jose 6.0.9 → 6.0.11

package/README.md

@@ -118,10 +118,10 @@ Please note that certain algorithms may not be available depending on the runtim
 
 | Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ | Runtime and Module type         |
 | ----------------------------------------------- | ----------------- | ------------------ | --------------- | ------------------------------- |
-| [v6.x](https://github.com/panva/jose/tree/v6.x) | ✅                | ✅                 | ✅              | Universal[^universal] ESM[^cjs] |
-| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅                | ❌                 | ❌              | Universal[^universal] CJS + ESM |
-| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅                | ❌                 | ❌              | Universal[^universal] CJS + ESM |
-| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅                | ❌                 | ❌              | Node.js CJS                     |
+| [v6.x](https://github.com/panva/jose/tree/v6.x) | [Security Policy] | ✅                 | ✅              | Universal[^universal] ESM[^cjs] |
+| [v5.x](https://github.com/panva/jose/tree/v5.x) | [Security Policy] | ❌                 | ❌              | Universal[^universal] CJS + ESM |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | [Security Policy] | ❌                 | ❌              | Universal[^universal] CJS + ESM |
+| [v2.x](https://github.com/panva/jose/tree/v2.x) | [Security Policy] | ❌                 | ❌              | Node.js CJS                     |
 
 ## Specifications
 
@@ -145,7 +145,8 @@ The algorithm implementations in `jose` have been tested using test vectors from
 [sponsor-auth0]: https://a0.to/signup/panva
 [WebCryptoAPI]: https://w3c.github.io/webcrypto/
 [Fetch API]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
+[Security Policy]: https://github.com/panva/jose/security/policy
 
-[^cjs]: CJS style `let jose = require('jose')` is possible in Node.js versions where `process.features.require_module` is `true` by default (^20.19.0 || ^22.12.0 || >= 23.0.0) or with the `--experimental-require-module` Node.js CLI flag.
+[^cjs]: CJS style `let jose = require('jose')` is possible in Node.js versions where the `require(esm)` feature is enabled by default (^20.19.0 || ^22.12.0 || >= 23.0.0).
 
 [^universal]: Assumes runtime support of [WebCryptoAPI][] and [Fetch API][]

package/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.9';
+    const VERSION = 'v6.0.11';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/jwt/decrypt.js

@@ -1,9 +1,9 @@
 import { compactDecrypt } from '../jwe/compact/decrypt.js';
-import jwtPayload from '../lib/jwt_claims_set.js';
+import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTClaimValidationFailed } from '../util/errors.js';
 export async function jwtDecrypt(jwt, key, options) {
     const decrypted = await compactDecrypt(jwt, key, options);
-    const payload = jwtPayload(decrypted.protectedHeader, decrypted.plaintext, options);
+    const payload = validateClaimsSet(decrypted.protectedHeader, decrypted.plaintext, options);
     const { protectedHeader } = decrypted;
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
         throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');

package/dist/webapi/jwt/encrypt.js

@@ -1,5 +1,5 @@
 import { CompactEncrypt } from '../jwe/compact/encrypt.js';
-import { ProduceJWT } from './produce.js';
+import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
 export class EncryptJWT {
     #cek;
     #iv;
@@ -10,7 +10,7 @@ export class EncryptJWT {
     #replicateAudienceAsHeader;
     #jwt;
     constructor(payload = {}) {
-        this.#jwt = new ProduceJWT(payload);
+        this.#jwt = new JWTClaimsBuilder(payload);
     }
     setIssuer(issuer) {
         this.#jwt.iss = issuer;

package/dist/webapi/jwt/sign.js

@@ -1,11 +1,11 @@
 import { CompactSign } from '../jws/compact/sign.js';
 import { JWTInvalid } from '../util/errors.js';
-import { ProduceJWT } from './produce.js';
+import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
 export class SignJWT {
     #protectedHeader;
     #jwt;
     constructor(payload = {}) {
-        this.#jwt = new ProduceJWT(payload);
+        this.#jwt = new JWTClaimsBuilder(payload);
     }
     setIssuer(issuer) {
         this.#jwt.iss = issuer;

package/dist/webapi/jwt/unsecured.js

@@ -1,12 +1,11 @@
 import * as b64u from '../util/base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
 import { JWTInvalid } from '../util/errors.js';
-import jwtPayload from '../lib/jwt_claims_set.js';
-import { ProduceJWT } from './produce.js';
+import { validateClaimsSet, JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
 export class UnsecuredJWT {
     #jwt;
     constructor(payload = {}) {
-        this.#jwt = new ProduceJWT(payload);
+        this.#jwt = new JWTClaimsBuilder(payload);
     }
     encode() {
         const header = b64u.encode(JSON.stringify({ alg: 'none' }));
@@ -58,7 +57,7 @@ export class UnsecuredJWT {
         catch {
             throw new JWTInvalid('Invalid Unsecured JWT');
         }
-        const payload = jwtPayload(header, b64u.decode(encodedPayload), options);
+        const payload = validateClaimsSet(header, b64u.decode(encodedPayload), options);
         return { payload, header };
     }
 }

package/dist/webapi/jwt/verify.js

@@ -1,12 +1,12 @@
 import { compactVerify } from '../jws/compact/verify.js';
-import jwtPayload from '../lib/jwt_claims_set.js';
+import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTInvalid } from '../util/errors.js';
 export async function jwtVerify(jwt, key, options) {
     const verified = await compactVerify(jwt, key, options);
     if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
-    const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
+    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
     const result = { payload, protectedHeader: verified.protectedHeader };
     if (typeof key === 'function') {
         return { ...result, key: verified.key };

package/dist/webapi/lib/jwt_claims_set.js

@@ -3,7 +3,19 @@ import { decoder } from './buffer_utils.js';
 import epoch from './epoch.js';
 import secs from './secs.js';
 import isObject from './is_object.js';
-const normalizeTyp = (value) => value.toLowerCase().replace(/^application\//, '');
+import { encoder } from './buffer_utils.js';
+function validateInput(label, input) {
+    if (!Number.isFinite(input)) {
+        throw new TypeError(`Invalid ${label} input`);
+    }
+    return input;
+}
+const normalizeTyp = (value) => {
+    if (value.includes('/')) {
+        return value.toLowerCase();
+    }
+    return `application/${value.toLowerCase()}`;
+};
 const checkAudiencePresence = (audPayload, audOption) => {
     if (typeof audPayload === 'string') {
         return audOption.includes(audPayload);
@@ -13,7 +25,7 @@ const checkAudiencePresence = (audPayload, audOption) => {
     }
     return false;
 };
-export default (protectedHeader, encodedPayload, options = {}) => {
+export function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     let payload;
     try {
         payload = JSON.parse(decoder.decode(encodedPayload));
@@ -101,4 +113,73 @@ export default (protectedHeader, encodedPayload, options = {}) => {
         }
     }
     return payload;
-};
+}
+export class JWTClaimsBuilder {
+    #payload;
+    constructor(payload) {
+        if (!isObject(payload)) {
+            throw new TypeError('JWT Claims Set MUST be an object');
+        }
+        this.#payload = structuredClone(payload);
+    }
+    data() {
+        return encoder.encode(JSON.stringify(this.#payload));
+    }
+    get iss() {
+        return this.#payload.iss;
+    }
+    set iss(value) {
+        this.#payload.iss = value;
+    }
+    get sub() {
+        return this.#payload.sub;
+    }
+    set sub(value) {
+        this.#payload.sub = value;
+    }
+    get aud() {
+        return this.#payload.aud;
+    }
+    set aud(value) {
+        this.#payload.aud = value;
+    }
+    set jti(value) {
+        this.#payload.jti = value;
+    }
+    set nbf(value) {
+        if (typeof value === 'number') {
+            this.#payload.nbf = validateInput('setNotBefore', value);
+        }
+        else if (value instanceof Date) {
+            this.#payload.nbf = validateInput('setNotBefore', epoch(value));
+        }
+        else {
+            this.#payload.nbf = epoch(new Date()) + secs(value);
+        }
+    }
+    set exp(value) {
+        if (typeof value === 'number') {
+            this.#payload.exp = validateInput('setExpirationTime', value);
+        }
+        else if (value instanceof Date) {
+            this.#payload.exp = validateInput('setExpirationTime', epoch(value));
+        }
+        else {
+            this.#payload.exp = epoch(new Date()) + secs(value);
+        }
+    }
+    set iat(value) {
+        if (typeof value === 'undefined') {
+            this.#payload.iat = epoch(new Date());
+        }
+        else if (value instanceof Date) {
+            this.#payload.iat = validateInput('setIssuedAt', epoch(value));
+        }
+        else if (typeof value === 'string') {
+            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
+        }
+        else {
+            this.#payload.iat = validateInput('setIssuedAt', value);
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.0.9",
+  "version": "6.0.11",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",

package/dist/types/jwt/produce.d.ts

@@ -1,20 +0,0 @@
-import type * as types from '../types.d.ts';
-export declare class ProduceJWT {
-    #private;
-    constructor(payload: types.JWTPayload);
-    data(): Uint8Array;
-    get iss(): string | undefined;
-    set iss(value: string);
-    get sub(): string | undefined;
-    set sub(value: string);
-    get aud(): string | string[] | undefined;
-    set aud(value: string | string[]);
-    get jti(): string | undefined;
-    set jti(value: string);
-    get nbf(): number | undefined;
-    set nbf(value: number | string | Date);
-    get exp(): number | undefined;
-    set exp(value: number | string | Date);
-    get iat(): number | undefined;
-    set iat(value: number | string | Date | undefined);
-}

package/dist/webapi/jwt/produce.js

@@ -1,91 +0,0 @@
-import epoch from '../lib/epoch.js';
-import secs from '../lib/secs.js';
-import isObject from '../lib/is_object.js';
-import { encoder } from '../lib/buffer_utils.js';
-function validateInput(label, input) {
-    if (!Number.isFinite(input)) {
-        throw new TypeError(`Invalid ${label} input`);
-    }
-    return input;
-}
-export class ProduceJWT {
-    #payload;
-    constructor(payload) {
-        if (!isObject(payload)) {
-            throw new TypeError('JWT Claims Set MUST be an object');
-        }
-        this.#payload = structuredClone(payload);
-    }
-    data() {
-        return encoder.encode(JSON.stringify(this.#payload));
-    }
-    get iss() {
-        return this.#payload.iss;
-    }
-    set iss(value) {
-        this.#payload.iss = value;
-    }
-    get sub() {
-        return this.#payload.sub;
-    }
-    set sub(value) {
-        this.#payload.sub = value;
-    }
-    get aud() {
-        return this.#payload.aud;
-    }
-    set aud(value) {
-        this.#payload.aud = value;
-    }
-    get jti() {
-        return this.#payload.jti;
-    }
-    set jti(value) {
-        this.#payload.jti = value;
-    }
-    get nbf() {
-        return this.#payload.nbf;
-    }
-    set nbf(value) {
-        if (typeof value === 'number') {
-            this.#payload.nbf = validateInput('setNotBefore', value);
-        }
-        else if (value instanceof Date) {
-            this.#payload.nbf = validateInput('setNotBefore', epoch(value));
-        }
-        else {
-            this.#payload.nbf = epoch(new Date()) + secs(value);
-        }
-    }
-    get exp() {
-        return this.#payload.exp;
-    }
-    set exp(value) {
-        if (typeof value === 'number') {
-            this.#payload.exp = validateInput('setExpirationTime', value);
-        }
-        else if (value instanceof Date) {
-            this.#payload.exp = validateInput('setExpirationTime', epoch(value));
-        }
-        else {
-            this.#payload.exp = epoch(new Date()) + secs(value);
-        }
-    }
-    get iat() {
-        return this.#payload.iat;
-    }
-    set iat(value) {
-        if (typeof value === 'undefined') {
-            this.#payload.iat = epoch(new Date());
-        }
-        else if (value instanceof Date) {
-            this.#payload.iat = validateInput('setIssuedAt', epoch(value));
-        }
-        else if (typeof value === 'string') {
-            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
-        }
-        else {
-            this.#payload.iat = validateInput('setIssuedAt', value);
-        }
-    }
-}