@logto/connector-apple 1.0.1 → 1.0.3

package/LICENSE

@@ -1,9 +1,3 @@
-Portions of this software are licensed as follows:
-
-* All content that resides under the "packages/cloud" directory of this repository, if that directory exists, is licensed under the license defined in "packages/cloud/LICENSE" (Elastic-2.0).
-* All third party components incorporated into this software are licensed under the original license provided by the owner of the applicable component.
-* Content outside of the above mentioned directories or restrictions above is available under the "MPL-2.0" license as defined below.
-
 Mozilla Public License Version 2.0
 ==================================
 

package/README.md

@@ -2,8 +2,6 @@
 
 The official Logto connector for Apple social sign-in.
 
-Apple 社交登录 Logto 官方连接器 [中文文档](#apple-连接器)
-
 **Table of contents**
 
 - [Apple connector](#apple-connector)
@@ -12,12 +10,6 @@ Apple 社交登录 Logto 官方连接器 [中文文档](#apple-连接器)
     - [Create an identifier](#create-an-identifier)
     - [Enable Sign in with Apple for your identifier](#enable-sign-in-with-apple-for-your-identifier)
   - [Test Apple connector](#test-apple-connector)
-- [Apple 连接器](#apple-连接器)
-  - [开始上手](#开始上手)
-    - [为你的应用启用「通过 Apple 登录」](#为你的应用启用通过-apple-登录)
-    - [创建一个 identifier](#创建一个-identifier)
-    - [为你的 identifier 启用「通过 Apple 登录」](#为你的-identifier-启用通过-apple-登录)
-  - [测试 Apple 连接器](#测试-apple-连接器)
 
 ## Get started
 
@@ -77,66 +69,4 @@ Click "Next" then "Done" to close the modal. Click "Continue" on the top-right c
 
 ## Test Apple connector
 
-That's it. The Apple connector should be available in both web and native apps. Don't forget to [Enable connector in sign-in experience](https://docs.logto.io/docs/tutorials/get-started/enable-social-sign-in#enable-connector-in-sign-in-experience).
-
-# Apple 连接器
-
-## 开始上手
-
-如果你还不知道连接器的概念，或者还不知道如何将本连接器添加至你的「登录体验」，请先参见 [Logto 教程](https://docs.logto.io/zh-cn/docs/tutorials/get-started/enable-social-sign-in)。
-
-> ℹ️ **Note**
-> 
-> 如果你的应用有其他的社交登录方式，AppStore 要求必须同时有 Apple 登录。
-> 如果同时提供 Android 应用，在 Android 设备上同时提供 Apple 登录会让用户体验很棒。
-
-在继续前，你需要加入 [Apple Developer Program](https://developer.apple.com/programs/)。
-
-### 为你的应用启用「通过 Apple 登录」
-
-> ⚠️ **Caution**
-> 
-> 即使你只想在 web 应用中实现「通过 Apple 登录」，你仍需要拥有一个拥抱 AppStore 生态的应用（即：有一个有效的 App ID）。
-
-你可以通过 Xcode -> Project settings -> Signing & Capabilities 来启用，或者访问 [Certificates, Identifiers & Profiles](https://developer.apple.com/account/resources/identifiers/list/bundleId)。
-
-![Enable Sign in with Apple](/packages/connector-apple/docs/enable-sign-in-with-apple-in-xcode.png)
-
-参见 [Apple 官方文档](https://developer.apple.com/documentation/sign_in_with_apple/configuring_your_environment_for_sign_in_with_apple) 里的「Enable an App ID」章节以了解更多。
-
-### 创建一个 identifier
-
-1. 访问 [Certificates, Identifiers & Profiles](https://developer.apple.com/account/resources/identifiers/list/serviceId)，并点按在「Identifier」旁边的「+」按钮。
-2. 在「Register a new identifier」页面，选择「Services IDs」并点按「Continue」。
-3. 填写「Description」与「Identifier」（例如 `Logto Test` 和 `io.logto.test`），并点按「Continue」。
-4. 再次检查相关信息并点按「Register」。
-
-### 为你的 identifier 启用「通过 Apple 登录」
-
-点按你刚刚创建的 identifier。在详情页勾选「Sign in with Apple」并点按「Configure」。
-
-![Enable Sign in with Apple](/packages/connector-apple/docs/enable-sign-in-with-apple.png)
-
-在打开的对话框中，选择刚刚启用了「通过 Apple 登录」的 App ID。
-
-输入你的 Logto 实例域名（不含协议和端口），例如 `your.logto.domain`；并输入「Return URL」（即 Redirect URI）。Return URL 的值是 Logto URL 加上 `/callback/${connector_id}`，例如 `https://your.logto.domain/callback/apple-universal`。在管理控制台创建了 Apple 连接器之后，在详情页可以找到生成的随机 `connector_id`。
-
-![domain-and-url](/packages/connector-apple/docs/domain-and-url.png)
-
-点按「Next」以及「Done」以关闭对话框。点按右上角的「Continue」，接着点按「Save」以保存你的配置。
-
-> ⚠️ **Caution**
-> 
-> Apple _不允许_ HTTP 协议或 `localhost` 域名作为 Return URL。
-> 
-> 如果你想在本地进行测试，你需要编辑 `/etc/hosts` 文件以映射 localhost 到一个自定义域名，并设置一个本地的 HTTPS 环境。[mkcert](https://github.com/FiloSottile/mkcert) 可以帮助你设置本地 HTTPS。
-
-> ℹ️ **Note**
-> 
-> 本连接器暂时不支持自定义 `scope`（例如 name，email）。因为在 `scope` 非空时，Apple 要求 `response_mode` 为 `form_post`，与现在连接器的设计不兼容。
-> 
-> 我们将稍后解决这个问题。
-
-## 测试 Apple 连接器
-
-大功告成。Apple 连接器应该在 web 和原生应用中都可用了。别忘了 [在登录体验中启用本连接器](https://docs.logto.io/zh-cn/docs/tutorials/get-started/enable-social-sign-in/#%E5%9C%A8%E7%99%BB%E5%BD%95%E4%BD%93%E9%AA%8C%E4%B8%AD%E5%90%AF%E7%94%A8%E8%BF%9E%E6%8E%A5%E5%99%A8)。
+That's it. The Apple connector should be available in both web and native apps. Don't forget to [Enable connector in sign-in experience](https://docs.logto.io/docs/tutorials/get-started/passwordless-sign-in-by-adding-connectors#enable-social-sign-in).

package/lib/index.js

@@ -1,13 +1,13 @@
 import { ConnectorPlatform, ConnectorConfigFormItemType, ConnectorType, validateConfig, ConnectorError, ConnectorErrorCodes } from '@logto/connector-kit';
-import * as crypto from 'crypto';
-import { randomFillSync, KeyObject, createPublicKey, createPrivateKey, createSecretKey, constants } from 'crypto';
+import * as crypto from 'node:crypto';
+import crypto__default, { KeyObject, createPrivateKey, createPublicKey, constants, createSecretKey } from 'node:crypto';
 import { z } from 'zod';
-import { Buffer as Buffer$1 } from 'buffer';
-import * as util from 'util';
-import { promisify } from 'util';
-import * as http from 'http';
-import * as https from 'https';
-import { once } from 'events';
+import * as http from 'node:http';
+import * as https from 'node:https';
+import { once } from 'node:events';
+import { Buffer as Buffer$1 } from 'node:buffer';
+import * as util from 'node:util';
+import { promisify } from 'node:util';
 
 // https://github.com/facebook/jest/issues/7547
 const assert = (value, error) => {
@@ -20,22 +20,22 @@ const assert = (value, error) => {
 
 const POOL_SIZE_MULTIPLIER = 128;
 let pool, poolOffset;
-let fillPool = bytes => {
+function fillPool(bytes) {
   if (!pool || pool.length < bytes) {
     pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
-    randomFillSync(pool);
+    crypto__default.getRandomValues(pool);
     poolOffset = 0;
   } else if (poolOffset + bytes > pool.length) {
-    randomFillSync(pool);
+    crypto__default.getRandomValues(pool);
     poolOffset = 0;
   }
   poolOffset += bytes;
-};
-let random = bytes => {
+}
+function random(bytes) {
   fillPool((bytes -= 0));
   return pool.subarray(poolOffset - bytes, poolOffset)
-};
-let customRandom = (alphabet, defaultSize, getRandom) => {
+}
+function customRandom(alphabet, defaultSize, getRandom) {
   let mask = (2 << (31 - Math.clz32((alphabet.length - 1) | 1))) - 1;
   let step = Math.ceil((1.6 * mask * defaultSize) / alphabet.length);
   return (size = defaultSize) => {
@@ -49,14 +49,33 @@ let customRandom = (alphabet, defaultSize, getRandom) => {
       }
     }
   }
-};
-let customAlphabet = (alphabet, size = 21) =>
-  customRandom(alphabet, size, random);
+}
+function customAlphabet(alphabet, size = 21) {
+  return customRandom(alphabet, size, random)
+}
 
 const lowercaseAlphabet = '0123456789abcdefghijklmnopqrstuvwxyz';
 const alphabet = `${lowercaseAlphabet}ABCDEFGHIJKLMNOPQRSTUVWXYZ`;
-const buildIdGenerator = (size, includingUppercase = false) => customAlphabet(includingUppercase ? alphabet : lowercaseAlphabet, size);
-const generateStandardId = buildIdGenerator(21);
+const buildIdGenerator = (size, includingUppercase = true) => customAlphabet(includingUppercase ? alphabet : lowercaseAlphabet, size);
+/**
+ * Generate a standard id with 21 characters, including lowercase letters and numbers.
+ *
+ * @see {@link lowercaseAlphabet}
+ */
+const generateStandardId = buildIdGenerator(21, false);
+/**
+ * Generate a standard short id with 12 characters, including lowercase letters and numbers.
+ *
+ * @see {@link lowercaseAlphabet}
+ */
+buildIdGenerator(12, false);
+/**
+ * Generate a standard secret with 32 characters, including uppercase letters, lowercase
+ * letters, and numbers.
+ *
+ * @see {@link alphabet}
+ */
+buildIdGenerator(32);
 
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
@@ -78,141 +97,109 @@ function normalize(input) {
     }
     return encoded;
 }
-if (Buffer$1.isEncoding('base64url')) ;
-const decode = (input) => Buffer$1.from(normalize(input), 'base64');
+const decode = (input) => new Uint8Array(Buffer$1.from(normalize(input), 'base64'));
 
 class JOSEError extends Error {
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
+    code = 'ERR_JOSE_GENERIC';
     constructor(message) {
-        var _a;
         super(message);
-        this.code = 'ERR_JOSE_GENERIC';
         this.name = this.constructor.name;
-        (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
-    }
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
+        Error.captureStackTrace?.(this, this.constructor);
     }
 }
 class JWTClaimValidationFailed extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
+    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    claim;
+    reason;
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
 }
 class JWTExpired extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
+    code = 'ERR_JWT_EXPIRED';
+    claim;
+    reason;
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
 }
 class JOSEAlgNotAllowed extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
-    }
     static get code() {
         return 'ERR_JOSE_ALG_NOT_ALLOWED';
     }
+    code = 'ERR_JOSE_ALG_NOT_ALLOWED';
 }
 class JOSENotSupported extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JOSE_NOT_SUPPORTED';
-    }
     static get code() {
         return 'ERR_JOSE_NOT_SUPPORTED';
     }
+    code = 'ERR_JOSE_NOT_SUPPORTED';
 }
 class JWSInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWS_INVALID';
-    }
     static get code() {
         return 'ERR_JWS_INVALID';
     }
+    code = 'ERR_JWS_INVALID';
 }
 class JWTInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWT_INVALID';
-    }
     static get code() {
         return 'ERR_JWT_INVALID';
     }
+    code = 'ERR_JWT_INVALID';
 }
 class JWKSInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_INVALID';
-    }
     static get code() {
         return 'ERR_JWKS_INVALID';
     }
+    code = 'ERR_JWKS_INVALID';
 }
 class JWKSNoMatchingKey extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_NO_MATCHING_KEY';
-        this.message = 'no applicable key found in the JSON Web Key Set';
-    }
     static get code() {
         return 'ERR_JWKS_NO_MATCHING_KEY';
     }
+    code = 'ERR_JWKS_NO_MATCHING_KEY';
+    message = 'no applicable key found in the JSON Web Key Set';
 }
 class JWKSMultipleMatchingKeys extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-        this.message = 'multiple matching keys found in the JSON Web Key Set';
-    }
+    [Symbol.asyncIterator];
     static get code() {
         return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     }
+    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+    message = 'multiple matching keys found in the JSON Web Key Set';
 }
 class JWKSTimeout extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_TIMEOUT';
-        this.message = 'request timed out';
-    }
     static get code() {
         return 'ERR_JWKS_TIMEOUT';
     }
+    code = 'ERR_JWKS_TIMEOUT';
+    message = 'request timed out';
 }
 class JWSSignatureVerificationFailed extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-        this.message = 'signature verification failed';
-    }
     static get code() {
         return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     }
+    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+    message = 'signature verification failed';
 }
 
-var isKeyObject = util.types.isKeyObject
-    ? (obj) => util.types.isKeyObject(obj)
-    : (obj) => obj != null && obj instanceof KeyObject;
+var isKeyObject = (obj) => util.types.isKeyObject(obj);
 
-const isCryptoKey = util.types.isCryptoKey
-    ? (key) => util.types.isCryptoKey(key)
-    :
-        (key) => false;
-
-function isCloudflareWorkers() {
-    return false;
-}
+const webcrypto = crypto.webcrypto;
+const isCryptoKey = (key) => util.types.isCryptoKey(key);
 
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
@@ -286,11 +273,6 @@ function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case isCloudflareWorkers() : {
-            if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
-                throw unusable('NODE-ED25519');
-            break;
-        }
         case 'EdDSA': {
             if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
                 throw unusable('Ed25519 or Ed448');
@@ -347,7 +329,7 @@ function withAlg(alg, actual, ...types) {
 
 var isKeyLike = (key) => isKeyObject(key) || isCryptoKey(key);
 const types = ['KeyObject'];
-if (parseInt(process.versions.node) >= 16) {
+if (globalThis.CryptoKey || webcrypto?.CryptoKey) {
     types.push('CryptoKey');
 }
 
@@ -390,11 +372,6 @@ function isObject(input) {
     return Object.getPrototypeOf(input) === proto;
 }
 
-const p256 = Buffer$1.from([42, 134, 72, 206, 61, 3, 1, 7]);
-const p384 = Buffer$1.from([43, 129, 4, 0, 34]);
-const p521 = Buffer$1.from([43, 129, 4, 0, 35]);
-const secp256k1 = Buffer$1.from([43, 129, 4, 0, 10]);
-const weakMap$1 = new WeakMap();
 const namedCurveToJOSE = (namedCurve) => {
     switch (namedCurve) {
         case 'prime256v1':
@@ -410,7 +387,6 @@ const namedCurveToJOSE = (namedCurve) => {
     }
 };
 const getNamedCurve = (kee, raw) => {
-    var _a;
     let key;
     if (isCryptoKey(kee)) {
         key = KeyObject.from(kee);
@@ -432,315 +408,38 @@ const getNamedCurve = (kee, raw) => {
         case 'x448':
             return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
-            if (weakMap$1.has(key)) {
-                return weakMap$1.get(key);
-            }
-            let namedCurve = (_a = key.asymmetricKeyDetails) === null || _a === void 0 ? void 0 : _a.namedCurve;
-            if (!namedCurve && key.type === 'private') {
-                namedCurve = getNamedCurve(createPublicKey(key), true);
-            }
-            else if (!namedCurve) {
-                const buf = key.export({ format: 'der', type: 'spki' });
-                const i = buf[1] < 128 ? 14 : 15;
-                const len = buf[i];
-                const curveOid = buf.slice(i + 1, i + 1 + len);
-                if (curveOid.equals(p256)) {
-                    namedCurve = 'prime256v1';
-                }
-                else if (curveOid.equals(p384)) {
-                    namedCurve = 'secp384r1';
-                }
-                else if (curveOid.equals(p521)) {
-                    namedCurve = 'secp521r1';
-                }
-                else if (curveOid.equals(secp256k1)) {
-                    namedCurve = 'secp256k1';
-                }
-                else {
-                    throw new JOSENotSupported('Unsupported key curve for this operation');
-                }
-            }
-            if (raw)
+            let namedCurve = key.asymmetricKeyDetails.namedCurve;
+            if (raw) {
                 return namedCurve;
-            const curve = namedCurveToJOSE(namedCurve);
-            weakMap$1.set(key, curve);
-            return curve;
+            }
+            return namedCurveToJOSE(namedCurve);
         }
         default:
             throw new TypeError('Invalid asymmetric key type for this operation');
     }
 };
-function setCurve(keyObject, curve) {
-    weakMap$1.set(keyObject, curve);
-}
 
-const weakMap = new WeakMap();
-const getLength = (buf, index) => {
-    let len = buf.readUInt8(1);
-    if ((len & 0x80) === 0) {
-        if (index === 0) {
-            return len;
-        }
-        return getLength(buf.subarray(2 + len), index - 1);
-    }
-    const num = len & 0x7f;
-    len = 0;
-    for (let i = 0; i < num; i++) {
-        len <<= 8;
-        const j = buf.readUInt8(2 + i);
-        len |= j;
-    }
-    if (index === 0) {
-        return len;
-    }
-    return getLength(buf.subarray(2 + len), index - 1);
-};
-const getLengthOfSeqIndex = (sequence, index) => {
-    const len = sequence.readUInt8(1);
-    if ((len & 0x80) === 0) {
-        return getLength(sequence.subarray(2), index);
-    }
-    const num = len & 0x7f;
-    return getLength(sequence.subarray(2 + num), index);
-};
-const getModulusLength = (key) => {
-    var _a, _b;
-    if (weakMap.has(key)) {
-        return weakMap.get(key);
-    }
-    const modulusLength = (_b = (_a = key.asymmetricKeyDetails) === null || _a === void 0 ? void 0 : _a.modulusLength) !== null && _b !== void 0 ? _b : (getLengthOfSeqIndex(key.export({ format: 'der', type: 'pkcs1' }), key.type === 'private' ? 1 : 0) -
-        1) <<
-        3;
-    weakMap.set(key, modulusLength);
-    return modulusLength;
-};
-const setModulusLength = (keyObject, modulusLength) => {
-    weakMap.set(keyObject, modulusLength);
-};
-var checkModulusLength = (key, alg) => {
-    if (getModulusLength(key) < 2048) {
+var checkKeyLength = (key, alg) => {
+    const { modulusLength } = key.asymmetricKeyDetails;
+    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
         throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
     }
 };
 
-const tagInteger = 0x02;
-const tagBitStr = 0x03;
-const tagOctStr = 0x04;
-const tagSequence = 0x30;
-const bZero = Buffer$1.from([0x00]);
-const bTagInteger = Buffer$1.from([tagInteger]);
-const bTagBitStr = Buffer$1.from([tagBitStr]);
-const bTagSequence = Buffer$1.from([tagSequence]);
-const bTagOctStr = Buffer$1.from([tagOctStr]);
-const encodeLength = (len) => {
-    if (len < 128)
-        return Buffer$1.from([len]);
-    const buffer = Buffer$1.alloc(5);
-    buffer.writeUInt32BE(len, 1);
-    let offset = 1;
-    while (buffer[offset] === 0)
-        offset++;
-    buffer[offset - 1] = 0x80 | (5 - offset);
-    return buffer.slice(offset - 1);
-};
-const oids = new Map([
-    ['P-256', Buffer$1.from('06 08 2A 86 48 CE 3D 03 01 07'.replace(/ /g, ''), 'hex')],
-    ['secp256k1', Buffer$1.from('06 05 2B 81 04 00 0A'.replace(/ /g, ''), 'hex')],
-    ['P-384', Buffer$1.from('06 05 2B 81 04 00 22'.replace(/ /g, ''), 'hex')],
-    ['P-521', Buffer$1.from('06 05 2B 81 04 00 23'.replace(/ /g, ''), 'hex')],
-    ['ecPublicKey', Buffer$1.from('06 07 2A 86 48 CE 3D 02 01'.replace(/ /g, ''), 'hex')],
-    ['X25519', Buffer$1.from('06 03 2B 65 6E'.replace(/ /g, ''), 'hex')],
-    ['X448', Buffer$1.from('06 03 2B 65 6F'.replace(/ /g, ''), 'hex')],
-    ['Ed25519', Buffer$1.from('06 03 2B 65 70'.replace(/ /g, ''), 'hex')],
-    ['Ed448', Buffer$1.from('06 03 2B 65 71'.replace(/ /g, ''), 'hex')],
-]);
-class DumbAsn1Encoder {
-    constructor() {
-        this.length = 0;
-        this.elements = [];
-    }
-    oidFor(oid) {
-        const bOid = oids.get(oid);
-        if (!bOid) {
-            throw new JOSENotSupported('Invalid or unsupported OID');
-        }
-        this.elements.push(bOid);
-        this.length += bOid.length;
-    }
-    zero() {
-        this.elements.push(bTagInteger, Buffer$1.from([0x01]), bZero);
-        this.length += 3;
-    }
-    one() {
-        this.elements.push(bTagInteger, Buffer$1.from([0x01]), Buffer$1.from([0x01]));
-        this.length += 3;
-    }
-    unsignedInteger(integer) {
-        if (integer[0] & 0x80) {
-            const len = encodeLength(integer.length + 1);
-            this.elements.push(bTagInteger, len, bZero, integer);
-            this.length += 2 + len.length + integer.length;
-        }
-        else {
-            let i = 0;
-            while (integer[i] === 0 && (integer[i + 1] & 0x80) === 0)
-                i++;
-            const len = encodeLength(integer.length - i);
-            this.elements.push(bTagInteger, encodeLength(integer.length - i), integer.slice(i));
-            this.length += 1 + len.length + integer.length - i;
-        }
-    }
-    octStr(octStr) {
-        const len = encodeLength(octStr.length);
-        this.elements.push(bTagOctStr, encodeLength(octStr.length), octStr);
-        this.length += 1 + len.length + octStr.length;
-    }
-    bitStr(bitS) {
-        const len = encodeLength(bitS.length + 1);
-        this.elements.push(bTagBitStr, encodeLength(bitS.length + 1), bZero, bitS);
-        this.length += 1 + len.length + bitS.length + 1;
-    }
-    add(seq) {
-        this.elements.push(seq);
-        this.length += seq.length;
-    }
-    end(tag = bTagSequence) {
-        const len = encodeLength(this.length);
-        return Buffer$1.concat([tag, len, ...this.elements], 1 + len.length + this.length);
-    }
-}
-
-const [major$2, minor$2] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkImportSupported = major$2 >= 16 || (major$2 === 15 && minor$2 >= 12);
 const parse = (jwk) => {
-    if (jwkImportSupported && jwk.kty !== 'oct') {
-        return jwk.d
-            ? createPrivateKey({ format: 'jwk', key: jwk })
-            : createPublicKey({ format: 'jwk', key: jwk });
-    }
-    switch (jwk.kty) {
-        case 'oct': {
-            return createSecretKey(decode(jwk.k));
-        }
-        case 'RSA': {
-            const enc = new DumbAsn1Encoder();
-            const isPrivate = jwk.d !== undefined;
-            const modulus = Buffer$1.from(jwk.n, 'base64');
-            const exponent = Buffer$1.from(jwk.e, 'base64');
-            if (isPrivate) {
-                enc.zero();
-                enc.unsignedInteger(modulus);
-                enc.unsignedInteger(exponent);
-                enc.unsignedInteger(Buffer$1.from(jwk.d, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.p, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.q, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.dp, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.dq, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.qi, 'base64'));
-            }
-            else {
-                enc.unsignedInteger(modulus);
-                enc.unsignedInteger(exponent);
-            }
-            const der = enc.end();
-            const createInput = {
-                key: der,
-                format: 'der',
-                type: 'pkcs1',
-            };
-            const keyObject = isPrivate ? createPrivateKey(createInput) : createPublicKey(createInput);
-            setModulusLength(keyObject, modulus.length << 3);
-            return keyObject;
-        }
-        case 'EC': {
-            const enc = new DumbAsn1Encoder();
-            const isPrivate = jwk.d !== undefined;
-            const pub = Buffer$1.concat([
-                Buffer$1.alloc(1, 4),
-                Buffer$1.from(jwk.x, 'base64'),
-                Buffer$1.from(jwk.y, 'base64'),
-            ]);
-            if (isPrivate) {
-                enc.zero();
-                const enc$1 = new DumbAsn1Encoder();
-                enc$1.oidFor('ecPublicKey');
-                enc$1.oidFor(jwk.crv);
-                enc.add(enc$1.end());
-                const enc$2 = new DumbAsn1Encoder();
-                enc$2.one();
-                enc$2.octStr(Buffer$1.from(jwk.d, 'base64'));
-                const enc$3 = new DumbAsn1Encoder();
-                enc$3.bitStr(pub);
-                const f2 = enc$3.end(Buffer$1.from([0xa1]));
-                enc$2.add(f2);
-                const f = enc$2.end();
-                const enc$4 = new DumbAsn1Encoder();
-                enc$4.add(f);
-                const f3 = enc$4.end(Buffer$1.from([0x04]));
-                enc.add(f3);
-                const der = enc.end();
-                const keyObject = createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
-                setCurve(keyObject, jwk.crv);
-                return keyObject;
-            }
-            const enc$1 = new DumbAsn1Encoder();
-            enc$1.oidFor('ecPublicKey');
-            enc$1.oidFor(jwk.crv);
-            enc.add(enc$1.end());
-            enc.bitStr(pub);
-            const der = enc.end();
-            const keyObject = createPublicKey({ key: der, format: 'der', type: 'spki' });
-            setCurve(keyObject, jwk.crv);
-            return keyObject;
-        }
-        case 'OKP': {
-            const enc = new DumbAsn1Encoder();
-            const isPrivate = jwk.d !== undefined;
-            if (isPrivate) {
-                enc.zero();
-                const enc$1 = new DumbAsn1Encoder();
-                enc$1.oidFor(jwk.crv);
-                enc.add(enc$1.end());
-                const enc$2 = new DumbAsn1Encoder();
-                enc$2.octStr(Buffer$1.from(jwk.d, 'base64'));
-                const f = enc$2.end(Buffer$1.from([0x04]));
-                enc.add(f);
-                const der = enc.end();
-                return createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
-            }
-            const enc$1 = new DumbAsn1Encoder();
-            enc$1.oidFor(jwk.crv);
-            enc.add(enc$1.end());
-            enc.bitStr(Buffer$1.from(jwk.x, 'base64'));
-            const der = enc.end();
-            return createPublicKey({ key: der, format: 'der', type: 'spki' });
-        }
-        default:
-            throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
-    }
+    return (jwk.d ? createPrivateKey : createPublicKey)({ format: 'jwk', key: jwk });
 };
 
-async function importJWK(jwk, alg, octAsKeyObject) {
-    var _a;
+async function importJWK(jwk, alg) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
+    alg ||= jwk.alg;
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {
                 throw new TypeError('missing "k" (Key Value) Parameter value');
             }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return parse({ ...jwk, alg, ext: (_a = jwk.ext) !== null && _a !== void 0 ? _a : false });
-            }
             return decode(jwk.k);
         case 'RSA':
             if (jwk.oth !== undefined) {
@@ -863,12 +562,6 @@ function dsaDigest(alg) {
     }
 }
 
-const [major$1, minor$1] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const electron = 'electron' in process.versions;
-const rsaPssParams = !electron && (major$1 >= 17 || (major$1 === 16 && minor$1 >= 9));
 const PSS = {
     padding: constants.RSA_PKCS1_PSS_PADDING,
     saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
@@ -892,11 +585,11 @@ function keyForCrypto(alg, key) {
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
-            checkModulusLength(key, alg);
+            checkKeyLength(key, alg);
             return key;
-        case rsaPssParams && 'PS256':
-        case rsaPssParams && 'PS384':
-        case rsaPssParams && 'PS512':
+        case 'PS256':
+        case 'PS384':
+        case 'PS512':
             if (key.asymmetricKeyType === 'rsa-pss') {
                 const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
@@ -911,15 +604,7 @@ function keyForCrypto(alg, key) {
             else if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
             }
-            checkModulusLength(key, alg);
-            return { key, ...PSS };
-        case !rsaPssParams && 'PS256':
-        case !rsaPssParams && 'PS384':
-        case !rsaPssParams && 'PS512':
-            if (key.asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
-            }
-            checkModulusLength(key, alg);
+            checkKeyLength(key, alg);
             return { key, ...PSS };
         case 'ES256':
         case 'ES256K':
@@ -970,13 +655,7 @@ function getSignVerifyKey(alg, key, usage) {
     throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }
 
-let oneShotSign;
-if (crypto.sign.length > 3) {
-    oneShotSign = promisify(crypto.sign);
-}
-else {
-    oneShotSign = crypto.sign;
-}
+const oneShotSign = promisify(crypto.sign);
 const sign = async (alg, key, data) => {
     const keyObject = getSignVerifyKey(alg, key, 'sign');
     if (alg.startsWith('HS')) {
@@ -987,18 +666,7 @@ const sign = async (alg, key, data) => {
     return oneShotSign(dsaDigest(alg), data, keyForCrypto(alg, keyObject));
 };
 
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);
-let oneShotVerify;
-if (crypto.verify.length > 4 && oneShotCallbackSupported) {
-    oneShotVerify = promisify(crypto.verify);
-}
-else {
-    oneShotVerify = crypto.verify;
-}
+const oneShotVerify = promisify(crypto.verify);
 const verify = async (alg, key, signature, data) => {
     const keyObject = getSignVerifyKey(alg, key, 'verify');
     if (alg.startsWith('HS')) {
@@ -1022,7 +690,6 @@ const verify = async (alg, key, signature, data) => {
 };
 
 async function flattenedVerify(jws, key, options) {
-    var _a;
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
     }
@@ -1058,7 +725,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -1072,7 +739,7 @@ async function flattenedVerify(jws, key, options) {
     }
     const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
     if (b64) {
         if (typeof jws.payload !== 'string') {
@@ -1088,15 +755,26 @@ async function flattenedVerify(jws, key, options) {
         resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
-    const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
-    const signature = decode(jws.signature);
+    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
+    let signature;
+    try {
+        signature = decode(jws.signature);
+    }
+    catch {
+        throw new JWSInvalid('Failed to base64url decode the signature');
+    }
     const verified = await verify(alg, key, signature, data);
     if (!verified) {
         throw new JWSSignatureVerificationFailed();
     }
     let payload;
     if (b64) {
-        payload = decode(jws.payload);
+        try {
+            payload = decode(jws.payload);
+        }
+        catch {
+            throw new JWSInvalid('Failed to base64url decode the payload');
+        }
     }
     else if (typeof jws.payload === 'string') {
         payload = encoder.encode(jws.payload);
@@ -1209,15 +887,26 @@ var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
     if (!isObject(payload)) {
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
-    const { issuer } = options;
+    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+    if (maxTokenAge !== undefined)
+        requiredClaims.push('iat');
+    if (audience !== undefined)
+        requiredClaims.push('aud');
+    if (subject !== undefined)
+        requiredClaims.push('sub');
+    if (issuer !== undefined)
+        requiredClaims.push('iss');
+    for (const claim of new Set(requiredClaims.reverse())) {
+        if (!(claim in payload)) {
+            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+        }
+    }
     if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
         throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
     }
-    const { subject } = options;
     if (subject && payload.sub !== subject) {
         throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
     }
-    const { audience } = options;
     if (audience &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
         throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
@@ -1238,7 +927,7 @@ var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
     }
     const { currentDate } = options;
     const now = epoch(currentDate || new Date());
-    if ((payload.iat !== undefined || options.maxTokenAge) && typeof payload.iat !== 'number') {
+    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
         throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
@@ -1257,9 +946,9 @@ var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
             throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
         }
     }
-    if (options.maxTokenAge) {
+    if (maxTokenAge) {
         const age = now - payload.iat;
-        const max = typeof options.maxTokenAge === 'number' ? options.maxTokenAge : secs(options.maxTokenAge);
+        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
         if (age - tolerance > max) {
             throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
         }
@@ -1271,9 +960,8 @@ var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
 };
 
 async function jwtVerify(jwt, key, options) {
-    var _a;
     const verified = await compactVerify(jwt, key, options);
-    if (((_a = verified.protectedHeader.crit) === null || _a === void 0 ? void 0 : _a.includes('b64')) && verified.protectedHeader.b64 === false) {
+    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
@@ -1313,15 +1001,16 @@ function clone(obj) {
     return JSON.parse(JSON.stringify(obj));
 }
 class LocalJWKSet {
+    _jwks;
+    _cached = new WeakMap();
     constructor(jwks) {
-        this._cached = new WeakMap();
         if (!isJWKSLike(jwks)) {
             throw new JWKSInvalid('JSON Web Key Set malformed');
         }
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token.header };
+        const { alg, kid } = { ...protectedHeader, ...token?.header };
         const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;
@@ -1363,18 +1052,33 @@ class LocalJWKSet {
             throw new JWKSNoMatchingKey();
         }
         else if (length !== 1) {
-            throw new JWKSMultipleMatchingKeys();
+            const error = new JWKSMultipleMatchingKeys();
+            const { _cached } = this;
+            error[Symbol.asyncIterator] = async function* () {
+                for (const jwk of candidates) {
+                    try {
+                        yield await importWithAlgCache(_cached, jwk, alg);
+                    }
+                    catch {
+                        continue;
+                    }
+                }
+            };
+            throw error;
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-            }
-            cached[alg] = keyObject;
+        return importWithAlgCache(this._cached, jwk, alg);
+    }
+}
+async function importWithAlgCache(cache, jwk, alg) {
+    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    if (cached[alg] === undefined) {
+        const key = await importJWK({ ...jwk, ext: true }, alg);
+        if (key instanceof Uint8Array || key.type !== 'public') {
+            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
         }
-        return cached[alg];
+        cached[alg] = key;
     }
+    return cached[alg];
 }
 
 const fetchJwks = async (url, timeout, options) => {
@@ -1415,7 +1119,19 @@ const fetchJwks = async (url, timeout, options) => {
     }
 };
 
+function isCloudflareWorkers() {
+    return (typeof WebSocketPair !== 'undefined' ||
+        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
+        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
+}
 class RemoteJWKSet extends LocalJWKSet {
+    _url;
+    _timeoutDuration;
+    _cooldownDuration;
+    _cacheMaxAge;
+    _jwksTimestamp;
+    _pendingFetch;
+    _options;
     constructor(url, options) {
         super({ keys: [] });
         this._jwks = undefined;
@@ -1423,12 +1139,12 @@ class RemoteJWKSet extends LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
+        this._options = { agent: options?.agent, headers: options?.headers };
         this._timeoutDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
+            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
         this._cooldownDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
-        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
+            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
     }
     coolingDown() {
         return typeof this._jwksTimestamp === 'number'
@@ -1459,38 +1175,29 @@ class RemoteJWKSet extends LocalJWKSet {
     }
     async reload() {
         if (this._pendingFetch && isCloudflareWorkers()) {
-            return new Promise((resolve) => {
-                const isDone = () => {
-                    if (this._pendingFetch === undefined) {
-                        resolve();
-                    }
-                    else {
-                        setTimeout(isDone, 5);
-                    }
-                };
-                isDone();
-            });
-        }
-        if (!this._pendingFetch) {
-            this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
-                .then((json) => {
-                if (!isJWKSLike(json)) {
-                    throw new JWKSInvalid('JSON Web Key Set malformed');
-                }
-                this._jwks = { keys: json.keys };
-                this._jwksTimestamp = Date.now();
-                this._pendingFetch = undefined;
-            })
-                .catch((err) => {
-                this._pendingFetch = undefined;
-                throw err;
-            });
+            this._pendingFetch = undefined;
         }
+        this._pendingFetch ||= fetchJwks(this._url, this._timeoutDuration, this._options)
+            .then((json) => {
+            if (!isJWKSLike(json)) {
+                throw new JWKSInvalid('JSON Web Key Set malformed');
+            }
+            this._jwks = { keys: json.keys };
+            this._jwksTimestamp = Date.now();
+            this._pendingFetch = undefined;
+        })
+            .catch((err) => {
+            this._pendingFetch = undefined;
+            throw err;
+        });
         await this._pendingFetch;
     }
 }
 function createRemoteJWKSet(url, options) {
-    return RemoteJWKSet.prototype.getKey.bind(new RemoteJWKSet(url, options));
+    const set = new RemoteJWKSet(url, options);
+    return async function (protectedHeader, token) {
+        return set.getKey(protectedHeader, token);
+    };
 }
 
 // https://appleid.apple.com/.well-known/openid-configuration

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@logto/connector-apple",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Apple web connector implementation.",
   "dependencies": {
-    "@logto/connector-kit": "^1.1.1",
-    "@logto/shared": "^2.0.0",
-    "jose": "^4.3.8"
+    "@logto/connector-kit": "^2.0.0",
+    "@logto/shared": "^3.0.0",
+    "jose": "^5.0.0"
   },
   "main": "./lib/index.js",
   "module": "./lib/index.js",