@saurbit/oauth2-jwt 0.1.5 → 0.1.7

package/esm/methods.d.ts

@@ -1,4 +1,4 @@
-import type { JwkVerify, JwtDecode, JwtVerify } from "@saurbit/oauth2";
+import type { JwkThumbprintCalculator, JwkVerify, JwtDecode, JwtVerify } from "@saurbit/oauth2";
 /**
  * Verifies a JWT using the provided secret or key and returns the decoded payload.
  * Wraps [jose](https://github.com/panva/jose)'s `jwtVerify`.
@@ -32,8 +32,19 @@ export declare const decodeJwt: JwtDecode;
  * Pass this as the `JwkVerify` argument to `DPoPTokenType` from `@saurbit/oauth2`.
  *
  * @param token - The compact serialized JWT (DPoP proof) to verify.
- * @returns The verified JWT payload.
+ * @returns The verified JWT payload and the protected header.
  * @throws If the token is invalid, the `jwk` header is missing, or signature verification fails.
  */
 export declare const verifyJwk: JwkVerify;
+/**
+ * Calculates the JWK thumbprint for a given JSON Web Key (JWK) using SHA-256.
+ * The thumbprint is a base64url-encoded string that uniquely identifies the JWK.
+ *
+ * @param jwk - The JSON Web Key (JWK) for which to calculate the thumbprint.
+ * @returns The JWK thumbprint as a base64url-encoded string.
+ * @throws If the JWK is invalid or cannot be processed.
+ *
+ * Pass this as the `JwkThumbprintCalculator` argument to `DPoPTokenType` from `@saurbit/oauth2`.
+ */
+export declare const calculateJwkThumbprint: JwkThumbprintCalculator;
 //# sourceMappingURL=methods.d.ts.map

package/esm/methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,EAAE,SAEvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,EAAE,SAYvB,CAAC"}
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAQhG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,EAAE,SAEvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,EAAE,SAYvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAEpC,CAAC"}

package/esm/methods.js

@@ -1,4 +1,4 @@
-import { decodeJwt as joseDecodeJwt, importJWK, jwtVerify } from "jose";
+import { calculateJwkThumbprint as joseCalculateJwkThumbprint, decodeJwt as joseDecodeJwt, importJWK, jwtVerify, } from "jose";
 /**
  * Verifies a JWT using the provided secret or key and returns the decoded payload.
  * Wraps [jose](https://github.com/panva/jose)'s `jwtVerify`.
@@ -37,16 +37,29 @@ export const decodeJwt = (jwt) => {
  * Pass this as the `JwkVerify` argument to `DPoPTokenType` from `@saurbit/oauth2`.
  *
  * @param token - The compact serialized JWT (DPoP proof) to verify.
- * @returns The verified JWT payload.
+ * @returns The verified JWT payload and the protected header.
  * @throws If the token is invalid, the `jwk` header is missing, or signature verification fails.
  */
 export const verifyJwk = async (token) => {
-    const { payload } = await jwtVerify(token, (header) => {
+    const { payload, protectedHeader } = await jwtVerify(token, (header) => {
         if (!header.jwk)
             throw new Error("Missing JWK");
         return importJWK(header.jwk, header.alg);
     }, {
         algorithms: ["ES256"],
     });
-    return payload;
+    return { payload, protectedHeader };
+};
+/**
+ * Calculates the JWK thumbprint for a given JSON Web Key (JWK) using SHA-256.
+ * The thumbprint is a base64url-encoded string that uniquely identifies the JWK.
+ *
+ * @param jwk - The JSON Web Key (JWK) for which to calculate the thumbprint.
+ * @returns The JWK thumbprint as a base64url-encoded string.
+ * @throws If the JWK is invalid or cannot be processed.
+ *
+ * Pass this as the `JwkThumbprintCalculator` argument to `DPoPTokenType` from `@saurbit/oauth2`.
+ */
+export const calculateJwkThumbprint = (jwk) => {
+    return joseCalculateJwkThumbprint(jwk, "sha256");
 };

package/esm/mod.d.ts

@@ -1,6 +1,6 @@
 export { JoseJwksAuthority } from "./jose_jwks_authority.js";
 export { createInMemoryKeyStore, InMemoryKeyStore } from "./jwks_key_store.js";
 export { JwksRotator, type JwksRotatorOptions } from "./jwks_rotator.js";
-export { decodeJwt, verifyJwk, verifyJwt } from "./methods.js";
+export { calculateJwkThumbprint, decodeJwt, verifyJwk, verifyJwt } from "./methods.js";
 export type { JwksKeyStore, JwksRotationTimestampStore, JwtAuthority, JwtSigner, JwtVerifier, KeyGenerator, RawKey, RSA, } from "./types.js";
 //# sourceMappingURL=mod.d.ts.map

package/esm/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE/D,YAAY,EACV,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,GAAG,GACJ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEvF,YAAY,EACV,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,GAAG,GACJ,MAAM,YAAY,CAAC"}

package/esm/mod.js

@@ -1,4 +1,4 @@
 export { JoseJwksAuthority } from "./jose_jwks_authority.js";
 export { createInMemoryKeyStore, InMemoryKeyStore } from "./jwks_key_store.js";
 export { JwksRotator } from "./jwks_rotator.js";
-export { decodeJwt, verifyJwk, verifyJwt } from "./methods.js";
+export { calculateJwkThumbprint, decodeJwt, verifyJwk, verifyJwt } from "./methods.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saurbit/oauth2-jwt",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "JWT utilities for @saurbit/oauth2 (jose-based)",
   "keywords": [
     "oauth2",
@@ -27,7 +27,7 @@
     "jose": "^6.2.2"
   },
   "peerDependencies": {
-    "@saurbit/oauth2": "^0.1.7"
+    "@saurbit/oauth2": "^0.1.8"
   },
   "_generatedBy": "dnt@dev"
 }

package/script/methods.d.ts

@@ -1,4 +1,4 @@
-import type { JwkVerify, JwtDecode, JwtVerify } from "@saurbit/oauth2";
+import type { JwkThumbprintCalculator, JwkVerify, JwtDecode, JwtVerify } from "@saurbit/oauth2";
 /**
  * Verifies a JWT using the provided secret or key and returns the decoded payload.
  * Wraps [jose](https://github.com/panva/jose)'s `jwtVerify`.
@@ -32,8 +32,19 @@ export declare const decodeJwt: JwtDecode;
  * Pass this as the `JwkVerify` argument to `DPoPTokenType` from `@saurbit/oauth2`.
  *
  * @param token - The compact serialized JWT (DPoP proof) to verify.
- * @returns The verified JWT payload.
+ * @returns The verified JWT payload and the protected header.
  * @throws If the token is invalid, the `jwk` header is missing, or signature verification fails.
  */
 export declare const verifyJwk: JwkVerify;
+/**
+ * Calculates the JWK thumbprint for a given JSON Web Key (JWK) using SHA-256.
+ * The thumbprint is a base64url-encoded string that uniquely identifies the JWK.
+ *
+ * @param jwk - The JSON Web Key (JWK) for which to calculate the thumbprint.
+ * @returns The JWK thumbprint as a base64url-encoded string.
+ * @throws If the JWK is invalid or cannot be processed.
+ *
+ * Pass this as the `JwkThumbprintCalculator` argument to `DPoPTokenType` from `@saurbit/oauth2`.
+ */
+export declare const calculateJwkThumbprint: JwkThumbprintCalculator;
 //# sourceMappingURL=methods.d.ts.map

package/script/methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,EAAE,SAEvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,EAAE,SAYvB,CAAC"}
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAQhG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,EAAE,SAEvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,EAAE,SAYvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAEpC,CAAC"}

package/script/methods.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyJwk = exports.decodeJwt = exports.verifyJwt = void 0;
+exports.calculateJwkThumbprint = exports.verifyJwk = exports.decodeJwt = exports.verifyJwt = void 0;
 const jose_1 = require("jose");
 /**
  * Verifies a JWT using the provided secret or key and returns the decoded payload.
@@ -42,17 +42,31 @@ exports.decodeJwt = decodeJwt;
  * Pass this as the `JwkVerify` argument to `DPoPTokenType` from `@saurbit/oauth2`.
  *
  * @param token - The compact serialized JWT (DPoP proof) to verify.
- * @returns The verified JWT payload.
+ * @returns The verified JWT payload and the protected header.
  * @throws If the token is invalid, the `jwk` header is missing, or signature verification fails.
  */
 const verifyJwk = async (token) => {
-    const { payload } = await (0, jose_1.jwtVerify)(token, (header) => {
+    const { payload, protectedHeader } = await (0, jose_1.jwtVerify)(token, (header) => {
         if (!header.jwk)
             throw new Error("Missing JWK");
         return (0, jose_1.importJWK)(header.jwk, header.alg);
     }, {
         algorithms: ["ES256"],
     });
-    return payload;
+    return { payload, protectedHeader };
 };
 exports.verifyJwk = verifyJwk;
+/**
+ * Calculates the JWK thumbprint for a given JSON Web Key (JWK) using SHA-256.
+ * The thumbprint is a base64url-encoded string that uniquely identifies the JWK.
+ *
+ * @param jwk - The JSON Web Key (JWK) for which to calculate the thumbprint.
+ * @returns The JWK thumbprint as a base64url-encoded string.
+ * @throws If the JWK is invalid or cannot be processed.
+ *
+ * Pass this as the `JwkThumbprintCalculator` argument to `DPoPTokenType` from `@saurbit/oauth2`.
+ */
+const calculateJwkThumbprint = (jwk) => {
+    return (0, jose_1.calculateJwkThumbprint)(jwk, "sha256");
+};
+exports.calculateJwkThumbprint = calculateJwkThumbprint;

package/script/mod.d.ts

@@ -1,6 +1,6 @@
 export { JoseJwksAuthority } from "./jose_jwks_authority.js";
 export { createInMemoryKeyStore, InMemoryKeyStore } from "./jwks_key_store.js";
 export { JwksRotator, type JwksRotatorOptions } from "./jwks_rotator.js";
-export { decodeJwt, verifyJwk, verifyJwt } from "./methods.js";
+export { calculateJwkThumbprint, decodeJwt, verifyJwk, verifyJwt } from "./methods.js";
 export type { JwksKeyStore, JwksRotationTimestampStore, JwtAuthority, JwtSigner, JwtVerifier, KeyGenerator, RawKey, RSA, } from "./types.js";
 //# sourceMappingURL=mod.d.ts.map

package/script/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE/D,YAAY,EACV,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,GAAG,GACJ,MAAM,YAAY,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEvF,YAAY,EACV,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,GAAG,GACJ,MAAM,YAAY,CAAC"}

package/script/mod.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyJwt = exports.verifyJwk = exports.decodeJwt = exports.JwksRotator = exports.InMemoryKeyStore = exports.createInMemoryKeyStore = exports.JoseJwksAuthority = void 0;
+exports.verifyJwt = exports.verifyJwk = exports.decodeJwt = exports.calculateJwkThumbprint = exports.JwksRotator = exports.InMemoryKeyStore = exports.createInMemoryKeyStore = exports.JoseJwksAuthority = void 0;
 var jose_jwks_authority_js_1 = require("./jose_jwks_authority.js");
 Object.defineProperty(exports, "JoseJwksAuthority", { enumerable: true, get: function () { return jose_jwks_authority_js_1.JoseJwksAuthority; } });
 var jwks_key_store_js_1 = require("./jwks_key_store.js");
@@ -9,6 +9,7 @@ Object.defineProperty(exports, "InMemoryKeyStore", { enumerable: true, get: func
 var jwks_rotator_js_1 = require("./jwks_rotator.js");
 Object.defineProperty(exports, "JwksRotator", { enumerable: true, get: function () { return jwks_rotator_js_1.JwksRotator; } });
 var methods_js_1 = require("./methods.js");
+Object.defineProperty(exports, "calculateJwkThumbprint", { enumerable: true, get: function () { return methods_js_1.calculateJwkThumbprint; } });
 Object.defineProperty(exports, "decodeJwt", { enumerable: true, get: function () { return methods_js_1.decodeJwt; } });
 Object.defineProperty(exports, "verifyJwk", { enumerable: true, get: function () { return methods_js_1.verifyJwk; } });
 Object.defineProperty(exports, "verifyJwt", { enumerable: true, get: function () { return methods_js_1.verifyJwt; } });