hono 4.10.1 → 4.10.2

package/dist/cjs/utils/jwt/jwt.js

@@ -62,7 +62,8 @@ const verify = async (token, publicKey, algOrOptions) => {
     iss: optsIn.iss,
     nbf: optsIn.nbf ?? true,
     exp: optsIn.exp ?? true,
-    iat: optsIn.iat ?? true
+    iat: optsIn.iat ?? true,
+    aud: optsIn.aud
   };
   const tokenParts = token.split(".");
   if (tokenParts.length !== 3) {
@@ -93,6 +94,31 @@ const verify = async (token, publicKey, algOrOptions) => {
       throw new import_types.JwtTokenIssuer(opts.iss, payload.iss);
     }
   }
+  if (opts.aud) {
+    if (!payload.aud) {
+      throw new import_types.JwtPayloadRequiresAud(payload);
+    }
+  }
+  if (payload.aud) {
+    const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    const matched = audiences.some((aud) => {
+      if (opts.aud instanceof RegExp && opts.aud.test(aud)) {
+        return true;
+      } else if (typeof opts.aud === "string") {
+        if (aud === opts.aud) {
+          return true;
+        }
+      } else if (Array.isArray(opts.aud)) {
+        if (opts.aud.includes(aud)) {
+          return true;
+        }
+      }
+      return false;
+    });
+    if (opts.aud && !matched) {
+      throw new import_types.JwtTokenAudience(opts.aud, payload.aud);
+    }
+  }
   const headerPayload = token.substring(0, token.lastIndexOf("."));
   const verified = await (0, import_jws.verifying)(
     publicKey,

package/dist/cjs/utils/jwt/types.js

@@ -22,6 +22,8 @@ __export(types_exports, {
   JwtAlgorithmNotImplemented: () => JwtAlgorithmNotImplemented,
   JwtHeaderInvalid: () => JwtHeaderInvalid,
   JwtHeaderRequiresKid: () => JwtHeaderRequiresKid,
+  JwtPayloadRequiresAud: () => JwtPayloadRequiresAud,
+  JwtTokenAudience: () => JwtTokenAudience,
   JwtTokenExpired: () => JwtTokenExpired,
   JwtTokenInvalid: () => JwtTokenInvalid,
   JwtTokenIssuedAt: () => JwtTokenIssuedAt,
@@ -86,6 +88,20 @@ class JwtTokenSignatureMismatched extends Error {
     this.name = "JwtTokenSignatureMismatched";
   }
 }
+class JwtPayloadRequiresAud extends Error {
+  constructor(payload) {
+    super(`required "aud" in jwt payload: ${JSON.stringify(payload)}`);
+    this.name = "JwtPayloadRequiresAud";
+  }
+}
+class JwtTokenAudience extends Error {
+  constructor(expected, aud) {
+    super(
+      `expected audience "${Array.isArray(expected) ? expected.join(", ") : expected}", got "${aud}"`
+    );
+    this.name = "JwtTokenAudience";
+  }
+}
 var CryptoKeyUsage = /* @__PURE__ */ ((CryptoKeyUsage2) => {
   CryptoKeyUsage2["Encrypt"] = "encrypt";
   CryptoKeyUsage2["Decrypt"] = "decrypt";
@@ -103,6 +119,8 @@ var CryptoKeyUsage = /* @__PURE__ */ ((CryptoKeyUsage2) => {
   JwtAlgorithmNotImplemented,
   JwtHeaderInvalid,
   JwtHeaderRequiresKid,
+  JwtPayloadRequiresAud,
+  JwtTokenAudience,
   JwtTokenExpired,
   JwtTokenInvalid,
   JwtTokenIssuedAt,

package/dist/types/utils/jwt/jwt.d.ts

@@ -22,6 +22,8 @@ export type VerifyOptions = {
     exp?: boolean;
     /** Verify the `iat` claim (default: `true`) */
     iat?: boolean;
+    /** Acceptable audience(s) for the token */
+    aud?: string | string[] | RegExp;
 };
 export type VerifyOptionsWithAlg = {
     /** The algorithm used for decoding the token */

package/dist/types/utils/jwt/types.d.ts

@@ -29,6 +29,12 @@ export declare class JwtHeaderRequiresKid extends Error {
 export declare class JwtTokenSignatureMismatched extends Error {
     constructor(token: string);
 }
+export declare class JwtPayloadRequiresAud extends Error {
+    constructor(payload: object);
+}
+export declare class JwtTokenAudience extends Error {
+    constructor(expected: string | string[] | RegExp, aud: string | string[]);
+}
 export declare enum CryptoKeyUsage {
     Encrypt = "encrypt",
     Decrypt = "decrypt",
@@ -60,5 +66,9 @@ export type JWTPayload = {
      * The token is checked to ensure it has been issued by a trusted issuer.
      */
     iss?: string;
+    /**
+     * The token is checked to ensure it is intended for a specific audience.
+     */
+    aud?: string | string[];
 };
 export type { HonoJsonWebKey } from './jws';

package/dist/utils/jwt/jwt.js

@@ -5,6 +5,8 @@ import { signing, verifying } from "./jws.js";
 import {
   JwtHeaderInvalid,
   JwtHeaderRequiresKid,
+  JwtPayloadRequiresAud,
+  JwtTokenAudience,
   JwtTokenExpired,
   JwtTokenInvalid,
   JwtTokenIssuedAt,
@@ -44,7 +46,8 @@ var verify = async (token, publicKey, algOrOptions) => {
     iss: optsIn.iss,
     nbf: optsIn.nbf ?? true,
     exp: optsIn.exp ?? true,
-    iat: optsIn.iat ?? true
+    iat: optsIn.iat ?? true,
+    aud: optsIn.aud
   };
   const tokenParts = token.split(".");
   if (tokenParts.length !== 3) {
@@ -75,6 +78,31 @@ var verify = async (token, publicKey, algOrOptions) => {
       throw new JwtTokenIssuer(opts.iss, payload.iss);
     }
   }
+  if (opts.aud) {
+    if (!payload.aud) {
+      throw new JwtPayloadRequiresAud(payload);
+    }
+  }
+  if (payload.aud) {
+    const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    const matched = audiences.some((aud) => {
+      if (opts.aud instanceof RegExp && opts.aud.test(aud)) {
+        return true;
+      } else if (typeof opts.aud === "string") {
+        if (aud === opts.aud) {
+          return true;
+        }
+      } else if (Array.isArray(opts.aud)) {
+        if (opts.aud.includes(aud)) {
+          return true;
+        }
+      }
+      return false;
+    });
+    if (opts.aud && !matched) {
+      throw new JwtTokenAudience(opts.aud, payload.aud);
+    }
+  }
   const headerPayload = token.substring(0, token.lastIndexOf("."));
   const verified = await verifying(
     publicKey,

package/dist/utils/jwt/types.js

@@ -55,6 +55,20 @@ var JwtTokenSignatureMismatched = class extends Error {
     this.name = "JwtTokenSignatureMismatched";
   }
 };
+var JwtPayloadRequiresAud = class extends Error {
+  constructor(payload) {
+    super(`required "aud" in jwt payload: ${JSON.stringify(payload)}`);
+    this.name = "JwtPayloadRequiresAud";
+  }
+};
+var JwtTokenAudience = class extends Error {
+  constructor(expected, aud) {
+    super(
+      `expected audience "${Array.isArray(expected) ? expected.join(", ") : expected}", got "${aud}"`
+    );
+    this.name = "JwtTokenAudience";
+  }
+};
 var CryptoKeyUsage = /* @__PURE__ */ ((CryptoKeyUsage2) => {
   CryptoKeyUsage2["Encrypt"] = "encrypt";
   CryptoKeyUsage2["Decrypt"] = "decrypt";
@@ -71,6 +85,8 @@ export {
   JwtAlgorithmNotImplemented,
   JwtHeaderInvalid,
   JwtHeaderRequiresKid,
+  JwtPayloadRequiresAud,
+  JwtTokenAudience,
   JwtTokenExpired,
   JwtTokenInvalid,
   JwtTokenIssuedAt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.10.1",
+  "version": "4.10.2",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",