jose 3.19.0 → 3.20.3

package/dist/browser/util/errors.js

@@ -1,108 +1,147 @@
 export class JOSEError extends Error {
     constructor(message) {
+        var _a;
         super(message);
-        this.code = JOSEError.code;
+        this.code = 'ERR_JOSE_GENERIC';
         this.name = this.constructor.name;
-        if (Error.captureStackTrace) {
-            Error.captureStackTrace(this, this.constructor);
-        }
+        (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
+    }
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
     }
 }
-JOSEError.code = 'ERR_JOSE_GENERIC';
 export class JWTClaimValidationFailed extends JOSEError {
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = JWTClaimValidationFailed.code;
+        this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
+}
+export class JWTExpired extends JOSEError {
+    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+        super(message);
+        this.code = 'ERR_JWT_EXPIRED';
+        this.claim = claim;
+        this.reason = reason;
+    }
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
 }
-JWTClaimValidationFailed.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JOSEAlgNotAllowed.code;
+        this.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
+    }
+    static get code() {
+        return 'ERR_JOSE_ALG_NOT_ALLOWED';
     }
 }
-JOSEAlgNotAllowed.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
 export class JOSENotSupported extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JOSENotSupported.code;
+        this.code = 'ERR_JOSE_NOT_SUPPORTED';
+    }
+    static get code() {
+        return 'ERR_JOSE_NOT_SUPPORTED';
     }
 }
-JOSENotSupported.code = 'ERR_JOSE_NOT_SUPPORTED';
 export class JWEDecryptionFailed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWEDecryptionFailed.code;
+        this.code = 'ERR_JWE_DECRYPTION_FAILED';
         this.message = 'decryption operation failed';
     }
+    static get code() {
+        return 'ERR_JWE_DECRYPTION_FAILED';
+    }
 }
-JWEDecryptionFailed.code = 'ERR_JWE_DECRYPTION_FAILED';
 export class JWEInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWEInvalid.code;
+        this.code = 'ERR_JWE_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWE_INVALID';
     }
 }
-JWEInvalid.code = 'ERR_JWE_INVALID';
 export class JWSInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWSInvalid.code;
+        this.code = 'ERR_JWS_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWS_INVALID';
     }
 }
-JWSInvalid.code = 'ERR_JWS_INVALID';
 export class JWTInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWTInvalid.code;
+        this.code = 'ERR_JWT_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWT_INVALID';
     }
 }
-JWTInvalid.code = 'ERR_JWT_INVALID';
 export class JWKInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKInvalid.code;
+        this.code = 'ERR_JWK_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWK_INVALID';
     }
 }
-JWKInvalid.code = 'ERR_JWK_INVALID';
 export class JWKSInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSInvalid.code;
+        this.code = 'ERR_JWKS_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWKS_INVALID';
     }
 }
-JWKSInvalid.code = 'ERR_JWKS_INVALID';
 export class JWKSNoMatchingKey extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSNoMatchingKey.code;
+        this.code = 'ERR_JWKS_NO_MATCHING_KEY';
         this.message = 'no applicable key found in the JSON Web Key Set';
     }
+    static get code() {
+        return 'ERR_JWKS_NO_MATCHING_KEY';
+    }
 }
-JWKSNoMatchingKey.code = 'ERR_JWKS_NO_MATCHING_KEY';
 export class JWKSMultipleMatchingKeys extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSMultipleMatchingKeys.code;
+        this.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
         this.message = 'multiple matching keys found in the JSON Web Key Set';
     }
+    static get code() {
+        return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+    }
 }
-JWKSMultipleMatchingKeys.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-export class JWSSignatureVerificationFailed extends JOSEError {
+export class JWKSTimeout extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWSSignatureVerificationFailed.code;
-        this.message = 'signature verification failed';
+        this.code = 'ERR_JWKS_TIMEOUT';
+        this.message = 'request timed out';
+    }
+    static get code() {
+        return 'ERR_JWKS_TIMEOUT';
     }
 }
-JWSSignatureVerificationFailed.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-export class JWTExpired extends JWTClaimValidationFailed {
+export class JWSSignatureVerificationFailed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWTExpired.code;
+        this.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+        this.message = 'signature verification failed';
+    }
+    static get code() {
+        return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     }
 }
-JWTExpired.code = 'ERR_JWT_EXPIRED';

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -4,7 +4,6 @@ exports.flattenedDecrypt = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
 const decrypt_js_1 = require("../../runtime/decrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
-const random_js_1 = require("../../runtime/random.js");
 const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const is_object_js_1 = require("../../lib/is_object.js");
@@ -13,10 +12,6 @@ const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const cek_js_1 = require("../../lib/cek.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
-const generateCek = (0, cek_js_1.default)(random_js_1.default);
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWEInvalid, new Map());
-const checkAlgOption = validate_algorithms_js_1.default.bind(undefined, 'keyManagementAlgorithms');
-const checkEncOption = validate_algorithms_js_1.default.bind(undefined, 'contentEncryptionAlgorithms');
 async function flattenedDecrypt(jwe, key, options) {
     var _a;
     if (!(0, is_object_js_1.default)(jwe)) {
@@ -67,7 +62,7 @@ async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
         if (!parsedProt || !parsedProt.zip) {
             throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -83,8 +78,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (typeof enc !== 'string' || !enc) {
         throw new errors_js_1.JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
     }
-    const keyManagementAlgorithms = options && checkAlgOption(options.keyManagementAlgorithms);
-    const contentEncryptionAlgorithms = options && checkEncOption(options.contentEncryptionAlgorithms);
+    const keyManagementAlgorithms = options && (0, validate_algorithms_js_1.default)('keyManagementAlgorithms', options.keyManagementAlgorithms);
+    const contentEncryptionAlgorithms = options &&
+        (0, validate_algorithms_js_1.default)('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
     if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
         throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }
@@ -108,7 +104,7 @@ async function flattenedDecrypt(jwe, key, options) {
         if (err instanceof TypeError) {
             throw err;
         }
-        cek = generateCek(enc);
+        cek = (0, cek_js_1.default)(enc);
     }
     const iv = (0, base64url_js_1.decode)(jwe.iv);
     const tag = (0, base64url_js_1.decode)(jwe.tag);

package/dist/node/cjs/jwe/flattened/encrypt.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlattenedEncrypt = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
-const random_js_1 = require("../../runtime/random.js");
 const encrypt_js_1 = require("../../runtime/encrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
 const iv_js_1 = require("../../lib/iv.js");
@@ -11,8 +10,6 @@ const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
-const generateIv = (0, iv_js_1.default)(random_js_1.default);
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -78,7 +75,7 @@ class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
             if (!this._protectedHeader || !this._protectedHeader.zip) {
                 throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -118,7 +115,7 @@ class FlattenedEncrypt {
                 }
             }
         }
-        this._iv || (this._iv = generateIv(enc));
+        this._iv || (this._iv = (0, iv_js_1.default)(enc));
         let additionalData;
         let protectedHeader;
         let aadMember;

package/dist/node/cjs/jwk/embedded.js

@@ -12,8 +12,8 @@ async function EmbeddedJWK(protectedHeader, token) {
     if (!(0, is_object_js_1.default)(joseHeader.jwk)) {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = (await (0, import_js_1.importJWK)({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true));
-    if (key.type !== 'public') {
+    const key = await (0, import_js_1.importJWK)({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true);
+    if (key instanceof Uint8Array || key.type !== 'public') {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }
     return key;

package/dist/node/cjs/jwks/remote.js

@@ -2,11 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
-const parse_js_1 = require("../jwk/parse.js");
+const import_js_1 = require("../key/import.js");
 const errors_js_1 = require("../util/errors.js");
 const is_object_js_1 = require("../lib/is_object.js");
 function getKtyFromAlg(alg) {
-    switch (alg.substr(0, 2)) {
+    switch (typeof alg === 'string' && alg.substr(0, 2)) {
         case 'RS':
         case 'PS':
             return 'RSA';
@@ -35,7 +35,7 @@ class RemoteJWKSet {
             typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
     }
     coolingDown() {
-        if (typeof this._cooldownStarted === 'undefined') {
+        if (!this._cooldownStarted) {
             return false;
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
@@ -59,7 +59,7 @@ class RemoteJWKSet {
                 candidate = jwk.key_ops.includes('verify');
             }
             if (candidate && protectedHeader.alg === 'EdDSA') {
-                candidate = ['Ed25519', 'Ed448'].includes(jwk.crv);
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
                 switch (protectedHeader.alg) {
@@ -91,13 +91,10 @@ class RemoteJWKSet {
         else if (length !== 1) {
             throw new errors_js_1.JWKSMultipleMatchingKeys();
         }
-        if (!this._cached.has(jwk)) {
-            this._cached.set(jwk, {});
-        }
-        const cached = this._cached.get(jwk);
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = (await (0, parse_js_1.default)({ ...jwk, alg: protectedHeader.alg, ext: true }));
-            if (keyObject.type !== 'public') {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, protectedHeader.alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }
             cached[protectedHeader.alg] = keyObject;

package/dist/node/cjs/jws/flattened/sign.js

@@ -8,7 +8,6 @@ const errors_js_1 = require("../../util/errors.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
@@ -41,7 +40,7 @@ class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = (0, validate_crit_js_1.default)(errors_js_1.JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/node/cjs/jws/flattened/verify.js

@@ -10,8 +10,6 @@ const is_object_js_1 = require("../../lib/is_object.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWSInvalid, new Map([['b64', true]]));
-const checkAlgOption = validate_algorithms_js_1.default.bind(undefined, 'algorithms');
 async function flattenedVerify(jws, key, options) {
     var _a;
     if (!(0, is_object_js_1.default)(jws)) {
@@ -49,7 +47,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = (0, validate_crit_js_1.default)(errors_js_1.JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -61,7 +59,7 @@ async function flattenedVerify(jws, key, options) {
     if (typeof alg !== 'string' || !alg) {
         throw new errors_js_1.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
-    const algorithms = options && checkAlgOption(options.algorithms);
+    const algorithms = options && (0, validate_algorithms_js_1.default)('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
         throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }

package/dist/node/cjs/jwt/encrypt.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EncryptJWT = void 0;
 const encrypt_js_1 = require("../jwe/compact/encrypt.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const jwt_producer_js_1 = require("../lib/jwt_producer.js");
-class EncryptJWT extends jwt_producer_js_1.default {
+const produce_js_1 = require("./produce.js");
+class EncryptJWT extends produce_js_1.ProduceJWT {
     setProtectedHeader(protectedHeader) {
         if (this._protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');

package/dist/node/cjs/{lib/jwt_producer.js → jwt/produce.js}

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const epoch_js_1 = require("./epoch.js");
-const is_object_js_1 = require("./is_object.js");
-const secs_js_1 = require("./secs.js");
+exports.ProduceJWT = void 0;
+const epoch_js_1 = require("../lib/epoch.js");
+const is_object_js_1 = require("../lib/is_object.js");
+const secs_js_1 = require("../lib/secs.js");
 class ProduceJWT {
     constructor(payload) {
         if (!(0, is_object_js_1.default)(payload)) {
@@ -54,4 +55,4 @@ class ProduceJWT {
         return this;
     }
 }
-exports.default = ProduceJWT;
+exports.ProduceJWT = ProduceJWT;

package/dist/node/cjs/jwt/sign.js

@@ -4,8 +4,8 @@ exports.SignJWT = void 0;
 const sign_js_1 = require("../jws/compact/sign.js");
 const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const jwt_producer_js_1 = require("../lib/jwt_producer.js");
-class SignJWT extends jwt_producer_js_1.default {
+const produce_js_1 = require("./produce.js");
+class SignJWT extends produce_js_1.ProduceJWT {
     setProtectedHeader(protectedHeader) {
         this._protectedHeader = protectedHeader;
         return this;

package/dist/node/cjs/jwt/unsecured.js

@@ -5,8 +5,8 @@ const base64url = require("../runtime/base64url.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const errors_js_1 = require("../util/errors.js");
 const jwt_claims_set_js_1 = require("../lib/jwt_claims_set.js");
-const jwt_producer_js_1 = require("../lib/jwt_producer.js");
-class UnsecuredJWT extends jwt_producer_js_1.default {
+const produce_js_1 = require("./produce.js");
+class UnsecuredJWT extends produce_js_1.ProduceJWT {
     encode() {
         const header = base64url.encode(JSON.stringify({ alg: 'none' }));
         const payload = base64url.encode(JSON.stringify(this._payload));

package/dist/node/cjs/lib/cek.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bitLengths = void 0;
 const errors_js_1 = require("../util/errors.js");
+const random_js_1 = require("../runtime/random.js");
 const bitLengths = new Map([
     ['A128CBC-HS256', 256],
     ['A128GCM', 128],
@@ -11,11 +12,11 @@ const bitLengths = new Map([
     ['A256GCM', 256],
 ]);
 exports.bitLengths = bitLengths;
-const factory = (random) => (alg) => {
+const generateCek = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return random(new Uint8Array(bitLength >> 3));
+    return (0, random_js_1.default)(new Uint8Array(bitLength >> 3));
 };
-exports.default = factory;
+exports.default = generateCek;

package/dist/node/cjs/lib/check_key_type.js

@@ -1,30 +1,47 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const invalid_key_input_js_1 = require("../runtime/invalid_key_input.js");
-const checkKeyType = (alg, key, usage) => {
-    if (!(key instanceof Uint8Array) && !(key === null || key === void 0 ? void 0 : key.type)) {
-        throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+const is_key_like_js_1 = require("../runtime/is_key_like.js");
+const symmetricTypeCheck = (key) => {
+    if (key instanceof Uint8Array)
+        return;
+    if (!(0, is_key_like_js_1.default)(key)) {
+        throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
     }
-    if (alg.startsWith('HS') ||
-        alg === 'dir' ||
-        alg.startsWith('PBES2') ||
-        alg.match(/^A\d{3}(?:GCM)?KW$/)) {
-        if (key instanceof Uint8Array || key.type === 'secret') {
-            return;
-        }
-        throw new TypeError('CryptoKey or KeyObject instances for symmetric algorithms must be of type "secret"');
+    if (key.type !== 'secret') {
+        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
     }
-    if (key instanceof Uint8Array) {
-        throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey'));
+};
+const asymmetricTypeCheck = (key, usage) => {
+    if (!(0, is_key_like_js_1.default)(key)) {
+        throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types));
     }
     if (key.type === 'secret') {
-        throw new TypeError('CryptoKey or KeyObject instances for asymmetric algorithms must not be of type "secret"');
+        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);
     }
     if (usage === 'sign' && key.type === 'public') {
-        throw new TypeError('CryptoKey or KeyObject instances for asymmetric algorithm signing must be of type "private"');
+        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithm signing must be of type "private"`);
     }
     if (usage === 'decrypt' && key.type === 'public') {
-        throw new TypeError('CryptoKey or KeyObject instances for asymmetric algorithm decryption must be of type "private"');
+        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithm decryption must be of type "private"`);
+    }
+    if (key.algorithm && usage === 'verify' && key.type === 'private') {
+        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithm verifying must be of type "public"`);
+    }
+    if (key.algorithm && usage === 'encrypt' && key.type === 'private') {
+        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithm encryption must be of type "public"`);
+    }
+};
+const checkKeyType = (alg, key, usage) => {
+    const symmetric = alg.startsWith('HS') ||
+        alg === 'dir' ||
+        alg.startsWith('PBES2') ||
+        /^A\d{3}(?:GCM)?KW$/.test(alg);
+    if (symmetric) {
+        symmetricTypeCheck(key);
+    }
+    else {
+        asymmetricTypeCheck(key, usage);
     }
 };
 exports.default = checkKeyType;

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -10,81 +10,81 @@ const errors_js_1 = require("../util/errors.js");
 const cek_js_1 = require("../lib/cek.js");
 const import_js_1 = require("../key/import.js");
 const check_key_type_js_1 = require("./check_key_type.js");
-function assertEnryptedKey(encryptedKey) {
-    if (!encryptedKey) {
-        throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
-    }
-}
-function assertHeaderParameter(joseHeader, parameter, name) {
-    if (joseHeader[parameter] === undefined) {
-        throw new errors_js_1.JWEInvalid(`JOSE Header ${name} (${parameter}) missing`);
-    }
-}
+const is_object_js_1 = require("./is_object.js");
 async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
     (0, check_key_type_js_1.default)(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
-            if (encryptedKey !== undefined) {
+            if (encryptedKey !== undefined)
                 throw new errors_js_1.JWEInvalid('Encountered unexpected JWE Encrypted Key');
-            }
             return key;
         }
         case 'ECDH-ES':
-            if (encryptedKey !== undefined) {
+            if (encryptedKey !== undefined)
                 throw new errors_js_1.JWEInvalid('Encountered unexpected JWE Encrypted Key');
-            }
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW': {
-            assertHeaderParameter(joseHeader, 'epk', 'Ephemeral Public Key');
-            if (!ECDH.ecdhAllowed(key)) {
+            if (!(0, is_object_js_1.default)(joseHeader.epk))
+                throw new errors_js_1.JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
+            if (!ECDH.ecdhAllowed(key))
                 throw new errors_js_1.JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
-            }
             const epk = await (0, import_js_1.importJWK)(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
-            if (joseHeader.apu !== undefined)
+            if (joseHeader.apu !== undefined) {
+                if (typeof joseHeader.apu !== 'string')
+                    throw new errors_js_1.JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
                 partyUInfo = (0, base64url_js_1.decode)(joseHeader.apu);
-            if (joseHeader.apv !== undefined)
+            }
+            if (joseHeader.apv !== undefined) {
+                if (typeof joseHeader.apv !== 'string')
+                    throw new errors_js_1.JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
+            }
             const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(joseHeader.enc), partyUInfo, partyVInfo);
-            if (alg === 'ECDH-ES') {
+            if (alg === 'ECDH-ES')
                 return sharedSecret;
-            }
-            assertEnryptedKey(encryptedKey);
-            const kwAlg = alg.substr(-6);
-            return (0, aeskw_js_1.unwrap)(kwAlg, sharedSecret, encryptedKey);
+            if (encryptedKey === undefined)
+                throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
+            return (0, aeskw_js_1.unwrap)(alg.substr(-6), sharedSecret, encryptedKey);
         }
         case 'RSA1_5':
         case 'RSA-OAEP':
         case 'RSA-OAEP-256':
         case 'RSA-OAEP-384':
         case 'RSA-OAEP-512': {
-            assertEnryptedKey(encryptedKey);
+            if (encryptedKey === undefined)
+                throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
             return (0, rsaes_js_1.decrypt)(alg, key, encryptedKey);
         }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
         case 'PBES2-HS512+A256KW': {
-            assertEnryptedKey(encryptedKey);
-            assertHeaderParameter(joseHeader, 'p2c', 'PBES2 Count');
-            assertHeaderParameter(joseHeader, 'p2s', 'PBES2 Salt');
-            const { p2c } = joseHeader;
-            const p2s = (0, base64url_js_1.decode)(joseHeader.p2s);
-            return (0, pbes2kw_js_1.decrypt)(alg, key, encryptedKey, p2c, p2s);
+            if (encryptedKey === undefined)
+                throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
+            if (typeof joseHeader.p2c !== 'number')
+                throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            if (typeof joseHeader.p2s !== 'string')
+                throw new errors_js_1.JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
+            return (0, pbes2kw_js_1.decrypt)(alg, key, encryptedKey, joseHeader.p2c, (0, base64url_js_1.decode)(joseHeader.p2s));
         }
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
-            assertEnryptedKey(encryptedKey);
+            if (encryptedKey === undefined)
+                throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
             return (0, aeskw_js_1.unwrap)(alg, key, encryptedKey);
         }
         case 'A128GCMKW':
         case 'A192GCMKW':
         case 'A256GCMKW': {
-            assertEnryptedKey(encryptedKey);
-            assertHeaderParameter(joseHeader, 'iv', 'Initialization Vector');
-            assertHeaderParameter(joseHeader, 'tag', 'Authentication Tag');
+            if (encryptedKey === undefined)
+                throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
+            if (typeof joseHeader.iv !== 'string')
+                throw new errors_js_1.JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
+            if (typeof joseHeader.tag !== 'string')
+                throw new errors_js_1.JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
             const iv = (0, base64url_js_1.decode)(joseHeader.iv);
             const tag = (0, base64url_js_1.decode)(joseHeader.tag);
             return (0, aesgcmkw_js_1.unwrap)(alg, key, encryptedKey, iv, tag);