jose 5.9.3 → 5.9.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +43 -31
- package/dist/browser/jwks/remote.js +1 -1
- package/dist/browser/util/errors.js +29 -64
- package/dist/node/cjs/jwe/compact/decrypt.js +1 -2
- package/dist/node/cjs/jwe/flattened/decrypt.js +1 -2
- package/dist/node/cjs/jwe/general/decrypt.js +1 -2
- package/dist/node/cjs/jwk/embedded.js +1 -2
- package/dist/node/cjs/jwk/thumbprint.js +2 -3
- package/dist/node/cjs/jwks/local.js +1 -2
- package/dist/node/cjs/jwks/remote.js +3 -3
- package/dist/node/cjs/jws/compact/verify.js +1 -2
- package/dist/node/cjs/jws/flattened/verify.js +1 -2
- package/dist/node/cjs/jws/general/verify.js +1 -2
- package/dist/node/cjs/jwt/decrypt.js +1 -2
- package/dist/node/cjs/jwt/verify.js +1 -2
- package/dist/node/cjs/key/export.js +3 -4
- package/dist/node/cjs/key/generate_key_pair.js +1 -2
- package/dist/node/cjs/key/generate_secret.js +1 -2
- package/dist/node/cjs/key/import.js +4 -5
- package/dist/node/cjs/lib/aesgcmkw.js +2 -3
- package/dist/node/cjs/lib/buffer_utils.js +7 -7
- package/dist/node/cjs/lib/cek.js +1 -2
- package/dist/node/cjs/lib/check_p2s.js +1 -1
- package/dist/node/cjs/lib/crypto_key.js +2 -3
- package/dist/node/cjs/lib/invalid_key_input.js +1 -2
- package/dist/node/cjs/lib/is_jwk.js +4 -5
- package/dist/node/cjs/lib/is_object.js +1 -1
- package/dist/node/cjs/lib/iv.js +1 -2
- package/dist/node/cjs/runtime/cbc_tag.js +1 -1
- package/dist/node/cjs/runtime/dsa_digest.js +1 -1
- package/dist/node/cjs/runtime/ecdhes.js +3 -3
- package/dist/node/cjs/runtime/generate.js +2 -3
- package/dist/node/cjs/runtime/get_sign_verify_key.js +1 -1
- package/dist/node/cjs/runtime/hmac_digest.js +1 -1
- package/dist/node/cjs/runtime/node_key.js +1 -1
- package/dist/node/cjs/util/decode_jwt.js +1 -2
- package/dist/node/cjs/util/decode_protected_header.js +1 -2
- package/dist/node/cjs/util/errors.js +34 -54
- package/dist/node/esm/jwks/remote.js +1 -1
- package/dist/node/esm/util/errors.js +34 -54
- package/dist/types/jwks/remote.d.ts +2 -2
- package/dist/types/util/errors.d.ts +39 -21
- package/package.json +151 -211
package/dist/node/cjs/lib/cek.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.bitLength =
|
|
3
|
+
exports.bitLength = bitLength;
|
|
4
4
|
const errors_js_1 = require("../util/errors.js");
|
|
5
5
|
const random_js_1 = require("../runtime/random.js");
|
|
6
6
|
function bitLength(alg) {
|
|
@@ -20,5 +20,4 @@ function bitLength(alg) {
|
|
|
20
20
|
throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
|
|
21
21
|
}
|
|
22
22
|
}
|
|
23
|
-
exports.bitLength = bitLength;
|
|
24
23
|
exports.default = (alg) => (0, random_js_1.default)(new Uint8Array(bitLength(alg) >> 3));
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.default = checkP2s;
|
|
3
4
|
const errors_js_1 = require("../util/errors.js");
|
|
4
5
|
function checkP2s(p2s) {
|
|
5
6
|
if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
|
|
6
7
|
throw new errors_js_1.JWEInvalid('PBES2 Salt Input must be 8 or more octets');
|
|
7
8
|
}
|
|
8
9
|
}
|
|
9
|
-
exports.default = checkP2s;
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.checkSigCryptoKey = checkSigCryptoKey;
|
|
4
|
+
exports.checkEncCryptoKey = checkEncCryptoKey;
|
|
4
5
|
function unusable(name, prop = 'algorithm.name') {
|
|
5
6
|
return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
|
|
6
7
|
}
|
|
@@ -95,7 +96,6 @@ function checkSigCryptoKey(key, alg, ...usages) {
|
|
|
95
96
|
}
|
|
96
97
|
checkUsage(key, usages);
|
|
97
98
|
}
|
|
98
|
-
exports.checkSigCryptoKey = checkSigCryptoKey;
|
|
99
99
|
function checkEncCryptoKey(key, alg, ...usages) {
|
|
100
100
|
switch (alg) {
|
|
101
101
|
case 'A128GCM':
|
|
@@ -154,4 +154,3 @@ function checkEncCryptoKey(key, alg, ...usages) {
|
|
|
154
154
|
}
|
|
155
155
|
checkUsage(key, usages);
|
|
156
156
|
}
|
|
157
|
-
exports.checkEncCryptoKey = checkEncCryptoKey;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.withAlg =
|
|
3
|
+
exports.withAlg = withAlg;
|
|
4
4
|
function message(msg, actual, ...types) {
|
|
5
5
|
types = types.filter(Boolean);
|
|
6
6
|
if (types.length > 2) {
|
|
@@ -32,4 +32,3 @@ exports.default = (actual, ...types) => {
|
|
|
32
32
|
function withAlg(alg, actual, ...types) {
|
|
33
33
|
return message(`Key for the ${alg} algorithm must be `, actual, ...types);
|
|
34
34
|
}
|
|
35
|
-
exports.withAlg = withAlg;
|
|
@@ -1,20 +1,19 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.isJWK = isJWK;
|
|
4
|
+
exports.isPrivateJWK = isPrivateJWK;
|
|
5
|
+
exports.isPublicJWK = isPublicJWK;
|
|
6
|
+
exports.isSecretJWK = isSecretJWK;
|
|
4
7
|
const is_object_js_1 = require("./is_object.js");
|
|
5
8
|
function isJWK(key) {
|
|
6
9
|
return (0, is_object_js_1.default)(key) && typeof key.kty === 'string';
|
|
7
10
|
}
|
|
8
|
-
exports.isJWK = isJWK;
|
|
9
11
|
function isPrivateJWK(key) {
|
|
10
12
|
return key.kty !== 'oct' && typeof key.d === 'string';
|
|
11
13
|
}
|
|
12
|
-
exports.isPrivateJWK = isPrivateJWK;
|
|
13
14
|
function isPublicJWK(key) {
|
|
14
15
|
return key.kty !== 'oct' && typeof key.d === 'undefined';
|
|
15
16
|
}
|
|
16
|
-
exports.isPublicJWK = isPublicJWK;
|
|
17
17
|
function isSecretJWK(key) {
|
|
18
18
|
return isJWK(key) && key.kty === 'oct' && typeof key.k === 'string';
|
|
19
19
|
}
|
|
20
|
-
exports.isSecretJWK = isSecretJWK;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.default = isObject;
|
|
3
4
|
function isObjectLike(value) {
|
|
4
5
|
return typeof value === 'object' && value !== null;
|
|
5
6
|
}
|
|
@@ -16,4 +17,3 @@ function isObject(input) {
|
|
|
16
17
|
}
|
|
17
18
|
return Object.getPrototypeOf(input) === proto;
|
|
18
19
|
}
|
|
19
|
-
exports.default = isObject;
|
package/dist/node/cjs/lib/iv.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.bitLength =
|
|
3
|
+
exports.bitLength = bitLength;
|
|
4
4
|
const errors_js_1 = require("../util/errors.js");
|
|
5
5
|
const random_js_1 = require("../runtime/random.js");
|
|
6
6
|
function bitLength(alg) {
|
|
@@ -20,5 +20,4 @@ function bitLength(alg) {
|
|
|
20
20
|
throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
|
|
21
21
|
}
|
|
22
22
|
}
|
|
23
|
-
exports.bitLength = bitLength;
|
|
24
23
|
exports.default = (alg) => (0, random_js_1.default)(new Uint8Array(bitLength(alg) >> 3));
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.default = cbcTag;
|
|
3
4
|
const node_crypto_1 = require("node:crypto");
|
|
4
5
|
const buffer_utils_js_1 = require("../lib/buffer_utils.js");
|
|
5
6
|
function cbcTag(aad, iv, ciphertext, macSize, macKey, keySize) {
|
|
@@ -8,4 +9,3 @@ function cbcTag(aad, iv, ciphertext, macSize, macKey, keySize) {
|
|
|
8
9
|
hmac.update(macData);
|
|
9
10
|
return hmac.digest().slice(0, keySize >> 3);
|
|
10
11
|
}
|
|
11
|
-
exports.default = cbcTag;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.default = dsaDigest;
|
|
3
4
|
const errors_js_1 = require("../util/errors.js");
|
|
4
5
|
function dsaDigest(alg) {
|
|
5
6
|
switch (alg) {
|
|
@@ -22,4 +23,3 @@ function dsaDigest(alg) {
|
|
|
22
23
|
throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
|
|
23
24
|
}
|
|
24
25
|
}
|
|
25
|
-
exports.default = dsaDigest;
|
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.ecdhAllowed =
|
|
3
|
+
exports.ecdhAllowed = void 0;
|
|
4
|
+
exports.deriveKey = deriveKey;
|
|
5
|
+
exports.generateEpk = generateEpk;
|
|
4
6
|
const node_crypto_1 = require("node:crypto");
|
|
5
7
|
const node_util_1 = require("node:util");
|
|
6
8
|
const get_named_curve_js_1 = require("./get_named_curve.js");
|
|
@@ -39,7 +41,6 @@ async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new
|
|
|
39
41
|
const sharedSecret = (0, node_crypto_1.diffieHellman)({ privateKey, publicKey });
|
|
40
42
|
return (0, buffer_utils_js_1.concatKdf)(sharedSecret, keyLength, value);
|
|
41
43
|
}
|
|
42
|
-
exports.deriveKey = deriveKey;
|
|
43
44
|
async function generateEpk(kee) {
|
|
44
45
|
let key;
|
|
45
46
|
if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
|
|
@@ -65,6 +66,5 @@ async function generateEpk(kee) {
|
|
|
65
66
|
throw new errors_js_1.JOSENotSupported('Invalid or unsupported EPK');
|
|
66
67
|
}
|
|
67
68
|
}
|
|
68
|
-
exports.generateEpk = generateEpk;
|
|
69
69
|
const ecdhAllowed = (key) => ['P-256', 'P-384', 'P-521', 'X25519', 'X448'].includes((0, get_named_curve_js_1.default)(key));
|
|
70
70
|
exports.ecdhAllowed = ecdhAllowed;
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.generateSecret = generateSecret;
|
|
4
|
+
exports.generateKeyPair = generateKeyPair;
|
|
4
5
|
const node_crypto_1 = require("node:crypto");
|
|
5
6
|
const node_util_1 = require("node:util");
|
|
6
7
|
const random_js_1 = require("./random.js");
|
|
@@ -33,7 +34,6 @@ async function generateSecret(alg, options) {
|
|
|
33
34
|
}
|
|
34
35
|
return (0, node_crypto_1.createSecretKey)((0, random_js_1.default)(new Uint8Array(length >> 3)));
|
|
35
36
|
}
|
|
36
|
-
exports.generateSecret = generateSecret;
|
|
37
37
|
async function generateKeyPair(alg, options) {
|
|
38
38
|
switch (alg) {
|
|
39
39
|
case 'RS256':
|
|
@@ -99,4 +99,3 @@ async function generateKeyPair(alg, options) {
|
|
|
99
99
|
throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
|
|
100
100
|
}
|
|
101
101
|
}
|
|
102
|
-
exports.generateKeyPair = generateKeyPair;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.default = getSignVerifyKey;
|
|
3
4
|
const node_crypto_1 = require("node:crypto");
|
|
4
5
|
const webcrypto_js_1 = require("./webcrypto.js");
|
|
5
6
|
const crypto_key_js_1 = require("../lib/crypto_key.js");
|
|
@@ -28,4 +29,3 @@ function getSignVerifyKey(alg, key, usage) {
|
|
|
28
29
|
}
|
|
29
30
|
throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array', 'JSON Web Key'));
|
|
30
31
|
}
|
|
31
|
-
exports.default = getSignVerifyKey;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.default = hmacDigest;
|
|
3
4
|
const errors_js_1 = require("../util/errors.js");
|
|
4
5
|
function hmacDigest(alg) {
|
|
5
6
|
switch (alg) {
|
|
@@ -13,4 +14,3 @@ function hmacDigest(alg) {
|
|
|
13
14
|
throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
|
|
14
15
|
}
|
|
15
16
|
}
|
|
16
|
-
exports.default = hmacDigest;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.default = keyForCrypto;
|
|
3
4
|
const node_crypto_1 = require("node:crypto");
|
|
4
5
|
const get_named_curve_js_1 = require("./get_named_curve.js");
|
|
5
6
|
const errors_js_1 = require("../util/errors.js");
|
|
@@ -103,4 +104,3 @@ function keyForCrypto(alg, key) {
|
|
|
103
104
|
}
|
|
104
105
|
return options ? { ...options, key } : key;
|
|
105
106
|
}
|
|
106
|
-
exports.default = keyForCrypto;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.decodeJwt =
|
|
3
|
+
exports.decodeJwt = decodeJwt;
|
|
4
4
|
const base64url_js_1 = require("./base64url.js");
|
|
5
5
|
const buffer_utils_js_1 = require("../lib/buffer_utils.js");
|
|
6
6
|
const is_object_js_1 = require("../lib/is_object.js");
|
|
@@ -33,4 +33,3 @@ function decodeJwt(jwt) {
|
|
|
33
33
|
throw new errors_js_1.JWTInvalid('Invalid JWT Claims Set');
|
|
34
34
|
return result;
|
|
35
35
|
}
|
|
36
|
-
exports.decodeJwt = decodeJwt;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.decodeProtectedHeader =
|
|
3
|
+
exports.decodeProtectedHeader = decodeProtectedHeader;
|
|
4
4
|
const base64url_js_1 = require("./base64url.js");
|
|
5
5
|
const buffer_utils_js_1 = require("../lib/buffer_utils.js");
|
|
6
6
|
const is_object_js_1 = require("../lib/is_object.js");
|
|
@@ -35,4 +35,3 @@ function decodeProtectedHeader(token) {
|
|
|
35
35
|
throw new TypeError('Invalid Token or Protected Header formatting');
|
|
36
36
|
}
|
|
37
37
|
}
|
|
38
|
-
exports.decodeProtectedHeader = decodeProtectedHeader;
|
|
@@ -2,27 +2,23 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
|
|
4
4
|
class JOSEError extends Error {
|
|
5
|
-
static
|
|
6
|
-
return 'ERR_JOSE_GENERIC';
|
|
7
|
-
}
|
|
5
|
+
static code = 'ERR_JOSE_GENERIC';
|
|
8
6
|
code = 'ERR_JOSE_GENERIC';
|
|
9
|
-
constructor(message) {
|
|
10
|
-
super(message);
|
|
7
|
+
constructor(message, options) {
|
|
8
|
+
super(message, options);
|
|
11
9
|
this.name = this.constructor.name;
|
|
12
10
|
Error.captureStackTrace?.(this, this.constructor);
|
|
13
11
|
}
|
|
14
12
|
}
|
|
15
13
|
exports.JOSEError = JOSEError;
|
|
16
14
|
class JWTClaimValidationFailed extends JOSEError {
|
|
17
|
-
static
|
|
18
|
-
return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
19
|
-
}
|
|
15
|
+
static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
20
16
|
code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
21
17
|
claim;
|
|
22
18
|
reason;
|
|
23
19
|
payload;
|
|
24
20
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
25
|
-
super(message);
|
|
21
|
+
super(message, { cause: { claim, reason, payload } });
|
|
26
22
|
this.claim = claim;
|
|
27
23
|
this.reason = reason;
|
|
28
24
|
this.payload = payload;
|
|
@@ -30,15 +26,13 @@ class JWTClaimValidationFailed extends JOSEError {
|
|
|
30
26
|
}
|
|
31
27
|
exports.JWTClaimValidationFailed = JWTClaimValidationFailed;
|
|
32
28
|
class JWTExpired extends JOSEError {
|
|
33
|
-
static
|
|
34
|
-
return 'ERR_JWT_EXPIRED';
|
|
35
|
-
}
|
|
29
|
+
static code = 'ERR_JWT_EXPIRED';
|
|
36
30
|
code = 'ERR_JWT_EXPIRED';
|
|
37
31
|
claim;
|
|
38
32
|
reason;
|
|
39
33
|
payload;
|
|
40
34
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
41
|
-
super(message);
|
|
35
|
+
super(message, { cause: { claim, reason, payload } });
|
|
42
36
|
this.claim = claim;
|
|
43
37
|
this.reason = reason;
|
|
44
38
|
this.payload = payload;
|
|
@@ -46,92 +40,78 @@ class JWTExpired extends JOSEError {
|
|
|
46
40
|
}
|
|
47
41
|
exports.JWTExpired = JWTExpired;
|
|
48
42
|
class JOSEAlgNotAllowed extends JOSEError {
|
|
49
|
-
static
|
|
50
|
-
return 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
51
|
-
}
|
|
43
|
+
static code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
52
44
|
code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
53
45
|
}
|
|
54
46
|
exports.JOSEAlgNotAllowed = JOSEAlgNotAllowed;
|
|
55
47
|
class JOSENotSupported extends JOSEError {
|
|
56
|
-
static
|
|
57
|
-
return 'ERR_JOSE_NOT_SUPPORTED';
|
|
58
|
-
}
|
|
48
|
+
static code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
59
49
|
code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
60
50
|
}
|
|
61
51
|
exports.JOSENotSupported = JOSENotSupported;
|
|
62
52
|
class JWEDecryptionFailed extends JOSEError {
|
|
63
|
-
static
|
|
64
|
-
return 'ERR_JWE_DECRYPTION_FAILED';
|
|
65
|
-
}
|
|
53
|
+
static code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
66
54
|
code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
67
|
-
message = 'decryption operation failed'
|
|
55
|
+
constructor(message = 'decryption operation failed', options) {
|
|
56
|
+
super(message, options);
|
|
57
|
+
}
|
|
68
58
|
}
|
|
69
59
|
exports.JWEDecryptionFailed = JWEDecryptionFailed;
|
|
70
60
|
class JWEInvalid extends JOSEError {
|
|
71
|
-
static
|
|
72
|
-
return 'ERR_JWE_INVALID';
|
|
73
|
-
}
|
|
61
|
+
static code = 'ERR_JWE_INVALID';
|
|
74
62
|
code = 'ERR_JWE_INVALID';
|
|
75
63
|
}
|
|
76
64
|
exports.JWEInvalid = JWEInvalid;
|
|
77
65
|
class JWSInvalid extends JOSEError {
|
|
78
|
-
static
|
|
79
|
-
return 'ERR_JWS_INVALID';
|
|
80
|
-
}
|
|
66
|
+
static code = 'ERR_JWS_INVALID';
|
|
81
67
|
code = 'ERR_JWS_INVALID';
|
|
82
68
|
}
|
|
83
69
|
exports.JWSInvalid = JWSInvalid;
|
|
84
70
|
class JWTInvalid extends JOSEError {
|
|
85
|
-
static
|
|
86
|
-
return 'ERR_JWT_INVALID';
|
|
87
|
-
}
|
|
71
|
+
static code = 'ERR_JWT_INVALID';
|
|
88
72
|
code = 'ERR_JWT_INVALID';
|
|
89
73
|
}
|
|
90
74
|
exports.JWTInvalid = JWTInvalid;
|
|
91
75
|
class JWKInvalid extends JOSEError {
|
|
92
|
-
static
|
|
93
|
-
return 'ERR_JWK_INVALID';
|
|
94
|
-
}
|
|
76
|
+
static code = 'ERR_JWK_INVALID';
|
|
95
77
|
code = 'ERR_JWK_INVALID';
|
|
96
78
|
}
|
|
97
79
|
exports.JWKInvalid = JWKInvalid;
|
|
98
80
|
class JWKSInvalid extends JOSEError {
|
|
99
|
-
static
|
|
100
|
-
return 'ERR_JWKS_INVALID';
|
|
101
|
-
}
|
|
81
|
+
static code = 'ERR_JWKS_INVALID';
|
|
102
82
|
code = 'ERR_JWKS_INVALID';
|
|
103
83
|
}
|
|
104
84
|
exports.JWKSInvalid = JWKSInvalid;
|
|
105
85
|
class JWKSNoMatchingKey extends JOSEError {
|
|
106
|
-
static
|
|
107
|
-
return 'ERR_JWKS_NO_MATCHING_KEY';
|
|
108
|
-
}
|
|
86
|
+
static code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
109
87
|
code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
110
|
-
message = 'no applicable key found in the JSON Web Key Set'
|
|
88
|
+
constructor(message = 'no applicable key found in the JSON Web Key Set', options) {
|
|
89
|
+
super(message, options);
|
|
90
|
+
}
|
|
111
91
|
}
|
|
112
92
|
exports.JWKSNoMatchingKey = JWKSNoMatchingKey;
|
|
113
93
|
class JWKSMultipleMatchingKeys extends JOSEError {
|
|
114
94
|
[Symbol.asyncIterator];
|
|
115
|
-
static
|
|
116
|
-
return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
117
|
-
}
|
|
95
|
+
static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
118
96
|
code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
119
|
-
message = 'multiple matching keys found in the JSON Web Key Set'
|
|
97
|
+
constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {
|
|
98
|
+
super(message, options);
|
|
99
|
+
}
|
|
120
100
|
}
|
|
121
101
|
exports.JWKSMultipleMatchingKeys = JWKSMultipleMatchingKeys;
|
|
122
102
|
class JWKSTimeout extends JOSEError {
|
|
123
|
-
static
|
|
124
|
-
return 'ERR_JWKS_TIMEOUT';
|
|
125
|
-
}
|
|
103
|
+
static code = 'ERR_JWKS_TIMEOUT';
|
|
126
104
|
code = 'ERR_JWKS_TIMEOUT';
|
|
127
|
-
message = 'request timed out'
|
|
105
|
+
constructor(message = 'request timed out', options) {
|
|
106
|
+
super(message, options);
|
|
107
|
+
}
|
|
128
108
|
}
|
|
129
109
|
exports.JWKSTimeout = JWKSTimeout;
|
|
130
110
|
class JWSSignatureVerificationFailed extends JOSEError {
|
|
131
|
-
static
|
|
132
|
-
return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
133
|
-
}
|
|
111
|
+
static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
134
112
|
code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
135
|
-
message = 'signature verification failed'
|
|
113
|
+
constructor(message = 'signature verification failed', options) {
|
|
114
|
+
super(message, options);
|
|
115
|
+
}
|
|
136
116
|
}
|
|
137
117
|
exports.JWSSignatureVerificationFailed = JWSSignatureVerificationFailed;
|
|
@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
|
|
|
10
10
|
let USER_AGENT;
|
|
11
11
|
if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
|
|
12
12
|
const NAME = 'jose';
|
|
13
|
-
const VERSION = 'v5.9.
|
|
13
|
+
const VERSION = 'v5.9.5';
|
|
14
14
|
USER_AGENT = `${NAME}/${VERSION}`;
|
|
15
15
|
}
|
|
16
16
|
export const jwksCache = Symbol();
|
|
@@ -1,119 +1,99 @@
|
|
|
1
1
|
export class JOSEError extends Error {
|
|
2
|
-
static
|
|
3
|
-
return 'ERR_JOSE_GENERIC';
|
|
4
|
-
}
|
|
2
|
+
static code = 'ERR_JOSE_GENERIC';
|
|
5
3
|
code = 'ERR_JOSE_GENERIC';
|
|
6
|
-
constructor(message) {
|
|
7
|
-
super(message);
|
|
4
|
+
constructor(message, options) {
|
|
5
|
+
super(message, options);
|
|
8
6
|
this.name = this.constructor.name;
|
|
9
7
|
Error.captureStackTrace?.(this, this.constructor);
|
|
10
8
|
}
|
|
11
9
|
}
|
|
12
10
|
export class JWTClaimValidationFailed extends JOSEError {
|
|
13
|
-
static
|
|
14
|
-
return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
15
|
-
}
|
|
11
|
+
static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
16
12
|
code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
|
|
17
13
|
claim;
|
|
18
14
|
reason;
|
|
19
15
|
payload;
|
|
20
16
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
21
|
-
super(message);
|
|
17
|
+
super(message, { cause: { claim, reason, payload } });
|
|
22
18
|
this.claim = claim;
|
|
23
19
|
this.reason = reason;
|
|
24
20
|
this.payload = payload;
|
|
25
21
|
}
|
|
26
22
|
}
|
|
27
23
|
export class JWTExpired extends JOSEError {
|
|
28
|
-
static
|
|
29
|
-
return 'ERR_JWT_EXPIRED';
|
|
30
|
-
}
|
|
24
|
+
static code = 'ERR_JWT_EXPIRED';
|
|
31
25
|
code = 'ERR_JWT_EXPIRED';
|
|
32
26
|
claim;
|
|
33
27
|
reason;
|
|
34
28
|
payload;
|
|
35
29
|
constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
|
|
36
|
-
super(message);
|
|
30
|
+
super(message, { cause: { claim, reason, payload } });
|
|
37
31
|
this.claim = claim;
|
|
38
32
|
this.reason = reason;
|
|
39
33
|
this.payload = payload;
|
|
40
34
|
}
|
|
41
35
|
}
|
|
42
36
|
export class JOSEAlgNotAllowed extends JOSEError {
|
|
43
|
-
static
|
|
44
|
-
return 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
45
|
-
}
|
|
37
|
+
static code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
46
38
|
code = 'ERR_JOSE_ALG_NOT_ALLOWED';
|
|
47
39
|
}
|
|
48
40
|
export class JOSENotSupported extends JOSEError {
|
|
49
|
-
static
|
|
50
|
-
return 'ERR_JOSE_NOT_SUPPORTED';
|
|
51
|
-
}
|
|
41
|
+
static code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
52
42
|
code = 'ERR_JOSE_NOT_SUPPORTED';
|
|
53
43
|
}
|
|
54
44
|
export class JWEDecryptionFailed extends JOSEError {
|
|
55
|
-
static
|
|
56
|
-
return 'ERR_JWE_DECRYPTION_FAILED';
|
|
57
|
-
}
|
|
45
|
+
static code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
58
46
|
code = 'ERR_JWE_DECRYPTION_FAILED';
|
|
59
|
-
message = 'decryption operation failed'
|
|
47
|
+
constructor(message = 'decryption operation failed', options) {
|
|
48
|
+
super(message, options);
|
|
49
|
+
}
|
|
60
50
|
}
|
|
61
51
|
export class JWEInvalid extends JOSEError {
|
|
62
|
-
static
|
|
63
|
-
return 'ERR_JWE_INVALID';
|
|
64
|
-
}
|
|
52
|
+
static code = 'ERR_JWE_INVALID';
|
|
65
53
|
code = 'ERR_JWE_INVALID';
|
|
66
54
|
}
|
|
67
55
|
export class JWSInvalid extends JOSEError {
|
|
68
|
-
static
|
|
69
|
-
return 'ERR_JWS_INVALID';
|
|
70
|
-
}
|
|
56
|
+
static code = 'ERR_JWS_INVALID';
|
|
71
57
|
code = 'ERR_JWS_INVALID';
|
|
72
58
|
}
|
|
73
59
|
export class JWTInvalid extends JOSEError {
|
|
74
|
-
static
|
|
75
|
-
return 'ERR_JWT_INVALID';
|
|
76
|
-
}
|
|
60
|
+
static code = 'ERR_JWT_INVALID';
|
|
77
61
|
code = 'ERR_JWT_INVALID';
|
|
78
62
|
}
|
|
79
63
|
export class JWKInvalid extends JOSEError {
|
|
80
|
-
static
|
|
81
|
-
return 'ERR_JWK_INVALID';
|
|
82
|
-
}
|
|
64
|
+
static code = 'ERR_JWK_INVALID';
|
|
83
65
|
code = 'ERR_JWK_INVALID';
|
|
84
66
|
}
|
|
85
67
|
export class JWKSInvalid extends JOSEError {
|
|
86
|
-
static
|
|
87
|
-
return 'ERR_JWKS_INVALID';
|
|
88
|
-
}
|
|
68
|
+
static code = 'ERR_JWKS_INVALID';
|
|
89
69
|
code = 'ERR_JWKS_INVALID';
|
|
90
70
|
}
|
|
91
71
|
export class JWKSNoMatchingKey extends JOSEError {
|
|
92
|
-
static
|
|
93
|
-
return 'ERR_JWKS_NO_MATCHING_KEY';
|
|
94
|
-
}
|
|
72
|
+
static code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
95
73
|
code = 'ERR_JWKS_NO_MATCHING_KEY';
|
|
96
|
-
message = 'no applicable key found in the JSON Web Key Set'
|
|
74
|
+
constructor(message = 'no applicable key found in the JSON Web Key Set', options) {
|
|
75
|
+
super(message, options);
|
|
76
|
+
}
|
|
97
77
|
}
|
|
98
78
|
export class JWKSMultipleMatchingKeys extends JOSEError {
|
|
99
79
|
[Symbol.asyncIterator];
|
|
100
|
-
static
|
|
101
|
-
return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
102
|
-
}
|
|
80
|
+
static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
103
81
|
code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
|
|
104
|
-
message = 'multiple matching keys found in the JSON Web Key Set'
|
|
82
|
+
constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {
|
|
83
|
+
super(message, options);
|
|
84
|
+
}
|
|
105
85
|
}
|
|
106
86
|
export class JWKSTimeout extends JOSEError {
|
|
107
|
-
static
|
|
108
|
-
return 'ERR_JWKS_TIMEOUT';
|
|
109
|
-
}
|
|
87
|
+
static code = 'ERR_JWKS_TIMEOUT';
|
|
110
88
|
code = 'ERR_JWKS_TIMEOUT';
|
|
111
|
-
message = 'request timed out'
|
|
89
|
+
constructor(message = 'request timed out', options) {
|
|
90
|
+
super(message, options);
|
|
91
|
+
}
|
|
112
92
|
}
|
|
113
93
|
export class JWSSignatureVerificationFailed extends JOSEError {
|
|
114
|
-
static
|
|
115
|
-
return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
116
|
-
}
|
|
94
|
+
static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
117
95
|
code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
|
|
118
|
-
message = 'signature verification failed'
|
|
96
|
+
constructor(message = 'signature verification failed', options) {
|
|
97
|
+
super(message, options);
|
|
98
|
+
}
|
|
119
99
|
}
|
|
@@ -26,11 +26,11 @@ import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } f
|
|
|
26
26
|
* - Afterwards, update the key-value storage if the {@link ExportedJWKSCache.uat `uat`} property of
|
|
27
27
|
* the object has changed.
|
|
28
28
|
*
|
|
29
|
-
* import * as jose from 'jose'
|
|
30
|
-
*
|
|
31
29
|
* // Prerequisites
|
|
32
30
|
* let url!: URL
|
|
33
31
|
* let jwt!: string
|
|
32
|
+
* let getPreviouslyCachedJWKS!: () => Promise<jose.ExportedJWKSCache>
|
|
33
|
+
* let storeNewJWKScache!: (cache: jose.ExportedJWKSCache) => Promise<void>
|
|
34
34
|
*
|
|
35
35
|
* // Load JSON Web Key Set cache
|
|
36
36
|
* const jwksCache: jose.JWKSCacheInput = (await getPreviouslyCachedJWKS()) || {}
|