jose 4.3.0 → 4.3.2

package/dist/browser/jwks/remote.js

@@ -37,17 +37,21 @@ class RemoteJWKSet {
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
-    async getKey(protectedHeader) {
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
         if (!this._jwks) {
             await this.reload();
         }
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(protectedHeader.alg);
-            if (candidate && typeof protectedHeader.kid === 'string') {
-                candidate = protectedHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = protectedHeader.alg === jwk.alg;
+                candidate = joseHeader.alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -55,11 +59,11 @@ class RemoteJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && protectedHeader.alg === 'EdDSA') {
+            if (candidate && joseHeader.alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (protectedHeader.alg) {
+                switch (joseHeader.alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -81,7 +85,7 @@ class RemoteJWKSet {
         if (length === 0) {
             if (this.coolingDown() === false) {
                 await this.reload();
-                return this.getKey(protectedHeader);
+                return this.getKey(protectedHeader, token);
             }
             throw new JWKSNoMatchingKey();
         }
@@ -89,14 +93,14 @@ class RemoteJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, protectedHeader.alg);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[protectedHeader.alg] = keyObject;
+            cached[joseHeader.alg] = keyObject;
         }
-        return cached[protectedHeader.alg];
+        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {

package/dist/node/cjs/jwks/remote.js

@@ -40,17 +40,21 @@ class RemoteJWKSet {
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
-    async getKey(protectedHeader) {
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
         if (!this._jwks) {
             await this.reload();
         }
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(protectedHeader.alg);
-            if (candidate && typeof protectedHeader.kid === 'string') {
-                candidate = protectedHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = protectedHeader.alg === jwk.alg;
+                candidate = joseHeader.alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -58,11 +62,11 @@ class RemoteJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && protectedHeader.alg === 'EdDSA') {
+            if (candidate && joseHeader.alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (protectedHeader.alg) {
+                switch (joseHeader.alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -84,7 +88,7 @@ class RemoteJWKSet {
         if (length === 0) {
             if (this.coolingDown() === false) {
                 await this.reload();
-                return this.getKey(protectedHeader);
+                return this.getKey(protectedHeader, token);
             }
             throw new errors_js_1.JWKSNoMatchingKey();
         }
@@ -92,14 +96,14 @@ class RemoteJWKSet {
             throw new errors_js_1.JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, protectedHeader.alg);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[protectedHeader.alg] = keyObject;
+            cached[joseHeader.alg] = keyObject;
         }
-        return cached[protectedHeader.alg];
+        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {

package/dist/node/esm/jwks/remote.js

@@ -37,17 +37,21 @@ class RemoteJWKSet {
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
-    async getKey(protectedHeader) {
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
         if (!this._jwks) {
             await this.reload();
         }
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(protectedHeader.alg);
-            if (candidate && typeof protectedHeader.kid === 'string') {
-                candidate = protectedHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = protectedHeader.alg === jwk.alg;
+                candidate = joseHeader.alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -55,11 +59,11 @@ class RemoteJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && protectedHeader.alg === 'EdDSA') {
+            if (candidate && joseHeader.alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (protectedHeader.alg) {
+                switch (joseHeader.alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -81,7 +85,7 @@ class RemoteJWKSet {
         if (length === 0) {
             if (this.coolingDown() === false) {
                 await this.reload();
-                return this.getKey(protectedHeader);
+                return this.getKey(protectedHeader, token);
             }
             throw new JWKSNoMatchingKey();
         }
@@ -89,14 +93,14 @@ class RemoteJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, protectedHeader.alg);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[protectedHeader.alg] = keyObject;
+            cached[joseHeader.alg] = keyObject;
         }
-        return cached[protectedHeader.alg];
+        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {

package/dist/types/index.d.ts

@@ -42,4 +42,4 @@ export type { GenerateKeyPairResult, GenerateKeyPairOptions } from './key/genera
 export { generateSecret } from './key/generate_secret';
 export type { GenerateSecretOptions } from './key/generate_secret';
 export * as base64url from './util/base64url';
-export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, } from './types';
+export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, } from './types';

package/dist/types/jwe/compact/decrypt.d.ts

@@ -1,5 +1,5 @@
-import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
-export interface CompactDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
+import type { KeyLike, DecryptOptions, CompactJWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
+export interface CompactDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
 }
 export declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<CompactDecryptResult>;
 export declare function compactDecrypt(jwe: string | Uint8Array, getKey: CompactDecryptGetKey, options?: DecryptOptions): Promise<CompactDecryptResult & ResolvedKey>;

package/dist/types/jwe/compact/encrypt.d.ts

@@ -1,10 +1,10 @@
-import type { KeyLike, JWEKeyManagementHeaderParameters, JWEHeaderParameters, EncryptOptions } from '../../types';
+import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParameters, EncryptOptions } from '../../types';
 export declare class CompactEncrypt {
     private _flattened;
     constructor(plaintext: Uint8Array);
     setContentEncryptionKey(cek: Uint8Array): this;
     setInitializationVector(iv: Uint8Array): this;
-    setProtectedHeader(protectedHeader: JWEHeaderParameters): this;
+    setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
     setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
     encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<string>;
 }

package/dist/types/jws/compact/sign.d.ts

@@ -1,7 +1,7 @@
-import type { JWSHeaderParameters, KeyLike, SignOptions } from '../../types';
+import type { CompactJWSHeaderParameters, KeyLike, SignOptions } from '../../types';
 export declare class CompactSign {
     private _flattened;
     constructor(payload: Uint8Array);
-    setProtectedHeader(protectedHeader: JWSHeaderParameters): this;
+    setProtectedHeader(protectedHeader: CompactJWSHeaderParameters): this;
     sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
 }

package/dist/types/jws/compact/verify.d.ts

@@ -1,5 +1,5 @@
-import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
-export interface CompactVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
+import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, CompactJWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
+export interface CompactVerifyGetKey extends GetKeyFunction<CompactJWSHeaderParameters, FlattenedJWSInput> {
 }
 export declare function compactVerify(jws: string | Uint8Array, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<CompactVerifyResult>;
 export declare function compactVerify(jws: string | Uint8Array, getKey: CompactVerifyGetKey, options?: VerifyOptions): Promise<CompactVerifyResult & ResolvedKey>;

package/dist/types/jwt/decrypt.d.ts

@@ -1,7 +1,7 @@
-import type { KeyLike, DecryptOptions, JWTClaimVerificationOptions, GetKeyFunction, JWEHeaderParameters, FlattenedJWE, JWTDecryptResult, ResolvedKey } from '../types';
+import type { KeyLike, DecryptOptions, JWTClaimVerificationOptions, GetKeyFunction, CompactJWEHeaderParameters, FlattenedJWE, JWTDecryptResult, ResolvedKey } from '../types';
 export interface JWTDecryptOptions extends DecryptOptions, JWTClaimVerificationOptions {
 }
-export interface JWTDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
+export interface JWTDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
 }
 export declare function jwtDecrypt(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTDecryptOptions): Promise<JWTDecryptResult>;
 export declare function jwtDecrypt(jwt: string | Uint8Array, getKey: JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<JWTDecryptResult & ResolvedKey>;

package/dist/types/jwt/encrypt.d.ts

@@ -1,4 +1,4 @@
-import type { EncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, KeyLike } from '../types';
+import type { EncryptOptions, CompactJWEHeaderParameters, JWEKeyManagementHeaderParameters, KeyLike } from '../types';
 import { ProduceJWT } from './produce';
 export declare class EncryptJWT extends ProduceJWT {
     private _cek;
@@ -8,7 +8,7 @@ export declare class EncryptJWT extends ProduceJWT {
     private _replicateIssuerAsHeader;
     private _replicateSubjectAsHeader;
     private _replicateAudienceAsHeader;
-    setProtectedHeader(protectedHeader: JWEHeaderParameters): this;
+    setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
     setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
     setContentEncryptionKey(cek: Uint8Array): this;
     setInitializationVector(iv: Uint8Array): this;

package/dist/types/jwt/sign.d.ts

@@ -1,7 +1,7 @@
-import type { JWSHeaderParameters, KeyLike, SignOptions } from '../types';
+import type { JWTHeaderParameters, KeyLike, SignOptions } from '../types';
 import { ProduceJWT } from './produce';
 export declare class SignJWT extends ProduceJWT {
     private _protectedHeader;
-    setProtectedHeader(protectedHeader: JWSHeaderParameters): this;
+    setProtectedHeader(protectedHeader: JWTHeaderParameters): this;
     sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
 }

package/dist/types/jwt/verify.d.ts

@@ -1,7 +1,7 @@
-import type { KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWSHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
+import type { KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWTHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
 export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOptions {
 }
-export interface JWTVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
+export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, FlattenedJWSInput> {
 }
 export declare function jwtVerify(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTVerifyOptions): Promise<JWTVerifyResult>;
 export declare function jwtVerify(jwt: string | Uint8Array, getKey: JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<JWTVerifyResult & ResolvedKey>;

package/dist/types/types.d.ts

@@ -258,3 +258,13 @@ export interface JWTDecryptResult {
 export interface ResolvedKey {
   key: KeyLike | Uint8Array
 }
+export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
+  alg: string
+}
+export interface JWTHeaderParameters extends CompactJWSHeaderParameters {
+  b64: never
+}
+export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
+  alg: string
+  enc: string
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.3.0",
+  "version": "4.3.2",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",