@versini/auth-common 2.1.0 → 2.2.0

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import * as jose from 'jose';
+
 declare const AUTH_TYPES: {
     ID_TOKEN: string;
 };
@@ -9,5 +11,7 @@ declare const JWT: {
     USER_ID_KEY: string;
     ISSUER: string;
 };
+declare const JWT_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsF6i3Jd9fY/3COqCw/m7\nw5PKyTYLGAI2I6SIIdpe6i6DOCbEkmDz7LdVsBqwNtVi8gvWYIj+8ol6rU3qu1v5\ni1Jd45GSK4kzkVdgCmQZbM5ak0KI99q5wsrAIzUd+LRJ2HRvWtr5IYdsIiXaQjle\naMwPFOIcJH+rKfFgNcHLcaS5syp7zU1ANwZ+trgR+DifBr8TLVkBynmNeTyhDm2+\nl0haqjMk0UoNPPE8iYBWUHQJJE1Dqstj65d6Eh5g64Pao25y4cmYJbKjiblIGEkE\nsjqybA9mARAqh9k/eiIopecWSiffNQTwVQVd2I9ZH3BalhEXHlqFgrjz51kFqg81\nawIDAQAB\n-----END PUBLIC KEY-----";
+declare const verifyAndExtractToken: (token: string, audience: string) => Promise<jose.JWTVerifyResult<jose.JWTPayload> | undefined>;
 
-export { AUTH_TYPES, HEADERS, JWT };
+export { AUTH_TYPES, HEADERS, JWT, JWT_PUBLIC_KEY, verifyAndExtractToken };

package/dist/index.js

@@ -1,27 +1,621 @@
 /*!
-  @versini/auth-common v2.1.0
+  @versini/auth-common v2.2.0
   © 2024 gizmette.com
 */
 try {
   window.__VERSINI_AUTH_COMMON__ || (window.__VERSINI_AUTH_COMMON__ = {
-    version: "2.1.0",
-    buildTime: "06/21/2024 03:31 AM EDT",
+    version: "2.2.0",
+    buildTime: "06/24/2024 05:23 PM EDT",
     homepage: "https://github.com/aversini/auth-client",
     license: "MIT"
   });
 } catch {
 }
-const t = {
+const P = crypto, D = (e) => e instanceof CryptoKey, b = new TextEncoder(), g = new TextDecoder();
+function V(...e) {
+  const t = e.reduce((a, { length: i }) => a + i, 0), n = new Uint8Array(t);
+  let r = 0;
+  for (const a of e)
+    n.set(a, r), r += a.length;
+  return n;
+}
+const F = (e) => {
+  const t = atob(e), n = new Uint8Array(t.length);
+  for (let r = 0; r < t.length; r++)
+    n[r] = t.charCodeAt(r);
+  return n;
+}, R = (e) => {
+  let t = e;
+  t instanceof Uint8Array && (t = g.decode(t)), t = t.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, "");
+  try {
+    return F(t);
+  } catch {
+    throw new TypeError("The input to be decoded is not correctly encoded.");
+  }
+};
+class E extends Error {
+  static get code() {
+    return "ERR_JOSE_GENERIC";
+  }
+  constructor(t) {
+    var n;
+    super(t), this.code = "ERR_JOSE_GENERIC", this.name = this.constructor.name, (n = Error.captureStackTrace) == null || n.call(Error, this, this.constructor);
+  }
+}
+class h extends E {
+  static get code() {
+    return "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  }
+  constructor(t, n, r = "unspecified", a = "unspecified") {
+    super(t), this.code = "ERR_JWT_CLAIM_VALIDATION_FAILED", this.claim = r, this.reason = a, this.payload = n;
+  }
+}
+class O extends E {
+  static get code() {
+    return "ERR_JWT_EXPIRED";
+  }
+  constructor(t, n, r = "unspecified", a = "unspecified") {
+    super(t), this.code = "ERR_JWT_EXPIRED", this.claim = r, this.reason = a, this.payload = n;
+  }
+}
+class G extends E {
+  constructor() {
+    super(...arguments), this.code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  }
+  static get code() {
+    return "ERR_JOSE_ALG_NOT_ALLOWED";
+  }
+}
+class I extends E {
+  constructor() {
+    super(...arguments), this.code = "ERR_JOSE_NOT_SUPPORTED";
+  }
+  static get code() {
+    return "ERR_JOSE_NOT_SUPPORTED";
+  }
+}
+class d extends E {
+  constructor() {
+    super(...arguments), this.code = "ERR_JWS_INVALID";
+  }
+  static get code() {
+    return "ERR_JWS_INVALID";
+  }
+}
+class L extends E {
+  constructor() {
+    super(...arguments), this.code = "ERR_JWT_INVALID";
+  }
+  static get code() {
+    return "ERR_JWT_INVALID";
+  }
+}
+class q extends E {
+  constructor() {
+    super(...arguments), this.code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED", this.message = "signature verification failed";
+  }
+  static get code() {
+    return "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  }
+}
+function p(e, t = "algorithm.name") {
+  return new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);
+}
+function A(e, t) {
+  return e.name === t;
+}
+function T(e) {
+  return parseInt(e.name.slice(4), 10);
+}
+function Y(e) {
+  switch (e) {
+    case "ES256":
+      return "P-256";
+    case "ES384":
+      return "P-384";
+    case "ES512":
+      return "P-521";
+    default:
+      throw new Error("unreachable");
+  }
+}
+function z(e, t) {
+  if (t.length && !t.some((n) => e.usages.includes(n))) {
+    let n = "CryptoKey does not support this operation, its usages must include ";
+    if (t.length > 2) {
+      const r = t.pop();
+      n += `one of ${t.join(", ")}, or ${r}.`;
+    } else
+      t.length === 2 ? n += `one of ${t[0]} or ${t[1]}.` : n += `${t[0]}.`;
+    throw new TypeError(n);
+  }
+}
+function Q(e, t, ...n) {
+  switch (t) {
+    case "HS256":
+    case "HS384":
+    case "HS512": {
+      if (!A(e.algorithm, "HMAC"))
+        throw p("HMAC");
+      const r = parseInt(t.slice(2), 10);
+      if (T(e.algorithm.hash) !== r)
+        throw p(`SHA-${r}`, "algorithm.hash");
+      break;
+    }
+    case "RS256":
+    case "RS384":
+    case "RS512": {
+      if (!A(e.algorithm, "RSASSA-PKCS1-v1_5"))
+        throw p("RSASSA-PKCS1-v1_5");
+      const r = parseInt(t.slice(2), 10);
+      if (T(e.algorithm.hash) !== r)
+        throw p(`SHA-${r}`, "algorithm.hash");
+      break;
+    }
+    case "PS256":
+    case "PS384":
+    case "PS512": {
+      if (!A(e.algorithm, "RSA-PSS"))
+        throw p("RSA-PSS");
+      const r = parseInt(t.slice(2), 10);
+      if (T(e.algorithm.hash) !== r)
+        throw p(`SHA-${r}`, "algorithm.hash");
+      break;
+    }
+    case "EdDSA": {
+      if (e.algorithm.name !== "Ed25519" && e.algorithm.name !== "Ed448")
+        throw p("Ed25519 or Ed448");
+      break;
+    }
+    case "ES256":
+    case "ES384":
+    case "ES512": {
+      if (!A(e.algorithm, "ECDSA"))
+        throw p("ECDSA");
+      const r = Y(t);
+      if (e.algorithm.namedCurve !== r)
+        throw p(r, "algorithm.namedCurve");
+      break;
+    }
+    default:
+      throw new TypeError("CryptoKey does not support this operation");
+  }
+  z(e, n);
+}
+function U(e, t, ...n) {
+  var r;
+  if (n.length > 2) {
+    const a = n.pop();
+    e += `one of type ${n.join(", ")}, or ${a}.`;
+  } else
+    n.length === 2 ? e += `one of type ${n[0]} or ${n[1]}.` : e += `of type ${n[0]}.`;
+  return t == null ? e += ` Received ${t}` : typeof t == "function" && t.name ? e += ` Received function ${t.name}` : typeof t == "object" && t != null && (r = t.constructor) != null && r.name && (e += ` Received an instance of ${t.constructor.name}`), e;
+}
+const J = (e, ...t) => U("Key must be ", e, ...t);
+function $(e, t, ...n) {
+  return U(`Key for the ${e} algorithm must be `, t, ...n);
+}
+const k = (e) => D(e), S = ["CryptoKey"], X = (...e) => {
+  const t = e.filter(Boolean);
+  if (t.length === 0 || t.length === 1)
+    return !0;
+  let n;
+  for (const r of t) {
+    const a = Object.keys(r);
+    if (!n || n.size === 0) {
+      n = new Set(a);
+      continue;
+    }
+    for (const i of a) {
+      if (n.has(i))
+        return !1;
+      n.add(i);
+    }
+  }
+  return !0;
+};
+function j(e) {
+  return typeof e == "object" && e !== null;
+}
+function C(e) {
+  if (!j(e) || Object.prototype.toString.call(e) !== "[object Object]")
+    return !1;
+  if (Object.getPrototypeOf(e) === null)
+    return !0;
+  let t = e;
+  for (; Object.getPrototypeOf(t) !== null; )
+    t = Object.getPrototypeOf(t);
+  return Object.getPrototypeOf(e) === t;
+}
+const Z = (e, t) => {
+  if (e.startsWith("RS") || e.startsWith("PS")) {
+    const { modulusLength: n } = t.algorithm;
+    if (typeof n != "number" || n < 2048)
+      throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`);
+  }
+}, y = (e, t, n = 0) => {
+  n === 0 && (t.unshift(t.length), t.unshift(6));
+  const r = e.indexOf(t[0], n);
+  if (r === -1)
+    return !1;
+  const a = e.subarray(r, r + t.length);
+  return a.length !== t.length ? !1 : a.every((i, o) => i === t[o]) || y(e, t, r + 1);
+}, W = (e) => {
+  switch (!0) {
+    case y(e, [42, 134, 72, 206, 61, 3, 1, 7]):
+      return "P-256";
+    case y(e, [43, 129, 4, 0, 34]):
+      return "P-384";
+    case y(e, [43, 129, 4, 0, 35]):
+      return "P-521";
+    case y(e, [43, 101, 110]):
+      return "X25519";
+    case y(e, [43, 101, 111]):
+      return "X448";
+    case y(e, [43, 101, 112]):
+      return "Ed25519";
+    case y(e, [43, 101, 113]):
+      return "Ed448";
+    default:
+      throw new I("Invalid or unsupported EC Key Curve or OKP Key Sub Type");
+  }
+}, ee = async (e, t, n, r, a) => {
+  let i, o;
+  const c = new Uint8Array(atob(n.replace(e, "")).split("").map((s) => s.charCodeAt(0)));
+  switch (r) {
+    case "PS256":
+    case "PS384":
+    case "PS512":
+      i = { name: "RSA-PSS", hash: `SHA-${r.slice(-3)}` }, o = ["verify"];
+      break;
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      i = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${r.slice(-3)}` }, o = ["verify"];
+      break;
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512":
+      i = {
+        name: "RSA-OAEP",
+        hash: `SHA-${parseInt(r.slice(-3), 10) || 1}`
+      }, o = ["encrypt", "wrapKey"];
+      break;
+    case "ES256":
+      i = { name: "ECDSA", namedCurve: "P-256" }, o = ["verify"];
+      break;
+    case "ES384":
+      i = { name: "ECDSA", namedCurve: "P-384" }, o = ["verify"];
+      break;
+    case "ES512":
+      i = { name: "ECDSA", namedCurve: "P-521" }, o = ["verify"];
+      break;
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      const s = W(c);
+      i = s.startsWith("P-") ? { name: "ECDH", namedCurve: s } : { name: s }, o = [];
+      break;
+    }
+    case "EdDSA":
+      i = { name: W(c) }, o = ["verify"];
+      break;
+    default:
+      throw new I('Invalid or unsupported "alg" (Algorithm) value');
+  }
+  return P.subtle.importKey(t, c, i, !1, o);
+}, te = (e, t, n) => ee(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", e, t);
+async function re(e, t, n) {
+  if (e.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
+    throw new TypeError('"spki" must be SPKI formatted string');
+  return te(e, t);
+}
+const ne = (e, t) => {
+  if (!(t instanceof Uint8Array)) {
+    if (!k(t))
+      throw new TypeError($(e, t, ...S, "Uint8Array"));
+    if (t.type !== "secret")
+      throw new TypeError(`${S.join(" or ")} instances for symmetric algorithms must be of type "secret"`);
+  }
+}, ae = (e, t, n) => {
+  if (!k(t))
+    throw new TypeError($(e, t, ...S));
+  if (t.type === "secret")
+    throw new TypeError(`${S.join(" or ")} instances for asymmetric algorithms must not be of type "secret"`);
+  if (t.algorithm && n === "verify" && t.type === "private")
+    throw new TypeError(`${S.join(" or ")} instances for asymmetric algorithm verifying must be of type "public"`);
+  if (t.algorithm && n === "encrypt" && t.type === "private")
+    throw new TypeError(`${S.join(" or ")} instances for asymmetric algorithm encryption must be of type "public"`);
+}, oe = (e, t, n) => {
+  e.startsWith("HS") || e === "dir" || e.startsWith("PBES2") || /^A\d{3}(?:GCM)?KW$/.test(e) ? ne(e, t) : ae(e, t, n);
+};
+function ie(e, t, n, r, a) {
+  if (a.crit !== void 0 && (r == null ? void 0 : r.crit) === void 0)
+    throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!r || r.crit === void 0)
+    return /* @__PURE__ */ new Set();
+  if (!Array.isArray(r.crit) || r.crit.length === 0 || r.crit.some((o) => typeof o != "string" || o.length === 0))
+    throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  let i;
+  n !== void 0 ? i = new Map([...Object.entries(n), ...t.entries()]) : i = t;
+  for (const o of r.crit) {
+    if (!i.has(o))
+      throw new I(`Extension Header Parameter "${o}" is not recognized`);
+    if (a[o] === void 0)
+      throw new e(`Extension Header Parameter "${o}" is missing`);
+    if (i.get(o) && r[o] === void 0)
+      throw new e(`Extension Header Parameter "${o}" MUST be integrity protected`);
+  }
+  return new Set(r.crit);
+}
+const ce = (e, t) => {
+  if (t !== void 0 && (!Array.isArray(t) || t.some((n) => typeof n != "string")))
+    throw new TypeError(`"${e}" option must be an array of strings`);
+  if (t)
+    return new Set(t);
+};
+function se(e, t) {
+  const n = `SHA-${e.slice(-3)}`;
+  switch (e) {
+    case "HS256":
+    case "HS384":
+    case "HS512":
+      return { hash: n, name: "HMAC" };
+    case "PS256":
+    case "PS384":
+    case "PS512":
+      return { hash: n, name: "RSA-PSS", saltLength: e.slice(-3) >> 3 };
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      return { hash: n, name: "RSASSA-PKCS1-v1_5" };
+    case "ES256":
+    case "ES384":
+    case "ES512":
+      return { hash: n, name: "ECDSA", namedCurve: t.namedCurve };
+    case "EdDSA":
+      return { name: t.name };
+    default:
+      throw new I(`alg ${e} is not supported either by JOSE or your javascript runtime`);
+  }
+}
+function de(e, t, n) {
+  if (D(t))
+    return Q(t, e, n), t;
+  if (t instanceof Uint8Array) {
+    if (!e.startsWith("HS"))
+      throw new TypeError(J(t, ...S));
+    return P.subtle.importKey("raw", t, { hash: `SHA-${e.slice(-3)}`, name: "HMAC" }, !1, [n]);
+  }
+  throw new TypeError(J(t, ...S, "Uint8Array"));
+}
+const ue = async (e, t, n, r) => {
+  const a = await de(e, t, "verify");
+  Z(e, a);
+  const i = se(e, a.algorithm);
+  try {
+    return await P.subtle.verify(i, a, n, r);
+  } catch {
+    return !1;
+  }
+};
+async function fe(e, t, n) {
+  if (!C(e))
+    throw new d("Flattened JWS must be an object");
+  if (e.protected === void 0 && e.header === void 0)
+    throw new d('Flattened JWS must have either of the "protected" or "header" members');
+  if (e.protected !== void 0 && typeof e.protected != "string")
+    throw new d("JWS Protected Header incorrect type");
+  if (e.payload === void 0)
+    throw new d("JWS Payload missing");
+  if (typeof e.signature != "string")
+    throw new d("JWS Signature missing or incorrect type");
+  if (e.header !== void 0 && !C(e.header))
+    throw new d("JWS Unprotected Header incorrect type");
+  let r = {};
+  if (e.protected)
+    try {
+      const _ = R(e.protected);
+      r = JSON.parse(g.decode(_));
+    } catch {
+      throw new d("JWS Protected Header is invalid");
+    }
+  if (!X(r, e.header))
+    throw new d("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const a = {
+    ...r,
+    ...e.header
+  }, i = ie(d, /* @__PURE__ */ new Map([["b64", !0]]), n == null ? void 0 : n.crit, r, a);
+  let o = !0;
+  if (i.has("b64") && (o = r.b64, typeof o != "boolean"))
+    throw new d('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+  const { alg: c } = a;
+  if (typeof c != "string" || !c)
+    throw new d('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  const s = n && ce("algorithms", n.algorithms);
+  if (s && !s.has(c))
+    throw new G('"alg" (Algorithm) Header Parameter value not allowed');
+  if (o) {
+    if (typeof e.payload != "string")
+      throw new d("JWS Payload must be a string");
+  } else if (typeof e.payload != "string" && !(e.payload instanceof Uint8Array))
+    throw new d("JWS Payload must be a string or an Uint8Array instance");
+  let l = !1;
+  typeof t == "function" && (t = await t(r, e), l = !0), oe(c, t, "verify");
+  const w = V(b.encode(e.protected ?? ""), b.encode("."), typeof e.payload == "string" ? b.encode(e.payload) : e.payload);
+  let f;
+  try {
+    f = R(e.signature);
+  } catch {
+    throw new d("Failed to base64url decode the signature");
+  }
+  if (!await ue(c, t, f, w))
+    throw new q();
+  let m;
+  if (o)
+    try {
+      m = R(e.payload);
+    } catch {
+      throw new d("Failed to base64url decode the payload");
+    }
+  else
+    typeof e.payload == "string" ? m = b.encode(e.payload) : m = e.payload;
+  const u = { payload: m };
+  return e.protected !== void 0 && (u.protectedHeader = r), e.header !== void 0 && (u.unprotectedHeader = e.header), l ? { ...u, key: t } : u;
+}
+async function he(e, t, n) {
+  if (e instanceof Uint8Array && (e = g.decode(e)), typeof e != "string")
+    throw new d("Compact JWS must be a string or Uint8Array");
+  const { 0: r, 1: a, 2: i, length: o } = e.split(".");
+  if (o !== 3)
+    throw new d("Invalid Compact JWS");
+  const c = await fe({ payload: a, protected: r, signature: i }, t, n), s = { payload: c.payload, protectedHeader: c.protectedHeader };
+  return typeof t == "function" ? { ...s, key: c.key } : s;
+}
+const le = (e) => Math.floor(e.getTime() / 1e3), M = 60, B = M * 60, v = B * 24, pe = v * 7, me = v * 365.25, ye = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, K = (e) => {
+  const t = ye.exec(e);
+  if (!t || t[4] && t[1])
+    throw new TypeError("Invalid time period format");
+  const n = parseFloat(t[2]), r = t[3].toLowerCase();
+  let a;
+  switch (r) {
+    case "sec":
+    case "secs":
+    case "second":
+    case "seconds":
+    case "s":
+      a = Math.round(n);
+      break;
+    case "minute":
+    case "minutes":
+    case "min":
+    case "mins":
+    case "m":
+      a = Math.round(n * M);
+      break;
+    case "hour":
+    case "hours":
+    case "hr":
+    case "hrs":
+    case "h":
+      a = Math.round(n * B);
+      break;
+    case "day":
+    case "days":
+    case "d":
+      a = Math.round(n * v);
+      break;
+    case "week":
+    case "weeks":
+    case "w":
+      a = Math.round(n * pe);
+      break;
+    default:
+      a = Math.round(n * me);
+      break;
+  }
+  return t[1] === "-" || t[4] === "ago" ? -a : a;
+}, H = (e) => e.toLowerCase().replace(/^application\//, ""), Se = (e, t) => typeof e == "string" ? t.includes(e) : Array.isArray(e) ? t.some(Set.prototype.has.bind(new Set(e))) : !1, we = (e, t, n = {}) => {
+  let r;
+  try {
+    r = JSON.parse(g.decode(t));
+  } catch {
+  }
+  if (!C(r))
+    throw new L("JWT Claims Set must be a top-level JSON object");
+  const { typ: a } = n;
+  if (a && (typeof e.typ != "string" || H(e.typ) !== H(a)))
+    throw new h('unexpected "typ" JWT header value', r, "typ", "check_failed");
+  const { requiredClaims: i = [], issuer: o, subject: c, audience: s, maxTokenAge: l } = n, w = [...i];
+  l !== void 0 && w.push("iat"), s !== void 0 && w.push("aud"), c !== void 0 && w.push("sub"), o !== void 0 && w.push("iss");
+  for (const u of new Set(w.reverse()))
+    if (!(u in r))
+      throw new h(`missing required "${u}" claim`, r, u, "missing");
+  if (o && !(Array.isArray(o) ? o : [o]).includes(r.iss))
+    throw new h('unexpected "iss" claim value', r, "iss", "check_failed");
+  if (c && r.sub !== c)
+    throw new h('unexpected "sub" claim value', r, "sub", "check_failed");
+  if (s && !Se(r.aud, typeof s == "string" ? [s] : s))
+    throw new h('unexpected "aud" claim value', r, "aud", "check_failed");
+  let f;
+  switch (typeof n.clockTolerance) {
+    case "string":
+      f = K(n.clockTolerance);
+      break;
+    case "number":
+      f = n.clockTolerance;
+      break;
+    case "undefined":
+      f = 0;
+      break;
+    default:
+      throw new TypeError("Invalid clockTolerance option type");
+  }
+  const { currentDate: x } = n, m = le(x || /* @__PURE__ */ new Date());
+  if ((r.iat !== void 0 || l) && typeof r.iat != "number")
+    throw new h('"iat" claim must be a number', r, "iat", "invalid");
+  if (r.nbf !== void 0) {
+    if (typeof r.nbf != "number")
+      throw new h('"nbf" claim must be a number', r, "nbf", "invalid");
+    if (r.nbf > m + f)
+      throw new h('"nbf" claim timestamp check failed', r, "nbf", "check_failed");
+  }
+  if (r.exp !== void 0) {
+    if (typeof r.exp != "number")
+      throw new h('"exp" claim must be a number', r, "exp", "invalid");
+    if (r.exp <= m - f)
+      throw new O('"exp" claim timestamp check failed', r, "exp", "check_failed");
+  }
+  if (l) {
+    const u = m - r.iat, _ = typeof l == "number" ? l : K(l);
+    if (u - f > _)
+      throw new O('"iat" claim timestamp check failed (too far in the past)', r, "iat", "check_failed");
+    if (u < 0 - f)
+      throw new h('"iat" claim timestamp check failed (it should be in the past)', r, "iat", "check_failed");
+  }
+  return r;
+};
+async function Ee(e, t, n) {
+  var o;
+  const r = await he(e, t, n);
+  if ((o = r.protectedHeader.crit) != null && o.includes("b64") && r.protectedHeader.b64 === !1)
+    throw new L("JWTs MUST NOT use unencoded payload");
+  const i = { payload: we(r.protectedHeader, r.payload, n), protectedHeader: r.protectedHeader };
+  return typeof t == "function" ? { ...i, key: r.key } : i;
+}
+const Ae = {
   ID_TOKEN: "id_token"
-}, i = {
+}, ge = {
   CLIENT_ID: "X-Auth-ClientId"
-}, e = {
+}, N = {
   ALG: "RS256",
   USER_ID_KEY: "_id",
   ISSUER: "gizmette.com"
+}, be = `-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsF6i3Jd9fY/3COqCw/m7
+w5PKyTYLGAI2I6SIIdpe6i6DOCbEkmDz7LdVsBqwNtVi8gvWYIj+8ol6rU3qu1v5
+i1Jd45GSK4kzkVdgCmQZbM5ak0KI99q5wsrAIzUd+LRJ2HRvWtr5IYdsIiXaQjle
+aMwPFOIcJH+rKfFgNcHLcaS5syp7zU1ANwZ+trgR+DifBr8TLVkBynmNeTyhDm2+
+l0haqjMk0UoNPPE8iYBWUHQJJE1Dqstj65d6Eh5g64Pao25y4cmYJbKjiblIGEkE
+sjqybA9mARAqh9k/eiIopecWSiffNQTwVQVd2I9ZH3BalhEXHlqFgrjz51kFqg81
+awIDAQAB
+-----END PUBLIC KEY-----`, Ie = async (e, t) => {
+  try {
+    const n = N.ALG, a = await re(be, n);
+    return await Ee(e, a, {
+      issuer: N.ISSUER,
+      audience: t
+    });
+  } catch {
+    return;
+  }
 };
 export {
-  t as AUTH_TYPES,
-  i as HEADERS,
-  e as JWT
+  Ae as AUTH_TYPES,
+  ge as HEADERS,
+  N as JWT,
+  be as JWT_PUBLIC_KEY,
+  Ie as verifyAndExtractToken
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@versini/auth-common",
-	"version": "2.1.0",
+	"version": "2.2.0",
 	"license": "MIT",
 	"author": "Arno Versini",
 	"publishConfig": {
@@ -29,5 +29,8 @@
 		"lint": "biome lint src",
 		"start": "static-server dist --port 5173"
 	},
-	"gitHead": "a1350152d2ad705b4802d2db41fad60f03cae329"
+	"dependencies": {
+		"jose": "5.4.1"
+	},
+	"gitHead": "8ba8747f5ea5473bf63a348fef316ccff144f272"
 }