gdc-common-utils-ts 2.5.15 → 2.5.16

package/dist/CryptographyService.js

@@ -242,9 +242,24 @@ export class CryptographyService {
             throw new Error("Invalid Detached JWS format");
         const protectedHeaderB64Url = parts[0];
         const signatureB64Url = parts[1];
-        const payloadB64Url = Content.bytesToRawBase64UrlSafe(payloadBytes);
-        const signingInput = `${protectedHeaderB64Url}.${payloadB64Url}`;
-        const signingInputBytes = Content.stringToBytesUTF8(signingInput);
+        const protectedHeader = Content.base64UrlSafeToJSON(protectedHeaderB64Url);
+        if (protectedHeader.b64 !== undefined && typeof protectedHeader.b64 !== 'boolean') {
+            throw new Error("Detached JWS protected header 'b64' must be boolean.");
+        }
+        if (protectedHeader.b64 === false
+            && (!Array.isArray(protectedHeader.crit) || !protectedHeader.crit.includes('b64'))) {
+            throw new Error("RFC 7797 detached JWS with 'b64=false' must mark 'b64' critical.");
+        }
+        let signingInputBytes;
+        if (protectedHeader.b64 === false) {
+            const prefix = Content.stringToBytesUTF8(`${protectedHeaderB64Url}.`);
+            signingInputBytes = new Uint8Array(prefix.length + payloadBytes.length);
+            signingInputBytes.set(prefix);
+            signingInputBytes.set(payloadBytes, prefix.length);
+        }
+        else {
+            signingInputBytes = Content.stringToBytesUTF8(`${protectedHeaderB64Url}.${Content.bytesToRawBase64UrlSafe(payloadBytes)}`);
+        }
         const signatureBytes = Content.base64ToBytes(signatureB64Url);
         return this.verifyBytes(signatureBytes, signingInputBytes, publicJWKey);
     }

package/dist/interfaces/ICryptography.d.ts

@@ -132,6 +132,7 @@ export interface ICryptography {
      * @param publicJWKey The signer's public key (JWK) to use for verification.
      * @returns A boolean indicating if the signature is valid.
      */
+    /** Verifies encoded detached JWS and RFC 7797 `b64=false` detached payloads. */
     verifyDetachedJws(payloadBytes: Uint8Array, detachedJws: string, publicJWKey: PublicJwk): Promise<boolean>;
     /**
      * Converts a JWS Object (with decoded headers and payload) into Compact Serialization format.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdc-common-utils-ts",
-  "version": "2.5.15",
+  "version": "2.5.16",
   "publishConfig": {
     "access": "public"
   },