jose 4.4.0 → 4.5.2

package/README.md

@@ -42,10 +42,10 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 - JSON Web Tokens (JWT)
   - [Signing](docs/classes/jwt_sign.SignJWT.md#readme)
-  - [Verification & Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md#readme)
+  - [Verification & JWT Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md#readme)
   - Encrypted JSON Web Tokens
     - [Encryption](docs/classes/jwt_encrypt.EncryptJWT.md#readme)
-    - [Decryption & Claims Set Validation](docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
+    - [Decryption & JWT Claims Set Validation](docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
 - Key Import
   - [JWK Import](docs/functions/key_import.importJWK.md#readme)
   - [Public Key Import (SPKI)](docs/functions/key_import.importSPKI.md#readme)
@@ -72,6 +72,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
   - [Public Key Export](docs/functions/key_export.exportSPKI.md#readme)
 - Utilities
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
+  - [Decoding JWT Claims Set](docs/functions/util_decode_jwt.decodeJwt.md#readme)
 - [Unsecured JWT](docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
 - [JOSE Errors](docs/modules/util_errors.md#readme)
 
@@ -90,7 +91,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 | Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------- | --------- | -------- | -------- |
-| [4.x.x](https://github.com/panva/jose) | ✅ | ✅ | ✅ |
+| [4.x.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
 | [3.x.x](https://github.com/panva/jose/tree/v3.x) | ✅ | ✅ until 2022-04-30 | ❌ |
 | [2.x.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ✅ until 2022-04-30 | ❌ |
 | [1.x.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
@@ -135,16 +136,16 @@ install size should not be a cause for concern.
 
 [documentation]: /docs/README.md
 [node-jose]: https://github.com/cisco/node-jose
-[spec-b64]: https://tools.ietf.org/html/rfc7797
-[spec-cookbook]: https://tools.ietf.org/html/rfc7520
-[spec-jwa]: https://tools.ietf.org/html/rfc7518
-[spec-jwe]: https://tools.ietf.org/html/rfc7516
-[spec-jwk]: https://tools.ietf.org/html/rfc7517
-[spec-jws]: https://tools.ietf.org/html/rfc7515
-[spec-jwt]: https://tools.ietf.org/html/rfc7519
-[spec-okp]: https://tools.ietf.org/html/rfc8037
-[spec-secp256k1]: https://tools.ietf.org/html/rfc8812
-[spec-thumbprint]: https://tools.ietf.org/html/rfc7638
+[spec-b64]: https://www.rfc-editor.org/rfc/rfc7797
+[spec-cookbook]: https://www.rfc-editor.org/rfc/rfc7520
+[spec-jwa]: https://www.rfc-editor.org/rfc/rfc7518
+[spec-jwe]: https://www.rfc-editor.org/rfc/rfc7516
+[spec-jwk]: https://www.rfc-editor.org/rfc/rfc7517
+[spec-jws]: https://www.rfc-editor.org/rfc/rfc7515
+[spec-jwt]: https://www.rfc-editor.org/rfc/rfc7519
+[spec-okp]: https://www.rfc-editor.org/rfc/rfc8037
+[spec-secp256k1]: https://www.rfc-editor.org/rfc/rfc8812
+[spec-thumbprint]: https://www.rfc-editor.org/rfc/rfc7638
 [support-sponsor]: https://github.com/sponsors/panva
 [conditional-exports]: https://nodejs.org/api/packages.html#packages_conditional_exports
 [webcrypto]: https://www.w3.org/TR/WebCryptoAPI/

package/dist/browser/index.js

@@ -22,6 +22,7 @@ export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
 export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
 import * as errors_1 from './util/errors.js';
 export { errors_1 as errors };
 export { generateKeyPair } from './key/generate_key_pair.js';

package/dist/browser/jwe/compact/decrypt.js

@@ -13,7 +13,7 @@ export async function compactDecrypt(jwe, key, options) {
         throw new JWEInvalid('Invalid Compact JWE');
     }
     const decrypted = await flattenedDecrypt({
-        ciphertext: (ciphertext || undefined),
+        ciphertext,
         iv: (iv || undefined),
         protected: protectedHeader || undefined,
         tag: (tag || undefined),

package/dist/browser/jwk/thumbprint.js

@@ -12,6 +12,11 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    if (digestAlgorithm !== 'sha256' &&
+        digestAlgorithm !== 'sha384' &&
+        digestAlgorithm !== 'sha512') {
+        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+    }
     let components;
     switch (jwk.kty) {
         case 'EC':

package/dist/browser/jwks/local.js

@@ -38,17 +38,14 @@ export class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
+        const { alg, kid } = { ...protectedHeader, ...token.header };
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
+                candidate = alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -56,11 +53,11 @@ export class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && joseHeader.alg === 'EdDSA') {
+            if (candidate && alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (joseHeader.alg) {
+                switch (alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -73,7 +70,6 @@ export class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
-                    default:
                 }
             }
             return candidate;
@@ -86,14 +82,14 @@ export class LocalJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
+        if (cached[alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[joseHeader.alg] = keyObject;
+            cached[alg] = keyObject;
         }
-        return cached[joseHeader.alg];
+        return cached[alg];
     }
 }
 export function createLocalJWKSet(jwks) {

package/dist/browser/jwks/remote.js

@@ -1,4 +1,5 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
+import { isCloudflareWorkers } from '../runtime/env.js';
 import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
 import { isJWKSLike, LocalJWKSet } from './local.js';
 class RemoteJWKSet extends LocalJWKSet {
@@ -39,6 +40,19 @@ class RemoteJWKSet extends LocalJWKSet {
         }
     }
     async reload() {
+        if (this._pendingFetch && isCloudflareWorkers()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
                 .then((json) => {

package/dist/browser/lib/buffer_utils.js

@@ -1,3 +1,4 @@
+import digest from '../runtime/digest.js';
 export const encoder = new TextEncoder();
 export const decoder = new TextDecoder();
 const MAX_INT32 = 2 ** 32;
@@ -36,7 +37,7 @@ export function uint32be(value) {
 export function lengthAndInput(input) {
     return concat(uint32be(input.length), input);
 }
-export async function concatKdf(digest, secret, bits, value) {
+export async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
     let res;
     for (let iter = 1; iter <= iterations; iter++) {

package/dist/browser/runtime/ecdhes.js

@@ -1,7 +1,6 @@
 import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buffer_utils.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import digest from './digest.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
 export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
@@ -21,7 +20,7 @@ export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu
         name: 'ECDH',
         public: publicKey,
     }, privateKey, Math.ceil(parseInt(privateKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));
-    return concatKdf(digest, sharedSecret, keyLength, value);
+    return concatKdf(sharedSecret, keyLength, value);
 }
 export async function generateEpk(key) {
     if (!isCryptoKey(key)) {

package/dist/browser/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = base64url(payload);
+    }
+    catch (_a) {
+        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(decoder.decode(decoded));
+    }
+    catch (_b) {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -54,6 +54,8 @@ Object.defineProperty(exports, "importX509", { enumerable: true, get: function (
 Object.defineProperty(exports, "importJWK", { enumerable: true, get: function () { return import_js_1.importJWK; } });
 var decode_protected_header_js_1 = require("./util/decode_protected_header.js");
 Object.defineProperty(exports, "decodeProtectedHeader", { enumerable: true, get: function () { return decode_protected_header_js_1.decodeProtectedHeader; } });
+var decode_jwt_js_1 = require("./util/decode_jwt.js");
+Object.defineProperty(exports, "decodeJwt", { enumerable: true, get: function () { return decode_jwt_js_1.decodeJwt; } });
 exports.errors = require("./util/errors.js");
 var generate_key_pair_js_1 = require("./key/generate_key_pair.js");
 Object.defineProperty(exports, "generateKeyPair", { enumerable: true, get: function () { return generate_key_pair_js_1.generateKeyPair; } });

package/dist/node/cjs/jwe/compact/decrypt.js

@@ -16,7 +16,7 @@ async function compactDecrypt(jwe, key, options) {
         throw new errors_js_1.JWEInvalid('Invalid Compact JWE');
     }
     const decrypted = await (0, decrypt_js_1.flattenedDecrypt)({
-        ciphertext: (ciphertext || undefined),
+        ciphertext,
         iv: (iv || undefined),
         protected: protectedHeader || undefined,
         tag: (tag || undefined),

package/dist/node/cjs/jwk/thumbprint.js

@@ -15,6 +15,11 @@ async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     if (!(0, is_object_js_1.default)(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    if (digestAlgorithm !== 'sha256' &&
+        digestAlgorithm !== 'sha384' &&
+        digestAlgorithm !== 'sha512') {
+        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+    }
     let components;
     switch (jwk.kty) {
         case 'EC':

package/dist/node/cjs/jwks/local.js

@@ -42,17 +42,14 @@ class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
+        const { alg, kid } = { ...protectedHeader, ...token.header };
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
+                candidate = alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -60,11 +57,11 @@ class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && joseHeader.alg === 'EdDSA') {
+            if (candidate && alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (joseHeader.alg) {
+                switch (alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -77,7 +74,6 @@ class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
-                    default:
                 }
             }
             return candidate;
@@ -90,14 +86,14 @@ class LocalJWKSet {
             throw new errors_js_1.JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
+        if (cached[alg] === undefined) {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[joseHeader.alg] = keyObject;
+            cached[alg] = keyObject;
         }
-        return cached[joseHeader.alg];
+        return cached[alg];
     }
 }
 exports.LocalJWKSet = LocalJWKSet;

package/dist/node/cjs/jwks/remote.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
+const env_js_1 = require("../runtime/env.js");
 const errors_js_1 = require("../util/errors.js");
 const local_js_1 = require("./local.js");
 class RemoteJWKSet extends local_js_1.LocalJWKSet {
@@ -42,6 +43,19 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
         }
     }
     async reload() {
+        if (this._pendingFetch && (0, env_js_1.isCloudflareWorkers)()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)
                 .then((json) => {

package/dist/node/cjs/lib/buffer_utils.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.concatKdf = exports.lengthAndInput = exports.uint32be = exports.uint64be = exports.p2s = exports.concat = exports.decoder = exports.encoder = void 0;
+const digest_js_1 = require("../runtime/digest.js");
 exports.encoder = new TextEncoder();
 exports.decoder = new TextDecoder();
 const MAX_INT32 = 2 ** 32;
@@ -44,7 +45,7 @@ function lengthAndInput(input) {
     return concat(uint32be(input.length), input);
 }
 exports.lengthAndInput = lengthAndInput;
-async function concatKdf(digest, secret, bits, value) {
+async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
     let res;
     for (let iter = 1; iter <= iterations; iter++) {
@@ -53,10 +54,10 @@ async function concatKdf(digest, secret, bits, value) {
         buf.set(secret, 4);
         buf.set(value, 4 + secret.length);
         if (!res) {
-            res = await digest('sha256', buf);
+            res = await (0, digest_js_1.default)('sha256', buf);
         }
         else {
-            res = concat(res, await digest('sha256', buf));
+            res = concat(res, await (0, digest_js_1.default)('sha256', buf));
         }
     }
     res = res.slice(0, bits >> 3);

package/dist/node/cjs/runtime/base64url.js

@@ -3,7 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.decode = exports.encode = exports.encodeBase64 = exports.decodeBase64 = void 0;
 const buffer_1 = require("buffer");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-let encodeImpl;
+let encode;
+exports.encode = encode;
 function normalize(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {
@@ -12,15 +13,14 @@ function normalize(input) {
     return encoded;
 }
 if (buffer_1.Buffer.isEncoding('base64url')) {
-    encodeImpl = (input) => buffer_1.Buffer.from(input).toString('base64url');
+    exports.encode = encode = (input) => buffer_1.Buffer.from(input).toString('base64url');
 }
 else {
-    encodeImpl = (input) => buffer_1.Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    exports.encode = encode = (input) => buffer_1.Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 const decodeBase64 = (input) => buffer_1.Buffer.from(input, 'base64');
 exports.decodeBase64 = decodeBase64;
 const encodeBase64 = (input) => buffer_1.Buffer.from(input).toString('base64');
 exports.encodeBase64 = encodeBase64;
-exports.encode = encodeImpl;
 const decode = (input) => buffer_1.Buffer.from(normalize(input), 'base64');
 exports.decode = decode;

package/dist/node/cjs/runtime/ecdhes.js

@@ -5,7 +5,6 @@ const crypto_1 = require("crypto");
 const util_1 = require("util");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const digest_js_1 = require("./digest.js");
 const errors_js_1 = require("../util/errors.js");
 const webcrypto_js_1 = require("./webcrypto.js");
 const crypto_key_js_1 = require("../lib/crypto_key.js");
@@ -38,7 +37,7 @@ async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new
     }
     const value = (0, buffer_utils_js_1.concat)((0, buffer_utils_js_1.lengthAndInput)(buffer_utils_js_1.encoder.encode(algorithm)), (0, buffer_utils_js_1.lengthAndInput)(apu), (0, buffer_utils_js_1.lengthAndInput)(apv), (0, buffer_utils_js_1.uint32be)(keyLength));
     const sharedSecret = (0, crypto_1.diffieHellman)({ privateKey, publicKey });
-    return (0, buffer_utils_js_1.concatKdf)(digest_js_1.default, sharedSecret, keyLength, value);
+    return (0, buffer_utils_js_1.concatKdf)(sharedSecret, keyLength, value);
 }
 exports.deriveKey = deriveKey;
 async function generateEpk(kee) {

package/dist/node/cjs/util/decode_jwt.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwt = void 0;
+const base64url_js_1 = require("./base64url.js");
+const buffer_utils_js_1 = require("../lib/buffer_utils.js");
+const is_object_js_1 = require("../lib/is_object.js");
+const errors_js_1 = require("./errors.js");
+function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new errors_js_1.JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new errors_js_1.JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new errors_js_1.JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new errors_js_1.JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = (0, base64url_js_1.decode)(payload);
+    }
+    catch {
+        throw new errors_js_1.JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(buffer_utils_js_1.decoder.decode(decoded));
+    }
+    catch {
+        throw new errors_js_1.JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!(0, is_object_js_1.default)(result))
+        throw new errors_js_1.JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}
+exports.decodeJwt = decodeJwt;

package/dist/node/esm/index.js

@@ -22,6 +22,7 @@ export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
 export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
 export * as errors from './util/errors.js';
 export { generateKeyPair } from './key/generate_key_pair.js';
 export { generateSecret } from './key/generate_secret.js';

package/dist/node/esm/jwe/compact/decrypt.js

@@ -13,7 +13,7 @@ export async function compactDecrypt(jwe, key, options) {
         throw new JWEInvalid('Invalid Compact JWE');
     }
     const decrypted = await flattenedDecrypt({
-        ciphertext: (ciphertext || undefined),
+        ciphertext,
         iv: (iv || undefined),
         protected: protectedHeader || undefined,
         tag: (tag || undefined),

package/dist/node/esm/jwk/thumbprint.js

@@ -12,6 +12,11 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    if (digestAlgorithm !== 'sha256' &&
+        digestAlgorithm !== 'sha384' &&
+        digestAlgorithm !== 'sha512') {
+        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+    }
     let components;
     switch (jwk.kty) {
         case 'EC':

package/dist/node/esm/jwks/local.js

@@ -38,17 +38,14 @@ export class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
+        const { alg, kid } = { ...protectedHeader, ...token.header };
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
+                candidate = alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -56,11 +53,11 @@ export class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && joseHeader.alg === 'EdDSA') {
+            if (candidate && alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (joseHeader.alg) {
+                switch (alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -73,7 +70,6 @@ export class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
-                    default:
                 }
             }
             return candidate;
@@ -86,14 +82,14 @@ export class LocalJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
+        if (cached[alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[joseHeader.alg] = keyObject;
+            cached[alg] = keyObject;
         }
-        return cached[joseHeader.alg];
+        return cached[alg];
     }
 }
 export function createLocalJWKSet(jwks) {

package/dist/node/esm/jwks/remote.js

@@ -1,4 +1,5 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
+import { isCloudflareWorkers } from '../runtime/env.js';
 import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
 import { isJWKSLike, LocalJWKSet } from './local.js';
 class RemoteJWKSet extends LocalJWKSet {
@@ -39,6 +40,19 @@ class RemoteJWKSet extends LocalJWKSet {
         }
     }
     async reload() {
+        if (this._pendingFetch && isCloudflareWorkers()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
                 .then((json) => {

package/dist/node/esm/lib/buffer_utils.js

@@ -1,3 +1,4 @@
+import digest from '../runtime/digest.js';
 export const encoder = new TextEncoder();
 export const decoder = new TextDecoder();
 const MAX_INT32 = 2 ** 32;
@@ -36,7 +37,7 @@ export function uint32be(value) {
 export function lengthAndInput(input) {
     return concat(uint32be(input.length), input);
 }
-export async function concatKdf(digest, secret, bits, value) {
+export async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
     let res;
     for (let iter = 1; iter <= iterations; iter++) {

package/dist/node/esm/runtime/base64url.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer';
 import { decoder } from '../lib/buffer_utils.js';
-let encodeImpl;
+let encode;
 function normalize(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {
@@ -9,12 +9,12 @@ function normalize(input) {
     return encoded;
 }
 if (Buffer.isEncoding('base64url')) {
-    encodeImpl = (input) => Buffer.from(input).toString('base64url');
+    encode = (input) => Buffer.from(input).toString('base64url');
 }
 else {
-    encodeImpl = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    encode = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 export const decodeBase64 = (input) => Buffer.from(input, 'base64');
 export const encodeBase64 = (input) => Buffer.from(input).toString('base64');
-export const encode = encodeImpl;
+export { encode };
 export const decode = (input) => Buffer.from(normalize(input), 'base64');

package/dist/node/esm/runtime/ecdhes.js

@@ -2,7 +2,6 @@ import { diffieHellman, generateKeyPair as generateKeyPairCb, KeyObject } from '
 import { promisify } from 'util';
 import getNamedCurve from './get_named_curve.js';
 import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buffer_utils.js';
-import digest from './digest.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
@@ -35,7 +34,7 @@ export async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu
     }
     const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
     const sharedSecret = diffieHellman({ privateKey, publicKey });
-    return concatKdf(digest, sharedSecret, keyLength, value);
+    return concatKdf(sharedSecret, keyLength, value);
 }
 export async function generateEpk(kee) {
     let key;

package/dist/node/esm/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = base64url(payload);
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(decoder.decode(decoded));
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/dist/types/index.d.ts

@@ -36,6 +36,7 @@ export { exportPKCS8, exportSPKI, exportJWK } from './key/export';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import';
 export type { PEMImportOptions } from './key/import';
 export { decodeProtectedHeader } from './util/decode_protected_header';
+export { decodeJwt } from './util/decode_jwt';
 export type { ProtectedHeaderParameters } from './util/decode_protected_header';
 export * as errors from './util/errors';
 export { generateKeyPair } from './key/generate_key_pair';

package/dist/types/types.d.ts

@@ -118,7 +118,7 @@ export interface JWK {
   [propName: string]: unknown
 }
 export interface GetKeyFunction<T, T2> {
-  (protectedHeader: T, token: T2): Promise<KeyLike | Uint8Array>
+  (protectedHeader: T, token: T2): Promise<KeyLike | Uint8Array> | KeyLike | Uint8Array
 }
 export interface FlattenedJWSInput {
   header?: JWSHeaderParameters

package/dist/types/util/decode_jwt.d.ts

@@ -0,0 +1,2 @@
+import type { JWTPayload } from '../types';
+export declare function decodeJwt(jwt: string): JWTPayload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.4.0",
+  "version": "4.5.2",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",