jose 5.2.1 → 5.2.2

package/dist/browser/jwe/compact/decrypt.js

@@ -14,9 +14,9 @@ export async function compactDecrypt(jwe, key, options) {
     }
     const decrypted = await flattenedDecrypt({
         ciphertext,
-        iv: (iv || undefined),
-        protected: protectedHeader || undefined,
-        tag: (tag || undefined),
+        iv: iv || undefined,
+        protected: protectedHeader,
+        tag: tag || undefined,
         encrypted_key: encryptedKey || undefined,
     }, key, options);
     const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };

package/dist/browser/jwe/flattened/decrypt.js

@@ -15,14 +15,14 @@ export async function flattenedDecrypt(jwe, key, options) {
     if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
         throw new JWEInvalid('JOSE Header missing');
     }
-    if (typeof jwe.iv !== 'string') {
-        throw new JWEInvalid('JWE Initialization Vector missing or incorrect type');
+    if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
+        throw new JWEInvalid('JWE Initialization Vector incorrect type');
     }
     if (typeof jwe.ciphertext !== 'string') {
         throw new JWEInvalid('JWE Ciphertext missing or incorrect type');
     }
-    if (typeof jwe.tag !== 'string') {
-        throw new JWEInvalid('JWE Authentication Tag missing or incorrect type');
+    if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
+        throw new JWEInvalid('JWE Authentication Tag incorrect type');
     }
     if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
         throw new JWEInvalid('JWE Protected Header incorrect type');
@@ -104,17 +104,21 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let iv;
     let tag;
-    try {
-        iv = base64url(jwe.iv);
-    }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the iv');
-    }
-    try {
-        tag = base64url(jwe.tag);
+    if (jwe.iv !== undefined) {
+        try {
+            iv = base64url(jwe.iv);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the iv');
+        }
     }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the tag');
+    if (jwe.tag !== undefined) {
+        try {
+            tag = base64url(jwe.tag);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the tag');
+        }
     }
     const protectedHeader = encoder.encode(jwe.protected ?? '');
     let additionalData;

package/dist/browser/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.1';
+    const VERSION = 'v5.2.2';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends LocalJWKSet {

package/dist/browser/runtime/decrypt.js

@@ -2,7 +2,7 @@ import { concat, uint64be } from '../lib/buffer_utils.js';
 import checkIvLength from '../lib/check_iv_length.js';
 import checkCekLength from './check_cek_length.js';
 import timingSafeEqual from './timing_safe_equal.js';
-import { JOSENotSupported, JWEDecryptionFailed } from '../util/errors.js';
+import { JOSENotSupported, JWEDecryptionFailed, JWEInvalid } from '../util/errors.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
@@ -64,6 +64,12 @@ const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
+    if (!iv) {
+        throw new JWEInvalid('JWE Initialization Vector missing');
+    }
+    if (!tag) {
+        throw new JWEInvalid('JWE Authentication Tag missing');
+    }
     checkIvLength(enc, iv);
     switch (enc) {
         case 'A128CBC-HS256':

package/dist/node/cjs/jwe/compact/decrypt.js

@@ -17,9 +17,9 @@ async function compactDecrypt(jwe, key, options) {
     }
     const decrypted = await (0, decrypt_js_1.flattenedDecrypt)({
         ciphertext,
-        iv: (iv || undefined),
-        protected: protectedHeader || undefined,
-        tag: (tag || undefined),
+        iv: iv || undefined,
+        protected: protectedHeader,
+        tag: tag || undefined,
         encrypted_key: encryptedKey || undefined,
     }, key, options);
     const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -18,14 +18,14 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
         throw new errors_js_1.JWEInvalid('JOSE Header missing');
     }
-    if (typeof jwe.iv !== 'string') {
-        throw new errors_js_1.JWEInvalid('JWE Initialization Vector missing or incorrect type');
+    if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
+        throw new errors_js_1.JWEInvalid('JWE Initialization Vector incorrect type');
     }
     if (typeof jwe.ciphertext !== 'string') {
         throw new errors_js_1.JWEInvalid('JWE Ciphertext missing or incorrect type');
     }
-    if (typeof jwe.tag !== 'string') {
-        throw new errors_js_1.JWEInvalid('JWE Authentication Tag missing or incorrect type');
+    if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
+        throw new errors_js_1.JWEInvalid('JWE Authentication Tag incorrect type');
     }
     if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
         throw new errors_js_1.JWEInvalid('JWE Protected Header incorrect type');
@@ -107,17 +107,21 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let iv;
     let tag;
-    try {
-        iv = (0, base64url_js_1.decode)(jwe.iv);
-    }
-    catch {
-        throw new errors_js_1.JWEInvalid('Failed to base64url decode the iv');
-    }
-    try {
-        tag = (0, base64url_js_1.decode)(jwe.tag);
+    if (jwe.iv !== undefined) {
+        try {
+            iv = (0, base64url_js_1.decode)(jwe.iv);
+        }
+        catch {
+            throw new errors_js_1.JWEInvalid('Failed to base64url decode the iv');
+        }
     }
-    catch {
-        throw new errors_js_1.JWEInvalid('Failed to base64url decode the tag');
+    if (jwe.tag !== undefined) {
+        try {
+            tag = (0, base64url_js_1.decode)(jwe.tag);
+        }
+        catch {
+            throw new errors_js_1.JWEInvalid('Failed to base64url decode the tag');
+        }
     }
     const protectedHeader = buffer_utils_js_1.encoder.encode(jwe.protected ?? '');
     let additionalData;

package/dist/node/cjs/jwks/remote.js

@@ -12,7 +12,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.1';
+    const VERSION = 'v5.2.2';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends local_js_1.LocalJWKSet {

package/dist/node/cjs/runtime/decrypt.js

@@ -79,6 +79,12 @@ const decrypt = (enc, cek, ciphertext, iv, tag, aad) => {
     else {
         throw new TypeError((0, invalid_key_input_js_1.default)(cek, ...is_key_like_js_1.types, 'Uint8Array'));
     }
+    if (!iv) {
+        throw new errors_js_1.JWEInvalid('JWE Initialization Vector missing');
+    }
+    if (!tag) {
+        throw new errors_js_1.JWEInvalid('JWE Authentication Tag missing');
+    }
     (0, check_cek_length_js_1.default)(enc, key);
     (0, check_iv_length_js_1.default)(enc, iv);
     switch (enc) {

package/dist/node/esm/jwe/compact/decrypt.js

@@ -14,9 +14,9 @@ export async function compactDecrypt(jwe, key, options) {
     }
     const decrypted = await flattenedDecrypt({
         ciphertext,
-        iv: (iv || undefined),
-        protected: protectedHeader || undefined,
-        tag: (tag || undefined),
+        iv: iv || undefined,
+        protected: protectedHeader,
+        tag: tag || undefined,
         encrypted_key: encryptedKey || undefined,
     }, key, options);
     const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -15,14 +15,14 @@ export async function flattenedDecrypt(jwe, key, options) {
     if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
         throw new JWEInvalid('JOSE Header missing');
     }
-    if (typeof jwe.iv !== 'string') {
-        throw new JWEInvalid('JWE Initialization Vector missing or incorrect type');
+    if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
+        throw new JWEInvalid('JWE Initialization Vector incorrect type');
     }
     if (typeof jwe.ciphertext !== 'string') {
         throw new JWEInvalid('JWE Ciphertext missing or incorrect type');
     }
-    if (typeof jwe.tag !== 'string') {
-        throw new JWEInvalid('JWE Authentication Tag missing or incorrect type');
+    if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
+        throw new JWEInvalid('JWE Authentication Tag incorrect type');
     }
     if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
         throw new JWEInvalid('JWE Protected Header incorrect type');
@@ -104,17 +104,21 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let iv;
     let tag;
-    try {
-        iv = base64url(jwe.iv);
-    }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the iv');
-    }
-    try {
-        tag = base64url(jwe.tag);
+    if (jwe.iv !== undefined) {
+        try {
+            iv = base64url(jwe.iv);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the iv');
+        }
     }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the tag');
+    if (jwe.tag !== undefined) {
+        try {
+            tag = base64url(jwe.tag);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the tag');
+        }
     }
     const protectedHeader = encoder.encode(jwe.protected ?? '');
     let additionalData;

package/dist/node/esm/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.1';
+    const VERSION = 'v5.2.2';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends LocalJWKSet {

package/dist/node/esm/runtime/decrypt.js

@@ -2,7 +2,7 @@ import { createDecipheriv, KeyObject } from 'node:crypto';
 import checkIvLength from '../lib/check_iv_length.js';
 import checkCekLength from './check_cek_length.js';
 import { concat } from '../lib/buffer_utils.js';
-import { JOSENotSupported, JWEDecryptionFailed } from '../util/errors.js';
+import { JOSENotSupported, JWEDecryptionFailed, JWEInvalid } from '../util/errors.js';
 import timingSafeEqual from './timing_safe_equal.js';
 import cbcTag from './cbc_tag.js';
 import { isCryptoKey } from './webcrypto.js';
@@ -77,6 +77,12 @@ const decrypt = (enc, cek, ciphertext, iv, tag, aad) => {
     else {
         throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
+    if (!iv) {
+        throw new JWEInvalid('JWE Initialization Vector missing');
+    }
+    if (!tag) {
+        throw new JWEInvalid('JWE Authentication Tag missing');
+    }
     checkCekLength(enc, key);
     checkIvLength(enc, iv);
     switch (enc) {

package/dist/types/key/import.d.ts

@@ -11,6 +11,10 @@ export interface PEMImportOptions {
  * Imports a PEM-encoded SPKI string as a runtime-specific public key representation (KeyObject or
  * CryptoKey).
  *
+ * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
+ * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
+ * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ *
  * @param spki PEM-encoded SPKI string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -21,6 +25,10 @@ export declare function importSPKI<KeyLikeType extends KeyLike = KeyLike>(spki:
  * Imports the SPKI from an X.509 string certificate as a runtime-specific public key representation
  * (KeyObject or CryptoKey).
  *
+ * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
+ * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
+ * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ *
  * @param x509 X.509 certificate string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -31,6 +39,10 @@ export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509:
  * Imports a PEM-encoded PKCS#8 string as a runtime-specific private key representation (KeyObject
  * or CryptoKey).
  *
+ * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
+ * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
+ * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ *
  * @param pkcs8 PEM-encoded PKCS#8 string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -38,10 +50,11 @@ export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509:
  */
 export declare function importPKCS8<KeyLikeType extends KeyLike = KeyLike>(pkcs8: string, alg: string, options?: PEMImportOptions): Promise<KeyLikeType>;
 /**
- * Imports a JWK to a runtime-specific key representation (KeyLike). Either JWK "alg" (Algorithm)
- * Parameter must be present or the optional "alg" argument. When running on a runtime using
- * {@link https://www.w3.org/TR/WebCryptoAPI/ Web Cryptography API} the jwk parameters "use",
- * "key_ops", and "ext" are also used in the resulting `CryptoKey`.
+ * Imports a JWK to a runtime-specific key representation (KeyLike). Either the JWK "alg"
+ * (Algorithm) Parameter, or the optional "alg" argument, must be present.
+ *
+ * Note: When the runtime is using {@link https://w3c.github.io/webcrypto/ Web Cryptography API} the
+ * jwk parameters "use", "key_ops", and "ext" are also used in the resulting `CryptoKey`.
  *
  * @param jwk JSON Web Key.
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used

package/dist/types/types.d.ts

@@ -264,7 +264,7 @@ export interface FlattenedJWE {
    * The "iv" member MUST be present and contain the value BASE64URL(JWE Initialization Vector) when
    * the JWE Initialization Vector value is non-empty; otherwise, it MUST be absent.
    */
-  iv: string
+  iv?: string
 
   /**
    * The "protected" member MUST be present and contain the value BASE64URL(UTF8(JWE Protected
@@ -277,7 +277,7 @@ export interface FlattenedJWE {
    * The "tag" member MUST be present and contain the value BASE64URL(JWE Authentication Tag) when
    * the JWE Authentication Tag value is non-empty; otherwise, it MUST be absent.
    */
-  tag: string
+  tag?: string
 
   /**
    * The "unprotected" member MUST be present and contain the value JWE Shared Unprotected Header

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "5.2.1",
+  "version": "5.2.2",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",