jose 4.3.7 → 4.5.0

package/dist/node/esm/runtime/decrypt.js

@@ -12,13 +12,13 @@ import invalidKeyInput from '../lib/invalid_key_input.js';
 import supported from './ciphers.js';
 import { types } from './is_key_like.js';
 function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     if (isKeyObject(cek)) {
         cek = cek.export();
     }
     const encKey = cek.subarray(keySize >> 3);
     const macKey = cek.subarray(0, keySize >> 3);
-    const macSize = parseInt(enc.substr(-3), 10);
+    const macSize = parseInt(enc.slice(-3), 10);
     const algorithm = `aes-${keySize}-cbc`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);
@@ -46,7 +46,7 @@ function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     return plaintext;
 }
 function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);

package/dist/node/esm/runtime/ecdhes.js

@@ -10,7 +10,7 @@ import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
 const generateKeyPair = promisify(generateKeyPairCb);
-export const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
+export async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
     let publicKey;
     if (isCryptoKey(publicKee)) {
         checkEncCryptoKey(publicKee, 'ECDH-ES');
@@ -36,8 +36,8 @@ export const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new
     const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
     const sharedSecret = diffieHellman({ privateKey, publicKey });
     return concatKdf(digest, sharedSecret, keyLength, value);
-};
-export const generateEpk = async (kee) => {
+}
+export async function generateEpk(kee) {
     let key;
     if (isCryptoKey(kee)) {
         key = KeyObject.from(kee);
@@ -50,16 +50,16 @@ export const generateEpk = async (kee) => {
     }
     switch (key.asymmetricKeyType) {
         case 'x25519':
-            return (await generateKeyPair('x25519')).privateKey;
+            return generateKeyPair('x25519');
         case 'x448': {
-            return (await generateKeyPair('x448')).privateKey;
+            return generateKeyPair('x448');
         }
         case 'ec': {
             const namedCurve = getNamedCurve(key);
-            return (await generateKeyPair('ec', { namedCurve })).privateKey;
+            return generateKeyPair('ec', { namedCurve });
         }
         default:
             throw new JOSENotSupported('Invalid or unsupported EPK');
     }
-};
+}
 export const ecdhAllowed = (key) => ['P-256', 'P-384', 'P-521', 'X25519', 'X448'].includes(getNamedCurve(key));

package/dist/node/esm/runtime/encrypt.js

@@ -11,7 +11,7 @@ import { JOSENotSupported } from '../util/errors.js';
 import supported from './ciphers.js';
 import { types } from './is_key_like.js';
 function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     if (isKeyObject(cek)) {
         cek = cek.export();
     }
@@ -23,12 +23,12 @@ function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     }
     const cipher = createCipheriv(algorithm, encKey, iv);
     const ciphertext = concat(cipher.update(plaintext), cipher.final());
-    const macSize = parseInt(enc.substr(-3), 10);
+    const macSize = parseInt(enc.slice(-3), 10);
     const tag = cbcTag(aad, iv, ciphertext, macSize, macKey, keySize);
     return { ciphertext, tag };
 }
 function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!supported(algorithm)) {
         throw new JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);

package/dist/node/esm/runtime/generate.js

@@ -13,7 +13,7 @@ export async function generateSecret(alg, options) {
         case 'A128CBC-HS256':
         case 'A192CBC-HS384':
         case 'A256CBC-HS512':
-            length = parseInt(alg.substr(-3), 10);
+            length = parseInt(alg.slice(-3), 10);
             break;
         case 'A128KW':
         case 'A192KW':
@@ -24,7 +24,7 @@ export async function generateSecret(alg, options) {
         case 'A128GCM':
         case 'A192GCM':
         case 'A256GCM':
-            length = parseInt(alg.substring(1, 4), 10);
+            length = parseInt(alg.slice(1, 4), 10);
             break;
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');

package/dist/node/esm/runtime/get_named_curve.js

@@ -42,10 +42,10 @@ const getNamedCurve = (kee, raw) => {
     switch (key.asymmetricKeyType) {
         case 'ed25519':
         case 'ed448':
-            return `Ed${key.asymmetricKeyType.substr(2)}`;
+            return `Ed${key.asymmetricKeyType.slice(2)}`;
         case 'x25519':
         case 'x448':
-            return `X${key.asymmetricKeyType.substr(1)}`;
+            return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
             if (weakMap.has(key)) {
                 return weakMap.get(key);

package/dist/node/esm/runtime/jwk_to_key.js

@@ -6,7 +6,7 @@ import { setCurve } from './get_named_curve.js';
 import { setModulusLength } from './check_modulus_length.js';
 import Asn1SequenceEncoder from './asn1_sequence_encoder.js';
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
 const jwkImportSupported = major >= 16 || (major === 15 && minor >= 12);

package/dist/node/esm/runtime/key_to_jwk.js

@@ -8,7 +8,7 @@ import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
 const jwkExportSupported = major >= 16 || (major === 15 && minor >= 9);

package/dist/node/esm/runtime/node_key.js

@@ -3,7 +3,7 @@ import getNamedCurve from './get_named_curve.js';
 import { JOSENotSupported } from '../util/errors.js';
 import checkModulusLength from './check_modulus_length.js';
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
 const electron = 'electron' in process.versions;
@@ -38,7 +38,7 @@ export default function keyForCrypto(alg, key) {
         case rsaPssParams && 'PS512':
             if (key.asymmetricKeyType === 'rsa-pss') {
                 const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
-                const length = parseInt(alg.substr(-3), 10);
+                const length = parseInt(alg.slice(-3), 10);
                 if (hashAlgorithm !== undefined &&
                     (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
                     throw new TypeError(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${alg}`);

package/dist/node/esm/runtime/pbes2kw.js

@@ -27,17 +27,17 @@ function getPassword(key, alg) {
 export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
     checkP2s(p2s);
     const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.substr(13, 3), 10) >> 3;
+    const keylen = parseInt(alg.slice(13, 16), 10) >> 3;
     const password = getPassword(key, alg);
-    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.substr(8, 3)}`);
-    const encryptedKey = await wrap(alg.substr(-6), derivedKey, cek);
+    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.slice(8, 11)}`);
+    const encryptedKey = await wrap(alg.slice(-6), derivedKey, cek);
     return { encryptedKey, p2c, p2s: base64url(p2s) };
 };
 export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
     checkP2s(p2s);
     const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.substr(13, 3), 10) >> 3;
+    const keylen = parseInt(alg.slice(13, 16), 10) >> 3;
     const password = getPassword(key, alg);
-    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.substr(8, 3)}`);
-    return unwrap(alg.substr(-6), derivedKey, encryptedKey);
+    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.slice(8, 11)}`);
+    return unwrap(alg.slice(-6), derivedKey, encryptedKey);
 };

package/dist/node/esm/runtime/verify.js

@@ -5,7 +5,7 @@ import nodeKey from './node_key.js';
 import sign from './sign.js';
 import getVerifyKey from './get_sign_verify_key.js';
 const [major, minor] = process.version
-    .substr(1)
+    .slice(1)
     .split('.')
     .map((str) => parseInt(str, 10));
 const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);

package/dist/node/esm/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = base64url(payload);
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(decoder.decode(decoded));
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/dist/types/index.d.ts

@@ -27,6 +27,7 @@ export { SignJWT } from './jwt/sign';
 export { EncryptJWT } from './jwt/encrypt';
 export { calculateJwkThumbprint } from './jwk/thumbprint';
 export { EmbeddedJWK } from './jwk/embedded';
+export { createLocalJWKSet } from './jwks/local';
 export { createRemoteJWKSet } from './jwks/remote';
 export type { RemoteJWKSetOptions } from './jwks/remote';
 export { UnsecuredJWT } from './jwt/unsecured';
@@ -35,6 +36,7 @@ export { exportPKCS8, exportSPKI, exportJWK } from './key/export';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import';
 export type { PEMImportOptions } from './key/import';
 export { decodeProtectedHeader } from './util/decode_protected_header';
+export { decodeJwt } from './util/decode_jwt';
 export type { ProtectedHeaderParameters } from './util/decode_protected_header';
 export * as errors from './util/errors';
 export { generateKeyPair } from './key/generate_key_pair';
@@ -42,4 +44,4 @@ export type { GenerateKeyPairResult, GenerateKeyPairOptions } from './key/genera
 export { generateSecret } from './key/generate_secret';
 export type { GenerateSecretOptions } from './key/generate_secret';
 export * as base64url from './util/base64url';
-export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, } from './types';
+export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, JSONWebKeySet, } from './types';

package/dist/types/jwks/local.d.ts

@@ -0,0 +1,9 @@
+import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput, GetKeyFunction } from '../types';
+export declare function isJWKSLike(jwks: unknown): jwks is JSONWebKeySet;
+export declare class LocalJWKSet {
+    protected _jwks?: JSONWebKeySet;
+    private _cached;
+    constructor(jwks: unknown);
+    getKey(protectedHeader: JWSHeaderParameters, token: FlattenedJWSInput): Promise<KeyLike>;
+}
+export declare function createLocalJWKSet(jwks: JSONWebKeySet): GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;

package/dist/types/types.d.ts

@@ -268,3 +268,6 @@ export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
   alg: string
   enc: string
 }
+export interface JSONWebKeySet {
+  keys: JWK[]
+}

package/dist/types/util/decode_jwt.d.ts

@@ -0,0 +1,2 @@
+import type { JWTPayload } from '../types';
+export declare function decodeJwt(jwt: string): JWTPayload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.3.7",
+  "version": "4.5.0",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",