@sourceregistry/node-jwt 1.3.0 → 1.3.1

package/dist/jwks/index.d.ts

@@ -0,0 +1,91 @@
+import { KeyObject } from 'crypto';
+export type JWK = RSAJWK | ECJWK | OKPJWK | OctJWK;
+interface BaseJWK {
+    kty: string;
+    kid?: string;
+    alg?: string;
+    use?: 'sig' | 'enc';
+    key_ops?: Array<'sign' | 'verify'>;
+    x5c?: string[];
+    x5t?: string;
+}
+export interface RSAJWK extends BaseJWK {
+    kty: 'RSA';
+    n: string;
+    e: string;
+    d?: string;
+    p?: string;
+    q?: string;
+    dp?: string;
+    dq?: string;
+    qi?: string;
+}
+export interface ECJWK extends BaseJWK {
+    kty: 'EC';
+    crv: 'P-256' | 'P-384' | 'P-521' | 'secp256k1';
+    x: string;
+    y: string;
+    d?: string;
+}
+export interface OKPJWK extends BaseJWK {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    x: string;
+    d?: string;
+}
+export interface OctJWK extends BaseJWK {
+    kty: 'oct';
+    k: string;
+}
+/**
+ * Export KeyObject to JWK
+ * @param key
+ */
+export declare function exportJWK(key: KeyObject): JWK;
+/**
+ * Import JWK to KeyObject
+ * @param jwk
+ */
+export declare function importJWK(jwk: JWK): KeyObject;
+/**
+ * Export public-only JWK
+ * @param key
+ */
+export declare function toPublicJWK(key: KeyObject): JWK;
+/**
+ * RFC 7638 JWK thumbprint
+ * @param jwk
+ * @param hashAlg
+ */
+export declare function getJWKThumbprint(jwk: JWK, hashAlg?: 'sha256'): string;
+/**
+ * Compute x5t (SHA-1) from first cert in x5c if not set
+ * @param jwk
+ */
+export declare function computeX5T(jwk: JWK): string | undefined;
+export declare const JWK: {
+    export: typeof exportJWK;
+    import: typeof importJWK;
+    toPublic: typeof toPublicJWK;
+    thumbprint: typeof getJWKThumbprint;
+};
+export interface JWKS {
+    keys: JWK[];
+}
+/**
+ * Convert JWKS specific key of first key to KeyObject
+ * @param jwks
+ * @param kid
+ * @constructor
+ */
+export declare function JWKSToKeyObject(jwks: JWKS, kid?: string): KeyObject;
+/**
+ * Normalize JWKS
+ * @param jwks
+ */
+export declare function normalizeJWKS(jwks: JWKS): JWKS;
+export declare const JWKS: {
+    toKeyObject: typeof JWKSToKeyObject;
+    normalize: typeof normalizeJWKS;
+};
+export {};

package/dist/jwks/promises.d.ts

@@ -0,0 +1,51 @@
+import { KeyObject } from 'crypto';
+import { JWK as JWKType, JWKS as JSONWebKeySet } from './';
+/**
+ * Export a KeyObject to JWK
+ * @param key
+ */
+export declare const exportJWK: (key: KeyObject) => Promise<JWKType>;
+/**
+ * Import a JWK to KeyObject
+ * @param jwk
+ */
+export declare const importJWK: (jwk: JWKType) => Promise<KeyObject>;
+/**
+ * Export public-only JWK
+ * @param key
+ */
+export declare const toPublicJWK: (key: KeyObject) => Promise<JWKType>;
+/**
+ * RFC 7638 JWK thumbprint
+ * @param jwk
+ * @param hashAlg
+ */
+export declare const getJWKThumbprint: (jwk: JWKType, hashAlg?: "sha256") => Promise<string>;
+/**
+ * Resolve a KeyObject from a JWKS (kid-based)
+ * @param jwks
+ * @param kid
+ * @constructor
+ */
+export declare const JWKSToKeyObject: (jwks: JSONWebKeySet, kid?: string) => Promise<KeyObject>;
+/**
+ * Normalize JWKS (auto-generate missing kid values)
+ * @param jwks
+ */
+export declare const normalizeJWKS: (jwks: JSONWebKeySet) => Promise<JSONWebKeySet>;
+/**
+ * Compute x5t (SHA-1) from first cert in x5c if not set
+ * @param jwk
+ */
+export declare const computeX5T: (jwk: JWKType) => Promise<string | undefined>;
+export declare const JWK: {
+    export: (key: KeyObject) => Promise<JWKType>;
+    import: (jwk: JWKType) => Promise<KeyObject>;
+    toPublic: (key: KeyObject) => Promise<JWKType>;
+    thumbprint: (jwk: JWKType, hashAlg?: "sha256") => Promise<string>;
+    computeX5T: (jwk: JWKType) => Promise<string | undefined>;
+};
+export declare const JWKS: {
+    toKeyObject: (jwks: JSONWebKeySet, kid?: string) => Promise<KeyObject>;
+    normalize: (jwks: JSONWebKeySet) => Promise<JSONWebKeySet>;
+};

package/dist/jwt/index.d.ts

@@ -0,0 +1,249 @@
+import { BinaryLike, KeyLike, KeyObject } from 'crypto';
+export declare const base64Url: {
+    encode: (input: string | Buffer) => string;
+    decode: (input: string) => string;
+};
+export interface JWTPayload {
+    /**
+     * Issuer
+     */
+    iss?: string;
+    /**
+     * Subject
+     */
+    sub?: string;
+    /**
+     * Audience
+     */
+    aud?: string | string[];
+    /**
+     * Expiration Time (as UNIX timestamp)
+     */
+    exp?: number;
+    /**
+     * Not Before (as UNIX timestamp)
+     */
+    nbf?: number;
+    /**
+     * Issued At (as UNIX timestamp)
+     */
+    iat?: number;
+    /**
+     * JWT ID
+     */
+    jti?: string;
+    /**
+     * Session ID
+     */
+    sid?: string;
+    /**
+     * Custom claims
+     */
+    [key: string]: unknown;
+}
+export interface JWTHeader {
+    alg: string;
+    typ?: string;
+    kid?: string;
+}
+export interface JWT {
+    header: JWTHeader;
+    payload: JWTPayload;
+    signature: string;
+}
+export declare const SignatureAlgorithm: {
+    readonly HS256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly HS384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly HS512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES256K: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly PS256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly PS384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly PS512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly EdDSA: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+};
+export type SupportedAlgorithm = keyof typeof SignatureAlgorithm;
+export declare const SupportedAlgorithms: Array<SupportedAlgorithm>;
+/**
+ * Autodetection of algorithm for KeyObjects
+ * @param key
+ * @constructor
+ */
+export declare function AutodetectAlgorithm(key: KeyObject): SupportedAlgorithm;
+/**
+ * Decode a JWT string into its parts (without verification)
+ * @param token
+ */
+export declare const decode: (token: string) => JWT;
+/**
+ * Sign a JWT
+ * @param payload
+ * @param secret
+ * @param options
+ */
+export declare const sign: (payload: JWTPayload, secret: KeyLike, options?: {
+    alg?: SupportedAlgorithm;
+    kid?: string;
+    typ?: string;
+}) => string;
+/**
+ * Verify and validate a JWT
+ * @param token
+ * @param secret
+ * @param options
+ */
+export declare const verify: (token: string, secret: KeyLike, options?: {
+    algorithms?: SupportedAlgorithm[];
+    issuer?: string;
+    subject?: string;
+    audience?: string | string[];
+    jwtId?: string;
+    ignoreExpiration?: boolean;
+    clockSkew?: number;
+    maxTokenAge?: number;
+}) => {
+    valid: true;
+    header: JWTHeader;
+    payload: JWTPayload;
+    signature: string;
+} | {
+    valid: false;
+    error: {
+        reason: string;
+        code: string;
+    };
+};
+export declare const JWT: {
+    sign: (payload: JWTPayload, secret: KeyLike, options?: {
+        alg?: SupportedAlgorithm;
+        kid?: string;
+        typ?: string;
+    }) => string;
+    verify: (token: string, secret: KeyLike, options?: {
+        algorithms?: SupportedAlgorithm[];
+        issuer?: string;
+        subject?: string;
+        audience?: string | string[];
+        jwtId?: string;
+        ignoreExpiration?: boolean;
+        clockSkew?: number;
+        maxTokenAge?: number;
+    }) => {
+        valid: true;
+        header: JWTHeader;
+        payload: JWTPayload;
+        signature: string;
+    } | {
+        valid: false;
+        error: {
+            reason: string;
+            code: string;
+        };
+    };
+    decode: (token: string) => JWT;
+    algorithms: {
+        readonly HS256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly HS384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly HS512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES256K: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly EdDSA: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+    };
+};

package/dist/jwt/promises.d.ts

@@ -0,0 +1,118 @@
+import { KeyLike } from 'crypto';
+import { JWT as JSONWebToken, JWTPayload, SupportedAlgorithm, JWTHeader } from '../';
+export { type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload } from '../index';
+/**
+ * Decode a JWT string into its parts (without verification)
+ * @param token
+ */
+export declare const decode: (token: string) => Promise<JSONWebToken>;
+/**
+ * Sign a JWT
+ * @param payload
+ * @param secret
+ * @param options
+ */
+export declare const sign: (payload: JWTPayload, secret: KeyLike, options?: {
+    alg?: SupportedAlgorithm;
+    kid?: string;
+    typ?: string;
+}) => Promise<string>;
+/**
+ * Verify and validate a JWT
+ * @throws { { reason: string; code: string } } if invalid
+ */
+export declare const verify: (token: string, secret: KeyLike, options?: {
+    algorithms?: SupportedAlgorithm[];
+    issuer?: string;
+    subject?: string;
+    audience?: string | string[];
+    jwtId?: string;
+    ignoreExpiration?: boolean;
+    clockSkew?: number;
+    maxTokenAge?: number;
+}) => Promise<{
+    header: JWTHeader;
+    payload: JWTPayload;
+    signature: string;
+}>;
+export type JWT = JSONWebToken;
+export declare const JWT: {
+    sign: (payload: JWTPayload, secret: KeyLike, options?: {
+        alg?: SupportedAlgorithm;
+        kid?: string;
+        typ?: string;
+    }) => Promise<string>;
+    verify: (token: string, secret: KeyLike, options?: {
+        algorithms?: SupportedAlgorithm[];
+        issuer?: string;
+        subject?: string;
+        audience?: string | string[];
+        jwtId?: string;
+        ignoreExpiration?: boolean;
+        clockSkew?: number;
+        maxTokenAge?: number;
+    }) => Promise<{
+        header: JWTHeader;
+        payload: JWTPayload;
+        signature: string;
+    }>;
+    decode: (token: string) => Promise<JSONWebToken>;
+    algorithms: {
+        readonly HS256: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly HS384: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly HS512: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS256: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS384: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS512: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES256: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES384: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES512: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES256K: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS256: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS384: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS512: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly EdDSA: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/node-jwt",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "A lightweight, zero-dependency TypeScript library for creating, verifying and decoding JSON Web Tokens (JWT).",
   "main": "./dist/index.cjs.js",
   "module": "./dist/index.es.js",