@pagopa/io-react-native-jwt 0.4.1

package/package.json

@@ -0,0 +1,170 @@
+{
+  "name": "@pagopa/io-react-native-jwt",
+  "version": "0.4.1",
+  "description": "Native support for JWT",
+  "main": "lib/commonjs/index",
+  "module": "lib/module/index",
+  "types": "lib/typescript/index.d.ts",
+  "react-native": "src/index",
+  "source": "src/index",
+  "files": [
+    "src",
+    "lib",
+    "android",
+    "ios",
+    "cpp",
+    "*.podspec",
+    "!lib/typescript/example",
+    "!ios/build",
+    "!android/build",
+    "!android/gradle",
+    "!android/gradlew",
+    "!android/gradlew.bat",
+    "!android/local.properties",
+    "!**/__tests__",
+    "!**/__fixtures__",
+    "!**/__mocks__",
+    "!**/.*"
+  ],
+  "scripts": {
+    "test": "jest",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint \"**/*.{js,ts,tsx}\"",
+    "prepack": "bob build",
+    "release": "release-it",
+    "example": "yarn --cwd example",
+    "build:android": "cd example/android && ./gradlew assembleDebug --no-daemon --console=plain -PreactNativeArchitectures=arm64-v8a",
+    "build:ios": "cd example/ios && xcodebuild -workspace IoReactNativeJwtExample.xcworkspace -scheme IoReactNativeJwtExample -configuration Debug -sdk iphonesimulator CC=clang CPLUSPLUS=clang++ LD=clang LDPLUSPLUS=clang++ GCC_OPTIMIZATION_LEVEL=0 GCC_PRECOMPILE_PREFIX_HEADER=YES ASSETCATALOG_COMPILER_OPTIMIZATION=time DEBUG_INFORMATION_FORMAT=dwarf COMPILER_INDEX_STORE_ENABLE=NO",
+    "bootstrap": "yarn example && yarn install && yarn example pods",
+    "clean": "del-cli android/build example/android/build example/android/app/build example/ios/build",
+    "docs:generate": "typedoc"
+  },
+  "keywords": [
+    "react-native",
+    "ios",
+    "android"
+  ],
+  "repository": "https://github.com/pagopa/io-react-native-jwt",
+  "author": "PagoPa (https://github.com/pagopa)",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/pagopa/io-react-native-jwt/issues"
+  },
+  "homepage": "https://github.com/pagopa/io-react-native-jwt#readme",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "@commitlint/config-conventional": "^17.0.2",
+    "@evilmartians/lefthook": "^1.2.2",
+    "@react-native-community/eslint-config": "^3.0.2",
+    "@release-it/conventional-changelog": "^5.0.0",
+    "@types/jest": "^28.1.2",
+    "@types/react": "~17.0.21",
+    "@types/react-native": "0.70.0",
+    "commitlint": "^17.0.2",
+    "del-cli": "^5.0.0",
+    "eslint": "^8.4.1",
+    "eslint-config-prettier": "^8.5.0",
+    "eslint-plugin-prettier": "^4.0.0",
+    "jest": "^28.1.1",
+    "pod-install": "^0.1.0",
+    "prettier": "^2.0.5",
+    "react": "18.2.0",
+    "react-native": "0.72.1",
+    "react-native-builder-bob": "^0.20.0",
+    "release-it": "^15.0.0",
+    "turbo": "^1.10.7",
+    "typedoc": "^0.24.8",
+    "typedoc-plugin-markdown": "^3.15.3",
+    "typedoc-plugin-mdn-links": "^3.0.3",
+    "typescript": "^5.0.2"
+  },
+  "resolutions": {
+    "@types/react": "17.0.21"
+  },
+  "peerDependencies": {
+    "react": "*",
+    "react-native": "*"
+  },
+  "engines": {
+    "node": ">= 16.0.0"
+  },
+  "packageManager": "^yarn@1.22.15",
+  "jest": {
+    "preset": "react-native",
+    "modulePathIgnorePatterns": [
+      "<rootDir>/example/node_modules",
+      "<rootDir>/lib/"
+    ]
+  },
+  "commitlint": {
+    "extends": [
+      "@commitlint/config-conventional"
+    ]
+  },
+  "release-it": {
+    "git": {
+      "commitMessage": "chore: release ${version}",
+      "tagName": "v${version}"
+    },
+    "npm": {
+      "publish": true
+    },
+    "github": {
+      "release": true
+    },
+    "plugins": {
+      "@release-it/conventional-changelog": {
+        "preset": "angular"
+      }
+    }
+  },
+  "eslintConfig": {
+    "root": true,
+    "extends": [
+      "@react-native-community",
+      "prettier"
+    ],
+    "rules": {
+      "prettier/prettier": [
+        "error",
+        {
+          "quoteProps": "consistent",
+          "singleQuote": true,
+          "tabWidth": 2,
+          "trailingComma": "es5",
+          "useTabs": false
+        }
+      ]
+    }
+  },
+  "eslintIgnore": [
+    "node_modules/",
+    "lib/"
+  ],
+  "prettier": {
+    "quoteProps": "consistent",
+    "singleQuote": true,
+    "tabWidth": 2,
+    "trailingComma": "es5",
+    "useTabs": false
+  },
+  "react-native-builder-bob": {
+    "source": "src",
+    "output": "lib",
+    "targets": [
+      "commonjs",
+      "module",
+      [
+        "typescript",
+        {
+          "project": "tsconfig.build.json"
+        }
+      ]
+    ]
+  },
+  "dependencies": {
+    "abab": "^2.0.6"
+  }
+}

package/pagopa-io-react-native-jwt.podspec

@@ -0,0 +1,44 @@
+require "json"
+
+package = JSON.parse(File.read(File.join(__dir__, "package.json")))
+folly_compiler_flags = '-DFOLLY_NO_CONFIG -DFOLLY_MOBILE=1 -DFOLLY_USE_LIBCPP=1 -Wno-comma -Wno-shorten-64-to-32'
+
+Pod::Spec.new do |s|
+  s.name         = "pagopa-io-react-native-jwt"
+  s.version      = package["version"]
+  s.summary      = package["description"]
+  s.homepage     = package["homepage"]
+  s.license      = package["license"]
+  s.authors      = package["author"]
+
+  s.platforms    = { :ios => "11.0" }
+  s.source       = { :git => "https://github.com/pagopa/react-native-jwt.git", :tag => "#{s.version}" }
+
+  s.source_files = "ios/**/*.{h,m,mm,swift}"
+
+  #JOSESwift dependency
+  s.dependency "JOSESwift", "~> 2.3"
+
+  # Use install_modules_dependencies helper to install the dependencies if React Native version >=0.71.0.
+  # See https://github.com/facebook/react-native/blob/febf6b7f33fdb4904669f99d795eba4c0f95d7bf/scripts/cocoapods/new_architecture.rb#L79.
+  if respond_to?(:install_modules_dependencies, true)
+    install_modules_dependencies(s)
+  else
+  s.dependency "React-Core"
+
+  # Don't install the dependencies when we run `pod install` in the old architecture.
+  if ENV['RCT_NEW_ARCH_ENABLED'] == '1' then
+    s.compiler_flags = folly_compiler_flags + " -DRCT_NEW_ARCH_ENABLED=1"
+    s.pod_target_xcconfig    = {
+        "HEADER_SEARCH_PATHS" => "\"$(PODS_ROOT)/boost\"",
+        "OTHER_CPLUSPLUSFLAGS" => "-DFOLLY_NO_CONFIG -DFOLLY_MOBILE=1 -DFOLLY_USE_LIBCPP=1",
+        "CLANG_CXX_LANGUAGE_STANDARD" => "c++17"
+    }
+    s.dependency "React-Codegen"
+    s.dependency "RCT-Folly"
+    s.dependency "RCTRequired"
+    s.dependency "RCTTypeSafety"
+    s.dependency "ReactCommon/turbomodule/core"
+   end
+  end
+end

package/src/algorithms.ts

@@ -0,0 +1,46 @@
+import { JOSENotSupported } from './utils/errors';
+
+export const supportedAlgorithms = [
+  'RS256',
+  'RS384',
+  'RS512',
+  'PS256',
+  'PS384',
+  'PS512',
+  'ES256',
+  'ES384',
+  'ES512',
+];
+
+export const isAlgSupported = (alg: string) =>
+  supportedAlgorithms.includes(alg.toUpperCase());
+
+export const getKtyFromAlg = (alg: string) => {
+  switch (alg.slice(0, 2)) {
+    case 'RS':
+    case 'PS':
+      return 'RSA';
+    case 'ES':
+      return 'EC';
+    default:
+      throw new JOSENotSupported(
+        'Unsupported "alg" value for a JSON Web Key Set'
+      );
+  }
+};
+
+// Coordinates length in bytes: bits/8
+export const getCoordinateOctetLength = (alg: string) => {
+  switch (alg.slice(2, 5)) {
+    case '256':
+      return 32;
+    case '384':
+      return 48;
+    case '512':
+      return 66;
+    default:
+      throw new JOSENotSupported(
+        'Unsupported "alg" value for a JSON Web Key Set'
+      );
+  }
+};

package/src/hash.ts

@@ -0,0 +1,10 @@
+import { removePadding } from './utils/base64';
+import { IoReactNativeJwt } from './utils/proxy';
+
+/**
+ * Return base64 encoded SHA256 hash of input string
+ */
+export const sha256ToBase64 = async (toHash: string): Promise<string> => {
+  let hash = await IoReactNativeJwt.sha256(toHash);
+  return removePadding(hash);
+};

package/src/index.tsx

@@ -0,0 +1,120 @@
+import type {
+  JWK,
+  JWTClaimVerificationOptions,
+  JWTDecodeResult,
+} from './types';
+import jwtPayload from './jwt_claims_set';
+import { JWSSignatureVerificationFailed } from './utils/errors';
+import { IoReactNativeJwt } from './utils/proxy';
+import { SignJWT } from './sign';
+
+export * from './produce';
+export * from './sign';
+export * from './unsecured';
+export { derToJose } from './utils/asn1';
+export { encodeBase64, decodeBase64 } from './utils/base64';
+export { sha256ToBase64 } from './hash';
+/**
+ * Decode the JWT without validation.
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await decode(jwt)
+ *
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ */
+export const decode = (token: string): JWTDecodeResult => SignJWT.decode(token);
+
+/**
+ * Verifies the JWS signature
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwk = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * }
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const isSignatureValid = await verify(jwt, jwk)
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ * @param key Public key to verify the JWT in JWK format.
+ */
+export const isSignatureValid = (token: string, jwk: JWK): Promise<boolean> =>
+  IoReactNativeJwt.verify(token, jwk);
+
+/**
+ * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
+ * JWT Claims Set.
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const jwk = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * }
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await verify(jwt, jwk, {
+ *   typ: 'entity-statement+jwt',
+ *   requiredClaims: ['iss', 'sub', 'metadata'],
+ * })
+ * ```
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ * @param key Public key to verify the JWT in JWK format.
+ * @param options JWT Decryption and JWT Claims Set validation options.
+ */
+export const verify = async (
+  token: string,
+  jwk: JWK,
+  options: JWTClaimVerificationOptions = {}
+): Promise<JWTDecodeResult> => {
+  const { protectedHeader, payload } = await decode(token);
+  const signatureIsValid = await isSignatureValid(token, jwk);
+
+  if (signatureIsValid) {
+    const verifiedPayload = jwtPayload(protectedHeader, payload, options);
+    return { payload: verifiedPayload, protectedHeader };
+  } else {
+    throw new JWSSignatureVerificationFailed();
+  }
+};
+
+/**
+ * Calculate JWK thumbprint
+ *
+ * @example Get JWK thumbprint
+ *
+ * ```js
+ * const jwk: JWK = {
+ *   crv: 'P-256',
+ *   kty: 'EC',
+ *   x: 'qrJrj3Af_B57sbOIRrcBM7br7wOc8ynj7lHFPTeffUk',
+ *   y: '1H0cWDyGgvU8w-kPKU_xycOCUNT2o0bwslIQtnPU6iM',
+ * };
+
+ * const thumbprint = await thumbprint(jwk)
+ *
+ * ```
+ *
+ * @param jwk JSON Web Key
+ */
+export const thumbprint = (jwk: JWK): Promise<string> =>
+  IoReactNativeJwt.thumbprint(jwk);

package/src/jwt_claims_set.ts

@@ -0,0 +1,194 @@
+/*
+ * This code comes from https://github.com/panva/jose
+ */
+import type {
+  JWTPayload,
+  JWTClaimVerificationOptions,
+  JWSHeaderParameters,
+} from './types';
+import { JWTClaimValidationFailed, JWTExpired } from './utils/errors';
+
+import secs, { epoch } from './utils/secs';
+
+const normalizeTyp = (value: string) =>
+  value.toLowerCase().replace(/^application\//, '');
+
+const checkAudiencePresence = (audPayload: unknown, audOption: unknown[]) => {
+  if (typeof audPayload === 'string') {
+    return audOption.includes(audPayload);
+  }
+
+  if (Array.isArray(audPayload)) {
+    /*
+     * Each principal intended to process the JWT MUST
+     * identify itself with a value in the audience claim
+     */
+    return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
+  }
+
+  return false;
+};
+
+export default (
+  protectedHeader: JWSHeaderParameters,
+  payload: JWTPayload,
+  options: JWTClaimVerificationOptions = {}
+) => {
+  const { typ } = options;
+  if (
+    typ &&
+    (typeof protectedHeader!.typ !== 'string' ||
+      normalizeTyp(protectedHeader!.typ) !== normalizeTyp(typ))
+  ) {
+    throw new JWTClaimValidationFailed(
+      'unexpected "typ" JWT header value',
+      'typ',
+      'check_failed'
+    );
+  }
+
+  const {
+    requiredClaims = [],
+    issuer,
+    subject,
+    audience,
+    maxTokenAge,
+  } = options;
+
+  if (maxTokenAge !== undefined) requiredClaims.push('iat');
+  if (audience !== undefined) requiredClaims.push('aud');
+  if (subject !== undefined) requiredClaims.push('sub');
+  if (issuer !== undefined) requiredClaims.push('iss');
+
+  for (const claim of new Set(requiredClaims.reverse())) {
+    if (!(claim in payload)) {
+      throw new JWTClaimValidationFailed(
+        `missing required "${claim}" claim`,
+        claim,
+        'missing'
+      );
+    }
+  }
+
+  if (
+    issuer &&
+    !(<unknown[]>(Array.isArray(issuer) ? issuer : [issuer])).includes(
+      payload.iss!
+    )
+  ) {
+    throw new JWTClaimValidationFailed(
+      'unexpected "iss" claim value',
+      'iss',
+      'check_failed'
+    );
+  }
+
+  if (subject && payload.sub !== subject) {
+    throw new JWTClaimValidationFailed(
+      'unexpected "sub" claim value',
+      'sub',
+      'check_failed'
+    );
+  }
+
+  if (
+    audience &&
+    !checkAudiencePresence(
+      payload.aud,
+      typeof audience === 'string' ? [audience] : audience
+    )
+  ) {
+    throw new JWTClaimValidationFailed(
+      'unexpected "aud" claim value',
+      'aud',
+      'check_failed'
+    );
+  }
+
+  let tolerance: number;
+  switch (typeof options.clockTolerance) {
+    case 'string':
+      tolerance = secs(options.clockTolerance);
+      break;
+    case 'number':
+      tolerance = options.clockTolerance;
+      break;
+    case 'undefined':
+      tolerance = 0;
+      break;
+    default:
+      throw new TypeError('Invalid clockTolerance option type');
+  }
+
+  const { currentDate } = options;
+  const now = epoch(currentDate || new Date());
+
+  if (
+    (payload.iat !== undefined || maxTokenAge) &&
+    typeof payload.iat !== 'number'
+  ) {
+    throw new JWTClaimValidationFailed(
+      '"iat" claim must be a number',
+      'iat',
+      'invalid'
+    );
+  }
+
+  if (payload.nbf !== undefined) {
+    if (typeof payload.nbf !== 'number') {
+      throw new JWTClaimValidationFailed(
+        '"nbf" claim must be a number',
+        'nbf',
+        'invalid'
+      );
+    }
+    if (payload.nbf > now + tolerance) {
+      throw new JWTClaimValidationFailed(
+        '"nbf" claim timestamp check failed',
+        'nbf',
+        'check_failed'
+      );
+    }
+  }
+
+  if (payload.exp !== undefined) {
+    if (typeof payload.exp !== 'number') {
+      throw new JWTClaimValidationFailed(
+        '"exp" claim must be a number',
+        'exp',
+        'invalid'
+      );
+    }
+    if (payload.exp <= now - tolerance) {
+      throw new JWTExpired(
+        '"exp" claim timestamp check failed',
+        'exp',
+        'check_failed'
+      );
+    }
+  }
+
+  if (maxTokenAge) {
+    const age = now - payload.iat!;
+    const max =
+      typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
+
+    if (age - tolerance > max) {
+      throw new JWTExpired(
+        '"iat" claim timestamp check failed (too far in the past)',
+        'iat',
+        'check_failed'
+      );
+    }
+
+    if (age < 0 - tolerance) {
+      throw new JWTClaimValidationFailed(
+        '"iat" claim timestamp check failed (it should be in the past)',
+        'iat',
+        'check_failed'
+      );
+    }
+  }
+
+  return <JWTPayload>payload;
+};

package/src/produce.ts

@@ -0,0 +1,109 @@
+import type { JWTPayload } from './types';
+import isObject from './utils/is_object';
+import secs, { epoch } from './utils/secs';
+
+/** Generic class for JWT producing. */
+export class ProduceJWT {
+  protected _payload!: JWTPayload;
+
+  /** @param payload The JWT Claims Set object. */
+  constructor(payload: JWTPayload) {
+    if (!isObject(payload)) {
+      throw new TypeError('JWT Claims Set MUST be an object');
+    }
+    this._payload = payload;
+  }
+
+  /**
+   * Set "iss" (Issuer) Claim.
+   *
+   * @param issuer "Issuer" Claim value to set on the JWT Claims Set.
+   */
+  setIssuer(issuer: string) {
+    this._payload = { ...this._payload, iss: issuer };
+    return this;
+  }
+
+  /**
+   * Set "sub" (Subject) Claim.
+   *
+   * @param subject "sub" (Subject) Claim value to set on the JWT Claims Set.
+   */
+  setSubject(subject: string) {
+    this._payload = { ...this._payload, sub: subject };
+    return this;
+  }
+
+  /**
+   * Set "aud" (Audience) Claim.
+   *
+   * @param audience "aud" (Audience) Claim value to set on the JWT Claims Set.
+   */
+  setAudience(audience: string | string[]) {
+    this._payload = { ...this._payload, aud: audience };
+    return this;
+  }
+
+  /**
+   * Set "jti" (JWT ID) Claim.
+   *
+   * @param jwtId "jti" (JWT ID) Claim value to set on the JWT Claims Set.
+   */
+  setJti(jwtId: string) {
+    this._payload = { ...this._payload, jti: jwtId };
+    return this;
+  }
+
+  /**
+   * Set "nbf" (Not Before) Claim.
+   *
+   * @param input "nbf" (Not Before) Claim value to set on the JWT Claims Set. When number is passed
+   *   that is used as a value, when string is passed it is resolved to a time span and added to the
+   *   current timestamp.
+   */
+  setNotBefore(input: number | string) {
+    if (typeof input === 'number') {
+      this._payload = { ...this._payload, nbf: input };
+    } else {
+      this._payload = {
+        ...this._payload,
+        nbf: epoch(new Date()) + secs(input),
+      };
+    }
+    return this;
+  }
+
+  /**
+   * Set "exp" (Expiration Time) Claim.
+   *
+   * @param input "exp" (Expiration Time) Claim value to set on the JWT Claims Set. When number is
+   *   passed that is used as a value, when string is passed it is resolved to a time span and added
+   *   to the current timestamp.
+   */
+  setExpirationTime(input: number | string) {
+    if (typeof input === 'number') {
+      this._payload = { ...this._payload, exp: input };
+    } else {
+      this._payload = {
+        ...this._payload,
+        exp: epoch(new Date()) + secs(input),
+      };
+    }
+    return this;
+  }
+
+  /**
+   * Set "iat" (Issued At) Claim.
+   *
+   * @param input "iat" (Issued At) Claim value to set on the JWT Claims Set. Default is current
+   *   timestamp.
+   */
+  setIssuedAt(input?: number) {
+    if (typeof input === 'undefined') {
+      this._payload = { ...this._payload, iat: epoch(new Date()) };
+    } else {
+      this._payload = { ...this._payload, iat: input };
+    }
+    return this;
+  }
+}