jose 3.16.0 → 3.19.0

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -1,13 +1,13 @@
-import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import isObject from '../../lib/is_object.js';
 import { decode as base64url } from '../../runtime/base64url.js';
 import decrypt from '../../runtime/decrypt.js';
 import { inflate } from '../../runtime/zlib.js';
+import random from '../../runtime/random.js';
+import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
+import isDisjoint from '../../lib/is_disjoint.js';
+import isObject from '../../lib/is_object.js';
 import decryptKeyManagement from '../../lib/decrypt_key_management.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import cekFactory from '../../lib/cek.js';
-import random from '../../runtime/random.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
 const generateCek = cekFactory(random);
@@ -70,7 +70,7 @@ async function flattenedDecrypt(jwe, key, options) {
             throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
         }
         if (joseHeader.zip !== 'DEF') {
-            throw new JOSENotSupported('unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
+            throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
         }
     }
     const { alg, enc } = joseHeader;
@@ -92,8 +92,10 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.encrypted_key !== undefined) {
         encryptedKey = base64url(jwe.encrypted_key);
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jwe);
+        resolvedKey = true;
     }
     let cek;
     try {
@@ -132,6 +134,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.header !== undefined) {
         result.unprotectedHeader = jwe.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 export { flattenedDecrypt };

package/dist/node/esm/jwe/flattened/encrypt.js

@@ -1,8 +1,8 @@
-import ivFactory from '../../lib/iv.js';
 import { encode as base64url } from '../../runtime/base64url.js';
 import random from '../../runtime/random.js';
 import encrypt from '../../runtime/encrypt.js';
 import { deflate } from '../../runtime/zlib.js';
+import ivFactory from '../../lib/iv.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
@@ -12,6 +12,9 @@ const generateIv = ivFactory(random);
 const checkExtensions = validateCrit.bind(undefined, JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
+        if (!(plaintext instanceof Uint8Array)) {
+            throw new TypeError('plaintext must be an instance of Uint8Array');
+        }
         this._plaintext = plaintext;
     }
     setKeyManagementParameters(parameters) {
@@ -78,7 +81,7 @@ class FlattenedEncrypt {
                 throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
             }
             if (joseHeader.zip !== 'DEF') {
-                throw new JOSENotSupported('unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
+                throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
             }
         }
         const { alg, enc } = joseHeader;

package/dist/node/esm/jwk/embedded.js

@@ -1,4 +1,4 @@
-import parseJwk from './parse.js';
+import { importJWK } from '../key/import.js';
 import isObject from '../lib/is_object.js';
 import { JWSInvalid } from '../util/errors.js';
 async function EmbeddedJWK(protectedHeader, token) {
@@ -9,7 +9,7 @@ async function EmbeddedJWK(protectedHeader, token) {
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await parseJwk(joseHeader.jwk, joseHeader.alg, true);
+    const key = (await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true));
     if (key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/node/esm/jwk/from_key_like.js

@@ -1,6 +1,6 @@
-import asJWK from '../runtime/key_to_jwk.js';
+import { exportJWK } from '../key/export.js';
 async function fromKeyLike(key) {
-    return asJWK(key);
+    return exportJWK(key);
 }
 export { fromKeyLike };
 export default fromKeyLike;

package/dist/node/esm/jwk/parse.js

@@ -1,35 +1,6 @@
-import { decode as base64url } from '../runtime/base64url.js';
-import asKeyObject from '../runtime/jwk_to_key.js';
-import { JOSENotSupported } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
+import { importJWK } from '../key/import.js';
 async function parseJwk(jwk, alg, octAsKeyObject) {
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return asKeyObject({ ...jwk, alg, ext: false });
-            }
-            return base64url(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return asKeyObject({ ...jwk, alg });
-        default:
-            throw new JOSENotSupported('unsupported "kty" (Key Type) Parameter value');
-    }
+    return importJWK(jwk, alg, octAsKeyObject);
 }
 export { parseJwk };
 export default parseJwk;

package/dist/node/esm/jwk/thumbprint.js

@@ -1,6 +1,6 @@
-import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import digest from '../runtime/digest.js';
 import { encode as base64url } from '../runtime/base64url.js';
+import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encoder } from '../lib/buffer_utils.js';
 import isObject from '../lib/is_object.js';
 const check = (value, description) => {

package/dist/node/esm/jwks/remote.js

@@ -1,6 +1,6 @@
+import fetchJwks from '../runtime/fetch_jwks.js';
 import parseJWK from '../jwk/parse.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import fetchJwks from '../runtime/fetch_jwks.js';
 import isObject from '../lib/is_object.js';
 function getKtyFromAlg(alg) {
     switch (alg.substr(0, 2)) {
@@ -93,7 +93,7 @@ class RemoteJWKSet {
         }
         const cached = this._cached.get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await parseJWK({ ...jwk, alg: protectedHeader.alg });
+            const keyObject = (await parseJWK({ ...jwk, alg: protectedHeader.alg, ext: true }));
             if (keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }

package/dist/node/esm/jws/compact/verify.js

@@ -17,7 +17,11 @@ async function compactVerify(jws, key, options) {
         protected: protectedHeader || undefined,
         signature: (signature || undefined),
     }, key, options);
-    return { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 export { compactVerify };
 export default compactVerify;

package/dist/node/esm/jws/flattened/sign.js

@@ -1,13 +1,16 @@
+import { encode as base64url } from '../../runtime/base64url.js';
+import sign from '../../runtime/sign.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import { encode as base64url } from '../../runtime/base64url.js';
-import sign from '../../runtime/sign.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
+        if (!(payload instanceof Uint8Array)) {
+            throw new TypeError('payload must be an instance of Uint8Array');
+        }
         this._payload = payload;
     }
     setProtectedHeader(protectedHeader) {

package/dist/node/esm/jws/flattened/verify.js

@@ -1,10 +1,10 @@
+import { decode as base64url } from '../../runtime/base64url.js';
+import verify from '../../runtime/verify.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
 import checkKeyType from '../../lib/check_key_type.js';
-import { decode as base64url } from '../../runtime/base64url.js';
-import verify from '../../runtime/verify.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
 const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
@@ -70,8 +70,10 @@ async function flattenedVerify(jws, key, options) {
     else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
         throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
+        resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
@@ -97,6 +99,9 @@ async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined) {
         result.unprotectedHeader = jws.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 export { flattenedVerify };

package/dist/node/esm/jwt/decrypt.js

@@ -15,7 +15,11 @@ async function jwtDecrypt(jwt, key, options) {
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
         throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
     }
-    return { payload, protectedHeader };
+    const result = { payload, protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 export { jwtDecrypt };
 export default jwtDecrypt;

package/dist/node/esm/jwt/unsecured.js

@@ -1,5 +1,5 @@
-import { decoder } from '../lib/buffer_utils.js';
 import * as base64url from '../runtime/base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
 import { JWTInvalid } from '../util/errors.js';
 import jwtPayload from '../lib/jwt_claims_set.js';
 import ProduceJWT from '../lib/jwt_producer.js';

package/dist/node/esm/jwt/verify.js

@@ -8,7 +8,11 @@ async function jwtVerify(jwt, key, options) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
-    return { payload, protectedHeader: verified.protectedHeader };
+    const result = { payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 export { jwtVerify };
 export default jwtVerify;

package/dist/node/esm/key/export.js

@@ -0,0 +1,12 @@
+import { toSPKI as exportPublic } from '../runtime/asn1.js';
+import { toPKCS8 as exportPrivate } from '../runtime/asn1.js';
+import keyToJWK from '../runtime/key_to_jwk.js';
+export async function exportSPKI(key) {
+    return exportPublic(key);
+}
+export async function exportPKCS8(key) {
+    return exportPrivate(key);
+}
+export async function exportJWK(key) {
+    return keyToJWK(key);
+}

package/dist/node/esm/key/import.js

@@ -0,0 +1,119 @@
+import { decode as decodeBase64URL, encodeBase64, decodeBase64 } from '../runtime/base64url.js';
+import { fromSPKI as importPublic } from '../runtime/asn1.js';
+import { fromPKCS8 as importPrivate } from '../runtime/asn1.js';
+import asKeyObject from '../runtime/jwk_to_key.js';
+import { JOSENotSupported } from '../util/errors.js';
+import formatPEM from '../lib/format_pem.js';
+import isObject from '../lib/is_object.js';
+function getElement(seq) {
+    let result = [];
+    let next = 0;
+    while (next < seq.length) {
+        let nextPart = parseElement(seq.subarray(next));
+        result.push(nextPart);
+        next += nextPart.byteLength;
+    }
+    return result;
+}
+function parseElement(bytes) {
+    let position = 0;
+    let tag = bytes[0] & 0x1f;
+    position++;
+    if (tag === 0x1f) {
+        tag = 0;
+        while (bytes[position] >= 0x80) {
+            tag = tag * 128 + bytes[position] - 0x80;
+            position++;
+        }
+        tag = tag * 128 + bytes[position] - 0x80;
+        position++;
+    }
+    let length = 0;
+    if (bytes[position] < 0x80) {
+        length = bytes[position];
+        position++;
+    }
+    else {
+        let numberOfDigits = bytes[position] & 0x7f;
+        position++;
+        length = 0;
+        for (let i = 0; i < numberOfDigits; i++) {
+            length = length * 256 + bytes[position];
+            position++;
+        }
+    }
+    if (length === 0x80) {
+        length = 0;
+        while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+            length++;
+        }
+        const byteLength = position + length + 2;
+        return {
+            byteLength,
+            contents: bytes.subarray(position, position + length),
+            raw: bytes.subarray(0, byteLength),
+        };
+    }
+    const byteLength = position + length;
+    return {
+        byteLength,
+        contents: bytes.subarray(position, byteLength),
+        raw: bytes.subarray(0, byteLength),
+    };
+}
+function spkiFromX509(buf) {
+    return encodeBase64(getElement(getElement(parseElement(buf).contents)[0].contents)[6].raw);
+}
+function getSPKI(x509) {
+    const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
+    const raw = decodeBase64(pem);
+    return formatPEM(spkiFromX509(raw), 'PUBLIC KEY');
+}
+export async function importSPKI(spki, alg, options) {
+    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
+        throw new TypeError('"spki" must be SPKI formatted string');
+    }
+    return importPublic(spki, alg, options);
+}
+export async function importX509(x509, alg, options) {
+    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
+        throw new TypeError('"x509" must be X.509 formatted string');
+    }
+    const spki = getSPKI(x509);
+    return importPublic(spki, alg, options);
+}
+export async function importPKCS8(pkcs8, alg, options) {
+    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
+        throw new TypeError('"pkcs8" must be PCKS8 formatted string');
+    }
+    return importPrivate(pkcs8, alg, options);
+}
+export async function importJWK(jwk, alg, octAsKeyObject) {
+    if (!isObject(jwk)) {
+        throw new TypeError('JWK must be an object');
+    }
+    alg || (alg = jwk.alg);
+    if (typeof alg !== 'string' || !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    switch (jwk.kty) {
+        case 'oct':
+            if (typeof jwk.k !== 'string' || !jwk.k) {
+                throw new TypeError('missing "k" (Key Value) Parameter value');
+            }
+            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
+            if (octAsKeyObject) {
+                return asKeyObject({ ...jwk, alg, ext: false });
+            }
+            return decodeBase64URL(jwk.k);
+        case 'RSA':
+            if (jwk.oth !== undefined) {
+                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+            }
+        case 'EC':
+        case 'OKP':
+            return asKeyObject({ ...jwk, alg });
+        default:
+            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+}

package/dist/node/esm/lib/decrypt_key_management.js

@@ -1,12 +1,12 @@
-import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { unwrap as aesKw } from '../runtime/aeskw.js';
 import * as ECDH from '../runtime/ecdhes.js';
 import { decrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { decrypt as rsaEs } from '../runtime/rsaes.js';
 import { unwrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { decode as base64url } from '../runtime/base64url.js';
+import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLengths as cekLengths } from '../lib/cek.js';
-import { parseJwk } from '../jwk/parse.js';
+import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 function assertEnryptedKey(encryptedKey) {
     if (!encryptedKey) {
@@ -38,7 +38,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
             if (!ECDH.ecdhAllowed(key)) {
                 throw new JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
             }
-            const epk = await parseJwk(joseHeader.epk, alg);
+            const epk = await importJWK(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined)
@@ -88,7 +88,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
             return aesGcmKw(alg, key, encryptedKey, iv, tag);
         }
         default: {
-            throw new JOSENotSupported('unsupported or invalid "alg" (JWE Algorithm) header value');
+            throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
         }
     }
 }

package/dist/node/esm/lib/encrypt_key_management.js

@@ -1,5 +1,3 @@
-import cekFactory, { bitLengths as cekLengths } from '../lib/cek.js';
-import { JOSENotSupported } from '../util/errors.js';
 import random from '../runtime/random.js';
 import { wrap as aesKw } from '../runtime/aeskw.js';
 import * as ECDH from '../runtime/ecdhes.js';
@@ -7,6 +5,8 @@ import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
 import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { encode as base64url } from '../runtime/base64url.js';
+import cekFactory, { bitLengths as cekLengths } from '../lib/cek.js';
+import { JOSENotSupported } from '../util/errors.js';
 import { fromKeyLike } from '../jwk/from_key_like.js';
 import checkKeyType from './check_key_type.js';
 const generateCek = cekFactory(random);
@@ -79,7 +79,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             break;
         }
         default: {
-            throw new JOSENotSupported('unsupported or invalid "alg" (JWE Algorithm) header value');
+            throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
         }
     }
     return { cek, encryptedKey, parameters };

package/dist/node/esm/lib/format_pem.js

@@ -0,0 +1,4 @@
+export default (b64, descriptor) => {
+    const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
+    return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;
+};

package/dist/node/esm/runtime/aeskw.js

@@ -8,7 +8,7 @@ import invalidKeyInput from './invalid_key_input.js';
 import supported from './ciphers.js';
 function checkKeySize(key, alg) {
     if (key.symmetricKeySize << 3 !== parseInt(alg.substr(1, 3), 10)) {
-        throw new TypeError(`invalid key size for alg: ${alg}`);
+        throw new TypeError(`Invalid key size for alg: ${alg}`);
     }
 }
 function ensureKeyObject(key, alg, usage) {

package/dist/node/esm/runtime/asn1.js

@@ -0,0 +1,39 @@
+import { createPrivateKey, createPublicKey } from 'crypto';
+import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import isKeyObject from './is_key_object.js';
+import invalidKeyInput from './invalid_key_input.js';
+const genericExport = (keyType, keyFormat, key) => {
+    let keyObject;
+    if (isCryptoKey(key)) {
+        if (!key.extractable) {
+            throw new TypeError('CryptoKey is not extractable');
+        }
+        keyObject = getKeyObject(key);
+    }
+    else if (isKeyObject(key)) {
+        keyObject = key;
+    }
+    else {
+        throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+    }
+    if (keyObject.type !== keyType) {
+        throw new TypeError(`key is not a ${keyType} key`);
+    }
+    return keyObject.export({ format: 'pem', type: keyFormat });
+};
+export const toSPKI = (key) => {
+    return genericExport('public', 'spki', key);
+};
+export const toPKCS8 = (key) => {
+    return genericExport('private', 'pkcs8', key);
+};
+export const fromPKCS8 = (pem) => createPrivateKey({
+    key: Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, ''), 'base64'),
+    type: 'pkcs8',
+    format: 'der',
+});
+export const fromSPKI = (pem) => createPublicKey({
+    key: Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, ''), 'base64'),
+    type: 'spki',
+    format: 'der',
+});

package/dist/node/esm/runtime/asn1_sequence_encoder.js

@@ -38,7 +38,7 @@ export default class DumbAsn1Encoder {
     oidFor(oid) {
         const bOid = oids.get(oid);
         if (!bOid) {
-            throw new JOSENotSupported('unsupported or invalid OID');
+            throw new JOSENotSupported('Invalid or unsupported OID');
         }
         this.elements.push(bOid);
         this.length += bOid.length;

package/dist/node/esm/runtime/base64url.js

@@ -13,5 +13,7 @@ if (Buffer.isEncoding('base64url')) {
 else {
     encodeImpl = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
+export const decodeBase64 = (input) => Buffer.from(input, 'base64');
+export const encodeBase64 = (input) => Buffer.from(input).toString('base64');
 export const encode = encodeImpl;
 export const decode = (input) => Buffer.from(normalize(input), 'base64');

package/dist/node/esm/runtime/decrypt.js

@@ -84,7 +84,7 @@ const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
         case 'A256GCM':
             return gcmDecrypt(enc, key, ciphertext, iv, tag, aad);
         default:
-            throw new JOSENotSupported('unsupported JWE Content Encryption Algorithm');
+            throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
 };
 export default decrypt;

package/dist/node/esm/runtime/ecdhes.js

@@ -8,29 +8,41 @@ import { isCryptoKey, getKeyObject } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from './invalid_key_input.js';
 const generateKeyPair = promisify(generateKeyPairCb);
-export const deriveKey = async (publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
-    const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
-    if (isCryptoKey(publicKey)) {
-        publicKey = getKeyObject(publicKey, 'ECDH-ES');
+export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
+    let publicKey;
+    if (isCryptoKey(publicKee)) {
+        publicKey = getKeyObject(publicKee, 'ECDH-ES');
+    }
+    else if (isKeyObject(publicKee)) {
+        publicKey = publicKee;
+    }
+    else {
+        throw new TypeError(invalidKeyInput(publicKee, 'KeyObject', 'CryptoKey'));
     }
-    if (!isKeyObject(publicKey)) {
-        throw new TypeError(invalidKeyInput(publicKey, 'KeyObject', 'CryptoKey'));
+    let privateKey;
+    if (isCryptoKey(privateKee)) {
+        privateKey = getKeyObject(privateKee, 'ECDH-ES', new Set(['deriveBits', 'deriveKey']));
     }
-    if (isCryptoKey(privateKey)) {
-        privateKey = getKeyObject(privateKey, 'ECDH-ES', new Set(['deriveBits', 'deriveKey']));
+    else if (isKeyObject(privateKee)) {
+        privateKey = privateKee;
     }
-    if (!isKeyObject(privateKey)) {
-        throw new TypeError(invalidKeyInput(privateKey, 'KeyObject', 'CryptoKey'));
+    else {
+        throw new TypeError(invalidKeyInput(privateKee, 'KeyObject', 'CryptoKey'));
     }
+    const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
     const sharedSecret = diffieHellman({ privateKey, publicKey });
     return concatKdf(digest, sharedSecret, keyLength, value);
 };
-export const generateEpk = async (key) => {
-    if (isCryptoKey(key)) {
-        key = getKeyObject(key);
+export const generateEpk = async (kee) => {
+    let key;
+    if (isCryptoKey(kee)) {
+        key = getKeyObject(kee);
+    }
+    else if (isKeyObject(kee)) {
+        key = kee;
     }
-    if (!isKeyObject(key)) {
-        throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+    else {
+        throw new TypeError(invalidKeyInput(kee, 'KeyObject', 'CryptoKey'));
     }
     switch (key.asymmetricKeyType) {
         case 'x25519':
@@ -43,7 +55,7 @@ export const generateEpk = async (key) => {
             return (await generateKeyPair('ec', { namedCurve })).privateKey;
         }
         default:
-            throw new JOSENotSupported('unsupported or invalid EPK');
+            throw new JOSENotSupported('Invalid or unsupported EPK');
     }
 };
 export const ecdhAllowed = (key) => ['P-256', 'P-384', 'P-521', 'X25519', 'X448'].includes(getNamedCurve(key));

package/dist/node/esm/runtime/encrypt.js

@@ -62,7 +62,7 @@ const encrypt = async (enc, plaintext, cek, iv, aad) => {
         case 'A256GCM':
             return gcmEncrypt(enc, plaintext, key, iv, aad);
         default:
-            throw new JOSENotSupported('unsupported JWE Content Encryption Algorithm');
+            throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
 };
 export default encrypt;

package/dist/node/esm/runtime/generate.js

@@ -27,7 +27,7 @@ export async function generateSecret(alg, options) {
             length = parseInt(alg.substring(1, 4), 10);
             break;
         default:
-            throw new JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
     return createSecretKey(random(new Uint8Array(length >> 3)));
 }
@@ -94,6 +94,6 @@ export async function generateKeyPair(alg, options) {
                     throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
             }
         default:
-            throw new JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
 }