@naturalcycles/nodejs-lib 15.120.0 → 15.121.1

package/dist/jwt/jwt.service.js

@@ -182,9 +182,11 @@ export class JWTService {
         if (err instanceof errors.JOSEError) {
             return new JWTInvalidError(err.message, errorData);
         }
-        if (this.cfg.verifyAlgorithms && err instanceof TypeError) {
+        if (this.cfg.verifyAlgorithms && (err instanceof TypeError || err instanceof DOMException)) {
             // With multiple verifyAlgorithms, a token/key algorithm mismatch is reachable
-            // by untrusted input, and jose reports it as TypeError - treat it as an invalid token
+            // by untrusted input, and jose reports it as TypeError, or (since jose 6.2.6,
+            // which prepares keys via Node's KeyObject.toCryptoKey) as DOMException
+            // "DataError: Invalid key type" - treat it as an invalid token
             return new JWTInvalidError(err.message, errorData);
         }
         return err;

package/dist/validation/ajv/jSchema.d.ts

@@ -271,7 +271,16 @@ export declare class JString<OUT extends string | undefined = string, Opt extend
     ipv4(): this;
     ipv6(): this;
     slug(): this;
+    /**
+     * Validates the 3-part semver format: `major.minor.patch`, e.g `1.2.3`.
+     */
     semVer(): this;
+    /**
+     * Validates the 4-part version format: `major.minor.patch.build`, e.g `1.2.3.4`.
+     *
+     * Not a semver by the spec, but is used by e.g .NET and some mobile app versions.
+     */
+    semVer4(): this;
     languageTag(): this;
     countryCode(): this;
     currency(): this;

package/dist/validation/ajv/jSchema.js

@@ -5,7 +5,7 @@ import { _deepCopy, _filterNullishValues, _sortObject } from '@naturalcycles/js-
 import { _substringBefore } from '@naturalcycles/js-lib/string';
 import { _objectAssign, _typeCast, JWT_REGEX } from '@naturalcycles/js-lib/types';
 import { _inspect } from '../../string/inspect.js';
-import { BASE64URL_REGEX, COUNTRY_CODE_REGEX, CURRENCY_REGEX, IPV4_REGEX, IPV6_REGEX, LANGUAGE_TAG_REGEX, SEMVER_REGEX, SLUG_REGEX, URL_REGEX, UUID_REGEX, } from '../regexes.js';
+import { BASE64URL_REGEX, COUNTRY_CODE_REGEX, CURRENCY_REGEX, IPV4_REGEX, IPV6_REGEX, LANGUAGE_TAG_REGEX, SEMVER4_REGEX, SEMVER_REGEX, SLUG_REGEX, URL_REGEX, UUID_REGEX, } from '../regexes.js';
 import { TIMEZONES } from '../timezones.js';
 import { AjvValidationError } from './ajvValidationError.js';
 import { getAjv } from './getAjv.js';
@@ -623,9 +623,20 @@ export class JString extends JBuilder {
     slug() {
         return this.regex(SLUG_REGEX, { msg: 'is not a valid slug format' });
     }
+    /**
+     * Validates the 3-part semver format: `major.minor.patch`, e.g `1.2.3`.
+     */
     semVer() {
         return this.regex(SEMVER_REGEX, { msg: 'is not a valid semver format' });
     }
+    /**
+     * Validates the 4-part version format: `major.minor.patch.build`, e.g `1.2.3.4`.
+     *
+     * Not a semver by the spec, but is used by e.g .NET and some mobile app versions.
+     */
+    semVer4() {
+        return this.regex(SEMVER4_REGEX, { msg: 'is not a valid 4-part semver format' });
+    }
     languageTag() {
         return this.regex(LANGUAGE_TAG_REGEX, { msg: 'is not a valid language format' });
     }

package/dist/validation/regexes.d.ts

@@ -17,5 +17,6 @@ export declare const IPV6_REGEX: RegExp;
 export declare const LANGUAGE_TAG_REGEX: RegExp;
 export declare const MAC_ADDRESS_REGEX: RegExp;
 export declare const SEMVER_REGEX: RegExp;
+export declare const SEMVER4_REGEX: RegExp;
 export declare const SLUG_REGEX: RegExp;
 export declare const URL_REGEX: RegExp;

package/dist/validation/regexes.js

@@ -22,6 +22,8 @@ export const IPV6_REGEX = /^((([0-9a-fA-F]{1,4}:){7}([0-9a-fA-F]{1,4}|:))|(([0-9
 export const LANGUAGE_TAG_REGEX = /^[a-z]{2}(-[A-Z]{2})?$/;
 export const MAC_ADDRESS_REGEX = /^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/;
 export const SEMVER_REGEX = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+// 4-part version (major.minor.patch.build)
+export const SEMVER4_REGEX = /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/;
 export const SLUG_REGEX = /^[a-z0-9-]+$/;
 // URL regex based on `ajv-formats`, but without flags for JSON Schema compatibility.
 // Uses [a-zA-Z] instead of [a-z] with i flag. Simplified to not require unicode flag.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/nodejs-lib",
   "type": "module",
-  "version": "15.120.0",
+  "version": "15.121.1",
   "dependencies": {
     "@naturalcycles/js-lib": "^15",
     "@standard-schema/spec": "^1",

package/src/jwt/jwt.service.ts

@@ -379,9 +379,11 @@ export class JWTService<T extends AnyObject = AnyObject> {
     if (err instanceof errors.JOSEError) {
       return new JWTInvalidError(err.message, errorData)
     }
-    if (this.cfg.verifyAlgorithms && err instanceof TypeError) {
+    if (this.cfg.verifyAlgorithms && (err instanceof TypeError || err instanceof DOMException)) {
       // With multiple verifyAlgorithms, a token/key algorithm mismatch is reachable
-      // by untrusted input, and jose reports it as TypeError - treat it as an invalid token
+      // by untrusted input, and jose reports it as TypeError, or (since jose 6.2.6,
+      // which prepares keys via Node's KeyObject.toCryptoKey) as DOMException
+      // "DataError: Invalid key type" - treat it as an invalid token
       return new JWTInvalidError(err.message, errorData)
     }
     return err as Error

package/src/validation/ajv/jSchema.ts

@@ -36,6 +36,7 @@ import {
   IPV4_REGEX,
   IPV6_REGEX,
   LANGUAGE_TAG_REGEX,
+  SEMVER4_REGEX,
   SEMVER_REGEX,
   SLUG_REGEX,
   URL_REGEX,
@@ -831,10 +832,22 @@ export class JString<
     return this.regex(SLUG_REGEX, { msg: 'is not a valid slug format' })
   }
 
+  /**
+   * Validates the 3-part semver format: `major.minor.patch`, e.g `1.2.3`.
+   */
   semVer(): this {
     return this.regex(SEMVER_REGEX, { msg: 'is not a valid semver format' })
   }
 
+  /**
+   * Validates the 4-part version format: `major.minor.patch.build`, e.g `1.2.3.4`.
+   *
+   * Not a semver by the spec, but is used by e.g .NET and some mobile app versions.
+   */
+  semVer4(): this {
+    return this.regex(SEMVER4_REGEX, { msg: 'is not a valid 4-part semver format' })
+  }
+
   languageTag(): this {
     return this.regex(LANGUAGE_TAG_REGEX, { msg: 'is not a valid language format' })
   }

package/src/validation/regexes.ts

@@ -23,6 +23,8 @@ export const IPV6_REGEX =
 export const LANGUAGE_TAG_REGEX = /^[a-z]{2}(-[A-Z]{2})?$/
 export const MAC_ADDRESS_REGEX = /^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$/
 export const SEMVER_REGEX = /^[0-9]+\.[0-9]+\.[0-9]+$/
+// 4-part version (major.minor.patch.build)
+export const SEMVER4_REGEX = /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/
 export const SLUG_REGEX = /^[a-z0-9-]+$/
 // URL regex based on `ajv-formats`, but without flags for JSON Schema compatibility.
 // Uses [a-zA-Z] instead of [a-z] with i flag. Simplified to not require unicode flag.