jose 4.5.3 → 4.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/browser/jwe/general/encrypt.js +8 -1
- package/dist/browser/jwks/local.js +2 -1
- package/dist/browser/lib/buffer_utils.js +5 -11
- package/dist/browser/lib/crypto_key.js +1 -1
- package/dist/browser/lib/decrypt_key_management.js +1 -1
- package/dist/browser/lib/encrypt_key_management.js +1 -1
- package/dist/browser/lib/jwt_claims_set.js +2 -7
- package/dist/browser/runtime/base64url.js +6 -3
- package/dist/browser/runtime/ecdhes.js +2 -5
- package/dist/browser/runtime/pbes2kw.js +1 -1
- package/dist/node/cjs/jwe/general/encrypt.js +8 -1
- package/dist/node/cjs/jwks/local.js +2 -1
- package/dist/node/cjs/lib/buffer_utils.js +5 -11
- package/dist/node/cjs/lib/crypto_key.js +1 -1
- package/dist/node/cjs/lib/decrypt_key_management.js +1 -1
- package/dist/node/cjs/lib/encrypt_key_management.js +1 -1
- package/dist/node/cjs/lib/jwt_claims_set.js +2 -7
- package/dist/node/cjs/runtime/ecdhes.js +2 -2
- package/dist/node/cjs/runtime/generate.js +3 -2
- package/dist/node/cjs/runtime/pbes2kw.js +1 -1
- package/dist/node/esm/jwe/general/encrypt.js +8 -1
- package/dist/node/esm/jwks/local.js +2 -1
- package/dist/node/esm/lib/buffer_utils.js +5 -11
- package/dist/node/esm/lib/crypto_key.js +1 -1
- package/dist/node/esm/lib/decrypt_key_management.js +1 -1
- package/dist/node/esm/lib/encrypt_key_management.js +1 -1
- package/dist/node/esm/lib/jwt_claims_set.js +2 -7
- package/dist/node/esm/runtime/ecdhes.js +2 -2
- package/dist/node/esm/runtime/generate.js +3 -2
- package/dist/node/esm/runtime/pbes2kw.js +1 -1
- package/dist/types/jwe/compact/decrypt.d.ts +26 -0
- package/dist/types/jwe/compact/encrypt.d.ts +56 -0
- package/dist/types/jwe/flattened/decrypt.d.ts +39 -0
- package/dist/types/jwe/flattened/encrypt.d.ts +77 -0
- package/dist/types/jwe/general/decrypt.d.ts +43 -0
- package/dist/types/jwe/general/encrypt.d.ts +63 -0
- package/dist/types/jwk/embedded.d.ts +20 -0
- package/dist/types/jwk/thumbprint.d.ts +19 -0
- package/dist/types/jwks/local.d.ts +42 -0
- package/dist/types/jwks/remote.d.ts +44 -0
- package/dist/types/jws/compact/sign.d.ts +30 -0
- package/dist/types/jws/compact/verify.d.ts +29 -0
- package/dist/types/jws/flattened/sign.d.ts +35 -0
- package/dist/types/jws/flattened/verify.d.ts +34 -0
- package/dist/types/jws/general/sign.d.ts +50 -0
- package/dist/types/jws/general/verify.d.ts +37 -0
- package/dist/types/jwt/decrypt.d.ts +32 -0
- package/dist/types/jwt/encrypt.d.ts +68 -0
- package/dist/types/jwt/produce.d.ts +46 -0
- package/dist/types/jwt/sign.d.ts +28 -0
- package/dist/types/jwt/unsecured.d.ts +34 -0
- package/dist/types/jwt/verify.d.ts +35 -0
- package/dist/types/key/export.d.ts +38 -0
- package/dist/types/key/generate_key_pair.d.ts +38 -0
- package/dist/types/key/generate_secret.d.ts +20 -0
- package/dist/types/key/import.d.ts +96 -0
- package/dist/types/types.d.ts +499 -2
- package/dist/types/util/base64url.d.ts +10 -0
- package/dist/types/util/decode_jwt.d.ts +14 -0
- package/dist/types/util/decode_protected_header.d.ts +11 -0
- package/dist/types/util/errors.d.ts +65 -0
- package/package.json +1 -1
|
@@ -1,7 +1,39 @@
|
|
|
1
1
|
import type { KeyLike, DecryptOptions, JWTClaimVerificationOptions, GetKeyFunction, CompactJWEHeaderParameters, FlattenedJWE, JWTDecryptResult, ResolvedKey } from '../types';
|
|
2
|
+
/**
|
|
3
|
+
* Combination of JWE Decryption options and JWT Claims Set verification options.
|
|
4
|
+
*/
|
|
2
5
|
export interface JWTDecryptOptions extends DecryptOptions, JWTClaimVerificationOptions {
|
|
3
6
|
}
|
|
7
|
+
/**
|
|
8
|
+
* Interface for JWT Decryption dynamic key resolution.
|
|
9
|
+
* No token components have been verified at the time of this function call.
|
|
10
|
+
*/
|
|
4
11
|
export interface JWTDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
|
|
5
12
|
}
|
|
13
|
+
/**
|
|
14
|
+
* Verifies the JWT format (to be a JWE Compact format), decrypts the ciphertext, validates the JWT Claims Set.
|
|
15
|
+
*
|
|
16
|
+
* @param jwt JSON Web Token value (encoded as JWE).
|
|
17
|
+
* @param key Private Key or Secret to decrypt and verify the JWT with.
|
|
18
|
+
* @param options JWT Decryption and JWT Claims Set validation options.
|
|
19
|
+
*
|
|
20
|
+
* @example Usage
|
|
21
|
+
* ```js
|
|
22
|
+
* const jwt = 'eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..KVcNLqK-3-8ZkYIC.xSwF4VxO0kUMUD2W-cifsNUxnr-swyBq-nADBptyt6y9n79-iNc5b0AALJpRwc0wwDkJw8hNOMjApNUTMsK9b-asToZ3DXFMvwfJ6n1aWefvd7RsoZ2LInWFfVAuttJDzoGB.uuexQoWHwrLMEYRElT8pBQ'
|
|
23
|
+
*
|
|
24
|
+
* const { payload, protectedHeader } = await jose.jwtDecrypt(jwt, secretKey, {
|
|
25
|
+
* issuer: 'urn:example:issuer',
|
|
26
|
+
* audience: 'urn:example:audience'
|
|
27
|
+
* })
|
|
28
|
+
*
|
|
29
|
+
* console.log(protectedHeader)
|
|
30
|
+
* console.log(payload)
|
|
31
|
+
* ```
|
|
32
|
+
*/
|
|
6
33
|
export declare function jwtDecrypt(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTDecryptOptions): Promise<JWTDecryptResult>;
|
|
34
|
+
/**
|
|
35
|
+
* @param jwt JSON Web Token value (encoded as JWE).
|
|
36
|
+
* @param getKey Function resolving Private Key or Secret to decrypt and verify the JWT with.
|
|
37
|
+
* @param options JWT Decryption and JWT Claims Set validation options.
|
|
38
|
+
*/
|
|
7
39
|
export declare function jwtDecrypt(jwt: string | Uint8Array, getKey: JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<JWTDecryptResult & ResolvedKey>;
|
|
@@ -1,5 +1,21 @@
|
|
|
1
1
|
import type { EncryptOptions, CompactJWEHeaderParameters, JWEKeyManagementHeaderParameters, KeyLike } from '../types';
|
|
2
2
|
import { ProduceJWT } from './produce';
|
|
3
|
+
/**
|
|
4
|
+
* The EncryptJWT class is a utility for creating Compact JWE formatted JWT strings.
|
|
5
|
+
*
|
|
6
|
+
* @example Usage
|
|
7
|
+
* ```js
|
|
8
|
+
* const jwt = await new jose.EncryptJWT({ 'urn:example:claim': true })
|
|
9
|
+
* .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
|
|
10
|
+
* .setIssuedAt()
|
|
11
|
+
* .setIssuer('urn:example:issuer')
|
|
12
|
+
* .setAudience('urn:example:audience')
|
|
13
|
+
* .setExpirationTime('2h')
|
|
14
|
+
* .encrypt(secretKey)
|
|
15
|
+
*
|
|
16
|
+
* console.log(jwt)
|
|
17
|
+
* ```
|
|
18
|
+
*/
|
|
3
19
|
export declare class EncryptJWT extends ProduceJWT {
|
|
4
20
|
private _cek;
|
|
5
21
|
private _iv;
|
|
@@ -8,12 +24,64 @@ export declare class EncryptJWT extends ProduceJWT {
|
|
|
8
24
|
private _replicateIssuerAsHeader;
|
|
9
25
|
private _replicateSubjectAsHeader;
|
|
10
26
|
private _replicateAudienceAsHeader;
|
|
27
|
+
/**
|
|
28
|
+
* Sets the JWE Protected Header on the EncryptJWT object.
|
|
29
|
+
*
|
|
30
|
+
* @param protectedHeader JWE Protected Header.
|
|
31
|
+
* Must contain an "alg" (JWE Algorithm) and "enc" (JWE
|
|
32
|
+
* Encryption Algorithm) properties.
|
|
33
|
+
*/
|
|
11
34
|
setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
|
|
35
|
+
/**
|
|
36
|
+
* Sets the JWE Key Management parameters to be used when encrypting.
|
|
37
|
+
* Use of this is method is really only needed for ECDH based algorithms
|
|
38
|
+
* when utilizing the Agreement PartyUInfo or Agreement PartyVInfo parameters.
|
|
39
|
+
* Other parameters will always be randomly generated when needed and missing.
|
|
40
|
+
*
|
|
41
|
+
* @param parameters JWE Key Management parameters.
|
|
42
|
+
*/
|
|
12
43
|
setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
|
|
44
|
+
/**
|
|
45
|
+
* Sets a content encryption key to use, by default a random suitable one
|
|
46
|
+
* is generated for the JWE enc" (Encryption Algorithm) Header Parameter.
|
|
47
|
+
*
|
|
48
|
+
* @param cek JWE Content Encryption Key.
|
|
49
|
+
*
|
|
50
|
+
* @deprecated You should not use this method. It is only really intended
|
|
51
|
+
* for test and vector validation purposes.
|
|
52
|
+
*/
|
|
13
53
|
setContentEncryptionKey(cek: Uint8Array): this;
|
|
54
|
+
/**
|
|
55
|
+
* Sets the JWE Initialization Vector to use for content encryption, by default
|
|
56
|
+
* a random suitable one is generated for the JWE enc" (Encryption Algorithm)
|
|
57
|
+
* Header Parameter.
|
|
58
|
+
*
|
|
59
|
+
* @param iv JWE Initialization Vector.
|
|
60
|
+
*
|
|
61
|
+
* @deprecated You should not use this method. It is only really intended
|
|
62
|
+
* for test and vector validation purposes.
|
|
63
|
+
*/
|
|
14
64
|
setInitializationVector(iv: Uint8Array): this;
|
|
65
|
+
/**
|
|
66
|
+
* Replicates the "iss" (Issuer) Claim as a JWE Protected Header Parameter as per
|
|
67
|
+
* [RFC7519#section-5.3](https://www.rfc-editor.org/rfc/rfc7519#section-5.3).
|
|
68
|
+
*/
|
|
15
69
|
replicateIssuerAsHeader(): this;
|
|
70
|
+
/**
|
|
71
|
+
* Replicates the "sub" (Subject) Claim as a JWE Protected Header Parameter as per
|
|
72
|
+
* [RFC7519#section-5.3](https://www.rfc-editor.org/rfc/rfc7519#section-5.3).
|
|
73
|
+
*/
|
|
16
74
|
replicateSubjectAsHeader(): this;
|
|
75
|
+
/**
|
|
76
|
+
* Replicates the "aud" (Audience) Claim as a JWE Protected Header Parameter as per
|
|
77
|
+
* [RFC7519#section-5.3](https://www.rfc-editor.org/rfc/rfc7519#section-5.3).
|
|
78
|
+
*/
|
|
17
79
|
replicateAudienceAsHeader(): this;
|
|
80
|
+
/**
|
|
81
|
+
* Encrypts and returns the JWT.
|
|
82
|
+
*
|
|
83
|
+
* @param key Public Key or Secret to encrypt the JWT with.
|
|
84
|
+
* @param options JWE Encryption options.
|
|
85
|
+
*/
|
|
18
86
|
encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<string>;
|
|
19
87
|
}
|
|
@@ -1,12 +1,58 @@
|
|
|
1
1
|
import type { JWTPayload } from '../types';
|
|
2
|
+
/**
|
|
3
|
+
* Generic class for JWT producing.
|
|
4
|
+
*/
|
|
2
5
|
export declare class ProduceJWT {
|
|
3
6
|
protected _payload: JWTPayload;
|
|
7
|
+
/**
|
|
8
|
+
* @param payload The JWT Claims Set object.
|
|
9
|
+
*/
|
|
4
10
|
constructor(payload: JWTPayload);
|
|
11
|
+
/**
|
|
12
|
+
* Set "iss" (Issuer) Claim.
|
|
13
|
+
*
|
|
14
|
+
* @param issuer "Issuer" Claim value to set on the JWT Claims Set.
|
|
15
|
+
*/
|
|
5
16
|
setIssuer(issuer: string): this;
|
|
17
|
+
/**
|
|
18
|
+
* Set "sub" (Subject) Claim.
|
|
19
|
+
*
|
|
20
|
+
* @param subject "sub" (Subject) Claim value to set on the JWT Claims Set.
|
|
21
|
+
*/
|
|
6
22
|
setSubject(subject: string): this;
|
|
23
|
+
/**
|
|
24
|
+
* Set "aud" (Audience) Claim.
|
|
25
|
+
*
|
|
26
|
+
* @param audience "aud" (Audience) Claim value to set on the JWT Claims Set.
|
|
27
|
+
*/
|
|
7
28
|
setAudience(audience: string | string[]): this;
|
|
29
|
+
/**
|
|
30
|
+
* Set "jti" (JWT ID) Claim.
|
|
31
|
+
*
|
|
32
|
+
* @param jwtId "jti" (JWT ID) Claim value to set on the JWT Claims Set.
|
|
33
|
+
*/
|
|
8
34
|
setJti(jwtId: string): this;
|
|
35
|
+
/**
|
|
36
|
+
* Set "nbf" (Not Before) Claim.
|
|
37
|
+
*
|
|
38
|
+
* @param input "nbf" (Not Before) Claim value to set on the JWT Claims Set.
|
|
39
|
+
* When number is passed that is used as a value, when string is passed
|
|
40
|
+
* it is resolved to a time span and added to the current timestamp.
|
|
41
|
+
*/
|
|
9
42
|
setNotBefore(input: number | string): this;
|
|
43
|
+
/**
|
|
44
|
+
* Set "exp" (Expiration Time) Claim.
|
|
45
|
+
*
|
|
46
|
+
* @param input "exp" (Expiration Time) Claim value to set on the JWT Claims Set.
|
|
47
|
+
* When number is passed that is used as a value, when string is passed
|
|
48
|
+
* it is resolved to a time span and added to the current timestamp.
|
|
49
|
+
*/
|
|
10
50
|
setExpirationTime(input: number | string): this;
|
|
51
|
+
/**
|
|
52
|
+
* Set "iat" (Issued At) Claim.
|
|
53
|
+
*
|
|
54
|
+
* @param input "iat" (Issued At) Claim value to set on the JWT Claims Set.
|
|
55
|
+
* Default is current timestamp.
|
|
56
|
+
*/
|
|
11
57
|
setIssuedAt(input?: number): this;
|
|
12
58
|
}
|
package/dist/types/jwt/sign.d.ts
CHANGED
|
@@ -1,7 +1,35 @@
|
|
|
1
1
|
import type { JWTHeaderParameters, KeyLike, SignOptions } from '../types';
|
|
2
2
|
import { ProduceJWT } from './produce';
|
|
3
|
+
/**
|
|
4
|
+
* The SignJWT class is a utility for creating Compact JWS formatted JWT strings.
|
|
5
|
+
*
|
|
6
|
+
* @example Usage
|
|
7
|
+
* ```js
|
|
8
|
+
* const jwt = await new jose.SignJWT({ 'urn:example:claim': true })
|
|
9
|
+
* .setProtectedHeader({ alg: 'ES256' })
|
|
10
|
+
* .setIssuedAt()
|
|
11
|
+
* .setIssuer('urn:example:issuer')
|
|
12
|
+
* .setAudience('urn:example:audience')
|
|
13
|
+
* .setExpirationTime('2h')
|
|
14
|
+
* .sign(privateKey)
|
|
15
|
+
*
|
|
16
|
+
* console.log(jwt)
|
|
17
|
+
* ```
|
|
18
|
+
*/
|
|
3
19
|
export declare class SignJWT extends ProduceJWT {
|
|
4
20
|
private _protectedHeader;
|
|
21
|
+
/**
|
|
22
|
+
* Sets the JWS Protected Header on the SignJWT object.
|
|
23
|
+
*
|
|
24
|
+
* @param protectedHeader JWS Protected Header.
|
|
25
|
+
* Must contain an "alg" (JWS Algorithm) property.
|
|
26
|
+
*/
|
|
5
27
|
setProtectedHeader(protectedHeader: JWTHeaderParameters): this;
|
|
28
|
+
/**
|
|
29
|
+
* Signs and returns the JWT.
|
|
30
|
+
*
|
|
31
|
+
* @param key Private Key or Secret to sign the JWT with.
|
|
32
|
+
* @param options JWT Sign options.
|
|
33
|
+
*/
|
|
6
34
|
sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
|
|
7
35
|
}
|
|
@@ -4,7 +4,41 @@ export interface UnsecuredResult {
|
|
|
4
4
|
payload: JWTPayload;
|
|
5
5
|
header: JWSHeaderParameters;
|
|
6
6
|
}
|
|
7
|
+
/**
|
|
8
|
+
* The UnsecuredJWT class is a utility for dealing with `{ "alg": "none" }` Unsecured JWTs.
|
|
9
|
+
*
|
|
10
|
+
* @example Encoding
|
|
11
|
+
* ```js
|
|
12
|
+
* const unsecuredJwt = new jose.UnsecuredJWT({ 'urn:example:claim': true })
|
|
13
|
+
* .setIssuedAt()
|
|
14
|
+
* .setIssuer('urn:example:issuer')
|
|
15
|
+
* .setAudience('urn:example:audience')
|
|
16
|
+
* .setExpirationTime('2h')
|
|
17
|
+
* .encode()
|
|
18
|
+
*
|
|
19
|
+
* console.log(unsecuredJwt)
|
|
20
|
+
* ```
|
|
21
|
+
*
|
|
22
|
+
* @example Decoding
|
|
23
|
+
* ```js
|
|
24
|
+
* const payload = jose.UnsecuredJWT.decode(jwt, {
|
|
25
|
+
* issuer: 'urn:example:issuer',
|
|
26
|
+
* audience: 'urn:example:audience'
|
|
27
|
+
* })
|
|
28
|
+
*
|
|
29
|
+
* console.log(payload)
|
|
30
|
+
* ```
|
|
31
|
+
*/
|
|
7
32
|
export declare class UnsecuredJWT extends ProduceJWT {
|
|
33
|
+
/**
|
|
34
|
+
* Encodes the Unsecured JWT.
|
|
35
|
+
*/
|
|
8
36
|
encode(): string;
|
|
37
|
+
/**
|
|
38
|
+
* Decodes an unsecured JWT.
|
|
39
|
+
*
|
|
40
|
+
* @param jwt Unsecured JWT to decode the payload of.
|
|
41
|
+
* @param options JWT Claims Set validation options.
|
|
42
|
+
*/
|
|
9
43
|
static decode(jwt: string, options?: JWTClaimVerificationOptions): UnsecuredResult;
|
|
10
44
|
}
|
|
@@ -1,7 +1,42 @@
|
|
|
1
1
|
import type { KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWTHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
|
|
2
|
+
/**
|
|
3
|
+
* Combination of JWS Verification options and JWT Claims Set verification options.
|
|
4
|
+
*/
|
|
2
5
|
export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOptions {
|
|
3
6
|
}
|
|
7
|
+
/**
|
|
8
|
+
* Interface for JWT Verification dynamic key resolution.
|
|
9
|
+
* No token components have been verified at the time of this function call.
|
|
10
|
+
*
|
|
11
|
+
* See [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset)
|
|
12
|
+
* to verify using a remote JSON Web Key Set.
|
|
13
|
+
*/
|
|
4
14
|
export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, FlattenedJWSInput> {
|
|
5
15
|
}
|
|
16
|
+
/**
|
|
17
|
+
* Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the JWT Claims Set.
|
|
18
|
+
*
|
|
19
|
+
* @param jwt JSON Web Token value (encoded as JWS).
|
|
20
|
+
* @param key Key to verify the JWT with.
|
|
21
|
+
* @param options JWT Decryption and JWT Claims Set validation options.
|
|
22
|
+
*
|
|
23
|
+
* @example Usage
|
|
24
|
+
* ```js
|
|
25
|
+
* const jwt = 'eyJhbGciOiJFUzI1NiJ9.eyJ1cm46ZXhhbXBsZTpjbGFpbSI6dHJ1ZSwiaWF0IjoxNjA0MzE1MDc0LCJpc3MiOiJ1cm46ZXhhbXBsZTppc3N1ZXIiLCJhdWQiOiJ1cm46ZXhhbXBsZTphdWRpZW5jZSJ9.hx1nOfAT5LlXuzu8O-bhjXBGpklWDt2EsHw7-MDn49NrnwvVsstNhEnkW2ddauB7eSikFtUNeumLpFI9CWDBsg'
|
|
26
|
+
*
|
|
27
|
+
* const { payload, protectedHeader } = await jose.jwtVerify(jwt, publicKey, {
|
|
28
|
+
* issuer: 'urn:example:issuer',
|
|
29
|
+
* audience: 'urn:example:audience'
|
|
30
|
+
* })
|
|
31
|
+
*
|
|
32
|
+
* console.log(protectedHeader)
|
|
33
|
+
* console.log(payload)
|
|
34
|
+
* ```
|
|
35
|
+
*/
|
|
6
36
|
export declare function jwtVerify(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTVerifyOptions): Promise<JWTVerifyResult>;
|
|
37
|
+
/**
|
|
38
|
+
* @param jwt JSON Web Token value (encoded as JWS).
|
|
39
|
+
* @param getKey Function resolving a key to verify the JWT with.
|
|
40
|
+
* @param options JWT Decryption and JWT Claims Set validation options.
|
|
41
|
+
*/
|
|
7
42
|
export declare function jwtVerify(jwt: string | Uint8Array, getKey: JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<JWTVerifyResult & ResolvedKey>;
|
|
@@ -1,4 +1,42 @@
|
|
|
1
1
|
import type { JWK, KeyLike } from '../types';
|
|
2
|
+
/**
|
|
3
|
+
* Exports a runtime-specific public key representation (KeyObject or CryptoKey) to an PEM-encoded SPKI string format.
|
|
4
|
+
*
|
|
5
|
+
* @param key Key representation to transform to an PEM-encoded SPKI string format.
|
|
6
|
+
*
|
|
7
|
+
* @example Usage
|
|
8
|
+
* ```js
|
|
9
|
+
* const spkiPem = await jose.exportSPKI(publicKey)
|
|
10
|
+
*
|
|
11
|
+
* console.log(spkiPem)
|
|
12
|
+
* ```
|
|
13
|
+
*/
|
|
2
14
|
export declare function exportSPKI(key: KeyLike): Promise<string>;
|
|
15
|
+
/**
|
|
16
|
+
* Exports a runtime-specific private key representation (KeyObject or CryptoKey) to an PEM-encoded PKCS8 string format.
|
|
17
|
+
*
|
|
18
|
+
* @param key Key representation to transform to an PEM-encoded PKCS8 string format.
|
|
19
|
+
*
|
|
20
|
+
* @example Usage
|
|
21
|
+
* ```js
|
|
22
|
+
* const pkcs8Pem = await jose.exportPKCS8(privateKey)
|
|
23
|
+
*
|
|
24
|
+
* console.log(pkcs8Pem)
|
|
25
|
+
* ```
|
|
26
|
+
*/
|
|
3
27
|
export declare function exportPKCS8(key: KeyLike): Promise<string>;
|
|
28
|
+
/**
|
|
29
|
+
* Exports a runtime-specific key representation (KeyLike) to a JWK.
|
|
30
|
+
*
|
|
31
|
+
* @param key Key representation to export as JWK.
|
|
32
|
+
*
|
|
33
|
+
* @example Usage
|
|
34
|
+
* ```js
|
|
35
|
+
* const privateJwk = await jose.exportJWK(privateKey)
|
|
36
|
+
* const publicJwk = await jose.exportJWK(publicKey)
|
|
37
|
+
*
|
|
38
|
+
* console.log(privateJwk)
|
|
39
|
+
* console.log(publicJwk)
|
|
40
|
+
* ```
|
|
41
|
+
*/
|
|
4
42
|
export declare function exportJWK(key: KeyLike | Uint8Array): Promise<JWK>;
|
|
@@ -1,11 +1,49 @@
|
|
|
1
1
|
import type { KeyLike } from '../types';
|
|
2
2
|
export interface GenerateKeyPairResult {
|
|
3
|
+
/**
|
|
4
|
+
* The generated Private Key.
|
|
5
|
+
*/
|
|
3
6
|
privateKey: KeyLike;
|
|
7
|
+
/**
|
|
8
|
+
* Public Key corresponding to the generated Private Key.
|
|
9
|
+
*/
|
|
4
10
|
publicKey: KeyLike;
|
|
5
11
|
}
|
|
6
12
|
export interface GenerateKeyPairOptions {
|
|
13
|
+
/**
|
|
14
|
+
* The EC "crv" (Curve) or OKP "crv" (Subtype of Key Pair) value to generate.
|
|
15
|
+
* The curve must be both supported on the runtime as well as applicable for
|
|
16
|
+
* the given JWA algorithm identifier.
|
|
17
|
+
*/
|
|
7
18
|
crv?: string;
|
|
19
|
+
/**
|
|
20
|
+
* A hint for RSA algorithms to generate an RSA key of a given `modulusLength`
|
|
21
|
+
* (Key size in bits). JOSE requires 2048 bits or larger. Default is 2048.
|
|
22
|
+
*/
|
|
8
23
|
modulusLength?: number;
|
|
24
|
+
/**
|
|
25
|
+
* (Web Cryptography API specific) The value to use as
|
|
26
|
+
* [SubtleCrypto.generateKey()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey)
|
|
27
|
+
* `extractable` argument. Default is false.
|
|
28
|
+
*/
|
|
9
29
|
extractable?: boolean;
|
|
10
30
|
}
|
|
31
|
+
/**
|
|
32
|
+
* Generates a private and a public key for a given JWA algorithm identifier.
|
|
33
|
+
* This can only generate asymmetric key pairs. For symmetric secrets use the
|
|
34
|
+
* `generateSecret` function.
|
|
35
|
+
*
|
|
36
|
+
* Note: Under Web Cryptography API runtime the `privateKey` is generated with
|
|
37
|
+
* `extractable` set to `false` by default.
|
|
38
|
+
*
|
|
39
|
+
* @param alg JWA Algorithm Identifier to be used with the generated key pair.
|
|
40
|
+
* @param options Additional options passed down to the key pair generation.
|
|
41
|
+
*
|
|
42
|
+
* @example Usage
|
|
43
|
+
* ```js
|
|
44
|
+
* const { publicKey, privateKey } = await jose.generateKeyPair('PS256')
|
|
45
|
+
* console.log(publicKey)
|
|
46
|
+
* console.log(privateKey)
|
|
47
|
+
* ```
|
|
48
|
+
*/
|
|
11
49
|
export declare function generateKeyPair(alg: string, options?: GenerateKeyPairOptions): Promise<GenerateKeyPairResult>;
|
|
@@ -1,5 +1,25 @@
|
|
|
1
1
|
import type { KeyLike } from '../types';
|
|
2
2
|
export interface GenerateSecretOptions {
|
|
3
|
+
/**
|
|
4
|
+
* (Web Cryptography API specific) The value to use as
|
|
5
|
+
* [SubtleCrypto.generateKey()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey)
|
|
6
|
+
* `extractable` argument. Default is false.
|
|
7
|
+
*/
|
|
3
8
|
extractable?: boolean;
|
|
4
9
|
}
|
|
10
|
+
/**
|
|
11
|
+
* Generates a symmetric secret key for a given JWA algorithm identifier.
|
|
12
|
+
*
|
|
13
|
+
* Note: Under Web Cryptography API runtime the secret key is generated with
|
|
14
|
+
* `extractable` set to `false` by default.
|
|
15
|
+
*
|
|
16
|
+
* @example Usage
|
|
17
|
+
* ```js
|
|
18
|
+
* const secret = await jose.generateSecret('HS256')
|
|
19
|
+
* console.log(secret)
|
|
20
|
+
* ```
|
|
21
|
+
*
|
|
22
|
+
* @param alg JWA Algorithm Identifier to be used with the generated secret.
|
|
23
|
+
* @param options Additional options passed down to the secret generation.
|
|
24
|
+
*/
|
|
5
25
|
export declare function generateSecret(alg: string, options?: GenerateSecretOptions): Promise<KeyLike | Uint8Array>;
|
|
@@ -1,8 +1,104 @@
|
|
|
1
1
|
import type { JWK, KeyLike } from '../types';
|
|
2
2
|
export interface PEMImportOptions {
|
|
3
|
+
/**
|
|
4
|
+
* (Web Cryptography API specific) The value to use as
|
|
5
|
+
* [SubtleCrypto.importKey()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey)
|
|
6
|
+
* `extractable` argument. Default is false.
|
|
7
|
+
*/
|
|
3
8
|
extractable?: boolean;
|
|
4
9
|
}
|
|
10
|
+
/**
|
|
11
|
+
* Imports an PEM-encoded SPKI string as a runtime-specific public key representation (KeyObject or CryptoKey).
|
|
12
|
+
* See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210) to learn about key to algorithm
|
|
13
|
+
* requirements and mapping.
|
|
14
|
+
*
|
|
15
|
+
* @param pem PEM-encoded SPKI string
|
|
16
|
+
* @param alg JSON Web Algorithm identifier to be used with the imported key.
|
|
17
|
+
*
|
|
18
|
+
* @example Usage
|
|
19
|
+
* ```js
|
|
20
|
+
* const algorithm = 'ES256'
|
|
21
|
+
* const spki = `-----BEGIN PUBLIC KEY-----
|
|
22
|
+
* MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFlHHWfLk0gLBbsLTcuCrbCqoHqmM
|
|
23
|
+
* YJepMC+Q+Dd6RBmBiA41evUsNMwLeN+PNFqib+xwi9JkJ8qhZkq8Y/IzGg==
|
|
24
|
+
* -----END PUBLIC KEY-----`
|
|
25
|
+
* const ecPublicKey = await jose.importSPKI(spki, algorithm)
|
|
26
|
+
* ```
|
|
27
|
+
*/
|
|
5
28
|
export declare function importSPKI(spki: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;
|
|
29
|
+
/**
|
|
30
|
+
* Imports the SPKI from an X.509 string certificate as a runtime-specific public key representation (KeyObject or CryptoKey).
|
|
31
|
+
* See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210) to learn about key to algorithm
|
|
32
|
+
* requirements and mapping.
|
|
33
|
+
*
|
|
34
|
+
* @param pem X.509 certificate string
|
|
35
|
+
* @param alg JSON Web Algorithm identifier to be used with the imported key.
|
|
36
|
+
*
|
|
37
|
+
* @example Usage
|
|
38
|
+
* ```js
|
|
39
|
+
* const algorithm = 'ES256'
|
|
40
|
+
* const x509 = `-----BEGIN CERTIFICATE-----
|
|
41
|
+
* MIIBXjCCAQSgAwIBAgIGAXvykuMKMAoGCCqGSM49BAMCMDYxNDAyBgNVBAMMK3Np
|
|
42
|
+
* QXBNOXpBdk1VaXhXVWVGaGtjZXg1NjJRRzFyQUhXaV96UlFQTVpQaG8wHhcNMjEw
|
|
43
|
+
* OTE3MDcwNTE3WhcNMjIwNzE0MDcwNTE3WjA2MTQwMgYDVQQDDCtzaUFwTTl6QXZN
|
|
44
|
+
* VWl4V1VlRmhrY2V4NTYyUUcxckFIV2lfelJRUE1aUGhvMFkwEwYHKoZIzj0CAQYI
|
|
45
|
+
* KoZIzj0DAQcDQgAE8PbPvCv5D5xBFHEZlBp/q5OEUymq7RIgWIi7tkl9aGSpYE35
|
|
46
|
+
* UH+kBKDnphJO3odpPZ5gvgKs2nwRWcrDnUjYLDAKBggqhkjOPQQDAgNIADBFAiEA
|
|
47
|
+
* 1yyMTRe66MhEXID9+uVub7woMkNYd0LhSHwKSPMUUTkCIFQGsfm1ecXOpeGOufAh
|
|
48
|
+
* v+A1QWZMuTWqYt+uh/YSRNDn
|
|
49
|
+
* -----END CERTIFICATE-----`
|
|
50
|
+
* const ecPublicKey = await jose.importX509(x509, algorithm)
|
|
51
|
+
* ```
|
|
52
|
+
*/
|
|
6
53
|
export declare function importX509(x509: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;
|
|
54
|
+
/**
|
|
55
|
+
* Imports an PEM-encoded PKCS8 string as a runtime-specific private key representation (KeyObject or CryptoKey).
|
|
56
|
+
* See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210) to learn about key to algorithm
|
|
57
|
+
* requirements and mapping. Encrypted keys are not supported.
|
|
58
|
+
*
|
|
59
|
+
* @param pem PEM-encoded PKCS8 string
|
|
60
|
+
* @param alg JSON Web Algorithm identifier to be used with the imported key.
|
|
61
|
+
*
|
|
62
|
+
* @example Usage
|
|
63
|
+
* ```js
|
|
64
|
+
* const algorithm = 'ES256'
|
|
65
|
+
* const pkcs8 = `-----BEGIN PRIVATE KEY-----
|
|
66
|
+
* MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiyvo0X+VQ0yIrOaN
|
|
67
|
+
* nlrnUclopnvuuMfoc8HHly3505OhRANCAAQWUcdZ8uTSAsFuwtNy4KtsKqgeqYxg
|
|
68
|
+
* l6kwL5D4N3pEGYGIDjV69Sw0zAt43480WqJv7HCL0mQnyqFmSrxj8jMa
|
|
69
|
+
* -----END PRIVATE KEY-----`
|
|
70
|
+
* const ecPrivateKey = await jose.importPKCS8(pkcs8, algorithm)
|
|
71
|
+
* ```
|
|
72
|
+
*/
|
|
7
73
|
export declare function importPKCS8(pkcs8: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;
|
|
74
|
+
/**
|
|
75
|
+
* Imports a JWK to a runtime-specific key representation (KeyLike). Either
|
|
76
|
+
* JWK "alg" (Algorithm) Parameter must be present or the optional "alg" argument. When
|
|
77
|
+
* running on a runtime using [Web Cryptography API](https://www.w3.org/TR/WebCryptoAPI/)
|
|
78
|
+
* the jwk parameters "use", "key_ops", and "ext" are also used in the resulting `CryptoKey`.
|
|
79
|
+
* See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210) to learn about key to algorithm
|
|
80
|
+
* requirements and mapping.
|
|
81
|
+
*
|
|
82
|
+
* @param jwk JSON Web Key.
|
|
83
|
+
* @param alg JSON Web Algorithm identifier to be used with the imported key.
|
|
84
|
+
* Default is the "alg" property on the JWK.
|
|
85
|
+
* @param octAsKeyObject Forces a symmetric key to be imported to a KeyObject or
|
|
86
|
+
* CryptoKey. Default is true unless JWK "ext" (Extractable) is true.
|
|
87
|
+
*
|
|
88
|
+
* @example Usage
|
|
89
|
+
* ```js
|
|
90
|
+
* const ecPublicKey = await jose.importJWK({
|
|
91
|
+
* crv: 'P-256',
|
|
92
|
+
* kty: 'EC',
|
|
93
|
+
* x: 'ySK38C1jBdLwDsNWKzzBHqKYEE5Cgv-qjWvorUXk9fw',
|
|
94
|
+
* y: '_LeQBw07cf5t57Iavn4j-BqJsAD1dpoz8gokd3sBsOo'
|
|
95
|
+
* }, 'ES256')
|
|
96
|
+
*
|
|
97
|
+
* const rsaPublicKey = await jose.importJWK({
|
|
98
|
+
* kty: 'RSA',
|
|
99
|
+
* e: 'AQAB',
|
|
100
|
+
* n: '12oBZRhCiZFJLcPg59LkZZ9mdhSMTKAQZYq32k_ti5SBB6jerkh-WzOMAO664r_qyLkqHUSp3u5SbXtseZEpN3XPWGKSxjsy-1JyEFTdLSYe6f9gfrmxkUF_7DTpq0gn6rntP05g2-wFW50YO7mosfdslfrTJYWHFhJALabAeYirYD7-9kqq9ebfFMF4sRRELbv9oi36As6Q9B3Qb5_C1rAzqfao_PCsf9EPsTZsVVVkA5qoIAr47lo1ipfiBPxUCCNSdvkmDTYgvvRm6ZoMjFbvOtgyts55fXKdMWv7I9HMD5HwE9uW839PWA514qhbcIsXEYSFMPMV6fnlsiZvQQ'
|
|
101
|
+
* }, 'PS256')
|
|
102
|
+
* ```
|
|
103
|
+
*/
|
|
8
104
|
export declare function importJWK(jwk: JWK, alg?: string, octAsKeyObject?: boolean): Promise<KeyLike | Uint8Array>;
|