@logto/connector-apple 1.0.2 → 1.1.0

package/README.md

@@ -30,7 +30,7 @@ You need to enroll [Apple Developer Program](https://developer.apple.com/program
 
 You can do it via Xcode -> Project settings -> Signing & Capabilities, or visit [Certificates, Identifiers & Profiles](https://developer.apple.com/account/resources/identifiers/list/bundleId).
 
-![Enable Sign in with Apple](/packages/connector-apple/docs/enable-sign-in-with-apple-in-xcode.png)
+![Enable Sign in with Apple](/packages/connectors/connector-apple/docs/enable-sign-in-with-apple-in-xcode.png)
 
 See the "Enable an App ID" section in [Apple official docs](https://developer.apple.com/documentation/sign_in_with_apple/configuring_your_environment_for_sign_in_with_apple) for more info.
 
@@ -45,13 +45,13 @@ See the "Enable an App ID" section in [Apple official docs](https://developer.ap
 
 Click the identifier you just created. Check "Sign in with Apple" on the details page and click "Configure".
 
-![Enable Sign in with Apple](/packages/connector-apple/docs/enable-sign-in-with-apple.png)
+![Enable Sign in with Apple](/packages/connectors/connector-apple/docs/enable-sign-in-with-apple.png)
 
 In the opening modal, select the App ID you just enabled Sign in with Apple.
 
 Enter the domain of your Logto instance without protocol and port, e.g., `your.logto.domain`; then enter the "Return URL" (i.e., Redirect URI), which is the Logto URL with `/callback/${connector_id}`, e.g., `https://your.logto.domain/callback/apple-universal`. You can get the randomly generated `connector_id` after creating Apple connector in Admin Console.
 
-![domain-and-url](/packages/connector-apple/docs/domain-and-url.png)
+![domain-and-url](/packages/connectors/connector-apple/docs/domain-and-url.png)
 
 Click "Next" then "Done" to close the modal. Click "Continue" on the top-right corner, then click "Save" to save your configuration.
 

package/lib/constant.d.ts

@@ -1,8 +1,8 @@
 import type { ConnectorMetadata } from '@logto/connector-kit';
 export declare const issuer = "https://appleid.apple.com";
-export declare const authorizationEndpoint: string;
-export declare const accessTokenEndpoint: string;
-export declare const jwksUri: string;
+export declare const authorizationEndpoint = "https://appleid.apple.com/auth/authorize";
+export declare const accessTokenEndpoint = "https://appleid.apple.com/auth/token";
+export declare const jwksUri = "https://appleid.apple.com/auth/keys";
 export declare const scope = "";
 export declare const defaultMetadata: ConnectorMetadata;
 export declare const defaultTimeout = 5000;

package/lib/index.js

@@ -1,13 +1,13 @@
 import { ConnectorPlatform, ConnectorConfigFormItemType, ConnectorType, validateConfig, ConnectorError, ConnectorErrorCodes } from '@logto/connector-kit';
-import * as crypto from 'crypto';
-import { randomFillSync, KeyObject, createPublicKey, createPrivateKey, createSecretKey, constants } from 'crypto';
+import * as crypto from 'node:crypto';
+import crypto__default, { KeyObject, createPrivateKey, createPublicKey, constants, createSecretKey } from 'node:crypto';
 import { z } from 'zod';
-import { Buffer as Buffer$1 } from 'buffer';
-import * as util from 'util';
-import { promisify } from 'util';
-import * as http from 'http';
-import * as https from 'https';
-import { once } from 'events';
+import * as http from 'node:http';
+import * as https from 'node:https';
+import { once } from 'node:events';
+import { Buffer as Buffer$1 } from 'node:buffer';
+import * as util from 'node:util';
+import { promisify } from 'node:util';
 
 // https://github.com/facebook/jest/issues/7547
 const assert = (value, error) => {
@@ -20,22 +20,22 @@ const assert = (value, error) => {
 
 const POOL_SIZE_MULTIPLIER = 128;
 let pool, poolOffset;
-let fillPool = bytes => {
+function fillPool(bytes) {
   if (!pool || pool.length < bytes) {
     pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER);
-    randomFillSync(pool);
+    crypto__default.getRandomValues(pool);
     poolOffset = 0;
   } else if (poolOffset + bytes > pool.length) {
-    randomFillSync(pool);
+    crypto__default.getRandomValues(pool);
     poolOffset = 0;
   }
   poolOffset += bytes;
-};
-let random = bytes => {
+}
+function random(bytes) {
   fillPool((bytes -= 0));
   return pool.subarray(poolOffset - bytes, poolOffset)
-};
-let customRandom = (alphabet, defaultSize, getRandom) => {
+}
+function customRandom(alphabet, defaultSize, getRandom) {
   let mask = (2 << (31 - Math.clz32((alphabet.length - 1) | 1))) - 1;
   let step = Math.ceil((1.6 * mask * defaultSize) / alphabet.length);
   return (size = defaultSize) => {
@@ -49,9 +49,10 @@ let customRandom = (alphabet, defaultSize, getRandom) => {
       }
     }
   }
-};
-let customAlphabet = (alphabet, size = 21) =>
-  customRandom(alphabet, size, random);
+}
+function customAlphabet(alphabet, size = 21) {
+  return customRandom(alphabet, size, random)
+}
 
 const lowercaseAlphabet = '0123456789abcdefghijklmnopqrstuvwxyz';
 const alphabet = `${lowercaseAlphabet}ABCDEFGHIJKLMNOPQRSTUVWXYZ`;
@@ -96,141 +97,109 @@ function normalize(input) {
     }
     return encoded;
 }
-if (Buffer$1.isEncoding('base64url')) ;
-const decode = (input) => Buffer$1.from(normalize(input), 'base64');
+const decode = (input) => new Uint8Array(Buffer$1.from(normalize(input), 'base64'));
 
 class JOSEError extends Error {
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
+    code = 'ERR_JOSE_GENERIC';
     constructor(message) {
-        var _a;
         super(message);
-        this.code = 'ERR_JOSE_GENERIC';
         this.name = this.constructor.name;
-        (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
-    }
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
+        Error.captureStackTrace?.(this, this.constructor);
     }
 }
 class JWTClaimValidationFailed extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
+    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    claim;
+    reason;
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
 }
 class JWTExpired extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
+    code = 'ERR_JWT_EXPIRED';
+    claim;
+    reason;
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
 }
 class JOSEAlgNotAllowed extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
-    }
     static get code() {
         return 'ERR_JOSE_ALG_NOT_ALLOWED';
     }
+    code = 'ERR_JOSE_ALG_NOT_ALLOWED';
 }
 class JOSENotSupported extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JOSE_NOT_SUPPORTED';
-    }
     static get code() {
         return 'ERR_JOSE_NOT_SUPPORTED';
     }
+    code = 'ERR_JOSE_NOT_SUPPORTED';
 }
 class JWSInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWS_INVALID';
-    }
     static get code() {
         return 'ERR_JWS_INVALID';
     }
+    code = 'ERR_JWS_INVALID';
 }
 class JWTInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWT_INVALID';
-    }
     static get code() {
         return 'ERR_JWT_INVALID';
     }
+    code = 'ERR_JWT_INVALID';
 }
 class JWKSInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_INVALID';
-    }
     static get code() {
         return 'ERR_JWKS_INVALID';
     }
+    code = 'ERR_JWKS_INVALID';
 }
 class JWKSNoMatchingKey extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_NO_MATCHING_KEY';
-        this.message = 'no applicable key found in the JSON Web Key Set';
-    }
     static get code() {
         return 'ERR_JWKS_NO_MATCHING_KEY';
     }
+    code = 'ERR_JWKS_NO_MATCHING_KEY';
+    message = 'no applicable key found in the JSON Web Key Set';
 }
 class JWKSMultipleMatchingKeys extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-        this.message = 'multiple matching keys found in the JSON Web Key Set';
-    }
+    [Symbol.asyncIterator];
     static get code() {
         return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     }
+    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+    message = 'multiple matching keys found in the JSON Web Key Set';
 }
 class JWKSTimeout extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_TIMEOUT';
-        this.message = 'request timed out';
-    }
     static get code() {
         return 'ERR_JWKS_TIMEOUT';
     }
+    code = 'ERR_JWKS_TIMEOUT';
+    message = 'request timed out';
 }
 class JWSSignatureVerificationFailed extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-        this.message = 'signature verification failed';
-    }
     static get code() {
         return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     }
+    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+    message = 'signature verification failed';
 }
 
-var isKeyObject = util.types.isKeyObject
-    ? (obj) => util.types.isKeyObject(obj)
-    : (obj) => obj != null && obj instanceof KeyObject;
+var isKeyObject = (obj) => util.types.isKeyObject(obj);
 
-const isCryptoKey = util.types.isCryptoKey
-    ? (key) => util.types.isCryptoKey(key)
-    :
-        (key) => false;
-
-function isCloudflareWorkers() {
-    return false;
-}
+const webcrypto = crypto.webcrypto;
+const isCryptoKey = (key) => util.types.isCryptoKey(key);
 
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
@@ -304,11 +273,6 @@ function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case isCloudflareWorkers() : {
-            if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
-                throw unusable('NODE-ED25519');
-            break;
-        }
         case 'EdDSA': {
             if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
                 throw unusable('Ed25519 or Ed448');
@@ -365,7 +329,7 @@ function withAlg(alg, actual, ...types) {
 
 var isKeyLike = (key) => isKeyObject(key) || isCryptoKey(key);
 const types = ['KeyObject'];
-if (parseInt(process.versions.node) >= 16) {
+if (globalThis.CryptoKey || webcrypto?.CryptoKey) {
     types.push('CryptoKey');
 }
 
@@ -408,11 +372,6 @@ function isObject(input) {
     return Object.getPrototypeOf(input) === proto;
 }
 
-const p256 = Buffer$1.from([42, 134, 72, 206, 61, 3, 1, 7]);
-const p384 = Buffer$1.from([43, 129, 4, 0, 34]);
-const p521 = Buffer$1.from([43, 129, 4, 0, 35]);
-const secp256k1 = Buffer$1.from([43, 129, 4, 0, 10]);
-const weakMap$1 = new WeakMap();
 const namedCurveToJOSE = (namedCurve) => {
     switch (namedCurve) {
         case 'prime256v1':
@@ -428,7 +387,6 @@ const namedCurveToJOSE = (namedCurve) => {
     }
 };
 const getNamedCurve = (kee, raw) => {
-    var _a;
     let key;
     if (isCryptoKey(kee)) {
         key = KeyObject.from(kee);
@@ -450,315 +408,38 @@ const getNamedCurve = (kee, raw) => {
         case 'x448':
             return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
-            if (weakMap$1.has(key)) {
-                return weakMap$1.get(key);
-            }
-            let namedCurve = (_a = key.asymmetricKeyDetails) === null || _a === void 0 ? void 0 : _a.namedCurve;
-            if (!namedCurve && key.type === 'private') {
-                namedCurve = getNamedCurve(createPublicKey(key), true);
-            }
-            else if (!namedCurve) {
-                const buf = key.export({ format: 'der', type: 'spki' });
-                const i = buf[1] < 128 ? 14 : 15;
-                const len = buf[i];
-                const curveOid = buf.slice(i + 1, i + 1 + len);
-                if (curveOid.equals(p256)) {
-                    namedCurve = 'prime256v1';
-                }
-                else if (curveOid.equals(p384)) {
-                    namedCurve = 'secp384r1';
-                }
-                else if (curveOid.equals(p521)) {
-                    namedCurve = 'secp521r1';
-                }
-                else if (curveOid.equals(secp256k1)) {
-                    namedCurve = 'secp256k1';
-                }
-                else {
-                    throw new JOSENotSupported('Unsupported key curve for this operation');
-                }
-            }
-            if (raw)
+            let namedCurve = key.asymmetricKeyDetails.namedCurve;
+            if (raw) {
                 return namedCurve;
-            const curve = namedCurveToJOSE(namedCurve);
-            weakMap$1.set(key, curve);
-            return curve;
+            }
+            return namedCurveToJOSE(namedCurve);
         }
         default:
             throw new TypeError('Invalid asymmetric key type for this operation');
     }
 };
-function setCurve(keyObject, curve) {
-    weakMap$1.set(keyObject, curve);
-}
 
-const weakMap = new WeakMap();
-const getLength = (buf, index) => {
-    let len = buf.readUInt8(1);
-    if ((len & 0x80) === 0) {
-        if (index === 0) {
-            return len;
-        }
-        return getLength(buf.subarray(2 + len), index - 1);
-    }
-    const num = len & 0x7f;
-    len = 0;
-    for (let i = 0; i < num; i++) {
-        len <<= 8;
-        const j = buf.readUInt8(2 + i);
-        len |= j;
-    }
-    if (index === 0) {
-        return len;
-    }
-    return getLength(buf.subarray(2 + len), index - 1);
-};
-const getLengthOfSeqIndex = (sequence, index) => {
-    const len = sequence.readUInt8(1);
-    if ((len & 0x80) === 0) {
-        return getLength(sequence.subarray(2), index);
-    }
-    const num = len & 0x7f;
-    return getLength(sequence.subarray(2 + num), index);
-};
-const getModulusLength = (key) => {
-    var _a, _b;
-    if (weakMap.has(key)) {
-        return weakMap.get(key);
-    }
-    const modulusLength = (_b = (_a = key.asymmetricKeyDetails) === null || _a === void 0 ? void 0 : _a.modulusLength) !== null && _b !== void 0 ? _b : (getLengthOfSeqIndex(key.export({ format: 'der', type: 'pkcs1' }), key.type === 'private' ? 1 : 0) -
-        1) <<
-        3;
-    weakMap.set(key, modulusLength);
-    return modulusLength;
-};
-const setModulusLength = (keyObject, modulusLength) => {
-    weakMap.set(keyObject, modulusLength);
-};
-var checkModulusLength = (key, alg) => {
-    if (getModulusLength(key) < 2048) {
+var checkKeyLength = (key, alg) => {
+    const { modulusLength } = key.asymmetricKeyDetails;
+    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
         throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
     }
 };
 
-const tagInteger = 0x02;
-const tagBitStr = 0x03;
-const tagOctStr = 0x04;
-const tagSequence = 0x30;
-const bZero = Buffer$1.from([0x00]);
-const bTagInteger = Buffer$1.from([tagInteger]);
-const bTagBitStr = Buffer$1.from([tagBitStr]);
-const bTagSequence = Buffer$1.from([tagSequence]);
-const bTagOctStr = Buffer$1.from([tagOctStr]);
-const encodeLength = (len) => {
-    if (len < 128)
-        return Buffer$1.from([len]);
-    const buffer = Buffer$1.alloc(5);
-    buffer.writeUInt32BE(len, 1);
-    let offset = 1;
-    while (buffer[offset] === 0)
-        offset++;
-    buffer[offset - 1] = 0x80 | (5 - offset);
-    return buffer.slice(offset - 1);
-};
-const oids = new Map([
-    ['P-256', Buffer$1.from('06 08 2A 86 48 CE 3D 03 01 07'.replace(/ /g, ''), 'hex')],
-    ['secp256k1', Buffer$1.from('06 05 2B 81 04 00 0A'.replace(/ /g, ''), 'hex')],
-    ['P-384', Buffer$1.from('06 05 2B 81 04 00 22'.replace(/ /g, ''), 'hex')],
-    ['P-521', Buffer$1.from('06 05 2B 81 04 00 23'.replace(/ /g, ''), 'hex')],
-    ['ecPublicKey', Buffer$1.from('06 07 2A 86 48 CE 3D 02 01'.replace(/ /g, ''), 'hex')],
-    ['X25519', Buffer$1.from('06 03 2B 65 6E'.replace(/ /g, ''), 'hex')],
-    ['X448', Buffer$1.from('06 03 2B 65 6F'.replace(/ /g, ''), 'hex')],
-    ['Ed25519', Buffer$1.from('06 03 2B 65 70'.replace(/ /g, ''), 'hex')],
-    ['Ed448', Buffer$1.from('06 03 2B 65 71'.replace(/ /g, ''), 'hex')],
-]);
-class DumbAsn1Encoder {
-    constructor() {
-        this.length = 0;
-        this.elements = [];
-    }
-    oidFor(oid) {
-        const bOid = oids.get(oid);
-        if (!bOid) {
-            throw new JOSENotSupported('Invalid or unsupported OID');
-        }
-        this.elements.push(bOid);
-        this.length += bOid.length;
-    }
-    zero() {
-        this.elements.push(bTagInteger, Buffer$1.from([0x01]), bZero);
-        this.length += 3;
-    }
-    one() {
-        this.elements.push(bTagInteger, Buffer$1.from([0x01]), Buffer$1.from([0x01]));
-        this.length += 3;
-    }
-    unsignedInteger(integer) {
-        if (integer[0] & 0x80) {
-            const len = encodeLength(integer.length + 1);
-            this.elements.push(bTagInteger, len, bZero, integer);
-            this.length += 2 + len.length + integer.length;
-        }
-        else {
-            let i = 0;
-            while (integer[i] === 0 && (integer[i + 1] & 0x80) === 0)
-                i++;
-            const len = encodeLength(integer.length - i);
-            this.elements.push(bTagInteger, encodeLength(integer.length - i), integer.slice(i));
-            this.length += 1 + len.length + integer.length - i;
-        }
-    }
-    octStr(octStr) {
-        const len = encodeLength(octStr.length);
-        this.elements.push(bTagOctStr, encodeLength(octStr.length), octStr);
-        this.length += 1 + len.length + octStr.length;
-    }
-    bitStr(bitS) {
-        const len = encodeLength(bitS.length + 1);
-        this.elements.push(bTagBitStr, encodeLength(bitS.length + 1), bZero, bitS);
-        this.length += 1 + len.length + bitS.length + 1;
-    }
-    add(seq) {
-        this.elements.push(seq);
-        this.length += seq.length;
-    }
-    end(tag = bTagSequence) {
-        const len = encodeLength(this.length);
-        return Buffer$1.concat([tag, len, ...this.elements], 1 + len.length + this.length);
-    }
-}
-
-const [major$2, minor$2] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkImportSupported = major$2 >= 16 || (major$2 === 15 && minor$2 >= 12);
 const parse = (jwk) => {
-    if (jwkImportSupported && jwk.kty !== 'oct') {
-        return jwk.d
-            ? createPrivateKey({ format: 'jwk', key: jwk })
-            : createPublicKey({ format: 'jwk', key: jwk });
-    }
-    switch (jwk.kty) {
-        case 'oct': {
-            return createSecretKey(decode(jwk.k));
-        }
-        case 'RSA': {
-            const enc = new DumbAsn1Encoder();
-            const isPrivate = jwk.d !== undefined;
-            const modulus = Buffer$1.from(jwk.n, 'base64');
-            const exponent = Buffer$1.from(jwk.e, 'base64');
-            if (isPrivate) {
-                enc.zero();
-                enc.unsignedInteger(modulus);
-                enc.unsignedInteger(exponent);
-                enc.unsignedInteger(Buffer$1.from(jwk.d, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.p, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.q, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.dp, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.dq, 'base64'));
-                enc.unsignedInteger(Buffer$1.from(jwk.qi, 'base64'));
-            }
-            else {
-                enc.unsignedInteger(modulus);
-                enc.unsignedInteger(exponent);
-            }
-            const der = enc.end();
-            const createInput = {
-                key: der,
-                format: 'der',
-                type: 'pkcs1',
-            };
-            const keyObject = isPrivate ? createPrivateKey(createInput) : createPublicKey(createInput);
-            setModulusLength(keyObject, modulus.length << 3);
-            return keyObject;
-        }
-        case 'EC': {
-            const enc = new DumbAsn1Encoder();
-            const isPrivate = jwk.d !== undefined;
-            const pub = Buffer$1.concat([
-                Buffer$1.alloc(1, 4),
-                Buffer$1.from(jwk.x, 'base64'),
-                Buffer$1.from(jwk.y, 'base64'),
-            ]);
-            if (isPrivate) {
-                enc.zero();
-                const enc$1 = new DumbAsn1Encoder();
-                enc$1.oidFor('ecPublicKey');
-                enc$1.oidFor(jwk.crv);
-                enc.add(enc$1.end());
-                const enc$2 = new DumbAsn1Encoder();
-                enc$2.one();
-                enc$2.octStr(Buffer$1.from(jwk.d, 'base64'));
-                const enc$3 = new DumbAsn1Encoder();
-                enc$3.bitStr(pub);
-                const f2 = enc$3.end(Buffer$1.from([0xa1]));
-                enc$2.add(f2);
-                const f = enc$2.end();
-                const enc$4 = new DumbAsn1Encoder();
-                enc$4.add(f);
-                const f3 = enc$4.end(Buffer$1.from([0x04]));
-                enc.add(f3);
-                const der = enc.end();
-                const keyObject = createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
-                setCurve(keyObject, jwk.crv);
-                return keyObject;
-            }
-            const enc$1 = new DumbAsn1Encoder();
-            enc$1.oidFor('ecPublicKey');
-            enc$1.oidFor(jwk.crv);
-            enc.add(enc$1.end());
-            enc.bitStr(pub);
-            const der = enc.end();
-            const keyObject = createPublicKey({ key: der, format: 'der', type: 'spki' });
-            setCurve(keyObject, jwk.crv);
-            return keyObject;
-        }
-        case 'OKP': {
-            const enc = new DumbAsn1Encoder();
-            const isPrivate = jwk.d !== undefined;
-            if (isPrivate) {
-                enc.zero();
-                const enc$1 = new DumbAsn1Encoder();
-                enc$1.oidFor(jwk.crv);
-                enc.add(enc$1.end());
-                const enc$2 = new DumbAsn1Encoder();
-                enc$2.octStr(Buffer$1.from(jwk.d, 'base64'));
-                const f = enc$2.end(Buffer$1.from([0x04]));
-                enc.add(f);
-                const der = enc.end();
-                return createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
-            }
-            const enc$1 = new DumbAsn1Encoder();
-            enc$1.oidFor(jwk.crv);
-            enc.add(enc$1.end());
-            enc.bitStr(Buffer$1.from(jwk.x, 'base64'));
-            const der = enc.end();
-            return createPublicKey({ key: der, format: 'der', type: 'spki' });
-        }
-        default:
-            throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
-    }
+    return (jwk.d ? createPrivateKey : createPublicKey)({ format: 'jwk', key: jwk });
 };
 
-async function importJWK(jwk, alg, octAsKeyObject) {
-    var _a;
+async function importJWK(jwk, alg) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
+    alg ||= jwk.alg;
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {
                 throw new TypeError('missing "k" (Key Value) Parameter value');
             }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return parse({ ...jwk, alg, ext: (_a = jwk.ext) !== null && _a !== void 0 ? _a : false });
-            }
             return decode(jwk.k);
         case 'RSA':
             if (jwk.oth !== undefined) {
@@ -881,12 +562,6 @@ function dsaDigest(alg) {
     }
 }
 
-const [major$1, minor$1] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const electron = 'electron' in process.versions;
-const rsaPssParams = !electron && (major$1 >= 17 || (major$1 === 16 && minor$1 >= 9));
 const PSS = {
     padding: constants.RSA_PKCS1_PSS_PADDING,
     saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
@@ -910,11 +585,11 @@ function keyForCrypto(alg, key) {
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
-            checkModulusLength(key, alg);
+            checkKeyLength(key, alg);
             return key;
-        case rsaPssParams && 'PS256':
-        case rsaPssParams && 'PS384':
-        case rsaPssParams && 'PS512':
+        case 'PS256':
+        case 'PS384':
+        case 'PS512':
             if (key.asymmetricKeyType === 'rsa-pss') {
                 const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
@@ -929,15 +604,7 @@ function keyForCrypto(alg, key) {
             else if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
             }
-            checkModulusLength(key, alg);
-            return { key, ...PSS };
-        case !rsaPssParams && 'PS256':
-        case !rsaPssParams && 'PS384':
-        case !rsaPssParams && 'PS512':
-            if (key.asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
-            }
-            checkModulusLength(key, alg);
+            checkKeyLength(key, alg);
             return { key, ...PSS };
         case 'ES256':
         case 'ES256K':
@@ -988,13 +655,7 @@ function getSignVerifyKey(alg, key, usage) {
     throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }
 
-let oneShotSign;
-if (crypto.sign.length > 3) {
-    oneShotSign = promisify(crypto.sign);
-}
-else {
-    oneShotSign = crypto.sign;
-}
+const oneShotSign = promisify(crypto.sign);
 const sign = async (alg, key, data) => {
     const keyObject = getSignVerifyKey(alg, key, 'sign');
     if (alg.startsWith('HS')) {
@@ -1005,18 +666,7 @@ const sign = async (alg, key, data) => {
     return oneShotSign(dsaDigest(alg), data, keyForCrypto(alg, keyObject));
 };
 
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);
-let oneShotVerify;
-if (crypto.verify.length > 4 && oneShotCallbackSupported) {
-    oneShotVerify = promisify(crypto.verify);
-}
-else {
-    oneShotVerify = crypto.verify;
-}
+const oneShotVerify = promisify(crypto.verify);
 const verify = async (alg, key, signature, data) => {
     const keyObject = getSignVerifyKey(alg, key, 'verify');
     if (alg.startsWith('HS')) {
@@ -1040,7 +690,6 @@ const verify = async (alg, key, signature, data) => {
 };
 
 async function flattenedVerify(jws, key, options) {
-    var _a;
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
     }
@@ -1076,7 +725,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -1090,7 +739,7 @@ async function flattenedVerify(jws, key, options) {
     }
     const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
     if (b64) {
         if (typeof jws.payload !== 'string') {
@@ -1106,15 +755,26 @@ async function flattenedVerify(jws, key, options) {
         resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
-    const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
-    const signature = decode(jws.signature);
+    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
+    let signature;
+    try {
+        signature = decode(jws.signature);
+    }
+    catch {
+        throw new JWSInvalid('Failed to base64url decode the signature');
+    }
     const verified = await verify(alg, key, signature, data);
     if (!verified) {
         throw new JWSSignatureVerificationFailed();
     }
     let payload;
     if (b64) {
-        payload = decode(jws.payload);
+        try {
+            payload = decode(jws.payload);
+        }
+        catch {
+            throw new JWSInvalid('Failed to base64url decode the payload');
+        }
     }
     else if (typeof jws.payload === 'string') {
         payload = encoder.encode(jws.payload);
@@ -1227,15 +887,26 @@ var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
     if (!isObject(payload)) {
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
-    const { issuer } = options;
+    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+    if (maxTokenAge !== undefined)
+        requiredClaims.push('iat');
+    if (audience !== undefined)
+        requiredClaims.push('aud');
+    if (subject !== undefined)
+        requiredClaims.push('sub');
+    if (issuer !== undefined)
+        requiredClaims.push('iss');
+    for (const claim of new Set(requiredClaims.reverse())) {
+        if (!(claim in payload)) {
+            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+        }
+    }
     if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
         throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
     }
-    const { subject } = options;
     if (subject && payload.sub !== subject) {
         throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
     }
-    const { audience } = options;
     if (audience &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
         throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
@@ -1256,7 +927,7 @@ var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
     }
     const { currentDate } = options;
     const now = epoch(currentDate || new Date());
-    if ((payload.iat !== undefined || options.maxTokenAge) && typeof payload.iat !== 'number') {
+    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
         throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
@@ -1275,9 +946,9 @@ var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
             throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
         }
     }
-    if (options.maxTokenAge) {
+    if (maxTokenAge) {
         const age = now - payload.iat;
-        const max = typeof options.maxTokenAge === 'number' ? options.maxTokenAge : secs(options.maxTokenAge);
+        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
         if (age - tolerance > max) {
             throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
         }
@@ -1289,9 +960,8 @@ var jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
 };
 
 async function jwtVerify(jwt, key, options) {
-    var _a;
     const verified = await compactVerify(jwt, key, options);
-    if (((_a = verified.protectedHeader.crit) === null || _a === void 0 ? void 0 : _a.includes('b64')) && verified.protectedHeader.b64 === false) {
+    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
@@ -1331,15 +1001,16 @@ function clone(obj) {
     return JSON.parse(JSON.stringify(obj));
 }
 class LocalJWKSet {
+    _jwks;
+    _cached = new WeakMap();
     constructor(jwks) {
-        this._cached = new WeakMap();
         if (!isJWKSLike(jwks)) {
             throw new JWKSInvalid('JSON Web Key Set malformed');
         }
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token.header };
+        const { alg, kid } = { ...protectedHeader, ...token?.header };
         const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;
@@ -1381,18 +1052,33 @@ class LocalJWKSet {
             throw new JWKSNoMatchingKey();
         }
         else if (length !== 1) {
-            throw new JWKSMultipleMatchingKeys();
+            const error = new JWKSMultipleMatchingKeys();
+            const { _cached } = this;
+            error[Symbol.asyncIterator] = async function* () {
+                for (const jwk of candidates) {
+                    try {
+                        yield await importWithAlgCache(_cached, jwk, alg);
+                    }
+                    catch {
+                        continue;
+                    }
+                }
+            };
+            throw error;
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-            }
-            cached[alg] = keyObject;
+        return importWithAlgCache(this._cached, jwk, alg);
+    }
+}
+async function importWithAlgCache(cache, jwk, alg) {
+    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    if (cached[alg] === undefined) {
+        const key = await importJWK({ ...jwk, ext: true }, alg);
+        if (key instanceof Uint8Array || key.type !== 'public') {
+            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
         }
-        return cached[alg];
+        cached[alg] = key;
     }
+    return cached[alg];
 }
 
 const fetchJwks = async (url, timeout, options) => {
@@ -1433,7 +1119,19 @@ const fetchJwks = async (url, timeout, options) => {
     }
 };
 
+function isCloudflareWorkers() {
+    return (typeof WebSocketPair !== 'undefined' ||
+        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
+        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
+}
 class RemoteJWKSet extends LocalJWKSet {
+    _url;
+    _timeoutDuration;
+    _cooldownDuration;
+    _cacheMaxAge;
+    _jwksTimestamp;
+    _pendingFetch;
+    _options;
     constructor(url, options) {
         super({ keys: [] });
         this._jwks = undefined;
@@ -1441,12 +1139,12 @@ class RemoteJWKSet extends LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
+        this._options = { agent: options?.agent, headers: options?.headers };
         this._timeoutDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
+            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
         this._cooldownDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
-        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
+            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
     }
     coolingDown() {
         return typeof this._jwksTimestamp === 'number'
@@ -1477,38 +1175,29 @@ class RemoteJWKSet extends LocalJWKSet {
     }
     async reload() {
         if (this._pendingFetch && isCloudflareWorkers()) {
-            return new Promise((resolve) => {
-                const isDone = () => {
-                    if (this._pendingFetch === undefined) {
-                        resolve();
-                    }
-                    else {
-                        setTimeout(isDone, 5);
-                    }
-                };
-                isDone();
-            });
-        }
-        if (!this._pendingFetch) {
-            this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
-                .then((json) => {
-                if (!isJWKSLike(json)) {
-                    throw new JWKSInvalid('JSON Web Key Set malformed');
-                }
-                this._jwks = { keys: json.keys };
-                this._jwksTimestamp = Date.now();
-                this._pendingFetch = undefined;
-            })
-                .catch((err) => {
-                this._pendingFetch = undefined;
-                throw err;
-            });
+            this._pendingFetch = undefined;
         }
+        this._pendingFetch ||= fetchJwks(this._url, this._timeoutDuration, this._options)
+            .then((json) => {
+            if (!isJWKSLike(json)) {
+                throw new JWKSInvalid('JSON Web Key Set malformed');
+            }
+            this._jwks = { keys: json.keys };
+            this._jwksTimestamp = Date.now();
+            this._pendingFetch = undefined;
+        })
+            .catch((err) => {
+            this._pendingFetch = undefined;
+            throw err;
+        });
         await this._pendingFetch;
     }
 }
 function createRemoteJWKSet(url, options) {
-    return RemoteJWKSet.prototype.getKey.bind(new RemoteJWKSet(url, options));
+    const set = new RemoteJWKSet(url, options);
+    return async function (protectedHeader, token) {
+        return set.getKey(protectedHeader, token);
+    };
 }
 
 // https://appleid.apple.com/.well-known/openid-configuration

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@logto/connector-apple",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Apple web connector implementation.",
   "dependencies": {
-    "@logto/connector-kit": "^1.1.1",
-    "@logto/shared": "^3.0.0",
-    "jose": "^4.3.8"
+    "@logto/connector-kit": "^2.1.0",
+    "@logto/shared": "^3.1.0",
+    "jose": "^5.0.0"
   },
   "main": "./lib/index.js",
   "module": "./lib/index.js",
@@ -19,7 +19,7 @@
     "logo-dark.svg"
   ],
   "engines": {
-    "node": "^18.12.0"
+    "node": "^20.9.0"
   },
   "eslintConfig": {
     "extends": "@silverhand",