jose 4.6.2 → 4.8.1

package/README.md

@@ -91,10 +91,8 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 | Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------- | --------- | -------- | -------- |
-| [4.x.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
-| [3.x.x](https://github.com/panva/jose/tree/v3.x) | ✅ | ✅ until 2022-04-30 | ❌ |
-| [2.x.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ✅ until 2022-04-30 | ❌ |
-| [1.x.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
+| [v3.x](https://github.com/panva/jose/tree/v3.x), [v2.x](https://github.com/panva/jose/tree/v2.x), [v1.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
 
 #### Semver?
 

package/dist/browser/jwks/remote.js

@@ -10,20 +10,25 @@ class RemoteJWKSet extends LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent };
+        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
         this._timeoutDuration =
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =
             typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
     }
     coolingDown() {
-        if (!this._cooldownStarted) {
-            return false;
-        }
-        return Date.now() < this._cooldownStarted + this._cooldownDuration;
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
+            : false;
+    }
+    fresh() {
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
+            : false;
     }
     async getKey(protectedHeader, token) {
-        if (!this._jwks) {
+        if (!this._jwks || !this.fresh()) {
             await this.reload();
         }
         try {
@@ -60,7 +65,7 @@ class RemoteJWKSet extends LocalJWKSet {
                     throw new JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };
-                this._cooldownStarted = Date.now();
+                this._jwksTimestamp = Date.now();
                 this._pendingFetch = undefined;
             })
                 .catch((err) => {

package/dist/browser/runtime/fetch_jwks.js

@@ -1,5 +1,5 @@
 import { JOSEError, JWKSTimeout } from '../util/errors.js';
-const fetchJwks = async (url, timeout) => {
+const fetchJwks = async (url, timeout, options) => {
     let controller;
     let id;
     let timedOut = false;
@@ -13,6 +13,7 @@ const fetchJwks = async (url, timeout) => {
     const response = await fetch(url.href, {
         signal: controller ? controller.signal : undefined,
         redirect: 'manual',
+        headers: options.headers,
     }).catch((err) => {
         if (timedOut)
             throw new JWKSTimeout();

package/dist/browser/runtime/webcrypto.js

@@ -1,12 +1,2 @@
 export default crypto;
-export function isCryptoKey(key) {
-    try {
-        return (key != null &&
-            typeof key.extractable === 'boolean' &&
-            typeof key.algorithm.name === 'string' &&
-            typeof key.type === 'string');
-    }
-    catch (_a) {
-        return false;
-    }
-}
+export const isCryptoKey = (key) => key instanceof CryptoKey;

package/dist/node/cjs/jwks/remote.js

@@ -13,20 +13,25 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent };
+        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
         this._timeoutDuration =
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =
             typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
     }
     coolingDown() {
-        if (!this._cooldownStarted) {
-            return false;
-        }
-        return Date.now() < this._cooldownStarted + this._cooldownDuration;
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
+            : false;
+    }
+    fresh() {
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
+            : false;
     }
     async getKey(protectedHeader, token) {
-        if (!this._jwks) {
+        if (!this._jwks || !this.fresh()) {
             await this.reload();
         }
         try {
@@ -63,7 +68,7 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
                     throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };
-                this._cooldownStarted = Date.now();
+                this._jwksTimestamp = Date.now();
                 this._pendingFetch = undefined;
             })
                 .catch((err) => {

package/dist/node/cjs/runtime/fetch_jwks.js

@@ -17,10 +17,11 @@ const fetchJwks = async (url, timeout, options) => {
         default:
             throw new TypeError('Unsupported URL protocol.');
     }
-    const { agent } = options;
+    const { agent, headers } = options;
     const req = get(url.href, {
         agent,
         timeout,
+        headers,
     });
     const [response] = (await Promise.race([(0, events_1.once)(req, 'response'), (0, events_1.once)(req, 'timeout')]));
     if (!response) {

package/dist/node/cjs/runtime/webcrypto.js

@@ -6,6 +6,6 @@ const util = require("util");
 const webcrypto = crypto.webcrypto;
 exports.default = webcrypto;
 exports.isCryptoKey = util.types.isCryptoKey
-    ? (obj) => util.types.isCryptoKey(obj)
+    ? (key) => util.types.isCryptoKey(key)
     :
-        (obj) => false;
+        (key) => false;

package/dist/node/esm/jwks/remote.js

@@ -10,20 +10,25 @@ class RemoteJWKSet extends LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent };
+        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
         this._timeoutDuration =
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =
             typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
     }
     coolingDown() {
-        if (!this._cooldownStarted) {
-            return false;
-        }
-        return Date.now() < this._cooldownStarted + this._cooldownDuration;
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
+            : false;
+    }
+    fresh() {
+        return typeof this._jwksTimestamp === 'number'
+            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
+            : false;
     }
     async getKey(protectedHeader, token) {
-        if (!this._jwks) {
+        if (!this._jwks || !this.fresh()) {
             await this.reload();
         }
         try {
@@ -60,7 +65,7 @@ class RemoteJWKSet extends LocalJWKSet {
                     throw new JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };
-                this._cooldownStarted = Date.now();
+                this._jwksTimestamp = Date.now();
                 this._pendingFetch = undefined;
             })
                 .catch((err) => {

package/dist/node/esm/runtime/fetch_jwks.js

@@ -15,10 +15,11 @@ const fetchJwks = async (url, timeout, options) => {
         default:
             throw new TypeError('Unsupported URL protocol.');
     }
-    const { agent } = options;
+    const { agent, headers } = options;
     const req = get(url.href, {
         agent,
         timeout,
+        headers,
     });
     const [response] = (await Promise.race([once(req, 'response'), once(req, 'timeout')]));
     if (!response) {

package/dist/node/esm/runtime/webcrypto.js

@@ -3,6 +3,6 @@ import * as util from 'util';
 const webcrypto = crypto.webcrypto;
 export default webcrypto;
 export const isCryptoKey = util.types.isCryptoKey
-    ? (obj) => util.types.isCryptoKey(obj)
+    ? (key) => util.types.isCryptoKey(key)
     :
-        (obj) => false;
+        (key) => false;

package/dist/types/jwks/remote.d.ts

@@ -4,25 +4,38 @@ import type { JWSHeaderParameters, FlattenedJWSInput, GetKeyFunction } from '../
  */
 export interface RemoteJWKSetOptions {
     /**
-     * Timeout (in milliseconds) for the HTTP request. When reached the request will be
-     * aborted and the verification will fail. Default is 5000.
+     * Timeout (in milliseconds) for the HTTP request. When reached the request
+     * will be aborted and the verification will fail. Default is 5000 (5
+     * seconds).
      */
     timeoutDuration?: number;
     /**
-     * Duration (in milliseconds) for which no more HTTP requests will be triggered
-     * after a previous successful fetch. Default is 30000.
+     * Duration (in milliseconds) for which no more HTTP requests will be
+     * triggered after a previous successful fetch. Default is 30000 (30 seconds).
      */
     cooldownDuration?: number;
     /**
-     * An instance of [http.Agent](https://nodejs.org/api/http.html#http_class_http_agent)
-     * or [https.Agent](https://nodejs.org/api/https.html#https_class_https_agent) to pass
-     * to the [http.get](https://nodejs.org/api/http.html#http_http_get_options_callback)
-     * or [https.get](https://nodejs.org/api/https.html#https_https_get_options_callback)
-     * method's options. Use when behind an http(s) proxy.
-     * This is a Node.js runtime specific option, it is ignored
-     * when used outside of Node.js runtime.
+     * Maximum time (in milliseconds) between successful HTTP requests. Default is
+     * 600000 (10 minutes).
+     */
+    cacheMaxAge?: number | typeof Infinity;
+    /**
+     * An instance of
+     * [http.Agent](https://nodejs.org/api/http.html#http_class_http_agent) or
+     * [https.Agent](https://nodejs.org/api/https.html#https_class_https_agent) to
+     * pass to the
+     * [http.get](https://nodejs.org/api/http.html#http_http_get_options_callback)
+     * or
+     * [https.get](https://nodejs.org/api/https.html#https_https_get_options_callback)
+     * method's options. Use when behind an http(s) proxy. This is a Node.js
+     * runtime specific option, it is ignored when used outside of Node.js
+     * runtime.
      */
     agent?: any;
+    /**
+     * Optional headers to be sent with the HTTP request.
+     */
+    headers?: Record<string, string>;
 }
 interface URL {
     href: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.6.2",
+  "version": "4.8.1",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",
@@ -55,7 +55,9 @@
   "sideEffects": false,
   "exports": {
     ".": {
+      "types": "./dist/types/index.d.ts",
       "browser": "./dist/browser/index.js",
+      "worker": "./dist/browser/index.js",
       "import": "./dist/node/esm/index.js",
       "require": "./dist/node/cjs/index.js"
     },