jose 6.2.9 → 6.2.11

package/dist/webapi/jwks/remote.js

@@ -1,170 +1,101 @@
-import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
-import { createLocalJWKSet } from './local.js';
-import { isObject } from '../lib/type_checks.js';
+import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from "../util/errors.js";
+import { createLocalJWKSet } from "./local.js";
+import { isJwkSet } from "../lib/type_checks.js";
 function isCloudflareWorkers() {
-    return (typeof WebSocketPair !== 'undefined' ||
-        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
-        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 let USER_AGENT;
-if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
-    const NAME = 'jose';
-    const VERSION = 'v6.2.9';
-    USER_AGENT = `${NAME}/${VERSION}`;
-}
-export const customFetch = Symbol();
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.11");
+const customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
-    const response = await fetchImpl(url, {
-        method: 'GET',
-        signal,
-        redirect: 'manual',
-        headers,
-    }).catch((err) => {
-        if (err.name === 'TimeoutError') {
-            throw new JWKSTimeout();
-        }
-        throw err;
-    });
-    if (response.status !== 200) {
-        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
-    }
-    try {
-        return await response.json();
-    }
-    catch {
-        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
-    }
+  const response = await fetchImpl(url, {
+    method: "GET",
+    signal,
+    redirect: "manual",
+    headers
+  }).catch((err) => {
+    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
+  });
+  if (response.status !== 200)
+    throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
+  try {
+    return await response.json();
+  } catch {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  }
 }
-export const jwksCache = Symbol();
-function isFreshJwksCache(input, cacheMaxAge) {
-    if (typeof input !== 'object' || input === null) {
-        return false;
-    }
-    if (!('uat' in input) || typeof input.uat !== 'number' || Date.now() - input.uat >= cacheMaxAge) {
-        return false;
-    }
-    if (!('jwks' in input) ||
-        !isObject(input.jwks) ||
-        !Array.isArray(input.jwks.keys) ||
-        !Array.prototype.every.call(input.jwks.keys, isObject)) {
-        return false;
-    }
-    return true;
+const jwksCache = /* @__PURE__ */ Symbol();
+function isFreshFor(timestamp, duration) {
+  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
 }
-class RemoteJWKSetImpl {
-    #url;
-    #timeoutDuration;
-    #cooldownDuration;
-    #cacheMaxAge;
-    #jwksTimestamp;
-    #pendingFetch;
-    #headers;
-    #customFetch;
-    #local;
-    #cache;
-    constructor(url, options) {
-        if (!(url instanceof URL)) {
-            throw new TypeError('url must be an instance of URL');
-        }
-        this.#url = new URL(url.href);
-        const opts = options ?? {};
-        this.#timeoutDuration = typeof opts.timeoutDuration === 'number' ? opts.timeoutDuration : 5000;
-        this.#cooldownDuration =
-            typeof opts.cooldownDuration === 'number' ? opts.cooldownDuration : 30000;
-        this.#cacheMaxAge = typeof opts.cacheMaxAge === 'number' ? opts.cacheMaxAge : 600000;
-        this.#headers = new Headers(opts.headers);
-        if (USER_AGENT && !this.#headers.has('User-Agent')) {
-            this.#headers.set('User-Agent', USER_AGENT);
-        }
-        if (!this.#headers.has('accept')) {
-            this.#headers.set('accept', 'application/json');
-            this.#headers.append('accept', 'application/jwk-set+json');
-        }
-        this.#customFetch = opts[customFetch];
-        const cache = opts[jwksCache];
-        if (cache !== undefined) {
-            this.#cache = cache;
-            if (isFreshJwksCache(cache, this.#cacheMaxAge)) {
-                this.#jwksTimestamp = this.#cache.uat;
-                this.#local = createLocalJWKSet(this.#cache.jwks);
-            }
-        }
-    }
-    pendingFetch() {
-        return !!this.#pendingFetch;
-    }
-    #validFor(duration) {
-        return typeof this.#jwksTimestamp === 'number' && Date.now() < this.#jwksTimestamp + duration;
-    }
-    coolingDown() {
-        return this.#validFor(this.#cooldownDuration);
-    }
-    fresh() {
-        return this.#validFor(this.#cacheMaxAge);
-    }
-    jwks() {
-        return this.#local?.jwks();
+function validateDuration(value, fallback, option) {
+  if (Number.isNaN(value))
+    throw new TypeError(`"${option}" option must not be NaN`);
+  return typeof value == "number" ? value : fallback;
+}
+function createRemoteJWKSet(url, options) {
+  if (!(url instanceof URL))
+    throw new TypeError("url must be an instance of URL");
+  const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+  USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+  const fetchImpl = opts[customFetch], cache = opts[jwksCache];
+  let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+  if (cache && typeof cache == "object") {
+    const { uat, jwks } = cache;
+    isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+      const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+        const next = createLocalJWKSet(json);
+        if (sequence <= appliedSequence)
+          return;
+        local = next;
+        const updatedAt = Date.now();
+        cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
+      }).finally(() => {
+        pendingFetch === current && (pendingFetch = void 0);
+      });
     }
-    async getKey(protectedHeader, token) {
-        if (!this.#local || !this.fresh()) {
-            await this.reload();
-        }
-        try {
-            return await this.#local(protectedHeader, token);
-        }
-        catch (err) {
-            if (err instanceof JWKSNoMatchingKey) {
-                if (this.coolingDown() === false) {
-                    await this.reload();
-                    return this.#local(protectedHeader, token);
-                }
-            }
-            throw err;
-        }
+    await pendingFetch;
+  };
+  return Object.defineProperties(async (protectedHeader, token) => {
+    (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
+    try {
+      return await local(protectedHeader, token);
+    } catch (err) {
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+        return await reload(), local(protectedHeader, token);
+      throw err;
     }
-    async reload() {
-        if (this.#pendingFetch && isCloudflareWorkers()) {
-            this.#pendingFetch = undefined;
-        }
-        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)
-            .then((json) => {
-            this.#local = createLocalJWKSet(json);
-            if (this.#cache) {
-                this.#cache.uat = Date.now();
-                this.#cache.jwks = json;
-            }
-            this.#jwksTimestamp = Date.now();
-        })
-            .finally(() => {
-            this.#pendingFetch = undefined;
-        });
-        await this.#pendingFetch;
+  }, {
+    coolingDown: {
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+      enumerable: !0
+    },
+    fresh: {
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+      enumerable: !0
+    },
+    reload: {
+      value: reload,
+      enumerable: !0
+    },
+    reloading: {
+      get: () => !!pendingFetch,
+      enumerable: !0
+    },
+    jwks: {
+      value: () => local?.jwks(),
+      enumerable: !0
     }
+  });
 }
-export function createRemoteJWKSet(url, options) {
-    const set = new RemoteJWKSetImpl(url, options);
-    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperties(remoteJWKSet, {
-        coolingDown: {
-            get: () => set.coolingDown(),
-            enumerable: true,
-        },
-        fresh: {
-            get: () => set.fresh(),
-            enumerable: true,
-        },
-        reload: {
-            value: () => set.reload(),
-            enumerable: true,
-        },
-        reloading: {
-            get: () => set.pendingFetch(),
-            enumerable: true,
-        },
-        jwks: {
-            value: () => set.jwks(),
-            enumerable: true,
-        },
-    });
-    return remoteJWKSet;
-}
+export {
+  createRemoteJWKSet,
+  customFetch,
+  jwksCache
+};

package/dist/webapi/jws/compact/sign.js

@@ -1,21 +1,22 @@
-import { FlattenedSign } from '../flattened/sign.js';
-import { unencodedPayload } from '../../lib/jws_sign.js';
-export class CompactSign {
-    #flattened;
-    #protectedHeader;
-    constructor(payload) {
-        this.#flattened = new FlattenedSign(payload);
-    }
-    setProtectedHeader(protectedHeader) {
-        this.#flattened.setProtectedHeader(protectedHeader);
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    async sign(key, options) {
-        if (unencodedPayload(this.#protectedHeader)) {
-            throw new TypeError('use the flattened module for creating JWS with b64: false');
-        }
-        const jws = await this.#flattened.sign(key, options);
-        return `${jws.protected}.${jws.payload}.${jws.signature}`;
-    }
+import { createCompactSignature } from "../../lib/jws_sign.js";
+import { assertNotSet } from "../../lib/helpers.js";
+class CompactSign {
+  #payload;
+  #protectedHeader;
+  constructor(payload) {
+    if (!(payload instanceof Uint8Array))
+      throw new TypeError("payload must be an instance of Uint8Array");
+    this.#payload = payload;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(this.#payload, this.#protectedHeader, options?.crit, key, () => {
+      throw new TypeError("use the flattened module for creating JWS with b64: false");
+    });
+  }
 }
+export {
+  CompactSign
+};

package/dist/webapi/jws/compact/verify.js

@@ -1,9 +1,8 @@
-import { prepareVerify, verifyCompact } from '../../lib/jws_verify.js';
-export async function compactVerify(jws, key, options) {
-    const verified = await verifyCompact(jws, prepareVerify(options), key);
-    const result = { payload: verified[0], protectedHeader: verified[1] };
-    if (typeof key === 'function') {
-        return { ...result, key: verified[3] };
-    }
-    return result;
+import { prepareVerify, verifyCompact } from "../../lib/jws_verify.js";
+async function compactVerify(jws, key, options) {
+  const verified = await verifyCompact(jws, prepareVerify(options), key), result = { payload: verified[0], protectedHeader: verified[1] };
+  return typeof key == "function" ? { ...result, key: verified[3] } : result;
 }
+export {
+  compactVerify
+};

package/dist/webapi/jws/flattened/sign.js

@@ -1,31 +1,30 @@
-import { createSignature } from '../../lib/jws_sign.js';
-import { assertNotSet } from '../../lib/helpers.js';
-export class FlattenedSign {
-    #payload;
-    #protectedHeader;
-    #unprotectedHeader;
-    constructor(payload) {
-        if (!(payload instanceof Uint8Array)) {
-            throw new TypeError('payload must be an instance of Uint8Array');
-        }
-        this.#payload = payload;
-    }
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
-        this.#unprotectedHeader = unprotectedHeader;
-        return this;
-    }
-    async sign(key, options) {
-        return createSignature({
-            payload: this.#payload,
-            protectedHeader: this.#protectedHeader,
-            unprotectedHeader: this.#unprotectedHeader,
-            crit: options?.crit,
-        }, key);
-    }
+import { createSignature } from "../../lib/jws_sign.js";
+import { assertNotSet } from "../../lib/helpers.js";
+class FlattenedSign {
+  #payload;
+  #protectedHeader;
+  #unprotectedHeader;
+  constructor(payload) {
+    if (!(payload instanceof Uint8Array))
+      throw new TypeError("payload must be an instance of Uint8Array");
+    this.#payload = payload;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader"), this.#unprotectedHeader = unprotectedHeader, this;
+  }
+  async sign(key, options) {
+    const [jws] = await createSignature({
+      payload: this.#payload,
+      protectedHeader: this.#protectedHeader,
+      unprotectedHeader: this.#unprotectedHeader,
+      crit: options?.crit
+    }, key);
+    return jws;
+  }
 }
+export {
+  FlattenedSign
+};

package/dist/webapi/jws/flattened/verify.js

@@ -1,24 +1,22 @@
-import { JWSInvalid } from '../../util/errors.js';
-import { isObject } from '../../lib/type_checks.js';
-import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
-export async function flattenedVerify(jws, key, options) {
-    if (!isObject(jws)) {
-        throw new JWSInvalid('Flattened JWS must be an object');
-    }
-    if (jws.protected === undefined && jws.header === undefined) {
-        throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
-    }
-    if (jws.protected !== undefined && typeof jws.protected !== 'string') {
-        throw new JWSInvalid('JWS Protected Header incorrect type');
-    }
-    if (jws.payload === undefined) {
-        throw new JWSInvalid('JWS Payload missing');
-    }
-    if (typeof jws.signature !== 'string') {
-        throw new JWSInvalid('JWS Signature missing or incorrect type');
-    }
-    if (jws.header !== undefined && !isObject(jws.header)) {
-        throw new JWSInvalid('JWS Unprotected Header incorrect type');
-    }
-    return verifyResult(jws, await verifySignature(jws, prepareVerify(options), key));
+import { JWSInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/type_checks.js";
+import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature, verifyResult } from "../../lib/jws_verify.js";
+async function flattenedVerify(jws, key, options) {
+  if (!isObject(jws))
+    throw new JWSInvalid("Flattened JWS must be an object");
+  const snapshot = snapshotJws(jws);
+  if (snapshot.protected === void 0 && snapshot.header === void 0)
+    throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
+  if (snapshot.protected !== void 0 && typeof snapshot.protected != "string")
+    throw new JWSInvalid("JWS Protected Header incorrect type");
+  if (snapshot.payload === void 0)
+    throw new JWSInvalid("JWS Payload missing");
+  if (typeof snapshot.signature != "string")
+    throw new JWSInvalid("JWS Signature missing or incorrect type");
+  if (snapshot.header !== void 0 && !isObject(snapshot.header))
+    throw new JWSInvalid("JWS Unprotected Header incorrect type");
+  return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
 }
+export {
+  flattenedVerify
+};

package/dist/webapi/jws/general/sign.js

@@ -1,74 +1,65 @@
-import { createSignature } from '../../lib/jws_sign.js';
-import { JWSInvalid } from '../../util/errors.js';
-import { assertNotSet } from '../../lib/helpers.js';
+import { createSignature } from "../../lib/jws_sign.js";
+import { JWSInvalid } from "../../util/errors.js";
+import { assertNotSet } from "../../lib/helpers.js";
 class IndividualSignature {
-    #parent;
-    state;
-    constructor(sig, key, options) {
-        this.#parent = sig;
-        this.state = [undefined, undefined, key, options?.crit];
-    }
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.state[0], 'setProtectedHeader');
-        this.state[0] = protectedHeader;
-        return this;
-    }
-    setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.state[1], 'setUnprotectedHeader');
-        this.state[1] = unprotectedHeader;
-        return this;
-    }
-    addSignature(...args) {
-        return this.#parent.addSignature(...args);
-    }
-    sign(...args) {
-        return this.#parent.sign(...args);
-    }
-    done() {
-        return this.#parent;
-    }
+  #parent;
+  state;
+  constructor(sig, key, options) {
+    this.#parent = sig, this.state = [void 0, void 0, key, options?.crit];
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.state[0], "setProtectedHeader"), this.state[0] = protectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.state[1], "setUnprotectedHeader"), this.state[1] = unprotectedHeader, this;
+  }
+  addSignature(...args) {
+    return this.#parent.addSignature(...args);
+  }
+  sign(...args) {
+    return this.#parent.sign(...args);
+  }
+  done() {
+    return this.#parent;
+  }
 }
-export class GeneralSign {
-    #payload;
-    #signatures = [];
-    constructor(payload) {
-        this.#payload = payload;
-    }
-    addSignature(key, options) {
-        const signature = new IndividualSignature(this, key, options);
-        this.#signatures.push(signature);
-        return signature;
-    }
-    async sign() {
-        if (!this.#signatures.length) {
-            throw new JWSInvalid('at least one signature must be added');
-        }
-        if (!(this.#payload instanceof Uint8Array)) {
-            throw new TypeError('payload must be an instance of Uint8Array');
-        }
-        const jws = {
-            signatures: [],
-            payload: '',
-        };
-        const encoded = [];
-        for (let i = 0; i < this.#signatures.length; i++) {
-            const signature = this.#signatures[i];
-            const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
-            const { payload, ...rest } = await createSignature({
-                payload: this.#payload,
-                protectedHeader,
-                unprotectedHeader,
-                crit,
-                encoded,
-            }, key);
-            if (i === 0) {
-                jws.payload = payload;
-            }
-            else if (jws.payload !== payload) {
-                throw new JWSInvalid('inconsistent use of JWS Unencoded Payload (RFC7797)');
-            }
-            jws.signatures.push(rest);
-        }
-        return jws;
+class GeneralSign {
+  #payload;
+  #signatures = [];
+  constructor(payload) {
+    this.#payload = payload;
+  }
+  addSignature(key, options) {
+    const signature = new IndividualSignature(this, key, options);
+    return this.#signatures.push(signature), signature;
+  }
+  async sign() {
+    if (!this.#signatures.length)
+      throw new JWSInvalid("at least one signature must be added");
+    if (!(this.#payload instanceof Uint8Array))
+      throw new TypeError("payload must be an instance of Uint8Array");
+    const jws = {
+      signatures: [],
+      payload: ""
+    }, encoded = [];
+    let b64;
+    for (let i = 0; i < this.#signatures.length; i++) {
+      const signature = this.#signatures[i], [protectedHeader, unprotectedHeader, key, crit] = signature.state, [{ payload, ...rest }, signatureB64] = await createSignature({
+        payload: this.#payload,
+        protectedHeader,
+        unprotectedHeader,
+        crit,
+        encoded
+      }, key);
+      if (b64 === void 0)
+        b64 = signatureB64, jws.payload = payload;
+      else if (b64 !== signatureB64)
+        throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
+      jws.signatures.push(rest);
     }
+    return jws;
+  }
 }
+export {
+  GeneralSign
+};