jose 5.9.6 → 5.10.0

package/README.md

@@ -5,9 +5,9 @@
 ## Sponsor
 
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="./sponsor/Auth0byOkta_dark.png">
-  <source media="(prefers-color-scheme: light)" srcset="./sponsor/Auth0byOkta_light.png">
-  <img height="65" align="left" alt="Auth0 by Okta" src="./sponsor/Auth0byOkta_light.png">
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/panva/jose/HEAD/sponsor/Auth0byOkta_dark.png">
+  <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/panva/jose/HEAD/sponsor/Auth0byOkta_light.png">
+  <img height="65" align="left" alt="Auth0 by Okta" src="https://raw.githubusercontent.com/panva/jose/HEAD/sponsor/Auth0byOkta_light.png">
 </picture>
 
 If you want to quickly add JWT authentication to JavaScript apps, feel free to check out Auth0's JavaScript SDK and free plan. [Create an Auth0 account; it's free!][sponsor-auth0]<br><br>
@@ -25,11 +25,13 @@ Support from the community to continue maintaining and improving this module is
 `jose` is distributed via [npmjs.com](https://www.npmjs.com/package/jose), [deno.land/x](https://deno.land/x/jose), [cdnjs.com](https://cdnjs.com/libraries/jose), [jsdelivr.com](https://www.jsdelivr.com/package/npm/jose), and [github.com](https://github.com/panva/jose).
 
 **`example`** ESM import
+
 ```js
 import * as jose from 'jose'
 ```
 
 **`example`** CJS require
+
 ```js
 const jose = require('jose')
 ```
@@ -107,6 +109,7 @@ The following are additional features and utilities provided by the `jose` modul
 The `jose` module is compatible with JavaScript runtimes that support the utilized Web API globals and standard built-in objects or are Node.js.
 
 The following runtimes are supported _(this is not an exhaustive list)_:
+
 - [Bun](https://github.com/panva/jose/issues/471)
 - [Browsers](https://github.com/panva/jose/issues/263)
 - [Cloudflare Workers](https://github.com/panva/jose/issues/265)
@@ -119,11 +122,11 @@ Please note that certain algorithms may not be available depending on the runtim
 
 ## Supported Versions
 
-| Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
-| ------- | --------- | -------- | -------- |
-| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅ | ✅ | ✅ |
-| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ❌ | ❌ |
-| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ❌ | ❌ |
+| Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
+| ----------------------------------------------- | ----------------- | ------------------ | --------------- |
+| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅                | ✅                 | ✅              |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅                | ❌                 | ❌              |
+| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅                | ❌                 | ❌              |
 
 ## Specifications
 
@@ -143,7 +146,6 @@ Please note that certain algorithms may not be available depending on the runtim
 
 The algorithm implementations in `jose` have been tested using test vectors from their respective specifications as well as [RFC7520](https://www.rfc-editor.org/rfc/rfc7520).
 
-
 </details>
 
-[sponsor-auth0]: https://auth0.com/signup?utm_source=external_sites&utm_medium=panva&utm_campaign=devn_signup
+[sponsor-auth0]: https://a0.to/signup/panva

package/dist/browser/jwks/local.js

@@ -54,9 +54,6 @@ class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
             if (candidate) {
                 switch (alg) {
                     case 'ES256':
@@ -71,6 +68,12 @@ class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
+                    case 'Ed25519':
+                        candidate = jwk.crv === 'Ed25519';
+                        break;
+                    case 'EdDSA':
+                        candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+                        break;
                 }
             }
             return candidate;

package/dist/browser/jwks/remote.js

@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.9.6';
+    const VERSION = 'v5.10.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const jwksCache = Symbol();

package/dist/browser/key/import.js

@@ -33,7 +33,7 @@ export async function importJWK(jwk, alg) {
             }
             return decodeBase64URL(jwk.k);
         case 'RSA':
-            if (jwk.oth !== undefined) {
+            if ('oth' in jwk && jwk.oth !== undefined) {
                 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
             }
         case 'EC':

package/dist/browser/lib/crypto_key.js

@@ -76,6 +76,11 @@ export function checkSigCryptoKey(key, alg, ...usages) {
             }
             break;
         }
+        case 'Ed25519': {
+            if (!isAlgorithm(key.algorithm, 'Ed25519'))
+                throw unusable('Ed25519');
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {

package/dist/browser/runtime/asn1.js

@@ -106,6 +106,10 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
             keyUsages = isPublic ? [] : ['deriveBits'];
             break;
         }
+        case 'Ed25519':
+            algorithm = { name: 'Ed25519' };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
         case 'EdDSA':
             algorithm = { name: getNamedCurve(keyData) };
             keyUsages = isPublic ? ['verify'] : ['sign'];

package/dist/browser/runtime/generate.js

@@ -97,6 +97,10 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
             keyUsages = ['sign', 'verify'];
             break;
+        case 'Ed25519':
+            algorithm = { name: 'Ed25519' };
+            keyUsages = ['sign', 'verify'];
+            break;
         case 'EdDSA': {
             keyUsages = ['sign', 'verify'];
             const crv = options?.crv ?? 'Ed25519';

package/dist/browser/runtime/jwk_to_key.js

@@ -61,6 +61,10 @@ function subtleMapping(jwk) {
         }
         case 'OKP': {
             switch (jwk.alg) {
+                case 'Ed25519':
+                    algorithm = { name: 'Ed25519' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
                 case 'EdDSA':
                     algorithm = { name: jwk.crv };
                     keyUsages = jwk.d ? ['sign'] : ['verify'];

package/dist/browser/runtime/subtle_dsa.js

@@ -18,6 +18,8 @@ export default function subtleDsa(alg, algorithm) {
         case 'ES384':
         case 'ES512':
             return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };
+        case 'Ed25519':
+            return { name: 'Ed25519' };
         case 'EdDSA':
             return { name: algorithm.name };
         default:

package/dist/node/cjs/jwks/local.js

@@ -58,9 +58,6 @@ class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
             if (candidate) {
                 switch (alg) {
                     case 'ES256':
@@ -75,6 +72,12 @@ class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
+                    case 'Ed25519':
+                        candidate = jwk.crv === 'Ed25519';
+                        break;
+                    case 'EdDSA':
+                        candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+                        break;
                 }
             }
             return candidate;

package/dist/node/cjs/jwks/remote.js

@@ -14,7 +14,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.9.6';
+    const VERSION = 'v5.10.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 exports.jwksCache = Symbol();

package/dist/node/cjs/key/import.js

@@ -39,7 +39,7 @@ async function importJWK(jwk, alg) {
             }
             return (0, base64url_js_1.decode)(jwk.k);
         case 'RSA':
-            if (jwk.oth !== undefined) {
+            if ('oth' in jwk && jwk.oth !== undefined) {
                 throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
             }
         case 'EC':

package/dist/node/cjs/lib/crypto_key.js

@@ -80,6 +80,11 @@ function checkSigCryptoKey(key, alg, ...usages) {
             }
             break;
         }
+        case 'Ed25519': {
+            if (!isAlgorithm(key.algorithm, 'Ed25519'))
+                throw unusable('Ed25519');
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {

package/dist/node/cjs/runtime/dsa_digest.js

@@ -17,6 +17,7 @@ function dsaDigest(alg) {
         case 'RS512':
         case 'ES512':
             return 'sha512';
+        case 'Ed25519':
         case 'EdDSA':
             return undefined;
         default:

package/dist/node/cjs/runtime/generate.js

@@ -65,6 +65,8 @@ async function generateKeyPair(alg, options) {
             return generate('ec', { namedCurve: 'P-384' });
         case 'ES512':
             return generate('ec', { namedCurve: 'P-521' });
+        case 'Ed25519':
+            return generate('ed25519');
         case 'EdDSA': {
             switch (options?.crv) {
                 case undefined:

package/dist/node/cjs/runtime/node_key.js

@@ -45,6 +45,11 @@ function keyForCrypto(alg, key) {
     }
     let options;
     switch (alg) {
+        case 'Ed25519':
+            if (asymmetricKeyType !== 'ed25519') {
+                throw new TypeError(`Invalid key for this operation, its asymmetricKeyType must be ed25519`);
+            }
+            break;
         case 'EdDSA':
             if (!['ed25519', 'ed448'].includes(asymmetricKeyType)) {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');

package/dist/node/esm/jwks/local.js

@@ -55,9 +55,6 @@ class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
             if (candidate) {
                 switch (alg) {
                     case 'ES256':
@@ -72,6 +69,12 @@ class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
+                    case 'Ed25519':
+                        candidate = jwk.crv === 'Ed25519';
+                        break;
+                    case 'EdDSA':
+                        candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+                        break;
                 }
             }
             return candidate;

package/dist/node/esm/jwks/remote.js

@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.9.6';
+    const VERSION = 'v5.10.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const jwksCache = Symbol();

package/dist/node/esm/key/import.js

@@ -33,7 +33,7 @@ export async function importJWK(jwk, alg) {
             }
             return decodeBase64URL(jwk.k);
         case 'RSA':
-            if (jwk.oth !== undefined) {
+            if ('oth' in jwk && jwk.oth !== undefined) {
                 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
             }
         case 'EC':

package/dist/node/esm/lib/crypto_key.js

@@ -76,6 +76,11 @@ export function checkSigCryptoKey(key, alg, ...usages) {
             }
             break;
         }
+        case 'Ed25519': {
+            if (!isAlgorithm(key.algorithm, 'Ed25519'))
+                throw unusable('Ed25519');
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {

package/dist/node/esm/runtime/dsa_digest.js

@@ -14,6 +14,7 @@ export default function dsaDigest(alg) {
         case 'RS512':
         case 'ES512':
             return 'sha512';
+        case 'Ed25519':
         case 'EdDSA':
             return undefined;
         default:

package/dist/node/esm/runtime/generate.js

@@ -61,6 +61,8 @@ export async function generateKeyPair(alg, options) {
             return generate('ec', { namedCurve: 'P-384' });
         case 'ES512':
             return generate('ec', { namedCurve: 'P-521' });
+        case 'Ed25519':
+            return generate('ed25519');
         case 'EdDSA': {
             switch (options?.crv) {
                 case undefined:

package/dist/node/esm/runtime/node_key.js

@@ -42,6 +42,11 @@ export default function keyForCrypto(alg, key) {
     }
     let options;
     switch (alg) {
+        case 'Ed25519':
+            if (asymmetricKeyType !== 'ed25519') {
+                throw new TypeError(`Invalid key for this operation, its asymmetricKeyType must be ed25519`);
+            }
+            break;
         case 'EdDSA':
             if (!['ed25519', 'ed448'].includes(asymmetricKeyType)) {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');

package/dist/types/types.d.ts

@@ -96,16 +96,6 @@ export interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
   dp: string
   /** RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
   dq: string
-  /**
-   * RSA JWK "oth" (Other Primes Info) Parameter
-   *
-   * This parameter is not supported
-   */
-  oth?: Array<{
-    d?: string
-    r?: string
-    t?: string
-  }>
   /** RSA JWK "p" (First Prime Factor) Parameter */
   p: string
   /** RSA JWK "q" (Second Prime Factor) Parameter */
@@ -154,16 +144,6 @@ export interface JWK extends JWKParameters {
   k?: string
   /** RSA JWK "n" (Modulus) Parameter */
   n?: string
-  /**
-   * Private RSA JWK "oth" (Other Primes Info) Parameter
-   *
-   * This parameter is not supported
-   */
-  oth?: Array<{
-    d?: string
-    r?: string
-    t?: string
-  }>
   /** Private RSA JWK "p" (First Prime Factor) Parameter */
   p?: string
   /** Private RSA JWK "q" (Second Prime Factor) Parameter */
@@ -499,10 +479,13 @@ export interface JWTClaimVerificationOptions {
   audience?: string | string[]
 
   /**
-   * Expected clock tolerance
+   * Clock skew tolerance
    *
    * - In seconds when number (e.g. 5)
-   * - Parsed as seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
+   * - Resolved into a number of seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
+   *
+   * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
+   * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
    */
   clockTolerance?: string | number
 
@@ -517,7 +500,7 @@ export interface JWTClaimVerificationOptions {
    * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
    *
    * - In seconds when number (e.g. 5)
-   * - Parsed as seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
+   * - Resolved into a number of seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
    *
    * This option makes the JWT "iat" (Issued At) Claim presence required.
    */
@@ -542,13 +525,11 @@ export interface JWTClaimVerificationOptions {
 
   /**
    * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
-   * the {@link JWTClaimVerificationOptions.issuer `issuer` option} is set, then JWT "iss" (Issuer)
-   * Claim must be present; if the {@link JWTClaimVerificationOptions.audience `audience` option} is
-   * set, then JWT "aud" (Audience) Claim must be present; if the
-   * {@link JWTClaimVerificationOptions.subject `subject` option} is set, then JWT "sub" (Subject)
-   * Claim must be present; if the
-   * {@link JWTClaimVerificationOptions.maxTokenAge `maxTokenAge` option} is set, then JWT "iat"
-   * (Issued At) Claim must be present.
+   * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
+   * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
+   * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
+   * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
+   * present.
    */
   requiredClaims?: string[]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "5.9.6",
+  "version": "5.10.0",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",