@pagopa/io-react-native-jwt 0.6.4 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +32 -36
- package/lib/commonjs/algorithms.js +34 -2
- package/lib/commonjs/algorithms.js.map +1 -1
- package/lib/commonjs/jwt/produce.js +8 -2
- package/lib/commonjs/jwt/produce.js.map +1 -1
- package/lib/commonjs/jwt/sign.js +54 -75
- package/lib/commonjs/jwt/sign.js.map +1 -1
- package/lib/commonjs/jwt/unsecured.js +2 -2
- package/lib/commonjs/jwt/unsecured.js.map +1 -1
- package/lib/commonjs/types.js +1 -1
- package/lib/commonjs/types.js.map +1 -1
- package/lib/commonjs/utils/asn1.js.map +1 -1
- package/lib/commonjs/utils/crypto.js +6 -0
- package/lib/commonjs/utils/crypto.js.map +1 -0
- package/lib/module/algorithms.js +31 -0
- package/lib/module/algorithms.js.map +1 -1
- package/lib/module/jwt/produce.js +8 -2
- package/lib/module/jwt/produce.js.map +1 -1
- package/lib/module/jwt/sign.js +56 -78
- package/lib/module/jwt/sign.js.map +1 -1
- package/lib/module/jwt/unsecured.js +2 -2
- package/lib/module/jwt/unsecured.js.map +1 -1
- package/lib/module/types.js +1 -1
- package/lib/module/types.js.map +1 -1
- package/lib/module/utils/asn1.js.map +1 -1
- package/lib/module/utils/crypto.js +2 -0
- package/lib/module/utils/crypto.js.map +1 -0
- package/lib/typescript/algorithms.d.ts +5 -2
- package/lib/typescript/algorithms.d.ts.map +1 -1
- package/lib/typescript/index.d.ts +1 -0
- package/lib/typescript/index.d.ts.map +1 -1
- package/lib/typescript/jwt/produce.d.ts +1 -1
- package/lib/typescript/jwt/produce.d.ts.map +1 -1
- package/lib/typescript/jwt/sign.d.ts +26 -26
- package/lib/typescript/jwt/sign.d.ts.map +1 -1
- package/lib/typescript/jwt/unsecured.d.ts +2 -2
- package/lib/typescript/jwt/unsecured.d.ts.map +1 -1
- package/lib/typescript/types.d.ts +5 -4
- package/lib/typescript/types.d.ts.map +1 -1
- package/lib/typescript/utils/asn1.d.ts +2 -1
- package/lib/typescript/utils/asn1.d.ts.map +1 -1
- package/lib/typescript/utils/crypto.d.ts +25 -0
- package/lib/typescript/utils/crypto.d.ts.map +1 -0
- package/package.json +1 -1
- package/src/algorithms.ts +38 -3
- package/src/index.ts +1 -0
- package/src/jwt/produce.ts +4 -3
- package/src/jwt/sign.ts +64 -101
- package/src/jwt/unsecured.ts +5 -5
- package/src/types.ts +5 -4
- package/src/utils/asn1.ts +6 -2
- package/src/utils/crypto.ts +25 -0
package/lib/module/jwt/sign.js
CHANGED
|
@@ -1,124 +1,102 @@
|
|
|
1
|
-
import { JOSENotSupported,
|
|
1
|
+
import { JOSENotSupported, JWTInvalid } from '../utils/errors';
|
|
2
2
|
import { ProduceJWT } from './produce';
|
|
3
3
|
import { decodeBase64, encodeBase64, removePadding } from '../utils/base64';
|
|
4
|
-
import {
|
|
4
|
+
import { getAlgFromKey, isAlgSupported } from '../algorithms';
|
|
5
5
|
import { derToJose } from '../utils/asn1';
|
|
6
|
-
|
|
7
6
|
/**
|
|
8
7
|
* The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
|
|
9
8
|
*
|
|
10
9
|
* @example Usage with a given signature
|
|
11
10
|
*
|
|
12
11
|
* ```js
|
|
13
|
-
* const
|
|
14
|
-
* const signature = 'Axy0....'
|
|
12
|
+
* const crypto: Crypto = { any implementation fo Crypto interface }
|
|
15
13
|
*
|
|
16
|
-
* const jwt = new SignJWT(
|
|
17
|
-
* .
|
|
14
|
+
* const jwt = new SignJWT(crypto)
|
|
15
|
+
* .setPayload({ 'urn:example:claim': true })
|
|
16
|
+
* .setProtectedHeader({ typ })
|
|
18
17
|
* .setIssuedAt()
|
|
19
18
|
* .setIssuer('urn:example:issuer')
|
|
20
19
|
* .setAudience('urn:example:audience')
|
|
21
20
|
* .setExpirationTime('2h')
|
|
22
|
-
* .sign(signature)
|
|
23
21
|
*
|
|
24
|
-
*
|
|
22
|
+
* jwt.data()
|
|
23
|
+
* await jwt.sign()
|
|
25
24
|
* ```
|
|
26
25
|
*/
|
|
26
|
+
|
|
27
27
|
export class SignJWT extends ProduceJWT {
|
|
28
|
+
_protectedHeader = {};
|
|
29
|
+
/**
|
|
30
|
+
* @param crypto An implementation of the crypto interface. @see utils/crypto for more.
|
|
31
|
+
*/
|
|
32
|
+
constructor(crypto) {
|
|
33
|
+
super();
|
|
34
|
+
this.crypto = crypto;
|
|
35
|
+
}
|
|
36
|
+
|
|
28
37
|
/**
|
|
29
38
|
* Sets the JWS Protected Header on the SignJWT object.
|
|
39
|
+
* Any invocation overrides what's been already put in the header.
|
|
40
|
+
* Value for "alg" are ignored, as it will be inferred by the key used by the cryptographic context.
|
|
30
41
|
*
|
|
31
|
-
* @param protectedHeader JWS Protected Header.
|
|
42
|
+
* @param protectedHeader JWS Protected Header.
|
|
32
43
|
*/
|
|
33
44
|
setProtectedHeader(protectedHeader) {
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
return this;
|
|
37
|
-
}
|
|
38
|
-
throw new JOSENotSupported('Unsupported "alg" value');
|
|
45
|
+
this._protectedHeader = protectedHeader;
|
|
46
|
+
return this;
|
|
39
47
|
}
|
|
40
48
|
|
|
41
49
|
/**
|
|
42
|
-
* Return a JWT without signature (`header.payload`)
|
|
50
|
+
* Return a JWT without signature (`header.payload`).
|
|
43
51
|
*
|
|
44
52
|
*/
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
}
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
53
|
+
async unsigned() {
|
|
54
|
+
const {
|
|
55
|
+
alg
|
|
56
|
+
} = await this.getSelectedSigningAlgorithm();
|
|
57
|
+
return [{
|
|
58
|
+
...this._protectedHeader,
|
|
59
|
+
alg
|
|
60
|
+
}, this._payload].map(e => JSON.stringify(e)).map(encodeBase64).join('.');
|
|
61
|
+
}
|
|
62
|
+
async getSelectedSigningAlgorithm() {
|
|
63
|
+
const publicKey = await this.crypto.getPublicKey();
|
|
64
|
+
const alg = getAlgFromKey(publicKey);
|
|
65
|
+
return {
|
|
66
|
+
kty: publicKey.kty,
|
|
67
|
+
alg
|
|
68
|
+
};
|
|
56
69
|
}
|
|
57
70
|
|
|
58
71
|
/**
|
|
59
|
-
*
|
|
60
|
-
* For an ECDSA signature it is required that this is in ASN.1/DER encoded format.
|
|
61
|
-
* The same format used by the TEE. Conversion to JWS is handled automatically.
|
|
72
|
+
* Return a signed JWT.
|
|
62
73
|
*
|
|
63
|
-
* @param jwtWithoutSignature
|
|
64
|
-
* @param signature
|
|
65
74
|
*/
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
const
|
|
74
|
-
|
|
75
|
-
const encodedJws = await derToJose(signature, alg);
|
|
76
|
-
return `${jwtWithoutSignature}.${encodedJws}`;
|
|
77
|
-
} else {
|
|
78
|
-
const encodedJws = removePadding(signature);
|
|
79
|
-
return `${jwtWithoutSignature}.${encodedJws}`;
|
|
80
|
-
}
|
|
75
|
+
async sign() {
|
|
76
|
+
const unsigned = await this.unsigned();
|
|
77
|
+
const signature = await this.crypto.getSignature(unsigned);
|
|
78
|
+
const {
|
|
79
|
+
kty,
|
|
80
|
+
alg
|
|
81
|
+
} = await this.getSelectedSigningAlgorithm();
|
|
82
|
+
const encodedJws = await (kty === 'EC' ? derToJose(signature, alg) : removePadding(signature));
|
|
83
|
+
return `${unsigned}.${encodedJws}`;
|
|
81
84
|
}
|
|
82
85
|
|
|
83
86
|
/**
|
|
84
|
-
*
|
|
85
|
-
*
|
|
86
|
-
* @param jwtWithoutSignature JWT to sign that needs to be decoded.
|
|
87
|
+
* Plain data of the produced JWT
|
|
87
88
|
*/
|
|
88
|
-
|
|
89
|
-
if (typeof jwtWithoutSignature !== 'string') {
|
|
90
|
-
throw new JWTInvalid('JWT must be a string');
|
|
91
|
-
}
|
|
92
|
-
const {
|
|
93
|
-
0: encodedHeader,
|
|
94
|
-
1: encodedPayload,
|
|
95
|
-
length
|
|
96
|
-
} = jwtWithoutSignature.split('.');
|
|
97
|
-
let header;
|
|
98
|
-
try {
|
|
99
|
-
let decoded = decodeBase64(encodedHeader);
|
|
100
|
-
header = JSON.parse(decoded);
|
|
101
|
-
if (!header.alg || !isAlgSupported(header.alg)) {
|
|
102
|
-
throw new JOSENotSupported('Unsupported "alg" value');
|
|
103
|
-
}
|
|
104
|
-
} catch {
|
|
105
|
-
throw new JWTInvalid('Unable to decode JWT header');
|
|
106
|
-
}
|
|
107
|
-
if (length !== 2 || encodedPayload === '') {
|
|
108
|
-
throw new JWTInvalid('Invalid JWT to sign');
|
|
109
|
-
}
|
|
110
|
-
let decodedPayload = decodeBase64(encodedPayload);
|
|
111
|
-
const payload = JSON.parse(decodedPayload);
|
|
89
|
+
data() {
|
|
112
90
|
return {
|
|
113
|
-
|
|
114
|
-
|
|
91
|
+
protectedHeader: this._protectedHeader,
|
|
92
|
+
payload: this._payload
|
|
115
93
|
};
|
|
116
94
|
}
|
|
117
95
|
|
|
118
96
|
/**
|
|
119
|
-
* Decodes a JWT
|
|
97
|
+
* Decodes a signed JWT
|
|
120
98
|
*
|
|
121
|
-
* @param
|
|
99
|
+
* @param jwt JWT to sign that needs to be decoded.
|
|
122
100
|
*/
|
|
123
101
|
static decode(jwt) {
|
|
124
102
|
if (typeof jwt !== 'string') {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["JOSENotSupported","
|
|
1
|
+
{"version":3,"names":["JOSENotSupported","JWTInvalid","ProduceJWT","decodeBase64","encodeBase64","removePadding","getAlgFromKey","isAlgSupported","derToJose","SignJWT","_protectedHeader","constructor","crypto","setProtectedHeader","protectedHeader","unsigned","alg","getSelectedSigningAlgorithm","_payload","map","e","JSON","stringify","join","publicKey","getPublicKey","kty","sign","signature","getSignature","encodedJws","data","payload","decode","jwt","encodedHeader","encodedPayload","length","split","decoded","parse","decodedPayload"],"sourceRoot":"../../../src","sources":["jwt/sign.ts"],"mappings":"AAAA,SAASA,gBAAgB,EAAEC,UAAU,QAAQ,iBAAiB;AAE9D,SAASC,UAAU,QAAQ,WAAW;AACtC,SAASC,YAAY,EAAEC,YAAY,EAAEC,aAAa,QAAQ,iBAAiB;AAC3E,SACEC,aAAa,EACbC,cAAc,QAET,eAAe;AAEtB,SAASC,SAAS,QAAQ,eAAe;AAGzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAO,MAAMC,OAAO,SAASP,UAAU,CAAC;EAC9BQ,gBAAgB,GAAqC,CAAC,CAAC;EAG/D;AACF;AACA;EACEC,WAAWA,CAACC,MAAqB,EAAE;IACjC,KAAK,CAAC,CAAC;IACP,IAAI,CAACA,MAAM,GAAGA,MAAM;EACtB;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;EACEC,kBAAkBA,CAACC,eAAiD,EAAE;IACpE,IAAI,CAACJ,gBAAgB,GAAGI,eAAe;IACvC,OAAO,IAAI;EACb;;EAEA;AACF;AACA;AACA;EACE,MAAcC,QAAQA,CAAA,EAAoB;IACxC,MAAM;MAAEC;IAAI,CAAC,GAAG,MAAM,IAAI,CAACC,2BAA2B,CAAC,CAAC;IAExD,OAAO,CAAC;MAAE,GAAG,IAAI,CAACP,gBAAgB;MAAEM;IAAI,CAAC,EAAE,IAAI,CAACE,QAAQ,CAAC,CACtDC,GAAG,CAAEC,CAAC,IAAKC,IAAI,CAACC,SAAS,CAACF,CAAC,CAAC,CAAC,CAC7BD,GAAG,CAACf,YAAY,CAAC,CACjBmB,IAAI,CAAC,GAAG,CAAC;EACd;EAEA,MAAcN,2BAA2BA,CAAA,EAGtC;IACD,MAAMO,SAAS,GAAG,MAAM,IAAI,CAACZ,MAAM,CAACa,YAAY,CAAC,CAAC;IAClD,MAAMT,GAAG,GAAGV,aAAa,CAACkB,SAAS,CAAC;IAEpC,OAAO;MAAEE,GAAG,EAAEF,SAAS,CAACE,GAAG;MAAEV;IAAI,CAAC;EACpC;;EAEA;AACF;AACA;AACA;EACE,MAAMW,IAAIA,CAAA,EAAoB;IAC5B,MAAMZ,QAAQ,GAAG,MAAM,IAAI,CAACA,QAAQ,CAAC,CAAC;IACtC,MAAMa,SAAS,GAAG,MAAM,IAAI,CAAChB,MAAM,CAACiB,YAAY,CAACd,QAAQ,CAAC;IAE1D,MAAM;MAAEW,GAAG;MAAEV;IAAI,CAAC,GAAG,MAAM,IAAI,CAACC,2BAA2B,CAAC,CAAC;IAE7D,MAAMa,UAAU,GAAG,OAAOJ,GAAG,KAAK,IAAI,GAClClB,SAAS,CAACoB,SAAS,EAAEZ,GAAG,CAAC,GACzBX,aAAa,CAACuB,SAAS,CAAC,CAAC;IAE7B,OAAQ,GAAEb,QAAS,IAAGe,UAAW,EAAC;EACpC;;EAEA;AACF;AACA;EACEC,IAAIA,CAAA,EAAoB;IACtB,OAAO;MAAEjB,eAAe,EAAE,IAAI,CAACJ,gBAAgB;MAAEsB,OAAO,EAAE,IAAI,CAACd;IAAS,CAAC;EAC3E;;EAEA;AACF;AACA;AACA;AACA;EACE,OAAOe,MAAMA,CAACC,GAAW,EAAmB;IAC1C,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;MAC3B,MAAM,IAAIjC,UAAU,CAAC,sBAAsB,CAAC;IAC9C;IACA,MAAM;MACJ,CAAC,EAAEkC,aAAa;MAChB,CAAC,EAAEC,cAAc;MACjB,CAAC,EAAER,SAAS;MACZS;IACF,CAAC,GAAGH,GAAG,CAACI,KAAK,CAAC,GAAG,CAAC;IAElB,IAAIxB,eAAoC;IACxC,IAAI;MACF,IAAIyB,OAAO,GAAGpC,YAAY,CAACgC,aAAc,CAAC;MAC1CrB,eAAe,GAAGO,IAAI,CAACmB,KAAK,CAACD,OAAO,CAAC;MACrC,IAAI,CAACzB,eAAe,CAACE,GAAG,IAAI,CAACT,cAAc,CAACO,eAAe,CAACE,GAAG,CAAC,EAAE;QAChE,MAAM,IAAIhB,gBAAgB,CAAC,yBAAyB,CAAC;MACvD;IACF,CAAC,CAAC,MAAM;MACN,MAAM,IAAIC,UAAU,CAAC,6BAA6B,CAAC;IACrD;IAEA,IAAIoC,MAAM,KAAK,CAAC,IAAID,cAAc,KAAK,EAAE,IAAIR,SAAS,KAAK,EAAE,EAAE;MAC7D,MAAM,IAAI3B,UAAU,CAAC,aAAa,CAAC;IACrC;IAEA,IAAIwC,cAAc,GAAGtC,YAAY,CAACiC,cAAe,CAAC;IAClD,MAAMJ,OAAO,GAAGX,IAAI,CAACmB,KAAK,CAACC,cAAc,CAAC;IAE1C,OAAO;MACLT,OAAO;MACPlB;IACF,CAAC;EACH;AACF"}
|
|
@@ -74,14 +74,14 @@ export class UnsecuredJWT extends ProduceJWT {
|
|
|
74
74
|
try {
|
|
75
75
|
let decoded = decodeBase64(encodedHeader);
|
|
76
76
|
header = JSON.parse(decoded);
|
|
77
|
-
if (header.alg !== 'none') throw new Error();
|
|
77
|
+
if ('alg' in header && header.alg !== 'none') throw new Error();
|
|
78
78
|
} catch {
|
|
79
79
|
throw new JWTInvalid('Invalid Unsecured JWT');
|
|
80
80
|
}
|
|
81
81
|
let payload = UnsecuredJWT.decodePayload(encodedPayload, options);
|
|
82
82
|
return {
|
|
83
83
|
payload,
|
|
84
|
-
header
|
|
84
|
+
header: JSON.parse(decodeBase64(encodedHeader))
|
|
85
85
|
};
|
|
86
86
|
}
|
|
87
87
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["JWTInvalid","jwtPayload","ProduceJWT","decodeBase64","encodeBase64","UnsecuredJWT","encode","header","JSON","stringify","alg","payload","_payload","decode","jwt","options","encodedHeader","encodedPayload","signature","length","split","decoded","parse","Error","decodePayload","decodedPayload"],"sourceRoot":"../../../src","sources":["jwt/unsecured.ts"],"mappings":"AAMA,SAASA,UAAU,QAAQ,iBAAiB;AAC5C,OAAOC,UAAU,MAAM,kBAAkB;AACzC,SAASC,UAAU,QAAQ,WAAW;AACtC,SAASC,YAAY,EAAEC,YAAY,QAAQ,iBAAiB;AAO5D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,YAAY,SAASH,UAAU,CAAC;EAC3C;EACAI,MAAMA,CAAA,EAAW;IACf,MAAMC,MAAM,GAAGH,YAAY,CAACI,IAAI,CAACC,SAAS,CAAC;MAAEC,GAAG,EAAE;IAAO,CAAC,CAAC,CAAC;IAC5D,MAAMC,OAAO,GAAGP,YAAY,CAACI,IAAI,CAACC,SAAS,CAAC,IAAI,CAACG,QAAQ,CAAC,CAAC;IAE3D,OAAQ,GAAEL,MAAO,IAAGI,OAAQ,GAAE;EAChC;;EAEA;AACF;AACA;AACA;AACA;AACA;EACE,OAAOE,MAAMA,CACXC,GAAW,EACXC,OAAqC,EACpB;IACjB,IAAI,OAAOD,GAAG,KAAK,QAAQ,EAAE;MAC3B,MAAM,IAAId,UAAU,CAAC,gCAAgC,CAAC;IACxD;IACA,MAAM;MACJ,CAAC,EAAEgB,aAAa;MAChB,CAAC,EAAEC,cAAc;MACjB,CAAC,EAAEC,SAAS;MACZC;IACF,CAAC,GAAGL,GAAG,CAACM,KAAK,CAAC,GAAG,CAAC;IAElB,IAAID,MAAM,KAAK,CAAC,IAAID,SAAS,KAAK,EAAE,IAAI,CAACD,cAAc,EAAE;MACvD,MAAM,IAAIjB,UAAU,CAAC,uBAAuB,CAAC;IAC/C;IAEA,IAAIO,
|
|
1
|
+
{"version":3,"names":["JWTInvalid","jwtPayload","ProduceJWT","decodeBase64","encodeBase64","UnsecuredJWT","encode","header","JSON","stringify","alg","payload","_payload","decode","jwt","options","encodedHeader","encodedPayload","signature","length","split","decoded","parse","Error","decodePayload","decodedPayload"],"sourceRoot":"../../../src","sources":["jwt/unsecured.ts"],"mappings":"AAMA,SAASA,UAAU,QAAQ,iBAAiB;AAC5C,OAAOC,UAAU,MAAM,kBAAkB;AACzC,SAASC,UAAU,QAAQ,WAAW;AACtC,SAASC,YAAY,EAAEC,YAAY,QAAQ,iBAAiB;AAO5D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,YAAY,SAASH,UAAU,CAAC;EAC3C;EACAI,MAAMA,CAAA,EAAW;IACf,MAAMC,MAAM,GAAGH,YAAY,CAACI,IAAI,CAACC,SAAS,CAAC;MAAEC,GAAG,EAAE;IAAO,CAAC,CAAC,CAAC;IAC5D,MAAMC,OAAO,GAAGP,YAAY,CAACI,IAAI,CAACC,SAAS,CAAC,IAAI,CAACG,QAAQ,CAAC,CAAC;IAE3D,OAAQ,GAAEL,MAAO,IAAGI,OAAQ,GAAE;EAChC;;EAEA;AACF;AACA;AACA;AACA;AACA;EACE,OAAOE,MAAMA,CACXC,GAAW,EACXC,OAAqC,EACpB;IACjB,IAAI,OAAOD,GAAG,KAAK,QAAQ,EAAE;MAC3B,MAAM,IAAId,UAAU,CAAC,gCAAgC,CAAC;IACxD;IACA,MAAM;MACJ,CAAC,EAAEgB,aAAa;MAChB,CAAC,EAAEC,cAAc;MACjB,CAAC,EAAEC,SAAS;MACZC;IACF,CAAC,GAAGL,GAAG,CAACM,KAAK,CAAC,GAAG,CAAC;IAElB,IAAID,MAAM,KAAK,CAAC,IAAID,SAAS,KAAK,EAAE,IAAI,CAACD,cAAc,EAAE;MACvD,MAAM,IAAIjB,UAAU,CAAC,uBAAuB,CAAC;IAC/C;IAEA,IAAIO,MAAoC;IACxC,IAAI;MACF,IAAIc,OAAO,GAAGlB,YAAY,CAACa,aAAc,CAAC;MAC1CT,MAAM,GAAGC,IAAI,CAACc,KAAK,CAACD,OAAO,CAAC;MAC5B,IAAI,KAAK,IAAId,MAAM,IAAIA,MAAM,CAACG,GAAG,KAAK,MAAM,EAAE,MAAM,IAAIa,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC,MAAM;MACN,MAAM,IAAIvB,UAAU,CAAC,uBAAuB,CAAC;IAC/C;IAEA,IAAIW,OAAO,GAAGN,YAAY,CAACmB,aAAa,CAACP,cAAc,EAAEF,OAAO,CAAC;IAEjE,OAAO;MAAEJ,OAAO;MAAEJ,MAAM,EAAEC,IAAI,CAACc,KAAK,CAACnB,YAAY,CAACa,aAAc,CAAC;IAAE,CAAC;EACtE;;EAEA;AACF;AACA;AACA;AACA;AACA;EACE,OAAOQ,aAAaA,CAClBV,GAAW,EACXC,OAAqC,EACzB;IACZ,IAAI,OAAOD,GAAG,KAAK,QAAQ,EAAE;MAC3B,MAAM,IAAId,UAAU,CAAC,gCAAgC,CAAC;IACxD;IACA,MAAM;MAAE,CAAC,EAAEiB,cAAc;MAAEE;IAAO,CAAC,GAAGL,GAAG,CAACM,KAAK,CAAC,GAAG,CAAC;IAEpD,IAAID,MAAM,KAAK,CAAC,IAAIF,cAAc,KAAK,EAAE,EAAE;MACzC,MAAM,IAAIjB,UAAU,CAAC,uBAAuB,CAAC;IAC/C;IAEA,IAAIyB,cAAc,GAAGtB,YAAY,CAACc,cAAe,CAAC;IAClD,MAAMN,OAAO,GAAGV,UAAU,CAAC,CAAC,CAAC,EAAEO,IAAI,CAACc,KAAK,CAACG,cAAc,CAAC,EAAEV,OAAO,CAAC;IAEnE,OAAOJ,OAAO;EAChB;AACF"}
|
package/lib/module/types.js
CHANGED
|
@@ -2,7 +2,7 @@ import { z } from 'zod';
|
|
|
2
2
|
|
|
3
3
|
/** Recognized JWS Header Parameters, any other Header Members may also be present. */
|
|
4
4
|
|
|
5
|
-
/**
|
|
5
|
+
/** JOSE Header for an unsecued JWT */
|
|
6
6
|
|
|
7
7
|
/** Recognized JWE Header Parameters, any other Header members may also be present. */
|
|
8
8
|
|
package/lib/module/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["z","JWK","object","string","optional","boolean","array","d","r","t","WithJWKS","jwks","keys"],"sourceRoot":"../../src","sources":["types.ts"],"mappings":"AAAA,SAASA,CAAC,QAAQ,KAAK;;
|
|
1
|
+
{"version":3,"names":["z","JWK","object","string","optional","boolean","array","d","r","t","WithJWKS","jwks","keys"],"sourceRoot":"../../src","sources":["types.ts"],"mappings":"AAAA,SAASA,CAAC,QAAQ,KAAK;;AAqCvB;;AAkBA;;AAKA;;AAYA;;AAuDA;;AA6CA,OAAO,MAAMC,GAAG,GAAGD,CAAC,CAACE,MAAM,CAAC;EAC1B,KAAK,EAAEF,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,IAAI,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B,IAAI,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,KAAK,EAAEJ,CAAC,CAACK,OAAO,CAAC,CAAC,CAACD,QAAQ,CAAC,CAAC;EAC7B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,SAAS,EAAEJ,CAAC,CAACM,KAAK,CAACN,CAAC,CAACG,MAAM,CAAC,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACzC;EACA,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B;AACF;AACA;EACE,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC;EACjB,GAAG,EAAEH,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,KAAK,EAAEJ,CAAC,CACLM,KAAK,CACJN,CAAC,CAACE,MAAM,CAAC;IACPK,CAAC,EAAEP,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;IACxBI,CAAC,EAAER,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;IACxBK,CAAC,EAAET,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC;EACzB,CAAC,CACH,CAAC,CACAA,QAAQ,CAAC,CAAC;EACb,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,IAAI,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B;EACA,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,KAAK,EAAEJ,CAAC,CAACM,KAAK,CAACN,CAAC,CAACG,MAAM,CAAC,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACrC;EACA,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B;EACA,UAAU,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACjC;EACA,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC;AAC7B,CAAC,CAAC;AAGF,OAAO,MAAMM,QAAQ,GAAGV,CAAC,CAACE,MAAM,CAAC;EAC/BS,IAAI,EAAEX,CAAC,CAACE,MAAM,CAAC;IACbU,IAAI,EAAEZ,CAAC,CAACM,KAAK,CAACL,GAAG;EACnB,CAAC;AACH,CAAC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"names":["getCoordinateOctetLength","getKtyFromAlg","IoReactNativeJwt","removePadding","JOSENotSupported","derToJose","asn1Signature","alg","kty","unpackedJws","unpackBerEncodedASN1","encodedJws","replace"],"sourceRoot":"../../../src","sources":["utils/asn1.ts"],"mappings":"AAAA,
|
|
1
|
+
{"version":3,"names":["getCoordinateOctetLength","getKtyFromAlg","IoReactNativeJwt","removePadding","JOSENotSupported","derToJose","asn1Signature","alg","kty","unpackedJws","unpackBerEncodedASN1","encodedJws","replace"],"sourceRoot":"../../../src","sources":["utils/asn1.ts"],"mappings":"AAAA,SACEA,wBAAwB,EACxBC,aAAa,QAER,eAAe;AACtB,SAASC,gBAAgB,QAAQ,SAAS;AAC1C,SAASC,aAAa,QAAQ,UAAU;AACxC,SAASC,gBAAgB,QAAQ,UAAU;;AAE3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,SAAS,GAAG,MAAAA,CACvBC,aAAqB,EACrBC,GAAuB,KACH;EACpB,MAAMC,GAAG,GAAGP,aAAa,CAACM,GAAG,CAAC;EAC9B,IAAIC,GAAG,KAAK,IAAI,EAAE;IAChB,MAAMC,WAAW,GAAG,MAAMP,gBAAgB,CAACQ,oBAAoB,CAC7DJ,aAAa,EACbN,wBAAwB,CAACO,GAAG,CAC9B,CAAC;IACD,MAAMI,UAAU,GAAGR,aAAa,CAACM,WAAW,CAAC,CAACG,OAAO,CACnD,iBAAiB,EACjB,EACF,CAAC;IACD,OAAOD,UAAU;EACnB,CAAC,MAAM;IACL,MAAM,IAAIP,gBAAgB,CAAC,yBAAyB,CAAC;EACvD;AACF,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"names":[],"sourceRoot":"../../../src","sources":["utils/crypto.ts"],"mappings":""}
|
|
@@ -1,5 +1,8 @@
|
|
|
1
|
-
|
|
2
|
-
export declare const
|
|
1
|
+
import type { JWK } from './types';
|
|
2
|
+
export declare const supportedAlgorithms: readonly ["RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512"];
|
|
3
|
+
export type SupportedAlgorithm = (typeof supportedAlgorithms)[number];
|
|
4
|
+
export declare const isAlgSupported: (alg: string) => alg is "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "ES256" | "ES384" | "ES512";
|
|
3
5
|
export declare const getKtyFromAlg: (alg: string) => "RSA" | "EC";
|
|
6
|
+
export declare const getAlgFromKey: ({ kty, alg, crv }: JWK) => SupportedAlgorithm;
|
|
4
7
|
export declare const getCoordinateOctetLength: (alg: string) => 32 | 48 | 66;
|
|
5
8
|
//# sourceMappingURL=algorithms.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"algorithms.d.ts","sourceRoot":"","sources":["../../src/algorithms.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"algorithms.d.ts","sourceRoot":"","sources":["../../src/algorithms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAGnC,eAAO,MAAM,mBAAmB,4FAUtB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,eAAO,MAAM,cAAc,QAAS,MAAM,mGACgC,CAAC;AAE3E,eAAO,MAAM,aAAa,QAAS,MAAM,iBAYxC,CAAC;AAEF,eAAO,MAAM,aAAa,sBAAuB,GAAG,KAAG,kBActD,CAAC;AAoBF,eAAO,MAAM,wBAAwB,QAAS,MAAM,iBAanD,CAAC"}
|
|
@@ -8,4 +8,5 @@ export type { UnsecuredResult } from './jwt/unsecured';
|
|
|
8
8
|
export { derToJose } from './utils/asn1';
|
|
9
9
|
export { encodeBase64, decodeBase64, removePadding, addPadding, } from './utils/base64';
|
|
10
10
|
export { sha256ToBase64 } from './hash';
|
|
11
|
+
export { type CryptoContext } from './utils/crypto';
|
|
11
12
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,MAAM,EACN,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,MAAM,EACN,gBAAgB,EAChB,MAAM,EACN,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
|
|
@@ -3,7 +3,7 @@ import type { JWTPayload } from '../types';
|
|
|
3
3
|
export declare class ProduceJWT {
|
|
4
4
|
protected _payload: JWTPayload;
|
|
5
5
|
/** @param payload The JWT Claims Set object. */
|
|
6
|
-
|
|
6
|
+
setPayload(payload: JWTPayload): this;
|
|
7
7
|
/**
|
|
8
8
|
* Set "iss" (Issuer) Claim.
|
|
9
9
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"produce.d.ts","sourceRoot":"","sources":["../../../src/jwt/produce.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAI3C,uCAAuC;AACvC,qBAAa,UAAU;IACrB,SAAS,CAAC,QAAQ,
|
|
1
|
+
{"version":3,"file":"produce.d.ts","sourceRoot":"","sources":["../../../src/jwt/produce.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAI3C,uCAAuC;AACvC,qBAAa,UAAU;IACrB,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAM;IAEpC,gDAAgD;IAChD,UAAU,CAAC,OAAO,EAAE,UAAU;IAQ9B;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM;IAKxB;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM;IAK1B;;;;OAIG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IAKvC;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM;IAKpB;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAYnC;;;;;;OAMG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAYxC;;;;;OAKG;IACH,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM;CAQ3B"}
|
|
@@ -1,60 +1,60 @@
|
|
|
1
|
-
import type {
|
|
1
|
+
import type { JWSHeaderParameters, JWTDecodeResult } from '../types';
|
|
2
2
|
import { ProduceJWT } from './produce';
|
|
3
|
+
import type { CryptoContext } from 'src/utils/crypto';
|
|
3
4
|
/**
|
|
4
5
|
* The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
|
|
5
6
|
*
|
|
6
7
|
* @example Usage with a given signature
|
|
7
8
|
*
|
|
8
9
|
* ```js
|
|
9
|
-
* const
|
|
10
|
-
* const signature = 'Axy0....'
|
|
10
|
+
* const crypto: Crypto = { any implementation fo Crypto interface }
|
|
11
11
|
*
|
|
12
|
-
* const jwt = new SignJWT(
|
|
13
|
-
* .
|
|
12
|
+
* const jwt = new SignJWT(crypto)
|
|
13
|
+
* .setPayload({ 'urn:example:claim': true })
|
|
14
|
+
* .setProtectedHeader({ typ })
|
|
14
15
|
* .setIssuedAt()
|
|
15
16
|
* .setIssuer('urn:example:issuer')
|
|
16
17
|
* .setAudience('urn:example:audience')
|
|
17
18
|
* .setExpirationTime('2h')
|
|
18
|
-
* .sign(signature)
|
|
19
19
|
*
|
|
20
|
-
*
|
|
20
|
+
* jwt.data()
|
|
21
|
+
* await jwt.sign()
|
|
21
22
|
* ```
|
|
22
23
|
*/
|
|
23
24
|
export declare class SignJWT extends ProduceJWT {
|
|
24
25
|
private _protectedHeader;
|
|
26
|
+
private crypto;
|
|
27
|
+
/**
|
|
28
|
+
* @param crypto An implementation of the crypto interface. @see utils/crypto for more.
|
|
29
|
+
*/
|
|
30
|
+
constructor(crypto: CryptoContext);
|
|
25
31
|
/**
|
|
26
32
|
* Sets the JWS Protected Header on the SignJWT object.
|
|
33
|
+
* Any invocation overrides what's been already put in the header.
|
|
34
|
+
* Value for "alg" are ignored, as it will be inferred by the key used by the cryptographic context.
|
|
27
35
|
*
|
|
28
|
-
* @param protectedHeader JWS Protected Header.
|
|
36
|
+
* @param protectedHeader JWS Protected Header.
|
|
29
37
|
*/
|
|
30
|
-
setProtectedHeader(protectedHeader:
|
|
38
|
+
setProtectedHeader(protectedHeader: Omit<JWSHeaderParameters, 'alg'>): this;
|
|
31
39
|
/**
|
|
32
|
-
* Return a JWT without signature (`header.payload`)
|
|
40
|
+
* Return a JWT without signature (`header.payload`).
|
|
33
41
|
*
|
|
34
42
|
*/
|
|
35
|
-
|
|
43
|
+
private unsigned;
|
|
44
|
+
private getSelectedSigningAlgorithm;
|
|
36
45
|
/**
|
|
37
|
-
*
|
|
38
|
-
* For an ECDSA signature it is required that this is in ASN.1/DER encoded format.
|
|
39
|
-
* The same format used by the TEE. Conversion to JWS is handled automatically.
|
|
46
|
+
* Return a signed JWT.
|
|
40
47
|
*
|
|
41
|
-
* @param jwtWithoutSignature
|
|
42
|
-
* @param signature
|
|
43
48
|
*/
|
|
44
|
-
|
|
49
|
+
sign(): Promise<string>;
|
|
45
50
|
/**
|
|
46
|
-
*
|
|
47
|
-
*
|
|
48
|
-
* @param jwtWithoutSignature JWT to sign that needs to be decoded.
|
|
51
|
+
* Plain data of the produced JWT
|
|
49
52
|
*/
|
|
50
|
-
|
|
51
|
-
payload: JWTPayload;
|
|
52
|
-
header: CompactJWSHeaderParameters;
|
|
53
|
-
};
|
|
53
|
+
data(): JWTDecodeResult;
|
|
54
54
|
/**
|
|
55
|
-
* Decodes a JWT
|
|
55
|
+
* Decodes a signed JWT
|
|
56
56
|
*
|
|
57
|
-
* @param
|
|
57
|
+
* @param jwt JWT to sign that needs to be decoded.
|
|
58
58
|
*/
|
|
59
59
|
static decode(jwt: string): JWTDecodeResult;
|
|
60
60
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/jwt/sign.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/jwt/sign.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AASvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,qBAAa,OAAQ,SAAQ,UAAU;IACrC,OAAO,CAAC,gBAAgB,CAAwC;IAChE,OAAO,CAAC,MAAM,CAAgB;IAE9B;;OAEG;gBACS,MAAM,EAAE,aAAa;IAKjC;;;;;;OAMG;IACH,kBAAkB,CAAC,eAAe,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC;IAKpE;;;OAGG;YACW,QAAQ;YASR,2BAA2B;IAUzC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAa7B;;OAEG;IACH,IAAI,IAAI,eAAe;IAIvB;;;;OAIG;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;CAkC5C"}
|
|
@@ -1,8 +1,8 @@
|
|
|
1
|
-
import type {
|
|
1
|
+
import type { JWTClaimVerificationOptions, JWTPayload, JWTUnsecuredHeaderParameters } from '../types';
|
|
2
2
|
import { ProduceJWT } from './produce';
|
|
3
3
|
export interface UnsecuredResult {
|
|
4
4
|
payload: JWTPayload;
|
|
5
|
-
header:
|
|
5
|
+
header: JWTUnsecuredHeaderParameters;
|
|
6
6
|
}
|
|
7
7
|
/**
|
|
8
8
|
* The UnsecuredJWT class is a utility for dealing with `{ "alg": "none" }` Unsecured JWTs.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unsecured.d.ts","sourceRoot":"","sources":["../../../src/jwt/unsecured.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,
|
|
1
|
+
{"version":3,"file":"unsecured.d.ts","sourceRoot":"","sources":["../../../src/jwt/unsecured.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,2BAA2B,EAC3B,UAAU,EACV,4BAA4B,EAC7B,MAAM,UAAU,CAAC;AAIlB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,4BAA4B,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,qBAAa,YAAa,SAAQ,UAAU;IAC1C,iCAAiC;IACjC,MAAM,IAAI,MAAM;IAOhB;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,2BAA2B,GACpC,eAAe;IA6BlB;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAClB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,2BAA2B,GACpC,UAAU;CAed"}
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
+
import type { SupportedAlgorithm } from './algorithms';
|
|
2
3
|
export interface JWTDecodeResult {
|
|
3
4
|
/** JWT Claims Set. */
|
|
4
5
|
payload: JWTPayload;
|
|
@@ -26,7 +27,7 @@ export interface JoseHeaderParameters {
|
|
|
26
27
|
/** Recognized JWS Header Parameters, any other Header Members may also be present. */
|
|
27
28
|
export interface JWSHeaderParameters extends JoseHeaderParameters {
|
|
28
29
|
/** JWS "alg" (Algorithm) Header Parameter. */
|
|
29
|
-
alg?:
|
|
30
|
+
alg?: SupportedAlgorithm;
|
|
30
31
|
/**
|
|
31
32
|
* This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
|
|
32
33
|
* Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
|
|
@@ -37,9 +38,9 @@ export interface JWSHeaderParameters extends JoseHeaderParameters {
|
|
|
37
38
|
/** Any other JWS Header member. */
|
|
38
39
|
[propName: string]: unknown;
|
|
39
40
|
}
|
|
40
|
-
/**
|
|
41
|
-
export interface
|
|
42
|
-
alg
|
|
41
|
+
/** JOSE Header for an unsecued JWT */
|
|
42
|
+
export interface JWTUnsecuredHeaderParameters extends JoseHeaderParameters {
|
|
43
|
+
alg?: 'none';
|
|
43
44
|
}
|
|
44
45
|
/** Recognized JWE Header Parameters, any other Header members may also be present. */
|
|
45
46
|
export interface JWEHeaderParameters extends JoseHeaderParameters {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,sBAAsB;IACtB,OAAO,EAAE,UAAU,CAAC;IAEpB,4BAA4B;IAC5B,eAAe,EAAE,mBAAmB,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6CAA6C;IAC7C,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;IAEvD,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAC/D,8CAA8C;IAC9C,GAAG,CAAC,EAAE,kBAAkB,CAAC;IAEzB;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IAEd,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,mCAAmC;IACnC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,sCAAsC;AACtC,MAAM,WAAW,4BAA6B,SAAQ,oBAAoB;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sFAAsF;AACtF,MAAM,WAAW,mBAAoB,SAAQ,oBAAoB;IAC/D,8CAA8C;IAC9C,GAAG,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC;IAElC,yDAAyD;IACzD,GAAG,CAAC,EAAE,eAAe,GAAG,eAAe,CAAC;IAExC,mCAAmC;IACnC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,sCAAsC;IACtC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,2CAA2C;AAC3C,MAAM,WAAW,2BAA2B;IAC1C,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEjC,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,+EAA+E;IAC/E,WAAW,CAAC,EAAE,IAAI,CAAC;IAEnB;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;AACtC,eAAO,MAAM,GAAG;;;;;;;IAOd,yCAAyC;;;IAGzC,gDAAgD;;IAEhD,oCAAoC;;IAEpC;;kCAE8B;;;;;;;;;;;;;;;;;;;IAe9B,4CAA4C;;;;IAI5C,qDAAqD;;IAErD,gEAAgE;;IAEhE,mEAAmE;;IAEnE,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEvC,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAChD,eAAO,MAAM,QAAQ;;;;;;;;;YAvCnB,yCAAyC;;;YAGzC,gDAAgD;;YAEhD,oCAAoC;;YAEpC;;0CAE8B;;;;;;;;;;;;;;;;;;;YAe9B,4CAA4C;;;;YAI5C,qDAAqD;;YAErD,gEAAgE;;YAEhE,mEAAmE;;YAEnE,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvC,CAAC"}
|
|
@@ -1,2 +1,3 @@
|
|
|
1
|
-
|
|
1
|
+
import { type SupportedAlgorithm } from '../algorithms';
|
|
2
|
+
export declare const derToJose: (asn1Signature: string, alg: SupportedAlgorithm) => Promise<string>;
|
|
2
3
|
//# sourceMappingURL=asn1.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"asn1.d.ts","sourceRoot":"","sources":["../../../src/utils/asn1.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"asn1.d.ts","sourceRoot":"","sources":["../../../src/utils/asn1.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,eAAe,CAAC;AAoBvB,eAAO,MAAM,SAAS,kBACL,MAAM,OAChB,kBAAkB,KACtB,QAAQ,MAAM,CAehB,CAAC"}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
import type { JWK } from 'src/types';
|
|
2
|
+
/**
|
|
3
|
+
* The interface of a cryptographic context to be used to sign tokens.
|
|
4
|
+
* Implementations are assumed to be initialized on a single, already-existing key pair.
|
|
5
|
+
*
|
|
6
|
+
* The generation and persistence of the key pair is delegated to the implementation.
|
|
7
|
+
*/
|
|
8
|
+
export interface CryptoContext {
|
|
9
|
+
/**
|
|
10
|
+
* Retrieves the public key to be used in this context.
|
|
11
|
+
* MUST be the same key at every invocation.
|
|
12
|
+
* @returns The public key to be used
|
|
13
|
+
* @throws If no keys are found
|
|
14
|
+
*/
|
|
15
|
+
getPublicKey: () => Promise<JWK>;
|
|
16
|
+
/**
|
|
17
|
+
* Produce a cryptographic signature for a given value.
|
|
18
|
+
* The signature MUST be produced using the private key paired with the public retrieved by getPublicKey()
|
|
19
|
+
* @param value The value to be signed
|
|
20
|
+
* @returns The signature
|
|
21
|
+
* @throws If no keys are found
|
|
22
|
+
*/
|
|
23
|
+
getSignature: (value: string) => Promise<string>;
|
|
24
|
+
}
|
|
25
|
+
//# sourceMappingURL=crypto.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/utils/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErC;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD"}
|
package/package.json
CHANGED
package/src/algorithms.ts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { JWK } from './types';
|
|
1
2
|
import { JOSENotSupported } from './utils/errors';
|
|
2
3
|
|
|
3
4
|
export const supportedAlgorithms = [
|
|
@@ -10,10 +11,11 @@ export const supportedAlgorithms = [
|
|
|
10
11
|
'ES256',
|
|
11
12
|
'ES384',
|
|
12
13
|
'ES512',
|
|
13
|
-
];
|
|
14
|
+
] as const;
|
|
15
|
+
export type SupportedAlgorithm = (typeof supportedAlgorithms)[number];
|
|
14
16
|
|
|
15
|
-
export const isAlgSupported = (alg: string) =>
|
|
16
|
-
supportedAlgorithms.includes(alg.toUpperCase());
|
|
17
|
+
export const isAlgSupported = (alg: string): alg is SupportedAlgorithm =>
|
|
18
|
+
(supportedAlgorithms as unknown as string[]).includes(alg.toUpperCase());
|
|
17
19
|
|
|
18
20
|
export const getKtyFromAlg = (alg: string) => {
|
|
19
21
|
switch (alg.slice(0, 2)) {
|
|
@@ -29,6 +31,39 @@ export const getKtyFromAlg = (alg: string) => {
|
|
|
29
31
|
}
|
|
30
32
|
};
|
|
31
33
|
|
|
34
|
+
export const getAlgFromKey = ({ kty, alg, crv }: JWK): SupportedAlgorithm => {
|
|
35
|
+
if (kty === 'RSA' && alg && isAlgSupported(alg)) {
|
|
36
|
+
return alg;
|
|
37
|
+
} else if (kty === 'EC') {
|
|
38
|
+
return getAlgFromEllipticCurveKey(crv);
|
|
39
|
+
}
|
|
40
|
+
|
|
41
|
+
throw new JOSENotSupported(
|
|
42
|
+
`Unable to determine a supported algorithm for ${JSON.stringify({
|
|
43
|
+
kty,
|
|
44
|
+
alg,
|
|
45
|
+
crv,
|
|
46
|
+
})}`
|
|
47
|
+
);
|
|
48
|
+
};
|
|
49
|
+
|
|
50
|
+
const getAlgFromEllipticCurveKey = (crv: JWK['crv']): SupportedAlgorithm => {
|
|
51
|
+
switch (crv) {
|
|
52
|
+
case 'P-256':
|
|
53
|
+
return 'ES256';
|
|
54
|
+
case 'P-384':
|
|
55
|
+
return 'ES384';
|
|
56
|
+
case 'P-512':
|
|
57
|
+
case 'P-521': // https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/dev/src/Microsoft.IdentityModel.Tokens/JsonWebKeyECTypes.cs#L40
|
|
58
|
+
return 'ES512';
|
|
59
|
+
|
|
60
|
+
default:
|
|
61
|
+
throw new JOSENotSupported(
|
|
62
|
+
`Unsupported "crv" value for an elliptic curve key (${crv})`
|
|
63
|
+
);
|
|
64
|
+
}
|
|
65
|
+
};
|
|
66
|
+
|
|
32
67
|
// Coordinates length in bytes: bits/8
|
|
33
68
|
export const getCoordinateOctetLength = (alg: string) => {
|
|
34
69
|
switch (alg.slice(2, 5)) {
|
package/src/index.ts
CHANGED