@pagopa/io-react-native-jwt 0.4.1

package/lib/commonjs/utils/secs.js

@@ -0,0 +1,61 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.epoch = exports.default = void 0;
+const minute = 60;
+const hour = minute * 60;
+const day = hour * 24;
+const week = day * 7;
+const year = day * 365.25;
+
+/*
+ * It allows to extract the value and the unit of measurement for the time.
+ * For example, indicating a string like "1s" or "1 second" or "3 hour"
+ * the regex extracts a group made up of [1, "s"], [1, "second"] or [3, "hour"]
+ */
+const REGEX = /^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i;
+var _default = str => {
+  const matched = REGEX.exec(str);
+  if (!matched) {
+    throw new TypeError('Invalid time period format');
+  }
+  const value = parseFloat(matched[1]);
+  const unit = matched[2].toLowerCase();
+  switch (unit) {
+    case 'sec':
+    case 'secs':
+    case 'second':
+    case 'seconds':
+    case 's':
+      return Math.round(value);
+    case 'minute':
+    case 'minutes':
+    case 'min':
+    case 'mins':
+    case 'm':
+      return Math.round(value * minute);
+    case 'hour':
+    case 'hours':
+    case 'hr':
+    case 'hrs':
+    case 'h':
+      return Math.round(value * hour);
+    case 'day':
+    case 'days':
+    case 'd':
+      return Math.round(value * day);
+    case 'week':
+    case 'weeks':
+    case 'w':
+      return Math.round(value * week);
+    // years matched
+    default:
+      return Math.round(value * year);
+  }
+};
+exports.default = _default;
+const epoch = date => Math.floor(date.getTime() / 1000);
+exports.epoch = epoch;
+//# sourceMappingURL=secs.js.map

package/lib/commonjs/utils/secs.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["minute","hour","day","week","year","REGEX","_default","str","matched","exec","TypeError","value","parseFloat","unit","toLowerCase","Math","round","exports","default","epoch","date","floor","getTime"],"sourceRoot":"../../../src","sources":["utils/secs.ts"],"mappings":";;;;;;AAAA,MAAMA,MAAM,GAAG,EAAE;AACjB,MAAMC,IAAI,GAAGD,MAAM,GAAG,EAAE;AACxB,MAAME,GAAG,GAAGD,IAAI,GAAG,EAAE;AACrB,MAAME,IAAI,GAAGD,GAAG,GAAG,CAAC;AACpB,MAAME,IAAI,GAAGF,GAAG,GAAG,MAAM;;AAEzB;AACA;AACA;AACA;AACA;AACA,MAAMG,KAAK,GACT,qGAAqG;AAAC,IAAAC,QAAA,GAExFC,GAAW,IAAa;EACtC,MAAMC,OAAO,GAAGH,KAAK,CAACI,IAAI,CAACF,GAAG,CAAC;EAE/B,IAAI,CAACC,OAAO,EAAE;IACZ,MAAM,IAAIE,SAAS,CAAC,4BAA4B,CAAC;EACnD;EAEA,MAAMC,KAAK,GAAGC,UAAU,CAACJ,OAAO,CAAC,CAAC,CAAE,CAAC;EACrC,MAAMK,IAAI,GAAGL,OAAO,CAAC,CAAC,CAAC,CAAEM,WAAW,CAAC,CAAC;EAEtC,QAAQD,IAAI;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,QAAQ;IACb,KAAK,SAAS;IACd,KAAK,GAAG;MACN,OAAOE,IAAI,CAACC,KAAK,CAACL,KAAK,CAAC;IAC1B,KAAK,QAAQ;IACb,KAAK,SAAS;IACd,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,GAAG;MACN,OAAOI,IAAI,CAACC,KAAK,CAACL,KAAK,GAAGX,MAAM,CAAC;IACnC,KAAK,MAAM;IACX,KAAK,OAAO;IACZ,KAAK,IAAI;IACT,KAAK,KAAK;IACV,KAAK,GAAG;MACN,OAAOe,IAAI,CAACC,KAAK,CAACL,KAAK,GAAGV,IAAI,CAAC;IACjC,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,GAAG;MACN,OAAOc,IAAI,CAACC,KAAK,CAACL,KAAK,GAAGT,GAAG,CAAC;IAChC,KAAK,MAAM;IACX,KAAK,OAAO;IACZ,KAAK,GAAG;MACN,OAAOa,IAAI,CAACC,KAAK,CAACL,KAAK,GAAGR,IAAI,CAAC;IACjC;IACA;MACE,OAAOY,IAAI,CAACC,KAAK,CAACL,KAAK,GAAGP,IAAI,CAAC;EACnC;AACF,CAAC;AAAAa,OAAA,CAAAC,OAAA,GAAAZ,QAAA;AAEM,MAAMa,KAAK,GAAIC,IAAU,IAAKL,IAAI,CAACM,KAAK,CAACD,IAAI,CAACE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;AAACL,OAAA,CAAAE,KAAA,GAAAA,KAAA"}

package/lib/module/algorithms.js

@@ -0,0 +1,29 @@
+import { JOSENotSupported } from './utils/errors';
+export const supportedAlgorithms = ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'ES256', 'ES384', 'ES512'];
+export const isAlgSupported = alg => supportedAlgorithms.includes(alg.toUpperCase());
+export const getKtyFromAlg = alg => {
+  switch (alg.slice(0, 2)) {
+    case 'RS':
+    case 'PS':
+      return 'RSA';
+    case 'ES':
+      return 'EC';
+    default:
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+  }
+};
+
+// Coordinates length in bytes: bits/8
+export const getCoordinateOctetLength = alg => {
+  switch (alg.slice(2, 5)) {
+    case '256':
+      return 32;
+    case '384':
+      return 48;
+    case '512':
+      return 66;
+    default:
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+  }
+};
+//# sourceMappingURL=algorithms.js.map

package/lib/module/algorithms.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["JOSENotSupported","supportedAlgorithms","isAlgSupported","alg","includes","toUpperCase","getKtyFromAlg","slice","getCoordinateOctetLength"],"sourceRoot":"../../src","sources":["algorithms.ts"],"mappings":"AAAA,SAASA,gBAAgB,QAAQ,gBAAgB;AAEjD,OAAO,MAAMC,mBAAmB,GAAG,CACjC,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR;AAED,OAAO,MAAMC,cAAc,GAAIC,GAAW,IACxCF,mBAAmB,CAACG,QAAQ,CAACD,GAAG,CAACE,WAAW,CAAC,CAAC,CAAC;AAEjD,OAAO,MAAMC,aAAa,GAAIH,GAAW,IAAK;EAC5C,QAAQA,GAAG,CAACI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,KAAK,IAAI;IACT,KAAK,IAAI;MACP,OAAO,KAAK;IACd,KAAK,IAAI;MACP,OAAO,IAAI;IACb;MACE,MAAM,IAAIP,gBAAgB,CACxB,gDACF,CAAC;EACL;AACF,CAAC;;AAED;AACA,OAAO,MAAMQ,wBAAwB,GAAIL,GAAW,IAAK;EACvD,QAAQA,GAAG,CAACI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,KAAK,KAAK;MACR,OAAO,EAAE;IACX,KAAK,KAAK;MACR,OAAO,EAAE;IACX,KAAK,KAAK;MACR,OAAO,EAAE;IACX;MACE,MAAM,IAAIP,gBAAgB,CACxB,gDACF,CAAC;EACL;AACF,CAAC"}

package/lib/module/hash.js

@@ -0,0 +1,11 @@
+import { removePadding } from './utils/base64';
+import { IoReactNativeJwt } from './utils/proxy';
+
+/**
+ * Return base64 encoded SHA256 hash of input string
+ */
+export const sha256ToBase64 = async toHash => {
+  let hash = await IoReactNativeJwt.sha256(toHash);
+  return removePadding(hash);
+};
+//# sourceMappingURL=hash.js.map

package/lib/module/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["removePadding","IoReactNativeJwt","sha256ToBase64","toHash","hash","sha256"],"sourceRoot":"../../src","sources":["hash.ts"],"mappings":"AAAA,SAASA,aAAa,QAAQ,gBAAgB;AAC9C,SAASC,gBAAgB,QAAQ,eAAe;;AAEhD;AACA;AACA;AACA,OAAO,MAAMC,cAAc,GAAG,MAAOC,MAAc,IAAsB;EACvE,IAAIC,IAAI,GAAG,MAAMH,gBAAgB,CAACI,MAAM,CAACF,MAAM,CAAC;EAChD,OAAOH,aAAa,CAACI,IAAI,CAAC;AAC5B,CAAC"}

package/lib/module/index.js

@@ -0,0 +1,115 @@
+import jwtPayload from './jwt_claims_set';
+import { JWSSignatureVerificationFailed } from './utils/errors';
+import { IoReactNativeJwt } from './utils/proxy';
+import { SignJWT } from './sign';
+export * from './produce';
+export * from './sign';
+export * from './unsecured';
+export { derToJose } from './utils/asn1';
+export { encodeBase64, decodeBase64 } from './utils/base64';
+export { sha256ToBase64 } from './hash';
+/**
+ * Decode the JWT without validation.
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await decode(jwt)
+ *
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ */
+export const decode = token => SignJWT.decode(token);
+
+/**
+ * Verifies the JWS signature
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwk = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * }
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const isSignatureValid = await verify(jwt, jwk)
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ * @param key Public key to verify the JWT in JWK format.
+ */
+export const isSignatureValid = (token, jwk) => IoReactNativeJwt.verify(token, jwk);
+
+/**
+ * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
+ * JWT Claims Set.
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwk = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * }
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await verify(jwt, jwk, {
+ *   typ: 'entity-statement+jwt',
+ *   requiredClaims: ['iss', 'sub', 'metadata'],
+ * })
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ * @param key Public key to verify the JWT in JWK format.
+ * @param options JWT Decryption and JWT Claims Set validation options.
+ */
+export const verify = async function (token, jwk) {
+  let options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+  const {
+    protectedHeader,
+    payload
+  } = await decode(token);
+  const signatureIsValid = await isSignatureValid(token, jwk);
+  if (signatureIsValid) {
+    const verifiedPayload = jwtPayload(protectedHeader, payload, options);
+    return {
+      payload: verifiedPayload,
+      protectedHeader
+    };
+  } else {
+    throw new JWSSignatureVerificationFailed();
+  }
+};
+
+/**
+ * Calculate JWK thumbprint
+ *
+ * @example Get JWK thumbprint
+ *
+ * ```js
+ * const jwk: JWK = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * };
+
+ * const thumbprint = await thumbprint(jwk)
+ *
+ * ```
+ *
+ * @param jwk JSON Web Key
+ */
+export const thumbprint = jwk => IoReactNativeJwt.thumbprint(jwk);
+//# sourceMappingURL=index.js.map

package/lib/module/index.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["jwtPayload","JWSSignatureVerificationFailed","IoReactNativeJwt","SignJWT","derToJose","encodeBase64","decodeBase64","sha256ToBase64","decode","token","isSignatureValid","jwk","verify","options","arguments","length","undefined","protectedHeader","payload","signatureIsValid","verifiedPayload","thumbprint"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":"AAKA,OAAOA,UAAU,MAAM,kBAAkB;AACzC,SAASC,8BAA8B,QAAQ,gBAAgB;AAC/D,SAASC,gBAAgB,QAAQ,eAAe;AAChD,SAASC,OAAO,QAAQ,QAAQ;AAEhC,cAAc,WAAW;AACzB,cAAc,QAAQ;AACtB,cAAc,aAAa;AAC3B,SAASC,SAAS,QAAQ,cAAc;AACxC,SAASC,YAAY,EAAEC,YAAY,QAAQ,gBAAgB;AAC3D,SAASC,cAAc,QAAQ,QAAQ;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,MAAM,GAAIC,KAAa,IAAsBN,OAAO,CAACK,MAAM,CAACC,KAAK,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,gBAAgB,GAAGA,CAACD,KAAa,EAAEE,GAAQ,KACtDT,gBAAgB,CAACU,MAAM,CAACH,KAAK,EAAEE,GAAG,CAAC;;AAErC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,MAAM,GAAG,eAAAA,CACpBH,KAAa,EACbE,GAAQ,EAEqB;EAAA,IAD7BE,OAAoC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzC,MAAM;IAAEG,eAAe;IAAEC;EAAQ,CAAC,GAAG,MAAMV,MAAM,CAACC,KAAK,CAAC;EACxD,MAAMU,gBAAgB,GAAG,MAAMT,gBAAgB,CAACD,KAAK,EAAEE,GAAG,CAAC;EAE3D,IAAIQ,gBAAgB,EAAE;IACpB,MAAMC,eAAe,GAAGpB,UAAU,CAACiB,eAAe,EAAEC,OAAO,EAAEL,OAAO,CAAC;IACrE,OAAO;MAAEK,OAAO,EAAEE,eAAe;MAAEH;IAAgB,CAAC;EACtD,CAAC,MAAM;IACL,MAAM,IAAIhB,8BAA8B,CAAC,CAAC;EAC5C;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMoB,UAAU,GAAIV,GAAQ,IACjCT,gBAAgB,CAACmB,UAAU,CAACV,GAAG,CAAC"}

package/lib/module/jwt_claims_set.js

@@ -0,0 +1,103 @@
+/*
+ * This code comes from https://github.com/panva/jose
+ */
+
+import { JWTClaimValidationFailed, JWTExpired } from './utils/errors';
+import secs, { epoch } from './utils/secs';
+const normalizeTyp = value => value.toLowerCase().replace(/^application\//, '');
+const checkAudiencePresence = (audPayload, audOption) => {
+  if (typeof audPayload === 'string') {
+    return audOption.includes(audPayload);
+  }
+  if (Array.isArray(audPayload)) {
+    /*
+     * Each principal intended to process the JWT MUST
+     * identify itself with a value in the audience claim
+     */
+    return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
+  }
+  return false;
+};
+export default (function (protectedHeader, payload) {
+  let options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+  const {
+    typ
+  } = options;
+  if (typ && (typeof protectedHeader.typ !== 'string' || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
+  }
+  const {
+    requiredClaims = [],
+    issuer,
+    subject,
+    audience,
+    maxTokenAge
+  } = options;
+  if (maxTokenAge !== undefined) requiredClaims.push('iat');
+  if (audience !== undefined) requiredClaims.push('aud');
+  if (subject !== undefined) requiredClaims.push('sub');
+  if (issuer !== undefined) requiredClaims.push('iss');
+  for (const claim of new Set(requiredClaims.reverse())) {
+    if (!(claim in payload)) {
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+    }
+  }
+  if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
+    throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
+  }
+  if (subject && payload.sub !== subject) {
+    throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
+  }
+  if (audience && !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
+    throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
+  }
+  let tolerance;
+  switch (typeof options.clockTolerance) {
+    case 'string':
+      tolerance = secs(options.clockTolerance);
+      break;
+    case 'number':
+      tolerance = options.clockTolerance;
+      break;
+    case 'undefined':
+      tolerance = 0;
+      break;
+    default:
+      throw new TypeError('Invalid clockTolerance option type');
+  }
+  const {
+    currentDate
+  } = options;
+  const now = epoch(currentDate || new Date());
+  if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
+    throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
+  }
+  if (payload.nbf !== undefined) {
+    if (typeof payload.nbf !== 'number') {
+      throw new JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
+    }
+    if (payload.nbf > now + tolerance) {
+      throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
+    }
+  }
+  if (payload.exp !== undefined) {
+    if (typeof payload.exp !== 'number') {
+      throw new JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
+    }
+    if (payload.exp <= now - tolerance) {
+      throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
+    }
+  }
+  if (maxTokenAge) {
+    const age = now - payload.iat;
+    const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
+    if (age - tolerance > max) {
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
+    }
+    if (age < 0 - tolerance) {
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
+    }
+  }
+  return payload;
+});
+//# sourceMappingURL=jwt_claims_set.js.map

package/lib/module/jwt_claims_set.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["JWTClaimValidationFailed","JWTExpired","secs","epoch","normalizeTyp","value","toLowerCase","replace","checkAudiencePresence","audPayload","audOption","includes","Array","isArray","some","Set","prototype","has","bind","protectedHeader","payload","options","arguments","length","undefined","typ","requiredClaims","issuer","subject","audience","maxTokenAge","push","claim","reverse","iss","sub","aud","tolerance","clockTolerance","TypeError","currentDate","now","Date","iat","nbf","exp","age","max"],"sourceRoot":"../../src","sources":["jwt_claims_set.ts"],"mappings":"AAAA;AACA;AACA;;AAMA,SAASA,wBAAwB,EAAEC,UAAU,QAAQ,gBAAgB;AAErE,OAAOC,IAAI,IAAIC,KAAK,QAAQ,cAAc;AAE1C,MAAMC,YAAY,GAAIC,KAAa,IACjCA,KAAK,CAACC,WAAW,CAAC,CAAC,CAACC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;AAEnD,MAAMC,qBAAqB,GAAGA,CAACC,UAAmB,EAAEC,SAAoB,KAAK;EAC3E,IAAI,OAAOD,UAAU,KAAK,QAAQ,EAAE;IAClC,OAAOC,SAAS,CAACC,QAAQ,CAACF,UAAU,CAAC;EACvC;EAEA,IAAIG,KAAK,CAACC,OAAO,CAACJ,UAAU,CAAC,EAAE;IAC7B;AACJ;AACA;AACA;IACI,OAAOC,SAAS,CAACI,IAAI,CAACC,GAAG,CAACC,SAAS,CAACC,GAAG,CAACC,IAAI,CAAC,IAAIH,GAAG,CAACN,UAAU,CAAC,CAAC,CAAC;EACpE;EAEA,OAAO,KAAK;AACd,CAAC;AAED,gBAAe,UACbU,eAAoC,EACpCC,OAAmB,EAEhB;EAAA,IADHC,OAAoC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzC,MAAM;IAAEG;EAAI,CAAC,GAAGJ,OAAO;EACvB,IACEI,GAAG,KACF,OAAON,eAAe,CAAEM,GAAG,KAAK,QAAQ,IACvCrB,YAAY,CAACe,eAAe,CAAEM,GAAG,CAAC,KAAKrB,YAAY,CAACqB,GAAG,CAAC,CAAC,EAC3D;IACA,MAAM,IAAIzB,wBAAwB,CAChC,mCAAmC,EACnC,KAAK,EACL,cACF,CAAC;EACH;EAEA,MAAM;IACJ0B,cAAc,GAAG,EAAE;IACnBC,MAAM;IACNC,OAAO;IACPC,QAAQ;IACRC;EACF,CAAC,GAAGT,OAAO;EAEX,IAAIS,WAAW,KAAKN,SAAS,EAAEE,cAAc,CAACK,IAAI,CAAC,KAAK,CAAC;EACzD,IAAIF,QAAQ,KAAKL,SAAS,EAAEE,cAAc,CAACK,IAAI,CAAC,KAAK,CAAC;EACtD,IAAIH,OAAO,KAAKJ,SAAS,EAAEE,cAAc,CAACK,IAAI,CAAC,KAAK,CAAC;EACrD,IAAIJ,MAAM,KAAKH,SAAS,EAAEE,cAAc,CAACK,IAAI,CAAC,KAAK,CAAC;EAEpD,KAAK,MAAMC,KAAK,IAAI,IAAIjB,GAAG,CAACW,cAAc,CAACO,OAAO,CAAC,CAAC,CAAC,EAAE;IACrD,IAAI,EAAED,KAAK,IAAIZ,OAAO,CAAC,EAAE;MACvB,MAAM,IAAIpB,wBAAwB,CAC/B,qBAAoBgC,KAAM,SAAQ,EACnCA,KAAK,EACL,SACF,CAAC;IACH;EACF;EAEA,IACEL,MAAM,IACN,CAAC,CAAaf,KAAK,CAACC,OAAO,CAACc,MAAM,CAAC,GAAGA,MAAM,GAAG,CAACA,MAAM,CAAC,EAAGhB,QAAQ,CAChES,OAAO,CAACc,GACV,CAAC,EACD;IACA,MAAM,IAAIlC,wBAAwB,CAChC,8BAA8B,EAC9B,KAAK,EACL,cACF,CAAC;EACH;EAEA,IAAI4B,OAAO,IAAIR,OAAO,CAACe,GAAG,KAAKP,OAAO,EAAE;IACtC,MAAM,IAAI5B,wBAAwB,CAChC,8BAA8B,EAC9B,KAAK,EACL,cACF,CAAC;EACH;EAEA,IACE6B,QAAQ,IACR,CAACrB,qBAAqB,CACpBY,OAAO,CAACgB,GAAG,EACX,OAAOP,QAAQ,KAAK,QAAQ,GAAG,CAACA,QAAQ,CAAC,GAAGA,QAC9C,CAAC,EACD;IACA,MAAM,IAAI7B,wBAAwB,CAChC,8BAA8B,EAC9B,KAAK,EACL,cACF,CAAC;EACH;EAEA,IAAIqC,SAAiB;EACrB,QAAQ,OAAOhB,OAAO,CAACiB,cAAc;IACnC,KAAK,QAAQ;MACXD,SAAS,GAAGnC,IAAI,CAACmB,OAAO,CAACiB,cAAc,CAAC;MACxC;IACF,KAAK,QAAQ;MACXD,SAAS,GAAGhB,OAAO,CAACiB,cAAc;MAClC;IACF,KAAK,WAAW;MACdD,SAAS,GAAG,CAAC;MACb;IACF;MACE,MAAM,IAAIE,SAAS,CAAC,oCAAoC,CAAC;EAC7D;EAEA,MAAM;IAAEC;EAAY,CAAC,GAAGnB,OAAO;EAC/B,MAAMoB,GAAG,GAAGtC,KAAK,CAACqC,WAAW,IAAI,IAAIE,IAAI,CAAC,CAAC,CAAC;EAE5C,IACE,CAACtB,OAAO,CAACuB,GAAG,KAAKnB,SAAS,IAAIM,WAAW,KACzC,OAAOV,OAAO,CAACuB,GAAG,KAAK,QAAQ,EAC/B;IACA,MAAM,IAAI3C,wBAAwB,CAChC,8BAA8B,EAC9B,KAAK,EACL,SACF,CAAC;EACH;EAEA,IAAIoB,OAAO,CAACwB,GAAG,KAAKpB,SAAS,EAAE;IAC7B,IAAI,OAAOJ,OAAO,CAACwB,GAAG,KAAK,QAAQ,EAAE;MACnC,MAAM,IAAI5C,wBAAwB,CAChC,8BAA8B,EAC9B,KAAK,EACL,SACF,CAAC;IACH;IACA,IAAIoB,OAAO,CAACwB,GAAG,GAAGH,GAAG,GAAGJ,SAAS,EAAE;MACjC,MAAM,IAAIrC,wBAAwB,CAChC,oCAAoC,EACpC,KAAK,EACL,cACF,CAAC;IACH;EACF;EAEA,IAAIoB,OAAO,CAACyB,GAAG,KAAKrB,SAAS,EAAE;IAC7B,IAAI,OAAOJ,OAAO,CAACyB,GAAG,KAAK,QAAQ,EAAE;MACnC,MAAM,IAAI7C,wBAAwB,CAChC,8BAA8B,EAC9B,KAAK,EACL,SACF,CAAC;IACH;IACA,IAAIoB,OAAO,CAACyB,GAAG,IAAIJ,GAAG,GAAGJ,SAAS,EAAE;MAClC,MAAM,IAAIpC,UAAU,CAClB,oCAAoC,EACpC,KAAK,EACL,cACF,CAAC;IACH;EACF;EAEA,IAAI6B,WAAW,EAAE;IACf,MAAMgB,GAAG,GAAGL,GAAG,GAAGrB,OAAO,CAACuB,GAAI;IAC9B,MAAMI,GAAG,GACP,OAAOjB,WAAW,KAAK,QAAQ,GAAGA,WAAW,GAAG5B,IAAI,CAAC4B,WAAW,CAAC;IAEnE,IAAIgB,GAAG,GAAGT,SAAS,GAAGU,GAAG,EAAE;MACzB,MAAM,IAAI9C,UAAU,CAClB,0DAA0D,EAC1D,KAAK,EACL,cACF,CAAC;IACH;IAEA,IAAI6C,GAAG,GAAG,CAAC,GAAGT,SAAS,EAAE;MACvB,MAAM,IAAIrC,wBAAwB,CAChC,+DAA+D,EAC/D,KAAK,EACL,cACF,CAAC;IACH;EACF;EAEA,OAAmBoB,OAAO;AAC5B,CAAC"}

package/lib/module/produce.js

@@ -0,0 +1,131 @@
+import isObject from './utils/is_object';
+import secs, { epoch } from './utils/secs';
+
+/** Generic class for JWT producing. */
+export class ProduceJWT {
+  /** @param payload The JWT Claims Set object. */
+  constructor(payload) {
+    if (!isObject(payload)) {
+      throw new TypeError('JWT Claims Set MUST be an object');
+    }
+    this._payload = payload;
+  }
+
+  /**
+   * Set "iss" (Issuer) Claim.
+   *
+   * @param issuer "Issuer" Claim value to set on the JWT Claims Set.
+   */
+  setIssuer(issuer) {
+    this._payload = {
+      ...this._payload,
+      iss: issuer
+    };
+    return this;
+  }
+
+  /**
+   * Set "sub" (Subject) Claim.
+   *
+   * @param subject "sub" (Subject) Claim value to set on the JWT Claims Set.
+   */
+  setSubject(subject) {
+    this._payload = {
+      ...this._payload,
+      sub: subject
+    };
+    return this;
+  }
+
+  /**
+   * Set "aud" (Audience) Claim.
+   *
+   * @param audience "aud" (Audience) Claim value to set on the JWT Claims Set.
+   */
+  setAudience(audience) {
+    this._payload = {
+      ...this._payload,
+      aud: audience
+    };
+    return this;
+  }
+
+  /**
+   * Set "jti" (JWT ID) Claim.
+   *
+   * @param jwtId "jti" (JWT ID) Claim value to set on the JWT Claims Set.
+   */
+  setJti(jwtId) {
+    this._payload = {
+      ...this._payload,
+      jti: jwtId
+    };
+    return this;
+  }
+
+  /**
+   * Set "nbf" (Not Before) Claim.
+   *
+   * @param input "nbf" (Not Before) Claim value to set on the JWT Claims Set. When number is passed
+   *   that is used as a value, when string is passed it is resolved to a time span and added to the
+   *   current timestamp.
+   */
+  setNotBefore(input) {
+    if (typeof input === 'number') {
+      this._payload = {
+        ...this._payload,
+        nbf: input
+      };
+    } else {
+      this._payload = {
+        ...this._payload,
+        nbf: epoch(new Date()) + secs(input)
+      };
+    }
+    return this;
+  }
+
+  /**
+   * Set "exp" (Expiration Time) Claim.
+   *
+   * @param input "exp" (Expiration Time) Claim value to set on the JWT Claims Set. When number is
+   *   passed that is used as a value, when string is passed it is resolved to a time span and added
+   *   to the current timestamp.
+   */
+  setExpirationTime(input) {
+    if (typeof input === 'number') {
+      this._payload = {
+        ...this._payload,
+        exp: input
+      };
+    } else {
+      this._payload = {
+        ...this._payload,
+        exp: epoch(new Date()) + secs(input)
+      };
+    }
+    return this;
+  }
+
+  /**
+   * Set "iat" (Issued At) Claim.
+   *
+   * @param input "iat" (Issued At) Claim value to set on the JWT Claims Set. Default is current
+   *   timestamp.
+   */
+  setIssuedAt(input) {
+    if (typeof input === 'undefined') {
+      this._payload = {
+        ...this._payload,
+        iat: epoch(new Date())
+      };
+    } else {
+      this._payload = {
+        ...this._payload,
+        iat: input
+      };
+    }
+    return this;
+  }
+}
+//# sourceMappingURL=produce.js.map

package/lib/module/produce.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["isObject","secs","epoch","ProduceJWT","constructor","payload","TypeError","_payload","setIssuer","issuer","iss","setSubject","subject","sub","setAudience","audience","aud","setJti","jwtId","jti","setNotBefore","input","nbf","Date","setExpirationTime","exp","setIssuedAt","iat"],"sourceRoot":"../../src","sources":["produce.ts"],"mappings":"AACA,OAAOA,QAAQ,MAAM,mBAAmB;AACxC,OAAOC,IAAI,IAAIC,KAAK,QAAQ,cAAc;;AAE1C;AACA,OAAO,MAAMC,UAAU,CAAC;EAGtB;EACAC,WAAWA,CAACC,OAAmB,EAAE;IAC/B,IAAI,CAACL,QAAQ,CAACK,OAAO,CAAC,EAAE;MACtB,MAAM,IAAIC,SAAS,CAAC,kCAAkC,CAAC;IACzD;IACA,IAAI,CAACC,QAAQ,GAAGF,OAAO;EACzB;;EAEA;AACF;AACA;AACA;AACA;EACEG,SAASA,CAACC,MAAc,EAAE;IACxB,IAAI,CAACF,QAAQ,GAAG;MAAE,GAAG,IAAI,CAACA,QAAQ;MAAEG,GAAG,EAAED;IAAO,CAAC;IACjD,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;AACA;EACEE,UAAUA,CAACC,OAAe,EAAE;IAC1B,IAAI,CAACL,QAAQ,GAAG;MAAE,GAAG,IAAI,CAACA,QAAQ;MAAEM,GAAG,EAAED;IAAQ,CAAC;IAClD,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;AACA;EACEE,WAAWA,CAACC,QAA2B,EAAE;IACvC,IAAI,CAACR,QAAQ,GAAG;MAAE,GAAG,IAAI,CAACA,QAAQ;MAAES,GAAG,EAAED;IAAS,CAAC;IACnD,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;AACA;EACEE,MAAMA,CAACC,KAAa,EAAE;IACpB,IAAI,CAACX,QAAQ,GAAG;MAAE,GAAG,IAAI,CAACA,QAAQ;MAAEY,GAAG,EAAED;IAAM,CAAC;IAChD,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;EACEE,YAAYA,CAACC,KAAsB,EAAE;IACnC,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE;MAC7B,IAAI,CAACd,QAAQ,GAAG;QAAE,GAAG,IAAI,CAACA,QAAQ;QAAEe,GAAG,EAAED;MAAM,CAAC;IAClD,CAAC,MAAM;MACL,IAAI,CAACd,QAAQ,GAAG;QACd,GAAG,IAAI,CAACA,QAAQ;QAChBe,GAAG,EAAEpB,KAAK,CAAC,IAAIqB,IAAI,CAAC,CAAC,CAAC,GAAGtB,IAAI,CAACoB,KAAK;MACrC,CAAC;IACH;IACA,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;EACEG,iBAAiBA,CAACH,KAAsB,EAAE;IACxC,IAAI,OAAOA,KAAK,KAAK,QAAQ,EAAE;MAC7B,IAAI,CAACd,QAAQ,GAAG;QAAE,GAAG,IAAI,CAACA,QAAQ;QAAEkB,GAAG,EAAEJ;MAAM,CAAC;IAClD,CAAC,MAAM;MACL,IAAI,CAACd,QAAQ,GAAG;QACd,GAAG,IAAI,CAACA,QAAQ;QAChBkB,GAAG,EAAEvB,KAAK,CAAC,IAAIqB,IAAI,CAAC,CAAC,CAAC,GAAGtB,IAAI,CAACoB,KAAK;MACrC,CAAC;IACH;IACA,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;AACA;AACA;EACEK,WAAWA,CAACL,KAAc,EAAE;IAC1B,IAAI,OAAOA,KAAK,KAAK,WAAW,EAAE;MAChC,IAAI,CAACd,QAAQ,GAAG;QAAE,GAAG,IAAI,CAACA,QAAQ;QAAEoB,GAAG,EAAEzB,KAAK,CAAC,IAAIqB,IAAI,CAAC,CAAC;MAAE,CAAC;IAC9D,CAAC,MAAM;MACL,IAAI,CAAChB,QAAQ,GAAG;QAAE,GAAG,IAAI,CAACA,QAAQ;QAAEoB,GAAG,EAAEN;MAAM,CAAC;IAClD;IACA,OAAO,IAAI;EACb;AACF"}

package/lib/module/sign.js

@@ -0,0 +1,153 @@
+import { JOSENotSupported, JWSInvalid, JWTInvalid } from './utils/errors';
+import { ProduceJWT } from './produce';
+import { decodeBase64, encodeBase64, removePadding } from './utils/base64';
+import { isAlgSupported } from './algorithms';
+import { derToJose } from './utils/asn1';
+
+/**
+ * The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
+ *
+ * @example Usage with a given signature
+ *
+ * ```js
+ * const alg = 'RS256'
+ * const signature = 'Axy0....'
+ *
+ * const jwt = new SignJWT({ 'urn:example:claim': true })
+ *   .setProtectedHeader({ alg })
+ *   .setIssuedAt()
+ *   .setIssuer('urn:example:issuer')
+ *   .setAudience('urn:example:audience')
+ *   .setExpirationTime('2h')
+ *   .sign(signature)
+ *
+ * console.log(jwt)
+ * ```
+ */
+export class SignJWT extends ProduceJWT {
+  /**
+   * Sets the JWS Protected Header on the SignJWT object.
+   *
+   * @param protectedHeader JWS Protected Header. Must contain an "alg" (JWS Algorithm) property.
+   */
+  setProtectedHeader(protectedHeader) {
+    if (protectedHeader.alg && isAlgSupported(protectedHeader.alg)) {
+      this._protectedHeader = protectedHeader;
+      return this;
+    }
+    throw new JOSENotSupported('Unsupported "alg" value');
+  }
+
+  /**
+   * Return a JWT without signature (`header.payload`) to sign.
+   *
+   */
+  toSign() {
+    if (!this._protectedHeader || !this._protectedHeader.alg) {
+      throw new JWSInvalid('Missing signature algorithm. Specify the `alg` field');
+    }
+    const protectedHeader = encodeBase64(JSON.stringify(this._protectedHeader));
+    const payload = encodeBase64(JSON.stringify(this._payload));
+    if (payload && protectedHeader) {
+      return `${protectedHeader}.${payload}`;
+    } else {
+      throw new JWSInvalid();
+    }
+  }
+
+  /**
+   * Append signature to unsigned JWT.
+   * For an ECDSA signature it is required that this is in ASN.1/DER encoded format.
+   * The same format used by the TEE. Conversion to JWS is handled automatically.
+   *
+   * @param jwtWithoutSignature
+   * @param signature
+   */
+  static async appendSignature(jwtWithoutSignature, signature) {
+    if (typeof jwtWithoutSignature !== 'string' || typeof signature !== 'string') {
+      throw new JWTInvalid('JWS must be a string');
+    }
+    if (signature === '') throw new JWSInvalid('Invalid signature');
+    const jwtDecoded = SignJWT.decodeJwtWithoutSignature(jwtWithoutSignature);
+    const alg = jwtDecoded.header.alg;
+    try {
+      const encodedJws = await derToJose(signature, alg);
+      return `${jwtWithoutSignature}.${encodedJws}`;
+    } catch {
+      const encodedJws = removePadding(signature);
+      return `${jwtWithoutSignature}.${encodedJws}`;
+    }
+  }
+
+  /**
+   * Decodes a JWT without signature
+   *
+   * @param jwtWithoutSignature JWT to sign that needs to be decoded.
+   */
+  static decodeJwtWithoutSignature(jwtWithoutSignature) {
+    if (typeof jwtWithoutSignature !== 'string') {
+      throw new JWTInvalid('JWT must be a string');
+    }
+    const {
+      0: encodedHeader,
+      1: encodedPayload,
+      length
+    } = jwtWithoutSignature.split('.');
+    let header;
+    try {
+      let decoded = decodeBase64(encodedHeader);
+      header = JSON.parse(decoded);
+      if (!header.alg || !isAlgSupported(header.alg)) {
+        throw new JOSENotSupported('Unsupported "alg" value');
+      }
+    } catch {
+      throw new JWTInvalid('Unable to decode JWT header');
+    }
+    if (length !== 2 || encodedPayload === '') {
+      throw new JWTInvalid('Invalid JWT to sign');
+    }
+    let decodedPayload = decodeBase64(encodedPayload);
+    const payload = JSON.parse(decodedPayload);
+    return {
+      payload,
+      header
+    };
+  }
+
+  /**
+   * Decodes a JWT without signature
+   *
+   * @param jwtWithoutSignature JWT to sign that needs to be decoded.
+   */
+  static decode(jwt) {
+    if (typeof jwt !== 'string') {
+      throw new JWTInvalid('JWT must be a string');
+    }
+    const {
+      0: encodedHeader,
+      1: encodedPayload,
+      2: signature,
+      length
+    } = jwt.split('.');
+    let protectedHeader;
+    try {
+      let decoded = decodeBase64(encodedHeader);
+      protectedHeader = JSON.parse(decoded);
+      if (!protectedHeader.alg || !isAlgSupported(protectedHeader.alg)) {
+        throw new JOSENotSupported('Unsupported "alg" value');
+      }
+    } catch {
+      throw new JWTInvalid('Unable to decode JWT header');
+    }
+    if (length !== 3 || encodedPayload === '' || signature === '') {
+      throw new JWTInvalid('Invalid JWT');
+    }
+    let decodedPayload = decodeBase64(encodedPayload);
+    const payload = JSON.parse(decodedPayload);
+    return {
+      payload,
+      protectedHeader
+    };
+  }
+}
+//# sourceMappingURL=sign.js.map

package/lib/module/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["JOSENotSupported","JWSInvalid","JWTInvalid","ProduceJWT","decodeBase64","encodeBase64","removePadding","isAlgSupported","derToJose","SignJWT","setProtectedHeader","protectedHeader","alg","_protectedHeader","toSign","JSON","stringify","payload","_payload","appendSignature","jwtWithoutSignature","signature","jwtDecoded","decodeJwtWithoutSignature","header","encodedJws","encodedHeader","encodedPayload","length","split","decoded","parse","decodedPayload","decode","jwt"],"sourceRoot":"../../src","sources":["sign.ts"],"mappings":"AAAA,SAASA,gBAAgB,EAAEC,UAAU,EAAEC,UAAU,QAAQ,gBAAgB;AAMzE,SAASC,UAAU,QAAQ,WAAW;AACtC,SAASC,YAAY,EAAEC,YAAY,EAAEC,aAAa,QAAQ,gBAAgB;AAC1E,SAASC,cAAc,QAAQ,cAAc;AAE7C,SAASC,SAAS,QAAQ,cAAc;;AAExC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,OAAO,SAASN,UAAU,CAAC;EAGtC;AACF;AACA;AACA;AACA;EACEO,kBAAkBA,CAACC,eAA2C,EAAE;IAC9D,IAAIA,eAAe,CAACC,GAAG,IAAIL,cAAc,CAACI,eAAe,CAACC,GAAG,CAAC,EAAE;MAC9D,IAAI,CAACC,gBAAgB,GAAGF,eAAe;MACvC,OAAO,IAAI;IACb;IACA,MAAM,IAAIX,gBAAgB,CAAC,yBAAyB,CAAC;EACvD;;EAEA;AACF;AACA;AACA;EACEc,MAAMA,CAAA,EAAW;IACf,IAAI,CAAC,IAAI,CAACD,gBAAgB,IAAI,CAAC,IAAI,CAACA,gBAAgB,CAACD,GAAG,EAAE;MACxD,MAAM,IAAIX,UAAU,CAClB,sDACF,CAAC;IACH;IACA,MAAMU,eAAe,GAAGN,YAAY,CAACU,IAAI,CAACC,SAAS,CAAC,IAAI,CAACH,gBAAgB,CAAC,CAAC;IAC3E,MAAMI,OAAO,GAAGZ,YAAY,CAACU,IAAI,CAACC,SAAS,CAAC,IAAI,CAACE,QAAQ,CAAC,CAAC;IAC3D,IAAID,OAAO,IAAIN,eAAe,EAAE;MAC9B,OAAQ,GAAEA,eAAgB,IAAGM,OAAQ,EAAC;IACxC,CAAC,MAAM;MACL,MAAM,IAAIhB,UAAU,CAAC,CAAC;IACxB;EACF;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE,aAAakB,eAAeA,CAC1BC,mBAA2B,EAC3BC,SAAiB,EACA;IACjB,IACE,OAAOD,mBAAmB,KAAK,QAAQ,IACvC,OAAOC,SAAS,KAAK,QAAQ,EAC7B;MACA,MAAM,IAAInB,UAAU,CAAC,sBAAsB,CAAC;IAC9C;IACA,IAAImB,SAAS,KAAK,EAAE,EAAE,MAAM,IAAIpB,UAAU,CAAC,mBAAmB,CAAC;IAE/D,MAAMqB,UAAU,GAAGb,OAAO,CAACc,yBAAyB,CAACH,mBAAmB,CAAC;IACzE,MAAMR,GAAG,GAAGU,UAAU,CAACE,MAAM,CAACZ,GAAG;IACjC,IAAI;MACF,MAAMa,UAAU,GAAG,MAAMjB,SAAS,CAACa,SAAS,EAAET,GAAG,CAAC;MAClD,OAAQ,GAAEQ,mBAAoB,IAAGK,UAAW,EAAC;IAC/C,CAAC,CAAC,MAAM;MACN,MAAMA,UAAU,GAAGnB,aAAa,CAACe,SAAS,CAAC;MAC3C,OAAQ,GAAED,mBAAoB,IAAGK,UAAW,EAAC;IAC/C;EACF;;EAEA;AACF;AACA;AACA;AACA;EACE,OAAOF,yBAAyBA,CAACH,mBAA2B,EAG1D;IACA,IAAI,OAAOA,mBAAmB,KAAK,QAAQ,EAAE;MAC3C,MAAM,IAAIlB,UAAU,CAAC,sBAAsB,CAAC;IAC9C;IACA,MAAM;MACJ,CAAC,EAAEwB,aAAa;MAChB,CAAC,EAAEC,cAAc;MACjBC;IACF,CAAC,GAAGR,mBAAmB,CAACS,KAAK,CAAC,GAAG,CAAC;IAElC,IAAIL,MAAkC;IACtC,IAAI;MACF,IAAIM,OAAO,GAAG1B,YAAY,CAACsB,aAAc,CAAC;MAC1CF,MAAM,GAAGT,IAAI,CAACgB,KAAK,CAACD,OAAO,CAAC;MAC5B,IAAI,CAACN,MAAM,CAACZ,GAAG,IAAI,CAACL,cAAc,CAACiB,MAAM,CAACZ,GAAG,CAAC,EAAE;QAC9C,MAAM,IAAIZ,gBAAgB,CAAC,yBAAyB,CAAC;MACvD;IACF,CAAC,CAAC,MAAM;MACN,MAAM,IAAIE,UAAU,CAAC,6BAA6B,CAAC;IACrD;IAEA,IAAI0B,MAAM,KAAK,CAAC,IAAID,cAAc,KAAK,EAAE,EAAE;MACzC,MAAM,IAAIzB,UAAU,CAAC,qBAAqB,CAAC;IAC7C;IAEA,IAAI8B,cAAc,GAAG5B,YAAY,CAACuB,cAAe,CAAC;IAClD,MAAMV,OAAO,GAAGF,IAAI,CAACgB,KAAK,CAACC,cAAc,CAAC;IAE1C,OAAO;MACLf,OAAO;MACPO;IACF,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;EACE,OAAOS,MAAMA,CAACC,GAAW,EAAmB;IAC1C,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;MAC3B,MAAM,IAAIhC,UAAU,CAAC,sBAAsB,CAAC;IAC9C;IACA,MAAM;MACJ,CAAC,EAAEwB,aAAa;MAChB,CAAC,EAAEC,cAAc;MACjB,CAAC,EAAEN,SAAS;MACZO;IACF,CAAC,GAAGM,GAAG,CAACL,KAAK,CAAC,GAAG,CAAC;IAElB,IAAIlB,eAA2C;IAC/C,IAAI;MACF,IAAImB,OAAO,GAAG1B,YAAY,CAACsB,aAAc,CAAC;MAC1Cf,eAAe,GAAGI,IAAI,CAACgB,KAAK,CAACD,OAAO,CAAC;MACrC,IAAI,CAACnB,eAAe,CAACC,GAAG,IAAI,CAACL,cAAc,CAACI,eAAe,CAACC,GAAG,CAAC,EAAE;QAChE,MAAM,IAAIZ,gBAAgB,CAAC,yBAAyB,CAAC;MACvD;IACF,CAAC,CAAC,MAAM;MACN,MAAM,IAAIE,UAAU,CAAC,6BAA6B,CAAC;IACrD;IAEA,IAAI0B,MAAM,KAAK,CAAC,IAAID,cAAc,KAAK,EAAE,IAAIN,SAAS,KAAK,EAAE,EAAE;MAC7D,MAAM,IAAInB,UAAU,CAAC,aAAa,CAAC;IACrC;IAEA,IAAI8B,cAAc,GAAG5B,YAAY,CAACuB,cAAe,CAAC;IAClD,MAAMV,OAAO,GAAGF,IAAI,CAACgB,KAAK,CAACC,cAAc,CAAC;IAE1C,OAAO;MACLf,OAAO;MACPN;IACF,CAAC;EACH;AACF"}

package/lib/module/types.js

@@ -0,0 +1,2 @@
+
+//# sourceMappingURL=types.js.map

package/lib/module/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../src","sources":["types.ts"],"mappings":""}