@suveren/gateway 0.7.3 → 0.7.6

package/node_modules/jose/dist/webapi/jwk/thumbprint.js

@@ -3,9 +3,10 @@ import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encode } from '../lib/buffer_utils.js';
 import { isKeyLike } from '../lib/is_key_like.js';
-import { isJWK } from '../lib/type_checks.js';
+import { isObject } from '../lib/type_checks.js';
 import { exportJWK } from '../key/export.js';
 import { invalidKeyInput } from '../lib/invalid_key_input.js';
+import { snapshotJwk } from '../lib/jwk_metadata.js';
 const check = (value, description) => {
     if (typeof value !== 'string' || !value) {
         throw new JWKInvalid(`${description} missing or invalid`);
@@ -13,11 +14,14 @@ const check = (value, description) => {
 };
 export async function calculateJwkThumbprint(key, digestAlgorithm) {
     let jwk;
-    if (isJWK(key)) {
-        jwk = key;
+    if (isObject(key)) {
+        jwk = snapshotJwk(key);
+        if (typeof jwk.kty !== 'string') {
+            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+        }
     }
     else if (isKeyLike(key)) {
-        jwk = await exportJWK(key);
+        jwk = snapshotJwk(await exportJWK(key));
     }
     else {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
@@ -52,7 +56,9 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
             components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
             break;
         case 'oct':
-            check(jwk.k, '"k" (Key Value) Parameter');
+            if (typeof jwk.k !== 'string') {
+                throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+            }
             components = { k: jwk.k, kty: jwk.kty };
             break;
         default:

package/node_modules/jose/dist/webapi/jwks/local.js

@@ -1,78 +1,70 @@
 import { jwkToKey } from '../lib/jwk_to_key.js';
 import { JWS } from '../lib/jws_algorithms.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import { isObject } from '../lib/type_checks.js';
-function signatureAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
-    if (!entry || entry.secret) {
-        throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-    return entry;
+import { isJwkSet } from '../lib/type_checks.js';
+import { snapshotJwk } from '../lib/jwk_metadata.js';
+function isUsableJWK(jwk, entry, alg, kid) {
+    const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
+    const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+    return ((ext === undefined || typeof ext === 'boolean') &&
+        (keyOps === undefined ||
+            (Array.isArray(keyOps) &&
+                keyOps.every((operation, index) => typeof operation === 'string' && keyOps.indexOf(operation) === index) &&
+                keyOps.includes('verify'))) &&
+        entry.kty.includes(kty) &&
+        (kid === undefined || (typeof kid === 'string' && kid === jwkKid)) &&
+        (jwkAlg === undefined ? kty !== 'AKP' : alg === jwkAlg) &&
+        (use === undefined || use === 'sig') &&
+        (!entry.crv || crv === entry.crv));
 }
-function isJWKSLike(jwks) {
-    if (!jwks || typeof jwks !== 'object') {
-        return false;
+async function importWithAlgCache(cache, jwk, entry) {
+    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    const { alg } = entry;
+    if (cached[alg] === undefined) {
+        const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
+        if (key.type !== 'public') {
+            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+        }
+        cached[alg] = key;
     }
-    const { keys } = jwks;
-    return Array.isArray(keys) && keys.every((isObject));
+    return cached[alg];
 }
-class LocalJWKSetImpl {
-    #jwks;
-    #cached = new WeakMap();
-    constructor(jwks) {
-        if (!isJWKSLike(jwks)) {
-            throw new JWKSInvalid('JSON Web Key Set malformed');
-        }
-        this.#jwks = structuredClone(jwks);
+export function createLocalJWKSet(jwks) {
+    let snapshot;
+    try {
+        snapshot = structuredClone(jwks);
     }
-    jwks() {
-        return this.#jwks;
+    catch { }
+    if (!isJwkSet(snapshot)) {
+        throw new JWKSInvalid('JSON Web Key Set malformed');
     }
-    async getKey(protectedHeader, token) {
+    const cached = new WeakMap();
+    const localJWKSet = async (protectedHeader, token) => {
         const { alg, kid } = { ...protectedHeader, ...token?.header };
-        const entry = signatureAlgorithm(alg);
-        const candidates = this.#jwks.keys.filter((jwk) => entry.kty.includes(jwk.kty) &&
-            (typeof kid !== 'string' || kid === jwk.kid) &&
-            (!(typeof jwk.alg === 'string' || jwk.kty === 'AKP') || alg === jwk.alg) &&
-            (typeof jwk.use !== 'string' || jwk.use === 'sig') &&
-            (!Array.isArray(jwk.key_ops) || jwk.key_ops.includes('verify')) &&
-            (!entry.crv || jwk.crv === entry.crv));
+        const entry = typeof alg === 'string' ? JWS[alg] : undefined;
+        if (!entry || entry.secret) {
+            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+        }
+        const candidates = snapshot.keys.filter((jwk) => isUsableJWK(jwk, entry, alg, kid));
         const { 0: jwk, length } = candidates;
-        if (length === 0) {
+        if (!length) {
             throw new JWKSNoMatchingKey();
         }
         if (length !== 1) {
             const error = new JWKSMultipleMatchingKeys();
-            const _cached = this.#cached;
             error[Symbol.asyncIterator] = async function* () {
                 for (const jwk of candidates) {
                     try {
-                        yield await importWithAlgCache(_cached, jwk, entry);
+                        yield await importWithAlgCache(cached, jwk, entry);
                     }
                     catch { }
                 }
             };
             throw error;
         }
-        return importWithAlgCache(this.#cached, jwk, entry);
-    }
-}
-async function importWithAlgCache(cache, jwk, entry) {
-    const cached = cache.get(jwk) || cache.set(jwk, { __proto__: null }).get(jwk);
-    if (cached[entry.alg] === undefined) {
-        const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
-        if (key.type !== 'public') {
-            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-        }
-        cached[entry.alg] = key;
-    }
-    return cached[entry.alg];
-}
-export function createLocalJWKSet(jwks) {
-    const set = new LocalJWKSetImpl(jwks);
-    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperty(localJWKSet, 'jwks', {
-        value: () => structuredClone(set.jwks()),
+        return importWithAlgCache(cached, jwk, entry);
+    };
+    return Object.defineProperty(localJWKSet, 'jwks', {
+        value: () => structuredClone(snapshot),
     });
-    return localJWKSet;
 }

package/node_modules/jose/dist/webapi/jwks/remote.js

@@ -1,6 +1,6 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
 import { createLocalJWKSet } from './local.js';
-import { isObject } from '../lib/type_checks.js';
+import { isJwkSet } from '../lib/type_checks.js';
 function isCloudflareWorkers() {
     return (typeof WebSocketPair !== 'undefined' ||
         (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.8';
+    const VERSION = 'v6.2.10';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();
@@ -36,135 +36,114 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     }
 }
 export const jwksCache = Symbol();
-function isFreshJwksCache(input, cacheMaxAge) {
-    if (typeof input !== 'object' || input === null) {
-        return false;
-    }
-    if (!('uat' in input) || typeof input.uat !== 'number' || Date.now() - input.uat >= cacheMaxAge) {
-        return false;
-    }
-    if (!('jwks' in input) ||
-        !isObject(input.jwks) ||
-        !Array.isArray(input.jwks.keys) ||
-        !Array.prototype.every.call(input.jwks.keys, isObject)) {
-        return false;
-    }
-    return true;
+function isFreshFor(timestamp, duration) {
+    return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
 }
-class RemoteJWKSetImpl {
-    #url;
-    #timeoutDuration;
-    #cooldownDuration;
-    #cacheMaxAge;
-    #jwksTimestamp;
-    #pendingFetch;
-    #headers;
-    #customFetch;
-    #local;
-    #cache;
-    constructor(url, options) {
-        if (!(url instanceof URL)) {
-            throw new TypeError('url must be an instance of URL');
-        }
-        this.#url = new URL(url.href);
-        const opts = options ?? {};
-        this.#timeoutDuration = typeof opts.timeoutDuration === 'number' ? opts.timeoutDuration : 5000;
-        this.#cooldownDuration =
-            typeof opts.cooldownDuration === 'number' ? opts.cooldownDuration : 30000;
-        this.#cacheMaxAge = typeof opts.cacheMaxAge === 'number' ? opts.cacheMaxAge : 600000;
-        this.#headers = new Headers(opts.headers);
-        if (USER_AGENT && !this.#headers.has('User-Agent')) {
-            this.#headers.set('User-Agent', USER_AGENT);
-        }
-        if (!this.#headers.has('accept')) {
-            this.#headers.set('accept', 'application/json');
-            this.#headers.append('accept', 'application/jwk-set+json');
-        }
-        this.#customFetch = opts[customFetch];
-        const cache = opts[jwksCache];
-        if (cache !== undefined) {
-            this.#cache = cache;
-            if (isFreshJwksCache(cache, this.#cacheMaxAge)) {
-                this.#jwksTimestamp = this.#cache.uat;
-                this.#local = createLocalJWKSet(this.#cache.jwks);
-            }
-        }
+function validateDuration(value, fallback, option) {
+    if (Number.isNaN(value)) {
+        throw new TypeError(`"${option}" option must not be NaN`);
     }
-    pendingFetch() {
-        return !!this.#pendingFetch;
+    return typeof value === 'number' ? value : fallback;
+}
+export function createRemoteJWKSet(url, options) {
+    if (!(url instanceof URL)) {
+        throw new TypeError('url must be an instance of URL');
     }
-    #validFor(duration) {
-        return typeof this.#jwksTimestamp === 'number' && Date.now() < this.#jwksTimestamp + duration;
+    const href = new URL(url.href).href;
+    const opts = options ?? {};
+    const timeoutOption = opts.timeoutDuration;
+    if (typeof timeoutOption === 'number' &&
+        (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+        throw new TypeError('"timeoutDuration" option must be a non-negative integer');
     }
-    coolingDown() {
-        return this.#validFor(this.#cooldownDuration);
+    const timeoutDuration = typeof timeoutOption === 'number' ? timeoutOption : 5000;
+    const cooldownDuration = validateDuration(opts.cooldownDuration, 30000, 'cooldownDuration');
+    const cacheMaxAge = validateDuration(opts.cacheMaxAge, 600000, 'cacheMaxAge');
+    const headers = new Headers(opts.headers);
+    if (USER_AGENT && !headers.has('User-Agent')) {
+        headers.set('User-Agent', USER_AGENT);
     }
-    fresh() {
-        return this.#validFor(this.#cacheMaxAge);
+    if (!headers.has('accept')) {
+        headers.set('accept', 'application/json, application/jwk-set+json');
     }
-    jwks() {
-        return this.#local?.jwks();
+    const fetchImpl = opts[customFetch];
+    const cache = opts[jwksCache];
+    let jwksTimestamp;
+    let pendingFetch;
+    let reloadSequence = 0;
+    let appliedSequence = 0;
+    let local;
+    if (cache && typeof cache === 'object') {
+        const { uat, jwks } = cache;
+        if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
+            jwksTimestamp = uat;
+            local = createLocalJWKSet(jwks);
+        }
     }
-    async getKey(protectedHeader, token) {
-        if (!this.#local || !this.fresh()) {
-            await this.reload();
+    const reload = async () => {
+        if (pendingFetch && isCloudflareWorkers()) {
+            pendingFetch = undefined;
+        }
+        if (!pendingFetch) {
+            const sequence = ++reloadSequence;
+            const current = (pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl)
+                .then((json) => {
+                const next = createLocalJWKSet(json);
+                if (sequence <= appliedSequence) {
+                    return;
+                }
+                local = next;
+                const updatedAt = Date.now();
+                if (cache) {
+                    cache.uat = updatedAt;
+                    cache.jwks = json;
+                }
+                jwksTimestamp = updatedAt;
+                appliedSequence = sequence;
+            })
+                .finally(() => {
+                if (pendingFetch === current) {
+                    pendingFetch = undefined;
+                }
+            }));
+        }
+        await pendingFetch;
+    };
+    const remoteJWKSet = async (protectedHeader, token) => {
+        if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
+            await reload();
         }
         try {
-            return await this.#local(protectedHeader, token);
+            return await local(protectedHeader, token);
         }
         catch (err) {
-            if (err instanceof JWKSNoMatchingKey) {
-                if (this.coolingDown() === false) {
-                    await this.reload();
-                    return this.#local(protectedHeader, token);
-                }
+            if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
+                await reload();
+                return local(protectedHeader, token);
             }
             throw err;
         }
-    }
-    async reload() {
-        if (this.#pendingFetch && isCloudflareWorkers()) {
-            this.#pendingFetch = undefined;
-        }
-        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)
-            .then((json) => {
-            this.#local = createLocalJWKSet(json);
-            if (this.#cache) {
-                this.#cache.uat = Date.now();
-                this.#cache.jwks = json;
-            }
-            this.#jwksTimestamp = Date.now();
-        })
-            .finally(() => {
-            this.#pendingFetch = undefined;
-        });
-        await this.#pendingFetch;
-    }
-}
-export function createRemoteJWKSet(url, options) {
-    const set = new RemoteJWKSetImpl(url, options);
-    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperties(remoteJWKSet, {
+    };
+    return Object.defineProperties(remoteJWKSet, {
         coolingDown: {
-            get: () => set.coolingDown(),
+            get: () => isFreshFor(jwksTimestamp, cooldownDuration),
             enumerable: true,
         },
         fresh: {
-            get: () => set.fresh(),
+            get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
             enumerable: true,
         },
         reload: {
-            value: () => set.reload(),
+            value: reload,
             enumerable: true,
         },
         reloading: {
-            get: () => set.pendingFetch(),
+            get: () => !!pendingFetch,
             enumerable: true,
         },
         jwks: {
-            value: () => set.jwks(),
+            value: () => local?.jwks(),
             enumerable: true,
         },
     });
-    return remoteJWKSet;
 }

package/node_modules/jose/dist/webapi/jws/compact/sign.js

@@ -1,21 +1,22 @@
-import { FlattenedSign } from '../flattened/sign.js';
-import { unencodedPayload } from '../../lib/jws_sign.js';
+import { createCompactSignature } from '../../lib/jws_sign.js';
+import { assertNotSet } from '../../lib/helpers.js';
 export class CompactSign {
-    #flattened;
+    #payload;
     #protectedHeader;
     constructor(payload) {
-        this.#flattened = new FlattenedSign(payload);
+        if (!(payload instanceof Uint8Array)) {
+            throw new TypeError('payload must be an instance of Uint8Array');
+        }
+        this.#payload = payload;
     }
     setProtectedHeader(protectedHeader) {
-        this.#flattened.setProtectedHeader(protectedHeader);
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     async sign(key, options) {
-        if (unencodedPayload(this.#protectedHeader)) {
+        return createCompactSignature(this.#payload, this.#protectedHeader, options?.crit, key, () => {
             throw new TypeError('use the flattened module for creating JWS with b64: false');
-        }
-        const jws = await this.#flattened.sign(key, options);
-        return `${jws.protected}.${jws.payload}.${jws.signature}`;
+        });
     }
 }

package/node_modules/jose/dist/webapi/jws/flattened/sign.js

@@ -21,11 +21,12 @@ export class FlattenedSign {
         return this;
     }
     async sign(key, options) {
-        return createSignature({
+        const [jws] = await createSignature({
             payload: this.#payload,
             protectedHeader: this.#protectedHeader,
             unprotectedHeader: this.#unprotectedHeader,
             crit: options?.crit,
         }, key);
+        return jws;
     }
 }

package/node_modules/jose/dist/webapi/jws/flattened/verify.js

@@ -1,24 +1,25 @@
 import { JWSInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
-import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
+import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature, verifyResult, } from '../../lib/jws_verify.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
     }
-    if (jws.protected === undefined && jws.header === undefined) {
+    const snapshot = snapshotJws(jws);
+    if (snapshot.protected === undefined && snapshot.header === undefined) {
         throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
     }
-    if (jws.protected !== undefined && typeof jws.protected !== 'string') {
+    if (snapshot.protected !== undefined && typeof snapshot.protected !== 'string') {
         throw new JWSInvalid('JWS Protected Header incorrect type');
     }
-    if (jws.payload === undefined) {
+    if (snapshot.payload === undefined) {
         throw new JWSInvalid('JWS Payload missing');
     }
-    if (typeof jws.signature !== 'string') {
+    if (typeof snapshot.signature !== 'string') {
         throw new JWSInvalid('JWS Signature missing or incorrect type');
     }
-    if (jws.header !== undefined && !isObject(jws.header)) {
+    if (snapshot.header !== undefined && !isObject(snapshot.header)) {
         throw new JWSInvalid('JWS Unprotected Header incorrect type');
     }
-    return verifyResult(jws, await verifySignature(jws, prepareVerify(options), key));
+    return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
 }

package/node_modules/jose/dist/webapi/jws/general/sign.js

@@ -51,20 +51,22 @@ export class GeneralSign {
             payload: '',
         };
         const encoded = [];
+        let b64;
         for (let i = 0; i < this.#signatures.length; i++) {
             const signature = this.#signatures[i];
             const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
-            const { payload, ...rest } = await createSignature({
+            const [{ payload, ...rest }, signatureB64] = await createSignature({
                 payload: this.#payload,
                 protectedHeader,
                 unprotectedHeader,
                 crit,
                 encoded,
             }, key);
-            if (i === 0) {
+            if (b64 === undefined) {
+                b64 = signatureB64;
                 jws.payload = payload;
             }
-            else if (jws.payload !== payload) {
+            else if (b64 !== signatureB64) {
                 throw new JWSInvalid('inconsistent use of JWS Unencoded Payload (RFC7797)');
             }
             jws.signatures.push(rest);

package/node_modules/jose/dist/webapi/jws/general/verify.js

@@ -1,41 +1,71 @@
-import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
+import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature, verifyResult, } from '../../lib/jws_verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
+function snapshotSignature(signature, payload) {
+    try {
+        const jws = snapshotJws(signature, [payload]);
+        const { protected: encodedProtected, header, signature: encodedSignature } = jws;
+        if (encodedProtected === undefined && header === undefined)
+            return undefined;
+        if (encodedProtected !== undefined && typeof encodedProtected !== 'string')
+            return undefined;
+        if (typeof encodedSignature !== 'string')
+            return undefined;
+        if (header !== undefined && !isObject(header))
+            return undefined;
+        const protectedHeader = parseProtectedHeader(encodedProtected);
+        const { b64, crit } = protectedHeader;
+        return [
+            jws,
+            protectedHeader,
+            Array.isArray(crit) && crit.includes('b64')
+                ? typeof b64 === 'boolean'
+                    ? b64
+                        ? 1
+                        : 2
+                    : 0
+                : 1,
+        ];
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');
     }
-    const { signatures, payload } = jws;
-    if (!Array.isArray(signatures) || !signatures.every(isObject)) {
+    const { signatures, payload: inputPayload } = jws;
+    if (!Array.isArray(signatures)) {
+        throw new JWSInvalid('JWS Signatures missing or incorrect type');
+    }
+    const signatureEntries = Array.from(signatures);
+    if (!signatureEntries.every(isObject)) {
         throw new JWSInvalid('JWS Signatures missing or incorrect type');
     }
     let shared;
     try {
-        if (payload === undefined)
+        if (inputPayload === undefined)
             throw new Error();
         shared = prepareVerify(options);
     }
     catch {
         throw new JWSSignatureVerificationFailed();
     }
-    for (const signature of signatures) {
+    const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload;
+    const candidates = signatureEntries
+        .map((signature) => snapshotSignature(signature, payload))
+        .filter((candidate) => candidate !== undefined);
+    let modes = 0;
+    for (const [, , mode] of candidates) {
+        modes |= mode;
+        if (modes === 3) {
+            throw new JWSInvalid('inconsistent use of JWS Unencoded Payload (RFC7797)');
+        }
+    }
+    for (const candidate of candidates) {
         try {
-            const { protected: encodedProtected, header, signature: encodedSignature } = signature;
-            if (encodedProtected === undefined && header === undefined)
-                throw new Error();
-            if (encodedProtected !== undefined && typeof encodedProtected !== 'string') {
-                throw new Error();
-            }
-            if (typeof encodedSignature !== 'string')
-                throw new Error();
-            if (header !== undefined && !isObject(header))
-                throw new Error();
-            return verifyResult(signature, await verifySignature({
-                header,
-                payload,
-                protected: encodedProtected,
-                signature: encodedSignature,
-            }, shared, key));
+            return verifyResult(candidate[0], await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]));
         }
         catch {
         }

package/node_modules/jose/dist/webapi/jwt/decrypt.js

@@ -5,15 +5,13 @@ export async function jwtDecrypt(jwt, key, options) {
     const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
     const protectedHeader = decrypted[1];
     const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
-    if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
-    }
-    if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
-    }
-    if (protectedHeader.aud !== undefined &&
-        JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
+    for (const claim of ['iss', 'sub', 'aud']) {
+        if (protectedHeader[claim] !== undefined &&
+            (claim === 'aud'
+                ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)
+                : protectedHeader[claim] !== payload[claim])) {
+            throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, 'mismatch');
+        }
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {