jose 6.2.15 → 6.2.16

package/dist/webapi/jwe/general/decrypt.js

@@ -13,9 +13,10 @@ async function generalDecrypt(jwe, key, options) {
     throw new JWEInvalid("JWE Recipients missing or incorrect type");
   if (!recipients.length)
     throw new JWEInvalid("JWE Recipients has no members");
-  let shared, sharedJwe, token;
+  const shared = prepareDecrypt(options);
+  let sharedJwe, token;
   try {
-    shared = prepareDecrypt(options), sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
+    sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
   } catch {
     throw new JWEDecryptionFailed();
   }

package/dist/webapi/jwks/remote.js

@@ -5,7 +5,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 let USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.15");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.16");
 const customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {

package/dist/webapi/jws/general/verify.js

@@ -22,15 +22,9 @@ async function generalVerify(jws, key, options) {
   const signatureEntries = Array.from(signatures);
   if (!signatureEntries.every(isObject))
     throw new JWSInvalid("JWS Signatures missing or incorrect type");
-  let shared;
-  try {
-    if (inputPayload === void 0)
-      throw new Error();
-    shared = prepareVerify(options);
-  } catch {
+  if (inputPayload === void 0)
     throw new JWSSignatureVerificationFailed();
-  }
-  const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
+  const shared = prepareVerify(options), payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
   let payloadEncodings = 0;
   for (const [, , payloadEncoding] of candidates)
     if (payloadEncodings |= payloadEncoding, payloadEncodings === 3)

package/dist/webapi/lib/jwe_decrypt.js

@@ -1,7 +1,7 @@
 import { decrypt, generateCek } from "./content_encryption.js";
 import { decodeBase64url, encodeAsciiMember, parseJoseHeader, isDisjoint, isObject, validateCrit, validateAlgorithms, JWE_RECOGNIZED } from "./validate.js";
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from "../util/errors.js";
-import { decryptKeyManagement } from "./key_management.js";
+import { decryptKeyManagement, validateMaxPBES2Count } from "./key_management.js";
 import { decoder } from "./buffer_utils.js";
 import { prepareKey } from "./key.js";
 import { JWE, isJWECEKTransport, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
@@ -69,12 +69,17 @@ function shareJWE(jwe) {
   ];
 }
 function prepareDecrypt(options) {
+  const keyManagementAlgorithms = options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms), contentEncryptionAlgorithms = options && validateAlgorithms("contentEncryptionAlgorithms", options.contentEncryptionAlgorithms), { crit, maxPBES2Count, maxDecompressedLength } = options ?? {};
+  validateMaxPBES2Count(maxPBES2Count);
+  const decompressionLimit = maxDecompressedLength ?? 25e4;
+  if (decompressionLimit !== 0 && decompressionLimit !== 1 / 0 && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1))
+    throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");
   return [
-    options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms),
-    options && validateAlgorithms("contentEncryptionAlgorithms", options.contentEncryptionAlgorithms),
-    options?.crit,
-    options?.maxPBES2Count,
-    options?.maxDecompressedLength
+    keyManagementAlgorithms,
+    contentEncryptionAlgorithms,
+    crit,
+    maxPBES2Count,
+    maxDecompressedLength
   ];
 }
 async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
@@ -145,8 +150,6 @@ async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
     const decompressionLimit = maxDecompressedLength ?? 25e4;
     if (decompressionLimit === 0)
       throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
-    if (decompressionLimit !== 1 / 0 && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1))
-      throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");
     plaintext = await decompress(plaintext, decompressionLimit).catch((cause) => {
       throw cause instanceof JWEInvalid ? cause : new JWEInvalid("Failed to decompress plaintext", { cause });
     });

package/dist/webapi/lib/key_management.js

@@ -111,7 +111,6 @@ async function decryptKeyManagement(entry, enc, key, encryptedKey, joseHeader, m
     case "PBKDF2": {
       if (typeof joseHeader.p2c != "number")
         throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) missing or invalid');
-      validateMaxPBES2Count(maxPBES2Count);
       const p2cLimit = maxPBES2Count ?? 1e4;
       if (joseHeader.p2c > p2cLimit)
         throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.15",
+  "version": "6.2.16",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",