jose 6.2.0 → 6.2.2

package/dist/webapi/jwe/flattened/decrypt.js

@@ -1,11 +1,12 @@
 import { decode as b64u } from '../../util/base64url.js';
-import { decrypt } from '../../lib/decrypt.js';
+import { decrypt } from '../../lib/content_encryption.js';
+import { decodeBase64url } from '../../lib/helpers.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
-import { isObject } from '../../lib/is_object.js';
-import { decryptKeyManagement } from '../../lib/decrypt_key_management.js';
+import { isDisjoint } from '../../lib/type_checks.js';
+import { isObject } from '../../lib/type_checks.js';
+import { decryptKeyManagement } from '../../lib/key_management.js';
 import { decoder, concat, encode } from '../../lib/buffer_utils.js';
-import { generateCek } from '../../lib/cek.js';
+import { generateCek } from '../../lib/content_encryption.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { validateAlgorithms } from '../../lib/validate_algorithms.js';
 import { normalizeKey } from '../../lib/normalize_key.js';
@@ -86,12 +87,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
-        try {
-            encryptedKey = b64u(jwe.encrypted_key);
-        }
-        catch {
-            throw new JWEInvalid('Failed to base64url decode the encrypted_key');
-        }
+        encryptedKey = decodeBase64url(jwe.encrypted_key, 'encrypted_key', JWEInvalid);
     }
     let resolvedKey = false;
     if (typeof key === 'function') {
@@ -113,20 +109,10 @@ export async function flattenedDecrypt(jwe, key, options) {
     let iv;
     let tag;
     if (jwe.iv !== undefined) {
-        try {
-            iv = b64u(jwe.iv);
-        }
-        catch {
-            throw new JWEInvalid('Failed to base64url decode the iv');
-        }
+        iv = decodeBase64url(jwe.iv, 'iv', JWEInvalid);
     }
     if (jwe.tag !== undefined) {
-        try {
-            tag = b64u(jwe.tag);
-        }
-        catch {
-            throw new JWEInvalid('Failed to base64url decode the tag');
-        }
+        tag = decodeBase64url(jwe.tag, 'tag', JWEInvalid);
     }
     const protectedHeader = jwe.protected !== undefined ? encode(jwe.protected) : new Uint8Array();
     let additionalData;
@@ -136,13 +122,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     else {
         additionalData = protectedHeader;
     }
-    let ciphertext;
-    try {
-        ciphertext = b64u(jwe.ciphertext);
-    }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the ciphertext');
-    }
+    const ciphertext = decodeBase64url(jwe.ciphertext, 'ciphertext', JWEInvalid);
     const plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
     const result = { plaintext };
     if (joseHeader.zip === 'DEF') {
@@ -154,18 +134,17 @@ export async function flattenedDecrypt(jwe, key, options) {
             (!Number.isSafeInteger(maxDecompressedLength) || maxDecompressedLength < 1)) {
             throw new TypeError('maxDecompressedLength must be 0, a positive safe integer, or Infinity');
         }
-        result.plaintext = await decompress(plaintext, maxDecompressedLength);
+        result.plaintext = await decompress(plaintext, maxDecompressedLength).catch((cause) => {
+            if (cause instanceof JWEInvalid)
+                throw cause;
+            throw new JWEInvalid('Failed to decompress plaintext', { cause });
+        });
     }
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;
     }
     if (jwe.aad !== undefined) {
-        try {
-            result.additionalAuthenticatedData = b64u(jwe.aad);
-        }
-        catch {
-            throw new JWEInvalid('Failed to base64url decode the aad');
-        }
+        result.additionalAuthenticatedData = decodeBase64url(jwe.aad, 'aad', JWEInvalid);
     }
     if (jwe.unprotected !== undefined) {
         result.sharedUnprotectedHeader = jwe.unprotected;

package/dist/webapi/jwe/flattened/encrypt.js

@@ -1,9 +1,9 @@
 import { encode as b64u } from '../../util/base64url.js';
-import { unprotected } from '../../lib/private_symbols.js';
-import { encrypt } from '../../lib/encrypt.js';
-import { encryptKeyManagement } from '../../lib/encrypt_key_management.js';
+import { unprotected, assertNotSet } from '../../lib/helpers.js';
+import { encrypt } from '../../lib/content_encryption.js';
+import { encryptKeyManagement } from '../../lib/key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
+import { isDisjoint } from '../../lib/type_checks.js';
 import { concat, encode } from '../../lib/buffer_utils.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { normalizeKey } from '../../lib/normalize_key.js';
@@ -25,30 +25,22 @@ export class FlattenedEncrypt {
         this.#plaintext = plaintext;
     }
     setKeyManagementParameters(parameters) {
-        if (this.#keyManagementParameters) {
-            throw new TypeError('setKeyManagementParameters can only be called once');
-        }
+        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
         this.#keyManagementParameters = parameters;
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.#protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        if (this.#sharedUnprotectedHeader) {
-            throw new TypeError('setSharedUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.#sharedUnprotectedHeader, 'setSharedUnprotectedHeader');
         this.#sharedUnprotectedHeader = sharedUnprotectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this.#unprotectedHeader) {
-            throw new TypeError('setUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
         this.#unprotectedHeader = unprotectedHeader;
         return this;
     }
@@ -57,16 +49,12 @@ export class FlattenedEncrypt {
         return this;
     }
     setContentEncryptionKey(cek) {
-        if (this.#cek) {
-            throw new TypeError('setContentEncryptionKey can only be called once');
-        }
+        assertNotSet(this.#cek, 'setContentEncryptionKey');
         this.#cek = cek;
         return this;
     }
     setInitializationVector(iv) {
-        if (this.#iv) {
-            throw new TypeError('setInitializationVector can only be called once');
-        }
+        assertNotSet(this.#iv, 'setInitializationVector');
         this.#iv = iv;
         return this;
     }
@@ -145,7 +133,9 @@ export class FlattenedEncrypt {
         }
         let plaintext = this.#plaintext;
         if (joseHeader.zip === 'DEF') {
-            plaintext = await compress(plaintext);
+            plaintext = await compress(plaintext).catch((cause) => {
+                throw new JWEInvalid('Failed to compress plaintext', { cause });
+            });
         }
         const { ciphertext, tag, iv } = await encrypt(enc, plaintext, cek, this.#iv, additionalData);
         const jwe = {

package/dist/webapi/jwe/general/decrypt.js

@@ -1,6 +1,6 @@
 import { flattenedDecrypt } from '../flattened/decrypt.js';
 import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
-import { isObject } from '../../lib/is_object.js';
+import { isObject } from '../../lib/type_checks.js';
 export async function generalDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('General JWE must be an object');

package/dist/webapi/jwe/general/encrypt.js

@@ -1,9 +1,9 @@
 import { FlattenedEncrypt } from '../flattened/encrypt.js';
-import { unprotected } from '../../lib/private_symbols.js';
+import { unprotected, assertNotSet } from '../../lib/helpers.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import { generateCek } from '../../lib/cek.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
-import { encryptKeyManagement } from '../../lib/encrypt_key_management.js';
+import { generateCek } from '../../lib/content_encryption.js';
+import { isDisjoint } from '../../lib/type_checks.js';
+import { encryptKeyManagement } from '../../lib/key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { normalizeKey } from '../../lib/normalize_key.js';
@@ -20,16 +20,12 @@ class IndividualRecipient {
         this.options = options;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this.unprotectedHeader) {
-            throw new TypeError('setUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.unprotectedHeader, 'setUnprotectedHeader');
         this.unprotectedHeader = unprotectedHeader;
         return this;
     }
     setKeyManagementParameters(parameters) {
-        if (this.keyManagementParameters) {
-            throw new TypeError('setKeyManagementParameters can only be called once');
-        }
+        assertNotSet(this.keyManagementParameters, 'setKeyManagementParameters');
         this.keyManagementParameters = parameters;
         return this;
     }
@@ -58,16 +54,12 @@ export class GeneralEncrypt {
         return recipient;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.#protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        if (this.#unprotectedHeader) {
-            throw new TypeError('setSharedUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.#unprotectedHeader, 'setSharedUnprotectedHeader');
         this.#unprotectedHeader = sharedUnprotectedHeader;
         return this;
     }

package/dist/webapi/jwk/embedded.js

@@ -1,5 +1,5 @@
 import { importJWK } from '../key/import.js';
-import { isObject } from '../lib/is_object.js';
+import { isObject } from '../lib/type_checks.js';
 import { JWSInvalid } from '../util/errors.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {

package/dist/webapi/jwk/thumbprint.js

@@ -1,9 +1,9 @@
-import { digest } from '../lib/digest.js';
+import { digest } from '../lib/helpers.js';
 import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encode } from '../lib/buffer_utils.js';
 import { isKeyLike } from '../lib/is_key_like.js';
-import { isJWK } from '../lib/is_jwk.js';
+import { isJWK } from '../lib/type_checks.js';
 import { exportJWK } from '../key/export.js';
 import { invalidKeyInput } from '../lib/invalid_key_input.js';
 const check = (value, description) => {

package/dist/webapi/jwks/local.js

@@ -1,6 +1,6 @@
 import { importJWK } from '../key/import.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import { isObject } from '../lib/is_object.js';
+import { isObject } from '../lib/type_checks.js';
 function getKtyFromAlg(alg) {
     switch (typeof alg === 'string' && alg.slice(0, 2)) {
         case 'RS':

package/dist/webapi/jwks/remote.js

@@ -1,6 +1,6 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
 import { createLocalJWKSet } from './local.js';
-import { isObject } from '../lib/is_object.js';
+import { isObject } from '../lib/type_checks.js';
 function isCloudflareWorkers() {
     return (typeof WebSocketPair !== 'undefined' ||
         (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.0';
+    const VERSION = 'v6.2.2';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/jws/flattened/sign.js

@@ -1,11 +1,12 @@
 import { encode as b64u } from '../../util/base64url.js';
-import { sign } from '../../lib/sign.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
+import { sign } from '../../lib/signing.js';
+import { isDisjoint } from '../../lib/type_checks.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { concat, encode } from '../../lib/buffer_utils.js';
 import { checkKeyType } from '../../lib/check_key_type.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { normalizeKey } from '../../lib/normalize_key.js';
+import { assertNotSet } from '../../lib/helpers.js';
 export class FlattenedSign {
     #payload;
     #protectedHeader;
@@ -17,16 +18,12 @@ export class FlattenedSign {
         this.#payload = payload;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.#protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this.#unprotectedHeader) {
-            throw new TypeError('setUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
         this.#unprotectedHeader = unprotectedHeader;
         return this;
     }

package/dist/webapi/jws/flattened/verify.js

@@ -1,9 +1,10 @@
 import { decode as b64u } from '../../util/base64url.js';
-import { verify } from '../../lib/verify.js';
+import { verify } from '../../lib/signing.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
-import { isObject } from '../../lib/is_object.js';
+import { decodeBase64url } from '../../lib/helpers.js';
+import { isDisjoint } from '../../lib/type_checks.js';
+import { isObject } from '../../lib/type_checks.js';
 import { checkKeyType } from '../../lib/check_key_type.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { validateAlgorithms } from '../../lib/validate_algorithms.js';
@@ -79,13 +80,7 @@ export async function flattenedVerify(jws, key, options) {
             ? encode(jws.payload)
             : encoder.encode(jws.payload)
         : jws.payload);
-    let signature;
-    try {
-        signature = b64u(jws.signature);
-    }
-    catch {
-        throw new JWSInvalid('Failed to base64url decode the signature');
-    }
+    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
     const k = await normalizeKey(key, alg);
     const verified = await verify(alg, k, signature, data);
     if (!verified) {
@@ -93,12 +88,7 @@ export async function flattenedVerify(jws, key, options) {
     }
     let payload;
     if (b64) {
-        try {
-            payload = b64u(jws.payload);
-        }
-        catch {
-            throw new JWSInvalid('Failed to base64url decode the payload');
-        }
+        payload = decodeBase64url(jws.payload, 'payload', JWSInvalid);
     }
     else if (typeof jws.payload === 'string') {
         payload = encoder.encode(jws.payload);

package/dist/webapi/jws/general/sign.js

@@ -1,5 +1,6 @@
 import { FlattenedSign } from '../flattened/sign.js';
 import { JWSInvalid } from '../../util/errors.js';
+import { assertNotSet } from '../../lib/helpers.js';
 class IndividualSignature {
     #parent;
     protectedHeader;
@@ -12,16 +13,12 @@ class IndividualSignature {
         this.options = options;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.protectedHeader, 'setProtectedHeader');
         this.protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this.unprotectedHeader) {
-            throw new TypeError('setUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.unprotectedHeader, 'setUnprotectedHeader');
         this.unprotectedHeader = unprotectedHeader;
         return this;
     }

package/dist/webapi/jws/general/verify.js

@@ -1,6 +1,6 @@
 import { flattenedVerify } from '../flattened/verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { isObject } from '../../lib/is_object.js';
+import { isObject } from '../../lib/type_checks.js';
 export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');

package/dist/webapi/jwt/encrypt.js

@@ -1,5 +1,6 @@
 import { CompactEncrypt } from '../jwe/compact/encrypt.js';
 import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
+import { assertNotSet } from '../lib/helpers.js';
 export class EncryptJWT {
     #cek;
     #iv;
@@ -41,30 +42,22 @@ export class EncryptJWT {
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.#protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     setKeyManagementParameters(parameters) {
-        if (this.#keyManagementParameters) {
-            throw new TypeError('setKeyManagementParameters can only be called once');
-        }
+        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
         this.#keyManagementParameters = parameters;
         return this;
     }
     setContentEncryptionKey(cek) {
-        if (this.#cek) {
-            throw new TypeError('setContentEncryptionKey can only be called once');
-        }
+        assertNotSet(this.#cek, 'setContentEncryptionKey');
         this.#cek = cek;
         return this;
     }
     setInitializationVector(iv) {
-        if (this.#iv) {
-            throw new TypeError('setInitializationVector can only be called once');
-        }
+        assertNotSet(this.#iv, 'setInitializationVector');
         this.#iv = iv;
         return this;
     }

package/dist/webapi/key/import.js

@@ -2,7 +2,7 @@ import { decode as decodeBase64URL } from '../util/base64url.js';
 import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
 import { jwkToKey } from '../lib/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';
-import { isObject } from '../lib/is_object.js';
+import { isObject } from '../lib/type_checks.js';
 export async function importSPKI(spki, alg, options) {
     if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
         throw new TypeError('"spki" must be SPKI formatted string');

package/dist/webapi/lib/aesgcmkw.js

@@ -1,5 +1,4 @@
-import { encrypt } from './encrypt.js';
-import { decrypt } from './decrypt.js';
+import { encrypt, decrypt } from './content_encryption.js';
 import { encode as b64u } from '../util/base64url.js';
 export async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.slice(0, 7);

package/dist/webapi/lib/check_key_type.js

@@ -1,6 +1,6 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import { isKeyLike } from './is_key_like.js';
-import * as jwk from './is_jwk.js';
+import * as jwk from './type_checks.js';
 const tag = (key) => key?.[Symbol.toStringTag];
 const jwkMatchesOp = (alg, key, usage) => {
     if (key.use !== undefined) {