jose 4.3.9 → 4.4.0

package/README.md

@@ -61,6 +61,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
   - [Thumbprints](docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
   - [EmbeddedJWK](docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
 - JSON Web Key Set (JWKS)
+  - [Verify using a local JWKSet](docs/functions/jwks_local.createLocalJWKSet.md#readme)
   - [Verify using a remote JWKSet](docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
 - Key Pair or Secret Generation
   - [Asymmetric Key Pair Generation](docs/functions/key_generate_key_pair.generateKeyPair.md#readme)

package/dist/browser/index.js

@@ -16,6 +16,7 @@ export { SignJWT } from './jwt/sign.js';
 export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
+export { createLocalJWKSet } from './jwks/local.js';
 export { createRemoteJWKSet } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';

package/dist/browser/jwks/local.js

@@ -0,0 +1,101 @@
+import { importJWK } from '../key/import.js';
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
+import isObject from '../lib/is_object.js';
+function getKtyFromAlg(alg) {
+    switch (typeof alg === 'string' && alg.slice(0, 2)) {
+        case 'RS':
+        case 'PS':
+            return 'RSA';
+        case 'ES':
+            return 'EC';
+        case 'Ed':
+            return 'OKP';
+        default:
+            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+}
+export function isJWKSLike(jwks) {
+    return (jwks &&
+        typeof jwks === 'object' &&
+        Array.isArray(jwks.keys) &&
+        jwks.keys.every(isJWKLike));
+}
+function isJWKLike(key) {
+    return isObject(key);
+}
+function clone(obj) {
+    if (typeof structuredClone === 'function') {
+        return structuredClone(obj);
+    }
+    return JSON.parse(JSON.stringify(obj));
+}
+export class LocalJWKSet {
+    constructor(jwks) {
+        this._cached = new WeakMap();
+        if (!isJWKSLike(jwks)) {
+            throw new JWKSInvalid('JSON Web Key Set malformed');
+        }
+        this._jwks = clone(jwks);
+    }
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
+        const candidates = this._jwks.keys.filter((jwk) => {
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
+            }
+            if (candidate && typeof jwk.alg === 'string') {
+                candidate = joseHeader.alg === jwk.alg;
+            }
+            if (candidate && typeof jwk.use === 'string') {
+                candidate = jwk.use === 'sig';
+            }
+            if (candidate && Array.isArray(jwk.key_ops)) {
+                candidate = jwk.key_ops.includes('verify');
+            }
+            if (candidate && joseHeader.alg === 'EdDSA') {
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+            }
+            if (candidate) {
+                switch (joseHeader.alg) {
+                    case 'ES256':
+                        candidate = jwk.crv === 'P-256';
+                        break;
+                    case 'ES256K':
+                        candidate = jwk.crv === 'secp256k1';
+                        break;
+                    case 'ES384':
+                        candidate = jwk.crv === 'P-384';
+                        break;
+                    case 'ES512':
+                        candidate = jwk.crv === 'P-521';
+                        break;
+                    default:
+                }
+            }
+            return candidate;
+        });
+        const { 0: jwk, length } = candidates;
+        if (length === 0) {
+            throw new JWKSNoMatchingKey();
+        }
+        else if (length !== 1) {
+            throw new JWKSMultipleMatchingKeys();
+        }
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
+                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+            }
+            cached[joseHeader.alg] = keyObject;
+        }
+        return cached[joseHeader.alg];
+    }
+}
+export function createLocalJWKSet(jwks) {
+    return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));
+}

package/dist/browser/jwks/remote.js

@@ -1,26 +1,10 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
-import { importJWK } from '../key/import.js';
-import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.slice(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKLike(key) {
-    return isObject(key);
-}
-class RemoteJWKSet {
+import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
+import { isJWKSLike, LocalJWKSet } from './local.js';
+class RemoteJWKSet extends LocalJWKSet {
     constructor(url, options) {
-        this._cached = new WeakMap();
+        super({ keys: [] });
+        this._jwks = undefined;
         if (!(url instanceof URL)) {
             throw new TypeError('url must be an instance of URL');
         }
@@ -38,78 +22,27 @@ class RemoteJWKSet {
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
         if (!this._jwks) {
             await this.reload();
         }
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && joseHeader.alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (joseHeader.alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                    default:
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            if (this.coolingDown() === false) {
-                await this.reload();
-                return this.getKey(protectedHeader, token);
-            }
-            throw new JWKSNoMatchingKey();
-        }
-        else if (length !== 1) {
-            throw new JWKSMultipleMatchingKeys();
+        try {
+            return await super.getKey(protectedHeader, token);
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+        catch (err) {
+            if (err instanceof JWKSNoMatchingKey) {
+                if (this.coolingDown() === false) {
+                    await this.reload();
+                    return super.getKey(protectedHeader, token);
+                }
             }
-            cached[joseHeader.alg] = keyObject;
+            throw err;
         }
-        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {
             this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
                 .then((json) => {
-                if (typeof json !== 'object' ||
-                    !json ||
-                    !Array.isArray(json.keys) ||
-                    !json.keys.every(isJWKLike)) {
+                if (!isJWKSLike(json)) {
                     throw new JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -37,6 +37,8 @@ var thumbprint_js_1 = require("./jwk/thumbprint.js");
 Object.defineProperty(exports, "calculateJwkThumbprint", { enumerable: true, get: function () { return thumbprint_js_1.calculateJwkThumbprint; } });
 var embedded_js_1 = require("./jwk/embedded.js");
 Object.defineProperty(exports, "EmbeddedJWK", { enumerable: true, get: function () { return embedded_js_1.EmbeddedJWK; } });
+var local_js_1 = require("./jwks/local.js");
+Object.defineProperty(exports, "createLocalJWKSet", { enumerable: true, get: function () { return local_js_1.createLocalJWKSet; } });
 var remote_js_1 = require("./jwks/remote.js");
 Object.defineProperty(exports, "createRemoteJWKSet", { enumerable: true, get: function () { return remote_js_1.createRemoteJWKSet; } });
 var unsecured_js_1 = require("./jwt/unsecured.js");

package/dist/node/cjs/jwks/local.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLocalJWKSet = exports.LocalJWKSet = exports.isJWKSLike = void 0;
+const import_js_1 = require("../key/import.js");
+const errors_js_1 = require("../util/errors.js");
+const is_object_js_1 = require("../lib/is_object.js");
+function getKtyFromAlg(alg) {
+    switch (typeof alg === 'string' && alg.slice(0, 2)) {
+        case 'RS':
+        case 'PS':
+            return 'RSA';
+        case 'ES':
+            return 'EC';
+        case 'Ed':
+            return 'OKP';
+        default:
+            throw new errors_js_1.JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+}
+function isJWKSLike(jwks) {
+    return (jwks &&
+        typeof jwks === 'object' &&
+        Array.isArray(jwks.keys) &&
+        jwks.keys.every(isJWKLike));
+}
+exports.isJWKSLike = isJWKSLike;
+function isJWKLike(key) {
+    return (0, is_object_js_1.default)(key);
+}
+function clone(obj) {
+    if (typeof structuredClone === 'function') {
+        return structuredClone(obj);
+    }
+    return JSON.parse(JSON.stringify(obj));
+}
+class LocalJWKSet {
+    constructor(jwks) {
+        this._cached = new WeakMap();
+        if (!isJWKSLike(jwks)) {
+            throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
+        }
+        this._jwks = clone(jwks);
+    }
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
+        const candidates = this._jwks.keys.filter((jwk) => {
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
+            }
+            if (candidate && typeof jwk.alg === 'string') {
+                candidate = joseHeader.alg === jwk.alg;
+            }
+            if (candidate && typeof jwk.use === 'string') {
+                candidate = jwk.use === 'sig';
+            }
+            if (candidate && Array.isArray(jwk.key_ops)) {
+                candidate = jwk.key_ops.includes('verify');
+            }
+            if (candidate && joseHeader.alg === 'EdDSA') {
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+            }
+            if (candidate) {
+                switch (joseHeader.alg) {
+                    case 'ES256':
+                        candidate = jwk.crv === 'P-256';
+                        break;
+                    case 'ES256K':
+                        candidate = jwk.crv === 'secp256k1';
+                        break;
+                    case 'ES384':
+                        candidate = jwk.crv === 'P-384';
+                        break;
+                    case 'ES512':
+                        candidate = jwk.crv === 'P-521';
+                        break;
+                    default:
+                }
+            }
+            return candidate;
+        });
+        const { 0: jwk, length } = candidates;
+        if (length === 0) {
+            throw new errors_js_1.JWKSNoMatchingKey();
+        }
+        else if (length !== 1) {
+            throw new errors_js_1.JWKSMultipleMatchingKeys();
+        }
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
+                throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
+            }
+            cached[joseHeader.alg] = keyObject;
+        }
+        return cached[joseHeader.alg];
+    }
+}
+exports.LocalJWKSet = LocalJWKSet;
+function createLocalJWKSet(jwks) {
+    return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));
+}
+exports.createLocalJWKSet = createLocalJWKSet;

package/dist/node/cjs/jwks/remote.js

@@ -2,28 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
-const import_js_1 = require("../key/import.js");
 const errors_js_1 = require("../util/errors.js");
-const is_object_js_1 = require("../lib/is_object.js");
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.slice(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new errors_js_1.JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKLike(key) {
-    return (0, is_object_js_1.default)(key);
-}
-class RemoteJWKSet {
+const local_js_1 = require("./local.js");
+class RemoteJWKSet extends local_js_1.LocalJWKSet {
     constructor(url, options) {
-        this._cached = new WeakMap();
+        super({ keys: [] });
+        this._jwks = undefined;
         if (!(url instanceof URL)) {
             throw new TypeError('url must be an instance of URL');
         }
@@ -41,78 +25,27 @@ class RemoteJWKSet {
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
         if (!this._jwks) {
             await this.reload();
         }
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && joseHeader.alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (joseHeader.alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                    default:
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            if (this.coolingDown() === false) {
-                await this.reload();
-                return this.getKey(protectedHeader, token);
-            }
-            throw new errors_js_1.JWKSNoMatchingKey();
-        }
-        else if (length !== 1) {
-            throw new errors_js_1.JWKSMultipleMatchingKeys();
+        try {
+            return await super.getKey(protectedHeader, token);
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
+        catch (err) {
+            if (err instanceof errors_js_1.JWKSNoMatchingKey) {
+                if (this.coolingDown() === false) {
+                    await this.reload();
+                    return super.getKey(protectedHeader, token);
+                }
             }
-            cached[joseHeader.alg] = keyObject;
+            throw err;
         }
-        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {
             this._pendingFetch = (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)
                 .then((json) => {
-                if (typeof json !== 'object' ||
-                    !json ||
-                    !Array.isArray(json.keys) ||
-                    !json.keys.every(isJWKLike)) {
+                if (!(0, local_js_1.isJWKSLike)(json)) {
                     throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };

package/dist/node/esm/index.js

@@ -16,6 +16,7 @@ export { SignJWT } from './jwt/sign.js';
 export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
+export { createLocalJWKSet } from './jwks/local.js';
 export { createRemoteJWKSet } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';

package/dist/node/esm/jwks/local.js

@@ -0,0 +1,101 @@
+import { importJWK } from '../key/import.js';
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
+import isObject from '../lib/is_object.js';
+function getKtyFromAlg(alg) {
+    switch (typeof alg === 'string' && alg.slice(0, 2)) {
+        case 'RS':
+        case 'PS':
+            return 'RSA';
+        case 'ES':
+            return 'EC';
+        case 'Ed':
+            return 'OKP';
+        default:
+            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+}
+export function isJWKSLike(jwks) {
+    return (jwks &&
+        typeof jwks === 'object' &&
+        Array.isArray(jwks.keys) &&
+        jwks.keys.every(isJWKLike));
+}
+function isJWKLike(key) {
+    return isObject(key);
+}
+function clone(obj) {
+    if (typeof structuredClone === 'function') {
+        return structuredClone(obj);
+    }
+    return JSON.parse(JSON.stringify(obj));
+}
+export class LocalJWKSet {
+    constructor(jwks) {
+        this._cached = new WeakMap();
+        if (!isJWKSLike(jwks)) {
+            throw new JWKSInvalid('JSON Web Key Set malformed');
+        }
+        this._jwks = clone(jwks);
+    }
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
+        const candidates = this._jwks.keys.filter((jwk) => {
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
+            }
+            if (candidate && typeof jwk.alg === 'string') {
+                candidate = joseHeader.alg === jwk.alg;
+            }
+            if (candidate && typeof jwk.use === 'string') {
+                candidate = jwk.use === 'sig';
+            }
+            if (candidate && Array.isArray(jwk.key_ops)) {
+                candidate = jwk.key_ops.includes('verify');
+            }
+            if (candidate && joseHeader.alg === 'EdDSA') {
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+            }
+            if (candidate) {
+                switch (joseHeader.alg) {
+                    case 'ES256':
+                        candidate = jwk.crv === 'P-256';
+                        break;
+                    case 'ES256K':
+                        candidate = jwk.crv === 'secp256k1';
+                        break;
+                    case 'ES384':
+                        candidate = jwk.crv === 'P-384';
+                        break;
+                    case 'ES512':
+                        candidate = jwk.crv === 'P-521';
+                        break;
+                    default:
+                }
+            }
+            return candidate;
+        });
+        const { 0: jwk, length } = candidates;
+        if (length === 0) {
+            throw new JWKSNoMatchingKey();
+        }
+        else if (length !== 1) {
+            throw new JWKSMultipleMatchingKeys();
+        }
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
+                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+            }
+            cached[joseHeader.alg] = keyObject;
+        }
+        return cached[joseHeader.alg];
+    }
+}
+export function createLocalJWKSet(jwks) {
+    return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));
+}

package/dist/node/esm/jwks/remote.js

@@ -1,26 +1,10 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
-import { importJWK } from '../key/import.js';
-import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.slice(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKLike(key) {
-    return isObject(key);
-}
-class RemoteJWKSet {
+import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
+import { isJWKSLike, LocalJWKSet } from './local.js';
+class RemoteJWKSet extends LocalJWKSet {
     constructor(url, options) {
-        this._cached = new WeakMap();
+        super({ keys: [] });
+        this._jwks = undefined;
         if (!(url instanceof URL)) {
             throw new TypeError('url must be an instance of URL');
         }
@@ -38,78 +22,27 @@ class RemoteJWKSet {
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
         if (!this._jwks) {
             await this.reload();
         }
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && joseHeader.alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (joseHeader.alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                    default:
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            if (this.coolingDown() === false) {
-                await this.reload();
-                return this.getKey(protectedHeader, token);
-            }
-            throw new JWKSNoMatchingKey();
-        }
-        else if (length !== 1) {
-            throw new JWKSMultipleMatchingKeys();
+        try {
+            return await super.getKey(protectedHeader, token);
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+        catch (err) {
+            if (err instanceof JWKSNoMatchingKey) {
+                if (this.coolingDown() === false) {
+                    await this.reload();
+                    return super.getKey(protectedHeader, token);
+                }
             }
-            cached[joseHeader.alg] = keyObject;
+            throw err;
         }
-        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {
             this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
                 .then((json) => {
-                if (typeof json !== 'object' ||
-                    !json ||
-                    !Array.isArray(json.keys) ||
-                    !json.keys.every(isJWKLike)) {
+                if (!isJWKSLike(json)) {
                     throw new JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };

package/dist/types/index.d.ts

@@ -27,6 +27,7 @@ export { SignJWT } from './jwt/sign';
 export { EncryptJWT } from './jwt/encrypt';
 export { calculateJwkThumbprint } from './jwk/thumbprint';
 export { EmbeddedJWK } from './jwk/embedded';
+export { createLocalJWKSet } from './jwks/local';
 export { createRemoteJWKSet } from './jwks/remote';
 export type { RemoteJWKSetOptions } from './jwks/remote';
 export { UnsecuredJWT } from './jwt/unsecured';
@@ -42,4 +43,4 @@ export type { GenerateKeyPairResult, GenerateKeyPairOptions } from './key/genera
 export { generateSecret } from './key/generate_secret';
 export type { GenerateSecretOptions } from './key/generate_secret';
 export * as base64url from './util/base64url';
-export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, } from './types';
+export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, JSONWebKeySet, } from './types';

package/dist/types/jwks/local.d.ts

@@ -0,0 +1,9 @@
+import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput, GetKeyFunction } from '../types';
+export declare function isJWKSLike(jwks: unknown): jwks is JSONWebKeySet;
+export declare class LocalJWKSet {
+    protected _jwks?: JSONWebKeySet;
+    private _cached;
+    constructor(jwks: unknown);
+    getKey(protectedHeader: JWSHeaderParameters, token: FlattenedJWSInput): Promise<KeyLike>;
+}
+export declare function createLocalJWKSet(jwks: JSONWebKeySet): GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;

package/dist/types/types.d.ts

@@ -268,3 +268,6 @@ export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
   alg: string
   enc: string
 }
+export interface JSONWebKeySet {
+  keys: JWK[]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.3.9",
+  "version": "4.4.0",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",