jose 5.8.0 → 5.9.0

package/README.md

@@ -92,23 +92,6 @@ The following are additional features and utilities provided by the `jose` modul
 - [Unsecured JWT](docs/classes/jwt_unsecured.UnsecuredJWT.md)
 - [JOSE Errors](docs/modules/util_errors.md)
 
-## Implemented specifications
-
-The `jose` module implements the following specifications:
-
-- JSON Web Signature (JWS) - [RFC7515](https://www.rfc-editor.org/rfc/rfc7515)
-- JSON Web Encryption (JWE) - [RFC7516](https://www.rfc-editor.org/rfc/rfc7516)
-- JSON Web Key (JWK) - [RFC7517](https://www.rfc-editor.org/rfc/rfc7517)
-- JSON Web Algorithms (JWA) - [RFC7518](https://www.rfc-editor.org/rfc/rfc7518)
-- JSON Web Token (JWT) - [RFC7519](https://www.rfc-editor.org/rfc/rfc7519)
-- JSON Web Key Thumbprint - [RFC7638](https://www.rfc-editor.org/rfc/rfc7638)
-- JSON Web Key Thumbprint URI - [RFC9278](https://www.rfc-editor.org/rfc/rfc9278)
-- JWS Unencoded Payload Option - [RFC7797](https://www.rfc-editor.org/rfc/rfc7797)
-- CFRG Elliptic Curve ECDH and Signatures - [RFC8037](https://www.rfc-editor.org/rfc/rfc8037)
-- secp256k1 EC Key curve support - [RFC8812](https://www.rfc-editor.org/rfc/rfc8812)
-
-The algorithm implementations have been tested using test vectors from their respective specifications as well as [RFC7520](https://www.rfc-editor.org/rfc/rfc7520).
-
 ## Supported Runtimes
 
 The `jose` module is compatible with JavaScript runtimes that support the utilized Web API globals and standard built-in objects or are Node.js.
@@ -131,3 +114,24 @@ Please note that certain algorithms may not be available depending on the runtim
 | [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅ | ✅ | ✅ |
 | [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ❌ | ❌ |
 | [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ❌ | ❌ |
+
+## Specifications
+
+<details>
+<summary>Details</summary>
+
+- JSON Web Signature (JWS) - [RFC7515](https://www.rfc-editor.org/rfc/rfc7515)
+- JSON Web Encryption (JWE) - [RFC7516](https://www.rfc-editor.org/rfc/rfc7516)
+- JSON Web Key (JWK) - [RFC7517](https://www.rfc-editor.org/rfc/rfc7517)
+- JSON Web Algorithms (JWA) - [RFC7518](https://www.rfc-editor.org/rfc/rfc7518)
+- JSON Web Token (JWT) - [RFC7519](https://www.rfc-editor.org/rfc/rfc7519)
+- JSON Web Key Thumbprint - [RFC7638](https://www.rfc-editor.org/rfc/rfc7638)
+- JSON Web Key Thumbprint URI - [RFC9278](https://www.rfc-editor.org/rfc/rfc9278)
+- JWS Unencoded Payload Option - [RFC7797](https://www.rfc-editor.org/rfc/rfc7797)
+- CFRG Elliptic Curve ECDH and Signatures - [RFC8037](https://www.rfc-editor.org/rfc/rfc8037)
+- secp256k1 EC Key curve support - [RFC8812](https://www.rfc-editor.org/rfc/rfc8812)
+
+The algorithm implementations in `jose` have been tested using test vectors from their respective specifications as well as [RFC7520](https://www.rfc-editor.org/rfc/rfc7520).
+
+
+</details>

package/dist/browser/jwks/remote.js

@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.8.0';
+    const VERSION = 'v5.9.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const jwksCache = Symbol();

package/dist/browser/jws/flattened/sign.js

@@ -3,7 +3,7 @@ import sign from '../../runtime/sign.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 export class FlattenedSign {
     constructor(payload) {
@@ -49,7 +49,7 @@ export class FlattenedSign {
         if (typeof alg !== 'string' || !alg) {
             throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
-        checkKeyType(alg, key, 'sign');
+        checkKeyTypeWithJwk(alg, key, 'sign');
         let payload = this._payload;
         if (b64) {
             payload = encoder.encode(base64url(payload));

package/dist/browser/jws/flattened/verify.js

@@ -4,9 +4,11 @@ import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '.
 import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
+import { isJWK } from '../../lib/is_jwk.js';
+import { importJWK } from '../../key/import.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
@@ -71,8 +73,14 @@ export async function flattenedVerify(jws, key, options) {
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
         resolvedKey = true;
+        checkKeyTypeWithJwk(alg, key, 'verify');
+        if (isJWK(key)) {
+            key = await importJWK(key, alg);
+        }
+    }
+    else {
+        checkKeyTypeWithJwk(alg, key, 'verify');
     }
-    checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {

package/dist/browser/lib/check_key_type.js

@@ -1,19 +1,49 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import isKeyLike, { types } from '../runtime/is_key_like.js';
+import * as jwk from './is_jwk.js';
 const tag = (key) => key?.[Symbol.toStringTag];
-const symmetricTypeCheck = (alg, key) => {
+const jwkMatchesOp = (alg, key, usage) => {
+    if (key.use !== undefined && key.use !== 'sig') {
+        throw new TypeError('Invalid key for this operation, when present its use must be sig');
+    }
+    if (key.key_ops !== undefined && key.key_ops.includes?.(usage) !== true) {
+        throw new TypeError(`Invalid key for this operation, when present its key_ops must include ${usage}`);
+    }
+    if (key.alg !== undefined && key.alg !== alg) {
+        throw new TypeError(`Invalid key for this operation, when present its alg must be ${alg}`);
+    }
+    return true;
+};
+const symmetricTypeCheck = (alg, key, usage, allowJwk) => {
     if (key instanceof Uint8Array)
         return;
+    if (allowJwk && jwk.isJWK(key)) {
+        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
+            return;
+        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+    }
     if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array', allowJwk ? 'JSON Web Key' : null));
     }
     if (key.type !== 'secret') {
         throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
     }
 };
-const asymmetricTypeCheck = (alg, key, usage) => {
+const asymmetricTypeCheck = (alg, key, usage, allowJwk) => {
+    if (allowJwk && jwk.isJWK(key)) {
+        switch (usage) {
+            case 'sign':
+                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a private JWK`);
+            case 'verify':
+                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a public JWK`);
+        }
+    }
     if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, ...types));
+        throw new TypeError(invalidKeyInput(alg, key, ...types, allowJwk ? 'JSON Web Key' : null));
     }
     if (key.type === 'secret') {
         throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
@@ -31,16 +61,17 @@ const asymmetricTypeCheck = (alg, key, usage) => {
         throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
     }
 };
-const checkKeyType = (alg, key, usage) => {
+function checkKeyType(allowJwk, alg, key, usage) {
     const symmetric = alg.startsWith('HS') ||
         alg === 'dir' ||
         alg.startsWith('PBES2') ||
         /^A\d{3}(?:GCM)?KW$/.test(alg);
     if (symmetric) {
-        symmetricTypeCheck(alg, key);
+        symmetricTypeCheck(alg, key, usage, allowJwk);
     }
     else {
-        asymmetricTypeCheck(alg, key, usage);
+        asymmetricTypeCheck(alg, key, usage, allowJwk);
     }
-};
-export default checkKeyType;
+}
+export default checkKeyType.bind(undefined, false);
+export const checkKeyTypeWithJwk = checkKeyType.bind(undefined, true);

package/dist/browser/lib/invalid_key_input.js

@@ -1,4 +1,5 @@
 function message(msg, actual, ...types) {
+    types = types.filter(Boolean);
     if (types.length > 2) {
         const last = types.pop();
         msg += `one of type ${types.join(', ')}, or ${last}.`;

package/dist/browser/lib/is_jwk.js

@@ -0,0 +1,13 @@
+import isObject from './is_object.js';
+export function isJWK(key) {
+    return isObject(key) && typeof key.kty === 'string';
+}
+export function isPrivateJWK(key) {
+    return key.kty !== 'oct' && typeof key.d === 'string';
+}
+export function isPublicJWK(key) {
+    return key.kty !== 'oct' && typeof key.d === 'undefined';
+}
+export function isSecretJWK(key) {
+    return isJWK(key) && key.kty === 'oct' && typeof key.k === 'string';
+}

package/dist/browser/runtime/get_sign_verify_key.js

@@ -20,5 +20,5 @@ export default async function getCryptoKey(alg, key, usage) {
         }
         return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);
     }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array', 'JSON Web Key'));
 }

package/dist/browser/runtime/normalize_key.js

@@ -1,17 +1,20 @@
+import { isJWK } from '../lib/is_jwk.js';
 import { decode } from './base64url.js';
 import importJWK from './jwk_to_key.js';
-const normalizeSecretKey = (k) => decode(k);
+const exportKeyValue = (k) => decode(k);
 let privCache;
 let pubCache;
 const isKeyObject = (key) => {
     return key?.[Symbol.toStringTag] === 'KeyObject';
 };
-const importAndCache = async (cache, key, jwk, alg) => {
+const importAndCache = async (cache, key, jwk, alg, freeze = false) => {
     let cached = cache.get(key);
     if (cached?.[alg]) {
         return cached[alg];
     }
     const cryptoKey = await importJWK({ ...jwk, alg });
+    if (freeze)
+        Object.freeze(key);
     if (!cached) {
         cache.set(key, { [alg]: cryptoKey });
     }
@@ -30,22 +33,36 @@ const normalizePublicKey = (key, alg) => {
         delete jwk.q;
         delete jwk.qi;
         if (jwk.k) {
-            return normalizeSecretKey(jwk.k);
+            return exportKeyValue(jwk.k);
         }
         pubCache || (pubCache = new WeakMap());
         return importAndCache(pubCache, key, jwk, alg);
     }
+    if (isJWK(key)) {
+        if (key.k)
+            return decode(key.k);
+        pubCache || (pubCache = new WeakMap());
+        const cryptoKey = importAndCache(pubCache, key, key, alg, true);
+        return cryptoKey;
+    }
     return key;
 };
 const normalizePrivateKey = (key, alg) => {
     if (isKeyObject(key)) {
         let jwk = key.export({ format: 'jwk' });
         if (jwk.k) {
-            return normalizeSecretKey(jwk.k);
+            return exportKeyValue(jwk.k);
         }
         privCache || (privCache = new WeakMap());
         return importAndCache(privCache, key, jwk, alg);
     }
+    if (isJWK(key)) {
+        if (key.k)
+            return decode(key.k);
+        privCache || (privCache = new WeakMap());
+        const cryptoKey = importAndCache(privCache, key, key, alg, true);
+        return cryptoKey;
+    }
     return key;
 };
 export default { normalizePublicKey, normalizePrivateKey };

package/dist/node/cjs/jwks/remote.js

@@ -13,7 +13,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.8.0';
+    const VERSION = 'v5.9.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 exports.jwksCache = Symbol();

package/dist/node/cjs/jws/flattened/sign.js

@@ -55,7 +55,7 @@ class FlattenedSign {
         if (typeof alg !== 'string' || !alg) {
             throw new errors_js_1.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
-        (0, check_key_type_js_1.default)(alg, key, 'sign');
+        (0, check_key_type_js_1.checkKeyTypeWithJwk)(alg, key, 'sign');
         let payload = this._payload;
         if (b64) {
             payload = buffer_utils_js_1.encoder.encode((0, base64url_js_1.encode)(payload));

package/dist/node/cjs/jws/flattened/verify.js

@@ -10,6 +10,8 @@ const is_object_js_1 = require("../../lib/is_object.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
+const is_jwk_js_1 = require("../../lib/is_jwk.js");
+const import_js_1 = require("../../key/import.js");
 async function flattenedVerify(jws, key, options) {
     if (!(0, is_object_js_1.default)(jws)) {
         throw new errors_js_1.JWSInvalid('Flattened JWS must be an object');
@@ -74,8 +76,14 @@ async function flattenedVerify(jws, key, options) {
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
         resolvedKey = true;
+        (0, check_key_type_js_1.checkKeyTypeWithJwk)(alg, key, 'verify');
+        if ((0, is_jwk_js_1.isJWK)(key)) {
+            key = await (0, import_js_1.importJWK)(key, alg);
+        }
+    }
+    else {
+        (0, check_key_type_js_1.checkKeyTypeWithJwk)(alg, key, 'verify');
     }
-    (0, check_key_type_js_1.default)(alg, key, 'verify');
     const data = (0, buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode(jws.protected ?? ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {

package/dist/node/cjs/lib/check_key_type.js

@@ -1,21 +1,52 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkKeyTypeWithJwk = void 0;
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const is_key_like_js_1 = require("../runtime/is_key_like.js");
+const jwk = require("./is_jwk.js");
 const tag = (key) => key?.[Symbol.toStringTag];
-const symmetricTypeCheck = (alg, key) => {
+const jwkMatchesOp = (alg, key, usage) => {
+    if (key.use !== undefined && key.use !== 'sig') {
+        throw new TypeError('Invalid key for this operation, when present its use must be sig');
+    }
+    if (key.key_ops !== undefined && key.key_ops.includes?.(usage) !== true) {
+        throw new TypeError(`Invalid key for this operation, when present its key_ops must include ${usage}`);
+    }
+    if (key.alg !== undefined && key.alg !== alg) {
+        throw new TypeError(`Invalid key for this operation, when present its alg must be ${alg}`);
+    }
+    return true;
+};
+const symmetricTypeCheck = (alg, key, usage, allowJwk) => {
     if (key instanceof Uint8Array)
         return;
+    if (allowJwk && jwk.isJWK(key)) {
+        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
+            return;
+        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+    }
     if (!(0, is_key_like_js_1.default)(key)) {
-        throw new TypeError((0, invalid_key_input_js_1.withAlg)(alg, key, ...is_key_like_js_1.types, 'Uint8Array'));
+        throw new TypeError((0, invalid_key_input_js_1.withAlg)(alg, key, ...is_key_like_js_1.types, 'Uint8Array', allowJwk ? 'JSON Web Key' : null));
     }
     if (key.type !== 'secret') {
         throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
     }
 };
-const asymmetricTypeCheck = (alg, key, usage) => {
+const asymmetricTypeCheck = (alg, key, usage, allowJwk) => {
+    if (allowJwk && jwk.isJWK(key)) {
+        switch (usage) {
+            case 'sign':
+                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a private JWK`);
+            case 'verify':
+                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a public JWK`);
+        }
+    }
     if (!(0, is_key_like_js_1.default)(key)) {
-        throw new TypeError((0, invalid_key_input_js_1.withAlg)(alg, key, ...is_key_like_js_1.types));
+        throw new TypeError((0, invalid_key_input_js_1.withAlg)(alg, key, ...is_key_like_js_1.types, allowJwk ? 'JSON Web Key' : null));
     }
     if (key.type === 'secret') {
         throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
@@ -33,16 +64,17 @@ const asymmetricTypeCheck = (alg, key, usage) => {
         throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
     }
 };
-const checkKeyType = (alg, key, usage) => {
+function checkKeyType(allowJwk, alg, key, usage) {
     const symmetric = alg.startsWith('HS') ||
         alg === 'dir' ||
         alg.startsWith('PBES2') ||
         /^A\d{3}(?:GCM)?KW$/.test(alg);
     if (symmetric) {
-        symmetricTypeCheck(alg, key);
+        symmetricTypeCheck(alg, key, usage, allowJwk);
     }
     else {
-        asymmetricTypeCheck(alg, key, usage);
+        asymmetricTypeCheck(alg, key, usage, allowJwk);
     }
-};
-exports.default = checkKeyType;
+}
+exports.default = checkKeyType.bind(undefined, false);
+exports.checkKeyTypeWithJwk = checkKeyType.bind(undefined, true);

package/dist/node/cjs/lib/invalid_key_input.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.withAlg = void 0;
 function message(msg, actual, ...types) {
+    types = types.filter(Boolean);
     if (types.length > 2) {
         const last = types.pop();
         msg += `one of type ${types.join(', ')}, or ${last}.`;

package/dist/node/cjs/lib/is_jwk.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSecretJWK = exports.isPublicJWK = exports.isPrivateJWK = exports.isJWK = void 0;
+const is_object_js_1 = require("./is_object.js");
+function isJWK(key) {
+    return (0, is_object_js_1.default)(key) && typeof key.kty === 'string';
+}
+exports.isJWK = isJWK;
+function isPrivateJWK(key) {
+    return key.kty !== 'oct' && typeof key.d === 'string';
+}
+exports.isPrivateJWK = isPrivateJWK;
+function isPublicJWK(key) {
+    return key.kty !== 'oct' && typeof key.d === 'undefined';
+}
+exports.isPublicJWK = isPublicJWK;
+function isSecretJWK(key) {
+    return isJWK(key) && key.kty === 'oct' && typeof key.k === 'string';
+}
+exports.isSecretJWK = isSecretJWK;

package/dist/node/cjs/runtime/base64url.js

@@ -16,5 +16,5 @@ const decodeBase64 = (input) => new Uint8Array(node_buffer_1.Buffer.from(input,
 exports.decodeBase64 = decodeBase64;
 const encodeBase64 = (input) => node_buffer_1.Buffer.from(input).toString('base64');
 exports.encodeBase64 = encodeBase64;
-const decode = (input) => new Uint8Array(node_buffer_1.Buffer.from(normalize(input), 'base64'));
+const decode = (input) => new Uint8Array(node_buffer_1.Buffer.from(normalize(input), 'base64url'));
 exports.decode = decode;

package/dist/node/cjs/runtime/check_key_length.js

@@ -1,7 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = require("node:crypto");
 exports.default = (key, alg) => {
-    const { modulusLength } = key.asymmetricKeyDetails;
+    let modulusLength;
+    try {
+        if (key instanceof node_crypto_1.KeyObject) {
+            modulusLength = key.asymmetricKeyDetails?.modulusLength;
+        }
+        else {
+            modulusLength = Buffer.from(key.n, 'base64url').byteLength << 3;
+        }
+    }
+    catch { }
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
         throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
     }

package/dist/node/cjs/runtime/get_named_curve.js

@@ -7,6 +7,7 @@ const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
+const is_jwk_js_1 = require("../lib/is_jwk.js");
 exports.weakMap = new WeakMap();
 const namedCurveToJOSE = (namedCurve) => {
     switch (namedCurve) {
@@ -30,6 +31,9 @@ const getNamedCurve = (kee, raw) => {
     else if ((0, is_key_object_js_1.default)(kee)) {
         key = kee;
     }
+    else if ((0, is_jwk_js_1.isJWK)(kee)) {
+        return kee.crv;
+    }
     else {
         throw new TypeError((0, invalid_key_input_js_1.default)(kee, ...is_key_like_js_1.types));
     }

package/dist/node/cjs/runtime/get_sign_verify_key.js

@@ -5,6 +5,7 @@ const webcrypto_js_1 = require("./webcrypto.js");
 const crypto_key_js_1 = require("../lib/crypto_key.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
+const jwk = require("../lib/is_jwk.js");
 function getSignVerifyKey(alg, key, usage) {
     if (key instanceof Uint8Array) {
         if (!alg.startsWith('HS')) {
@@ -19,6 +20,12 @@ function getSignVerifyKey(alg, key, usage) {
         (0, crypto_key_js_1.checkSigCryptoKey)(key, alg, usage);
         return node_crypto_1.KeyObject.from(key);
     }
-    throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
+    if (jwk.isJWK(key)) {
+        if (alg.startsWith('HS')) {
+            return (0, node_crypto_1.createSecretKey)(Buffer.from(key.k, 'base64url'));
+        }
+        return key;
+    }
+    throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array', 'JSON Web Key'));
 }
 exports.default = getSignVerifyKey;

package/dist/node/cjs/runtime/node_key.js

@@ -4,10 +4,6 @@ const node_crypto_1 = require("node:crypto");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const errors_js_1 = require("../util/errors.js");
 const check_key_length_js_1 = require("./check_key_length.js");
-const PSS = {
-    padding: node_crypto_1.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: node_crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
-};
 const ecCurveAlgMap = new Map([
     ['ES256', 'P-256'],
     ['ES256K', 'secp256k1'],
@@ -15,25 +11,57 @@ const ecCurveAlgMap = new Map([
     ['ES512', 'P-521'],
 ]);
 function keyForCrypto(alg, key) {
+    let asymmetricKeyType;
+    let asymmetricKeyDetails;
+    let isJWK;
+    if (key instanceof node_crypto_1.KeyObject) {
+        asymmetricKeyType = key.asymmetricKeyType;
+        asymmetricKeyDetails = key.asymmetricKeyDetails;
+    }
+    else {
+        isJWK = true;
+        switch (key.kty) {
+            case 'RSA':
+                asymmetricKeyType = 'rsa';
+                break;
+            case 'EC':
+                asymmetricKeyType = 'ec';
+                break;
+            case 'OKP': {
+                if (key.crv === 'Ed25519') {
+                    asymmetricKeyType = 'ed25519';
+                    break;
+                }
+                if (key.crv === 'Ed448') {
+                    asymmetricKeyType = 'ed448';
+                    break;
+                }
+                throw new TypeError('Invalid key for this operation, its crv must be Ed25519 or Ed448');
+            }
+            default:
+                throw new TypeError('Invalid key for this operation, its kty must be RSA, OKP, or EC');
+        }
+    }
+    let options;
     switch (alg) {
         case 'EdDSA':
-            if (!['ed25519', 'ed448'].includes(key.asymmetricKeyType)) {
+            if (!['ed25519', 'ed448'].includes(asymmetricKeyType)) {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');
             }
-            return key;
+            break;
         case 'RS256':
         case 'RS384':
         case 'RS512':
-            if (key.asymmetricKeyType !== 'rsa') {
+            if (asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
             (0, check_key_length_js_1.default)(key, alg);
-            return key;
+            break;
         case 'PS256':
         case 'PS384':
         case 'PS512':
-            if (key.asymmetricKeyType === 'rsa-pss') {
-                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
+            if (asymmetricKeyType === 'rsa-pss') {
+                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
                 if (hashAlgorithm !== undefined &&
                     (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
@@ -43,16 +71,20 @@ function keyForCrypto(alg, key) {
                     throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
                 }
             }
-            else if (key.asymmetricKeyType !== 'rsa') {
+            else if (asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
             }
             (0, check_key_length_js_1.default)(key, alg);
-            return { key, ...PSS };
+            options = {
+                padding: node_crypto_1.constants.RSA_PKCS1_PSS_PADDING,
+                saltLength: node_crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
+            };
+            break;
         case 'ES256':
         case 'ES256K':
         case 'ES384':
         case 'ES512': {
-            if (key.asymmetricKeyType !== 'ec') {
+            if (asymmetricKeyType !== 'ec') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ec');
             }
             const actual = (0, get_named_curve_js_1.default)(key);
@@ -60,10 +92,15 @@ function keyForCrypto(alg, key) {
             if (actual !== expected) {
                 throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);
             }
-            return { dsaEncoding: 'ieee-p1363', key };
+            options = { dsaEncoding: 'ieee-p1363' };
+            break;
         }
         default:
             throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }
+    if (isJWK) {
+        return { format: 'jwk', key, ...options };
+    }
+    return options ? { ...options, key } : key;
 }
 exports.default = keyForCrypto;

package/dist/node/cjs/runtime/sign.js

@@ -8,12 +8,12 @@ const node_key_js_1 = require("./node_key.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
 const oneShotSign = (0, node_util_1.promisify)(crypto.sign);
 const sign = async (alg, key, data) => {
-    const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'sign');
+    const k = (0, get_sign_verify_key_js_1.default)(alg, key, 'sign');
     if (alg.startsWith('HS')) {
-        const hmac = crypto.createHmac((0, hmac_digest_js_1.default)(alg), keyObject);
+        const hmac = crypto.createHmac((0, hmac_digest_js_1.default)(alg), k);
         hmac.update(data);
         return hmac.digest();
     }
-    return oneShotSign((0, dsa_digest_js_1.default)(alg), data, (0, node_key_js_1.default)(alg, keyObject));
+    return oneShotSign((0, dsa_digest_js_1.default)(alg), data, (0, node_key_js_1.default)(alg, k));
 };
 exports.default = sign;