jose 5.5.0 → 5.6.0

package/dist/browser/jwks/remote.js

@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.5.0';
+    const VERSION = 'v5.6.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const experimental_jwksCache = Symbol();

package/dist/browser/lib/check_key_type.js

@@ -1,5 +1,6 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import isKeyLike, { types } from '../runtime/is_key_like.js';
+const tag = (key) => key?.[Symbol.toStringTag];
 const symmetricTypeCheck = (alg, key) => {
     if (key instanceof Uint8Array)
         return;
@@ -7,7 +8,7 @@ const symmetricTypeCheck = (alg, key) => {
         throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array'));
     }
     if (key.type !== 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
+        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
     }
 };
 const asymmetricTypeCheck = (alg, key, usage) => {
@@ -15,19 +16,19 @@ const asymmetricTypeCheck = (alg, key, usage) => {
         throw new TypeError(invalidKeyInput(alg, key, ...types));
     }
     if (key.type === 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
     }
     if (usage === 'sign' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm signing must be of type "private"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
     }
     if (usage === 'decrypt' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm decryption must be of type "private"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
     }
     if (key.algorithm && usage === 'verify' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm verifying must be of type "public"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
     }
     if (key.algorithm && usage === 'encrypt' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm encryption must be of type "public"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
     }
 };
 const checkKeyType = (alg, key, usage) => {

package/dist/browser/lib/decrypt_key_management.js

@@ -3,6 +3,7 @@ import * as ECDH from '../runtime/ecdhes.js';
 import { decrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { decrypt as rsaEs } from '../runtime/rsaes.js';
 import { decode as base64url } from '../runtime/base64url.js';
+import * as normalize from '../runtime/normalize_key.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLength as cekLength } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
@@ -10,6 +11,9 @@ import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
 import { unwrap as aesGcmKw } from './aesgcmkw.js';
 async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
+    if (normalize.normalizePrivateKey) {
+        key = await normalize.normalizePrivateKey(key, alg);
+    }
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {

package/dist/browser/lib/encrypt_key_management.js

@@ -3,6 +3,7 @@ import * as ECDH from '../runtime/ecdhes.js';
 import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
 import { encode as base64url } from '../runtime/base64url.js';
+import * as normalize from '../runtime/normalize_key.js';
 import generateCek, { bitLength as cekLength } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
@@ -12,6 +13,9 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
     let encryptedKey;
     let parameters;
     let cek;
+    if (normalize.normalizePublicKey) {
+        key = await normalize.normalizePublicKey(key, alg);
+    }
     checkKeyType(alg, key, 'encrypt');
     switch (alg) {
         case 'dir': {

package/dist/browser/runtime/get_sign_verify_key.js

@@ -2,7 +2,14 @@ import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkSigCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
-export default function getCryptoKey(alg, key, usage) {
+import * as normalize from './normalize_key.js';
+export default async function getCryptoKey(alg, key, usage) {
+    if (normalize.normalizePrivateKey && usage === 'sign') {
+        key = await normalize.normalizePrivateKey(key, alg);
+    }
+    if (normalize.normalizePublicKey && usage === 'verify') {
+        key = await normalize.normalizePublicKey(key, alg);
+    }
     if (isCryptoKey(key)) {
         checkSigCryptoKey(key, alg, usage);
         return key;

package/dist/browser/runtime/is_key_like.js

@@ -1,5 +1,8 @@
 import { isCryptoKey } from './webcrypto.js';
 export default (key) => {
-    return isCryptoKey(key);
+    if (isCryptoKey(key)) {
+        return true;
+    }
+    return key?.[Symbol.toStringTag] === 'KeyObject';
 };
 export const types = ['CryptoKey'];

package/dist/browser/runtime/normalize_key.js

@@ -0,0 +1,29 @@
+import { decode } from './base64url.js';
+import importJWK from './jwk_to_key.js';
+const normalizeSecretKey = (k) => decode(k);
+export const normalizePublicKey = async (key, alg) => {
+    if (key?.[Symbol.toStringTag] === 'KeyObject') {
+        let jwk = key.export({ format: 'jwk' });
+        delete jwk.d;
+        delete jwk.dp;
+        delete jwk.dq;
+        delete jwk.p;
+        delete jwk.q;
+        delete jwk.qi;
+        if (jwk.k) {
+            return normalizeSecretKey(jwk.k);
+        }
+        return importJWK({ ...jwk, alg });
+    }
+    return key;
+};
+export const normalizePrivateKey = async (key, alg) => {
+    if (key?.[Symbol.toStringTag] === 'KeyObject') {
+        let jwk = key.export({ format: 'jwk' });
+        if (jwk.k) {
+            return normalizeSecretKey(jwk.k);
+        }
+        return importJWK({ ...jwk, alg });
+    }
+    return key;
+};

package/dist/node/cjs/jwks/remote.js

@@ -13,7 +13,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.5.0';
+    const VERSION = 'v5.6.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 exports.experimental_jwksCache = Symbol();

package/dist/node/cjs/lib/check_key_type.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const is_key_like_js_1 = require("../runtime/is_key_like.js");
+const tag = (key) => key?.[Symbol.toStringTag];
 const symmetricTypeCheck = (alg, key) => {
     if (key instanceof Uint8Array)
         return;
@@ -9,7 +10,7 @@ const symmetricTypeCheck = (alg, key) => {
         throw new TypeError((0, invalid_key_input_js_1.withAlg)(alg, key, ...is_key_like_js_1.types, 'Uint8Array'));
     }
     if (key.type !== 'secret') {
-        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
+        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
     }
 };
 const asymmetricTypeCheck = (alg, key, usage) => {
@@ -17,19 +18,19 @@ const asymmetricTypeCheck = (alg, key, usage) => {
         throw new TypeError((0, invalid_key_input_js_1.withAlg)(alg, key, ...is_key_like_js_1.types));
     }
     if (key.type === 'secret') {
-        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
     }
     if (usage === 'sign' && key.type === 'public') {
-        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithm signing must be of type "private"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
     }
     if (usage === 'decrypt' && key.type === 'public') {
-        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithm decryption must be of type "private"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
     }
     if (key.algorithm && usage === 'verify' && key.type === 'private') {
-        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithm verifying must be of type "public"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
     }
     if (key.algorithm && usage === 'encrypt' && key.type === 'private') {
-        throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithm encryption must be of type "public"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
     }
 };
 const checkKeyType = (alg, key, usage) => {

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -5,6 +5,7 @@ const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
 const rsaes_js_1 = require("../runtime/rsaes.js");
 const base64url_js_1 = require("../runtime/base64url.js");
+const normalize = require("../runtime/normalize_key.js");
 const errors_js_1 = require("../util/errors.js");
 const cek_js_1 = require("../lib/cek.js");
 const import_js_1 = require("../key/import.js");
@@ -12,6 +13,9 @@ const check_key_type_js_1 = require("./check_key_type.js");
 const is_object_js_1 = require("./is_object.js");
 const aesgcmkw_js_1 = require("./aesgcmkw.js");
 async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
+    if (normalize.normalizePrivateKey) {
+        key = await normalize.normalizePrivateKey(key, alg);
+    }
     (0, check_key_type_js_1.default)(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -5,6 +5,7 @@ const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
 const rsaes_js_1 = require("../runtime/rsaes.js");
 const base64url_js_1 = require("../runtime/base64url.js");
+const normalize = require("../runtime/normalize_key.js");
 const cek_js_1 = require("../lib/cek.js");
 const errors_js_1 = require("../util/errors.js");
 const export_js_1 = require("../key/export.js");
@@ -14,6 +15,9 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
     let encryptedKey;
     let parameters;
     let cek;
+    if (normalize.normalizePublicKey) {
+        key = await normalize.normalizePublicKey(key, alg);
+    }
     (0, check_key_type_js_1.default)(alg, key, 'encrypt');
     switch (alg) {
         case 'dir': {

package/dist/node/cjs/runtime/normalize_key.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/node/esm/jwks/remote.js

@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.5.0';
+    const VERSION = 'v5.6.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const experimental_jwksCache = Symbol();

package/dist/node/esm/lib/check_key_type.js

@@ -1,5 +1,6 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import isKeyLike, { types } from '../runtime/is_key_like.js';
+const tag = (key) => key?.[Symbol.toStringTag];
 const symmetricTypeCheck = (alg, key) => {
     if (key instanceof Uint8Array)
         return;
@@ -7,7 +8,7 @@ const symmetricTypeCheck = (alg, key) => {
         throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array'));
     }
     if (key.type !== 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
+        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
     }
 };
 const asymmetricTypeCheck = (alg, key, usage) => {
@@ -15,19 +16,19 @@ const asymmetricTypeCheck = (alg, key, usage) => {
         throw new TypeError(invalidKeyInput(alg, key, ...types));
     }
     if (key.type === 'secret') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
     }
     if (usage === 'sign' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm signing must be of type "private"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
     }
     if (usage === 'decrypt' && key.type === 'public') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm decryption must be of type "private"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
     }
     if (key.algorithm && usage === 'verify' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm verifying must be of type "public"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
     }
     if (key.algorithm && usage === 'encrypt' && key.type === 'private') {
-        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm encryption must be of type "public"`);
+        throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
     }
 };
 const checkKeyType = (alg, key, usage) => {

package/dist/node/esm/lib/decrypt_key_management.js

@@ -3,6 +3,7 @@ import * as ECDH from '../runtime/ecdhes.js';
 import { decrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { decrypt as rsaEs } from '../runtime/rsaes.js';
 import { decode as base64url } from '../runtime/base64url.js';
+import * as normalize from '../runtime/normalize_key.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLength as cekLength } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
@@ -10,6 +11,9 @@ import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
 import { unwrap as aesGcmKw } from './aesgcmkw.js';
 async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
+    if (normalize.normalizePrivateKey) {
+        key = await normalize.normalizePrivateKey(key, alg);
+    }
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {

package/dist/node/esm/lib/encrypt_key_management.js

@@ -3,6 +3,7 @@ import * as ECDH from '../runtime/ecdhes.js';
 import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
 import { encode as base64url } from '../runtime/base64url.js';
+import * as normalize from '../runtime/normalize_key.js';
 import generateCek, { bitLength as cekLength } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
@@ -12,6 +13,9 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
     let encryptedKey;
     let parameters;
     let cek;
+    if (normalize.normalizePublicKey) {
+        key = await normalize.normalizePublicKey(key, alg);
+    }
     checkKeyType(alg, key, 'encrypt');
     switch (alg) {
         case 'dir': {

package/dist/node/esm/runtime/normalize_key.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",