@nocobase/plugin-idp-oauth 2.3.0-beta.12 → 2.3.0-beta.14

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwks/local.js

@@ -0,0 +1,59 @@
+import { jwkToKey, snapshotJwk } from "../lib/key.js";
+import { JWS } from "../lib/jws_algorithms.js";
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from "../util/errors.js";
+import { isJwkSet } from "../lib/validate.js";
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+}
+async function importWithAlgCache(cache, jwk, entry) {
+  const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached[alg] === void 0) {
+    const pending = jwkToKey(entry, jwk, !0).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached[alg] = key, key;
+    }).catch((error) => {
+      throw cached[alg] === pending && delete cached[alg], error;
+    });
+    cached[alg] = pending;
+  }
+  return cached[alg];
+}
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
+  }
+  if (!isJwkSet(snapshot))
+    throw new JWKSInvalid("JSON Web Key Set malformed");
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached = /* @__PURE__ */ new WeakMap();
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret)
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
+      throw new JWKSNoMatchingKey();
+    if (length !== 1) {
+      const error = new JWKSMultipleMatchingKeys();
+      throw error[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
+          try {
+            yield await importWithAlgCache(cached, jwk2, entry);
+          } catch {
+          }
+      }, error;
+    }
+    return importWithAlgCache(cached, jwk, entry);
+  }, "jwks", {
+    value: () => structuredClone(snapshot)
+  });
+}
+export {
+  createLocalJWKSet
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwks/remote.js

@@ -0,0 +1,101 @@
+import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from "../util/errors.js";
+import { createLocalJWKSet } from "./local.js";
+import { isJwkSet } from "../lib/validate.js";
+function isCloudflareWorkers() {
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
+}
+let USER_AGENT;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+const customFetch = /* @__PURE__ */ Symbol();
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+  const response = await fetchImpl(url, {
+    method: "GET",
+    signal,
+    redirect: "manual",
+    headers
+  }).catch((err) => {
+    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
+  });
+  if (response.status !== 200)
+    throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+  try {
+    return await response.json();
+  } catch {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  }
+}
+const jwksCache = /* @__PURE__ */ Symbol();
+function isFreshFor(timestamp, duration) {
+  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
+}
+function validateDuration(value, fallback, option) {
+  if (Number.isNaN(value))
+    throw new TypeError(`"${option}" option must not be NaN`);
+  return typeof value == "number" ? value : fallback;
+}
+function createRemoteJWKSet(url, options) {
+  if (!(url instanceof URL))
+    throw new TypeError("url must be an instance of URL");
+  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache && typeof cache == "object") {
+    const { uat, jwks } = cache;
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+        const next = createLocalJWKSet(json);
+        if (sequence <= appliedSequence)
+          return;
+        local = next;
+        const updatedAt = Date.now();
+        cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
+      }).finally(() => {
+        pendingFetch === current && (pendingFetch = void 0);
+      });
+    }
+    await pendingFetch;
+  };
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
+    try {
+      return await local(protectedHeader, token);
+    } catch (err) {
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
+      throw err;
+    }
+  }, {
+    coolingDown: {
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+      enumerable: !0
+    },
+    fresh: {
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+      enumerable: !0
+    },
+    reload: {
+      value: reload,
+      enumerable: !0
+    },
+    reloading: {
+      get: () => !!pendingFetch,
+      enumerable: !0
+    },
+    jwks: {
+      value: () => local?.jwks(),
+      enumerable: !0
+    }
+  });
+}
+export {
+  createRemoteJWKSet,
+  customFetch,
+  jwksCache
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jws/compact/sign.js

@@ -0,0 +1,20 @@
+import { createCompactSignature } from "../../lib/jws_sign.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+class CompactSign {
+  #payload;
+  #protectedHeader;
+  constructor(payload) {
+    assertUint8Array(payload, "payload"), this.#payload = payload;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(this.#payload, this.#protectedHeader, options?.crit, key, () => {
+      throw new TypeError("use the flattened module for creating JWS with b64: false");
+    });
+  }
+}
+export {
+  CompactSign
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jws/compact/verify.js

@@ -0,0 +1,8 @@
+import { prepareVerify, verifyCompact } from "../../lib/jws_verify.js";
+async function compactVerify(jws, key, options) {
+  const [result] = await verifyCompact(jws, prepareVerify(options), key);
+  return result;
+}
+export {
+  compactVerify
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jws/flattened/sign.js

@@ -0,0 +1,23 @@
+import { createSignature } from "../../lib/jws_sign.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+class FlattenedSign {
+  #input;
+  constructor(payload) {
+    assertUint8Array(payload, "payload"), this.#input = [payload];
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.#input[2], "setUnprotectedHeader"), this.#input[2] = unprotectedHeader, this;
+  }
+  async sign(key, options) {
+    const input = [...this.#input];
+    input[3] = options?.crit;
+    const [jws] = await createSignature(input, key);
+    return jws;
+  }
+}
+export {
+  FlattenedSign
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jws/flattened/verify.js

@@ -0,0 +1,12 @@
+import { JWSInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
+import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
+async function flattenedVerify(jws, key, options) {
+  if (!isObject(jws))
+    throw new JWSInvalid("Flattened JWS must be an object");
+  const snapshot = snapshotJws(jws), [result] = await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload);
+  return result;
+}
+export {
+  flattenedVerify
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jws/general/sign.js

@@ -0,0 +1,58 @@
+import { createSignature } from "../../lib/jws_sign.js";
+import { JWSInvalid } from "../../util/errors.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
+class IndividualSignature {
+  #parent;
+  state;
+  constructor(sig, key, options) {
+    this.#parent = sig, this.state = [void 0, void 0, key, options?.crit];
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.state[0], "setProtectedHeader"), this.state[0] = protectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.state[1], "setUnprotectedHeader"), this.state[1] = unprotectedHeader, this;
+  }
+  addSignature(...args) {
+    return this.#parent.addSignature(...args);
+  }
+  sign(...args) {
+    return this.#parent.sign(...args);
+  }
+  done() {
+    return this.#parent;
+  }
+}
+class GeneralSign {
+  #payload;
+  #signatures = [];
+  constructor(payload) {
+    this.#payload = payload;
+  }
+  addSignature(key, options) {
+    const signature = new IndividualSignature(this, key, options);
+    return this.#signatures.push(signature), signature;
+  }
+  async sign() {
+    if (!this.#signatures.length)
+      throw new JWSInvalid("at least one signature must be added");
+    assertUint8Array(this.#payload, "payload");
+    const jws = {
+      signatures: [],
+      payload: ""
+    }, encoded = [];
+    let b64;
+    for (const signature of this.#signatures) {
+      const [protectedHeader, unprotectedHeader, key, crit] = signature.state, [{ payload, ...rest }, signatureB64] = await createSignature([this.#payload, protectedHeader, unprotectedHeader, crit, encoded], key);
+      if (b64 === void 0)
+        b64 = signatureB64, jws.payload = payload;
+      else if (b64 !== signatureB64)
+        throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
+      jws.signatures.push(rest);
+    }
+    return jws;
+  }
+}
+export {
+  GeneralSign
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jws/general/verify.js

@@ -0,0 +1,48 @@
+import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
+import { JWSInvalid, JWSSignatureVerificationFailed } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
+function snapshotSignature(signature, payload) {
+  try {
+    const jws = snapshotJws(signature, [payload]), protectedHeader = parseProtectedHeader(jws.protected), { b64, crit } = protectedHeader;
+    return [
+      jws,
+      protectedHeader,
+      Array.isArray(crit) && crit.includes("b64") ? typeof b64 == "boolean" ? b64 ? 1 : 2 : 0 : 1
+    ];
+  } catch {
+    return;
+  }
+}
+async function generalVerify(jws, key, options) {
+  if (!isObject(jws))
+    throw new JWSInvalid("General JWS must be an object");
+  const { signatures, payload: inputPayload } = jws;
+  if (!Array.isArray(signatures))
+    throw new JWSInvalid("JWS Signatures missing or incorrect type");
+  const signatureEntries = Array.from(signatures);
+  if (!signatureEntries.every(isObject))
+    throw new JWSInvalid("JWS Signatures missing or incorrect type");
+  let shared;
+  try {
+    if (inputPayload === void 0)
+      throw new Error();
+    shared = prepareVerify(options);
+  } catch {
+    throw new JWSSignatureVerificationFailed();
+  }
+  const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
+  let modes = 0;
+  for (const [, , mode] of candidates)
+    if (modes |= mode, modes === 3)
+      throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
+  for (const candidate of candidates)
+    try {
+      const [result] = await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]);
+      return result;
+    } catch {
+    }
+  throw new JWSSignatureVerificationFailed();
+}
+export {
+  generalVerify
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwt/decrypt.js

@@ -0,0 +1,13 @@
+import { prepareDecrypt, decryptCompact } from "../lib/jwe_decrypt.js";
+import { validateClaimsSet } from "../lib/jwt_claims_set.js";
+import { JWTClaimValidationFailed } from "../util/errors.js";
+async function jwtDecrypt(jwt, key, options) {
+  const { plaintext, ...result } = await decryptCompact(jwt, prepareDecrypt(options), key), { protectedHeader } = result, payload = validateClaimsSet(protectedHeader, plaintext, options);
+  for (const claim of ["iss", "sub", "aud"])
+    if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim]))
+      throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, "mismatch");
+  return { payload, ...result };
+}
+export {
+  jwtDecrypt
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwt/encrypt.js

@@ -0,0 +1,45 @@
+import { compactJWE, createJWE } from "../lib/jwe_encrypt.js";
+import { JWTClaimsBuilder, jwtClaim, jwtData } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
+const EncryptJWT_base = JWTClaimsBuilder;
+class EncryptJWT extends EncryptJWT_base {
+  #input = [void 0];
+  #replicateIssuerAsHeader;
+  #replicateSubjectAsHeader;
+  #replicateAudienceAsHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
+  }
+  replicateIssuerAsHeader() {
+    return this.#replicateIssuerAsHeader = !0, this;
+  }
+  replicateSubjectAsHeader() {
+    return this.#replicateSubjectAsHeader = !0, this;
+  }
+  replicateAudienceAsHeader() {
+    return this.#replicateAudienceAsHeader = !0, this;
+  }
+  async encrypt(key, options) {
+    const plaintext = jwtData(this);
+    this.#input[1] && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader) && (this.#input[1] = {
+      ...this.#input[1],
+      iss: this.#replicateIssuerAsHeader ? jwtClaim(this, "iss") : void 0,
+      sub: this.#replicateSubjectAsHeader ? jwtClaim(this, "sub") : void 0,
+      aud: this.#replicateAudienceAsHeader ? jwtClaim(this, "aud") : void 0
+    });
+    const input = [...this.#input];
+    return input[0] = plaintext, compactJWE(await createJWE(input, key, options));
+  }
+}
+export {
+  EncryptJWT
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwt/sign.js

@@ -0,0 +1,19 @@
+import { createCompactSignature } from "../lib/jws_sign.js";
+import { JWTInvalid } from "../util/errors.js";
+import { JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
+const SignJWT_base = JWTClaimsBuilder;
+class SignJWT extends SignJWT_base {
+  #protectedHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    });
+  }
+}
+export {
+  SignJWT
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwt/unsecured.js

@@ -0,0 +1,34 @@
+import * as b64u from "../util/base64url.js";
+import { decodeBase64url, parseJoseHeader, JWS_RECOGNIZED, validateB64, validateCrit } from "../lib/validate.js";
+import { JWSInvalid, JWTInvalid } from "../util/errors.js";
+import { validateClaimsSet, JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
+const UnsecuredJWT_base = JWTClaimsBuilder;
+class UnsecuredJWT extends UnsecuredJWT_base {
+  encode() {
+    const header = b64u.encode(JSON.stringify({ alg: "none" })), payload = b64u.encode(jwtData(this));
+    return `${header}.${payload}.`;
+  }
+  static decode(jwt, options) {
+    if (typeof jwt != "string")
+      throw new JWTInvalid("Unsecured JWT must be a string");
+    const { 0: encodedHeader, 1: encodedPayload, 2: signature, length } = jwt.split(".");
+    if (length !== 3 || signature !== "")
+      throw new JWTInvalid("Invalid Unsecured JWT");
+    let header, b64;
+    try {
+      header = parseJoseHeader(encodedHeader, JWSInvalid, "JWS Protected Header is invalid");
+      const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, void 0, header, header);
+      b64 = validateB64(header, extensions);
+    } catch (cause) {
+      throw cause instanceof JWSInvalid ? new JWTInvalid("Invalid Unsecured JWT", { cause }) : cause;
+    }
+    if (header.alg !== "none")
+      throw new JWTInvalid("Invalid Unsecured JWT");
+    if (!b64)
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    return { payload: validateClaimsSet(header, decodeBase64url(encodedPayload, "payload", JWTInvalid), options), header };
+  }
+}
+export {
+  UnsecuredJWT
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/jwt/verify.js

@@ -0,0 +1,13 @@
+import { prepareVerify, verifyCompact } from "../lib/jws_verify.js";
+import { validateClaimsSet } from "../lib/jwt_claims_set.js";
+import { JWTInvalid } from "../util/errors.js";
+async function jwtVerify(jwt, key, options) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
+}
+export {
+  jwtVerify
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/key/export.js

@@ -0,0 +1,35 @@
+import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from "../lib/asn1.js";
+import { invalidKeyInput, isCryptoKey, isKeyObject } from "../lib/key.js";
+import { encode as b64u } from "../util/base64url.js";
+function exportSPKI(key) {
+  return exportPublic(key);
+}
+function exportPKCS8(key) {
+  return exportPrivate(key);
+}
+async function exportJWK(key) {
+  if (isKeyObject(key))
+    if (key.type === "secret")
+      key = key.export();
+    else
+      return key.export({ format: "jwk" });
+  if (key instanceof Uint8Array)
+    return {
+      kty: "oct",
+      k: b64u(key)
+    };
+  if (!isCryptoKey(key))
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+  if (!key.extractable)
+    throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+  for (const parameter of Object.keys(jwk))
+    jwk[parameter] === void 0 && delete jwk[parameter];
+  return jwk;
+}
+export {
+  exportJWK,
+  exportPKCS8,
+  exportSPKI
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/key/generate_key_pair.js

@@ -0,0 +1,35 @@
+import { JOSENotSupported } from "../util/errors.js";
+import { validateExtractableOption } from "../lib/key.js";
+import { keyAlgorithm, unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
+function getModulusLengthOption(options) {
+  const modulusLength = options?.modulusLength ?? 2048;
+  if (typeof modulusLength != "number" || !Number.isInteger(modulusLength) || modulusLength < 2048)
+    throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
+  return modulusLength;
+}
+async function generateKeyPair(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+  entry.secret && unsupportedAlg(algArgument);
+  let algorithm;
+  if (entry.resolve) {
+    const crv = options?.crv ?? "P-256";
+    if (!["P-256", "P-384", "P-521", "X25519"].includes(crv))
+      throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+    algorithm = entry.resolve({ crv });
+  } else {
+    if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)
+      throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
+    algorithm = entry.kty[0] === "RSA" ? {
+      ...entry.subtle,
+      publicExponent: Uint8Array.of(1, 0, 1),
+      modulusLength: getModulusLengthOption(options)
+    } : entry.subtle;
+  }
+  return crypto.subtle.generateKey(algorithm, extractable ?? !1, [
+    ...entry.usages[1],
+    ...entry.usages[0]
+  ]);
+}
+export {
+  generateKeyPair
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/key/generate_secret.js

@@ -0,0 +1,36 @@
+import { unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
+import { validateExtractableOption } from "../lib/key.js";
+async function generateSecret(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable);
+  let length, algorithm, keyUsages;
+  switch (alg) {
+    case "HS256":
+    case "HS384":
+    case "HS512":
+      length = +alg.slice(-3), algorithm = { name: "HMAC", hash: `SHA-${length}`, length }, keyUsages = ["sign", "verify"];
+      break;
+    case "A128CBC-HS256":
+    case "A192CBC-HS384":
+    case "A256CBC-HS512":
+      return crypto.getRandomValues(new Uint8Array(+alg.slice(-3) >> 3));
+    case "A128KW":
+    case "A192KW":
+    case "A256KW":
+      length = +alg.slice(1, 4), algorithm = { name: "AES-KW", length }, keyUsages = ["wrapKey", "unwrapKey"];
+      break;
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW":
+    case "A128GCM":
+    case "A192GCM":
+    case "A256GCM":
+      length = +alg.slice(1, 4), algorithm = { name: "AES-GCM", length }, keyUsages = ["encrypt", "decrypt"];
+      break;
+    default:
+      unsupportedAlg(algArgument);
+  }
+  return crypto.subtle.generateKey(algorithm, extractable ?? !1, keyUsages);
+}
+export {
+  generateSecret
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/key/import.js

@@ -0,0 +1,53 @@
+import { decode as decodeBase64URL } from "../util/base64url.js";
+import { fromSPKI, fromPKCS8, fromX509 } from "../lib/asn1.js";
+import { jwkToKey, validateExtractableOption, normalizeJwk } from "../lib/key.js";
+import { keyAlgorithm } from "../lib/key_algorithm.js";
+import { JOSENotSupported } from "../util/errors.js";
+import { isObject } from "../lib/validate.js";
+async function importSPKI(spki, alg, options) {
+  if (typeof spki != "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
+    throw new TypeError('"spki" must be SPKI formatted string');
+  return fromSPKI(spki, alg, options);
+}
+async function importX509(x509, alg, options) {
+  if (typeof x509 != "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0)
+    throw new TypeError('"x509" must be X.509 formatted string');
+  return fromX509(x509, alg, options);
+}
+async function importPKCS8(pkcs8, alg, options) {
+  if (typeof pkcs8 != "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0)
+    throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
+  return fromPKCS8(pkcs8, alg, options);
+}
+async function importJWK(jwk, alg, options) {
+  if (!isObject(jwk))
+    throw new TypeError("JWK must be an object");
+  const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
+  if (alg ??= jwkAlg, normalized.kty !== "oct" && !alg)
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  switch (normalized.kty) {
+    case "oct":
+      if (typeof normalized.k != "string")
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      return decodeBase64URL(normalized.k);
+    case "AKP": {
+      if (typeof jwkAlg != "string" || !jwkAlg)
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      if (alg !== jwkAlg)
+        throw new TypeError("JWK alg and alg option value mismatch");
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+    }
+    case "RSA":
+    case "EC":
+    case "OKP":
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
+    default:
+      throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+export {
+  importJWK,
+  importPKCS8,
+  importSPKI,
+  importX509
+};