@toa.io/extensions.exposition 1.0.0-alpha.253 → 1.0.0-alpha.256

package/components/identity.tokens/manifest.toa.yaml

@@ -100,10 +100,26 @@ configuration:
     type: object
     properties:
       keys:
-        type: object
-        minProperties: 1
-        additionalProperties:
-          type: string
+        type: array
+        minItems: 1
+        contains:
+          properties:
+            format:
+              enum: [jwe]
+        items:
+          type: object
+          properties:
+            id:
+              type: string
+              minLength: 1
+            key:
+              type: string
+            format:
+              type: string
+              enum: [jwe, paseto]
+              default: jwe
+          required: [id, key]
+          additionalProperties: false
       lifetime:
         description: Token expiration time in seconds (default 30 days)
         type: integer
@@ -122,6 +138,7 @@ configuration:
             type: integer
             default: 600000
         default: {}
+    required: [keys]
 
 exposition:
   /:identity:

package/components/identity.tokens/operations/decrypt.d.ts

@@ -1,13 +1,15 @@
 import type { Maybe, Operation } from '@toa.io/types';
 import type { Context, DecryptOutput } from './lib';
 export declare class Computation implements Operation {
-    private keys;
+    private readonly keys;
+    private readonly legacy;
     private cache;
     private latest;
     private remote;
     private logs;
     mount(context: Context): void;
     execute(token: string): Promise<Maybe<DecryptOutput>>;
-    private kid;
+    private pasetoKid;
+    private jweKid;
     private key;
 }

package/components/identity.tokens/operations/decrypt.js

@@ -4,28 +4,39 @@ exports.Computation = void 0;
 const paseto_1 = require("paseto");
 const error_value_1 = require("error-value");
 const lru_cache_1 = require("lru-cache");
+const lib_1 = require("./lib");
+const jose_1 = require("./lib/jose");
 class Computation {
     keys = {};
+    legacy = {};
     cache;
     latest;
     remote;
     logs;
     mount(context) {
-        this.latest = Object.keys(context.configuration.keys)[0];
+        const latest = context.configuration.keys.find(({ format }) => format !== 'paseto');
+        if (latest === undefined)
+            throw new TypeError('At least one JWE key must be configured');
+        this.latest = latest.id;
         this.remote = context.remote.identity.keys;
         this.cache = new lru_cache_1.LRUCache(context.configuration.cache);
         this.logs = context.logs;
-        for (const [kid, key] of Object.entries(context.configuration.keys))
-            this.keys[kid] = { key };
+        for (const { id, key, format } of context.configuration.keys) {
+            const branch = format === 'paseto' ? this.legacy : this.keys;
+            branch[id] = { key };
+        }
     }
     async execute(token) {
-        const kid = this.kid(token);
+        const legacy = token.startsWith('v3.local.');
+        const kid = legacy ? this.pasetoKid(token) : await this.jweKid(token);
         if (kid instanceof Error)
             return kid;
-        const key = await this.key(kid);
+        const key = await this.key(kid, legacy);
         if (key instanceof Error)
             return key;
-        const claims = await decrypt(token, key.key);
+        const claims = legacy
+            ? await decryptPaseto(token, key.key)
+            : await decryptJWE(token, key.key);
         if (claims instanceof Error)
             return claims;
         this.logs.debug('Token claims', claims);
@@ -36,10 +47,10 @@ class Computation {
             iat: claims.iat,
             exp: claims.exp,
             identity: claims.identity,
-            refresh: kid !== this.latest && key.identity === undefined
+            refresh: legacy || (kid !== this.latest && key.identity === undefined)
         };
     }
-    kid(token) {
+    pasetoKid(token) {
         const [, , , footer] = token.split('.');
         if (footer === undefined)
             return ERR_INVALID_TOKEN;
@@ -54,9 +65,23 @@ class Computation {
             return ERR_INVALID_TOKEN;
         }
     }
-    async key(kid) {
-        if (kid in this.keys)
-            return this.keys[kid];
+    async jweKid(token) {
+        try {
+            const { decodeProtectedHeader } = await (0, jose_1.load)();
+            const header = decodeProtectedHeader(token);
+            if (header.alg !== 'dir' || header.enc !== 'A256GCM' || header.typ !== 'JWT' ||
+                typeof header.kid !== 'string')
+                return ERR_INVALID_TOKEN;
+            return header.kid;
+        }
+        catch {
+            return ERR_INVALID_TOKEN;
+        }
+    }
+    async key(kid, legacy) {
+        const configured = legacy ? this.legacy : this.keys;
+        if (kid in configured)
+            return configured[kid];
         if (!this.cache.has(kid)) {
             const value = await this.remote.observe({ query: { id: kid } });
             this.cache.set(kid, { value });
@@ -66,7 +91,7 @@ class Computation {
     }
 }
 exports.Computation = Computation;
-async function decrypt(token, key) {
+async function decryptPaseto(token, key) {
     try {
         return await paseto_1.V3.decrypt(token, key);
     }
@@ -74,6 +99,29 @@ async function decrypt(token, key) {
         return ERR_INVALID_TOKEN;
     }
 }
+async function decryptJWE(token, key) {
+    try {
+        const { jwtDecrypt } = await (0, jose_1.load)();
+        const { payload } = await jwtDecrypt(token, (0, lib_1.jweKey)(key), {
+            keyManagementAlgorithms: ['dir'],
+            contentEncryptionAlgorithms: ['A256GCM']
+        });
+        if (typeof payload.iss !== 'string' || typeof payload.iat !== 'number' ||
+            typeof payload.identity !== 'object' || payload.identity === null)
+            return ERR_INVALID_TOKEN;
+        if (payload.exp !== undefined && payload.exp * 1000 <= Date.now())
+            return ERR_INVALID_TOKEN;
+        return {
+            iss: payload.iss,
+            iat: new Date(payload.iat * 1000).toISOString(),
+            ...(payload.exp === undefined ? {} : { exp: new Date(payload.exp * 1000).toISOString() }),
+            identity: payload.identity
+        };
+    }
+    catch {
+        return ERR_INVALID_TOKEN;
+    }
+}
 const ERR_INVALID_TOKEN = new error_value_1.Err('INVALID_TOKEN');
 const ERR_INVALID_KEY = new error_value_1.Err('INVALID_KEY');
 const ERR_FORGED_KEY = new error_value_1.Err('FORGED_KEY');

package/components/identity.tokens/operations/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../source/decrypt.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAC3B,6CAAiC;AACjC,yCAAoC;AAIpC,MAAa,WAAW;IACd,IAAI,GAAwB,EAAE,CAAA;IAC9B,KAAK,CAA6B;IAClC,MAAM,CAAS;IACf,MAAM,CAAwC;IAC9C,IAAI,CAAkB;IAEvB,KAAK,CAAE,OAAgB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAQ,CAAmB,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACxE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QAExB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAA;IAC5B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAa;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE3B,IAAI,GAAG,YAAY,KAAK;YACtB,OAAO,GAAG,CAAA;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAE/B,IAAI,GAAG,YAAY,KAAK;YACtB,OAAO,GAAG,CAAA;QAEZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;QAE5C,IAAI,MAAM,YAAY,KAAK;YACzB,OAAO,MAAM,CAAA;QAEf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QAEvC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ;YACnE,OAAO,cAAc,CAAA;QAEvB,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS;SAC3D,CAAA;IACH,CAAC;IAEO,GAAG,CAAE,KAAa;QACxB,MAAM,CAAC,EAAE,AAAD,EAAG,AAAD,EAAG,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,iBAAiB,CAAA;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAEhC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBACzB,OAAO,iBAAiB,CAAA;YAE1B,OAAO,GAAG,CAAA;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,iBAAiB,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAE,GAAW;QAC5B,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI;YAClB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YAE/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,KAAK,IAAI,eAAe,CAAA;IACxC,CAAC;CACF;AAhFD,kCAgFC;AAED,KAAK,UAAU,OAAO,CAAE,KAAa,EAAE,GAAW;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,WAAE,CAAC,OAAO,CAAS,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAA;IAC1B,CAAC;AACH,CAAC;AAWD,MAAM,iBAAiB,GAAG,IAAI,iBAAG,CAAC,eAAe,CAAC,CAAA;AAClD,MAAM,eAAe,GAAG,IAAI,iBAAG,CAAC,aAAa,CAAC,CAAA;AAC9C,MAAM,cAAc,GAAG,IAAI,iBAAG,CAAC,YAAY,CAAC,CAAA"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../source/decrypt.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAC3B,6CAAiC;AACjC,yCAAoC;AACpC,+BAA8B;AAC9B,qCAAiC;AAIjC,MAAa,WAAW;IACL,IAAI,GAAwB,EAAE,CAAA;IAC9B,MAAM,GAAwB,EAAE,CAAA;IACzC,KAAK,CAA6B;IAClC,MAAM,CAAS;IACf,MAAM,CAAwC;IAC9C,IAAI,CAAkB;IAEvB,KAAK,CAAE,OAAgB;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;QAEnF,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;QAEhE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAA;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAQ,CAAmB,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACxE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QAExB,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;YAE5D,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAA;QACtB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAa;QACjC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErE,IAAI,GAAG,YAAY,KAAK;YACtB,OAAO,GAAG,CAAA;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAEvC,IAAI,GAAG,YAAY,KAAK;YACtB,OAAO,GAAG,CAAA;QAEZ,MAAM,MAAM,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;YACrC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;QAEpC,IAAI,MAAM,YAAY,KAAK;YACzB,OAAO,MAAM,CAAA;QAEf,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QAEvC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ;YACnE,OAAO,cAAc,CAAA;QAEvB,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;SACvE,CAAA;IACH,CAAC;IAEO,SAAS,CAAE,KAAa;QAC9B,MAAM,CAAC,EAAE,AAAD,EAAG,AAAD,EAAG,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAEvC,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,iBAAiB,CAAA;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAEhC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBACzB,OAAO,iBAAiB,CAAA;YAE1B,OAAO,GAAG,CAAA;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,iBAAiB,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAE,KAAa;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,IAAA,WAAI,GAAE,CAAA;YAC9C,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAE3C,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;gBAC1E,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC9B,OAAO,iBAAiB,CAAA;YAE1B,OAAO,MAAM,CAAC,GAAG,CAAA;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,iBAAiB,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,CAAE,GAAW,EAAE,MAAe;QAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;QAEnD,IAAI,GAAG,IAAI,UAAU;YACnB,OAAO,UAAU,CAAC,GAAG,CAAC,CAAA;QAExB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;YAE/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAChC,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEjC,OAAO,KAAK,EAAE,KAAK,IAAI,eAAe,CAAA;IACxC,CAAC;CACF;AA7GD,kCA6GC;AAED,KAAK,UAAU,aAAa,CAAE,KAAa,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,OAAO,MAAM,WAAE,CAAC,OAAO,CAAS,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAA;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAE,KAAa,EAAE,GAAW;IACnD,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,WAAI,GAAE,CAAA;QAEnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,CAAY,KAAK,EAAE,IAAA,YAAM,EAAC,GAAG,CAAC,EAAE;YAClE,uBAAuB,EAAE,CAAC,KAAK,CAAC;YAChC,2BAA2B,EAAE,CAAC,SAAS,CAAC;SACzC,CAAC,CAAA;QAEF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YACpE,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;YACjE,OAAO,iBAAiB,CAAA;QAE1B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;YAC/D,OAAO,iBAAiB,CAAA;QAE1B,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACzF,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAA;IAC1B,CAAC;AACH,CAAC;AAWD,MAAM,iBAAiB,GAAG,IAAI,iBAAG,CAAC,eAAe,CAAC,CAAA;AAClD,MAAM,eAAe,GAAG,IAAI,iBAAG,CAAC,aAAa,CAAC,CAAA;AAC9C,MAAM,cAAc,GAAG,IAAI,iBAAG,CAAC,YAAY,CAAC,CAAA"}

package/components/identity.tokens/operations/encrypt.js

@@ -1,37 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Effect = void 0;
-const paseto_1 = require("paseto");
 const error_value_1 = require("error-value");
+const lib_1 = require("./lib");
+const jose_1 = require("./lib/jose");
 class Effect {
     key;
     lifetime;
     mount(context) {
-        const [id, secret] = Object.entries(context.configuration.keys)[0];
-        this.key = { id, key: secret };
+        const key = context.configuration.keys.find(({ format }) => format !== 'paseto');
+        if (key === undefined)
+            throw new TypeError('At least one JWE key must be configured');
+        this.key = key;
         this.lifetime = context.configuration.lifetime * 1000;
     }
     async execute(input) {
+        const { EncryptJWT } = await (0, jose_1.load)();
         if (input.scopes?.some((scope) => !within(scope, input.identity.roles)) === true)
             return ERR_INACCESSIBLE_SCOPE;
         const lifetime = input.lifetime === undefined ? this.lifetime : (input.lifetime * 1000);
-        const exp = lifetime === 0
-            ? undefined
-            : new Date(Date.now() + lifetime).toISOString();
         const identity = {
             id: input.identity.id,
             roles: input.scopes ?? input.identity.roles
         };
         if (input.permissions !== undefined)
             identity.permissions = input.permissions;
-        const payload = {
-            identity,
-            iss: input.authority
-        };
-        if (exp !== undefined)
-            payload.exp = exp;
         const key = input.key ?? this.key;
-        return await paseto_1.V3.encrypt(payload, key.key, { footer: { kid: key.id } });
+        let token = new EncryptJWT({ identity })
+            .setProtectedHeader({ alg: 'dir', enc: 'A256GCM', typ: 'JWT', kid: key.id })
+            .setIssuer(input.authority)
+            .setIssuedAt(Date.now() / 1000);
+        if (lifetime !== 0)
+            token = token.setExpirationTime((Date.now() + lifetime) / 1000);
+        return await token.encrypt((0, lib_1.jweKey)(key.key));
     }
 }
 exports.Effect = Effect;

package/components/identity.tokens/operations/encrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../source/encrypt.ts"],"names":[],"mappings":";;;AAAA,mCAA2B;AAC3B,6CAAiC;AAIjC,MAAa,MAAM;IACT,GAAG,CAA0B;IAC7B,QAAQ,CAAS;IAElB,KAAK,CAAE,OAAgB;QAC5B,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAElE,IAAI,CAAC,GAAG,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB;QACvC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;YAC9E,OAAO,sBAAsB,CAAA;QAE/B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;QAEvF,MAAM,GAAG,GAAG,QAAQ,KAAK,CAAC;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;QAEjD,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK;SAC5C,CAAA;QAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YACjC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;QAE1C,MAAM,OAAO,GAAoB;YAC/B,QAAQ;YACR,GAAG,EAAE,KAAK,CAAC,SAAS;SACrB,CAAA;QAED,IAAI,GAAG,KAAK,SAAS;YACnB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAA;QAEnB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QAEjC,OAAO,MAAM,WAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACxE,CAAC;CACF;AAzCD,wBAyCC;AAED,SAAS,MAAM,CAAE,KAAa,EAAE,KAAe;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,iBAAG,CAAC,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../source/encrypt.ts"],"names":[],"mappings":";;;AAAA,6CAAiC;AACjC,+BAA8B;AAC9B,qCAAiC;AAIjC,MAAa,MAAM;IACT,GAAG,CAA0B;IAC7B,QAAQ,CAAS;IAElB,KAAK,CAAE,OAAgB;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;QAEhF,IAAI,GAAG,KAAK,SAAS;YACnB,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAA;QAEhE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAA;IACvD,CAAC;IAEM,KAAK,CAAC,OAAO,CAAE,KAAmB;QACvC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,WAAI,GAAE,CAAA;QAEnC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;YAC9E,OAAO,sBAAsB,CAAA;QAE/B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;QAEvF,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YACrB,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK;SAC5C,CAAA;QAED,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YACjC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;QAE1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QAEjC,IAAI,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;aACrC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;aAC3E,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC;aAC1B,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAEjC,IAAI,QAAQ,KAAK,CAAC;YAChB,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAA;QAEjE,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,IAAA,YAAM,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;CACF;AA1CD,wBA0CC;AAED,SAAS,MAAM,CAAE,KAAa,EAAE,KAAe;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,sBAAsB,GAAG,IAAI,iBAAG,CAAC,oBAAoB,CAAC,CAAA"}

package/components/identity.tokens/operations/lib/index.d.ts

@@ -1,2 +1,3 @@
 export * from './pad';
 export * from './types';
+export { jweKey } from './key';

package/components/identity.tokens/operations/lib/index.js

@@ -14,6 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.jweKey = void 0;
 __exportStar(require("./pad"), exports);
 __exportStar(require("./types"), exports);
+var key_1 = require("./key");
+Object.defineProperty(exports, "jweKey", { enumerable: true, get: function () { return key_1.jweKey; } });
 //# sourceMappingURL=index.js.map

package/components/identity.tokens/operations/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAqB;AACrB,0CAAuB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../source/lib/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,wCAAqB;AACrB,0CAAuB;AACvB,6BAA8B;AAArB,6FAAA,MAAM,OAAA"}

package/components/identity.tokens/operations/lib/jose.d.ts

@@ -0,0 +1,41 @@
+export function load(): Promise<{
+    default: typeof import("jose");
+    compactDecrypt: typeof import("jose").compactDecrypt;
+    flattenedDecrypt: typeof import("jose").flattenedDecrypt;
+    generalDecrypt: typeof import("jose").generalDecrypt;
+    GeneralEncrypt: typeof import("jose").GeneralEncrypt;
+    compactVerify: typeof import("jose").compactVerify;
+    flattenedVerify: typeof import("jose").flattenedVerify;
+    generalVerify: typeof import("jose").generalVerify;
+    jwtVerify: typeof import("jose").jwtVerify;
+    jwtDecrypt: typeof import("jose").jwtDecrypt;
+    CompactEncrypt: typeof import("jose").CompactEncrypt;
+    FlattenedEncrypt: typeof import("jose").FlattenedEncrypt;
+    CompactSign: typeof import("jose").CompactSign;
+    FlattenedSign: typeof import("jose").FlattenedSign;
+    GeneralSign: typeof import("jose").GeneralSign;
+    SignJWT: typeof import("jose").SignJWT;
+    EncryptJWT: typeof import("jose").EncryptJWT;
+    calculateJwkThumbprint: typeof import("jose").calculateJwkThumbprint;
+    calculateJwkThumbprintUri: typeof import("jose").calculateJwkThumbprintUri;
+    EmbeddedJWK: typeof import("jose").EmbeddedJWK;
+    createLocalJWKSet: typeof import("jose").createLocalJWKSet;
+    createRemoteJWKSet: typeof import("jose").createRemoteJWKSet;
+    jwksCache: typeof import("jose").jwksCache;
+    customFetch: typeof import("jose").customFetch;
+    UnsecuredJWT: typeof import("jose").UnsecuredJWT;
+    exportPKCS8: typeof import("jose").exportPKCS8;
+    exportSPKI: typeof import("jose").exportSPKI;
+    exportJWK: typeof import("jose").exportJWK;
+    importSPKI: typeof import("jose").importSPKI;
+    importPKCS8: typeof import("jose").importPKCS8;
+    importX509: typeof import("jose").importX509;
+    importJWK: typeof import("jose").importJWK;
+    decodeProtectedHeader: typeof import("jose").decodeProtectedHeader;
+    decodeJwt: typeof import("jose").decodeJwt;
+    errors: typeof import("jose/dist/types/util/errors");
+    generateKeyPair: typeof import("jose").generateKeyPair;
+    generateSecret: typeof import("jose").generateSecret;
+    base64url: typeof import("jose/dist/types/util/base64url");
+    cryptoRuntime: "WebCryptoAPI";
+}>;

package/components/identity.tokens/operations/lib/jose.js

@@ -0,0 +1,27 @@
+'use strict';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+const load = async () => await Promise.resolve().then(() => __importStar(require('jose')));
+exports.load = load;
+//# sourceMappingURL=jose.js.map

package/components/identity.tokens/operations/lib/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../../source/lib/jose.js"],"names":[],"mappings":"AAAA,YAAY,CAAA;;;;;;;;;;;;;;;;;;;;;;;;AAEZ,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC,wDAAa,MAAM,GAAC,CAAA;AAE7C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA"}

package/components/identity.tokens/operations/lib/key.d.ts

@@ -0,0 +1 @@
+export declare function jweKey(value: string): Uint8Array;

package/components/identity.tokens/operations/lib/key.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jweKey = void 0;
+function jweKey(value) {
+    const key = Buffer.from(value, 'base64url');
+    if (key.length !== 32 || key.toString('base64url') !== value)
+        throw new TypeError('JWE key must be a base64url-encoded 256-bit secret');
+    return new Uint8Array(key);
+}
+exports.jweKey = jweKey;
+//# sourceMappingURL=key.js.map

package/components/identity.tokens/operations/lib/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../source/lib/key.ts"],"names":[],"mappings":";;;AAAA,SAAgB,MAAM,CAAE,KAAa;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAE3C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAC1D,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAA;IAE3E,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;AAC5B,CAAC;AAPD,wBAOC"}

package/components/identity.tokens/operations/lib/types.d.ts

@@ -20,7 +20,7 @@ export interface Context {
     logs: telemetry.Logs;
 }
 export interface Configuration {
-    readonly keys: Record<string, string>;
+    readonly keys: ConfiguredKey[];
     readonly lifetime: number;
     readonly refresh: number;
     readonly cache: {
@@ -28,6 +28,9 @@ export interface Configuration {
         ttl: number;
     };
 }
+export interface ConfiguredKey extends Pick<Key, 'id' | 'key'> {
+    format?: 'jwe' | 'paseto';
+}
 export interface Entity {
     revokedAt?: number;
 }
@@ -65,6 +68,12 @@ export interface Claims {
     iat: string;
     exp?: string;
 }
+export interface JWEClaims {
+    identity: Identity;
+    iss: string;
+    iat: number;
+    exp?: number;
+}
 export interface Key {
     id: string;
     key: string;