jose 6.2.7 → 6.2.9

package/dist/types/jwe/compact/encrypt.d.ts

@@ -35,9 +35,10 @@ export declare class CompactEncrypt {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -9,9 +9,10 @@ export declare class FlattenedEncrypt {
      */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwe/general/encrypt.d.ts

@@ -8,9 +8,10 @@ export interface Recipient {
      */
     setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): Recipient;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwt/encrypt.d.ts

@@ -23,9 +23,10 @@ export declare class EncryptJWT implements types.ProduceJWT {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
+     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
+     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
+     * appropriate JOSE Header.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/types.d.ts

@@ -417,11 +417,13 @@ export interface JWEKeyManagementHeaderParameters {
    * used in ECDH's ConcatKDF.
    */
   apv?: Uint8Array
+
   /**
-   * @deprecated You should not use this parameter. It is only intended for testing and vector
-   *   validation purposes.
+   * PBES2 "p2c" (PBES2 Count). This will be used as a JOSE Header Parameter and as the PBKDF2
+   * iteration count.
    */
   p2c?: number
+
   /**
    * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.

package/dist/webapi/jwe/general/decrypt.js

@@ -21,6 +21,14 @@ export async function generalDecrypt(jwe, key, options) {
     catch {
         throw new JWEDecryptionFailed();
     }
+    if (jwe.recipients.length > 1) {
+        for (const { header } of jwe.recipients) {
+            const alg = token[0]?.alg ?? header?.alg ?? jwe.unprotected?.alg;
+            if (alg === 'dir' || alg === 'ECDH-ES') {
+                throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+            }
+        }
+    }
     for (const recipient of jwe.recipients) {
         try {
             const flattened = {

package/dist/webapi/jwe/general/encrypt.js

@@ -5,7 +5,7 @@ import { generateCek } from '../../lib/content_encryption.js';
 import { encryptKeyManagement } from '../../lib/key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
 import { validateCritDuplicates } from '../../lib/options.js';
-import { checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
+import { checkDisjoint, checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
 import { prepareKey } from '../../lib/key.js';
 import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
 class IndividualRecipient {
@@ -125,7 +125,7 @@ export class GeneralEncrypt {
             inputs.push(input);
             checked.push(headers);
             if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
-                throw new JWEInvalid('"dir" and "ECDH-ES" alg may only be used with a single recipient');
+                throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
             }
             if (!enc) {
                 enc = headers[2];
@@ -158,8 +158,12 @@ export class GeneralEncrypt {
             const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
             const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
             target.encrypted_key = b64u(encryptedKey);
-            if (unprotectedHeader || parameters)
-                target.header = { ...unprotectedHeader, ...parameters };
+            if (unprotectedHeader || parameters) {
+                const header = { ...unprotectedHeader, ...parameters };
+                if (parameters)
+                    checkDisjoint(this.#protectedHeader, header, this.#unprotectedHeader);
+                target.header = header;
+            }
         }
         return jwe;
     }

package/dist/webapi/jwks/local.js

@@ -1,9 +1,9 @@
 import { jwkToKey } from '../lib/jwk_to_key.js';
-import { maybeJWSAlgorithm } from '../lib/jws_algorithms.js';
+import { JWS } from '../lib/jws_algorithms.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
 import { isObject } from '../lib/type_checks.js';
 function signatureAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? maybeJWSAlgorithm(alg) : undefined;
+    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
     if (!entry || entry.secret) {
         throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
     }
@@ -58,7 +58,7 @@ class LocalJWKSetImpl {
     }
 }
 async function importWithAlgCache(cache, jwk, entry) {
-    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    const cached = cache.get(jwk) || cache.set(jwk, { __proto__: null }).get(jwk);
     if (cached[entry.alg] === undefined) {
         const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
         if (key.type !== 'public') {

package/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.7';
+    const VERSION = 'v6.2.9';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/key/generate_key_pair.js

@@ -1,5 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
-import { keyAlgorithm } from '../lib/key_algorithm.js';
+import { keyAlgorithm, unsupportedAlg, algArgument } from '../lib/key_algorithm.js';
 function getModulusLengthOption(options) {
     const modulusLength = options?.modulusLength ?? 2048;
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
@@ -8,9 +8,9 @@ function getModulusLengthOption(options) {
     return modulusLength;
 }
 export async function generateKeyPair(alg, options) {
-    const entry = keyAlgorithm(alg);
+    const entry = keyAlgorithm(alg, algArgument);
     if (entry.secret) {
-        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+        unsupportedAlg(algArgument);
     }
     let algorithm;
     if (entry.resolve) {

package/dist/webapi/key/generate_secret.js

@@ -1,4 +1,4 @@
-import { JOSENotSupported } from '../util/errors.js';
+import { unsupportedAlg, algArgument } from '../lib/key_algorithm.js';
 export async function generateSecret(alg, options) {
     let length;
     let algorithm;
@@ -34,7 +34,7 @@ export async function generateSecret(alg, options) {
             keyUsages = ['encrypt', 'decrypt'];
             break;
         default:
-            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            unsupportedAlg(algArgument);
     }
     return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
 }

package/dist/webapi/lib/asn1.js

@@ -1,7 +1,7 @@
 import { invalidKeyInput } from './invalid_key_input.js';
 import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 import { JOSENotSupported } from '../util/errors.js';
-import { keyAlgorithm } from './key_algorithm.js';
+import { keyAlgorithm, unsupportedAlg, algArgument } from './key_algorithm.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 const formatPEM = (b64, descriptor) => {
     const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
@@ -112,9 +112,9 @@ const parseECAlgorithmIdentifier = (state) => {
     throw new Error('Unsupported named curve');
 };
 const genericImport = async (keyFormat, keyData, alg, options) => {
-    const entry = keyAlgorithm(alg);
+    const entry = keyAlgorithm(alg, algArgument);
     if (entry.secret) {
-        throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
+        unsupportedAlg(algArgument);
     }
     const isPublic = keyFormat === 'spki';
     let algorithm;

package/dist/webapi/lib/jwe_algorithms.js

@@ -49,7 +49,7 @@ function pbes2() {
         ops: ['deriveBits', 'deriveBits'],
     };
 }
-const JWE = table({
+export const JWE = table({
     dir: {
         kty: ['oct'],
         secret: true,
@@ -96,21 +96,12 @@ const ENC = table({
     'A192CBC-HS384': contentEncryption(384, true),
     'A256CBC-HS512': contentEncryption(512, true),
 });
-const unsupportedAlg = 'Invalid or unsupported "alg" (JWE Algorithm) header value';
-export function jweAlgorithm(alg) {
-    const entry = JWE[alg];
-    if (!entry) {
-        throw new JOSENotSupported(unsupportedAlg);
-    }
-    return entry;
+function unsupported(parameter, name) {
+    throw new JOSENotSupported(`Invalid or unsupported "${parameter}" (JWE ${name}) header value`);
 }
-export function maybeJWEAlgorithm(alg) {
-    return JWE[alg];
+export function jweAlgorithm(alg) {
+    return (typeof alg === 'string' ? JWE[alg] : undefined) ?? unsupported('alg', 'Algorithm');
 }
 export function jweEncryption(enc) {
-    const entry = ENC[enc];
-    if (!entry) {
-        throw new JOSENotSupported(`Unsupported JWE Algorithm: ${enc}`);
-    }
-    return entry;
+    return ((typeof enc === 'string' ? ENC[enc] : undefined) ?? unsupported('enc', 'Encryption Algorithm'));
 }

package/dist/webapi/lib/jwe_encrypt.js

@@ -8,11 +8,14 @@ import { validateCrit, JWE_RECOGNIZED } from './options.js';
 import { prepareKey } from './key.js';
 import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { compress } from './deflate.js';
-export function checkEncryptHeaders(input) {
-    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+export function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
     if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
         throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
     }
+}
+export function checkEncryptHeaders(input) {
+    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+    checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     const joseHeader = {
         ...protectedHeader,
         ...unprotectedHeader,
@@ -52,6 +55,7 @@ export async function encryptJWE(input, checked, key) {
         else {
             protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
         }
+        checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     }
     let protectedHeaderS;
     let protectedHeaderB;

package/dist/webapi/lib/jws_algorithms.js

@@ -45,7 +45,7 @@ function mldsa(bits) {
         usages: sig,
     };
 }
-const JWS = table({
+export const JWS = table({
     HS256: hmac(256),
     HS384: hmac(384),
     HS512: hmac(512),
@@ -65,12 +65,9 @@ const JWS = table({
     'ML-DSA-87': mldsa(87),
 });
 export function jwsAlgorithm(alg) {
-    const entry = JWS[alg];
+    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
     if (!entry) {
         throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }
     return entry;
 }
-export function maybeJWSAlgorithm(alg) {
-    return JWS[alg];
-}

package/dist/webapi/lib/key.js

@@ -81,7 +81,7 @@ function cached(key, alg, value) {
             entry[alg] = value;
         }
         else {
-            cache.set(key, { [alg]: value });
+            cache.set(key, { __proto__: null, [alg]: value });
         }
     }
     return value ?? entry?.[alg];

package/dist/webapi/lib/key_algorithm.js

@@ -1,10 +1,10 @@
 import { JOSENotSupported } from '../util/errors.js';
-import { maybeJWSAlgorithm } from './jws_algorithms.js';
-import { maybeJWEAlgorithm } from './jwe_algorithms.js';
-export function keyAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? (maybeJWSAlgorithm(alg) ?? maybeJWEAlgorithm(alg)) : undefined;
-    if (!entry) {
-        throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-    }
-    return entry;
+import { JWS } from './jws_algorithms.js';
+import { JWE } from './jwe_algorithms.js';
+export const algArgument = '"alg" (Algorithm)';
+export function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+    throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+}
+export function keyAlgorithm(alg, source) {
+    return (typeof alg === 'string' ? (JWS[alg] ?? JWE[alg]) : undefined) ?? unsupportedAlg(source);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.7",
+  "version": "6.2.9",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",