fhirstarterjs 1.0.6 → 1.0.7

package/README.md

@@ -81,9 +81,23 @@ const res = await fetch(url, {
 | `tokenResponse()` | `LiveTokenResponse` | Getter-backed token response for `fhirclient` |
 | `onRefresh(callback)` | `() => void` | Subscribe to token updates — returns unsubscribe |
 | `getJwks()` | `Promise<JwkSet>` | Public JWKS derived from the private key |
+| `fhirStarter.thumbprint(privateKey)` | `string` | RFC 7638 JWK Thumbprint (base64url SHA-256) |
 
 `getJwks()` strips private key material — host the output JSON at your registered JWKS URL and pass that URL as `jwksUrl` so the JWT `jku` header is set automatically.
 
+## Thumbprint
+
+Derive a deterministic `kid` from a private key without instantiating the class:
+
+```ts
+import fhirStarter from "fhirstarterjs"
+
+const kid = fhirStarter.thumbprint("./privatekey.pem")
+console.log(kid) // base64url SHA-256 of the canonical RSA public JWK
+```
+
+This implements RFC 7638 — the SHA-256 of the sorted canonical JWK members `{e, kty, n}`, base64url-encoded. Use it as the `keyId` when registering your JWKS.
+
 ## JWKS
 
 Some SMART Backend Services registrations require a public JWKS URL when using `jku`. Generate it from the same private key you use for auth:

package/dist/fhirstarter.js

@@ -1,5 +1,5 @@
 import { importPKCS8, exportJWK, SignJWT, } from "jose";
-import { randomUUID } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 /**
  * SMART Backend Services auth provider.
@@ -298,4 +298,19 @@ export default class fhirStarter {
             throw new Error(`AuthConfig: privateKey must be PEM text, a Buffer, or a readable file path: ${trimmed}`);
         }
     }
+    /**
+     * Derives a deterministic key identifier from a private key using an
+     * RFC 7638 JWK Thumbprint (SHA-256 of canonical RSA public JWK members, base64url).
+     *
+     * @param privateKey - RSA PKCS#8 PEM text, a Buffer, or a readable file path.
+     * @returns A base64url-encoded SHA-256 thumbprint string.
+     * @throws If the key is not RSA or cannot be parsed.
+     */
+    static thumbprint(privateKey) {
+        const pem = fhirStarter.resolvePrivateKey(privateKey), key = createPrivateKey(pem);
+        if (key.asymmetricKeyType !== "rsa")
+            throw new Error(`thumbprint: expected RSA key, got ${key.asymmetricKeyType}`);
+        const pub = createPublicKey(key).export({ format: "jwk" }), canonical = JSON.stringify({ e: pub.e, kty: "RSA", n: pub.n });
+        return createHash("sha256").update(canonical).digest("base64url");
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
    "name": "fhirstarterjs",
-   "version": "1.0.6",
+   "version": "1.0.7",
    "description": "SMART Backend Services auth lifecycle for any FHIR client",
    "author": "Joshua Faulkenberry <j@joshuafaulkenberry.com> (https://joshuafaulkenberry.com/)",
    "license": "Kopimi",

package/ts/fhirstarter.ts

@@ -4,7 +4,7 @@ import {
    SignJWT,
    type JWTHeaderParameters,
 } from "jose";
-import { randomUUID } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 
 /**
@@ -348,4 +348,24 @@ export default class fhirStarter implements Provider {
          );
       }
    }
+
+   /**
+    * Derives a deterministic key identifier from a private key using an
+    * RFC 7638 JWK Thumbprint (SHA-256 of canonical RSA public JWK members, base64url).
+    *
+    * @param privateKey - RSA PKCS#8 PEM text, a Buffer, or a readable file path.
+    * @returns A base64url-encoded SHA-256 thumbprint string.
+    * @throws If the key is not RSA or cannot be parsed.
+    */
+   static thumbprint(privateKey: string | Buffer): string {
+      const
+         pem = fhirStarter.resolvePrivateKey(privateKey),
+         key = createPrivateKey(pem)
+      if (key.asymmetricKeyType !== "rsa")
+         throw new Error(`thumbprint: expected RSA key, got ${key.asymmetricKeyType}`)
+      const
+         pub = createPublicKey(key).export({ format: "jwk" }) as { e?: string, n?: string, kty?: string },
+         canonical = JSON.stringify({ e: pub.e, kty: "RSA", n: pub.n })
+      return createHash("sha256").update(canonical).digest("base64url")
+   }
 }