jose 5.10.0 → 6.0.1

package/dist/node/esm/runtime/node_key.js

@@ -1,108 +0,0 @@
-import { constants, KeyObject } from 'node:crypto';
-import getNamedCurve from './get_named_curve.js';
-import { JOSENotSupported } from '../util/errors.js';
-import checkKeyLength from './check_key_length.js';
-const ecCurveAlgMap = new Map([
-    ['ES256', 'P-256'],
-    ['ES256K', 'secp256k1'],
-    ['ES384', 'P-384'],
-    ['ES512', 'P-521'],
-]);
-export default function keyForCrypto(alg, key) {
-    let asymmetricKeyType;
-    let asymmetricKeyDetails;
-    let isJWK;
-    if (key instanceof KeyObject) {
-        asymmetricKeyType = key.asymmetricKeyType;
-        asymmetricKeyDetails = key.asymmetricKeyDetails;
-    }
-    else {
-        isJWK = true;
-        switch (key.kty) {
-            case 'RSA':
-                asymmetricKeyType = 'rsa';
-                break;
-            case 'EC':
-                asymmetricKeyType = 'ec';
-                break;
-            case 'OKP': {
-                if (key.crv === 'Ed25519') {
-                    asymmetricKeyType = 'ed25519';
-                    break;
-                }
-                if (key.crv === 'Ed448') {
-                    asymmetricKeyType = 'ed448';
-                    break;
-                }
-                throw new TypeError('Invalid key for this operation, its crv must be Ed25519 or Ed448');
-            }
-            default:
-                throw new TypeError('Invalid key for this operation, its kty must be RSA, OKP, or EC');
-        }
-    }
-    let options;
-    switch (alg) {
-        case 'Ed25519':
-            if (asymmetricKeyType !== 'ed25519') {
-                throw new TypeError(`Invalid key for this operation, its asymmetricKeyType must be ed25519`);
-            }
-            break;
-        case 'EdDSA':
-            if (!['ed25519', 'ed448'].includes(asymmetricKeyType)) {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');
-            }
-            break;
-        case 'RS256':
-        case 'RS384':
-        case 'RS512':
-            if (asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
-            }
-            checkKeyLength(key, alg);
-            break;
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
-            if (asymmetricKeyType === 'rsa-pss') {
-                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = asymmetricKeyDetails;
-                const length = parseInt(alg.slice(-3), 10);
-                if (hashAlgorithm !== undefined &&
-                    (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
-                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${alg}`);
-                }
-                if (saltLength !== undefined && saltLength > length >> 3) {
-                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
-                }
-            }
-            else if (asymmetricKeyType !== 'rsa') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
-            }
-            checkKeyLength(key, alg);
-            options = {
-                padding: constants.RSA_PKCS1_PSS_PADDING,
-                saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
-            };
-            break;
-        case 'ES256':
-        case 'ES256K':
-        case 'ES384':
-        case 'ES512': {
-            if (asymmetricKeyType !== 'ec') {
-                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ec');
-            }
-            const actual = getNamedCurve(key);
-            const expected = ecCurveAlgMap.get(alg);
-            if (actual !== expected) {
-                throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);
-            }
-            options = { dsaEncoding: 'ieee-p1363' };
-            break;
-        }
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-    if (isJWK) {
-        return { format: 'jwk', key, ...options };
-    }
-    return options ? { ...options, key } : key;
-}

package/dist/node/esm/runtime/normalize_key.js

@@ -1 +0,0 @@
-export default {};

package/dist/node/esm/runtime/pbes2kw.js

@@ -1,43 +0,0 @@
-import { promisify } from 'node:util';
-import { KeyObject, pbkdf2 as pbkdf2cb } from 'node:crypto';
-import random from './random.js';
-import { p2s as concatSalt } from '../lib/buffer_utils.js';
-import { encode as base64url } from './base64url.js';
-import { wrap, unwrap } from './aeskw.js';
-import checkP2s from '../lib/check_p2s.js';
-import { isCryptoKey } from './webcrypto.js';
-import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import isKeyObject from './is_key_object.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { types } from './is_key_like.js';
-const pbkdf2 = promisify(pbkdf2cb);
-function getPassword(key, alg) {
-    if (isKeyObject(key)) {
-        return key.export();
-    }
-    if (key instanceof Uint8Array) {
-        return key;
-    }
-    if (isCryptoKey(key)) {
-        checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
-        return KeyObject.from(key).export();
-    }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
-}
-export const encrypt = async (alg, key, cek, p2c = 2048, p2s = random(new Uint8Array(16))) => {
-    checkP2s(p2s);
-    const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.slice(13, 16), 10) >> 3;
-    const password = getPassword(key, alg);
-    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.slice(8, 11)}`);
-    const encryptedKey = await wrap(alg.slice(-6), derivedKey, cek);
-    return { encryptedKey, p2c, p2s: base64url(p2s) };
-};
-export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
-    checkP2s(p2s);
-    const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.slice(13, 16), 10) >> 3;
-    const password = getPassword(key, alg);
-    const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.slice(8, 11)}`);
-    return unwrap(alg.slice(-6), derivedKey, encryptedKey);
-};

package/dist/node/esm/runtime/random.js

@@ -1 +0,0 @@
-export { randomFillSync as default } from 'node:crypto';

package/dist/node/esm/runtime/rsaes.js

@@ -1,66 +0,0 @@
-import { KeyObject, publicEncrypt, constants, privateDecrypt } from 'node:crypto';
-import { deprecate } from 'node:util';
-import checkKeyLength from './check_key_length.js';
-import { isCryptoKey } from './webcrypto.js';
-import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import isKeyObject from './is_key_object.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { types } from './is_key_like.js';
-const checkKey = (key, alg) => {
-    if (key.asymmetricKeyType !== 'rsa') {
-        throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
-    }
-    checkKeyLength(key, alg);
-};
-const RSA1_5 = deprecate(() => constants.RSA_PKCS1_PADDING, 'The RSA1_5 "alg" (JWE Algorithm) is deprecated and will be removed in the next major revision.');
-const resolvePadding = (alg) => {
-    switch (alg) {
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512':
-            return constants.RSA_PKCS1_OAEP_PADDING;
-        case 'RSA1_5':
-            return RSA1_5();
-        default:
-            return undefined;
-    }
-};
-const resolveOaepHash = (alg) => {
-    switch (alg) {
-        case 'RSA-OAEP':
-            return 'sha1';
-        case 'RSA-OAEP-256':
-            return 'sha256';
-        case 'RSA-OAEP-384':
-            return 'sha384';
-        case 'RSA-OAEP-512':
-            return 'sha512';
-        default:
-            return undefined;
-    }
-};
-function ensureKeyObject(key, alg, ...usages) {
-    if (isKeyObject(key)) {
-        return key;
-    }
-    if (isCryptoKey(key)) {
-        checkEncCryptoKey(key, alg, ...usages);
-        return KeyObject.from(key);
-    }
-    throw new TypeError(invalidKeyInput(key, ...types));
-}
-export const encrypt = (alg, key, cek) => {
-    const padding = resolvePadding(alg);
-    const oaepHash = resolveOaepHash(alg);
-    const keyObject = ensureKeyObject(key, alg, 'wrapKey', 'encrypt');
-    checkKey(keyObject, alg);
-    return publicEncrypt({ key: keyObject, oaepHash, padding }, cek);
-};
-export const decrypt = (alg, key, encryptedKey) => {
-    const padding = resolvePadding(alg);
-    const oaepHash = resolveOaepHash(alg);
-    const keyObject = ensureKeyObject(key, alg, 'unwrapKey', 'decrypt');
-    checkKey(keyObject, alg);
-    return privateDecrypt({ key: keyObject, oaepHash, padding }, encryptedKey);
-};

package/dist/node/esm/runtime/runtime.js

@@ -1 +0,0 @@
-export default 'node:crypto';

package/dist/node/esm/runtime/sign.js

@@ -1,17 +0,0 @@
-import * as crypto from 'node:crypto';
-import { promisify } from 'node:util';
-import nodeDigest from './dsa_digest.js';
-import hmacDigest from './hmac_digest.js';
-import nodeKey from './node_key.js';
-import getSignKey from './get_sign_verify_key.js';
-const oneShotSign = promisify(crypto.sign);
-const sign = async (alg, key, data) => {
-    const k = getSignKey(alg, key, 'sign');
-    if (alg.startsWith('HS')) {
-        const hmac = crypto.createHmac(hmacDigest(alg), k);
-        hmac.update(data);
-        return hmac.digest();
-    }
-    return oneShotSign(nodeDigest(alg), data, nodeKey(alg, k));
-};
-export default sign;

package/dist/node/esm/runtime/timing_safe_equal.js

@@ -1,3 +0,0 @@
-import { timingSafeEqual as impl } from 'node:crypto';
-const timingSafeEqual = impl;
-export default timingSafeEqual;

package/dist/node/esm/runtime/verify.js

@@ -1,29 +0,0 @@
-import * as crypto from 'node:crypto';
-import { promisify } from 'node:util';
-import nodeDigest from './dsa_digest.js';
-import nodeKey from './node_key.js';
-import sign from './sign.js';
-import getVerifyKey from './get_sign_verify_key.js';
-const oneShotVerify = promisify(crypto.verify);
-const verify = async (alg, key, signature, data) => {
-    const k = getVerifyKey(alg, key, 'verify');
-    if (alg.startsWith('HS')) {
-        const expected = await sign(alg, k, data);
-        const actual = signature;
-        try {
-            return crypto.timingSafeEqual(actual, expected);
-        }
-        catch {
-            return false;
-        }
-    }
-    const algorithm = nodeDigest(alg);
-    const keyInput = nodeKey(alg, k);
-    try {
-        return await oneShotVerify(algorithm, data, keyInput, signature);
-    }
-    catch {
-        return false;
-    }
-};
-export default verify;

package/dist/node/esm/runtime/webcrypto.js

@@ -1,5 +0,0 @@
-import * as crypto from 'node:crypto';
-import * as util from 'node:util';
-const webcrypto = crypto.webcrypto;
-export default webcrypto;
-export const isCryptoKey = (key) => util.types.isCryptoKey(key);

package/dist/node/esm/util/decode_jwt.js

@@ -1,32 +0,0 @@
-import { decode as base64url } from './base64url.js';
-import { decoder } from '../lib/buffer_utils.js';
-import isObject from '../lib/is_object.js';
-import { JWTInvalid } from './errors.js';
-export function decodeJwt(jwt) {
-    if (typeof jwt !== 'string')
-        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
-    const { 1: payload, length } = jwt.split('.');
-    if (length === 5)
-        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
-    if (length !== 3)
-        throw new JWTInvalid('Invalid JWT');
-    if (!payload)
-        throw new JWTInvalid('JWTs must contain a payload');
-    let decoded;
-    try {
-        decoded = base64url(payload);
-    }
-    catch {
-        throw new JWTInvalid('Failed to base64url decode the payload');
-    }
-    let result;
-    try {
-        result = JSON.parse(decoder.decode(decoded));
-    }
-    catch {
-        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
-    }
-    if (!isObject(result))
-        throw new JWTInvalid('Invalid JWT Claims Set');
-    return result;
-}

package/dist/node/esm/util/decode_protected_header.js

@@ -1,34 +0,0 @@
-import { decode as base64url } from './base64url.js';
-import { decoder } from '../lib/buffer_utils.js';
-import isObject from '../lib/is_object.js';
-export function decodeProtectedHeader(token) {
-    let protectedB64u;
-    if (typeof token === 'string') {
-        const parts = token.split('.');
-        if (parts.length === 3 || parts.length === 5) {
-            ;
-            [protectedB64u] = parts;
-        }
-    }
-    else if (typeof token === 'object' && token) {
-        if ('protected' in token) {
-            protectedB64u = token.protected;
-        }
-        else {
-            throw new TypeError('Token does not contain a Protected Header');
-        }
-    }
-    try {
-        if (typeof protectedB64u !== 'string' || !protectedB64u) {
-            throw new Error();
-        }
-        const result = JSON.parse(decoder.decode(base64url(protectedB64u)));
-        if (!isObject(result)) {
-            throw new Error();
-        }
-        return result;
-    }
-    catch {
-        throw new TypeError('Invalid Token or Protected Header formatting');
-    }
-}

package/dist/node/esm/util/runtime.js

@@ -1,2 +0,0 @@
-import value from '../runtime/runtime.js';
-export default value;

package/dist/types/util/runtime.d.ts

@@ -1,3 +0,0 @@
-import type { CryptoRuntime } from '../types';
-declare const _default: CryptoRuntime;
-export default _default;