jose 3.20.1 → 3.20.4

package/dist/node/esm/jwe/flattened/encrypt.js

@@ -1,15 +1,12 @@
 import { encode as base64url } from '../../runtime/base64url.js';
-import random from '../../runtime/random.js';
 import encrypt from '../../runtime/encrypt.js';
 import { deflate } from '../../runtime/zlib.js';
-import ivFactory from '../../lib/iv.js';
+import generateIv from '../../lib/iv.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
-const generateIv = ivFactory(random);
-const checkExtensions = validateCrit.bind(undefined, JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -75,7 +72,7 @@ class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
             if (!this._protectedHeader || !this._protectedHeader.zip) {
                 throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');

package/dist/node/esm/jws/flattened/sign.js

@@ -5,7 +5,6 @@ import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
-const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
@@ -38,7 +37,7 @@ class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/node/esm/jws/flattened/verify.js

@@ -7,8 +7,6 @@ import isObject from '../../lib/is_object.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
-const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
-const checkAlgOption = validateAlgorithms.bind(undefined, 'algorithms');
 async function flattenedVerify(jws, key, options) {
     var _a;
     if (!isObject(jws)) {
@@ -46,7 +44,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -58,7 +56,7 @@ async function flattenedVerify(jws, key, options) {
     if (typeof alg !== 'string' || !alg) {
         throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
-    const algorithms = options && checkAlgOption(options.algorithms);
+    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
         throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }

package/dist/node/esm/lib/cek.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import random from '../runtime/random.js';
 const bitLengths = new Map([
     ['A128CBC-HS256', 256],
     ['A128GCM', 128],
@@ -7,12 +8,12 @@ const bitLengths = new Map([
     ['A256CBC-HS512', 512],
     ['A256GCM', 256],
 ]);
-const factory = (random) => (alg) => {
+const generateCek = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
     return random(new Uint8Array(bitLength >> 3));
 };
-export default factory;
+export default generateCek;
 export { bitLengths };

package/dist/node/esm/lib/decrypt_key_management.js

@@ -9,7 +9,7 @@ import { bitLengths as cekLengths } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
@@ -63,6 +63,9 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                 throw new JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, base64url(joseHeader.p2s));

package/dist/node/esm/lib/encrypt_key_management.js

@@ -1,15 +1,13 @@
-import random from '../runtime/random.js';
 import { wrap as aesKw } from '../runtime/aeskw.js';
 import * as ECDH from '../runtime/ecdhes.js';
 import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
 import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { encode as base64url } from '../runtime/base64url.js';
-import cekFactory, { bitLengths as cekLengths } from '../lib/cek.js';
+import generateCek, { bitLengths as cekLengths } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
 import checkKeyType from './check_key_type.js';
-const generateCek = cekFactory(random);
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;

package/dist/node/esm/lib/iv.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import random from '../runtime/random.js';
 const bitLengths = new Map([
     ['A128CBC-HS256', 128],
     ['A128GCM', 96],
@@ -10,12 +11,12 @@ const bitLengths = new Map([
     ['A256GCM', 96],
     ['A256GCMKW', 96],
 ]);
-const factory = (random) => (alg) => {
+const generateIv = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
     return random(new Uint8Array(bitLength >> 3));
 };
-export default factory;
+export default generateIv;
 export { bitLengths };

package/dist/node/esm/runtime/aesgcmkw.js

@@ -1,9 +1,7 @@
 import encrypt from './encrypt.js';
 import decrypt from './decrypt.js';
-import ivFactory from '../lib/iv.js';
-import random from './random.js';
+import generateIv from '../lib/iv.js';
 import { encode as base64url } from './base64url.js';
-const generateIv = ivFactory(random);
 export const wrap = async (alg, key, cek, iv) => {
     const jweAlgorithm = alg.substr(0, 7);
     iv || (iv = generateIv(jweAlgorithm));

package/dist/node/esm/runtime/random.js

@@ -1,2 +1 @@
-import { randomFillSync } from 'crypto';
-export default randomFillSync;
+export { randomFillSync as default } from 'crypto';

package/dist/node/esm/util/errors.js

@@ -2,114 +2,146 @@ export class JOSEError extends Error {
     constructor(message) {
         var _a;
         super(message);
-        this.code = JOSEError.code;
+        this.code = 'ERR_JOSE_GENERIC';
         this.name = this.constructor.name;
         (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
 }
-JOSEError.code = 'ERR_JOSE_GENERIC';
 export class JWTClaimValidationFailed extends JOSEError {
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = JWTClaimValidationFailed.code;
+        this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+        this.claim = claim;
+        this.reason = reason;
+    }
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
+}
+export class JWTExpired extends JOSEError {
+    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+        super(message);
+        this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
 }
-JWTClaimValidationFailed.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JOSEAlgNotAllowed.code;
+        this.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
+    }
+    static get code() {
+        return 'ERR_JOSE_ALG_NOT_ALLOWED';
     }
 }
-JOSEAlgNotAllowed.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
 export class JOSENotSupported extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JOSENotSupported.code;
+        this.code = 'ERR_JOSE_NOT_SUPPORTED';
+    }
+    static get code() {
+        return 'ERR_JOSE_NOT_SUPPORTED';
     }
 }
-JOSENotSupported.code = 'ERR_JOSE_NOT_SUPPORTED';
 export class JWEDecryptionFailed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWEDecryptionFailed.code;
+        this.code = 'ERR_JWE_DECRYPTION_FAILED';
         this.message = 'decryption operation failed';
     }
+    static get code() {
+        return 'ERR_JWE_DECRYPTION_FAILED';
+    }
 }
-JWEDecryptionFailed.code = 'ERR_JWE_DECRYPTION_FAILED';
 export class JWEInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWEInvalid.code;
+        this.code = 'ERR_JWE_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWE_INVALID';
     }
 }
-JWEInvalid.code = 'ERR_JWE_INVALID';
 export class JWSInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWSInvalid.code;
+        this.code = 'ERR_JWS_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWS_INVALID';
     }
 }
-JWSInvalid.code = 'ERR_JWS_INVALID';
 export class JWTInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWTInvalid.code;
+        this.code = 'ERR_JWT_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWT_INVALID';
     }
 }
-JWTInvalid.code = 'ERR_JWT_INVALID';
 export class JWKInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKInvalid.code;
+        this.code = 'ERR_JWK_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWK_INVALID';
     }
 }
-JWKInvalid.code = 'ERR_JWK_INVALID';
 export class JWKSInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSInvalid.code;
+        this.code = 'ERR_JWKS_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWKS_INVALID';
     }
 }
-JWKSInvalid.code = 'ERR_JWKS_INVALID';
 export class JWKSNoMatchingKey extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSNoMatchingKey.code;
+        this.code = 'ERR_JWKS_NO_MATCHING_KEY';
         this.message = 'no applicable key found in the JSON Web Key Set';
     }
+    static get code() {
+        return 'ERR_JWKS_NO_MATCHING_KEY';
+    }
 }
-JWKSNoMatchingKey.code = 'ERR_JWKS_NO_MATCHING_KEY';
 export class JWKSMultipleMatchingKeys extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSMultipleMatchingKeys.code;
+        this.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
         this.message = 'multiple matching keys found in the JSON Web Key Set';
     }
+    static get code() {
+        return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+    }
 }
-JWKSMultipleMatchingKeys.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
 export class JWKSTimeout extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSTimeout.code;
+        this.code = 'ERR_JWKS_TIMEOUT';
         this.message = 'request timed out';
     }
+    static get code() {
+        return 'ERR_JWKS_TIMEOUT';
+    }
 }
-JWKSTimeout.code = 'ERR_JWKS_TIMEOUT';
 export class JWSSignatureVerificationFailed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWSSignatureVerificationFailed.code;
+        this.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
         this.message = 'signature verification failed';
     }
-}
-JWSSignatureVerificationFailed.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-export class JWTExpired extends JWTClaimValidationFailed {
-    constructor() {
-        super(...arguments);
-        this.code = JWTExpired.code;
+    static get code() {
+        return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     }
 }
-JWTExpired.code = 'ERR_JWT_EXPIRED';

package/dist/types/types.d.ts

@@ -199,6 +199,7 @@ export interface DecryptOptions extends CritOption {
   keyManagementAlgorithms?: string[]
   contentEncryptionAlgorithms?: string[]
   inflateRaw?: InflateFunction
+  maxPBES2Count?: number
 }
 export interface EncryptOptions extends CritOption {
   deflateRaw?: DeflateFunction

package/dist/types/util/errors.d.ts

@@ -1,69 +1,72 @@
 export declare class JOSEError extends Error {
-    static code: string;
+    static get code(): string;
     code: string;
     constructor(message?: string);
 }
 export declare class JWTClaimValidationFailed extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    code: string;
+    claim: string;
+    reason: string;
+    constructor(message: string, claim?: string, reason?: string);
+}
+export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailed {
+    static get code(): 'ERR_JWT_EXPIRED';
     code: string;
     claim: string;
     reason: string;
     constructor(message: string, claim?: string, reason?: string);
 }
 export declare class JOSEAlgNotAllowed extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JOSE_ALG_NOT_ALLOWED';
     code: string;
 }
 export declare class JOSENotSupported extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JOSE_NOT_SUPPORTED';
     code: string;
 }
 export declare class JWEDecryptionFailed extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWE_DECRYPTION_FAILED';
     code: string;
     message: string;
 }
 export declare class JWEInvalid extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWE_INVALID';
     code: string;
 }
 export declare class JWSInvalid extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWS_INVALID';
     code: string;
 }
 export declare class JWTInvalid extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWT_INVALID';
     code: string;
 }
 export declare class JWKInvalid extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWK_INVALID';
     code: string;
 }
 export declare class JWKSInvalid extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWKS_INVALID';
     code: string;
 }
 export declare class JWKSNoMatchingKey extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWKS_NO_MATCHING_KEY';
     code: string;
     message: string;
 }
 export declare class JWKSMultipleMatchingKeys extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     code: string;
     message: string;
 }
 export declare class JWKSTimeout extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWKS_TIMEOUT';
     code: string;
     message: string;
 }
 export declare class JWSSignatureVerificationFailed extends JOSEError {
-    static code: string;
+    static get code(): 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     code: string;
     message: string;
 }
-export declare class JWTExpired extends JWTClaimValidationFailed {
-    static code: string;
-    code: string;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "3.20.1",
+  "version": "3.20.4",
   "description": "Universal 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies",
   "keywords": [
     "browser",
@@ -52,6 +52,7 @@
   },
   "license": "MIT",
   "author": "Filip Skokan <panva.ip@gmail.com>",
+  "sideEffects": false,
   "exports": {
     "./package.json": "./package.json",
     "./jwe/compact/decrypt": {