk/signJwk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signJwk.js","sourceRoot":"","sources":["../../../src/authentication/jwk/signJwk.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGnE,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAe,EACf,GAAwC,EACxC,GAAW;IAEX,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,GAAG;SACxB,MAAM,EAAE;SACR,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAE7D,MAAM,gBAAgB,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IAExD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAEjE,MAAM,SAAS,GAAG,MAAM,GAAG;SACxB,MAAM,EAAE;SACR,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/authentication/jwt/jwt-payload.d.ts

@@ -0,0 +1,10 @@
+import { TypeOf } from '../../typing/type-of.js';
+export declare const JwtPayload: import("../../typing/object-type-description.js").ObjectTypeDescription<{
+    sub: string;
+    aud: string;
+    iss: string;
+    iat: number | undefined;
+    nbf: number | undefined;
+    exp: number | undefined;
+}>;
+export type JwtPayload = TypeOf<typeof JwtPayload>;

package/dist/authentication/jwt/jwt-payload.js

@@ -0,0 +1,13 @@
+import { number } from '../../typing/number.js';
+import { object } from '../../typing/object.js';
+import { string } from '../../typing/string.js';
+import { optional } from '../../typing/optional.js';
+export const JwtPayload = object('JwtPayload', {
+    sub: string(),
+    aud: string(),
+    iss: string(),
+    iat: optional(number()),
+    nbf: optional(number()),
+    exp: optional(number()),
+});
+//# sourceMappingURL=jwt-payload.js.map

package/dist/authentication/jwt/jwt-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-payload.js","sourceRoot":"","sources":["../../../src/authentication/jwt/jwt-payload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,EAAE;IAC7C,GAAG,EAAE,MAAM,EAAE;IACb,GAAG,EAAE,MAAM,EAAE;IACb,GAAG,EAAE,MAAM,EAAE;IACb,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;CACxB,CAAC,CAAC"}

package/dist/authentication/jwt/parse-jwt.d.ts

@@ -0,0 +1,4 @@
+import { TypeDescription } from '../../typing/type-description.js';
+export declare function extractPart(token: string, partIndex: 0 | 1 | 2): string;
+export declare function extractObject(token: string, partIndex: 0 | 1): unknown;
+export declare function parseJwt<Type extends TypeDescription>(token: string, partIndex: 0 | 1, type: Type): Type['_output'];

package/dist/authentication/jwt/parse-jwt.js

@@ -0,0 +1,38 @@
+import { CustomError } from '../../error/custom-error.js';
+import { assert } from '../../typing/assert.js';
+import { getErrorMessage } from '../../runtime/get-error-message.js';
+export function extractPart(token, partIndex) {
+    const tokenPart = token.split('.')[partIndex];
+    if (!tokenPart) {
+        throw new Error('invalid format: token does not have enough parts');
+    }
+    return tokenPart;
+}
+export function extractObject(token, partIndex) {
+    const tokenPart = extractPart(token, partIndex);
+    let content = '';
+    try {
+        content = atob(tokenPart);
+    }
+    catch (e) {
+        throw new CustomError('invalid format', {
+            parseError: getErrorMessage(e),
+        });
+    }
+    let data;
+    try {
+        data = JSON.parse(content);
+    }
+    catch (e) {
+        throw new CustomError('invalid json format', {
+            jsonError: getErrorMessage(e),
+        });
+    }
+    return data;
+}
+export function parseJwt(token, partIndex, type) {
+    const data = extractObject(token, partIndex);
+    assert(data, type);
+    return data;
+}
+//# sourceMappingURL=parse-jwt.js.map

package/dist/authentication/jwt/parse-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-jwt.js","sourceRoot":"","sources":["../../../src/authentication/jwt/parse-jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,SAAoB;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,SAAgB;IAC3D,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEhD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE;YACtC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE;YAC3C,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,KAAa,EACb,SAAgB,EAChB,IAAU;IAEV,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/authentication/jwt/parse-path.d.ts

@@ -0,0 +1,2 @@
+import { TypeDescription } from '../../typing/type-description.js';
+export declare function parsePath<T extends TypeDescription>(path: string, value: unknown, type: T): T['_output'];

package/dist/authentication/jwt/parse-path.js

@@ -0,0 +1,46 @@
+import { CustomError } from '../../error/custom-error.js';
+import { assert } from '../../typing/assert.js';
+function ifNotFound(index, defaultValue) {
+    if (index === -1) {
+        return defaultValue;
+    }
+    else {
+        return index;
+    }
+}
+export function parsePath(path, value, type) {
+    let current = value;
+    let i = 0;
+    do {
+        if (!current || typeof current !== 'object') {
+            throw new CustomError('invalid object', { path });
+        }
+        const dotIndex = path.indexOf('.', i);
+        const arrowIndex = path.indexOf('->', i);
+        const nextIndex = Math.min(ifNotFound(dotIndex, path.length), ifNotFound(arrowIndex, path.length));
+        const nextPath = path.substring(i, nextIndex);
+        const nextKey = nextPath.trim();
+        current = nextKey in current ? current[nextKey] : null;
+        if (nextIndex === arrowIndex) {
+            if (typeof current !== 'string') {
+                throw new CustomError('invalid object to parse', { path });
+            }
+            try {
+                current = JSON.parse(current);
+            }
+            catch {
+                throw new CustomError('invalid object to parse', { path });
+            }
+        }
+        i = nextIndex;
+        if (nextIndex === arrowIndex) {
+            i += 2;
+        }
+        else if (nextIndex === dotIndex) {
+            i += 1;
+        }
+    } while (i < path.length);
+    assert(current, type);
+    return current;
+}
+//# sourceMappingURL=parse-path.js.map

package/dist/authentication/jwt/parse-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-path.js","sourceRoot":"","sources":["../../../src/authentication/jwt/parse-path.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,SAAS,UAAU,CAAC,KAAa,EAAE,YAAoB;IACrD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,KAAc,EACd,IAAO;IAEP,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,GAAG,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EACjC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CACpC,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAE,OAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEhE,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,CAAC,GAAG,SAAS,CAAC;QACd,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;IAE1B,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAEtB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/authentication/jwt/parse-path.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/authentication/jwt/parse-path.test.js

@@ -0,0 +1,16 @@
+import { describe, it } from 'node:test';
+import { parsePath } from './parse-path.js';
+import { string } from '../../typing/string.js';
+import { equal } from 'node:assert';
+describe('parse-path', () => {
+    it('should parse plain key', () => {
+        equal(parsePath('sub', { sub: 'value' }, string()), 'value');
+    });
+    it('should parse sub key', () => {
+        equal(parsePath('sub.child', { sub: { child: 'value' } }, string()), 'value');
+    });
+    it('should parse json key', () => {
+        equal(parsePath('oidc_extra->actor', { oidc_extra: JSON.stringify({ actor: 'value' }) }, string()), 'value');
+    });
+});
+//# sourceMappingURL=parse-path.test.js.map

package/dist/authentication/jwt/parse-path.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-path.test.js","sourceRoot":"","sources":["../../../src/authentication/jwt/parse-path.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,KAAK,CACH,SAAS,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAC7D,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,KAAK,CACH,SAAS,CACP,mBAAmB,EACnB,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,EAClD,MAAM,EAAE,CACT,EACD,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/authentication/jwt/validate-jwt.d.ts

@@ -0,0 +1,7 @@
+import { JwkKey } from '../jwk/jwk-key.js';
+import { RuntimeEnv } from '../../environment/runtime-env.js';
+import { TokenValidation } from '../keystore/token-validation.js';
+export declare function validateJwt(env: RuntimeEnv, access_token: string, subKey: string, attributeKeys: string[], keyResolver: (kid: {
+    kid: string | undefined;
+    x5t: string | undefined;
+}, signal: AbortSignal) => Promise<JwkKey | null>, signal: AbortSignal): Promise<TokenValidation | null>;