jose 4.6.0 → 4.7.0

package/dist/browser/jwks/local.js

@@ -39,8 +39,9 @@ export class LocalJWKSet {
     }
     async getKey(protectedHeader, token) {
         const { alg, kid } = { ...protectedHeader, ...token.header };
+        const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(alg);
+            let candidate = kty === jwk.kty;
             if (candidate && typeof kid === 'string') {
                 candidate = kid === jwk.kid;
             }

package/dist/browser/jwks/remote.js

@@ -15,15 +15,20 @@ class RemoteJWKSet extends LocalJWKSet {
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =
             typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
     }
     coolingDown() {
-        if (!this._cooldownStarted) {
-            return false;
-        }
-        return Date.now() < this._cooldownStarted + this._cooldownDuration;
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
+            : false;
+    }
+    fresh() {
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
+            : false;
     }
     async getKey(protectedHeader, token) {
-        if (!this._jwks) {
+        if (!this._jwks || !this.fresh()) {
             await this.reload();
         }
         try {
@@ -60,7 +65,7 @@ class RemoteJWKSet extends LocalJWKSet {
                     throw new JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };
-                this._cooldownStarted = Date.now();
+                this._jwksTimestamp = Date.now();
                 this._pendingFetch = undefined;
             })
                 .catch((err) => {

package/dist/browser/lib/buffer_utils.js

@@ -39,19 +39,13 @@ export function lengthAndInput(input) {
 }
 export async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
-    let res;
-    for (let iter = 1; iter <= iterations; iter++) {
+    const res = new Uint8Array(iterations * 32);
+    for (let iter = 0; iter < iterations; iter++) {
         const buf = new Uint8Array(4 + secret.length + value.length);
-        buf.set(uint32be(iter));
+        buf.set(uint32be(iter + 1));
         buf.set(secret, 4);
         buf.set(value, 4 + secret.length);
-        if (!res) {
-            res = await digest('sha256', buf);
-        }
-        else {
-            res = concat(res, await digest('sha256', buf));
-        }
+        res.set(await digest('sha256', buf), iter * 32);
     }
-    res = res.slice(0, bits >> 3);
-    return res;
+    return res.slice(0, bits >> 3);
 }

package/dist/browser/lib/jwt_claims_set.js

@@ -58,13 +58,8 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     }
     const { currentDate } = options;
     const now = epoch(currentDate || new Date());
-    if (payload.iat !== undefined || options.maxTokenAge) {
-        if (typeof payload.iat !== 'number') {
-            throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
-        }
-        if (payload.exp === undefined && payload.iat > now + tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
-        }
+    if ((payload.iat !== undefined || options.maxTokenAge) && typeof payload.iat !== 'number') {
+        throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {

package/dist/browser/runtime/base64url.js

@@ -15,9 +15,12 @@ export const encode = (input) => {
     return encodeBase64(input).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 };
 export const decodeBase64 = (encoded) => {
-    return new Uint8Array(atob(encoded)
-        .split('')
-        .map((c) => c.charCodeAt(0)));
+    const binary = atob(encoded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
 };
 export const decode = (input) => {
     let encoded = input;

package/dist/node/cjs/jwks/local.js

@@ -43,8 +43,9 @@ class LocalJWKSet {
     }
     async getKey(protectedHeader, token) {
         const { alg, kid } = { ...protectedHeader, ...token.header };
+        const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(alg);
+            let candidate = kty === jwk.kty;
             if (candidate && typeof kid === 'string') {
                 candidate = kid === jwk.kid;
             }

package/dist/node/cjs/jwks/remote.js

@@ -18,15 +18,20 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =
             typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
     }
     coolingDown() {
-        if (!this._cooldownStarted) {
-            return false;
-        }
-        return Date.now() < this._cooldownStarted + this._cooldownDuration;
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
+            : false;
+    }
+    fresh() {
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
+            : false;
     }
     async getKey(protectedHeader, token) {
-        if (!this._jwks) {
+        if (!this._jwks || !this.fresh()) {
             await this.reload();
         }
         try {
@@ -63,7 +68,7 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
                     throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };
-                this._cooldownStarted = Date.now();
+                this._jwksTimestamp = Date.now();
                 this._pendingFetch = undefined;
             })
                 .catch((err) => {

package/dist/node/cjs/lib/buffer_utils.js

@@ -47,20 +47,14 @@ function lengthAndInput(input) {
 exports.lengthAndInput = lengthAndInput;
 async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
-    let res;
-    for (let iter = 1; iter <= iterations; iter++) {
+    const res = new Uint8Array(iterations * 32);
+    for (let iter = 0; iter < iterations; iter++) {
         const buf = new Uint8Array(4 + secret.length + value.length);
-        buf.set(uint32be(iter));
+        buf.set(uint32be(iter + 1));
         buf.set(secret, 4);
         buf.set(value, 4 + secret.length);
-        if (!res) {
-            res = await (0, digest_js_1.default)('sha256', buf);
-        }
-        else {
-            res = concat(res, await (0, digest_js_1.default)('sha256', buf));
-        }
+        res.set(await (0, digest_js_1.default)('sha256', buf), iter * 32);
     }
-    res = res.slice(0, bits >> 3);
-    return res;
+    return res.slice(0, bits >> 3);
 }
 exports.concatKdf = concatKdf;

package/dist/node/cjs/lib/jwt_claims_set.js

@@ -60,13 +60,8 @@ exports.default = (protectedHeader, encodedPayload, options = {}) => {
     }
     const { currentDate } = options;
     const now = (0, epoch_js_1.default)(currentDate || new Date());
-    if (payload.iat !== undefined || options.maxTokenAge) {
-        if (typeof payload.iat !== 'number') {
-            throw new errors_js_1.JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
-        }
-        if (payload.exp === undefined && payload.iat > now + tolerance) {
-            throw new errors_js_1.JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
-        }
+    if ((payload.iat !== undefined || options.maxTokenAge) && typeof payload.iat !== 'number') {
+        throw new errors_js_1.JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {

package/dist/node/cjs/runtime/generate.js

@@ -84,12 +84,13 @@ async function generateKeyPair(alg, options) {
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW':
-            switch (options === null || options === void 0 ? void 0 : options.crv) {
+            const crv = (_b = options === null || options === void 0 ? void 0 : options.crv) !== null && _b !== void 0 ? _b : 'P-256';
+            switch (crv) {
                 case undefined:
                 case 'P-256':
                 case 'P-384':
                 case 'P-521':
-                    return generate('ec', { namedCurve: (_b = options === null || options === void 0 ? void 0 : options.crv) !== null && _b !== void 0 ? _b : 'P-256' });
+                    return generate('ec', { namedCurve: crv });
                 case 'X25519':
                     return generate('x25519');
                 case 'X448':

package/dist/node/esm/jwks/local.js

@@ -39,8 +39,9 @@ export class LocalJWKSet {
     }
     async getKey(protectedHeader, token) {
         const { alg, kid } = { ...protectedHeader, ...token.header };
+        const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(alg);
+            let candidate = kty === jwk.kty;
             if (candidate && typeof kid === 'string') {
                 candidate = kid === jwk.kid;
             }

package/dist/node/esm/jwks/remote.js

@@ -15,15 +15,20 @@ class RemoteJWKSet extends LocalJWKSet {
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =
             typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
     }
     coolingDown() {
-        if (!this._cooldownStarted) {
-            return false;
-        }
-        return Date.now() < this._cooldownStarted + this._cooldownDuration;
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
+            : false;
+    }
+    fresh() {
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
+            : false;
     }
     async getKey(protectedHeader, token) {
-        if (!this._jwks) {
+        if (!this._jwks || !this.fresh()) {
             await this.reload();
         }
         try {
@@ -60,7 +65,7 @@ class RemoteJWKSet extends LocalJWKSet {
                     throw new JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };
-                this._cooldownStarted = Date.now();
+                this._jwksTimestamp = Date.now();
                 this._pendingFetch = undefined;
             })
                 .catch((err) => {

package/dist/node/esm/lib/buffer_utils.js

@@ -39,19 +39,13 @@ export function lengthAndInput(input) {
 }
 export async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
-    let res;
-    for (let iter = 1; iter <= iterations; iter++) {
+    const res = new Uint8Array(iterations * 32);
+    for (let iter = 0; iter < iterations; iter++) {
         const buf = new Uint8Array(4 + secret.length + value.length);
-        buf.set(uint32be(iter));
+        buf.set(uint32be(iter + 1));
         buf.set(secret, 4);
         buf.set(value, 4 + secret.length);
-        if (!res) {
-            res = await digest('sha256', buf);
-        }
-        else {
-            res = concat(res, await digest('sha256', buf));
-        }
+        res.set(await digest('sha256', buf), iter * 32);
     }
-    res = res.slice(0, bits >> 3);
-    return res;
+    return res.slice(0, bits >> 3);
 }

package/dist/node/esm/lib/jwt_claims_set.js

@@ -58,13 +58,8 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     }
     const { currentDate } = options;
     const now = epoch(currentDate || new Date());
-    if (payload.iat !== undefined || options.maxTokenAge) {
-        if (typeof payload.iat !== 'number') {
-            throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
-        }
-        if (payload.exp === undefined && payload.iat > now + tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
-        }
+    if ((payload.iat !== undefined || options.maxTokenAge) && typeof payload.iat !== 'number') {
+        throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {

package/dist/node/esm/runtime/generate.js

@@ -80,12 +80,13 @@ export async function generateKeyPair(alg, options) {
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW':
-            switch (options === null || options === void 0 ? void 0 : options.crv) {
+            const crv = (_b = options === null || options === void 0 ? void 0 : options.crv) !== null && _b !== void 0 ? _b : 'P-256';
+            switch (crv) {
                 case undefined:
                 case 'P-256':
                 case 'P-384':
                 case 'P-521':
-                    return generate('ec', { namedCurve: (_b = options === null || options === void 0 ? void 0 : options.crv) !== null && _b !== void 0 ? _b : 'P-256' });
+                    return generate('ec', { namedCurve: crv });
                 case 'X25519':
                     return generate('x25519');
                 case 'X448':

package/dist/types/jwks/remote.d.ts

@@ -4,23 +4,32 @@ import type { JWSHeaderParameters, FlattenedJWSInput, GetKeyFunction } from '../
  */
 export interface RemoteJWKSetOptions {
     /**
-     * Timeout (in milliseconds) for the HTTP request. When reached the request will be
-     * aborted and the verification will fail. Default is 5000.
+     * Timeout (in milliseconds) for the HTTP request. When reached the request
+     * will be aborted and the verification will fail. Default is 5000 (5
+     * seconds).
      */
     timeoutDuration?: number;
     /**
-     * Duration (in milliseconds) for which no more HTTP requests will be triggered
-     * after a previous successful fetch. Default is 30000.
+     * Duration (in milliseconds) for which no more HTTP requests will be
+     * triggered after a previous successful fetch. Default is 30000 (30 seconds).
      */
     cooldownDuration?: number;
     /**
-     * An instance of [http.Agent](https://nodejs.org/api/http.html#http_class_http_agent)
-     * or [https.Agent](https://nodejs.org/api/https.html#https_class_https_agent) to pass
-     * to the [http.get](https://nodejs.org/api/http.html#http_http_get_options_callback)
-     * or [https.get](https://nodejs.org/api/https.html#https_https_get_options_callback)
-     * method's options. Use when behind an http(s) proxy.
-     * This is a Node.js runtime specific option, it is ignored
-     * when used outside of Node.js runtime.
+     * Maximum time (in milliseconds) between successful HTTP requests. Default is
+     * 600000 (10 minutes).
+     */
+    cacheMaxAge?: number | typeof Infinity;
+    /**
+     * An instance of
+     * [http.Agent](https://nodejs.org/api/http.html#http_class_http_agent) or
+     * [https.Agent](https://nodejs.org/api/https.html#https_class_https_agent) to
+     * pass to the
+     * [http.get](https://nodejs.org/api/http.html#http_http_get_options_callback)
+     * or
+     * [https.get](https://nodejs.org/api/https.html#https_https_get_options_callback)
+     * method's options. Use when behind an http(s) proxy. This is a Node.js
+     * runtime specific option, it is ignored when used outside of Node.js
+     * runtime.
      */
     agent?: any;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.6.0",
+  "version": "4.7.0",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",