jose 6.2.7 → 6.2.8

package/dist/webapi/jwe/general/decrypt.js

@@ -21,6 +21,14 @@ export async function generalDecrypt(jwe, key, options) {
     catch {
         throw new JWEDecryptionFailed();
     }
+    if (jwe.recipients.length > 1) {
+        for (const { header } of jwe.recipients) {
+            const alg = token[0]?.alg ?? header?.alg ?? jwe.unprotected?.alg;
+            if (alg === 'dir' || alg === 'ECDH-ES') {
+                throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+            }
+        }
+    }
     for (const recipient of jwe.recipients) {
         try {
             const flattened = {

package/dist/webapi/jwe/general/encrypt.js

@@ -125,7 +125,7 @@ export class GeneralEncrypt {
             inputs.push(input);
             checked.push(headers);
             if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
-                throw new JWEInvalid('"dir" and "ECDH-ES" alg may only be used with a single recipient');
+                throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
             }
             if (!enc) {
                 enc = headers[2];

package/dist/webapi/jwks/local.js

@@ -1,9 +1,9 @@
 import { jwkToKey } from '../lib/jwk_to_key.js';
-import { maybeJWSAlgorithm } from '../lib/jws_algorithms.js';
+import { JWS } from '../lib/jws_algorithms.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
 import { isObject } from '../lib/type_checks.js';
 function signatureAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? maybeJWSAlgorithm(alg) : undefined;
+    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
     if (!entry || entry.secret) {
         throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
     }
@@ -58,7 +58,7 @@ class LocalJWKSetImpl {
     }
 }
 async function importWithAlgCache(cache, jwk, entry) {
-    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    const cached = cache.get(jwk) || cache.set(jwk, { __proto__: null }).get(jwk);
     if (cached[entry.alg] === undefined) {
         const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
         if (key.type !== 'public') {

package/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.7';
+    const VERSION = 'v6.2.8';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/key/generate_key_pair.js

@@ -1,5 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
-import { keyAlgorithm } from '../lib/key_algorithm.js';
+import { keyAlgorithm, unsupportedAlg, algArgument } from '../lib/key_algorithm.js';
 function getModulusLengthOption(options) {
     const modulusLength = options?.modulusLength ?? 2048;
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
@@ -8,9 +8,9 @@ function getModulusLengthOption(options) {
     return modulusLength;
 }
 export async function generateKeyPair(alg, options) {
-    const entry = keyAlgorithm(alg);
+    const entry = keyAlgorithm(alg, algArgument);
     if (entry.secret) {
-        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+        unsupportedAlg(algArgument);
     }
     let algorithm;
     if (entry.resolve) {

package/dist/webapi/key/generate_secret.js

@@ -1,4 +1,4 @@
-import { JOSENotSupported } from '../util/errors.js';
+import { unsupportedAlg, algArgument } from '../lib/key_algorithm.js';
 export async function generateSecret(alg, options) {
     let length;
     let algorithm;
@@ -34,7 +34,7 @@ export async function generateSecret(alg, options) {
             keyUsages = ['encrypt', 'decrypt'];
             break;
         default:
-            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            unsupportedAlg(algArgument);
     }
     return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
 }

package/dist/webapi/lib/asn1.js

@@ -1,7 +1,7 @@
 import { invalidKeyInput } from './invalid_key_input.js';
 import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 import { JOSENotSupported } from '../util/errors.js';
-import { keyAlgorithm } from './key_algorithm.js';
+import { keyAlgorithm, unsupportedAlg, algArgument } from './key_algorithm.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 const formatPEM = (b64, descriptor) => {
     const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
@@ -112,9 +112,9 @@ const parseECAlgorithmIdentifier = (state) => {
     throw new Error('Unsupported named curve');
 };
 const genericImport = async (keyFormat, keyData, alg, options) => {
-    const entry = keyAlgorithm(alg);
+    const entry = keyAlgorithm(alg, algArgument);
     if (entry.secret) {
-        throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
+        unsupportedAlg(algArgument);
     }
     const isPublic = keyFormat === 'spki';
     let algorithm;

package/dist/webapi/lib/jwe_algorithms.js

@@ -49,7 +49,7 @@ function pbes2() {
         ops: ['deriveBits', 'deriveBits'],
     };
 }
-const JWE = table({
+export const JWE = table({
     dir: {
         kty: ['oct'],
         secret: true,
@@ -96,21 +96,12 @@ const ENC = table({
     'A192CBC-HS384': contentEncryption(384, true),
     'A256CBC-HS512': contentEncryption(512, true),
 });
-const unsupportedAlg = 'Invalid or unsupported "alg" (JWE Algorithm) header value';
-export function jweAlgorithm(alg) {
-    const entry = JWE[alg];
-    if (!entry) {
-        throw new JOSENotSupported(unsupportedAlg);
-    }
-    return entry;
+function unsupported(parameter, name) {
+    throw new JOSENotSupported(`Invalid or unsupported "${parameter}" (JWE ${name}) header value`);
 }
-export function maybeJWEAlgorithm(alg) {
-    return JWE[alg];
+export function jweAlgorithm(alg) {
+    return (typeof alg === 'string' ? JWE[alg] : undefined) ?? unsupported('alg', 'Algorithm');
 }
 export function jweEncryption(enc) {
-    const entry = ENC[enc];
-    if (!entry) {
-        throw new JOSENotSupported(`Unsupported JWE Algorithm: ${enc}`);
-    }
-    return entry;
+    return ((typeof enc === 'string' ? ENC[enc] : undefined) ?? unsupported('enc', 'Encryption Algorithm'));
 }

package/dist/webapi/lib/jws_algorithms.js

@@ -45,7 +45,7 @@ function mldsa(bits) {
         usages: sig,
     };
 }
-const JWS = table({
+export const JWS = table({
     HS256: hmac(256),
     HS384: hmac(384),
     HS512: hmac(512),
@@ -65,12 +65,9 @@ const JWS = table({
     'ML-DSA-87': mldsa(87),
 });
 export function jwsAlgorithm(alg) {
-    const entry = JWS[alg];
+    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
     if (!entry) {
         throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }
     return entry;
 }
-export function maybeJWSAlgorithm(alg) {
-    return JWS[alg];
-}

package/dist/webapi/lib/key.js

@@ -81,7 +81,7 @@ function cached(key, alg, value) {
             entry[alg] = value;
         }
         else {
-            cache.set(key, { [alg]: value });
+            cache.set(key, { __proto__: null, [alg]: value });
         }
     }
     return value ?? entry?.[alg];

package/dist/webapi/lib/key_algorithm.js

@@ -1,10 +1,10 @@
 import { JOSENotSupported } from '../util/errors.js';
-import { maybeJWSAlgorithm } from './jws_algorithms.js';
-import { maybeJWEAlgorithm } from './jwe_algorithms.js';
-export function keyAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? (maybeJWSAlgorithm(alg) ?? maybeJWEAlgorithm(alg)) : undefined;
-    if (!entry) {
-        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-    }
-    return entry;
+import { JWS } from './jws_algorithms.js';
+import { JWE } from './jwe_algorithms.js';
+export const algArgument = '"alg" (Algorithm)';
+export function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+    throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+export function keyAlgorithm(alg, source) {
+    return (typeof alg === 'string' ? (JWS[alg] ?? JWE[alg]) : undefined) ?? unsupportedAlg(source);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.7",
+  "version": "6.2.8",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",