@udibo/oauth2 0.17.0 → 0.17.1

package/dist/server/signing-keys.d.ts

@@ -117,8 +117,9 @@ export declare function exportSigningKeyJwk(key: SigningKey): Promise<JsonWebKey
 }>;
 /**
  * Import a signing key previously exported with {@link exportSigningKeyJwk}.
- * A JWK without a `kid` is given a random one, so every instance importing it
- * would publish and stamp a different `kid` — persist the exported `kid`.
+ * A JWK that sets a `kid` keeps it. One without a `kid` gets its RFC 7638 JWK
+ * thumbprint (base64url SHA-256 of the public key), so every instance
+ * importing the same key publishes and stamps the same `kid`.
  */
 export declare function importSigningKeyJwk(jwk: JsonWebKey & {
     kid?: string;

package/dist/server/signing-keys.js

@@ -13,6 +13,7 @@
  */
 import { base64urlDecode, base64urlEncode } from "../utils/crypto.js";
 import { snapshotAuthenticationContext } from "../utils/authentication-context.js";
+import { jwkThumbprint } from "../utils/_jwk-thumbprint.js";
 /** A {@link SigningKeyProvider} over one fixed key. */
 export class StaticSigningKeyProvider {
     #key;
@@ -130,12 +131,13 @@ export async function exportSigningKeyJwk(key) {
 }
 /**
  * Import a signing key previously exported with {@link exportSigningKeyJwk}.
- * A JWK without a `kid` is given a random one, so every instance importing it
- * would publish and stamp a different `kid` — persist the exported `kid`.
+ * A JWK that sets a `kid` keeps it. One without a `kid` gets its RFC 7638 JWK
+ * thumbprint (base64url SHA-256 of the public key), so every instance
+ * importing the same key publishes and stamps the same `kid`.
  */
 export async function importSigningKeyJwk(jwk) {
     const privateKey = await crypto.subtle.importKey("jwk", jwk, ES256_PARAMS, true, ["sign"]);
-    const kid = jwk.kid ?? crypto.randomUUID();
+    const kid = jwk.kid ?? (await jwkThumbprint(jwk));
     return {
         kid,
         alg: "ES256",

package/dist/utils/_jwk-thumbprint.d.ts

@@ -0,0 +1,12 @@
+/**
+ * RFC 7638 JWK thumbprints.
+ *
+ * @module
+ */
+/**
+ * The RFC 7638 SHA-256 thumbprint of a JWK, base64url-encoded. Only the key
+ * type's required public members are hashed, so a private JWK and its public
+ * half share a thumbprint. Rejects with a `TypeError` for a key type other
+ * than `EC`, `OKP` or `RSA`, or when a required member is missing.
+ */
+export declare function jwkThumbprint(jwk: JsonWebKey): Promise<string>;

package/dist/utils/_jwk-thumbprint.js

@@ -0,0 +1,34 @@
+/**
+ * RFC 7638 JWK thumbprints.
+ *
+ * @module
+ */
+import { encodeBase64Url } from "./_encoding.js";
+const REQUIRED_MEMBERS = {
+    EC: ["crv", "kty", "x", "y"],
+    OKP: ["crv", "kty", "x"],
+    RSA: ["e", "kty", "n"],
+};
+/**
+ * The RFC 7638 SHA-256 thumbprint of a JWK, base64url-encoded. Only the key
+ * type's required public members are hashed, so a private JWK and its public
+ * half share a thumbprint. Rejects with a `TypeError` for a key type other
+ * than `EC`, `OKP` or `RSA`, or when a required member is missing.
+ */
+export async function jwkThumbprint(jwk) {
+    const members = jwk.kty === undefined ? undefined : REQUIRED_MEMBERS[jwk.kty];
+    if (!members) {
+        throw new TypeError(`Cannot compute a JWK thumbprint for key type ${JSON.stringify(jwk.kty)}`);
+    }
+    const fields = jwk;
+    const canonical = {};
+    for (const member of members) {
+        const value = fields[member];
+        if (typeof value !== "string") {
+            throw new TypeError(`Cannot compute a JWK thumbprint without the "${member}" member`);
+        }
+        canonical[member] = value;
+    }
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(canonical)));
+    return encodeBase64Url(new Uint8Array(digest));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",