@lindorm/aegis 0.6.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +17 -0
- package/README.md +142 -180
- package/__tests__/jwe-interop.test.ts +3 -2
- package/__tests__/jwt-interop.test.ts +4 -7
- package/dist/classes/Aegis.d.ts +5 -5
- package/dist/classes/Aegis.d.ts.map +1 -1
- package/dist/classes/Aegis.js +35 -39
- package/dist/classes/Aegis.js.map +1 -1
- package/dist/classes/JweKit.d.ts +2 -2
- package/dist/classes/JweKit.d.ts.map +1 -1
- package/dist/classes/JweKit.js +47 -51
- package/dist/classes/JweKit.js.map +1 -1
- package/dist/classes/JwsKit.d.ts +2 -2
- package/dist/classes/JwsKit.d.ts.map +1 -1
- package/dist/classes/JwsKit.js +32 -36
- package/dist/classes/JwsKit.js.map +1 -1
- package/dist/classes/JwtKit.d.ts +3 -3
- package/dist/classes/JwtKit.d.ts.map +1 -1
- package/dist/classes/JwtKit.js +50 -54
- package/dist/classes/JwtKit.js.map +1 -1
- package/dist/classes/SignatureKit.d.ts +2 -2
- package/dist/classes/SignatureKit.d.ts.map +1 -1
- package/dist/classes/SignatureKit.js +13 -17
- package/dist/classes/SignatureKit.js.map +1 -1
- package/dist/classes/index.d.ts +5 -5
- package/dist/classes/index.d.ts.map +1 -1
- package/dist/classes/index.js +5 -21
- package/dist/classes/index.js.map +1 -1
- package/dist/constants/token-type.js +2 -5
- package/dist/constants/token-type.js.map +1 -1
- package/dist/errors/AegisError.js +2 -6
- package/dist/errors/AegisError.js.map +1 -1
- package/dist/errors/JweError.js +2 -6
- package/dist/errors/JweError.js.map +1 -1
- package/dist/errors/JwsError.js +2 -6
- package/dist/errors/JwsError.js.map +1 -1
- package/dist/errors/JwtError.js +2 -6
- package/dist/errors/JwtError.js.map +1 -1
- package/dist/errors/index.d.ts +4 -4
- package/dist/errors/index.d.ts.map +1 -1
- package/dist/errors/index.js +4 -20
- package/dist/errors/index.js.map +1 -1
- package/dist/guards/index.d.ts +2 -2
- package/dist/guards/index.d.ts.map +1 -1
- package/dist/guards/index.js +2 -18
- package/dist/guards/index.js.map +1 -1
- package/dist/guards/is-parsed-jws.d.ts +1 -1
- package/dist/guards/is-parsed-jws.d.ts.map +1 -1
- package/dist/guards/is-parsed-jws.js +1 -5
- package/dist/guards/is-parsed-jws.js.map +1 -1
- package/dist/guards/is-parsed-jwt.d.ts +1 -1
- package/dist/guards/is-parsed-jwt.d.ts.map +1 -1
- package/dist/guards/is-parsed-jwt.js +1 -5
- package/dist/guards/is-parsed-jwt.js.map +1 -1
- package/dist/index.d.ts +6 -7
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +5 -22
- package/dist/index.js.map +1 -1
- package/dist/interfaces/Aegis.d.ts +3 -3
- package/dist/interfaces/Aegis.d.ts.map +1 -1
- package/dist/interfaces/Aegis.js +1 -2
- package/dist/interfaces/JweKit.d.ts +1 -1
- package/dist/interfaces/JweKit.d.ts.map +1 -1
- package/dist/interfaces/JweKit.js +1 -2
- package/dist/interfaces/JwsKit.d.ts +1 -1
- package/dist/interfaces/JwsKit.d.ts.map +1 -1
- package/dist/interfaces/JwsKit.js +1 -2
- package/dist/interfaces/JwtKit.d.ts +2 -2
- package/dist/interfaces/JwtKit.d.ts.map +1 -1
- package/dist/interfaces/JwtKit.js +1 -2
- package/dist/interfaces/index.d.ts +4 -4
- package/dist/interfaces/index.d.ts.map +1 -1
- package/dist/interfaces/index.js +4 -20
- package/dist/interfaces/index.js.map +1 -1
- package/dist/internal/constants/aegis-profile-keys.js +1 -4
- package/dist/internal/constants/aegis-profile-keys.js.map +1 -1
- package/dist/internal/constants/format.js +1 -4
- package/dist/internal/constants/format.js.map +1 -1
- package/dist/internal/constants/header.js +13 -16
- package/dist/internal/constants/header.js.map +1 -1
- package/dist/internal/utils/compute-jwk-thumbprint.js +5 -9
- package/dist/internal/utils/compute-jwk-thumbprint.js.map +1 -1
- package/dist/internal/utils/compute-typ-header.d.ts +2 -2
- package/dist/internal/utils/compute-typ-header.d.ts.map +1 -1
- package/dist/internal/utils/compute-typ-header.js +6 -12
- package/dist/internal/utils/compute-typ-header.js.map +1 -1
- package/dist/internal/utils/create-hash.d.ts +1 -1
- package/dist/internal/utils/create-hash.d.ts.map +1 -1
- package/dist/internal/utils/create-hash.js +10 -17
- package/dist/internal/utils/create-hash.js.map +1 -1
- package/dist/internal/utils/extract-aegis-profile.d.ts +2 -2
- package/dist/internal/utils/extract-aegis-profile.d.ts.map +1 -1
- package/dist/internal/utils/extract-aegis-profile.js +6 -10
- package/dist/internal/utils/extract-aegis-profile.js.map +1 -1
- package/dist/internal/utils/extract-claims.d.ts +7 -7
- package/dist/internal/utils/extract-claims.d.ts.map +1 -1
- package/dist/internal/utils/extract-claims.js +47 -51
- package/dist/internal/utils/extract-claims.js.map +1 -1
- package/dist/internal/utils/extract-token-delegation.d.ts +2 -2
- package/dist/internal/utils/extract-token-delegation.d.ts.map +1 -1
- package/dist/internal/utils/extract-token-delegation.js +3 -7
- package/dist/internal/utils/extract-token-delegation.js.map +1 -1
- package/dist/internal/utils/generate-token-id.js +4 -8
- package/dist/internal/utils/generate-token-id.js.map +1 -1
- package/dist/internal/utils/jose-header.d.ts +1 -1
- package/dist/internal/utils/jose-header.d.ts.map +1 -1
- package/dist/internal/utils/jose-header.js +14 -19
- package/dist/internal/utils/jose-header.js.map +1 -1
- package/dist/internal/utils/jose-signature.d.ts +1 -1
- package/dist/internal/utils/jose-signature.d.ts.map +1 -1
- package/dist/internal/utils/jose-signature.js +7 -12
- package/dist/internal/utils/jose-signature.js.map +1 -1
- package/dist/internal/utils/jwt-payload.d.ts +3 -3
- package/dist/internal/utils/jwt-payload.d.ts.map +1 -1
- package/dist/internal/utils/jwt-payload.js +79 -86
- package/dist/internal/utils/jwt-payload.js.map +1 -1
- package/dist/internal/utils/jwt-validate.d.ts +2 -2
- package/dist/internal/utils/jwt-validate.d.ts.map +1 -1
- package/dist/internal/utils/jwt-validate.js +13 -17
- package/dist/internal/utils/jwt-validate.js.map +1 -1
- package/dist/internal/utils/jwt-verify.d.ts +3 -3
- package/dist/internal/utils/jwt-verify.d.ts.map +1 -1
- package/dist/internal/utils/jwt-verify.js +18 -22
- package/dist/internal/utils/jwt-verify.js.map +1 -1
- package/dist/internal/utils/parse-introspection.d.ts +2 -2
- package/dist/internal/utils/parse-introspection.d.ts.map +1 -1
- package/dist/internal/utils/parse-introspection.js +12 -16
- package/dist/internal/utils/parse-introspection.js.map +1 -1
- package/dist/internal/utils/parse-userinfo.d.ts +2 -2
- package/dist/internal/utils/parse-userinfo.d.ts.map +1 -1
- package/dist/internal/utils/parse-userinfo.js +10 -14
- package/dist/internal/utils/parse-userinfo.js.map +1 -1
- package/dist/internal/utils/resolve-cert-binding.d.ts +2 -2
- package/dist/internal/utils/resolve-cert-binding.d.ts.map +1 -1
- package/dist/internal/utils/resolve-cert-binding.js +3 -7
- package/dist/internal/utils/resolve-cert-binding.js.map +1 -1
- package/dist/internal/utils/token-header.d.ts +1 -1
- package/dist/internal/utils/token-header.d.ts.map +1 -1
- package/dist/internal/utils/token-header.js +15 -20
- package/dist/internal/utils/token-header.js.map +1 -1
- package/dist/internal/utils/validate-actor.d.ts +1 -1
- package/dist/internal/utils/validate-actor.d.ts.map +1 -1
- package/dist/internal/utils/validate-actor.js +1 -5
- package/dist/internal/utils/validate-actor.js.map +1 -1
- package/dist/internal/utils/validate-crit.js +1 -5
- package/dist/internal/utils/validate-crit.js.map +1 -1
- package/dist/internal/utils/validate.d.ts +1 -1
- package/dist/internal/utils/validate.d.ts.map +1 -1
- package/dist/internal/utils/validate.js +6 -10
- package/dist/internal/utils/validate.js.map +1 -1
- package/dist/internal/utils/verify-cert-binding.d.ts +3 -3
- package/dist/internal/utils/verify-cert-binding.d.ts.map +1 -1
- package/dist/internal/utils/verify-cert-binding.js +4 -8
- package/dist/internal/utils/verify-cert-binding.js.map +1 -1
- package/dist/internal/utils/verify-dpop-proof.d.ts +1 -1
- package/dist/internal/utils/verify-dpop-proof.d.ts.map +1 -1
- package/dist/internal/utils/verify-dpop-proof.js +23 -27
- package/dist/internal/utils/verify-dpop-proof.js.map +1 -1
- package/dist/mocks/create-mock-aegis.d.ts +3 -3
- package/dist/mocks/create-mock-aegis.d.ts.map +1 -1
- package/dist/mocks/create-mock-aegis.js +20 -20
- package/dist/mocks/create-mock-aegis.js.map +1 -1
- package/dist/mocks/jest.d.ts +5 -0
- package/dist/mocks/jest.d.ts.map +1 -0
- package/dist/mocks/jest.js +4 -0
- package/dist/mocks/jest.js.map +1 -0
- package/dist/mocks/vitest.d.ts +6 -0
- package/dist/mocks/vitest.d.ts.map +1 -0
- package/dist/mocks/vitest.js +5 -0
- package/dist/mocks/vitest.js.map +1 -0
- package/dist/types/aegis.d.ts +5 -5
- package/dist/types/aegis.d.ts.map +1 -1
- package/dist/types/aegis.js +1 -2
- package/dist/types/claims/act-claim.js +1 -2
- package/dist/types/claims/aegis-introspection.d.ts +6 -6
- package/dist/types/claims/aegis-introspection.d.ts.map +1 -1
- package/dist/types/claims/aegis-introspection.js +1 -2
- package/dist/types/claims/aegis-profile.js +1 -2
- package/dist/types/claims/aegis-userinfo.d.ts +1 -1
- package/dist/types/claims/aegis-userinfo.d.ts.map +1 -1
- package/dist/types/claims/aegis-userinfo.js +1 -2
- package/dist/types/claims/confirmation-claim.d.ts +1 -1
- package/dist/types/claims/confirmation-claim.d.ts.map +1 -1
- package/dist/types/claims/confirmation-claim.js +1 -2
- package/dist/types/claims/delegation-claims.d.ts +1 -1
- package/dist/types/claims/delegation-claims.d.ts.map +1 -1
- package/dist/types/claims/delegation-claims.js +1 -2
- package/dist/types/claims/index.d.ts +12 -12
- package/dist/types/claims/index.d.ts.map +1 -1
- package/dist/types/claims/index.js +12 -28
- package/dist/types/claims/index.js.map +1 -1
- package/dist/types/claims/jwt/act-claim-wire.js +1 -2
- package/dist/types/claims/jwt/confirmation-claim-wire.d.ts +1 -1
- package/dist/types/claims/jwt/confirmation-claim-wire.d.ts.map +1 -1
- package/dist/types/claims/jwt/confirmation-claim-wire.js +1 -2
- package/dist/types/claims/jwt/delegation-claims-wire.d.ts +1 -1
- package/dist/types/claims/jwt/delegation-claims-wire.d.ts.map +1 -1
- package/dist/types/claims/jwt/delegation-claims-wire.js +1 -2
- package/dist/types/claims/jwt/index.d.ts +9 -9
- package/dist/types/claims/jwt/index.d.ts.map +1 -1
- package/dist/types/claims/jwt/index.js +9 -25
- package/dist/types/claims/jwt/index.js.map +1 -1
- package/dist/types/claims/jwt/jwt-claims.d.ts +6 -6
- package/dist/types/claims/jwt/jwt-claims.d.ts.map +1 -1
- package/dist/types/claims/jwt/jwt-claims.js +1 -2
- package/dist/types/claims/jwt/lindorm-claims-wire.d.ts +2 -2
- package/dist/types/claims/jwt/lindorm-claims-wire.d.ts.map +1 -1
- package/dist/types/claims/jwt/lindorm-claims-wire.js +1 -2
- package/dist/types/claims/jwt/oauth-claims-wire.js +1 -2
- package/dist/types/claims/jwt/oidc-claims-wire.js +1 -2
- package/dist/types/claims/jwt/pop-claims-wire.d.ts +1 -1
- package/dist/types/claims/jwt/pop-claims-wire.d.ts.map +1 -1
- package/dist/types/claims/jwt/pop-claims-wire.js +1 -2
- package/dist/types/claims/jwt/std-claims-wire.js +1 -2
- package/dist/types/claims/lindorm-claims.d.ts +1 -1
- package/dist/types/claims/lindorm-claims.d.ts.map +1 -1
- package/dist/types/claims/lindorm-claims.js +1 -2
- package/dist/types/claims/oauth-claims.js +1 -2
- package/dist/types/claims/oidc-claims.js +1 -2
- package/dist/types/claims/pop-claims.d.ts +1 -1
- package/dist/types/claims/pop-claims.d.ts.map +1 -1
- package/dist/types/claims/pop-claims.js +1 -2
- package/dist/types/claims/std-claims.js +1 -2
- package/dist/types/header.d.ts +3 -3
- package/dist/types/header.d.ts.map +1 -1
- package/dist/types/header.js +1 -2
- package/dist/types/header.js.map +1 -1
- package/dist/types/index.d.ts +9 -9
- package/dist/types/index.d.ts.map +1 -1
- package/dist/types/index.js +9 -25
- package/dist/types/index.js.map +1 -1
- package/dist/types/jwe/index.d.ts +4 -4
- package/dist/types/jwe/index.d.ts.map +1 -1
- package/dist/types/jwe/index.js +4 -20
- package/dist/types/jwe/index.js.map +1 -1
- package/dist/types/jwe/jwe-decode.d.ts +1 -1
- package/dist/types/jwe/jwe-decode.d.ts.map +1 -1
- package/dist/types/jwe/jwe-decode.js +1 -2
- package/dist/types/jwe/jwe-decrypt.d.ts +3 -3
- package/dist/types/jwe/jwe-decrypt.d.ts.map +1 -1
- package/dist/types/jwe/jwe-decrypt.js +1 -2
- package/dist/types/jwe/jwe-encrypt.d.ts +2 -2
- package/dist/types/jwe/jwe-encrypt.d.ts.map +1 -1
- package/dist/types/jwe/jwe-encrypt.js +1 -2
- package/dist/types/jwe/jwe-kit.d.ts +1 -1
- package/dist/types/jwe/jwe-kit.d.ts.map +1 -1
- package/dist/types/jwe/jwe-kit.js +1 -2
- package/dist/types/jws/index.d.ts +4 -4
- package/dist/types/jws/index.d.ts.map +1 -1
- package/dist/types/jws/index.js +4 -20
- package/dist/types/jws/index.js.map +1 -1
- package/dist/types/jws/jws-decode.d.ts +1 -1
- package/dist/types/jws/jws-decode.d.ts.map +1 -1
- package/dist/types/jws/jws-decode.js +1 -2
- package/dist/types/jws/jws-kit.d.ts +1 -1
- package/dist/types/jws/jws-kit.d.ts.map +1 -1
- package/dist/types/jws/jws-kit.js +1 -2
- package/dist/types/jws/jws-parse.d.ts +3 -3
- package/dist/types/jws/jws-parse.d.ts.map +1 -1
- package/dist/types/jws/jws-parse.js +1 -2
- package/dist/types/jws/jws-sign.d.ts +2 -2
- package/dist/types/jws/jws-sign.d.ts.map +1 -1
- package/dist/types/jws/jws-sign.js +1 -2
- package/dist/types/jwt/index.d.ts +9 -9
- package/dist/types/jwt/index.d.ts.map +1 -1
- package/dist/types/jwt/index.js +9 -25
- package/dist/types/jwt/index.js.map +1 -1
- package/dist/types/jwt/jwt-claim-matchers.d.ts +1 -1
- package/dist/types/jwt/jwt-claim-matchers.d.ts.map +1 -1
- package/dist/types/jwt/jwt-claim-matchers.js +1 -2
- package/dist/types/jwt/jwt-decode.d.ts +3 -3
- package/dist/types/jwt/jwt-decode.d.ts.map +1 -1
- package/dist/types/jwt/jwt-decode.js +1 -2
- package/dist/types/jwt/jwt-delegation.d.ts +1 -1
- package/dist/types/jwt/jwt-delegation.d.ts.map +1 -1
- package/dist/types/jwt/jwt-delegation.js +1 -2
- package/dist/types/jwt/jwt-dpop.js +1 -2
- package/dist/types/jwt/jwt-kit.d.ts +1 -1
- package/dist/types/jwt/jwt-kit.d.ts.map +1 -1
- package/dist/types/jwt/jwt-kit.js +1 -2
- package/dist/types/jwt/jwt-parse.d.ts +7 -7
- package/dist/types/jwt/jwt-parse.d.ts.map +1 -1
- package/dist/types/jwt/jwt-parse.js +1 -2
- package/dist/types/jwt/jwt-sign.d.ts +4 -4
- package/dist/types/jwt/jwt-sign.d.ts.map +1 -1
- package/dist/types/jwt/jwt-sign.js +1 -2
- package/dist/types/jwt/jwt-validate.d.ts +3 -3
- package/dist/types/jwt/jwt-validate.d.ts.map +1 -1
- package/dist/types/jwt/jwt-validate.js +1 -2
- package/dist/types/jwt/jwt-verify.d.ts +2 -2
- package/dist/types/jwt/jwt-verify.d.ts.map +1 -1
- package/dist/types/jwt/jwt-verify.js +1 -2
- package/dist/types/kit.d.ts +3 -3
- package/dist/types/kit.d.ts.map +1 -1
- package/dist/types/kit.js +1 -2
- package/dist/types/level-of-assurance.js +1 -2
- package/dist/types/signature-kit.d.ts +2 -2
- package/dist/types/signature-kit.d.ts.map +1 -1
- package/dist/types/signature-kit.js +1 -2
- package/package.json +33 -33
- package/vitest.config.mjs +6 -0
- package/__tests__/__mocks__/cbor.ts +0 -17
- package/dist/mocks/index.d.ts +0 -2
- package/dist/mocks/index.d.ts.map +0 -1
- package/dist/mocks/index.js +0 -6
- package/dist/mocks/index.js.map +0 -1
- package/jest.config.interop.mjs +0 -27
- package/tsconfig.interop.json +0 -9
package/dist/classes/JwsKit.js
CHANGED
|
@@ -1,18 +1,15 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
const verify_cert_binding_1 = require("../internal/utils/verify-cert-binding");
|
|
14
|
-
const validate_crit_1 = require("../internal/utils/validate-crit");
|
|
15
|
-
class JwsKit {
|
|
1
|
+
import { B64 } from "@lindorm/b64";
|
|
2
|
+
import { isBuffer, isString } from "@lindorm/is";
|
|
3
|
+
import { B64U } from "../internal/constants/format.js";
|
|
4
|
+
import { JwsError } from "../errors/index.js";
|
|
5
|
+
import { computeTypHeader, decodeTokenTypeFromTyp, } from "../internal/utils/compute-typ-header.js";
|
|
6
|
+
import { decodeJoseHeader, encodeJoseHeader } from "../internal/utils/jose-header.js";
|
|
7
|
+
import { createJoseSignature, verifyJoseSignature, } from "../internal/utils/jose-signature.js";
|
|
8
|
+
import { parseTokenHeader } from "../internal/utils/token-header.js";
|
|
9
|
+
import { resolveCertBinding } from "../internal/utils/resolve-cert-binding.js";
|
|
10
|
+
import { verifyCertBinding } from "../internal/utils/verify-cert-binding.js";
|
|
11
|
+
import { validateCrit } from "../internal/utils/validate-crit.js";
|
|
12
|
+
export class JwsKit {
|
|
16
13
|
certBindingMode;
|
|
17
14
|
logger;
|
|
18
15
|
kryptos;
|
|
@@ -29,18 +26,18 @@ class JwsKit {
|
|
|
29
26
|
algorithm: this.kryptos.algorithm,
|
|
30
27
|
contentType: options.contentType
|
|
31
28
|
? options.contentType
|
|
32
|
-
:
|
|
29
|
+
: isString(data)
|
|
33
30
|
? "text/plain; charset=utf-8"
|
|
34
31
|
: "application/octet-stream",
|
|
35
|
-
headerType:
|
|
32
|
+
headerType: computeTypHeader(options.tokenType, "jws"),
|
|
36
33
|
jwksUri: this.kryptos.jwksUri ?? undefined,
|
|
37
34
|
keyId: this.kryptos.id,
|
|
38
35
|
objectId,
|
|
39
36
|
};
|
|
40
|
-
const cert =
|
|
41
|
-
const header =
|
|
42
|
-
const payload =
|
|
43
|
-
const signature =
|
|
37
|
+
const cert = resolveCertBinding(this.kryptos, options.bindCertificate);
|
|
38
|
+
const header = encodeJoseHeader(headerOptions, cert);
|
|
39
|
+
const payload = isBuffer(data) ? data.toString(B64U) : B64.encode(data, B64U);
|
|
40
|
+
const signature = createJoseSignature({
|
|
44
41
|
header,
|
|
45
42
|
payload,
|
|
46
43
|
kryptos: this.kryptos,
|
|
@@ -54,22 +51,22 @@ class JwsKit {
|
|
|
54
51
|
const parsed = JwsKit.parse(token);
|
|
55
52
|
if (parsed.header.critical?.length) {
|
|
56
53
|
for (const param of parsed.header.critical) {
|
|
57
|
-
throw new
|
|
54
|
+
throw new JwsError(`Unsupported critical header parameter: ${param}`);
|
|
58
55
|
}
|
|
59
56
|
}
|
|
60
57
|
if (this.kryptos.algorithm !== parsed.header.algorithm) {
|
|
61
|
-
throw new
|
|
58
|
+
throw new JwsError("Invalid token", {
|
|
62
59
|
data: { algorithm: parsed.header.algorithm },
|
|
63
60
|
debug: { expected: this.kryptos.algorithm },
|
|
64
61
|
});
|
|
65
62
|
}
|
|
66
|
-
const verified =
|
|
63
|
+
const verified = verifyJoseSignature(this.kryptos, token);
|
|
67
64
|
if (!verified) {
|
|
68
|
-
throw new
|
|
65
|
+
throw new JwsError("Invalid token", {
|
|
69
66
|
data: { verified, token: token },
|
|
70
67
|
});
|
|
71
68
|
}
|
|
72
|
-
|
|
69
|
+
verifyCertBinding({
|
|
73
70
|
header: {
|
|
74
71
|
x5tS256: parsed.header.x5tS256,
|
|
75
72
|
},
|
|
@@ -87,7 +84,7 @@ class JwsKit {
|
|
|
87
84
|
if (parts.length !== 3)
|
|
88
85
|
return false;
|
|
89
86
|
try {
|
|
90
|
-
const header =
|
|
87
|
+
const header = decodeJoseHeader(parts[0]);
|
|
91
88
|
if (typeof header.alg !== "string")
|
|
92
89
|
return false;
|
|
93
90
|
const typ = header.typ;
|
|
@@ -101,11 +98,11 @@ class JwsKit {
|
|
|
101
98
|
}
|
|
102
99
|
static decode(jws) {
|
|
103
100
|
const [header, payload, signature] = jws.split(".");
|
|
104
|
-
const decodedHeader =
|
|
101
|
+
const decodedHeader = decodeJoseHeader(header);
|
|
105
102
|
return {
|
|
106
103
|
header: decodedHeader,
|
|
107
104
|
payload: decodedHeader.cty === "text/plain; charset=utf-8"
|
|
108
|
-
?
|
|
105
|
+
? B64.toString(payload)
|
|
109
106
|
: payload,
|
|
110
107
|
signature,
|
|
111
108
|
};
|
|
@@ -117,25 +114,24 @@ class JwsKit {
|
|
|
117
114
|
typ !== "JWS" &&
|
|
118
115
|
typ !== "JOSE" &&
|
|
119
116
|
!(typeof typ === "string" && typ.endsWith("+jws"))) {
|
|
120
|
-
throw new
|
|
117
|
+
throw new JwsError("Invalid token", {
|
|
121
118
|
data: { typ },
|
|
122
119
|
details: "Header type must be JWS, JOSE, <type>+jws, or undefined",
|
|
123
120
|
});
|
|
124
121
|
}
|
|
125
|
-
const critError =
|
|
122
|
+
const critError = validateCrit(decoded.header);
|
|
126
123
|
if (critError) {
|
|
127
|
-
throw new
|
|
124
|
+
throw new JwsError(`Invalid crit header: ${critError}`, {
|
|
128
125
|
data: { crit: decoded.header.crit },
|
|
129
126
|
});
|
|
130
127
|
}
|
|
131
|
-
const header =
|
|
132
|
-
header.tokenType =
|
|
128
|
+
const header = parseTokenHeader(decoded.header);
|
|
129
|
+
header.tokenType = decodeTokenTypeFromTyp(typ, "jws");
|
|
133
130
|
header.baseFormat = "JWS";
|
|
134
131
|
const payload = header.contentType === "text/plain; charset=utf-8"
|
|
135
132
|
? decoded.payload
|
|
136
|
-
:
|
|
133
|
+
: B64.toBuffer(decoded.payload, B64U);
|
|
137
134
|
return { decoded, header, payload, token };
|
|
138
135
|
}
|
|
139
136
|
}
|
|
140
|
-
exports.JwsKit = JwsKit;
|
|
141
137
|
//# sourceMappingURL=JwsKit.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"JwsKit.js","sourceRoot":"","sources":["../../src/classes/JwsKit.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"JwsKit.js","sourceRoot":"","sources":["../../src/classes/JwsKit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAY9C,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,MAAM,OAAO,MAAM;IACA,eAAe,CAAkB;IACjC,MAAM,CAAU;IAChB,OAAO,CAAW;IAEnC,YAAmB,OAAsB;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC7D,CAAC;IAEM,IAAI,CACT,IAAO,EACP,UAA0B,EAAE;QAE5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAElC,MAAM,aAAa,GAAuB;YACxC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAC9B,CAAC,CAAC,OAAO,CAAC,WAAW;gBACrB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACd,CAAC,CAAC,2BAA2B;oBAC7B,CAAC,CAAC,0BAA0B;YAChC,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS;YAC1C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACtB,QAAQ;SACT,CAAC;QAEF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE9E,MAAM,SAAS,GAAG,mBAAmB,CAAC;YACpC,MAAM;YACN,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;QAElD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAE7C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAEM,MAAM,CAA4B,KAAa;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAI,KAAK,CAAC,CAAC;QAGtC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC3C,MAAM,IAAI,QAAQ,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAMD,iBAAiB,CAAC;YAChB,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;aAC/B;YACD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,eAAe;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAEpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAIM,MAAM,CAAC,KAAK,CAAC,GAAW;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACvB,OAAO,CACL,GAAG,KAAK,KAAK;gBACb,GAAG,KAAK,MAAM;gBACd,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAClD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,MAAM,CAAC,GAAW;QAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,aAAa,CAAC,GAAG,KAAK,2BAA2B;gBAC/C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACvB,CAAC,CAAC,OAAO;YACb,SAAS;SACV,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAA4B,KAAa;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAErC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/B,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,KAAK,KAAK;YACb,GAAG,KAAK,MAAM;YACd,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAClD,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,GAAG,EAAE;gBACb,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,wBAAwB,SAAS,EAAE,EAAE;gBACtD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAkB,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,CAAC,SAAS,GAAG,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;QAE1B,MAAM,OAAO,GACX,MAAM,CAAC,WAAW,KAAK,2BAA2B;YAChD,CAAC,CAAE,OAAO,CAAC,OAAa;YACxB,CAAC,CAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAO,CAAC;QAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;CACF"}
|
package/dist/classes/JwtKit.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
import { Dict } from "@lindorm/types";
|
|
2
|
-
import { IJwtKit } from "../interfaces";
|
|
3
|
-
import { DecodedJwt, JwtKitOptions, ParsedJwt, ParsedJwtPayload, SignJwtContent, SignJwtOptions, SignedJwt, ValidateJwtOptions, VerifyJwtOptions } from "../types";
|
|
1
|
+
import type { Dict } from "@lindorm/types";
|
|
2
|
+
import type { IJwtKit } from "../interfaces/index.js";
|
|
3
|
+
import type { DecodedJwt, JwtKitOptions, ParsedJwt, ParsedJwtPayload, SignJwtContent, SignJwtOptions, SignedJwt, ValidateJwtOptions, VerifyJwtOptions } from "../types/index.js";
|
|
4
4
|
export declare class JwtKit implements IJwtKit {
|
|
5
5
|
private readonly certBindingMode;
|
|
6
6
|
private readonly clockTolerance;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"JwtKit.d.ts","sourceRoot":"","sources":["../../src/classes/JwtKit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"JwtKit.d.ts","sourceRoot":"","sources":["../../src/classes/JwtKit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAU3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAEV,UAAU,EACV,aAAa,EACb,SAAS,EAET,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,SAAS,EAET,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,mBAAmB,CAAC;AAoB3B,qBAAa,MAAO,YAAW,OAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;gBAEhB,OAAO,EAAE,aAAa;IAUlC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EAC/B,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAC1B,OAAO,GAAE,cAAmB,GAC3B,SAAS;IA0CL,MAAM,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EACjC,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,gBAAqB,GAC5B,SAAS,CAAC,CAAC,CAAC;WA0GD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;WAc3B,MAAM,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC;WAUzD,KAAK,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;WAoCzD,QAAQ,CAAC,CAAC,SAAS,IAAI,GAAG,IAAI,EAC1C,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAC5B,OAAO,EAAE,kBAAkB,GAC1B,IAAI;CAKR"}
|
package/dist/classes/JwtKit.js
CHANGED
|
@@ -1,23 +1,20 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
const resolve_cert_binding_1 = require("../internal/utils/resolve-cert-binding");
|
|
17
|
-
const verify_cert_binding_1 = require("../internal/utils/verify-cert-binding");
|
|
18
|
-
const validate_1 = require("../internal/utils/validate");
|
|
1
|
+
import { JwtError } from "../errors/index.js";
|
|
2
|
+
import { computeTypHeader, decodeTokenTypeFromTyp, } from "../internal/utils/compute-typ-header.js";
|
|
3
|
+
import { extractTokenDelegation } from "../internal/utils/extract-token-delegation.js";
|
|
4
|
+
import { validateActor } from "../internal/utils/validate-actor.js";
|
|
5
|
+
import { validateCrit } from "../internal/utils/validate-crit.js";
|
|
6
|
+
import { verifyDpopProof } from "../internal/utils/verify-dpop-proof.js";
|
|
7
|
+
import { decodeJoseHeader, encodeJoseHeader } from "../internal/utils/jose-header.js";
|
|
8
|
+
import { createJoseSignature, verifyJoseSignature, } from "../internal/utils/jose-signature.js";
|
|
9
|
+
import { createJwtValidate } from "../internal/utils/jwt-validate.js";
|
|
10
|
+
import { decodeJwtPayload, encodeJwtPayload, parseTokenPayload, } from "../internal/utils/jwt-payload.js";
|
|
11
|
+
import { createJwtVerify } from "../internal/utils/jwt-verify.js";
|
|
12
|
+
import { parseTokenHeader } from "../internal/utils/token-header.js";
|
|
13
|
+
import { resolveCertBinding } from "../internal/utils/resolve-cert-binding.js";
|
|
14
|
+
import { verifyCertBinding } from "../internal/utils/verify-cert-binding.js";
|
|
15
|
+
import { validate } from "../internal/utils/validate.js";
|
|
19
16
|
const DEFAULT_DPOP_MAX_SKEW = 60;
|
|
20
|
-
class JwtKit {
|
|
17
|
+
export class JwtKit {
|
|
21
18
|
certBindingMode;
|
|
22
19
|
clockTolerance;
|
|
23
20
|
dpopMaxSkew;
|
|
@@ -35,22 +32,22 @@ class JwtKit {
|
|
|
35
32
|
sign(content, options = {}) {
|
|
36
33
|
this.logger.debug("Signing token", { content, options });
|
|
37
34
|
if (!this.issuer) {
|
|
38
|
-
throw new
|
|
35
|
+
throw new JwtError("Issuer is required to sign JWT");
|
|
39
36
|
}
|
|
40
37
|
const objectId = options.objectId;
|
|
41
38
|
const headerOptions = {
|
|
42
39
|
...(options.header ?? {}),
|
|
43
40
|
algorithm: this.kryptos.algorithm,
|
|
44
41
|
contentType: "application/json",
|
|
45
|
-
headerType:
|
|
42
|
+
headerType: computeTypHeader(content.tokenType, "jwt"),
|
|
46
43
|
jwksUri: this.kryptos.jwksUri ?? undefined,
|
|
47
44
|
keyId: this.kryptos.id,
|
|
48
45
|
objectId,
|
|
49
46
|
};
|
|
50
|
-
const cert =
|
|
51
|
-
const header =
|
|
52
|
-
const { expiresAt, expiresIn, expiresOn, payload, tokenId } =
|
|
53
|
-
const signature =
|
|
47
|
+
const cert = resolveCertBinding(this.kryptos, options.bindCertificate);
|
|
48
|
+
const header = encodeJoseHeader(headerOptions, cert);
|
|
49
|
+
const { expiresAt, expiresIn, expiresOn, payload, tokenId } = encodeJwtPayload({ algorithm: this.kryptos.algorithm, issuer: this.issuer }, content, options);
|
|
50
|
+
const signature = createJoseSignature({
|
|
54
51
|
header,
|
|
55
52
|
payload,
|
|
56
53
|
kryptos: this.kryptos,
|
|
@@ -64,31 +61,31 @@ class JwtKit {
|
|
|
64
61
|
const parsed = JwtKit.parse(token);
|
|
65
62
|
if (parsed.header.critical?.length) {
|
|
66
63
|
for (const param of parsed.header.critical) {
|
|
67
|
-
throw new
|
|
64
|
+
throw new JwtError(`Unsupported critical header parameter: ${param}`);
|
|
68
65
|
}
|
|
69
66
|
}
|
|
70
67
|
if (this.kryptos.algorithm !== parsed.header.algorithm) {
|
|
71
|
-
throw new
|
|
68
|
+
throw new JwtError("Invalid token", {
|
|
72
69
|
data: { algorithm: parsed.header.algorithm },
|
|
73
70
|
debug: { expected: this.kryptos.algorithm },
|
|
74
71
|
});
|
|
75
72
|
}
|
|
76
73
|
if (verify.tokenType !== undefined) {
|
|
77
|
-
const expectedTyp =
|
|
74
|
+
const expectedTyp = computeTypHeader(verify.tokenType, "jwt");
|
|
78
75
|
if (parsed.decoded.header.typ !== expectedTyp) {
|
|
79
|
-
throw new
|
|
76
|
+
throw new JwtError("Invalid token", {
|
|
80
77
|
data: { typ: parsed.decoded.header.typ },
|
|
81
78
|
debug: { expected: expectedTyp },
|
|
82
79
|
});
|
|
83
80
|
}
|
|
84
81
|
}
|
|
85
|
-
const verified =
|
|
82
|
+
const verified = verifyJoseSignature(this.kryptos, token);
|
|
86
83
|
if (!verified) {
|
|
87
|
-
throw new
|
|
84
|
+
throw new JwtError("Invalid token", {
|
|
88
85
|
data: { verified, token: token },
|
|
89
86
|
});
|
|
90
87
|
}
|
|
91
|
-
|
|
88
|
+
verifyCertBinding({
|
|
92
89
|
header: {
|
|
93
90
|
x5tS256: parsed.header.x5tS256,
|
|
94
91
|
},
|
|
@@ -96,7 +93,7 @@ class JwtKit {
|
|
|
96
93
|
logger: this.logger,
|
|
97
94
|
mode: this.certBindingMode,
|
|
98
95
|
});
|
|
99
|
-
const predicate =
|
|
96
|
+
const predicate = createJwtVerify(this.kryptos.algorithm, verify, this.clockTolerance);
|
|
100
97
|
const { decoded: { payload }, } = parsed;
|
|
101
98
|
const withDates = {
|
|
102
99
|
...payload,
|
|
@@ -106,23 +103,23 @@ class JwtKit {
|
|
|
106
103
|
auth_time: payload.auth_time ? new Date(payload.auth_time * 1000) : undefined,
|
|
107
104
|
};
|
|
108
105
|
try {
|
|
109
|
-
|
|
106
|
+
validate(withDates, predicate);
|
|
110
107
|
}
|
|
111
108
|
catch (err) {
|
|
112
|
-
throw new
|
|
109
|
+
throw new JwtError("Invalid token", { data: err.data });
|
|
113
110
|
}
|
|
114
|
-
const actorError =
|
|
111
|
+
const actorError = validateActor(parsed.delegation, verify.actor);
|
|
115
112
|
if (actorError) {
|
|
116
|
-
throw new
|
|
113
|
+
throw new JwtError(actorError);
|
|
117
114
|
}
|
|
118
115
|
const boundThumbprint = parsed.payload.confirmation?.thumbprint;
|
|
119
116
|
if (verify.dpopProof !== undefined) {
|
|
120
117
|
if (!boundThumbprint) {
|
|
121
|
-
throw new
|
|
118
|
+
throw new JwtError("Invalid token: DPoP proof provided but token is not bound", {
|
|
122
119
|
debug: { confirmation: parsed.payload.confirmation },
|
|
123
120
|
});
|
|
124
121
|
}
|
|
125
|
-
parsed.dpop =
|
|
122
|
+
parsed.dpop = verifyDpopProof({
|
|
126
123
|
proof: verify.dpopProof,
|
|
127
124
|
accessToken: token,
|
|
128
125
|
expectedThumbprint: boundThumbprint,
|
|
@@ -130,7 +127,7 @@ class JwtKit {
|
|
|
130
127
|
});
|
|
131
128
|
}
|
|
132
129
|
else if (boundThumbprint && !verify.trustBoundThumbprint) {
|
|
133
|
-
throw new
|
|
130
|
+
throw new JwtError("Invalid token: token is DPoP-bound but no DPoP proof was provided");
|
|
134
131
|
}
|
|
135
132
|
this.logger.debug("Token verified");
|
|
136
133
|
return parsed;
|
|
@@ -142,7 +139,7 @@ class JwtKit {
|
|
|
142
139
|
if (parts.length !== 3)
|
|
143
140
|
return false;
|
|
144
141
|
try {
|
|
145
|
-
const header =
|
|
142
|
+
const header = decodeJoseHeader(parts[0]);
|
|
146
143
|
if (typeof header.alg !== "string")
|
|
147
144
|
return false;
|
|
148
145
|
const typ = header.typ;
|
|
@@ -155,8 +152,8 @@ class JwtKit {
|
|
|
155
152
|
static decode(jwt) {
|
|
156
153
|
const [header, payload, signature] = jwt.split(".");
|
|
157
154
|
return {
|
|
158
|
-
header:
|
|
159
|
-
payload:
|
|
155
|
+
header: decodeJoseHeader(header),
|
|
156
|
+
payload: decodeJwtPayload(payload),
|
|
160
157
|
signature,
|
|
161
158
|
};
|
|
162
159
|
}
|
|
@@ -164,34 +161,33 @@ class JwtKit {
|
|
|
164
161
|
const decoded = JwtKit.decode(token);
|
|
165
162
|
const typ = decoded.header.typ;
|
|
166
163
|
if (typ !== "JWT" && !(typeof typ === "string" && typ.endsWith("+jwt"))) {
|
|
167
|
-
throw new
|
|
164
|
+
throw new JwtError("Invalid token", {
|
|
168
165
|
data: { typ },
|
|
169
166
|
details: "Header type must be JWT or <type>+jwt",
|
|
170
167
|
});
|
|
171
168
|
}
|
|
172
|
-
const critError =
|
|
169
|
+
const critError = validateCrit(decoded.header);
|
|
173
170
|
if (critError) {
|
|
174
|
-
throw new
|
|
171
|
+
throw new JwtError(`Invalid crit header: ${critError}`, {
|
|
175
172
|
data: { crit: decoded.header.crit },
|
|
176
173
|
});
|
|
177
174
|
}
|
|
178
175
|
if (!decoded.payload.iss) {
|
|
179
|
-
throw new
|
|
176
|
+
throw new JwtError("Invalid token", {
|
|
180
177
|
data: { iss: decoded.payload.iss },
|
|
181
178
|
details: "Issuer is required to decode JWT",
|
|
182
179
|
});
|
|
183
180
|
}
|
|
184
|
-
const header =
|
|
185
|
-
header.tokenType =
|
|
181
|
+
const header = parseTokenHeader(decoded.header);
|
|
182
|
+
header.tokenType = decodeTokenTypeFromTyp(typ, "jwt");
|
|
186
183
|
header.baseFormat = "JWT";
|
|
187
|
-
const payload =
|
|
188
|
-
const delegation =
|
|
184
|
+
const payload = parseTokenPayload(decoded.payload);
|
|
185
|
+
const delegation = extractTokenDelegation(decoded.payload);
|
|
189
186
|
return { decoded, delegation, header, payload, token };
|
|
190
187
|
}
|
|
191
188
|
static validate(payload, options) {
|
|
192
|
-
const operators =
|
|
193
|
-
|
|
189
|
+
const operators = createJwtValidate(options);
|
|
190
|
+
validate(payload, operators);
|
|
194
191
|
}
|
|
195
192
|
}
|
|
196
|
-
exports.JwtKit = JwtKit;
|
|
197
193
|
//# sourceMappingURL=JwtKit.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"JwtKit.js","sourceRoot":"","sources":["../../src/classes/JwtKit.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"JwtKit.js","sourceRoot":"","sources":["../../src/classes/JwtKit.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAgBzE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACtF,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAEzD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,MAAM,OAAO,MAAM;IACA,eAAe,CAAkB;IACjC,cAAc,CAAS;IACvB,WAAW,CAAS;IACpB,MAAM,CAAgB;IACtB,MAAM,CAAU;IAChB,OAAO,CAAW;IAEnC,YAAmB,OAAsB;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;QAErC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC;QAC3D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IAClE,CAAC;IAEM,IAAI,CACT,OAA0B,EAC1B,UAA0B,EAAE;QAE5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAElC,MAAM,aAAa,GAAuB;YACxC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YACzB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,WAAW,EAAE,kBAAkB;YAC/B,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS;YAC1C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACtB,QAAQ;SACT,CAAC;QAEF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAErD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAC5E,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC1D,OAAO,EACP,OAAO,CACR,CAAC;QAEF,MAAM,SAAS,GAAG,mBAAmB,CAAC;YACpC,MAAM;YACN,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;QAElD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAE7C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;IAEM,MAAM,CACX,KAAa,EACb,SAA2B,EAAE;QAE7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAI,KAAK,CAAC,CAAC;QAGtC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC3C,MAAM,IAAI,QAAQ,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC9C,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE;oBAClC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE;oBACxC,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;iBACjC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAMD,iBAAiB,CAAC;YAChB,MAAM,EAAE;gBACN,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;aAC/B;YACD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,eAAe;SAC3B,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,eAAe,CAC/B,IAAI,CAAC,OAAO,CAAC,SAAS,EACtB,MAAM,EACN,IAAI,CAAC,cAAc,CACpB,CAAC;QAEF,MAAM,EACJ,OAAO,EAAE,EAAE,OAAO,EAAE,GACrB,GAAG,MAAM,CAAC;QAEX,MAAM,SAAS,GAAG;YAChB,GAAG,OAAO;YACV,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3D,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9E,CAAC;QAEF,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,EAAE,IAAI,EAAG,GAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC;QAEhE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,MAAM,IAAI,QAAQ,CAAC,2DAA2D,EAAE;oBAC9E,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,eAAe,CAAC;gBAC5B,KAAK,EAAE,MAAM,CAAC,SAAS;gBACvB,WAAW,EAAE,KAAK;gBAClB,kBAAkB,EAAE,eAAe;gBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,eAAe,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,QAAQ,CAChB,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAEpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAIM,MAAM,CAAC,KAAK,CAAC,GAAW;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACvB,OAAO,GAAG,KAAK,KAAK,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,MAAM,CAAwB,GAAW;QACrD,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpD,OAAO;YACL,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,gBAAgB,CAAI,OAAO,CAAC;YACrC,SAAS;SACV,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAwB,KAAa;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAI,KAAK,CAAC,CAAC;QAExC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/B,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,GAAG,EAAE;gBACb,OAAO,EAAE,uCAAuC;aACjD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,wBAAwB,SAAS,EAAE,EAAE;gBACtD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE;gBAClC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;gBAClC,OAAO,EAAE,kCAAkC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAkB,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,CAAC,SAAS,GAAG,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;QAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAwB,CAAC,CAAC;QAE5E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,QAAQ,CACpB,OAA4B,EAC5B,OAA2B;QAE3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAE7C,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;CACF"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import { IKeyKit, KeyData } from "@lindorm/types";
|
|
2
|
-
import { SignatureOptions } from "../types";
|
|
1
|
+
import type { IKeyKit, KeyData } from "@lindorm/types";
|
|
2
|
+
import type { SignatureOptions } from "../types/index.js";
|
|
3
3
|
export declare class SignatureKit implements IKeyKit {
|
|
4
4
|
private readonly kit;
|
|
5
5
|
constructor(options: SignatureOptions);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"SignatureKit.d.ts","sourceRoot":"","sources":["../../src/classes/SignatureKit.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"SignatureKit.d.ts","sourceRoot":"","sources":["../../src/classes/SignatureKit.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,qBAAa,YAAa,YAAW,OAAO;IAC1C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAU;gBAEX,OAAO,EAAE,gBAAgB;IAMrC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM;IAI3B,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO;IAIlD,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI;IAI/C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAMnC,OAAO,CAAC,MAAM;CAqBf"}
|
|
@@ -1,13 +1,10 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
const rsa_1 = require("@lindorm/rsa");
|
|
9
|
-
const errors_1 = require("../errors");
|
|
10
|
-
class SignatureKit {
|
|
1
|
+
import { AkpKit } from "@lindorm/akp";
|
|
2
|
+
import { EcKit } from "@lindorm/ec";
|
|
3
|
+
import { OctKit } from "@lindorm/oct";
|
|
4
|
+
import { OkpKit } from "@lindorm/okp";
|
|
5
|
+
import { RsaKit } from "@lindorm/rsa";
|
|
6
|
+
import { AegisError } from "../errors/index.js";
|
|
7
|
+
export class SignatureKit {
|
|
11
8
|
kit;
|
|
12
9
|
constructor(options) {
|
|
13
10
|
this.kit = this.getKit(options);
|
|
@@ -27,19 +24,18 @@ class SignatureKit {
|
|
|
27
24
|
getKit(options) {
|
|
28
25
|
switch (options.kryptos.type) {
|
|
29
26
|
case "AKP":
|
|
30
|
-
return new
|
|
27
|
+
return new AkpKit(options);
|
|
31
28
|
case "EC":
|
|
32
|
-
return new
|
|
29
|
+
return new EcKit(options);
|
|
33
30
|
case "RSA":
|
|
34
|
-
return new
|
|
31
|
+
return new RsaKit(options);
|
|
35
32
|
case "OKP":
|
|
36
|
-
return new
|
|
33
|
+
return new OkpKit(options);
|
|
37
34
|
case "oct":
|
|
38
|
-
return new
|
|
35
|
+
return new OctKit(options);
|
|
39
36
|
default:
|
|
40
|
-
throw new
|
|
37
|
+
throw new AegisError("Unsupported kryptos type");
|
|
41
38
|
}
|
|
42
39
|
}
|
|
43
40
|
}
|
|
44
|
-
exports.SignatureKit = SignatureKit;
|
|
45
41
|
//# sourceMappingURL=SignatureKit.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"SignatureKit.js","sourceRoot":"","sources":["../../src/classes/SignatureKit.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"SignatureKit.js","sourceRoot":"","sources":["../../src/classes/SignatureKit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,MAAM,OAAO,YAAY;IACN,GAAG,CAAU;IAE9B,YAAmB,OAAyB;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAIM,IAAI,CAAC,IAAa;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEM,MAAM,CAAC,IAAa,EAAE,SAAkB;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEM,MAAM,CAAC,IAAa,EAAE,SAAkB;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEM,MAAM,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAIO,MAAM,CAAC,OAAyB;QACtC,QAAQ,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7B,KAAK,KAAK;gBACR,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAE7B,KAAK,IAAI;gBACP,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAE5B,KAAK,KAAK;gBACR,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAE7B,KAAK,KAAK;gBACR,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAE7B,KAAK,KAAK;gBACR,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YAE7B;gBACE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF"}
|
package/dist/classes/index.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
export * from "./Aegis";
|
|
2
|
-
export * from "./JweKit";
|
|
3
|
-
export * from "./JwsKit";
|
|
4
|
-
export * from "./JwtKit";
|
|
5
|
-
export * from "./SignatureKit";
|
|
1
|
+
export * from "./Aegis.js";
|
|
2
|
+
export * from "./JweKit.js";
|
|
3
|
+
export * from "./JwsKit.js";
|
|
4
|
+
export * from "./JwtKit.js";
|
|
5
|
+
export * from "./SignatureKit.js";
|
|
6
6
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/classes/index.ts"],"names":[],"mappings":"AAAA,cAAc,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/classes/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC"}
|
package/dist/classes/index.js
CHANGED
|
@@ -1,22 +1,6 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
-
}
|
|
8
|
-
Object.defineProperty(o, k2, desc);
|
|
9
|
-
}) : (function(o, m, k, k2) {
|
|
10
|
-
if (k2 === undefined) k2 = k;
|
|
11
|
-
o[k2] = m[k];
|
|
12
|
-
}));
|
|
13
|
-
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
14
|
-
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
|
-
};
|
|
16
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
__exportStar(require("./Aegis"), exports);
|
|
18
|
-
__exportStar(require("./JweKit"), exports);
|
|
19
|
-
__exportStar(require("./JwsKit"), exports);
|
|
20
|
-
__exportStar(require("./JwtKit"), exports);
|
|
21
|
-
__exportStar(require("./SignatureKit"), exports);
|
|
1
|
+
export * from "./Aegis.js";
|
|
2
|
+
export * from "./JweKit.js";
|
|
3
|
+
export * from "./JwsKit.js";
|
|
4
|
+
export * from "./JwtKit.js";
|
|
5
|
+
export * from "./SignatureKit.js";
|
|
22
6
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/classes/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/classes/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC"}
|
|
@@ -1,7 +1,4 @@
|
|
|
1
|
-
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.TOKEN_TYPE_TO_SHORT_NAME = exports.KNOWN_TOKEN_TYPES = void 0;
|
|
4
|
-
exports.KNOWN_TOKEN_TYPES = [
|
|
1
|
+
export const KNOWN_TOKEN_TYPES = [
|
|
5
2
|
"access_token",
|
|
6
3
|
"refresh_token",
|
|
7
4
|
"id_token",
|
|
@@ -9,7 +6,7 @@ exports.KNOWN_TOKEN_TYPES = [
|
|
|
9
6
|
"security_event",
|
|
10
7
|
"dpop",
|
|
11
8
|
];
|
|
12
|
-
|
|
9
|
+
export const TOKEN_TYPE_TO_SHORT_NAME = {
|
|
13
10
|
access_token: "at",
|
|
14
11
|
refresh_token: "rt",
|
|
15
12
|
id_token: "JWT",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token-type.js","sourceRoot":"","sources":["../../src/constants/token-type.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"token-type.js","sourceRoot":"","sources":["../../src/constants/token-type.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,cAAc;IACd,eAAe;IACf,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,MAAM;CACE,CAAC;AAMX,MAAM,CAAC,MAAM,wBAAwB,GAAmC;IACtE,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,QAAQ;IACtB,cAAc,EAAE,UAAU;IAC1B,IAAI,EAAE,MAAM;CACb,CAAC"}
|
|
@@ -1,8 +1,4 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
exports.AegisError = void 0;
|
|
4
|
-
const errors_1 = require("@lindorm/errors");
|
|
5
|
-
class AegisError extends errors_1.LindormError {
|
|
1
|
+
import { LindormError } from "@lindorm/errors";
|
|
2
|
+
export class AegisError extends LindormError {
|
|
6
3
|
}
|
|
7
|
-
exports.AegisError = AegisError;
|
|
8
4
|
//# sourceMappingURL=AegisError.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AegisError.js","sourceRoot":"","sources":["../../src/errors/AegisError.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"AegisError.js","sourceRoot":"","sources":["../../src/errors/AegisError.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,OAAO,UAAW,SAAQ,YAAY;CAAG"}
|