@pagopa/io-react-native-jwt 0.6.3 → 1.0.0

package/src/index.ts

@@ -12,5 +12,11 @@ export { UnsecuredJWT } from './jwt/unsecured';
 export type { UnsecuredResult } from './jwt/unsecured';
 
 export { derToJose } from './utils/asn1';
-export { encodeBase64, decodeBase64 } from './utils/base64';
+export {
+  encodeBase64,
+  decodeBase64,
+  removePadding,
+  addPadding,
+} from './utils/base64';
 export { sha256ToBase64 } from './hash';
+export { type CryptoContext } from './utils/crypto';

package/src/jwt/produce.ts

@@ -4,14 +4,15 @@ import secs, { epoch } from '../utils/secs';
 
 /** Generic class for JWT producing. */
 export class ProduceJWT {
-  protected _payload!: JWTPayload;
+  protected _payload: JWTPayload = {};
 
   /** @param payload The JWT Claims Set object. */
-  constructor(payload: JWTPayload) {
+  setPayload(payload: JWTPayload) {
     if (!isObject(payload)) {
       throw new TypeError('JWT Claims Set MUST be an object');
     }
-    this._payload = payload;
+    this._payload = { ...this._payload, ...payload };
+    return this;
   }
 
   /**

package/src/jwt/sign.ts

@@ -1,14 +1,15 @@
-import { JOSENotSupported, JWSInvalid, JWTInvalid } from '../utils/errors';
-import type {
-  CompactJWSHeaderParameters,
-  JWTDecodeResult,
-  JWTPayload,
-} from '../types';
+import { JOSENotSupported, JWTInvalid } from '../utils/errors';
+import type { JWSHeaderParameters, JWTDecodeResult } from '../types';
 import { ProduceJWT } from './produce';
 import { decodeBase64, encodeBase64, removePadding } from '../utils/base64';
-import { getKtyFromAlg, isAlgSupported } from '../algorithms';
+import {
+  getAlgFromKey,
+  isAlgSupported,
+  type SupportedAlgorithm,
+} from '../algorithms';
 
 import { derToJose } from '../utils/asn1';
+import type { CryptoContext } from 'src/utils/crypto';
 
 /**
  * The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
@@ -16,134 +17,96 @@ import { derToJose } from '../utils/asn1';
  * @example Usage with a given signature
  *
  * ```js
- * const alg = 'RS256'
- * const signature = 'Axy0....'
+ * const crypto: Crypto = { any implementation fo Crypto interface }
  *
- * const jwt = new SignJWT({ 'urn:example:claim': true })
- *   .setProtectedHeader({ alg })
+ * const jwt = new SignJWT(crypto)
+ *   .setPayload({ 'urn:example:claim': true })
+ *   .setProtectedHeader({ typ })
  *   .setIssuedAt()
  *   .setIssuer('urn:example:issuer')
  *   .setAudience('urn:example:audience')
  *   .setExpirationTime('2h')
- *   .sign(signature)
  *
- * console.log(jwt)
+ * jwt.data()
+ * await jwt.sign()
  * ```
  */
+
 export class SignJWT extends ProduceJWT {
-  private _protectedHeader!: CompactJWSHeaderParameters;
+  private _protectedHeader: Omit<JWSHeaderParameters, 'alg'> = {};
+  private crypto: CryptoContext;
 
   /**
-   * Sets the JWS Protected Header on the SignJWT object.
-   *
-   * @param protectedHeader JWS Protected Header. Must contain an "alg" (JWS Algorithm) property.
+   * @param crypto An implementation of the crypto interface. @see utils/crypto for more.
    */
-  setProtectedHeader(protectedHeader: CompactJWSHeaderParameters) {
-    if (protectedHeader.alg && isAlgSupported(protectedHeader.alg)) {
-      this._protectedHeader = protectedHeader;
-      return this;
-    }
-    throw new JOSENotSupported('Unsupported "alg" value');
+  constructor(crypto: CryptoContext) {
+    super();
+    this.crypto = crypto;
   }
 
   /**
-   * Return a JWT without signature (`header.payload`) to sign.
+   * Sets the JWS Protected Header on the SignJWT object.
+   * Any invocation overrides what's been already put in the header.
+   * Value for "alg" are ignored, as it will be inferred by the key used by the cryptographic context.
    *
+   * @param protectedHeader JWS Protected Header.
    */
-  toSign(): string {
-    if (!this._protectedHeader || !this._protectedHeader.alg) {
-      throw new JWSInvalid(
-        'Missing signature algorithm. Specify the `alg` field'
-      );
-    }
-    const protectedHeader = encodeBase64(JSON.stringify(this._protectedHeader));
-    const payload = encodeBase64(JSON.stringify(this._payload));
-    if (payload && protectedHeader) {
-      return `${protectedHeader}.${payload}`;
-    } else {
-      throw new JWSInvalid();
-    }
+  setProtectedHeader(protectedHeader: Omit<JWSHeaderParameters, 'alg'>) {
+    this._protectedHeader = protectedHeader;
+    return this;
   }
 
   /**
-   * Append signature to unsigned JWT.
-   * For an ECDSA signature it is required that this is in ASN.1/DER encoded format.
-   * The same format used by the TEE. Conversion to JWS is handled automatically.
+   * Return a JWT without signature (`header.payload`).
    *
-   * @param jwtWithoutSignature
-   * @param signature
    */
-  static async appendSignature(
-    jwtWithoutSignature: string,
-    signature: string
-  ): Promise<string> {
-    if (
-      typeof jwtWithoutSignature !== 'string' ||
-      typeof signature !== 'string'
-    ) {
-      throw new JWTInvalid('JWS must be a string');
-    }
-    if (signature === '') throw new JWSInvalid('Invalid signature');
-
-    const jwtDecoded = SignJWT.decodeJwtWithoutSignature(jwtWithoutSignature);
-    const alg = jwtDecoded.header.alg;
-    const kty = getKtyFromAlg(alg);
-
-    if (kty === 'EC') {
-      const encodedJws = await derToJose(signature, alg);
-      return `${jwtWithoutSignature}.${encodedJws}`;
-    } else {
-      const encodedJws = removePadding(signature);
-      return `${jwtWithoutSignature}.${encodedJws}`;
-    }
+  private async unsigned(): Promise<string> {
+    const { alg } = await this.getSelectedSigningAlgorithm();
+
+    return [{ ...this._protectedHeader, alg }, this._payload]
+      .map((e) => JSON.stringify(e))
+      .map(encodeBase64)
+      .join('.');
+  }
+
+  private async getSelectedSigningAlgorithm(): Promise<{
+    kty: string;
+    alg: SupportedAlgorithm;
+  }> {
+    const publicKey = await this.crypto.getPublicKey();
+    const alg = getAlgFromKey(publicKey);
+
+    return { kty: publicKey.kty, alg };
   }
 
   /**
-   * Decodes a JWT without signature
+   * Return a signed JWT.
    *
-   * @param jwtWithoutSignature JWT to sign that needs to be decoded.
    */
-  static decodeJwtWithoutSignature(jwtWithoutSignature: string): {
-    payload: JWTPayload;
-    header: CompactJWSHeaderParameters;
-  } {
-    if (typeof jwtWithoutSignature !== 'string') {
-      throw new JWTInvalid('JWT must be a string');
-    }
-    const {
-      0: encodedHeader,
-      1: encodedPayload,
-      length,
-    } = jwtWithoutSignature.split('.');
+  async sign(): Promise<string> {
+    const unsigned = await this.unsigned();
+    const signature = await this.crypto.getSignature(unsigned);
 
-    let header: CompactJWSHeaderParameters;
-    try {
-      let decoded = decodeBase64(encodedHeader!);
-      header = JSON.parse(decoded);
-      if (!header.alg || !isAlgSupported(header.alg)) {
-        throw new JOSENotSupported('Unsupported "alg" value');
-      }
-    } catch {
-      throw new JWTInvalid('Unable to decode JWT header');
-    }
+    const { kty, alg } = await this.getSelectedSigningAlgorithm();
 
-    if (length !== 2 || encodedPayload === '') {
-      throw new JWTInvalid('Invalid JWT to sign');
-    }
+    const encodedJws = await (kty === 'EC'
+      ? derToJose(signature, alg)
+      : removePadding(signature));
 
-    let decodedPayload = decodeBase64(encodedPayload!);
-    const payload = JSON.parse(decodedPayload);
+    return `${unsigned}.${encodedJws}`;
+  }
 
-    return {
-      payload,
-      header,
-    };
+  /**
+   * Plain data of the produced JWT
+   */
+  data(): JWTDecodeResult {
+    return { protectedHeader: this._protectedHeader, payload: this._payload };
   }
 
   /**
-   * Decodes a JWT without signature
+   * Decodes a signed JWT
    *
-   * @param jwtWithoutSignature JWT to sign that needs to be decoded.
+   * @param jwt JWT to sign that needs to be decoded.
    */
   static decode(jwt: string): JWTDecodeResult {
     if (typeof jwt !== 'string') {
@@ -156,7 +119,7 @@ export class SignJWT extends ProduceJWT {
       length,
     } = jwt.split('.');
 
-    let protectedHeader: CompactJWSHeaderParameters;
+    let protectedHeader: JWSHeaderParameters;
     try {
       let decoded = decodeBase64(encodedHeader!);
       protectedHeader = JSON.parse(decoded);

package/src/jwt/unsecured.ts

@@ -1,7 +1,7 @@
 import type {
-  JWSHeaderParameters,
   JWTClaimVerificationOptions,
   JWTPayload,
+  JWTUnsecuredHeaderParameters,
 } from '../types';
 
 import { JWTInvalid } from '../utils/errors';
@@ -11,7 +11,7 @@ import { decodeBase64, encodeBase64 } from '../utils/base64';
 
 export interface UnsecuredResult {
   payload: JWTPayload;
-  header: JWSHeaderParameters;
+  header: JWTUnsecuredHeaderParameters;
 }
 
 /**
@@ -86,18 +86,18 @@ export class UnsecuredJWT extends ProduceJWT {
       throw new JWTInvalid('Invalid Unsecured JWT');
     }
 
-    let header: JWSHeaderParameters;
+    let header: JWTUnsecuredHeaderParameters;
     try {
       let decoded = decodeBase64(encodedHeader!);
       header = JSON.parse(decoded);
-      if (header.alg !== 'none') throw new Error();
+      if ('alg' in header && header.alg !== 'none') throw new Error();
     } catch {
       throw new JWTInvalid('Invalid Unsecured JWT');
     }
 
     let payload = UnsecuredJWT.decodePayload(encodedPayload, options);
 
-    return { payload, header };
+    return { payload, header: JSON.parse(decodeBase64(encodedHeader!)) };
   }
 
   /**

package/src/types.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type { SupportedAlgorithm } from './algorithms';
 
 export interface JWTDecodeResult {
   /** JWT Claims Set. */
@@ -37,7 +38,7 @@ export interface JoseHeaderParameters {
 /** Recognized JWS Header Parameters, any other Header Members may also be present. */
 export interface JWSHeaderParameters extends JoseHeaderParameters {
   /** JWS "alg" (Algorithm) Header Parameter. */
-  alg?: string;
+  alg?: SupportedAlgorithm;
 
   /**
    * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
@@ -52,9 +53,9 @@ export interface JWSHeaderParameters extends JoseHeaderParameters {
   [propName: string]: unknown;
 }
 
-/** Recognized Compact JWS Header Parameters, any other Header Members may also be present. */
-export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
-  alg: string;
+/** JOSE Header for an unsecued JWT */
+export interface JWTUnsecuredHeaderParameters extends JoseHeaderParameters {
+  alg?: 'none';
 }
 
 /** Recognized JWE Header Parameters, any other Header members may also be present. */

package/src/utils/asn1.ts

@@ -1,4 +1,8 @@
-import { getCoordinateOctetLength, getKtyFromAlg } from '../algorithms';
+import {
+  getCoordinateOctetLength,
+  getKtyFromAlg,
+  type SupportedAlgorithm,
+} from '../algorithms';
 import { IoReactNativeJwt } from './proxy';
 import { removePadding } from './base64';
 import { JOSENotSupported } from './errors';
@@ -20,7 +24,7 @@ import { JOSENotSupported } from './errors';
  */
 export const derToJose = async (
   asn1Signature: string,
-  alg: string
+  alg: SupportedAlgorithm
 ): Promise<string> => {
   const kty = getKtyFromAlg(alg);
   if (kty === 'EC') {

package/src/utils/crypto.ts

@@ -0,0 +1,25 @@
+import type { JWK } from 'src/types';
+
+/**
+ * The interface of a cryptographic context to be used to sign tokens.
+ * Implementations are assumed to be initialized on a single, already-existing key pair.
+ *
+ * The generation and persistence of the key pair is delegated to the implementation.
+ */
+export interface CryptoContext {
+  /**
+   * Retrieves the public key to be used in this context.
+   * MUST be the same key at every invocation.
+   * @returns The public key to be used
+   * @throws If no keys are found
+   */
+  getPublicKey: () => Promise<JWK>;
+  /**
+   * Produce a cryptographic signature for a given value.
+   * The signature MUST be produced using the private key paired with the public retrieved by getPublicKey()
+   * @param value The value to be signed
+   * @returns The signature
+   * @throws If no keys are found
+   */
+  getSignature: (value: string) => Promise<string>;
+}