@psnext/slingcli 3.0.20260820-2 → 3.0.20260827-1

package/node_modules/jose/dist/webapi/lib/jws_sign.js

@@ -4,15 +4,37 @@ import { jwsAlgorithm } from './jws_algorithms.js';
 import { isDisjoint } from './type_checks.js';
 import { JWSInvalid } from '../util/errors.js';
 import { concat, encode } from './buffer_utils.js';
-import { validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from './options.js';
+import { serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED, } from './options.js';
 import { prepareKey } from './key.js';
-export function unencodedPayload(protectedHeader) {
-    return (protectedHeader?.b64 === false &&
-        Array.isArray(protectedHeader.crit) &&
-        protectedHeader.crit.includes('b64'));
+function serializeProtectedHeader(protectedHeader) {
+    if (protectedHeader === undefined)
+        return [undefined, ''];
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    return [normalized[0], b64u(normalized[1])];
 }
-export async function createSignature(input, key) {
-    const { protectedHeader, unprotectedHeader } = input;
+function validateSignatureHeader(protectedHeader, joseHeader, crit) {
+    validateCritDuplicates(JWSInvalid, protectedHeader);
+    return validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+}
+function signatureAlgorithm(joseHeader) {
+    const alg = joseHeader.alg;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    return jwsAlgorithm(alg);
+}
+async function signSignature(protectedHeader, payload, entry, key) {
+    const data = concat(encode(protectedHeader), encode('.'), payload);
+    const k = await prepareKey(entry, key, 'sign');
+    return b64u(await sign(entry, k, data));
+}
+export async function createSignature(input, key, assertB64) {
+    let { protectedHeader, unprotectedHeader } = input;
+    let protectedHeaderString;
+    [protectedHeader, protectedHeaderString] = serializeProtectedHeader(protectedHeader);
+    if (unprotectedHeader !== undefined) {
+        unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0];
+    }
     if (!protectedHeader && !unprotectedHeader) {
         throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
     }
@@ -20,20 +42,9 @@ export async function createSignature(input, key) {
         throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
     }
     const joseHeader = { ...protectedHeader, ...unprotectedHeader };
-    validateCritDuplicates(JWSInvalid, protectedHeader);
-    const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, input.crit, protectedHeader, joseHeader);
-    let b64 = true;
-    if (extensions.includes('b64')) {
-        b64 = protectedHeader.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    const entry = jwsAlgorithm(alg);
+    const b64 = validateSignatureHeader(protectedHeader, joseHeader, input.crit);
+    assertB64?.(b64);
+    const entry = signatureAlgorithm(joseHeader);
     let payloadS;
     let payloadB;
     if (b64) {
@@ -47,21 +58,8 @@ export async function createSignature(input, key) {
         payloadB = input.payload;
         payloadS = '';
     }
-    let protectedHeaderString;
-    let protectedHeaderBytes;
-    if (protectedHeader) {
-        protectedHeaderString = b64u(JSON.stringify(protectedHeader));
-        protectedHeaderBytes = encode(protectedHeaderString);
-    }
-    else {
-        protectedHeaderString = '';
-        protectedHeaderBytes = new Uint8Array();
-    }
-    const data = concat(protectedHeaderBytes, encode('.'), payloadB);
-    const k = await prepareKey(entry, key, 'sign');
-    const signature = await sign(entry, k, data);
     const jws = {
-        signature: b64u(signature),
+        signature: await signSignature(protectedHeaderString, payloadB, entry, key),
         payload: payloadS,
     };
     if (protectedHeader) {
@@ -70,5 +68,18 @@ export async function createSignature(input, key) {
     if (unprotectedHeader) {
         jws.header = unprotectedHeader;
     }
-    return jws;
+    return [jws, b64];
+}
+export async function createCompactSignature(payload, inputProtectedHeader, inputCrit, key, rejectUnencoded) {
+    const [protectedHeader, protectedHeaderString] = serializeProtectedHeader(inputProtectedHeader);
+    if (!protectedHeader) {
+        throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
+    }
+    const b64 = validateSignatureHeader(protectedHeader, protectedHeader, inputCrit);
+    if (!b64)
+        rejectUnencoded();
+    const entry = signatureAlgorithm(protectedHeader);
+    const encodedPayload = b64u(payload);
+    const signature = await signSignature(protectedHeaderString, encode(encodedPayload), entry, key);
+    return `${protectedHeaderString}.${encodedPayload}.${signature}`;
 }

package/node_modules/jose/dist/webapi/lib/jws_verify.js

@@ -3,9 +3,25 @@ import { jwsAlgorithm } from './jws_algorithms.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../util/errors.js';
 import { concat, decoder, encoder, encode } from './buffer_utils.js';
 import { decodeBase64url, encodeBase64url, parseJoseHeader } from './helpers.js';
-import { isDisjoint } from './type_checks.js';
-import { validateCrit, validateAlgorithms, JWS_RECOGNIZED } from './options.js';
+import { isDisjoint, isObject } from './type_checks.js';
+import { validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from './options.js';
 import { prepareKey } from './key.js';
+export function snapshotJws(jws, sharedPayload) {
+    const encodedProtected = jws.protected;
+    const inputHeader = jws.header;
+    const header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+    let payload = sharedPayload ? sharedPayload[0] : jws.payload;
+    if (!sharedPayload && payload instanceof Uint8Array) {
+        payload = new Uint8Array(payload);
+    }
+    const signature = jws.signature;
+    const snapshot = { payload, signature };
+    if (encodedProtected !== undefined)
+        snapshot.protected = encodedProtected;
+    if (inputHeader !== undefined)
+        snapshot.header = header;
+    return snapshot;
+}
 export function verifyResult(jws, verified) {
     const [payload, parsedProt, , key, resolvedKey] = verified;
     const result = { payload };
@@ -23,12 +39,24 @@ export function verifyResult(jws, verified) {
 export function prepareVerify(options) {
     return [options && validateAlgorithms('algorithms', options.algorithms), options?.crit];
 }
-export async function verifySignature(jws, shared, key) {
-    const { protected: encodedProtected, header, payload: inputPayload } = jws;
-    let parsedProt = {};
-    if (encodedProtected) {
-        parsedProt = parseJoseHeader(encodedProtected, JWSInvalid, 'JWS Protected Header is invalid');
+export function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === undefined
+    ? {}
+    : parseJoseHeader(encodedProtected, JWSInvalid, 'JWS Protected Header is invalid')) {
+    return parsedProtected;
+}
+function validateJwsHeaders(parsedProt, joseHeader, shared) {
+    const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
+    const alg = joseHeader.alg;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
+    if (shared[0] && !shared[0].has(alg)) {
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+    }
+    return [b64, alg];
+}
+export function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
+    const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
     let joseHeader;
     if (header !== undefined) {
         if (!isDisjoint(parsedProt, header)) {
@@ -39,58 +67,58 @@ export async function verifySignature(jws, shared, key) {
     else {
         joseHeader = parsedProt;
     }
-    const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader);
-    let b64 = true;
-    if (extensions.includes('b64')) {
-        b64 = parsedProt.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    if (shared[0] && !shared[0].has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    if (b64) {
-        if (typeof inputPayload !== 'string') {
-            throw new JWSInvalid('JWS Payload must be a string');
-        }
+    return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
+}
+export function encodeJsonUnencodedPayload(payload) {
+    const invalid = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
+    if (invalid !== undefined) {
+        throw new JWSInvalid(/\p{Cs}/u.test(invalid)
+            ? 'JWS Payload must be a well-formed Unicode string'
+            : 'JWS Payload must not contain unassigned Unicode code points');
+    }
+    return encoder.encode(payload);
+}
+function encodeCompactUnencodedPayload(payload) {
+    try {
+        return encode(payload);
     }
-    else if (typeof inputPayload !== 'string' && !(inputPayload instanceof Uint8Array)) {
-        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
+    catch {
+        throw new JWSInvalid('JWS Compact Serialization payload must use only ASCII characters');
     }
+}
+async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
     let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
         resolvedKey = true;
     }
+    const b64 = typeof signingPayload === 'string';
     const entry = jwsAlgorithm(alg);
-    const data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array(), encode('.'), typeof inputPayload === 'string'
-        ? b64
-            ?
-                (shared[2] ??= encodeBase64url(inputPayload, 'payload', JWSInvalid))
-            : encoder.encode(inputPayload)
-        : inputPayload);
+    const data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array(), encode('.'), b64
+        ?
+            (shared[2] ??= encodeBase64url(signingPayload, 'payload', JWSInvalid))
+        : signingPayload);
     const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
     const k = await prepareKey(entry, key, 'verify');
-    const verified = await verify(entry, k, signature, data);
-    if (!verified) {
+    if (!(await verify(entry, k, signature, data))) {
         throw new JWSSignatureVerificationFailed();
     }
-    let payload;
+    const payload = b64 ? decodeBase64url(signingPayload, 'payload', JWSInvalid) : signingPayload;
+    return [payload, parsedProt, b64, k, resolvedKey];
+}
+export async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+    const { protected: encodedProtected, header, payload: inputPayload } = jws;
+    const [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
     if (b64) {
-        payload = decodeBase64url(inputPayload, 'payload', JWSInvalid);
-    }
-    else if (typeof inputPayload === 'string') {
-        payload = encoder.encode(inputPayload);
+        if (typeof inputPayload !== 'string') {
+            throw new JWSInvalid('JWS Payload must be a string');
+        }
     }
-    else {
-        payload = inputPayload;
+    else if (typeof inputPayload !== 'string' && !(inputPayload instanceof Uint8Array)) {
+        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
-    return [payload, parsedProt, b64, k, resolvedKey];
+    const signingPayload = b64 || typeof inputPayload !== 'string' ? inputPayload : encodeUnencodedPayload(inputPayload);
+    return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
 }
 export async function verifyCompact(jws, shared, key) {
     if (jws instanceof Uint8Array) {
@@ -103,5 +131,9 @@ export async function verifyCompact(jws, shared, key) {
     if (length !== 3) {
         throw new JWSInvalid('Invalid Compact JWS');
     }
-    return verifySignature({ payload, protected: protectedHeader, signature }, shared, key);
+    const compactJws = { payload, protected: protectedHeader, signature };
+    const parsedProt = parseProtectedHeader(protectedHeader);
+    const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
+    const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
+    return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
 }

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -12,13 +12,22 @@ const multipliers = {
 };
 const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 const checkFailed = 'check_failed';
+function invalidDuration() {
+    throw new TypeError('Invalid time period format');
+}
 export function secs(str) {
+    if (typeof str !== 'string') {
+        invalidDuration();
+    }
     const matched = REGEX.exec(str);
     if (!matched || (matched[4] && matched[1])) {
-        throw new TypeError('Invalid time period format');
+        invalidDuration();
     }
     const value = parseFloat(matched[2]);
     const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+    if (!Number.isFinite(numericDate)) {
+        invalidDuration();
+    }
     if (matched[1] === '-' || matched[4] === 'ago') {
         return -numericDate;
     }
@@ -30,6 +39,17 @@ function validateInput(label, input) {
     }
     return input;
 }
+function validateStringClaim(claim, value) {
+    if (typeof value !== 'string') {
+        throw new TypeError(`"${claim}" claim must be a string`);
+    }
+}
+function validateAudienceClaim(value) {
+    if (typeof value !== 'string' &&
+        (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== 'string'))) {
+        throw new TypeError('"aud" claim must be a string or an array of strings');
+    }
+}
 function numericDate(value, label) {
     if (typeof value === 'number')
         return validateInput(label, value);
@@ -38,10 +58,8 @@ function numericDate(value, label) {
     return epoch(new Date()) + secs(value);
 }
 const normalizeTyp = (value) => {
-    if (value.includes('/')) {
-        return value.toLowerCase();
-    }
-    return `application/${value.toLowerCase()}`;
+    const normalized = value.toLowerCase();
+    return value.includes('/') ? normalized : `application/${normalized}`;
 };
 const checkAudiencePresence = (audPayload, audOption) => {
     if (typeof audPayload === 'string') {
@@ -75,7 +93,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
     const { typ } = options;
-    if (typ &&
+    if (typ !== undefined &&
         (typeof protectedHeader.typ !== 'string' ||
             normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
         throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', checkFailed);
@@ -119,7 +137,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     }
     validateInput('clockTolerance option', tolerance);
     const { currentDate } = options;
-    const now = validateInput('currentDate option', epoch(currentDate || new Date()));
+    const now = validateInput('currentDate option', epoch(currentDate === undefined ? new Date() : currentDate));
     const iat = validateNumericDate(payload, 'iat', maxTokenAge !== undefined);
     const nbf = validateNumericDate(payload, 'nbf');
     if (nbf !== undefined) {
@@ -135,63 +153,80 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     }
     if (maxTokenAge !== undefined) {
         const age = now - iat;
-        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
+        const max = validateInput('maxTokenAge option', typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge));
         if (age - tolerance > max) {
             throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', checkFailed);
         }
-        if (age < 0 - tolerance) {
+        if (age < -tolerance) {
             throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', checkFailed);
         }
     }
     return payload;
 }
+let producerPayloads;
+function producerPayload(producer) {
+    return producerPayloads.get(producer);
+}
+export function jwtData(producer) {
+    const payload = producerPayload(producer);
+    for (const claim of ['iat', 'nbf', 'exp']) {
+        const value = payload[claim];
+        if (typeof value === 'number' && !Number.isFinite(value)) {
+            throw new TypeError(`"${claim}" claim must be a finite number`);
+        }
+    }
+    return encoder.encode(JSON.stringify(payload));
+}
+export function jwtClaim(producer, claim) {
+    return producerPayload(producer)[claim];
+}
 export class JWTClaimsBuilder {
-    #payload;
-    constructor(payload) {
+    constructor(payload = {}) {
         if (!isObject(payload)) {
             throw new TypeError('JWT Claims Set MUST be an object');
         }
-        this.#payload = structuredClone(payload);
-    }
-    data() {
-        return encoder.encode(JSON.stringify(this.#payload));
-    }
-    get iss() {
-        return this.#payload.iss;
-    }
-    set iss(value) {
-        this.#payload.iss = value;
-    }
-    get sub() {
-        return this.#payload.sub;
-    }
-    set sub(value) {
-        this.#payload.sub = value;
-    }
-    get aud() {
-        return this.#payload.aud;
-    }
-    set aud(value) {
-        this.#payload.aud = value;
-    }
-    set jti(value) {
-        this.#payload.jti = value;
-    }
-    set nbf(value) {
-        this.#payload.nbf = numericDate(value, 'setNotBefore');
-    }
-    set exp(value) {
-        this.#payload.exp = numericDate(value, 'setExpirationTime');
-    }
-    set iat(value) {
+        ;
+        (producerPayloads ||= new WeakMap()).set(this, structuredClone(payload));
+    }
+    setIssuer(value) {
+        validateStringClaim('iss', value);
+        producerPayload(this).iss = value;
+        return this;
+    }
+    setSubject(value) {
+        validateStringClaim('sub', value);
+        producerPayload(this).sub = value;
+        return this;
+    }
+    setAudience(value) {
+        validateAudienceClaim(value);
+        producerPayload(this).aud = value;
+        return this;
+    }
+    setJti(value) {
+        validateStringClaim('jti', value);
+        producerPayload(this).jti = value;
+        return this;
+    }
+    setNotBefore(value) {
+        producerPayload(this).nbf = numericDate(value, 'setNotBefore');
+        return this;
+    }
+    setExpirationTime(value) {
+        producerPayload(this).exp = numericDate(value, 'setExpirationTime');
+        return this;
+    }
+    setIssuedAt(value) {
+        const payload = producerPayload(this);
         if (value === undefined) {
-            this.#payload.iat = epoch(new Date());
+            payload.iat = epoch(new Date());
         }
         else if (typeof value === 'string') {
-            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
+            payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
         }
         else {
-            this.#payload.iat = numericDate(value, 'setIssuedAt');
+            payload.iat = numericDate(value, 'setIssuedAt');
         }
+        return this;
     }
 }

package/node_modules/jose/dist/webapi/lib/key.js

@@ -1,8 +1,9 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import { isKeyLike, isCryptoKey } from './is_key_like.js';
-import * as jwk from './type_checks.js';
+import { isObject } from './type_checks.js';
 import { decode } from '../util/base64url.js';
 import { jwkToKey } from './jwk_to_key.js';
+import { normalizeJwk } from './jwk_metadata.js';
 const tag = (key) => key[Symbol.toStringTag];
 const jwkMatchesOp = (entry, key, usage) => {
     const { alg } = entry;
@@ -27,14 +28,27 @@ export function checkKeyType(entry, key, usage) {
     const privateKey = usage === 'decrypt' || usage === 'sign';
     if (secret && key instanceof Uint8Array)
         return [BYTES, key];
-    if (jwk.isJWK(key)) {
-        if (secret ? !jwk.isSecretJWK(key) : !(privateKey ? jwk.isPrivateJWK(key) : jwk.isPublicJWK(key))) {
+    if (isObject(key)) {
+        const normalized = normalizeJwk(key);
+        if (typeof normalized.kty !== 'string') {
+            throw new TypeError(secret
+                ? invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array')
+                : invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+        }
+        const valid = secret
+            ? normalized.kty === 'oct' && typeof normalized.k === 'string'
+            : normalized.kty !== 'oct' &&
+                (privateKey
+                    ? (normalized.kty === 'AKP' && typeof normalized.priv === 'string') ||
+                        typeof normalized.d === 'string'
+                    : normalized.d === undefined && normalized.priv === undefined);
+        if (!valid) {
             throw new TypeError(secret
                 ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`
                 : `JSON Web Key for this operation must be a ${privateKey ? 'private' : 'public'} JWK`);
         }
-        jwkMatchesOp(entry, key, usage);
-        return [JWK, key];
+        jwkMatchesOp(entry, normalized, usage);
+        return [JWK, key, normalized];
     }
     if (!isKeyLike(key)) {
         throw new TypeError(secret
@@ -81,7 +95,7 @@ function cached(key, alg, value) {
             entry[alg] = value;
         }
         else {
-            cache.set(key, { __proto__: null, [alg]: value });
+            cache.set(key, { [alg]: value });
         }
     }
     return value ?? entry?.[alg];
@@ -107,8 +121,9 @@ export async function prepareKey(entry, key, usage) {
             return tagged[1];
         case JWK: {
             const key = tagged[1];
-            if (key.k) {
-                return decode(key.k);
+            const normalized = tagged[2];
+            if (normalized.kty === 'oct') {
+                return decode(normalized.k);
             }
             if (!Object.isFrozen(key)) {
                 const { key_ops } = key;
@@ -116,7 +131,7 @@ export async function prepareKey(entry, key, usage) {
                     Object.freeze(key_ops);
                 Object.freeze(key);
             }
-            return handleJWK(key, key, entry);
+            return handleJWK(key, normalized, entry);
         }
         case KEYOBJECT: {
             const keyObject = tagged[1];

package/node_modules/jose/dist/webapi/lib/key_management.js

@@ -5,7 +5,7 @@ import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { decodeBase64url, digest } from './helpers.js';
 import { generateCek, encrypt, decrypt } from './content_encryption.js';
-import { isObject } from './type_checks.js';
+import { assertUint8Array, isObject } from './type_checks.js';
 import { checkCryptoKey, checkModulusLength, checkUsage } from './crypto_key.js';
 import { concat, encode, uint32be } from './buffer_utils.js';
 import { assertCryptoKey } from './is_key_like.js';
@@ -110,7 +110,7 @@ function assertNoEncryptedKey(encryptedKey) {
     if (encryptedKey !== undefined)
         throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
 }
-export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, options) {
+export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
     const entry = jweAlgorithm(alg);
     if (alg === 'dir') {
         assertNoEncryptedKey(encryptedKey);
@@ -152,7 +152,7 @@ export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHead
             assertEncryptedKey(encryptedKey);
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-            const p2cLimit = options?.maxPBES2Count || 10_000;
+            const p2cLimit = maxPBES2Count || 10_000;
             if (joseHeader.p2c > p2cLimit)
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
@@ -190,8 +190,14 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
         case 'ECDH': {
             assertEcdhKey(key);
             const { apu, apv } = providedParameters;
+            if (apu !== undefined) {
+                assertUint8Array(apu, '"apu"');
+            }
+            if (apv !== undefined) {
+                assertUint8Array(apv, '"apv"');
+            }
             let ephemeralKey;
-            if (providedParameters.epk) {
+            if (providedParameters.epk !== undefined) {
                 ephemeralKey = (await prepareKey(entry, providedParameters.epk, 'decrypt'));
             }
             else {

package/node_modules/jose/dist/webapi/lib/key_options.js

@@ -0,0 +1,6 @@
+export function validateExtractableOption(extractable) {
+    if (extractable !== undefined && typeof extractable !== 'boolean') {
+        throw new TypeError('"extractable" option must be a boolean');
+    }
+    return extractable;
+}

package/node_modules/jose/dist/webapi/lib/options.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';
+import { isObject } from './type_checks.js';
 export const JWS_RECOGNIZED = { __proto__: null, b64: true };
 export const JWE_RECOGNIZED = { __proto__: null };
 export function validateAlgorithms(option, algorithms) {
@@ -46,3 +47,28 @@ export function validateCrit(Err, recognizedDefault, recognizedOption, protected
     }
     return protectedHeader.crit;
 }
+export function validateB64(protectedHeader, extensions) {
+    if (extensions.includes('b64')) {
+        const b64 = protectedHeader.b64;
+        if (typeof b64 !== 'boolean') {
+            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+        }
+        return b64;
+    }
+    return true;
+}
+export function serializeJoseHeader(Err, header) {
+    let serialized;
+    let parsed;
+    try {
+        serialized = JSON.stringify(header);
+        parsed = JSON.parse(serialized);
+    }
+    catch (cause) {
+        throw new Err('JOSE Header is not valid JSON', { cause });
+    }
+    if (!isObject(parsed)) {
+        throw new Err('JOSE Header is not a JSON object');
+    }
+    return [parsed, serialized];
+}