jose 6.0.8 → 6.0.9

package/dist/webapi/jws/flattened/sign.js

@@ -7,44 +7,44 @@ import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import normalizeKey from '../../lib/normalize_key.js';
 export class FlattenedSign {
-    _payload;
-    _protectedHeader;
-    _unprotectedHeader;
+    #payload;
+    #protectedHeader;
+    #unprotectedHeader;
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
             throw new TypeError('payload must be an instance of Uint8Array');
         }
-        this._payload = payload;
+        this.#payload = payload;
     }
     setProtectedHeader(protectedHeader) {
-        if (this._protectedHeader) {
+        if (this.#protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        this._protectedHeader = protectedHeader;
+        this.#protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this._unprotectedHeader) {
+        if (this.#unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        this._unprotectedHeader = unprotectedHeader;
+        this.#unprotectedHeader = unprotectedHeader;
         return this;
     }
     async sign(key, options) {
-        if (!this._protectedHeader && !this._unprotectedHeader) {
+        if (!this.#protectedHeader && !this.#unprotectedHeader) {
             throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
         }
-        if (!isDisjoint(this._protectedHeader, this._unprotectedHeader)) {
+        if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader)) {
             throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
         }
         const joseHeader = {
-            ...this._protectedHeader,
-            ...this._unprotectedHeader,
+            ...this.#protectedHeader,
+            ...this.#unprotectedHeader,
         };
-        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, this._protectedHeader, joseHeader);
+        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, this.#protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
-            b64 = this._protectedHeader.b64;
+            b64 = this.#protectedHeader.b64;
             if (typeof b64 !== 'boolean') {
                 throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
             }
@@ -54,13 +54,13 @@ export class FlattenedSign {
             throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
         checkKeyType(alg, key, 'sign');
-        let payload = this._payload;
+        let payload = this.#payload;
         if (b64) {
             payload = encoder.encode(b64u(payload));
         }
         let protectedHeader;
-        if (this._protectedHeader) {
-            protectedHeader = encoder.encode(b64u(JSON.stringify(this._protectedHeader)));
+        if (this.#protectedHeader) {
+            protectedHeader = encoder.encode(b64u(JSON.stringify(this.#protectedHeader)));
         }
         else {
             protectedHeader = encoder.encode('');
@@ -75,10 +75,10 @@ export class FlattenedSign {
         if (b64) {
             jws.payload = decoder.decode(payload);
         }
-        if (this._unprotectedHeader) {
-            jws.header = this._unprotectedHeader;
+        if (this.#unprotectedHeader) {
+            jws.header = this.#unprotectedHeader;
         }
-        if (this._protectedHeader) {
+        if (this.#protectedHeader) {
             jws.protected = decoder.decode(protectedHeader);
         }
         return jws;

package/dist/webapi/jws/general/sign.js

@@ -1,13 +1,13 @@
 import { FlattenedSign } from '../flattened/sign.js';
 import { JWSInvalid } from '../../util/errors.js';
 class IndividualSignature {
-    parent;
+    #parent;
     protectedHeader;
     unprotectedHeader;
     options;
     key;
     constructor(sig, key, options) {
-        this.parent = sig;
+        this.#parent = sig;
         this.key = key;
         this.options = options;
     }
@@ -26,37 +26,37 @@ class IndividualSignature {
         return this;
     }
     addSignature(...args) {
-        return this.parent.addSignature(...args);
+        return this.#parent.addSignature(...args);
     }
     sign(...args) {
-        return this.parent.sign(...args);
+        return this.#parent.sign(...args);
     }
     done() {
-        return this.parent;
+        return this.#parent;
     }
 }
 export class GeneralSign {
-    _payload;
-    _signatures = [];
+    #payload;
+    #signatures = [];
     constructor(payload) {
-        this._payload = payload;
+        this.#payload = payload;
     }
     addSignature(key, options) {
         const signature = new IndividualSignature(this, key, options);
-        this._signatures.push(signature);
+        this.#signatures.push(signature);
         return signature;
     }
     async sign() {
-        if (!this._signatures.length) {
+        if (!this.#signatures.length) {
             throw new JWSInvalid('at least one signature must be added');
         }
         const jws = {
             signatures: [],
             payload: '',
         };
-        for (let i = 0; i < this._signatures.length; i++) {
-            const signature = this._signatures[i];
-            const flattened = new FlattenedSign(this._payload);
+        for (let i = 0; i < this.#signatures.length; i++) {
+            const signature = this.#signatures[i];
+            const flattened = new FlattenedSign(this.#payload);
             flattened.setProtectedHeader(signature.protectedHeader);
             flattened.setUnprotectedHeader(signature.unprotectedHeader);
             const { payload, ...rest } = await flattened.sign(signature.key, signature.options);

package/dist/webapi/jwt/encrypt.js

@@ -1,74 +1,107 @@
 import { CompactEncrypt } from '../jwe/compact/encrypt.js';
-import { encoder } from '../lib/buffer_utils.js';
 import { ProduceJWT } from './produce.js';
-export class EncryptJWT extends ProduceJWT {
-    _cek;
-    _iv;
-    _keyManagementParameters;
-    _protectedHeader;
-    _replicateIssuerAsHeader;
-    _replicateSubjectAsHeader;
-    _replicateAudienceAsHeader;
+export class EncryptJWT {
+    #cek;
+    #iv;
+    #keyManagementParameters;
+    #protectedHeader;
+    #replicateIssuerAsHeader;
+    #replicateSubjectAsHeader;
+    #replicateAudienceAsHeader;
+    #jwt;
+    constructor(payload = {}) {
+        this.#jwt = new ProduceJWT(payload);
+    }
+    setIssuer(issuer) {
+        this.#jwt.iss = issuer;
+        return this;
+    }
+    setSubject(subject) {
+        this.#jwt.sub = subject;
+        return this;
+    }
+    setAudience(audience) {
+        this.#jwt.aud = audience;
+        return this;
+    }
+    setJti(jwtId) {
+        this.#jwt.jti = jwtId;
+        return this;
+    }
+    setNotBefore(input) {
+        this.#jwt.nbf = input;
+        return this;
+    }
+    setExpirationTime(input) {
+        this.#jwt.exp = input;
+        return this;
+    }
+    setIssuedAt(input) {
+        this.#jwt.iat = input;
+        return this;
+    }
     setProtectedHeader(protectedHeader) {
-        if (this._protectedHeader) {
+        if (this.#protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        this._protectedHeader = protectedHeader;
+        this.#protectedHeader = protectedHeader;
         return this;
     }
     setKeyManagementParameters(parameters) {
-        if (this._keyManagementParameters) {
+        if (this.#keyManagementParameters) {
             throw new TypeError('setKeyManagementParameters can only be called once');
         }
-        this._keyManagementParameters = parameters;
+        this.#keyManagementParameters = parameters;
         return this;
     }
     setContentEncryptionKey(cek) {
-        if (this._cek) {
+        if (this.#cek) {
             throw new TypeError('setContentEncryptionKey can only be called once');
         }
-        this._cek = cek;
+        this.#cek = cek;
         return this;
     }
     setInitializationVector(iv) {
-        if (this._iv) {
+        if (this.#iv) {
             throw new TypeError('setInitializationVector can only be called once');
         }
-        this._iv = iv;
+        this.#iv = iv;
         return this;
     }
     replicateIssuerAsHeader() {
-        this._replicateIssuerAsHeader = true;
+        this.#replicateIssuerAsHeader = true;
         return this;
     }
     replicateSubjectAsHeader() {
-        this._replicateSubjectAsHeader = true;
+        this.#replicateSubjectAsHeader = true;
         return this;
     }
     replicateAudienceAsHeader() {
-        this._replicateAudienceAsHeader = true;
+        this.#replicateAudienceAsHeader = true;
         return this;
     }
     async encrypt(key, options) {
-        const enc = new CompactEncrypt(encoder.encode(JSON.stringify(this._payload)));
-        if (this._replicateIssuerAsHeader) {
-            this._protectedHeader = { ...this._protectedHeader, iss: this._payload.iss };
-        }
-        if (this._replicateSubjectAsHeader) {
-            this._protectedHeader = { ...this._protectedHeader, sub: this._payload.sub };
-        }
-        if (this._replicateAudienceAsHeader) {
-            this._protectedHeader = { ...this._protectedHeader, aud: this._payload.aud };
+        const enc = new CompactEncrypt(this.#jwt.data());
+        if (this.#protectedHeader &&
+            (this.#replicateIssuerAsHeader ||
+                this.#replicateSubjectAsHeader ||
+                this.#replicateAudienceAsHeader)) {
+            this.#protectedHeader = {
+                ...this.#protectedHeader,
+                iss: this.#replicateIssuerAsHeader ? this.#jwt.iss : undefined,
+                sub: this.#replicateSubjectAsHeader ? this.#jwt.sub : undefined,
+                aud: this.#replicateAudienceAsHeader ? this.#jwt.aud : undefined,
+            };
         }
-        enc.setProtectedHeader(this._protectedHeader);
-        if (this._iv) {
-            enc.setInitializationVector(this._iv);
+        enc.setProtectedHeader(this.#protectedHeader);
+        if (this.#iv) {
+            enc.setInitializationVector(this.#iv);
         }
-        if (this._cek) {
-            enc.setContentEncryptionKey(this._cek);
+        if (this.#cek) {
+            enc.setContentEncryptionKey(this.#cek);
         }
-        if (this._keyManagementParameters) {
-            enc.setKeyManagementParameters(this._keyManagementParameters);
+        if (this.#keyManagementParameters) {
+            enc.setKeyManagementParameters(this.#keyManagementParameters);
         }
         return enc.encrypt(key, options);
     }

package/dist/webapi/jwt/produce.js

@@ -1,6 +1,7 @@
 import epoch from '../lib/epoch.js';
-import isObject from '../lib/is_object.js';
 import secs from '../lib/secs.js';
+import isObject from '../lib/is_object.js';
+import { encoder } from '../lib/buffer_utils.js';
 function validateInput(label, input) {
     if (!Number.isFinite(input)) {
         throw new TypeError(`Invalid ${label} input`);
@@ -8,69 +9,83 @@ function validateInput(label, input) {
     return input;
 }
 export class ProduceJWT {
-    _payload;
-    constructor(payload = {}) {
+    #payload;
+    constructor(payload) {
         if (!isObject(payload)) {
             throw new TypeError('JWT Claims Set MUST be an object');
         }
-        this._payload = payload;
+        this.#payload = structuredClone(payload);
+    }
+    data() {
+        return encoder.encode(JSON.stringify(this.#payload));
+    }
+    get iss() {
+        return this.#payload.iss;
+    }
+    set iss(value) {
+        this.#payload.iss = value;
     }
-    setIssuer(issuer) {
-        this._payload = { ...this._payload, iss: issuer };
-        return this;
+    get sub() {
+        return this.#payload.sub;
     }
-    setSubject(subject) {
-        this._payload = { ...this._payload, sub: subject };
-        return this;
+    set sub(value) {
+        this.#payload.sub = value;
     }
-    setAudience(audience) {
-        this._payload = { ...this._payload, aud: audience };
-        return this;
+    get aud() {
+        return this.#payload.aud;
     }
-    setJti(jwtId) {
-        this._payload = { ...this._payload, jti: jwtId };
-        return this;
+    set aud(value) {
+        this.#payload.aud = value;
     }
-    setNotBefore(input) {
-        if (typeof input === 'number') {
-            this._payload = { ...this._payload, nbf: validateInput('setNotBefore', input) };
+    get jti() {
+        return this.#payload.jti;
+    }
+    set jti(value) {
+        this.#payload.jti = value;
+    }
+    get nbf() {
+        return this.#payload.nbf;
+    }
+    set nbf(value) {
+        if (typeof value === 'number') {
+            this.#payload.nbf = validateInput('setNotBefore', value);
         }
-        else if (input instanceof Date) {
-            this._payload = { ...this._payload, nbf: validateInput('setNotBefore', epoch(input)) };
+        else if (value instanceof Date) {
+            this.#payload.nbf = validateInput('setNotBefore', epoch(value));
         }
         else {
-            this._payload = { ...this._payload, nbf: epoch(new Date()) + secs(input) };
+            this.#payload.nbf = epoch(new Date()) + secs(value);
         }
-        return this;
     }
-    setExpirationTime(input) {
-        if (typeof input === 'number') {
-            this._payload = { ...this._payload, exp: validateInput('setExpirationTime', input) };
+    get exp() {
+        return this.#payload.exp;
+    }
+    set exp(value) {
+        if (typeof value === 'number') {
+            this.#payload.exp = validateInput('setExpirationTime', value);
         }
-        else if (input instanceof Date) {
-            this._payload = { ...this._payload, exp: validateInput('setExpirationTime', epoch(input)) };
+        else if (value instanceof Date) {
+            this.#payload.exp = validateInput('setExpirationTime', epoch(value));
         }
         else {
-            this._payload = { ...this._payload, exp: epoch(new Date()) + secs(input) };
+            this.#payload.exp = epoch(new Date()) + secs(value);
         }
-        return this;
     }
-    setIssuedAt(input) {
-        if (typeof input === 'undefined') {
-            this._payload = { ...this._payload, iat: epoch(new Date()) };
+    get iat() {
+        return this.#payload.iat;
+    }
+    set iat(value) {
+        if (typeof value === 'undefined') {
+            this.#payload.iat = epoch(new Date());
         }
-        else if (input instanceof Date) {
-            this._payload = { ...this._payload, iat: validateInput('setIssuedAt', epoch(input)) };
+        else if (value instanceof Date) {
+            this.#payload.iat = validateInput('setIssuedAt', epoch(value));
         }
-        else if (typeof input === 'string') {
-            this._payload = {
-                ...this._payload,
-                iat: validateInput('setIssuedAt', epoch(new Date()) + secs(input)),
-            };
+        else if (typeof value === 'string') {
+            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
         }
         else {
-            this._payload = { ...this._payload, iat: validateInput('setIssuedAt', input) };
+            this.#payload.iat = validateInput('setIssuedAt', value);
         }
-        return this;
     }
 }

package/dist/webapi/jwt/sign.js

@@ -1,19 +1,50 @@
 import { CompactSign } from '../jws/compact/sign.js';
 import { JWTInvalid } from '../util/errors.js';
-import { encoder } from '../lib/buffer_utils.js';
 import { ProduceJWT } from './produce.js';
-export class SignJWT extends ProduceJWT {
-    _protectedHeader;
+export class SignJWT {
+    #protectedHeader;
+    #jwt;
+    constructor(payload = {}) {
+        this.#jwt = new ProduceJWT(payload);
+    }
+    setIssuer(issuer) {
+        this.#jwt.iss = issuer;
+        return this;
+    }
+    setSubject(subject) {
+        this.#jwt.sub = subject;
+        return this;
+    }
+    setAudience(audience) {
+        this.#jwt.aud = audience;
+        return this;
+    }
+    setJti(jwtId) {
+        this.#jwt.jti = jwtId;
+        return this;
+    }
+    setNotBefore(input) {
+        this.#jwt.nbf = input;
+        return this;
+    }
+    setExpirationTime(input) {
+        this.#jwt.exp = input;
+        return this;
+    }
+    setIssuedAt(input) {
+        this.#jwt.iat = input;
+        return this;
+    }
     setProtectedHeader(protectedHeader) {
-        this._protectedHeader = protectedHeader;
+        this.#protectedHeader = protectedHeader;
         return this;
     }
     async sign(key, options) {
-        const sig = new CompactSign(encoder.encode(JSON.stringify(this._payload)));
-        sig.setProtectedHeader(this._protectedHeader);
-        if (Array.isArray(this._protectedHeader?.crit) &&
-            this._protectedHeader.crit.includes('b64') &&
-            this._protectedHeader.b64 === false) {
+        const sig = new CompactSign(this.#jwt.data());
+        sig.setProtectedHeader(this.#protectedHeader);
+        if (Array.isArray(this.#protectedHeader?.crit) &&
+            this.#protectedHeader.crit.includes('b64') &&
+            this.#protectedHeader.b64 === false) {
             throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
         }
         return sig.sign(key, options);

package/dist/webapi/jwt/unsecured.js

@@ -3,12 +3,44 @@ import { decoder } from '../lib/buffer_utils.js';
 import { JWTInvalid } from '../util/errors.js';
 import jwtPayload from '../lib/jwt_claims_set.js';
 import { ProduceJWT } from './produce.js';
-export class UnsecuredJWT extends ProduceJWT {
+export class UnsecuredJWT {
+    #jwt;
+    constructor(payload = {}) {
+        this.#jwt = new ProduceJWT(payload);
+    }
     encode() {
         const header = b64u.encode(JSON.stringify({ alg: 'none' }));
-        const payload = b64u.encode(JSON.stringify(this._payload));
+        const payload = b64u.encode(this.#jwt.data());
         return `${header}.${payload}.`;
     }
+    setIssuer(issuer) {
+        this.#jwt.iss = issuer;
+        return this;
+    }
+    setSubject(subject) {
+        this.#jwt.sub = subject;
+        return this;
+    }
+    setAudience(audience) {
+        this.#jwt.aud = audience;
+        return this;
+    }
+    setJti(jwtId) {
+        this.#jwt.jti = jwtId;
+        return this;
+    }
+    setNotBefore(input) {
+        this.#jwt.nbf = input;
+        return this;
+    }
+    setExpirationTime(input) {
+        this.#jwt.exp = input;
+        return this;
+    }
+    setIssuedAt(input) {
+        this.#jwt.iat = input;
+        return this;
+    }
     static decode(jwt, options) {
         if (typeof jwt !== 'string') {
             throw new JWTInvalid('Unsecured JWT must be a string');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.0.8",
+  "version": "6.0.9",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",