@pagopa/io-react-native-jwt 0.4.1 → 0.6.0

package/lib/typescript/utils/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/utils/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,6DAA6D;IAC7D,MAAM,KAAK,IAAI,IAAI,MAAM,CAExB;IAED,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAsB;gBAEtB,OAAO,CAAC,EAAE,MAAM;CAM7B;AACD,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,MAAM,KAAK,IAAI,IAAI,iCAAiC,CAEnD;IAED,IAAI,SAAqC;IAEzC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IAEd,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,KAAK,SAAgB,EAAE,MAAM,SAAgB;CAK3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,UAAW,SAAQ,SAAU,YAAW,wBAAwB;IAC3E,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAEnC;IAED,IAAI,SAAqB;IAEzB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IAEd,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,KAAK,SAAgB,EAAE,MAAM,SAAgB;CAK3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,MAAM,KAAK,IAAI,IAAI,0BAA0B,CAE5C;IAED,IAAI,SAA8B;CACnC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,MAAM,KAAK,IAAI,IAAI,wBAAwB,CAE1C;IAED,IAAI,SAA4B;CACjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,UAAW,SAAQ,SAAS;IACvC,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAEnC;IAED,IAAI,SAAqB;CAC1B;AAED;;GAEG;AACH,qBAAa,UAAW,SAAQ,SAAS;IACvC,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAEnC;IACD,IAAI,SAAqB;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,8BAA+B,SAAQ,SAAS;IAC3D,MAAM,KAAK,IAAI,IAAI,uCAAuC,CAEzD;IAED,IAAI,SAA2C;IAE/C,OAAO,SAAmC;CAC3C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/utils/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,6DAA6D;IAC7D,MAAM,KAAK,IAAI,IAAI,MAAM,CAExB;IAED,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAsB;gBAEtB,OAAO,CAAC,EAAE,MAAM;CAM7B;AACD,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,MAAM,KAAK,IAAI,IAAI,iCAAiC,CAEnD;IAED,IAAI,SAAqC;IAEzC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IAEd,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,KAAK,SAAgB,EAAE,MAAM,SAAgB;CAK3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,UAAW,SAAQ,SAAU,YAAW,wBAAwB;IAC3E,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAEnC;IAED,IAAI,SAAqB;IAEzB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IAEd,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,KAAK,SAAgB,EAAE,MAAM,SAAgB;CAK3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;IAC9C,MAAM,KAAK,IAAI,IAAI,0BAA0B,CAE5C;IAED,IAAI,SAA8B;CACnC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,MAAM,KAAK,IAAI,IAAI,wBAAwB,CAE1C;IAED,IAAI,SAA4B;CACjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,UAAW,SAAQ,SAAS;IACvC,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAEnC;IAED,IAAI,SAAqB;CAC1B;AAED;;GAEG;AACH,qBAAa,UAAW,SAAQ,SAAS;IACvC,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAEnC;IACD,IAAI,SAAqB;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,8BAA+B,SAAQ,SAAS;IAC3D,MAAM,KAAK,IAAI,IAAI,uCAAuC,CAEzD;IAED,IAAI,SAA2C;IAE/C,OAAO,SAAmC;CAC3C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,UAAW,SAAQ,SAAS;IACvC,MAAM,KAAK,IAAI,IAAI,iBAAiB,CAEnC;IAED,IAAI,SAAqB;CAC1B;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,SAAS;IAC1C,MAAM,KAAK,IAAI,IAAI,kBAAkB,CAEpC;IAED,IAAI,SAAsB;CAC3B;AAED;;GAEG;AACH,qBAAa,WAAY,SAAQ,SAAS;IACxC,MAAM,KAAK,IAAI,IAAI,mBAAmB,CAErC;IAED,IAAI,SAAuB;CAC5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/io-react-native-jwt",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Native support for JWT",
   "main": "lib/commonjs/index",
   "module": "lib/module/index",
@@ -165,6 +165,7 @@
     ]
   },
   "dependencies": {
-    "abab": "^2.0.6"
+    "abab": "^2.0.6",
+    "zod": "^3.21.4"
   }
 }

package/src/index.tsx

@@ -1,120 +1,10 @@
-import type {
-  JWK,
-  JWTClaimVerificationOptions,
-  JWTDecodeResult,
-} from './types';
-import jwtPayload from './jwt_claims_set';
-import { JWSSignatureVerificationFailed } from './utils/errors';
-import { IoReactNativeJwt } from './utils/proxy';
-import { SignJWT } from './sign';
+export * from './jwe/index';
+export * from './jwt/index';
+export * from './jwk/index';
+export * from './jwt/produce';
+export * from './jwt/sign';
+export * from './jwt/unsecured';
 
-export * from './produce';
-export * from './sign';
-export * from './unsecured';
 export { derToJose } from './utils/asn1';
 export { encodeBase64, decodeBase64 } from './utils/base64';
 export { sha256ToBase64 } from './hash';
-/**
- * Decode the JWT without validation.
- *
- * @example Usage with a public JWK encoded RSA key
- *
- * ```js
- * const jwt =
- *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
- *
- * const { payload, protectedHeader } = await decode(jwt)
- *
- * ```
- *
- * @param jwt JSON Web Token value (encoded as JWS).
- */
-export const decode = (token: string): JWTDecodeResult => SignJWT.decode(token);
-
-/**
- * Verifies the JWS signature
- *
- * @example Usage with a public JWK encoded RSA key
- *
- * ```js
- * const jwk = {
- *   crv: 'P-256',
- *   kty: 'EC',
- *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
- *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
- * }
- * const jwt =
- *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
- *
- * const isSignatureValid = await verify(jwt, jwk)
- * ```
- *
- * @param jwt JSON Web Token value (encoded as JWS).
- * @param key Public key to verify the JWT in JWK format.
- */
-export const isSignatureValid = (token: string, jwk: JWK): Promise<boolean> =>
-  IoReactNativeJwt.verify(token, jwk);
-
-/**
- * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
- * JWT Claims Set.
- *
- * @example Usage with a public JWK encoded RSA key
- *
- * ```js
- * const jwk = {
- *   crv: 'P-256',
- *   kty: 'EC',
- *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
- *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
- * }
- * const jwt =
- *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
- *
- * const { payload, protectedHeader } = await verify(jwt, jwk, {
- *   typ: 'entity-statement+jwt',
- *   requiredClaims: ['iss', 'sub', 'metadata'],
- * })
- * ```
- *
- * @param jwt JSON Web Token value (encoded as JWS).
- * @param key Public key to verify the JWT in JWK format.
- * @param options JWT Decryption and JWT Claims Set validation options.
- */
-export const verify = async (
-  token: string,
-  jwk: JWK,
-  options: JWTClaimVerificationOptions = {}
-): Promise<JWTDecodeResult> => {
-  const { protectedHeader, payload } = await decode(token);
-  const signatureIsValid = await isSignatureValid(token, jwk);
-
-  if (signatureIsValid) {
-    const verifiedPayload = jwtPayload(protectedHeader, payload, options);
-    return { payload: verifiedPayload, protectedHeader };
-  } else {
-    throw new JWSSignatureVerificationFailed();
-  }
-};
-
-/**
- * Calculate JWK thumbprint
- *
- * @example Get JWK thumbprint
- *
- * ```js
- * const jwk: JWK = {
- *   crv: 'P-256',
- *   kty: 'EC',
- *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
- *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
- * };
-
- * const thumbprint = await thumbprint(jwk)
- *
- * ```
- *
- * @param jwk JSON Web Key
- */
-export const thumbprint = (jwk: JWK): Promise<string> =>
-  IoReactNativeJwt.thumbprint(jwk);

package/src/jwe/index.ts

@@ -0,0 +1,45 @@
+import type { JWEHeaderParameters, JWK } from '../types';
+import { IoReactNativeJwt } from '../utils/proxy';
+
+/**
+ * The EncryptJwe class is used to build and encrypt Flattened JWE objects.
+ *
+ * @example Usage
+ *
+ * ```js
+ * const jwe = await new EncryptJwe(
+ *   new TextEncoder().encode('It’s a dangerous business, Frodo, going out your door.', { alg: 'RSA-OAEP-256', enc: 'A256GCM' }),
+ * )
+ *   .encrypt(publicKey)
+ *
+ * console.log(jwe)
+ * ```
+ */
+export class EncryptJwe {
+  private _plaintext: String;
+  private _protectedHeader!: JWEHeaderParameters & { alg: string; enc: string };
+
+  /** @param plaintext String representation of the plaintext to encrypt. */
+  /** @param header JWE header with alg and enc parameters. */
+  constructor(
+    plaintext: String,
+    header: JWEHeaderParameters & { alg: string; enc: string }
+  ) {
+    this._plaintext = plaintext;
+    this._protectedHeader = header;
+  }
+
+  /**
+   * Encrypts and resolves the value of the Flattened JWE object.
+   *
+   * @param key Public Key or Secret to encrypt the JWE with. See
+   */
+  async encrypt(key: JWK): Promise<string> {
+    let jwe = await IoReactNativeJwt.enc(
+      this._plaintext,
+      this._protectedHeader,
+      key
+    );
+    return jwe;
+  }
+}

package/src/jwk/index.ts

@@ -0,0 +1,51 @@
+import { IoReactNativeJwt } from '../utils/proxy';
+import { WithJWKS, JWK } from '../types';
+import { JWKSetInvalid } from '../utils/errors';
+import { decode } from '..';
+
+/**
+ * Calculate JWK thumbprint
+ *
+ * @example Get JWK thumbprint
+ *
+ * ```js
+ * const jwk: JWK = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * };
+
+ * const thumbprint = await thumbprint(jwk)
+ *
+ * ```
+ *
+ * @param jwk JSON Web Key
+ */
+export const thumbprint = (jwk: JWK): Promise<string> =>
+  IoReactNativeJwt.thumbprint(jwk);
+
+/**
+ * Returns a JSON Web Key Set (JWKS) downloaded from a remote endpoint,
+ * that is, for example, an OAuth 2.0 or OIDC jwks_uri.
+ *
+ * @param url URL string to fetch the JSON Web Key Set from.
+ * @param appFetch fetch function (optional)
+ */
+export const getRemoteJWKSet = async (
+  url: string,
+  appFetch: GlobalFetch['fetch'] = fetch
+): Promise<JWK[]> => {
+  let response = await appFetch(url);
+
+  if (response.status === 200) {
+    const jwt = await response.text();
+    const { payload } = await decode(jwt);
+    const parsedPayload = WithJWKS.parse(payload);
+    return parsedPayload.jwks.keys;
+  }
+
+  throw new JWKSetInvalid(
+    `Unable to obtain JWKSet from given url. Response status: ${response.status}`
+  );
+};

package/src/jwt/index.ts

@@ -0,0 +1,148 @@
+import type {
+  JWSHeaderParameters,
+  JWTClaimVerificationOptions,
+  JWTDecodeResult,
+} from '../types';
+import jwtPayload from './jwt_claims_set';
+import { JWKNotFound, JWSSignatureVerificationFailed } from '../utils/errors';
+import { IoReactNativeJwt } from '../utils/proxy';
+import { SignJWT } from './sign';
+import type { JWK } from '../types';
+import { getKtyFromAlg } from '../algorithms';
+
+export * from './produce';
+export * from './sign';
+export * from './unsecured';
+export { derToJose } from '../utils/asn1';
+export { encodeBase64, decodeBase64 } from '../utils/base64';
+export { sha256ToBase64 } from '../hash';
+/**
+ * Decode the JWT without validation.
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await decode(jwt)
+ *
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ */
+export const decode = (token: string): JWTDecodeResult => SignJWT.decode(token);
+
+/**
+ * Verifies the JWS signature
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwk = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * }
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const isSignatureValid = await verify(jwt, jwk)
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ * @param key Public key to verify the JWT in JWK format.
+ */
+export const isSignatureValid = (token: string, jwk: JWK): Promise<boolean> =>
+  IoReactNativeJwt.verify(token, jwk);
+
+/**
+ * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
+ * JWT Claims Set.
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwk = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * }
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await verify(jwt, jwk, {
+ *   typ: 'entity-statement+jwt',
+ *   requiredClaims: ['iss', 'sub', 'metadata'],
+ * })
+ * ```
+ *
+ *  * @example Usage with a JWKSet
+ *
+ * ```js
+ * const wellKnownUrl = 'https://example.com/.well-known/openid-federation';
+ * const jwks = await getRemoteJWKSet(wellKnownUrl);
+ *
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await verify(jwt, jwks, {
+ *   typ: 'entity-statement+jwt',
+ *   requiredClaims: ['iss', 'sub', 'metadata'],
+ * })
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ * @param key Public key to verify the JWT in JWK format or JWKS (array of JWK).
+ * @param options JWT Decryption and JWT Claims Set validation options.
+ */
+export const verify = async (
+  token: string,
+  jwk: JWK | JWK[],
+  options: JWTClaimVerificationOptions = {}
+): Promise<JWTDecodeResult> => {
+  const { protectedHeader, payload } = await decode(token);
+
+  const selectedJwk = Array.isArray(jwk)
+    ? getJwkFromHeader(protectedHeader, jwk)
+    : jwk;
+
+  const signatureIsValid = await isSignatureValid(token, selectedJwk);
+  if (signatureIsValid) {
+    const verifiedPayload = jwtPayload(protectedHeader, payload, options);
+    return { payload: verifiedPayload, protectedHeader };
+  } else {
+    throw new JWSSignatureVerificationFailed();
+  }
+};
+
+/**
+ * Given the header of a JWT return the corresponding key from a JWKS.
+ *
+ * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
+ * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
+ * there is one).
+ * Only a single public key must match the selection process.
+ *
+ * @param header JWT header
+ * @param jwks Json Web Key Set (JWKS)
+ *
+ */
+export const getJwkFromHeader = (
+  header: JWSHeaderParameters,
+  jwks: JWK[]
+): JWK => {
+  const { alg, kid } = header;
+  if (alg && kid) {
+    const kty = getKtyFromAlg(alg);
+    const filteredJwks = jwks.find((el) => el.kty === kty && el.kid === kid);
+
+    if (filteredJwks) {
+      return filteredJwks;
+    }
+  }
+
+  throw new JWKNotFound(`No JWKs found that match alg:${alg} and kid:${kid}`);
+};

package/src/{jwt_claims_set.ts → jwt/jwt_claims_set.ts}

@@ -5,10 +5,10 @@ import type {
   JWTPayload,
   JWTClaimVerificationOptions,
   JWSHeaderParameters,
-} from './types';
-import { JWTClaimValidationFailed, JWTExpired } from './utils/errors';
+} from '../types';
+import { JWTClaimValidationFailed, JWTExpired } from '../utils/errors';
 
-import secs, { epoch } from './utils/secs';
+import secs, { epoch } from '../utils/secs';
 
 const normalizeTyp = (value: string) =>
   value.toLowerCase().replace(/^application\//, '');

package/src/{produce.ts → jwt/produce.ts}

@@ -1,6 +1,6 @@
-import type { JWTPayload } from './types';
-import isObject from './utils/is_object';
-import secs, { epoch } from './utils/secs';
+import type { JWTPayload } from '../types';
+import isObject from '../utils/is_object';
+import secs, { epoch } from '../utils/secs';
 
 /** Generic class for JWT producing. */
 export class ProduceJWT {

package/src/{sign.ts → jwt/sign.ts}

@@ -1,14 +1,14 @@
-import { JOSENotSupported, JWSInvalid, JWTInvalid } from './utils/errors';
+import { JOSENotSupported, JWSInvalid, JWTInvalid } from '../utils/errors';
 import type {
   CompactJWSHeaderParameters,
   JWTDecodeResult,
   JWTPayload,
-} from './types';
+} from '../types';
 import { ProduceJWT } from './produce';
-import { decodeBase64, encodeBase64, removePadding } from './utils/base64';
-import { isAlgSupported } from './algorithms';
+import { decodeBase64, encodeBase64, removePadding } from '../utils/base64';
+import { isAlgSupported } from '../algorithms';
 
-import { derToJose } from './utils/asn1';
+import { derToJose } from '../utils/asn1';
 
 /**
  * The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.

package/src/{unsecured.ts → jwt/unsecured.ts}

@@ -2,12 +2,12 @@ import type {
   JWSHeaderParameters,
   JWTClaimVerificationOptions,
   JWTPayload,
-} from './types';
+} from '../types';
 
-import { JWTInvalid } from './utils/errors';
+import { JWTInvalid } from '../utils/errors';
 import jwtPayload from './jwt_claims_set';
 import { ProduceJWT } from './produce';
-import { decodeBase64, encodeBase64 } from './utils/base64';
+import { decodeBase64, encodeBase64 } from '../utils/base64';
 
 export interface UnsecuredResult {
   payload: JWTPayload;

package/src/types.ts

@@ -1,3 +1,5 @@
+import { z } from 'zod';
+
 export interface JWTDecodeResult {
   /** JWT Claims Set. */
   payload: JWTPayload;
@@ -6,54 +8,6 @@ export interface JWTDecodeResult {
   protectedHeader: JWSHeaderParameters;
 }
 
-/**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", and "oct"
- * key types are supported.
- */
-export interface JWK {
-  /** JWK "alg" (Algorithm) Parameter. */
-  'alg'?: string;
-  'crv'?: string;
-  'd'?: string;
-  'dp'?: string;
-  'dq'?: string;
-  'e'?: string;
-  /** JWK "ext" (Extractable) Parameter. */
-  'ext'?: boolean;
-  'k'?: string;
-  /** JWK "key_ops" (Key Operations) Parameter. */
-  'key_ops'?: string[];
-  /** JWK "kid" (Key ID) Parameter. */
-  'kid'?: string;
-  /** JWK "kty" (Key Type) Parameter.
-   * This attribute is required to discriminate the
-   * type of EC/RSA algorithm */
-  'kty': string;
-  'n'?: string;
-  'oth'?: Array<{
-    d?: string;
-    r?: string;
-    t?: string;
-  }>;
-  'p'?: string;
-  'q'?: string;
-  'qi'?: string;
-  /** JWK "use" (Public Key Use) Parameter. */
-  'use'?: string;
-  'x'?: string;
-  'y'?: string;
-  /** JWK "x5c" (X.509 Certificate Chain) Parameter. */
-  'x5c'?: string[];
-  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter. */
-  'x5t'?: string;
-  /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter. */
-  'x5t#S256'?: string;
-  /** JWK "x5u" (X.509 URL) Parameter. */
-  'x5u'?: string;
-
-  [propName: string]: unknown;
-}
-
 export interface JoseHeaderParameters {
   /** "kid" (Key ID) Header Parameter. */
   kid?: string;
@@ -103,6 +57,18 @@ export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
   alg: string;
 }
 
+/** Recognized JWE Header Parameters, any other Header members may also be present. */
+export interface JWEHeaderParameters extends JoseHeaderParameters {
+  /** JWE "alg" (Algorithm) Header Parameter. */
+  alg?: 'RSA-OAEP-256' | 'RSA-OAEP';
+
+  /** JWE "enc" (Encryption Algorithm) Header Parameter. */
+  enc?: 'A256CBC-HS512' | 'A128CBC-HS256';
+
+  /** Any other JWE Header member. */
+  [propName: string]: unknown;
+}
+
 /** Recognized JWT Claims Set members, any other members may also be present. */
 export interface JWTPayload {
   /**
@@ -201,3 +167,56 @@ export interface JWTClaimVerificationOptions {
    */
   requiredClaims?: string[];
 }
+
+export type JWK = z.infer<typeof JWK>;
+export const JWK = z.object({
+  'alg': z.string().optional(),
+  'crv': z.string().optional(),
+  'd': z.string().optional(),
+  'dp': z.string().optional(),
+  'dq': z.string().optional(),
+  'e': z.string().optional(),
+  /** JWK "ext" (Extractable) Parameter. */
+  'ext': z.boolean().optional(),
+  'k': z.string().optional(),
+  /** JWK "key_ops" (Key Operations) Parameter. */
+  'key_ops': z.array(z.string()).optional(),
+  /** JWK "kid" (Key ID) Parameter. */
+  'kid': z.string().optional(),
+  /** JWK "kty" (Key Type) Parameter.
+   * This attribute is required to discriminate the
+   * type of EC/RSA algorithm */
+  'kty': z.string(),
+  'n': z.string().optional(),
+  'oth': z
+    .array(
+      z.object({
+        d: z.string().optional(),
+        r: z.string().optional(),
+        t: z.string().optional(),
+      })
+    )
+    .optional(),
+  'p': z.string().optional(),
+  'q': z.string().optional(),
+  'qi': z.string().optional(),
+  /** JWK "use" (Public Key Use) Parameter. */
+  'use': z.string().optional(),
+  'x': z.string().optional(),
+  'y': z.string().optional(),
+  /** JWK "x5c" (X.509 Certificate Chain) Parameter. */
+  'x5c': z.array(z.string()).optional(),
+  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter. */
+  'x5t': z.string().optional(),
+  /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter. */
+  'x5t#S256': z.string().optional(),
+  /** JWK "x5u" (X.509 URL) Parameter. */
+  'x5u': z.string().optional(),
+});
+
+export type WithJWKS = z.infer<typeof WithJWKS>;
+export const WithJWKS = z.object({
+  jwks: z.object({
+    keys: z.array(JWK),
+  }),
+});

package/src/utils/errors.ts

@@ -204,3 +204,52 @@ export class JWSSignatureVerificationFailed extends JOSEError {
 
   message = 'signature verification failed';
 }
+
+/**
+ * An error subclass thrown when a JWE is invalid.
+ *
+ * @example Checking thrown error is this one using a stable error code
+ *
+ * ```js
+ * if (err.code === 'ERR_JWE_INVALID') {
+ *   // ...
+ * }
+ * ```
+ *
+ * @example Checking thrown error is this one using `instanceof`
+ *
+ * ```js
+ * if (err instanceof errors.JWEInvalid) {
+ *   // ...
+ * }
+ * ```
+ */
+export class JWEInvalid extends JOSEError {
+  static get code(): 'ERR_JWE_INVALID' {
+    return 'ERR_JWE_INVALID';
+  }
+
+  code = 'ERR_JWE_INVALID';
+}
+
+/**
+ * An error subclass thrown when a JWKSet is invalid.
+ */
+export class JWKSetInvalid extends JOSEError {
+  static get code(): 'ERR_JWKS_INVALID' {
+    return 'ERR_JWKS_INVALID';
+  }
+
+  code = 'ERR_JWKS_INVALID';
+}
+
+/**
+ * An error subclass thrown when a JWK is not found.
+ */
+export class JWKNotFound extends JOSEError {
+  static get code(): 'ERR_JWK_NOT_FOUND' {
+    return 'ERR_JWK_NOT_FOUND';
+  }
+
+  code = 'ERR_JWK_NOT_FOUND';
+}