@sudoplatform/sudo-user 16.0.2 → 17.0.0

package/lib/utils/jwt.js

@@ -0,0 +1,226 @@
+/*
+ * Copyright © 2026 Anonyome Labs, Inc. All rights reserved.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { SignJWT, jwtVerify, importPKCS8, importSPKI } from 'jose';
+/**
+ * Check if running in Node.js environment (where Buffer is available)
+ * @returns true if in Node.js, false if in browser
+ */
+function isNodeEnvironment() {
+    return typeof Buffer !== 'undefined';
+}
+/**
+ * Base64 decode that works in both Node.js and browser
+ */
+function base64Decode(base64) {
+    if (isNodeEnvironment()) {
+        return new Uint8Array(Buffer.from(base64, 'base64'));
+    }
+    else {
+        const binaryString = atob(base64);
+        const bytes = new Uint8Array(binaryString.length);
+        for (let i = 0; i < binaryString.length; i++) {
+            bytes[i] = binaryString.charCodeAt(i);
+        }
+        return bytes;
+    }
+}
+/**
+ * Base64 encode that works in both Node.js and browser
+ */
+function base64Encode(bytes) {
+    if (isNodeEnvironment()) {
+        return Buffer.from(bytes).toString('base64');
+    }
+    else {
+        let binary = '';
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary);
+    }
+}
+/**
+ * Convert PKCS#1 RSA PRIVATE KEY to PKCS#8 format
+ * This wraps the PKCS#1 key with the PKCS#8 structure
+ * @internal Exported for testing purposes
+ */
+export function convertPKCS1ToPKCS8(pkcs1Pem) {
+    // Extract the base64 content from PKCS#1 PEM
+    const base64 = pkcs1Pem
+        .replace('-----BEGIN RSA PRIVATE KEY-----', '')
+        .replace('-----END RSA PRIVATE KEY-----', '')
+        .replace(/\s/g, '');
+    // Decode base64 to get the DER bytes
+    const derBytes = base64Decode(base64);
+    // PKCS#8 structure for RSA:
+    // SEQUENCE {
+    //   version INTEGER (0)
+    //   algorithm SEQUENCE {
+    //     algorithm OBJECT IDENTIFIER (rsaEncryption: 1.2.840.113549.1.1.1)
+    //     parameters NULL
+    //   }
+    //   privateKey OCTET STRING (contains the PKCS#1 DER)
+    // }
+    // RSA algorithm identifier (1.2.840.113549.1.1.1) with NULL parameters
+    const algorithmIdentifier = new Uint8Array([
+        0x30,
+        0x0d, // SEQUENCE length 13
+        0x06,
+        0x09, // OID length 9
+        0x2a,
+        0x86,
+        0x48,
+        0x86,
+        0xf7,
+        0x0d,
+        0x01,
+        0x01,
+        0x01, // rsaEncryption OID
+        0x05,
+        0x00, // NULL
+    ]);
+    // Version (INTEGER 0)
+    const version = new Uint8Array([0x02, 0x01, 0x00]);
+    // Wrap PKCS#1 in OCTET STRING
+    const pkcs1Length = derBytes.length;
+    let lengthBytes;
+    if (pkcs1Length < 128) {
+        lengthBytes = new Uint8Array([pkcs1Length]);
+    }
+    else if (pkcs1Length < 256) {
+        lengthBytes = new Uint8Array([0x81, pkcs1Length]);
+    }
+    else {
+        lengthBytes = new Uint8Array([
+            0x82,
+            (pkcs1Length >> 8) & 0xff,
+            pkcs1Length & 0xff,
+        ]);
+    }
+    const octetStringHeader = new Uint8Array([0x04]);
+    const octetString = new Uint8Array(octetStringHeader.length + lengthBytes.length + derBytes.length);
+    octetString.set(octetStringHeader, 0);
+    octetString.set(lengthBytes, octetStringHeader.length);
+    octetString.set(derBytes, octetStringHeader.length + lengthBytes.length);
+    // Build the PKCS#8 structure
+    const pkcs8Content = new Uint8Array(version.length + algorithmIdentifier.length + octetString.length);
+    pkcs8Content.set(version, 0);
+    pkcs8Content.set(algorithmIdentifier, version.length);
+    pkcs8Content.set(octetString, version.length + algorithmIdentifier.length);
+    // Wrap in outer SEQUENCE
+    const totalLength = pkcs8Content.length;
+    let sequenceLengthBytes;
+    if (totalLength < 128) {
+        sequenceLengthBytes = new Uint8Array([totalLength]);
+    }
+    else if (totalLength < 256) {
+        sequenceLengthBytes = new Uint8Array([0x81, totalLength]);
+    }
+    else {
+        sequenceLengthBytes = new Uint8Array([
+            0x82,
+            (totalLength >> 8) & 0xff,
+            totalLength & 0xff,
+        ]);
+    }
+    const sequenceHeader = new Uint8Array([0x30]);
+    const pkcs8Der = new Uint8Array(sequenceHeader.length + sequenceLengthBytes.length + pkcs8Content.length);
+    pkcs8Der.set(sequenceHeader, 0);
+    pkcs8Der.set(sequenceLengthBytes, sequenceHeader.length);
+    pkcs8Der.set(pkcs8Content, sequenceHeader.length + sequenceLengthBytes.length);
+    // Convert to PEM format
+    const pkcs8Base64 = base64Encode(pkcs8Der);
+    const pkcs8Pem = '-----BEGIN PRIVATE KEY-----\n' +
+        pkcs8Base64.match(/.{1,64}/g)?.join('\n') +
+        '\n-----END PRIVATE KEY-----';
+    return pkcs8Pem;
+}
+export const jwt = {
+    /**
+     * Decode a JWT token without verification
+     * @param token JWT token string
+     * @returns Decoded token parts or null if invalid
+     */
+    decode(token) {
+        try {
+            const parts = token.split('.');
+            if (parts.length < 3)
+                return null;
+            const [header, payload, signature] = parts;
+            // Decode base64url - works in both Node.js and browser
+            const decodeBase64Url = (str) => {
+                const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+                // Pad if necessary
+                const padded = base64 + '==='.slice((base64.length + 3) % 4);
+                if (isNodeEnvironment()) {
+                    return Buffer.from(padded, 'base64').toString('utf-8');
+                }
+                else {
+                    return decodeURIComponent(atob(padded)
+                        .split('')
+                        .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))
+                        .join(''));
+                }
+            };
+            return {
+                header: JSON.parse(decodeBase64Url(header)),
+                payload: decodeBase64Url(payload),
+                signature,
+            };
+        }
+        catch {
+            return null;
+        }
+    },
+    /**
+     * Sign a JWT token
+     * @param options Sign options including header, payload, and private key
+     * @returns Signed JWT token
+     */
+    async sign(options) {
+        const { header, payload, privateKey } = options;
+        const algorithm = header.alg || 'RS256';
+        let keyToUse = privateKey;
+        if (privateKey.includes('BEGIN RSA PRIVATE KEY')) {
+            keyToUse = convertPKCS1ToPKCS8(privateKey);
+        }
+        // Import the private key (now guaranteed to be PKCS#8)
+        const key = await importPKCS8(keyToUse, algorithm);
+        const jwt = new SignJWT(payload).setProtectedHeader({
+            ...header,
+            alg: algorithm,
+        });
+        return await jwt.sign(key);
+    },
+    /**
+     * Verify a JWT token
+     * @param token JWT token to verify
+     * @param algorithm Algorithm to use (e.g., 'RS256')
+     * @param publicKey Public key in PEM format
+     * @returns true if valid, false if invalid, null on error
+     */
+    async verify(token, algorithm, publicKey) {
+        try {
+            // Import the public key
+            const key = await importSPKI(publicKey, algorithm);
+            // Verify the token
+            await jwtVerify(token, key, {
+                algorithms: [algorithm],
+            });
+            return true;
+        }
+        catch (error) {
+            // If verification fails, return false (not null)
+            // Only return null for unexpected errors
+            if (error instanceof Error) {
+                // JWTVerifyError means the token is invalid but parsing worked
+                return false;
+            }
+            return null;
+        }
+    },
+};
+//# sourceMappingURL=jwt.js.map

package/lib/utils/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/utils/jwt.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAoBlE;;;GAGG;AACH,SAAS,iBAAiB;IACxB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAA;AACtC,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtD,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACvC,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC9C,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,6CAA6C;IAC7C,MAAM,MAAM,GAAG,QAAQ;SACpB,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC;SAC9C,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;SAC5C,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAErB,qCAAqC;IACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IAErC,4BAA4B;IAC5B,aAAa;IACb,wBAAwB;IACxB,yBAAyB;IACzB,wEAAwE;IACxE,sBAAsB;IACtB,MAAM;IACN,sDAAsD;IACtD,IAAI;IAEJ,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,IAAI,UAAU,CAAC;QACzC,IAAI;QACJ,IAAI,EAAE,qBAAqB;QAC3B,IAAI;QACJ,IAAI,EAAE,eAAe;QACrB,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,IAAI,EAAE,oBAAoB;QAC1B,IAAI;QACJ,IAAI,EAAE,OAAO;KACd,CAAC,CAAA;IAEF,sBAAsB;IACtB,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAElD,8BAA8B;IAC9B,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAA;IACnC,IAAI,WAAuB,CAAA;IAE3B,IAAI,WAAW,GAAG,GAAG,EAAE,CAAC;QACtB,WAAW,GAAG,IAAI,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;IAC7C,CAAC;SAAM,IAAI,WAAW,GAAG,GAAG,EAAE,CAAC;QAC7B,WAAW,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IACnD,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,IAAI,UAAU,CAAC;YAC3B,IAAI;YACJ,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI;YACzB,WAAW,GAAG,IAAI;SACnB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAChD,MAAM,WAAW,GAAG,IAAI,UAAU,CAChC,iBAAiB,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAChE,CAAA;IACD,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAA;IACrC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACtD,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAExE,6BAA6B;IAC7B,MAAM,YAAY,GAAG,IAAI,UAAU,CACjC,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CACjE,CAAA;IACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC5B,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACrD,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAE1E,yBAAyB;IACzB,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAA;IACvC,IAAI,mBAA+B,CAAA;IAEnC,IAAI,WAAW,GAAG,GAAG,EAAE,CAAC;QACtB,mBAAmB,GAAG,IAAI,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;IACrD,CAAC;SAAM,IAAI,WAAW,GAAG,GAAG,EAAE,CAAC;QAC7B,mBAAmB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IAC3D,CAAC;SAAM,CAAC;QACN,mBAAmB,GAAG,IAAI,UAAU,CAAC;YACnC,IAAI;YACJ,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,IAAI;YACzB,WAAW,GAAG,IAAI;SACnB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,cAAc,CAAC,MAAM,GAAG,mBAAmB,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CACzE,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;IAC/B,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;IACxD,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAE9E,wBAAwB;IACxB,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,QAAQ,GACZ,+BAA+B;QAC/B,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC;QACzC,6BAA6B,CAAA;IAE/B,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAQ;IACtB;;;;OAIG;IACH,MAAM,CACJ,KAAa;QAEb,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACjC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAA;YAE1C,uDAAuD;YACvD,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,EAAE;gBACtC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;gBAExD,mBAAmB;gBACnB,MAAM,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBAE5D,IAAI,iBAAiB,EAAE,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACxD,CAAC;qBAAM,CAAC;oBACN,OAAO,kBAAkB,CACvB,IAAI,CAAC,MAAM,CAAC;yBACT,KAAK,CAAC,EAAE,CAAC;yBACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;yBACjE,IAAI,CAAC,EAAE,CAAC,CACZ,CAAA;gBACH,CAAC;YACH,CAAC,CAAA;YAED,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;gBAC3C,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;gBACjC,SAAS;aACV,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,OAAoB;QAC7B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;QAE/C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,IAAI,OAAO,CAAA;QACvC,IAAI,QAAQ,GAAG,UAAU,CAAA;QAEzB,IAAI,UAAU,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACjD,QAAQ,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;QAC5C,CAAC;QAED,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAElD,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC;YAClD,GAAG,MAAM;YACT,GAAG,EAAE,SAAS;SACf,CAAC,CAAA;QAEF,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,KAAa,EACb,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,wBAAwB;YACxB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YAElD,mBAAmB;YACnB,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC1B,UAAU,EAAE,CAAC,SAAS,CAAC;aACxB,CAAC,CAAA;YAEF,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iDAAiD;YACjD,yCAAyC;YACzC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,+DAA+D;gBAC/D,OAAO,KAAK,CAAA;YACd,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF,CAAA"}

package/lib/utils/sign-options-builder.js

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2023 Anonyome Labs, Inc. All rights reserved.
+ * Copyright © 2026 Anonyome Labs, Inc. All rights reserved.
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -18,7 +18,6 @@ export function getSignOptions({ aud, sub, iss, keyId, privateKey, attributes, }
             nbf: now,
         },
         privateKey,
-        encoding: 'utf8',
     };
     if (attributes) {
         for (const [key, value] of Object.entries(attributes)) {

package/lib/utils/sign-options-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-options-builder.js","sourceRoot":"","sources":["../../src/utils/sign-options-builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAA;AAEzB,MAAM,UAAU,cAAc,CAAC,EAC7B,GAAG,EACH,GAAG,EACH,GAAG,EACH,KAAK,EACL,UAAU,EACV,UAAU,GAQX;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAAoB;QACnC,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;QACpC,OAAO,EAAE;YACP,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG,EAAE,EAAE,EAAE;YACT,GAAG,EAAE,GAAG,GAAG,EAAE;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG;SACT;QACD,UAAU;QACV,QAAQ,EAAE,MAAM;KACjB,CAAA;IAED,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAClC,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC"}
+{"version":3,"file":"sign-options-builder.js","sourceRoot":"","sources":["../../src/utils/sign-options-builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAA;AAEzB,MAAM,UAAU,cAAc,CAAC,EAC7B,GAAG,EACH,GAAG,EACH,GAAG,EACH,KAAK,EACL,UAAU,EACV,UAAU,GAQX;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAAgB;QAC/B,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;QACpC,OAAO,EAAE;YACP,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG,EAAE,EAAE,EAAE;YACT,GAAG,EAAE,GAAG,GAAG,EAAE;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG;SACT;QACD,UAAU;KACX,CAAA;IAED,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAClC,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sudoplatform/sudo-user",
-  "version": "16.0.2",
+  "version": "17.0.0",
   "author": "Anonyome Labs, Inc.",
   "repository": {
     "type": "git",
@@ -13,10 +13,12 @@
     "lint:eslint": "eslint \"{bin,test,src}/**/*.{ts,tsx}\"",
     "lint:prettier": "prettier -l \"{bin,test,src}/**/*.{js,json,jsx,ts,tsx}\"",
     "codegen": "graphql-codegen -c codegen.yml",
+    "audit-with-suppressions": "true",
     "verify": "true",
     "unit-test": "yarn jest test/unit --verbose --coverage",
     "integration-test": "/bin/bash -c 'jest test/integration'",
-    "smoketest": "yarn unit-test && yarn integration-test",
+    "browser-test": "yarn jest --config jest.config.browser.json --verbose --coverage",
+    "smoketest": "yarn unit-test && yarn integration-test && yarn browser-test",
     "test": "yarn unit-test",
     "build": "yarn codegen && yarn verify && yarn build:transpile && yarn build:docs",
     "build:report-dependencies": "true",
@@ -57,7 +59,7 @@
     "fp-ts": "^2.16.11",
     "graphql": "^16.12.0",
     "io-ts": "^2.2.22",
-    "jws": "^4.0.1",
+    "jose": "^6.1.3",
     "lodash": "^4.17.21",
     "monocle-ts": "^2.3.13",
     "newtype-ts": "^0.3.5",
@@ -67,7 +69,9 @@
   },
   "resolutions": {
     "tmp": "^0.2.3",
-    "graphql": "^16.12.0"
+    "graphql": "^16.12.0",
+    "@smithy/config-resolver": "^4.4.6",
+    "fast-xml-parser": "^5.3.5"
   },
   "devDependencies": {
     "@graphql-codegen/add": "^6.0.0",
@@ -80,7 +84,6 @@
     "@types/amazon-cognito-auth-js": "^1.3.4",
     "@types/firefox-webext-browser": "^143.0.0",
     "@types/jest": "^29.5.14",
-    "@types/jws": "^3.2.11",
     "@types/lodash": "^4.17.21",
     "@types/node": "^22.19.1",
     "@typescript-eslint/eslint-plugin": "^8.46.3",
@@ -94,6 +97,7 @@
     "husky": "^9.1.7",
     "isomorphic-fetch": "^3.0.0",
     "jest": "^29.7.0",
+    "jest-environment-jsdom": "^30.2.0",
     "jest-environment-node": "^29.7.0",
     "prettier": "^3.6.2",
     "subscriptions-transport-ws": "^0.11.0",
@@ -110,12 +114,17 @@
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
+  "packageManager": "yarn@4.12.0+sha512.f45ab632439a67f8bc759bf32ead036a1f413287b9042726b7cc4818b7b49e14e9423ba49b18f9e06ea4941c1ad062385b1d8760a8d5091a1a31e5f6219afca8",
   "auditSuppressions": {
-    "1111987": {
-      "until": 1770781300,
-      "untilISO": "2026-02-11T03:41:40Z",
-      "reason": "Waiting for patch"
+    "1113296": {
+      "until": 1772584573,
+      "untilISO": "2026-03-04T00:36:13Z",
+      "reason": "minimatch - transitive dependency, we dont use the vulnerable functionality and waiting for patch"
+    },
+    "1113371": {
+      "until": 1772584573,
+      "untilISO": "2026-03-04T00:36:13Z",
+      "reason": "minimatch - transitive dependency, we dont use the vulnerable functionality and waiting for patch"
     }
   }
 }

package/types/utils/jwt.d.ts

@@ -0,0 +1,21 @@
+export interface SignOptions {
+    header: Record<string, any>;
+    payload: Record<string, any>;
+    privateKey: string;
+}
+export interface JWT {
+    decode(token: string): {
+        header: any;
+        payload: string;
+        signature: string;
+    } | null;
+    sign(options: SignOptions): Promise<string>;
+    verify(token: string, algorithm: string, publicKey: string): Promise<boolean | null>;
+}
+/**
+ * Convert PKCS#1 RSA PRIVATE KEY to PKCS#8 format
+ * This wraps the PKCS#1 key with the PKCS#8 structure
+ * @internal Exported for testing purposes
+ */
+export declare function convertPKCS1ToPKCS8(pkcs1Pem: string): string;
+export declare const jwt: JWT;

package/types/utils/sign-options-builder.d.ts

@@ -1,4 +1,4 @@
-import * as jws from 'jws';
+import { SignOptions } from './jwt';
 export declare function getSignOptions({ aud, sub, iss, keyId, privateKey, attributes, }: {
     aud: string;
     sub: string;
@@ -6,4 +6,4 @@ export declare function getSignOptions({ aud, sub, iss, keyId, privateKey, attri
     keyId: string;
     privateKey: string;
     attributes?: Record<string, any>;
-}): jws.SignOptions;
+}): SignOptions;