jose 6.2.6 → 6.2.8

package/dist/webapi/lib/jwt_claims_set.js

@@ -2,56 +2,23 @@ import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors
 import { encoder, strictDecoder } from './buffer_utils.js';
 import { isObject } from './type_checks.js';
 const epoch = (date) => Math.floor(date.getTime() / 1000);
-const minute = 60;
-const hour = minute * 60;
-const day = hour * 24;
-const week = day * 7;
-const year = day * 365.25;
+const multipliers = {
+    s: 1,
+    m: 60,
+    h: 3600,
+    d: 86400,
+    w: 604800,
+    y: 31557600,
+};
 const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+const checkFailed = 'check_failed';
 export function secs(str) {
     const matched = REGEX.exec(str);
     if (!matched || (matched[4] && matched[1])) {
         throw new TypeError('Invalid time period format');
     }
     const value = parseFloat(matched[2]);
-    const unit = matched[3].toLowerCase();
-    let numericDate;
-    switch (unit) {
-        case 'sec':
-        case 'secs':
-        case 'second':
-        case 'seconds':
-        case 's':
-            numericDate = Math.round(value);
-            break;
-        case 'minute':
-        case 'minutes':
-        case 'min':
-        case 'mins':
-        case 'm':
-            numericDate = Math.round(value * minute);
-            break;
-        case 'hour':
-        case 'hours':
-        case 'hr':
-        case 'hrs':
-        case 'h':
-            numericDate = Math.round(value * hour);
-            break;
-        case 'day':
-        case 'days':
-        case 'd':
-            numericDate = Math.round(value * day);
-            break;
-        case 'week':
-        case 'weeks':
-        case 'w':
-            numericDate = Math.round(value * week);
-            break;
-        default:
-            numericDate = Math.round(value * year);
-            break;
-    }
+    const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
     if (matched[1] === '-' || matched[4] === 'ago') {
         return -numericDate;
     }
@@ -63,6 +30,13 @@ function validateInput(label, input) {
     }
     return input;
 }
+function numericDate(value, label) {
+    if (typeof value === 'number')
+        return validateInput(label, value);
+    if (value instanceof Date)
+        return validateInput(label, epoch(value));
+    return epoch(new Date()) + secs(value);
+}
 const normalizeTyp = (value) => {
     if (value.includes('/')) {
         return value.toLowerCase();
@@ -74,10 +48,22 @@ const checkAudiencePresence = (audPayload, audOption) => {
         return audOption.includes(audPayload);
     }
     if (Array.isArray(audPayload)) {
-        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
+        return audOption.some((aud) => audPayload.includes(aud));
     }
     return false;
 };
+function validateNumericDate(payload, claim, required = false) {
+    const value = payload[claim];
+    if (value === undefined && !required)
+        return undefined;
+    if (typeof value !== 'number') {
+        throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, 'invalid');
+    }
+    return value;
+}
+function unexpectedClaim(payload, claim) {
+    throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
 export function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     let payload;
     try {
@@ -92,7 +78,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     if (typ &&
         (typeof protectedHeader.typ !== 'string' ||
             normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', checkFailed);
     }
     const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
     const presenceCheck = [...requiredClaims];
@@ -105,65 +91,56 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     if (issuer !== undefined)
         presenceCheck.push('iss');
     for (const claim of new Set(presenceCheck.reverse())) {
-        if (!(claim in payload)) {
+        if (!Object.hasOwn(payload, claim)) {
             throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
         }
     }
     if (issuer !== undefined &&
         !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
+        unexpectedClaim(payload, 'iss');
     }
     if (subject !== undefined && payload.sub !== subject) {
-        throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
+        unexpectedClaim(payload, 'sub');
     }
     if (audience !== undefined &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
-    }
-    let tolerance;
-    switch (typeof options.clockTolerance) {
-        case 'string':
-            tolerance = secs(options.clockTolerance);
-            break;
-        case 'number':
-            tolerance = options.clockTolerance;
-            break;
-        case 'undefined':
-            tolerance = 0;
-            break;
-        default:
+        unexpectedClaim(payload, 'aud');
+    }
+    const { clockTolerance } = options;
+    let tolerance = 0;
+    if (typeof clockTolerance === 'string') {
+        tolerance = secs(clockTolerance);
+    }
+    else if (clockTolerance !== undefined) {
+        if (typeof clockTolerance !== 'number') {
             throw new TypeError('Invalid clockTolerance option type');
+        }
+        tolerance = clockTolerance;
     }
     validateInput('clockTolerance option', tolerance);
     const { currentDate } = options;
     const now = validateInput('currentDate option', epoch(currentDate || new Date()));
-    if ((payload.iat !== undefined || maxTokenAge !== undefined) && typeof payload.iat !== 'number') {
-        throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
-    }
-    if (payload.nbf !== undefined) {
-        if (typeof payload.nbf !== 'number') {
-            throw new JWTClaimValidationFailed('"nbf" claim must be a number', payload, 'nbf', 'invalid');
-        }
-        if (payload.nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', 'check_failed');
+    const iat = validateNumericDate(payload, 'iat', maxTokenAge !== undefined);
+    const nbf = validateNumericDate(payload, 'nbf');
+    if (nbf !== undefined) {
+        if (nbf > now + tolerance) {
+            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', checkFailed);
         }
     }
-    if (payload.exp !== undefined) {
-        if (typeof payload.exp !== 'number') {
-            throw new JWTClaimValidationFailed('"exp" claim must be a number', payload, 'exp', 'invalid');
-        }
-        if (payload.exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
+    const exp = validateNumericDate(payload, 'exp');
+    if (exp !== undefined) {
+        if (exp <= now - tolerance) {
+            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', checkFailed);
         }
     }
     if (maxTokenAge !== undefined) {
-        const age = now - payload.iat;
+        const age = now - iat;
         const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
         if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');
+            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', checkFailed);
         }
         if (age < 0 - tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');
+            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', checkFailed);
         }
     }
     return payload;
@@ -201,39 +178,20 @@ export class JWTClaimsBuilder {
         this.#payload.jti = value;
     }
     set nbf(value) {
-        if (typeof value === 'number') {
-            this.#payload.nbf = validateInput('setNotBefore', value);
-        }
-        else if (value instanceof Date) {
-            this.#payload.nbf = validateInput('setNotBefore', epoch(value));
-        }
-        else {
-            this.#payload.nbf = epoch(new Date()) + secs(value);
-        }
+        this.#payload.nbf = numericDate(value, 'setNotBefore');
     }
     set exp(value) {
-        if (typeof value === 'number') {
-            this.#payload.exp = validateInput('setExpirationTime', value);
-        }
-        else if (value instanceof Date) {
-            this.#payload.exp = validateInput('setExpirationTime', epoch(value));
-        }
-        else {
-            this.#payload.exp = epoch(new Date()) + secs(value);
-        }
+        this.#payload.exp = numericDate(value, 'setExpirationTime');
     }
     set iat(value) {
         if (value === undefined) {
             this.#payload.iat = epoch(new Date());
         }
-        else if (value instanceof Date) {
-            this.#payload.iat = validateInput('setIssuedAt', epoch(value));
-        }
         else if (typeof value === 'string') {
             this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
         }
         else {
-            this.#payload.iat = validateInput('setIssuedAt', value);
+            this.#payload.iat = numericDate(value, 'setIssuedAt');
         }
     }
 }

package/dist/webapi/lib/key.js

@@ -7,17 +7,7 @@ const tag = (key) => key[Symbol.toStringTag];
 const jwkMatchesOp = (entry, key, usage) => {
     const { alg } = entry;
     if (key.use !== undefined) {
-        let expected;
-        switch (usage) {
-            case 'sign':
-            case 'verify':
-                expected = 'sig';
-                break;
-            case 'encrypt':
-            case 'decrypt':
-                expected = 'enc';
-                break;
-        }
+        const expected = usage === 'sign' || usage === 'verify' ? 'sig' : 'enc';
         if (key.use !== expected) {
             throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
         }
@@ -26,79 +16,56 @@ const jwkMatchesOp = (entry, key, usage) => {
         throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
     }
     if (Array.isArray(key.key_ops)) {
-        const expectedKeyOp = usage === 'encrypt' || usage === 'decrypt' ? entry.keyOps?.[usage] : usage;
-        if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) {
+        const expectedKeyOp = usage === 'encrypt' || usage === 'decrypt' ? entry.ops?.[usage === 'encrypt' ? 0 : 1] : usage;
+        if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) {
             throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
         }
     }
-    return true;
-};
-const symmetricTypeCheck = (entry, key, usage) => {
-    const { alg } = entry;
-    if (key instanceof Uint8Array)
-        return { kind: BYTES, key };
-    if (jwk.isJWK(key)) {
-        if (jwk.isSecretJWK(key) && jwkMatchesOp(entry, key, usage))
-            return { kind: JWK, key };
-        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
-    }
-    if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array'));
-    }
-    if (key.type !== 'secret') {
-        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-    }
-    return isCryptoKey(key) ? { kind: CRYPTO, key } : { kind: KEYOBJECT, key };
 };
-const asymmetricTypeCheck = (entry, key, usage) => {
-    const { alg } = entry;
+export function checkKeyType(entry, key, usage) {
+    const { alg, secret } = entry;
+    const privateKey = usage === 'decrypt' || usage === 'sign';
+    if (secret && key instanceof Uint8Array)
+        return [BYTES, key];
     if (jwk.isJWK(key)) {
-        switch (usage) {
-            case 'decrypt':
-            case 'sign':
-                if (jwk.isPrivateJWK(key) && jwkMatchesOp(entry, key, usage))
-                    return { kind: JWK, key };
-                throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
-            case 'encrypt':
-            case 'verify':
-                if (jwk.isPublicJWK(key) && jwkMatchesOp(entry, key, usage))
-                    return { kind: JWK, key };
-                throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
+        if (secret ? !jwk.isSecretJWK(key) : !(privateKey ? jwk.isPrivateJWK(key) : jwk.isPublicJWK(key))) {
+            throw new TypeError(secret
+                ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`
+                : `JSON Web Key for this operation must be a ${privateKey ? 'private' : 'public'} JWK`);
         }
+        jwkMatchesOp(entry, key, usage);
+        return [JWK, key];
     }
     if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
-    }
-    if (key.type === 'secret') {
-        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+        throw new TypeError(secret
+            ? invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array')
+            : invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
     }
-    if (key.type === 'public') {
-        switch (usage) {
-            case 'sign':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
-            case 'decrypt':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
+    if (secret) {
+        if (key.type !== 'secret') {
+            throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
         }
     }
-    if (key.type === 'private') {
-        switch (usage) {
-            case 'verify':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
-            case 'encrypt':
-                throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+    else {
+        if (key.type === 'secret') {
+            throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+        }
+        const expectedType = privateKey ? 'private' : 'public';
+        if ((key.type === 'public' || key.type === 'private') && key.type !== expectedType) {
+            const operation = usage === 'sign'
+                ? 'signing'
+                : usage === 'verify'
+                    ? 'verifying'
+                    : `${usage.slice(0, -1)}tion`;
+            throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`);
         }
     }
-    return isCryptoKey(key) ? { kind: CRYPTO, key } : { kind: KEYOBJECT, key };
-};
-const BYTES = Symbol();
-const CRYPTO = Symbol();
-const KEYOBJECT = Symbol();
-const JWK = Symbol();
-export function checkKeyType(entry, key, usage) {
-    return entry.symmetric
-        ? symmetricTypeCheck(entry, key, usage)
-        : asymmetricTypeCheck(entry, key, usage);
+    return isCryptoKey(key) ? [CRYPTO, key] : [KEYOBJECT, key];
 }
+const BYTES = 0;
+const CRYPTO = 1;
+const KEYOBJECT = 2;
+const JWK = 3;
 let cache;
 const nist = {
     __proto__: null,
@@ -106,58 +73,53 @@ const nist = {
     secp384r1: 'P-384',
     secp521r1: 'P-521',
 };
-function cached(key, alg) {
+function cached(key, alg, value) {
     cache ||= new WeakMap();
-    return cache.get(key)?.[alg];
-}
-function store(key, alg, cryptoKey) {
     const entry = cache.get(key);
-    if (entry) {
-        entry[alg] = cryptoKey;
-    }
-    else {
-        cache.set(key, { [alg]: cryptoKey });
+    if (value) {
+        if (entry) {
+            entry[alg] = value;
+        }
+        else {
+            cache.set(key, { __proto__: null, [alg]: value });
+        }
     }
-    return cryptoKey;
+    return value ?? entry?.[alg];
 }
-const handleJWK = async (key, jwk, entry) => {
-    const hit = cached(key, entry.alg);
-    if (hit)
-        return hit;
-    const cryptoKey = await jwkToKey(entry, { ...jwk, alg: entry.alg });
-    return store(key, entry.alg, cryptoKey);
-};
+const handleJWK = async (key, jwk, entry) => cached(key, entry.alg) ??
+    cached(key, entry.alg, await jwkToKey(entry, { ...jwk, alg: entry.alg }));
 const handleKeyObject = (keyObject, entry) => {
     const hit = cached(keyObject, entry.alg);
     if (hit)
         return hit;
     const isPublic = keyObject.type === 'public';
-    const usages = isPublic ? entry.usages.public : entry.usages.private;
+    const usages = entry.usages[isPublic ? 0 : 1];
     const { asymmetricKeyType } = keyObject;
     const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
-    const params = entry.subtleFor?.({ crv, asymmetricKeyType }) ?? entry.subtle;
-    return store(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
+    const params = entry.resolve?.({ crv, asymmetricKeyType }) ?? entry.subtle;
+    return cached(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
 };
 export async function prepareKey(entry, key, usage) {
     const tagged = checkKeyType(entry, key, usage);
-    switch (tagged.kind) {
+    switch (tagged[0]) {
         case BYTES:
         case CRYPTO:
-            return tagged.key;
+            return tagged[1];
         case JWK: {
-            if (tagged.key.k) {
-                return decode(tagged.key.k);
+            const key = tagged[1];
+            if (key.k) {
+                return decode(key.k);
             }
-            if (!Object.isFrozen(tagged.key)) {
-                const { key_ops } = tagged.key;
+            if (!Object.isFrozen(key)) {
+                const { key_ops } = key;
                 if (Array.isArray(key_ops))
                     Object.freeze(key_ops);
-                Object.freeze(tagged.key);
+                Object.freeze(key);
             }
-            return handleJWK(tagged.key, tagged.key, entry);
+            return handleJWK(key, key, entry);
         }
         case KEYOBJECT: {
-            const keyObject = tagged.key;
+            const keyObject = tagged[1];
             if (keyObject.type === 'secret') {
                 return keyObject.export();
             }

package/dist/webapi/lib/key_algorithm.js

@@ -1,16 +1,10 @@
 import { JOSENotSupported } from '../util/errors.js';
-import { maybeJWSAlgorithm } from './jws_algorithms.js';
-import { maybeJWEAlgorithm } from './jwe_algorithms.js';
-function unsupportedAlgorithm() {
-    return new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+import { JWS } from './jws_algorithms.js';
+import { JWE } from './jwe_algorithms.js';
+export const algArgument = '"alg" (Algorithm)';
+export function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+    throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
 }
-export function keyAlgorithm(alg) {
-    if (typeof alg !== 'string') {
-        throw unsupportedAlgorithm();
-    }
-    const entry = maybeJWSAlgorithm(alg) ?? maybeJWEAlgorithm(alg);
-    if (!entry) {
-        throw unsupportedAlgorithm();
-    }
-    return entry;
+export function keyAlgorithm(alg, source) {
+    return (typeof alg === 'string' ? (JWS[alg] ?? JWE[alg]) : undefined) ?? unsupportedAlg(source);
 }

package/dist/webapi/lib/key_descriptor.js

@@ -1,6 +1,6 @@
 export function table(entries) {
     const out = { __proto__: null };
-    for (const alg of Object.keys(entries)) {
+    for (const alg in entries) {
         out[alg] = { ...entries[alg], alg };
     }
     return out;