jose 4.7.0 → 4.8.3

package/README.md

@@ -19,9 +19,7 @@ The following specifications are implemented by `jose`
 The test suite utilizes examples defined in [RFC7520][spec-cookbook] to confirm its JOSE
 implementation is correct.
 
-## Support
-
-If you or your business use `jose`, please consider becoming a [sponsor][support-sponsor] so I can continue maintaining it and adding new features carefree.
+## [💗 Help the project](https://github.com/sponsors/panva)
 
 ## Documentation
 
@@ -91,10 +89,8 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 | Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------- | --------- | -------- | -------- |
-| [4.x.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
-| [3.x.x](https://github.com/panva/jose/tree/v3.x) | ✅ | ✅ until 2022-04-30 | ❌ |
-| [2.x.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ✅ until 2022-04-30 | ❌ |
-| [1.x.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
+| [v3.x](https://github.com/panva/jose/tree/v3.x), [v2.x](https://github.com/panva/jose/tree/v2.x), [v1.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
 
 #### Semver?
 

package/dist/browser/jwks/remote.js

@@ -10,7 +10,7 @@ class RemoteJWKSet extends LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent };
+        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
         this._timeoutDuration =
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =

package/dist/browser/lib/crypto_key.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from '../runtime/env.js';
+import { isCloudflareWorkers } from '../runtime/env.js';
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -71,11 +71,6 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case isNodeJs() && 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
-                throw unusable('NODE-ED25519 or NODE-ED448');
-            break;
-        }
         case isCloudflareWorkers() && 'EdDSA': {
             if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
                 throw unusable('NODE-ED25519');

package/dist/browser/runtime/asn1.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './env.js';
+import { isCloudflareWorkers } from './env.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { encodeBase64 } from './base64url.js';
@@ -44,10 +44,8 @@ const getNamedCurve = (keyData) => {
             return 'P-384';
         case findOid(keyData, [0x2b, 0x81, 0x04, 0x00, 0x23]):
             return 'P-521';
-        case (isCloudflareWorkers() || isNodeJs()) && findOid(keyData, [0x2b, 0x65, 0x70]):
+        case isCloudflareWorkers() && findOid(keyData, [0x2b, 0x65, 0x70]):
             return 'Ed25519';
-        case isNodeJs() && findOid(keyData, [0x2b, 0x65, 0x71]):
-            return 'Ed448';
         default:
             throw new JOSENotSupported('Invalid or unsupported EC Key Curve or OKP Key Sub Type');
     }
@@ -102,7 +100,7 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
             algorithm = { name: 'ECDH', namedCurve: getNamedCurve(keyData) };
             keyUsages = isPublic ? [] : ['deriveBits'];
             break;
-        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+        case isCloudflareWorkers() && 'EdDSA':
             const namedCurve = getNamedCurve(keyData).toUpperCase();
             algorithm = { name: `NODE-${namedCurve}`, namedCurve: `NODE-${namedCurve}` };
             keyUsages = isPublic ? ['verify'] : ['sign'];

package/dist/browser/runtime/env.js

@@ -1,11 +1,3 @@
 export function isCloudflareWorkers() {
     return typeof WebSocketPair === 'function';
 }
-export function isNodeJs() {
-    try {
-        return process.versions.node !== undefined;
-    }
-    catch (_a) {
-        return false;
-    }
-}

package/dist/browser/runtime/fetch_jwks.js

@@ -1,5 +1,5 @@
 import { JOSEError, JWKSTimeout } from '../util/errors.js';
-const fetchJwks = async (url, timeout) => {
+const fetchJwks = async (url, timeout, options) => {
     let controller;
     let id;
     let timedOut = false;
@@ -13,6 +13,7 @@ const fetchJwks = async (url, timeout) => {
     const response = await fetch(url.href, {
         signal: controller ? controller.signal : undefined,
         redirect: 'manual',
+        headers: options.headers,
     }).catch((err) => {
         if (timedOut)
             throw new JWKSTimeout();

package/dist/browser/runtime/generate.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './env.js';
+import { isCloudflareWorkers } from './env.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import random from './random.js';
@@ -101,19 +101,15 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
             keyUsages = ['sign', 'verify'];
             break;
-        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+        case isCloudflareWorkers() && 'EdDSA':
             switch (options === null || options === void 0 ? void 0 : options.crv) {
                 case undefined:
                 case 'Ed25519':
                     algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
                     keyUsages = ['sign', 'verify'];
                     break;
-                case isNodeJs() && 'Ed448':
-                    algorithm = { name: 'NODE-ED448', namedCurve: 'NODE-ED448' };
-                    keyUsages = ['sign', 'verify'];
-                    break;
                 default:
-                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are Ed25519 and Ed448');
+                    throw new JOSENotSupported('Invalid or unsupported crv option provided');
             }
             break;
         case 'ECDH-ES':

package/dist/browser/runtime/jwk_to_key.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './env.js';
+import { isCloudflareWorkers } from './env.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { decode as base64url } from './base64url.js';
@@ -99,7 +99,7 @@ function subtleMapping(jwk) {
             }
             break;
         }
-        case (isCloudflareWorkers() || isNodeJs()) && 'OKP':
+        case isCloudflareWorkers() && 'OKP':
             if (jwk.alg !== 'EdDSA') {
                 throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
             }
@@ -108,10 +108,6 @@ function subtleMapping(jwk) {
                     algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
                     keyUsages = jwk.d ? ['sign'] : ['verify'];
                     break;
-                case isNodeJs() && 'Ed448':
-                    algorithm = { name: 'NODE-ED448', namedCurve: 'NODE-ED448' };
-                    keyUsages = jwk.d ? ['sign'] : ['verify'];
-                    break;
                 default:
                     throw new JOSENotSupported('Invalid or unsupported JWK "crv" (Subtype of Key Pair) Parameter value');
             }

package/dist/browser/runtime/subtle_dsa.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './env.js';
+import { isCloudflareWorkers } from './env.js';
 import { JOSENotSupported } from '../util/errors.js';
 export default function subtleDsa(alg, algorithm) {
     const hash = `SHA-${alg.slice(-3)}`;
@@ -19,7 +19,7 @@ export default function subtleDsa(alg, algorithm) {
         case 'ES384':
         case 'ES512':
             return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };
-        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+        case isCloudflareWorkers() && 'EdDSA':
             const { namedCurve } = algorithm;
             return { name: namedCurve, namedCurve };
         default:

package/dist/browser/runtime/webcrypto.js

@@ -1,12 +1,2 @@
 export default crypto;
-export function isCryptoKey(key) {
-    try {
-        return (key != null &&
-            typeof key.extractable === 'boolean' &&
-            typeof key.algorithm.name === 'string' &&
-            typeof key.type === 'string');
-    }
-    catch (_a) {
-        return false;
-    }
-}
+export const isCryptoKey = (key) => key instanceof CryptoKey;

package/dist/node/cjs/jwks/remote.js

@@ -13,7 +13,7 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent };
+        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
         this._timeoutDuration =
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =

package/dist/node/cjs/lib/crypto_key.js

@@ -74,11 +74,6 @@ function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case (0, env_js_1.isNodeJs)() && 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
-                throw unusable('NODE-ED25519 or NODE-ED448');
-            break;
-        }
         case (0, env_js_1.isCloudflareWorkers)() && 'EdDSA': {
             if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
                 throw unusable('NODE-ED25519');

package/dist/node/cjs/runtime/env.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isNodeJs = exports.isCloudflareWorkers = void 0;
+exports.isCloudflareWorkers = void 0;
 function isCloudflareWorkers() {
     return false;
 }
 exports.isCloudflareWorkers = isCloudflareWorkers;
-function isNodeJs() {
-    return true;
-}
-exports.isNodeJs = isNodeJs;

package/dist/node/cjs/runtime/fetch_jwks.js

@@ -17,10 +17,11 @@ const fetchJwks = async (url, timeout, options) => {
         default:
             throw new TypeError('Unsupported URL protocol.');
     }
-    const { agent } = options;
+    const { agent, headers } = options;
     const req = get(url.href, {
         agent,
         timeout,
+        headers,
     });
     const [response] = (await Promise.race([(0, events_1.once)(req, 'response'), (0, events_1.once)(req, 'timeout')]));
     if (!response) {

package/dist/node/cjs/runtime/webcrypto.js

@@ -6,6 +6,6 @@ const util = require("util");
 const webcrypto = crypto.webcrypto;
 exports.default = webcrypto;
 exports.isCryptoKey = util.types.isCryptoKey
-    ? (obj) => util.types.isCryptoKey(obj)
+    ? (key) => util.types.isCryptoKey(key)
     :
-        (obj) => false;
+        (key) => false;

package/dist/node/esm/jwks/remote.js

@@ -10,7 +10,7 @@ class RemoteJWKSet extends LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent };
+        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
         this._timeoutDuration =
             typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
         this._cooldownDuration =

package/dist/node/esm/lib/crypto_key.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from '../runtime/env.js';
+import { isCloudflareWorkers } from '../runtime/env.js';
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -71,11 +71,6 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case isNodeJs() && 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
-                throw unusable('NODE-ED25519 or NODE-ED448');
-            break;
-        }
         case isCloudflareWorkers() && 'EdDSA': {
             if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
                 throw unusable('NODE-ED25519');

package/dist/node/esm/runtime/env.js

@@ -1,6 +1,3 @@
 export function isCloudflareWorkers() {
     return false;
 }
-export function isNodeJs() {
-    return true;
-}

package/dist/node/esm/runtime/fetch_jwks.js

@@ -15,10 +15,11 @@ const fetchJwks = async (url, timeout, options) => {
         default:
             throw new TypeError('Unsupported URL protocol.');
     }
-    const { agent } = options;
+    const { agent, headers } = options;
     const req = get(url.href, {
         agent,
         timeout,
+        headers,
     });
     const [response] = (await Promise.race([once(req, 'response'), once(req, 'timeout')]));
     if (!response) {

package/dist/node/esm/runtime/webcrypto.js

@@ -3,6 +3,6 @@ import * as util from 'util';
 const webcrypto = crypto.webcrypto;
 export default webcrypto;
 export const isCryptoKey = util.types.isCryptoKey
-    ? (obj) => util.types.isCryptoKey(obj)
+    ? (key) => util.types.isCryptoKey(key)
     :
-        (obj) => false;
+        (key) => false;

package/dist/types/jwks/remote.d.ts

@@ -32,6 +32,10 @@ export interface RemoteJWKSetOptions {
      * runtime.
      */
     agent?: any;
+    /**
+     * Optional headers to be sent with the HTTP request.
+     */
+    headers?: Record<string, string>;
 }
 interface URL {
     href: string;

package/dist/types/key/export.d.ts

@@ -1,8 +1,8 @@
 import type { JWK, KeyLike } from '../types';
 /**
- * Exports a runtime-specific public key representation (KeyObject or CryptoKey) to an PEM-encoded SPKI string format.
+ * Exports a runtime-specific public key representation (KeyObject or CryptoKey) to a PEM-encoded SPKI string format.
  *
- * @param key Key representation to transform to an PEM-encoded SPKI string format.
+ * @param key Key representation to transform to a PEM-encoded SPKI string format.
  *
  * @example Usage
  * ```js
@@ -13,9 +13,9 @@ import type { JWK, KeyLike } from '../types';
  */
 export declare function exportSPKI(key: KeyLike): Promise<string>;
 /**
- * Exports a runtime-specific private key representation (KeyObject or CryptoKey) to an PEM-encoded PKCS8 string format.
+ * Exports a runtime-specific private key representation (KeyObject or CryptoKey) to a PEM-encoded PKCS8 string format.
  *
- * @param key Key representation to transform to an PEM-encoded PKCS8 string format.
+ * @param key Key representation to transform to a PEM-encoded PKCS8 string format.
  *
  * @example Usage
  * ```js

package/dist/types/key/import.d.ts

@@ -8,7 +8,7 @@ export interface PEMImportOptions {
     extractable?: boolean;
 }
 /**
- * Imports an PEM-encoded SPKI string as a runtime-specific public key representation (KeyObject or CryptoKey).
+ * Imports a PEM-encoded SPKI string as a runtime-specific public key representation (KeyObject or CryptoKey).
  * See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210) to learn about key to algorithm
  * requirements and mapping.
  *
@@ -52,7 +52,7 @@ export declare function importSPKI(spki: string, alg: string, options?: PEMImpor
  */
 export declare function importX509(x509: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;
 /**
- * Imports an PEM-encoded PKCS8 string as a runtime-specific private key representation (KeyObject or CryptoKey).
+ * Imports a PEM-encoded PKCS8 string as a runtime-specific private key representation (KeyObject or CryptoKey).
  * See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210) to learn about key to algorithm
  * requirements and mapping. Encrypted keys are not supported.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.7.0",
+  "version": "4.8.3",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",
@@ -55,7 +55,9 @@
   "sideEffects": false,
   "exports": {
     ".": {
+      "types": "./dist/types/index.d.ts",
       "browser": "./dist/browser/index.js",
+      "worker": "./dist/browser/index.js",
       "import": "./dist/node/esm/index.js",
       "require": "./dist/node/cjs/index.js"
     },