@lindorm/aegis 0.2.5 → 0.3.0

package/dist/classes/CweKit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CweKit.js","sourceRoot":"","sources":["../../src/classes/CweKit.ts"],"names":[],"mappings":";;;AAAA,sCAA2E;AAC3E,oCAAiD;AAGjD,+BAAsC;AACtC,mCAAqC;AACrC,sCAA6C;AAW7C,8CAM0B;AAE1B,MAAa,MAAM;IACA,UAAU,CAAoB;IAC9B,MAAM,CAAU;IAChB,OAAO,CAAW;IAEnC,YAAmB,OAAsB;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC;IAClF,CAAC;IAEM,OAAO,CAAC,IAAgB,EAAE,UAA6B,EAAE;QAC9D,MAAM,GAAG,GAAG,IAAI,YAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAE/E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3E,MAAM,EACJ,OAAO,EACP,OAAO,EACP,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAEhC,MAAM,eAAe,GAAG,IAAA,uBAAa,EACnC,IAAA,wBAAc,EAAC;YACb,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACnC,UAAU,EAAE,0CAA0C;SACvD,CAAC,CACH,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC;QAE9C,MAAM,iBAAiB,GAAG,IAAA,uBAAa,EACrC,IAAA,wBAAc,EAAC;YACb,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,oBAAoB;YACpB,QAAQ;SACT,CAAC,CACH,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAErD,MAAM,eAAe,GAAG,IAAA,uBAAa,EACnC,IAAA,wBAAc,EAAC;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,oBAAoB,EAAE,kBAAkB;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS;YAC1C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACtB,eAAe;YACf,SAAS;YACT,mBAAmB;YACnB,mBAAmB;SACpB,CAAC,CACH,CAAC;QACF,MAAM,kBAAkB,GAAG,mBAAmB,IAAI,IAAI,CAAC;QACvD,MAAM,UAAU,GAAG,CAAC,CAAC,IAAA,aAAM,EAAC,EAAE,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,IAAA,aAAM,EAAC,CAAC,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEM,OAAO,CAAgC,KAAiB;QAC7D,MAAM,GAAG,GAAG,IAAI,YAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAE/E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAErC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACrD,MAAM,IAAI,yBAAgB,CAAC,eAAe,EAAE;gBAC1C,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;oBAC9B,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG;iBAC9B;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1D,MAAM,IAAI,yBAAgB,CAAC,uBAAuB,EAAE;gBAClD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI,CAAC,UAAU;oBACvB,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG;iBAC1C;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC;QACzD,MAAM,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;QAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;QACpD,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;QAC9D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;QAC9D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,mBAAmB,CAAC;QAElE,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,MAAM,IAAI,yBAAgB,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAqB;YAClD,GAAG,OAAO,CAAC,SAAS;YACpB,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG;YACtC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG;YACtC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG;YACtC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG;YACtC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG;SAC7B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAI;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAG,OAAO,CAAC,SAAS,CAAC,GAAsB,IAAI,YAAY;YACtE,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,oBAAoB;YACpB,eAAe;YACf,SAAS;YACT,kBAAkB;YAClB,mBAAmB;YACnB,mBAAmB;YACnB,mBAAmB;SACU,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAErC,OAAO;YACL,OAAO;YACP,MAAM;YACN,OAAO;YACP,KAAK,EAAE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC7D,CAAC;IACJ,CAAC;IAIM,MAAM,CAAC,KAAK,CAAC,KAAsB;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,0CAA0C,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,MAAM,CAAC,KAAiB;QACpC,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,IAAA,aAAM,EACrE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAC1D,CAAC;QAEF,MAAM,aAAa,GAAG,IAAA,0BAAgB,EAAC,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,MAAM,eAAe,GAAG,IAAA,0BAAgB,EAAC,eAAe,CAAC,CAAC;QAE1D,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC;QAC/B,MAAM,CAAC,CAAC,EAAE,eAAe,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;QAC5D,MAAM,aAAa,GAAG,IAAA,0BAAgB,EAAC,eAAe,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,aAAa,CAAC,GAAI,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAE7C,OAAO;YACL,SAAS,EAAE,aAAoB;YAC/B,WAAW,EAAE,eAAsB;YACnC,SAAS,EAAE;gBACT,WAAW,EAAE,aAAoB;gBACjC,oBAAoB,EAAE,aAAa,CAAC,EAAE;gBACtC,mBAAmB;aACpB;YACD,oBAAoB,EAAE,eAAe,CAAC,EAAG;YACzC,OAAO;YACP,OAAO;SACR,CAAC;IACJ,CAAC;IAIO,WAAW,CAAC,KAAiB;QACnC,IAAI,IAAA,aAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,0BAA0B,CAAC;QACpC,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;CACF;AAnMD,wBAmMC"}

package/dist/classes/CwsKit.d.ts

@@ -0,0 +1,13 @@
+import { ICwsKit } from "../interfaces";
+import { CwsContent, CwsKitOptions, DecodedCws, ParsedCws, SignCwsOptions, SignedCws } from "../types";
+export declare class CwsKit implements ICwsKit {
+    private readonly logger;
+    private readonly kryptos;
+    constructor(options: CwsKitOptions);
+    sign(data: CwsContent, options?: SignCwsOptions): SignedCws;
+    verify<T extends CwsContent>(token: CwsContent): ParsedCws<T>;
+    static isCws(token: Buffer | string): boolean;
+    static decode<T extends CwsContent>(token: CwsContent): DecodedCws<T>;
+    static parse<T extends CwsContent>(token: CwsContent): ParsedCws<T>;
+}
+//# sourceMappingURL=CwsKit.d.ts.map

package/dist/classes/CwsKit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CwsKit.d.ts","sourceRoot":"","sources":["../../src/classes/CwsKit.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,UAAU,EACV,aAAa,EACb,UAAU,EACV,SAAS,EAET,cAAc,EACd,SAAS,EACV,MAAM,UAAU,CAAC;AAWlB,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;gBAEhB,OAAO,EAAE,aAAa;IAKlC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,GAAE,cAAmB,GAAG,SAAS;IAiD/D,MAAM,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;WA4DtD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;WAStC,MAAM,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC;WAsB9D,KAAK,CAAC,CAAC,SAAS,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;CAU3E"}

package/dist/classes/CwsKit.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CwsKit = void 0;
+const is_1 = require("@lindorm/is");
+const cbor_1 = require("cbor");
+const crypto_1 = require("crypto");
+const errors_1 = require("../errors");
+const private_1 = require("../utils/private");
+class CwsKit {
+    logger;
+    kryptos;
+    constructor(options) {
+        this.logger = options.logger.child(["CoseSignKit"]);
+        this.kryptos = options.kryptos;
+    }
+    sign(data, options = {}) {
+        const objectId = options.objectId ?? (0, crypto_1.randomBytes)(20).toString("base64url");
+        this.logger.debug("Signing token", { options });
+        const protectedHeader = (0, private_1.mapCoseHeader)((0, private_1.mapTokenHeader)({
+            algorithm: this.kryptos.algorithm,
+            contentType: options.contentType
+                ? options.contentType
+                : (0, is_1.isString)(data)
+                    ? "text/plain; charset=utf-8"
+                    : "application/octet-stream",
+            headerType: "application/cose; cose-type=cose-sign",
+        }));
+        const protectedCbor = (0, cbor_1.encode)(protectedHeader);
+        const unprotectedHeader = (0, private_1.mapCoseHeader)((0, private_1.mapTokenHeader)({
+            ...(options.header ?? {}),
+            jwksUri: this.kryptos.jwksUri ?? undefined,
+            keyId: this.kryptos.id,
+            objectId,
+        }));
+        const payloadBuffer = (0, is_1.isBuffer)(data) ? data : Buffer.from(data, "utf-8");
+        const payloadCbor = (0, cbor_1.encode)(payloadBuffer);
+        const signature = (0, private_1.createCoseSignature)({
+            kryptos: this.kryptos,
+            payload: payloadCbor,
+            protectedHeader: protectedCbor,
+        });
+        const buffer = (0, private_1.createCoseSignToken)({
+            payload: payloadCbor,
+            protectedHeader: protectedCbor,
+            unprotectedHeader,
+            signature,
+        });
+        const token = buffer.toString("base64url");
+        this.logger.debug("Token signed", { token });
+        return { buffer, objectId, token };
+    }
+    verify(token) {
+        this.logger.debug("Verifying token", { token });
+        const [protectedCbor, unprotectedCose, payloadCbor, signature] = (0, cbor_1.decode)((0, is_1.isBuffer)(token) ? token : Buffer.from(token, "base64url"));
+        const protectedDict = (0, private_1.decodeCoseHeader)((0, cbor_1.decode)(protectedCbor));
+        if (this.kryptos.algorithm !== protectedDict.alg) {
+            throw new errors_1.CoseSignError("Invalid token", {
+                data: { algorithm: protectedDict.alg },
+                debug: { expected: this.kryptos.algorithm },
+            });
+        }
+        const verified = (0, private_1.verifyCoseSignature)({
+            kryptos: this.kryptos,
+            payload: payloadCbor,
+            protectedHeader: protectedCbor,
+            signature,
+        });
+        if (!verified) {
+            throw new errors_1.CoseSignError("Invalid token", {
+                data: { verified, token },
+            });
+        }
+        const unprotectedDict = (0, private_1.decodeCoseHeader)(unprotectedCose);
+        const payloadBuffer = (0, cbor_1.decode)(payloadCbor);
+        const decoded = {
+            protected: protectedDict,
+            unprotected: unprotectedDict,
+            payload: payloadBuffer,
+            signature: signature,
+        };
+        const header = (0, private_1.parseTokenHeader)({
+            ...protectedDict,
+            ...unprotectedDict,
+        });
+        const payload = header.contentType === "text/plain; charset=utf-8"
+            ? payloadBuffer.toString("utf-8")
+            : payloadBuffer;
+        this.logger.debug("Token verified");
+        return {
+            decoded,
+            header,
+            payload,
+            token: (0, is_1.isBuffer)(token) ? token.toString("base64url") : token,
+        };
+    }
+    static isCws(token) {
+        try {
+            const decode = CwsKit.decode(token);
+            return decode.protected.typ === "application/cose; cose-type=cose-sign";
+        }
+        catch {
+            return false;
+        }
+    }
+    static decode(token) {
+        const [protectedCbor, unprotectedHeader, payloadCbor, signature] = (0, cbor_1.decode)((0, is_1.isBuffer)(token) ? token : Buffer.from(token, "base64url"));
+        const protectedDict = (0, private_1.decodeCoseHeader)((0, cbor_1.decode)(protectedCbor));
+        const unprotectedDict = (0, private_1.decodeCoseHeader)(unprotectedHeader);
+        const payloadBuffer = (0, cbor_1.decode)(payloadCbor);
+        const payload = protectedDict.cty === "text/plain; charset=utf-8"
+            ? payloadBuffer.toString("utf-8")
+            : payloadBuffer;
+        return {
+            protected: protectedDict,
+            unprotected: unprotectedDict,
+            payload,
+            signature: signature.toString("base64url"),
+        };
+    }
+    static parse(token) {
+        const decoded = CwsKit.decode(token);
+        return {
+            decoded,
+            header: (0, private_1.parseTokenHeader)({ ...decoded.protected, ...decoded.unprotected }),
+            payload: decoded.payload,
+            token: (0, is_1.isBuffer)(token) ? token.toString("base64url") : token,
+        };
+    }
+}
+exports.CwsKit = CwsKit;
+//# sourceMappingURL=CwsKit.js.map

package/dist/classes/CwsKit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CwsKit.js","sourceRoot":"","sources":["../../src/classes/CwsKit.ts"],"names":[],"mappings":";;;AAAA,oCAAiD;AAGjD,+BAAsC;AACtC,mCAAqC;AACrC,sCAA0C;AAW1C,8CAQ0B;AAE1B,MAAa,MAAM;IACA,MAAM,CAAU;IAChB,OAAO,CAAW;IAEnC,YAAmB,OAAsB;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAEM,IAAI,CAAC,IAAgB,EAAE,UAA0B,EAAE;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEhD,MAAM,eAAe,GAAG,IAAA,uBAAa,EACnC,IAAA,wBAAc,EAAC;YACb,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAC9B,CAAC,CAAC,OAAO,CAAC,WAAW;gBACrB,CAAC,CAAC,IAAA,aAAQ,EAAC,IAAI,CAAC;oBACd,CAAC,CAAC,2BAA2B;oBAC7B,CAAC,CAAC,0BAA0B;YAChC,UAAU,EAAE,uCAAuC;SACpD,CAAC,CACH,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC;QAE9C,MAAM,iBAAiB,GAAG,IAAA,uBAAa,EACrC,IAAA,wBAAc,EAAC;YACb,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS;YAC1C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACtB,QAAQ;SACT,CAAC,CACH,CAAC;QAEF,MAAM,aAAa,GAAG,IAAA,aAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,IAAA,6BAAmB,EAAC;YACpC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,WAAW;YACpB,eAAe,EAAE,aAAa;SAC/B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAA,6BAAmB,EAAC;YACjC,OAAO,EAAE,WAAW;YACpB,eAAe,EAAE,aAAa;YAC9B,iBAAiB;YACjB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAE7C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAEM,MAAM,CAAuB,KAAiB;QACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhD,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,IAAA,aAAM,EACrE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAC1D,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,0BAAgB,EAAC,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC,CAAC;QAE9D,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC;YACjD,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE;gBACvC,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,EAAE;gBACtC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,6BAAmB,EAAC;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,WAAW;YACpB,eAAe,EAAE,aAAa;YAC9B,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE;gBACvC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,0BAAgB,EAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,IAAA,aAAM,EAAC,WAAW,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAkB;YAC7B,SAAS,EAAE,aAAoB;YAC/B,WAAW,EAAE,eAAsB;YACnC,OAAO,EAAE,aAAoB;YAC7B,SAAS,EAAE,SAAS;SACrB,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAkB;YAC/C,GAAG,aAAa;YAChB,GAAG,eAAe;SACZ,CAAC,CAAC;QAEV,MAAM,OAAO,GACX,MAAM,CAAC,WAAW,KAAK,2BAA2B;YAChD,CAAC,CAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAO;YACxC,CAAC,CAAC,aAAa,CAAC;QAEpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAEpC,OAAO;YACL,OAAO;YACP,MAAM;YACN,OAAO;YACP,KAAK,EAAE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;SAC7D,CAAC;IACJ,CAAC;IAIM,MAAM,CAAC,KAAK,CAAC,KAAsB;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,uCAAuC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,MAAM,CAAuB,KAAiB;QAC1D,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,IAAA,aAAM,EACvE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAC1D,CAAC;QAEF,MAAM,aAAa,GAAG,IAAA,0BAAgB,EAAC,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,MAAM,eAAe,GAAG,IAAA,0BAAgB,EAAC,iBAAiB,CAAC,CAAC;QAE5D,MAAM,aAAa,GAAG,IAAA,aAAM,EAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,OAAO,GACX,aAAa,CAAC,GAAG,KAAK,2BAA2B;YAC/C,CAAC,CAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAO;YACxC,CAAC,CAAC,aAAa,CAAC;QAEpB,OAAO;YACL,SAAS,EAAE,aAAoB;YAC/B,WAAW,EAAE,eAAsB;YACnC,OAAO;YACP,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC3C,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAuB,KAAiB;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAI,KAAK,CAAC,CAAC;QAExC,OAAO;YACL,OAAO;YACP,MAAM,EAAE,IAAA,0BAAgB,EAAC,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,WAAW,EAAS,CAAC;YACjF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;SAC7D,CAAC;IACJ,CAAC;CACF;AA/JD,wBA+JC"}

package/dist/classes/CwtKit.d.ts

@@ -0,0 +1,17 @@
+import { Dict } from "@lindorm/types";
+import { ICwtKit } from "../interfaces";
+import { CwtKitOptions, DecodedCwt, ParsedCwt, ParsedCwtPayload, SignCwtContent, SignCwtOptions, SignedCwt, ValidateCwtOptions, VerifyCwtOptions } from "../types";
+export declare class CwtKit implements ICwtKit {
+    private readonly clockTolerance;
+    private readonly issuer;
+    private readonly logger;
+    private readonly kryptos;
+    constructor(options: CwtKitOptions);
+    sign<C extends Dict = Dict>(content: SignCwtContent<C>, options?: SignCwtOptions): SignedCwt;
+    verify<C extends Dict = Dict>(token: Buffer | string, verify?: VerifyCwtOptions): ParsedCwt<C>;
+    static isCwt(token: Buffer | string): boolean;
+    static decode<C extends Dict = Dict>(token: Buffer | string): DecodedCwt<C>;
+    static parse<C extends Dict = Dict>(token: Buffer | string): ParsedCwt<C>;
+    static validate<C extends Dict = Dict>(payload: ParsedCwtPayload<C>, options: ValidateCwtOptions): void;
+}
+//# sourceMappingURL=CwtKit.d.ts.map

package/dist/classes/CwtKit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CwtKit.d.ts","sourceRoot":"","sources":["../../src/classes/CwtKit.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAItC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,aAAa,EACb,UAAU,EAEV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAmBlB,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;gBAEhB,OAAO,EAAE,aAAa;IAQlC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EAC/B,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAC1B,OAAO,GAAE,cAAmB,GAC3B,SAAS;IAiEL,MAAM,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EACjC,KAAK,EAAE,MAAM,GAAG,MAAM,EACtB,MAAM,GAAE,gBAAqB,GAC5B,SAAS,CAAC,CAAC,CAAC;WAkFD,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO;WAStC,MAAM,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC;WAepE,KAAK,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;WAWlE,QAAQ,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EAC1C,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC5B,OAAO,EAAE,kBAAkB,GAC1B,IAAI;CAKR"}

package/dist/classes/CwtKit.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CwtKit = void 0;
+const date_1 = require("@lindorm/date");
+const is_1 = require("@lindorm/is");
+const cbor_1 = require("cbor");
+const crypto_1 = require("crypto");
+const errors_1 = require("../errors");
+const private_1 = require("../utils/private");
+class CwtKit {
+    clockTolerance;
+    issuer;
+    logger;
+    kryptos;
+    constructor(options) {
+        this.logger = options.logger.child(["CwtKit"]);
+        this.kryptos = options.kryptos;
+        this.issuer = options.issuer ?? null;
+        this.clockTolerance = options.clockTolerance ?? 0;
+    }
+    sign(content, options = {}) {
+        this.logger.debug("Signing token", { content, options });
+        if (!this.issuer) {
+            throw new Error("Issuer is required to sign CWT");
+        }
+        const objectId = options.objectId ?? content.subject ?? (0, crypto_1.randomBytes)(20).toString("base64url");
+        const protectedDict = (0, private_1.mapCoseHeader)((0, private_1.mapTokenHeader)({
+            algorithm: this.kryptos.algorithm,
+            contentType: "application/json",
+            headerType: "application/cwt",
+        }));
+        const protectedCbor = (0, cbor_1.encode)(protectedDict);
+        const unprotectedDict = (0, private_1.mapCoseHeader)((0, private_1.mapTokenHeader)({
+            ...(options.header ?? {}),
+            jwksUri: this.kryptos.jwksUri ?? undefined,
+            keyId: this.kryptos.id,
+            objectId,
+        }));
+        const claims = (0, private_1.mapJwtContentToClaims)({ algorithm: this.kryptos.algorithm, issuer: this.issuer }, content, { tokenId: (0, crypto_1.randomBytes)(20).toString("base64url"), ...options });
+        const payloadDict = (0, private_1.mapCoseClaims)({ ...claims, ...(content.claims ?? {}) });
+        const payloadCbor = (0, cbor_1.encode)(payloadDict);
+        const signature = (0, private_1.createCoseSignature)({
+            kryptos: this.kryptos,
+            payload: payloadCbor,
+            protectedHeader: protectedCbor,
+        });
+        const buffer = (0, private_1.createCoseSignToken)({
+            payload: payloadCbor,
+            protectedHeader: protectedCbor,
+            unprotectedHeader: unprotectedDict,
+            signature,
+        });
+        const token = buffer.toString("base64url");
+        const { expiresAt, expiresIn, expiresOn } = (0, date_1.expires)(content.expires);
+        this.logger.debug("Token signed", { token });
+        return {
+            buffer,
+            expiresAt,
+            expiresIn,
+            expiresOn,
+            objectId,
+            token,
+            tokenId: claims.jti,
+        };
+    }
+    verify(token, verify = {}) {
+        this.logger.debug("Verifying token", { token, verify });
+        const [protectedCbor, unprotectedCose, payloadCbor, signature] = (0, cbor_1.decode)((0, is_1.isBuffer)(token) ? token : Buffer.from(token, "base64url"));
+        const protectedDict = (0, private_1.decodeCoseHeader)((0, cbor_1.decode)(protectedCbor));
+        const unprotectedDict = (0, private_1.decodeCoseHeader)(unprotectedCose);
+        const payloadDict = (0, private_1.decodeCoseClaims)((0, cbor_1.decode)(payloadCbor));
+        if (this.kryptos.algorithm !== protectedDict.alg) {
+            throw new errors_1.CwtError("Invalid token", {
+                data: { algorithm: protectedDict.alg },
+                debug: { expected: this.kryptos.algorithm },
+            });
+        }
+        const verified = (0, private_1.verifyCoseSignature)({
+            kryptos: this.kryptos,
+            payload: payloadCbor,
+            protectedHeader: protectedCbor,
+            signature,
+        });
+        if (!verified) {
+            throw new errors_1.CwtError("Invalid token", {
+                data: { verified, token },
+            });
+        }
+        const operators = (0, private_1.createJwtVerify)(this.kryptos.algorithm, verify, this.clockTolerance);
+        const invalid = [];
+        const withDates = {
+            ...payloadDict,
+            exp: payloadDict.exp ? new Date(payloadDict.exp * 1000) : undefined,
+            iat: payloadDict.iat ? new Date(payloadDict.iat * 1000) : undefined,
+            nbf: payloadDict.nbf ? new Date(payloadDict.nbf * 1000) : undefined,
+            auth_time: payloadDict.auth_time
+                ? new Date(payloadDict.auth_time * 1000)
+                : undefined,
+        };
+        for (const [key, ops] of Object.entries(operators)) {
+            const value = withDates[key];
+            if ((0, private_1.validateValue)(value, ops))
+                continue;
+            invalid.push({ key, value, ops });
+        }
+        if (invalid.length) {
+            throw new errors_1.CwtError("Invalid token", { data: { invalid } });
+        }
+        const decoded = {
+            protected: protectedDict,
+            unprotected: unprotectedDict,
+            payload: payloadDict,
+            signature: signature,
+        };
+        const payload = (0, private_1.parseTokenPayload)(payloadDict);
+        this.logger.debug("Token verified");
+        return {
+            decoded,
+            header: (0, private_1.parseTokenHeader)({
+                ...protectedDict,
+                ...unprotectedDict,
+            }),
+            payload,
+            token: (0, is_1.isBuffer)(token) ? token.toString("base64url") : token,
+        };
+    }
+    static isCwt(token) {
+        try {
+            const decode = CwtKit.decode(token);
+            return decode.protected.typ === "application/cwt";
+        }
+        catch {
+            return false;
+        }
+    }
+    static decode(token) {
+        const [protectedCbor, unprotectedHeader, payloadCbor, signature] = (0, cbor_1.decode)((0, is_1.isBuffer)(token) ? token : Buffer.from(token, "base64url"));
+        const protectedCose = (0, cbor_1.decode)(protectedCbor);
+        const payloadCose = (0, cbor_1.decode)(payloadCbor);
+        return {
+            protected: (0, private_1.decodeCoseHeader)(protectedCose),
+            unprotected: (0, private_1.decodeCoseHeader)(unprotectedHeader),
+            payload: (0, private_1.decodeCoseClaims)(payloadCose),
+            signature: signature.toString("base64url"),
+        };
+    }
+    static parse(token) {
+        const decoded = CwtKit.decode(token);
+        return {
+            decoded,
+            header: (0, private_1.parseTokenHeader)({ ...decoded.protected, ...decoded.unprotected }),
+            payload: (0, private_1.parseTokenPayload)(decoded.payload),
+            token: (0, is_1.isBuffer)(token) ? token.toString("base64url") : token,
+        };
+    }
+    static validate(payload, options) {
+        const operators = (0, private_1.createJwtValidate)(options);
+        (0, private_1.validate)(payload, operators);
+    }
+}
+exports.CwtKit = CwtKit;
+//# sourceMappingURL=CwtKit.js.map

package/dist/classes/CwtKit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CwtKit.js","sourceRoot":"","sources":["../../src/classes/CwtKit.ts"],"names":[],"mappings":";;;AAAA,wCAAwC;AACxC,oCAAuC;AAIvC,+BAAsC;AACtC,mCAAqC;AACrC,sCAAqC;AAcrC,8CAgB0B;AAE1B,MAAa,MAAM;IACA,cAAc,CAAS;IACvB,MAAM,CAAgB;IACtB,MAAM,CAAU;IAChB,OAAO,CAAW;IAEnC,YAAmB,OAAsB;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;QAErC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;IACpD,CAAC;IAEM,IAAI,CACT,OAA0B,EAC1B,UAA0B,EAAE;QAE5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,IAAI,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE/E,MAAM,aAAa,GAAG,IAAA,uBAAa,EACjC,IAAA,wBAAc,EAAC;YACb,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,WAAW,EAAE,kBAAkB;YAC/B,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CACH,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC;QAE5C,MAAM,eAAe,GAAG,IAAA,uBAAa,EACnC,IAAA,wBAAc,EAAC;YACb,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS;YAC1C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACtB,QAAQ;SACT,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,+BAAqB,EAClC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC1D,OAAO,EACP,EAAE,OAAO,EAAE,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,CAC/D,CAAC;QACF,MAAM,WAAW,GAAG,IAAA,uBAAa,EAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAA,aAAM,EAAC,WAAW,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,IAAA,6BAAmB,EAAC;YACpC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,WAAW;YACpB,eAAe,EAAE,aAAa;SAC/B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAA,6BAAmB,EAAC;YACjC,OAAO,EAAE,WAAW;YACpB,eAAe,EAAE,aAAa;YAC9B,iBAAiB,EAAE,eAAe;YAClC,SAAS;SACV,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3C,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAE7C,OAAO;YACL,MAAM;YACN,SAAS;YACT,SAAS;YACT,SAAS;YACT,QAAQ;YACR,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,GAAI;SACrB,CAAC;IACJ,CAAC;IAEM,MAAM,CACX,KAAsB,EACtB,SAA2B,EAAE;QAE7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAExD,MAAM,CAAC,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,IAAA,aAAM,EACrE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAC1D,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,0BAAgB,EAAC,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,MAAM,eAAe,GAAG,IAAA,0BAAgB,EAAC,eAAe,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAA,0BAAgB,EAAI,IAAA,aAAM,EAAC,WAAW,CAAC,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,aAAa,CAAC,GAAG,EAAE,CAAC;YACjD,MAAM,IAAI,iBAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,EAAE;gBACtC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,6BAAmB,EAAC;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,WAAW;YACpB,eAAe,EAAE,aAAa;YAC9B,SAAS;SACV,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iBAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,yBAAe,EAC/B,IAAI,CAAC,OAAO,CAAC,SAAS,EACtB,MAAM,EACN,IAAI,CAAC,cAAc,CACpB,CAAC;QAEF,MAAM,OAAO,GAAuD,EAAE,CAAC;QAEvE,MAAM,SAAS,GAAG;YAChB,GAAG,WAAW;YACd,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACnE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACnE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACnE,SAAS,EAAE,WAAW,CAAC,SAAS;gBAC9B,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC;gBACxC,CAAC,CAAC,SAAS;SACd,CAAC;QAEF,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,IAAA,uBAAa,EAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,SAAS;YACxC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,iBAAQ,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,OAAO,GAAkB;YAC7B,SAAS,EAAE,aAAoB;YAC/B,WAAW,EAAE,eAAsB;YACnC,OAAO,EAAE,WAAkB;YAC3B,SAAS,EAAE,SAAS;SACrB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAA,2BAAiB,EAAC,WAAW,CAAC,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAEpC,OAAO;YACL,OAAO;YACP,MAAM,EAAE,IAAA,0BAAgB,EAAC;gBACvB,GAAG,aAAa;gBAChB,GAAG,eAAe;aACZ,CAAC;YACT,OAAO;YACP,KAAK,EAAE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;SAC7D,CAAC;IACJ,CAAC;IAIM,MAAM,CAAC,KAAK,CAAC,KAAsB;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,iBAAiB,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,MAAM,CAAwB,KAAsB;QAChE,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,IAAA,aAAM,EACvE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAC1D,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAA,aAAM,EAAC,WAAW,CAAC,CAAC;QAExC,OAAO;YACL,SAAS,EAAE,IAAA,0BAAgB,EAAC,aAAa,CAAQ;YACjD,WAAW,EAAE,IAAA,0BAAgB,EAAC,iBAAiB,CAAQ;YACvD,OAAO,EAAE,IAAA,0BAAgB,EAAC,WAAW,CAAQ;YAC7C,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC3C,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAwB,KAAsB;QAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAI,KAAK,CAAC,CAAC;QAExC,OAAO;YACL,OAAO;YACP,MAAM,EAAE,IAAA,0BAAgB,EAAC,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAC1E,OAAO,EAAE,IAAA,2BAAiB,EAAC,OAAO,CAAC,OAAO,CAAC;YAC3C,KAAK,EAAE,IAAA,aAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;SAC7D,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,QAAQ,CACpB,OAA4B,EAC5B,OAA2B;QAE3B,MAAM,SAAS,GAAG,IAAA,2BAAiB,EAAC,OAAO,CAAC,CAAC;QAE7C,IAAA,kBAAQ,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;CACF;AAlND,wBAkNC"}

package/dist/classes/JweKit.d.ts

@@ -1,12 +1,13 @@
-import { DecodedJwe, DecryptedJwe, EncryptedJwe, IJweKit, JweEncryptOptions, JweKitOptions } from "../types";
+import { IJweKit } from "../interfaces";
+import { DecodedJwe, DecryptedJwe, EncryptedJwe, JweEncryptOptions, JweKitOptions } from "../types";
 export declare class JweKit implements IJweKit {
     private readonly encryption;
-    private readonly logger;
     private readonly kryptos;
-    private readonly kryptosMayOverrideEncryption;
+    private readonly logger;
     constructor(options: JweKitOptions);
     encrypt(data: string, options?: JweEncryptOptions): EncryptedJwe;
-    decrypt(jwe: string): DecryptedJwe;
+    decrypt(token: string): DecryptedJwe;
+    static isJwe(jwe: string): boolean;
     static decode(jwe: string): DecodedJwe;
     private contentType;
 }

package/dist/classes/JweKit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JweKit.d.ts","sourceRoot":"","sources":["../../src/classes/JweKit.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,UAAU,EACV,YAAY,EAEZ,YAAY,EACZ,OAAO,EACP,iBAAiB,EACjB,aAAa,EAEd,MAAM,UAAU,CAAC;AAGlB,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAU;gBAEpC,OAAO,EAAE,aAAa;IAQlC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,YAAY;IAuEpE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;WAuF3B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;IAe7C,OAAO,CAAC,WAAW;CASpB"}
+{"version":3,"file":"JweKit.d.ts","sourceRoot":"","sources":["../../src/classes/JweKit.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,UAAU,EACV,YAAY,EAEZ,YAAY,EACZ,iBAAiB,EACjB,aAAa,EAEd,MAAM,UAAU,CAAC;AAGlB,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;gBAEd,OAAO,EAAE,aAAa;IAMlC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,YAAY;IAqEpE,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY;WAqF7B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;WAI3B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;IAe7C,OAAO,CAAC,WAAW;CAuBpB"}

package/dist/classes/JweKit.js

@@ -3,80 +3,76 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.JweKit = void 0;
 const aes_1 = require("@lindorm/aes");
 const b64_1 = require("@lindorm/b64");
-const utils_1 = require("@lindorm/utils");
+const is_1 = require("@lindorm/is");
 const crypto_1 = require("crypto");
 const private_1 = require("../constants/private");
 const errors_1 = require("../errors");
 const private_2 = require("../utils/private");
 class JweKit {
     encryption;
-    logger;
     kryptos;
-    kryptosMayOverrideEncryption;
+    logger;
     constructor(options) {
         this.logger = options.logger.child(["JweKit"]);
         this.kryptos = options.kryptos;
-        this.encryption = options.encryption = "A256GCM";
-        this.kryptosMayOverrideEncryption = options.kryptosMayOverrideEncryption ?? false;
+        this.encryption = options.encryption ?? options.kryptos.encryption ?? "A256GCM";
     }
     encrypt(data, options = {}) {
-        const encryption = this.kryptosMayOverrideEncryption && this.kryptos.encryption
-            ? this.kryptos.encryption
-            : this.encryption;
-        const jwksUri = this.kryptos.jwksUri;
-        const keyId = this.kryptos.id;
+        const kit = new aes_1.AesKit({ encryption: this.encryption, kryptos: this.kryptos });
+        this.logger.debug("Encrypting token", { options });
         const objectId = options.objectId ?? (0, crypto_1.randomUUID)();
         const critical = [
             "algorithm",
             "encryption",
         ];
-        const aes = new aes_1.AesKit({ encryption, kryptos: this.kryptos });
-        const { authTag, content, hkdfSalt, initialisationVector, pbkdfIterations, pbkdfSalt, publicEncryptionIv, publicEncryptionJwk, publicEncryptionKey, publicEncryptionTag, } = aes.encrypt(data, "record");
-        if (publicEncryptionJwk)
-            critical.push("publicEncryptionJwk");
-        if (publicEncryptionIv)
-            critical.push("publicEncryptionIv");
-        if (publicEncryptionTag)
-            critical.push("publicEncryptionTag");
+        const { authTag, content, hkdfSalt, initialisationVector, pbkdfIterations, pbkdfSalt, publicEncryptionIv, publicEncryptionJwk, publicEncryptionKey, publicEncryptionTag, } = kit.encrypt(data, "record");
         if (hkdfSalt)
             critical.push("hkdfSalt");
         if (pbkdfIterations)
             critical.push("pbkdfIterations");
         if (pbkdfSalt)
             critical.push("pbkdfSalt");
+        if (publicEncryptionIv)
+            critical.push("initialisationVector");
+        if (publicEncryptionJwk)
+            critical.push("publicEncryptionJwk");
+        if (publicEncryptionTag)
+            critical.push("publicEncryptionTag");
         const headerOptions = {
+            ...(options.header ?? {}),
             algorithm: this.kryptos.algorithm,
             contentType: this.contentType(data),
             critical,
-            encryption,
+            encryption: this.encryption,
             headerType: "JWE",
             hkdfSalt,
-            jwksUri,
-            keyId,
+            initialisationVector: publicEncryptionIv,
+            jwksUri: this.kryptos.jwksUri ?? undefined,
+            keyId: this.kryptos.id,
             objectId,
             pbkdfIterations,
             pbkdfSalt,
-            publicEncryptionIv,
             publicEncryptionJwk,
             publicEncryptionTag,
         };
-        const header = (0, private_2.encodeTokenHeader)(headerOptions);
-        this.logger.silly("Token header encoded", { header, options: headerOptions });
-        const token = (0, utils_1.removeUndefined)([
+        const header = (0, private_2.encodeJoseHeader)(headerOptions);
+        if (!authTag) {
+            throw new errors_1.JweError("Missing auth tag");
+        }
+        const token = [
             header,
             publicEncryptionKey ? b64_1.B64.encode(publicEncryptionKey, private_1.B64U) : "",
             b64_1.B64.encode(initialisationVector, private_1.B64U),
             b64_1.B64.encode(content, private_1.B64U),
-            authTag ? b64_1.B64.encode(authTag, private_1.B64U) : undefined,
-        ]).join(".");
-        this.logger.silly("Token created", { keyId, token });
+            b64_1.B64.encode(authTag, private_1.B64U),
+        ].join(".");
+        this.logger.debug("Token encrypted", { token });
         return { token };
     }
-    decrypt(jwe) {
-        const encryption = this.kryptosMayOverrideEncryption && this.kryptos.encryption
-            ? this.kryptos.encryption
-            : this.encryption;
-        const decoded = JweKit.decode(jwe);
+    decrypt(token) {
+        const kit = new aes_1.AesKit({ encryption: this.encryption, kryptos: this.kryptos });
+        this.logger.debug("Decrypting token", { token });
+        const decoded = JweKit.decode(token);
         if (decoded.header.typ !== "JWE") {
             throw new errors_1.JweError("Invalid token", {
                 data: { typ: decoded.header.typ },
@@ -89,14 +85,19 @@ class JweKit {
             });
         }
         const header = (0, private_2.parseTokenHeader)(decoded.header);
-        const authTag = decoded.authTag ? b64_1.B64.toBuffer(decoded.authTag) : undefined;
+        if (header.encryption !== this.encryption) {
+            throw new errors_1.JweError("Unexpected encryption", {
+                debug: { actual: header.encryption, encryption: this.encryption },
+            });
+        }
+        const authTag = b64_1.B64.toBuffer(decoded.authTag);
         const content = b64_1.B64.toBuffer(decoded.content);
         const hkdfSalt = header.hkdfSalt ? b64_1.B64.toBuffer(header.hkdfSalt, private_1.B64U) : undefined;
         const initialisationVector = b64_1.B64.toBuffer(decoded.initialisationVector);
         const pbkdfIterations = header.pbkdfIterations;
         const pbkdfSalt = header.pbkdfSalt ? b64_1.B64.toBuffer(header.pbkdfSalt, private_1.B64U) : undefined;
-        const publicEncryptionIv = header.publicEncryptionIv
-            ? b64_1.B64.toBuffer(header.publicEncryptionIv)
+        const publicEncryptionIv = header.initialisationVector
+            ? b64_1.B64.toBuffer(header.initialisationVector)
             : undefined;
         const publicEncryptionKey = decoded.publicEncryptionKey
             ? b64_1.B64.toBuffer(decoded.publicEncryptionKey)
@@ -108,7 +109,7 @@ class JweKit {
         if (header.critical.includes("publicEncryptionJwk") && !publicEncryptionJwk) {
             throw new errors_1.JweError("Missing public encryption JWK");
         }
-        if (header.critical.includes("publicEncryptionIv") && !publicEncryptionIv) {
+        if (header.critical.includes("initialisationVector") && !publicEncryptionIv) {
             throw new errors_1.JweError("Missing public encryption iv");
         }
         if (header.critical.includes("publicEncryptionTag") && !publicEncryptionTag) {
@@ -123,11 +124,10 @@ class JweKit {
         if (header.critical.includes("pbkdfSalt") && !pbkdfSalt) {
             throw new errors_1.JweError("Missing salt");
         }
-        const aes = new aes_1.AesKit({ encryption, kryptos: this.kryptos });
-        const payload = aes.decrypt({
+        const payload = kit.decrypt({
             authTag,
             content,
-            encryption,
+            encryption: this.encryption,
             hkdfSalt,
             initialisationVector,
             pbkdfIterations,
@@ -137,30 +137,39 @@ class JweKit {
             publicEncryptionKey,
             publicEncryptionTag,
         });
-        this.logger.silly("Token decrypted", { payload });
-        return {
-            decoded,
-            header,
-            payload,
-            token: jwe,
-        };
+        this.logger.debug("Token decrypted");
+        return { header, payload, decoded, token };
+    }
+    static isJwe(jwe) {
+        return (0, is_1.isJwe)(jwe);
     }
     static decode(jwe) {
         const [header, publicEncryptionKey, initialisationVector, content, authTag] = jwe.split(".");
         return {
-            header: (0, private_2.decodeTokenHeader)(header),
+            header: (0, private_2.decodeJoseHeader)(header),
             publicEncryptionKey: publicEncryptionKey?.length ? publicEncryptionKey : undefined,
             initialisationVector,
             content,
-            authTag: authTag?.length ? authTag : undefined,
+            authTag,
         };
     }
     contentType(input) {
-        if (!input.startsWith("eyJ") && !input.includes(".")) {
-            return "text/plain";
+        if ((0, is_1.isJws)(input)) {
+            return "application/jws";
+        }
+        if ((0, is_1.isJwt)(input)) {
+            return "application/jwt";
+        }
+        if (input.startsWith("{") && input.endsWith("}")) {
+            return "application/json";
+        }
+        if (input.startsWith("[") && input.endsWith("]")) {
+            return "application/json";
+        }
+        if ((0, is_1.isString)(input)) {
+            return "text/plain; charset=utf-8";
         }
-        const [header] = input.split(".");
-        return (0, private_2.decodeTokenHeader)(header).typ;
+        return "application/unknown";
     }
 }
 exports.JweKit = JweKit;