jose 2.0.1 → 2.0.5

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.0.5](https://github.com/panva/jose/compare/v2.0.4...v2.0.5) (2021-04-09)
+
+
+### Bug Fixes
+
+* defer AES CBC w/ HMAC decryption after tag verification passes ([812e03f](https://github.com/panva/jose/commit/812e03fcf4963791ffd9a46417beea5a7a74d995))
+
+## [2.0.4](https://github.com/panva/jose/compare/v2.0.3...v2.0.4) (2021-01-18)
+
+
+### Performance
+
+* improve base64url encoding when available in Node.js ([d5af559](https://github.com/panva/jose/commit/d5af559a94f51ee82951e1def5c5c5749dfa290a))
+
+## [2.0.3](https://github.com/panva/jose/compare/v2.0.2...v2.0.3) (2020-10-29)
+
+
+### Bug Fixes
+
+* allow stubbing of the JWT.decode function ([6c3b92f](https://github.com/panva/jose/commit/6c3b92f4394a5d7092d7336922eda61e311e6f8c))
+
+## [2.0.2](https://github.com/panva/jose/compare/v2.0.1...v2.0.2) (2020-09-14)
+
+
+### Bug Fixes
+
+* **esm:** include esm files in the published package ([1956746](https://github.com/panva/jose/commit/1956746df6542c00bc33af750f93394805b5d603))
+
 ## [2.0.1](https://github.com/panva/jose/compare/v2.0.0...v2.0.1) (2020-09-10)
 
 

package/README.md

@@ -4,6 +4,20 @@
 
 <p align="center"><img src="/img/demo.gif?raw=true"/></p>
 
+## New major version is available
+
+`v2.x` continues being supported. It will continue receiving
+bug fixes until 2022-04-30. It will not be receiving any new
+features.
+
+`v3.x` is [available](https://github.com/panva/jose) with
+
+- Revised API
+- No dependencies
+- Browser support
+- Promise-based API
+- experimental (non-blocking 🎉) Node.js libuv thread pool based runtime
+
 ## Implemented specs & features
 
 The following specifications are implemented by `jose`
@@ -28,10 +42,6 @@ Available JWT validation profiles
 - (draft 04) OIDC Logout Token - [OpenID Connect Back-Channel Logout 1.0][spec-oidc-logout_token]
 - (draft 06) OAuth 2.0 JWT Access Tokens - [JWT Profile for OAuth 2.0 Access Tokens][draft-ietf-oauth-access-token-jwt]
 
-## Sponsor
-
-[<img width="65" height="65" align="left" src="https://avatars.githubusercontent.com/u/2824157?s=75&v=4" alt="auth0-logo">][sponsor-auth0] If you want to quickly add secure token-based authentication to Node.js projects, feel free to check Auth0’s free plan at [auth0.com/overview][sponsor-auth0].<br><br>
-
 ## Support
 
 If you or your business use `jose`, please consider becoming a [sponsor][support-sponsor] so I can continue maintaining it and adding new features carefree.
@@ -53,7 +63,7 @@ is also supported.
 Installing `jose`
 
 ```console
-npm install jose
+npm install jose@2
 ```
 
 Usage
@@ -307,9 +317,9 @@ jose.JWE.decrypt(
 
 | JWT profile validation | Supported | Stable profile |  |
 | -- | -- | -- | -- |
-| JWT Access Tokens - [JWT Profile for OAuth 2.0 Access Tokens][draft-ietf-oauth-access-token-jwt] | ✓ | ✕<sup>5</sup> | see [`JWT.AccessToken.verify`](/docs/README.md#jwtaccesstokenverifytoken-keyorstore-options) |
-| ID Token - [OpenID Connect Core 1.0][spec-oidc-id_token] | ✓ | ✓ | see [`JWT.IdToken.verify`](/docs/README.md#jwtidtokenverifytoken-keyorstore-options) |
-| Logout Token - [OpenID Connect Back-Channel Logout 1.0][spec-oidc-logout_token] | ✓ | ✕<sup>5</sup> | see [`JWT.LogoutToken.verify`](/docs/README.md#jwtlogouttokenverifytoken-keyorstore-options) |
+| JWT Access Tokens - [JWT Profile for OAuth 2.0 Access Tokens][draft-ietf-oauth-access-token-jwt] | ✓ | ✕<sup>5</sup> | see [`JWT.AccessToken.verify`]([/docs/README.md](https://github.com/panva/jose/blob/v2.x/docs/README.md)#jwtaccesstokenverifytoken-keyorstore-options) |
+| ID Token - [OpenID Connect Core 1.0][spec-oidc-id_token] | ✓ | ✓ | see [`JWT.IdToken.verify`]([/docs/README.md](https://github.com/panva/jose/blob/v2.x/docs/README.md)#jwtidtokenverifytoken-keyorstore-options) |
+| Logout Token - [OpenID Connect Back-Channel Logout 1.0][spec-oidc-logout_token] | ✓ | ✕<sup>5</sup> | see [`JWT.LogoutToken.verify`]([/docs/README.md](https://github.com/panva/jose/blob/v2.x/docs/README.md)#jwtlogouttokenverifytoken-keyorstore-options) |
 | JARM - [JWT Secured Authorization Response Mode for OAuth 2.0][draft-jarm] | ◯ |||
 | [JWT Response for OAuth Token Introspection][draft-jwtintrospection] | ◯ |||
 | [OAuth 2.0 DPoP][draft-dpop] | ◯ |||
@@ -331,6 +341,13 @@ attention to changelog and the drafts themselves.
 
 ## FAQ
 
+#### Supported Versions
+
+| Version | Bug Fixes 🐞 | New Features ⭐ |
+| ------- | --------- | -------- |
+| [3.x.x](https://github.com/panva/jose) | ✅ | ✅ |
+| [2.x.x](https://github.com/panva/jose/tree/v2.x) | ✅ until 2022-04-30 | ❌ |
+
 #### Semver?
 
 **Yes.** Everything that's either exported in the TypeScript definitions file or
@@ -381,13 +398,13 @@ in terms of performance and API (not having well defined errors).
 
 &plus; this was an amazing opportunity to learn JOSE as a whole
 
-[documentation-jwe]: /docs/README.md#jwe-json-web-encryption
-[documentation-jwk]: /docs/README.md#jwk-json-web-key
-[documentation-jwks]: /docs/README.md#jwks-json-web-key-set
-[documentation-jws]: /docs/README.md#jws-json-web-signature
-[documentation-jwt]: /docs/README.md#jwt-json-web-token
-[documentation-none]: /docs/README.md#jwknone
-[documentation]: /docs/README.md
+[documentation-jwe]: https://github.com/panva/jose/blob/v2.x/docs/README.md#jwe-json-web-encryption
+[documentation-jwk]: https://github.com/panva/jose/blob/v2.x/docs/README.md#jwk-json-web-key
+[documentation-jwks]: https://github.com/panva/jose/blob/v2.x/docs/README.md#jwks-json-web-key-set
+[documentation-jws]: https://github.com/panva/jose/blob/v2.x/docs/README.md#jws-json-web-signature
+[documentation-jwt]: https://github.com/panva/jose/blob/v2.x/docs/README.md#jwt-json-web-token
+[documentation-none]: https://github.com/panva/jose/blob/v2.x/docs/README.md#jwknone
+[documentation]: https://github.com/panva/jose/blob/v2.x/docs/README.md
 [node-jose]: https://github.com/cisco/node-jose
 [spec-b64]: https://tools.ietf.org/html/rfc7797
 [spec-cookbook]: https://tools.ietf.org/html/rfc7520
@@ -407,4 +424,3 @@ in terms of performance and API (not having well defined errors).
 [spec-oidc-logout_token]: https://openid.net/specs/openid-connect-backchannel-1_0-04.html#LogoutToken
 [oidc-token-hash]: https://www.npmjs.com/package/oidc-token-hash
 [support-sponsor]: https://github.com/sponsors/panva
-[sponsor-auth0]: https://auth0.com/overview?utm_source=GHsponsor&utm_medium=GHsponsor&utm_campaign=panva-jose&utm_content=auth

package/lib/help/base64url.js

@@ -1,15 +1,12 @@
-/* global BigInt */
-
-const fromBase64 = (base64) => {
-  return base64.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
-}
-
-const encode = (input, encoding = 'utf8') => {
-  return fromBase64(Buffer.from(input, encoding).toString('base64'))
-}
-
-const encodeBuffer = (buf) => {
-  return fromBase64(buf.toString('base64'))
+let encode
+let encodeBuffer
+if (Buffer.isEncoding('base64url')) {
+  encode = (input, encoding = 'utf8') => Buffer.from(input, encoding).toString('base64url')
+  encodeBuffer = (buf) => buf.toString('base64url')
+} else {
+  const fromBase64 = (base64) => base64.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
+  encode = (input, encoding = 'utf8') => fromBase64(Buffer.from(input, encoding).toString('base64'))
+  encodeBuffer = (buf) => fromBase64(buf.toString('base64'))
 }
 
 const decodeToBuffer = (input) => {

package/lib/help/key_object.js

@@ -1,5 +1,3 @@
-/* global BigInt */
-
 const { keyObjectSupported } = require('./runtime_support')
 
 let createPublicKey

package/lib/help/key_utils.js

@@ -1,5 +1,3 @@
-/* global BigInt */
-
 const { EOL } = require('os')
 
 const errors = require('../errors')

package/lib/help/rsa_primes.js

@@ -1,5 +1,3 @@
-/* global BigInt */
-
 const { randomBytes } = require('crypto')
 
 const base64url = require('./base64url')
@@ -67,7 +65,7 @@ const modPow = (a, b, n) => {
   let result = ONE
   let x = a
   while (b > 0) {
-    var leastSignificantBit = b % TWO
+    const leastSignificantBit = b % TWO
     b = b / TWO
     if (leastSignificantBit === ONE) {
       result = result * x

package/lib/index.mjs

@@ -0,0 +1,9 @@
+import mod from './index.js'
+
+export default mod
+export const JWE = mod.JWE
+export const JWK = mod.JWK
+export const JWKS = mod.JWKS
+export const JWS = mod.JWS
+export const JWT = mod.JWT
+export const errors = mod.errors

package/lib/jwa/aes_cbc_hmac_sha2.js

@@ -44,13 +44,17 @@ const decrypt = (size, sign, { [KEYOBJECT]: keyObject }, ciphertext, { iv, tag =
   const expectedTag = sign({ [KEYOBJECT]: macKey }, macData, tag).slice(0, keySize)
   const macCheckPassed = timingSafeEqual(tag, expectedTag)
 
+  if (!macCheckPassed) {
+    throw new JWEDecryptionFailed()
+  }
+
   let cleartext
   try {
     const cipher = createDecipheriv(`aes-${size}-cbc`, encKey, iv)
     cleartext = Buffer.concat([cipher.update(ciphertext), cipher.final()])
   } catch (err) {}
 
-  if (!cleartext || !macCheckPassed) {
+  if (!cleartext) {
     throw new JWEDecryptionFailed()
   }
 

package/lib/jwk/key/base.js

@@ -106,38 +106,48 @@ class Key {
       },
       kid: {
         enumerable: true,
-        ...(kid ? { value: kid } : {
-          get () {
-            Object.defineProperty(this, 'kid', { value: this.thumbprint, configurable: false })
-            return this.kid
-          },
-          configurable: true
-        })
+        ...(kid
+          ? { value: kid }
+          : {
+              get () {
+                Object.defineProperty(this, 'kid', { value: this.thumbprint, configurable: false })
+                return this.kid
+              },
+              configurable: true
+            })
       },
-      ...(x5c ? {
-        x5t: {
-          enumerable: true,
-          ...(x5t ? { value: x5t } : {
-            get () {
-              Object.defineProperty(this, 'x5t', { value: thumbprint.x5t(this.x5c[0]), configurable: false })
-              return this.x5t
-            },
-            configurable: true
-          })
-        }
-      } : undefined),
-      ...(x5c ? {
-        'x5t#S256': {
-          enumerable: true,
-          ...(x5t256 ? { value: x5t256 } : {
-            get () {
-              Object.defineProperty(this, 'x5t#S256', { value: thumbprint['x5t#S256'](this.x5c[0]), configurable: false })
-              return this['x5t#S256']
-            },
-            configurable: true
-          })
-        }
-      } : undefined),
+      ...(x5c
+        ? {
+            x5t: {
+              enumerable: true,
+              ...(x5t
+                ? { value: x5t }
+                : {
+                    get () {
+                      Object.defineProperty(this, 'x5t', { value: thumbprint.x5t(this.x5c[0]), configurable: false })
+                      return this.x5t
+                    },
+                    configurable: true
+                  })
+            }
+          }
+        : undefined),
+      ...(x5c
+        ? {
+            'x5t#S256': {
+              enumerable: true,
+              ...(x5t256
+                ? { value: x5t256 }
+                : {
+                    get () {
+                      Object.defineProperty(this, 'x5t#S256', { value: thumbprint['x5t#S256'](this.x5c[0]), configurable: false })
+                      return this['x5t#S256']
+                    },
+                    configurable: true
+                  })
+            }
+          }
+        : undefined),
       thumbprint: {
         get () {
           Object.defineProperty(this, 'thumbprint', { value: thumbprint.kid(this[THUMBPRINT_MATERIAL]()), configurable: false })

package/lib/jwks/keystore.js

@@ -26,14 +26,16 @@ const keyscore = (key, { alg, use, ops }) => {
 class KeyStore {
   constructor (...keys) {
     while (keys.some(Array.isArray)) {
-      keys = keys.flat ? keys.flat() : keys.reduce((acc, val) => {
-        if (Array.isArray(val)) {
-          return [...acc, ...val]
-        }
+      keys = keys.flat
+        ? keys.flat()
+        : keys.reduce((acc, val) => {
+          if (Array.isArray(val)) {
+            return [...acc, ...val]
+          }
 
-        acc.push(val)
-        return acc
-      }, [])
+          acc.push(val)
+          return acc
+        }, [])
     }
     if (keys.some(k => !isKey(k) || !k.kty)) {
       throw new TypeError('all keys must be instances of a key instantiated by JWK.asKey')
@@ -171,6 +173,7 @@ function asKeyStore (jwks, { ignoreErrors = false, calculateMissingRSAPrimes = f
       if (!ignoreErrors) {
         throw err
       }
+      return undefined
     }
   }).filter(Boolean)
 

package/lib/jwt/index.js

@@ -11,5 +11,6 @@ module.exports = {
 
 Object.defineProperty(module.exports, 'decode', {
   enumerable: false,
+  configurable: true,
   value: decode
 })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "2.0.1",
+  "version": "2.0.5",
   "description": "JSON Web Almost Everything - JWA, JWS, JWE, JWK, JWT, JWKS for Node.js with minimal dependencies",
   "keywords": [
     "access token",
@@ -56,6 +56,7 @@
   "types": "types/index.d.ts",
   "files": [
     "lib/**/*.js",
+    "lib/**/*.mjs",
     "LICENSE_THIRD_PARTY",
     "types/index.d.ts"
   ],
@@ -88,20 +89,16 @@
     "@panva/asn1.js": "^1.0.0"
   },
   "devDependencies": {
-    "@commitlint/cli": "^9.1.1",
-    "@commitlint/config-conventional": "^9.1.1",
+    "@commitlint/cli": "^11.0.0",
+    "@commitlint/config-conventional": "^11.0.0",
     "ava": "^2.4.0",
-    "babel-eslint": "^10.0.3",
-    "c8": "^7.2.1",
-    "husky": "^4.0.0",
-    "standard": "^14.3.1"
+    "c8": "^7.3.5",
+    "husky": "^4.3.0",
+    "standard": "^16.0.0"
   },
   "engines": {
     "node": ">=10.13.0 < 13 || >=13.7.0"
   },
-  "standard": {
-    "parser": "babel-eslint"
-  },
   "standard-version": {
     "scripts": {
       "postchangelog": "sed -i '' -e 's/### \\[/## [/g' CHANGELOG.md"
@@ -134,7 +131,8 @@
       },
       {
         "type": "perf",
-        "hidden": true
+        "section": "Performance",
+        "hidden": false
       },
       {
         "type": "test",