oauth4webapi 2.0.5 → 2.1.0

package/README.md

@@ -39,7 +39,7 @@ import * as oauth2 from 'oauth4webapi'
 **`example`** Deno import
 
 ```js
-import * as oauth2 from 'https://deno.land/x/oauth4webapi@v2.0.5/mod.ts'
+import * as oauth2 from 'https://deno.land/x/oauth4webapi@v2.1.0/mod.ts'
 ```
 
 - Authorization Code Flow - OpenID Connect [source](examples/code.ts), or plain OAuth 2 [source](examples/oauth.ts)

package/build/index.d.ts

@@ -45,31 +45,67 @@ export type ClientAuthenticationMethod = 'client_secret_basic' | 'client_secret_
 /**
  * Supported JWS `alg` Algorithm identifiers.
  *
- * @example CryptoKey algorithm for the `PS256` JWS Algorithm Identifier
+ * @example CryptoKey algorithm for the `PS256`, `PS384`, or `PS512` JWS Algorithm Identifiers
  *
  * ```ts
- * interface Ps256Algorithm extends RsaHashedKeyAlgorithm {
+ * interface RSAPSSAlgorithm extends RsaHashedKeyAlgorithm {
  *   name: 'RSA-PSS'
+ *   hash: { name: 'SHA-256' | 'SHA-384' | 'SHA-512' }
+ * }
+ *
+ * interface PS256 extends RSAPSSAlgorithm {
  *   hash: { name: 'SHA-256' }
  * }
+ *
+ * interface PS384 extends RSAPSSAlgorithm {
+ *   hash: { name: 'SHA-384' }
+ * }
+ *
+ * interface PS512 extends RSAPSSAlgorithm {
+ *   hash: { name: 'SHA-512' }
+ * }
  * ```
  *
- * @example CryptoKey algorithm for the `ES256` JWS Algorithm Identifier
+ * @example CryptoKey algorithm for the `ES256`, `ES384`, or `ES512` JWS Algorithm Identifiers
  *
  * ```ts
- * interface Es256Algorithm extends EcKeyAlgorithm {
+ * interface ECDSAAlgorithm extends EcKeyAlgorithm {
  *   name: 'ECDSA'
+ *   namedCurve: 'P-256' | 'P-384' | 'P-521'
+ * }
+ *
+ * interface ES256 extends ECDSAAlgorithm {
  *   namedCurve: 'P-256'
  * }
+ *
+ * interface ES384 extends ECDSAAlgorithm {
+ *   namedCurve: 'P-384'
+ * }
+ *
+ * interface ES512 extends ECDSAAlgorithm {
+ *   namedCurve: 'P-521'
+ * }
  * ```
  *
- * @example CryptoKey algorithm for the `RS256` JWS Algorithm Identifier
+ * @example CryptoKey algorithm for the `RS256`, `RS384`, or `RS512` JWS Algorithm Identifiers
  *
  * ```ts
- * interface Rs256Algorithm extends RsaHashedKeyAlgorithm {
+ * interface ECDSAAlgorithm extends RsaHashedKeyAlgorithm {
  *   name: 'RSASSA-PKCS1-v1_5'
+ *   hash: { name: 'SHA-256' | 'SHA-384' | 'SHA-512' }
+ * }
+ *
+ * interface RS256 extends ECDSAAlgorithm {
  *   hash: { name: 'SHA-256' }
  * }
+ *
+ * interface RS384 extends ECDSAAlgorithm {
+ *   hash: { name: 'SHA-384' }
+ * }
+ *
+ * interface RS512 extends ECDSAAlgorithm {
+ *   hash: { name: 'SHA-512' }
+ * }
  * ```
  *
  * @example CryptoKey algorithm for the `EdDSA` JWS Algorithm Identifier (Experimental)
@@ -79,12 +115,12 @@ export type ClientAuthenticationMethod = 'client_secret_basic' | 'client_secret_
  * widely adopted. If the proposal changes this implementation will follow up with a minor release.
  *
  * ```ts
- * interface EdDSAAlgorithm extends KeyAlgorithm {
- *   name: 'Ed25519'
+ * interface EdDSA extends KeyAlgorithm {
+ *   name: 'Ed25519' | 'Ed448'
  * }
  * ```
  */
-export type JWSAlgorithm = 'PS256' | 'ES256' | 'RS256' | 'EdDSA';
+export type JWSAlgorithm = 'PS256' | 'ES256' | 'RS256' | 'EdDSA' | 'ES384' | 'PS384' | 'RS384' | 'ES512' | 'PS512' | 'RS512';
 /**
  * Authorization Server Metadata
  *
@@ -1082,6 +1118,8 @@ export interface GenerateKeyPairOptions {
     extractable?: boolean;
     /** (RSA algorithms only) The length, in bits, of the RSA modulus. Default is `2048`. */
     modulusLength?: number;
+    /** (EdDSA algorithms only) The EdDSA sub-type. Default is `Ed25519`. */
+    crv?: 'Ed25519' | 'Ed448';
 }
 /**
  * Generates a CryptoKeyPair for a given JWS `alg` Algorithm identifier.

package/build/index.js

@@ -1,7 +1,7 @@
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'oauth4webapi';
-    const VERSION = 'v2.0.4';
+    const VERSION = 'v2.1.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 const encoder = new TextEncoder();
@@ -113,7 +113,18 @@ function isPrivateKey(key) {
 function isPublicKey(key) {
     return isCryptoKey(key) && key.type === 'public';
 }
-const SUPPORTED_JWS_ALGS = ['PS256', 'ES256', 'RS256', 'EdDSA'];
+const SUPPORTED_JWS_ALGS = [
+    'PS256',
+    'ES256',
+    'RS256',
+    'PS384',
+    'ES384',
+    'RS384',
+    'PS512',
+    'ES512',
+    'RS512',
+    'EdDSA',
+];
 function processDpopNonce(response) {
     const url = new URL(response.url);
     if (response.headers.has('dpop-nonce')) {
@@ -263,6 +274,10 @@ function psAlg(key) {
     switch (key.algorithm.hash.name) {
         case 'SHA-256':
             return 'PS256';
+        case 'SHA-384':
+            return 'PS384';
+        case 'SHA-512':
+            return 'PS512';
         default:
             throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name');
     }
@@ -271,6 +286,10 @@ function rsAlg(key) {
     switch (key.algorithm.hash.name) {
         case 'SHA-256':
             return 'RS256';
+        case 'SHA-384':
+            return 'RS384';
+        case 'SHA-512':
+            return 'RS512';
         default:
             throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name');
     }
@@ -279,11 +298,15 @@ function esAlg(key) {
     switch (key.algorithm.namedCurve) {
         case 'P-256':
             return 'ES256';
+        case 'P-384':
+            return 'ES384';
+        case 'P-521':
+            return 'ES512';
         default:
             throw new UnsupportedOperationError('unsupported EcKeyAlgorithm namedCurve');
     }
 }
-function determineJWSAlgorithm(key) {
+function keyToJws(key) {
     switch (key.algorithm.name) {
         case 'RSA-PSS':
             return psAlg(key);
@@ -292,6 +315,7 @@ function determineJWSAlgorithm(key) {
         case 'ECDSA':
             return esAlg(key);
         case 'Ed25519':
+        case 'Ed448':
             return 'EdDSA';
         default:
             throw new UnsupportedOperationError('unsupported CryptoKey algorithm name');
@@ -314,7 +338,7 @@ function clientAssertion(as, client) {
 }
 async function privateKeyJwt(as, client, key, kid) {
     return jwt({
-        alg: determineJWSAlgorithm(key),
+        alg: keyToJws(key),
         kid,
     }, clientAssertion(as, client), key);
 }
@@ -398,7 +422,7 @@ async function jwt(header, claimsSet, key) {
         throw new TypeError('CryptoKey instances used for signing assertions must include "sign" in their "usages"');
     }
     const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(claimsSet)))}`;
-    const signature = b64u(await crypto.subtle.sign(subtleAlgorithm(key), key, buf(input)));
+    const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));
     return `${input}.${signature}`;
 }
 export async function issueRequestObject(as, client, parameters, privateKey) {
@@ -445,7 +469,7 @@ export async function issueRequestObject(as, client, parameters, privateKey) {
         }
     }
     return jwt({
-        alg: determineJWSAlgorithm(key),
+        alg: keyToJws(key),
         typ: 'oauth-authz-req+jwt',
         kid,
     }, claims, key);
@@ -466,7 +490,7 @@ async function dpopProofJwt(headers, options, url, htm, accessToken) {
     }
     const now = epochTime();
     const proof = await jwt({
-        alg: determineJWSAlgorithm(privateKey),
+        alg: keyToJws(privateKey),
         typ: 'dpop+jwt',
         jwk: await publicJwk(publicKey),
     }, {
@@ -707,7 +731,9 @@ async function getPublicSigKeyFromIssuerJwksUri(as, options, header) {
         }
         switch (true) {
             case alg === 'ES256' && jwk.crv !== 'P-256':
-            case alg === 'EdDSA' && jwk.crv !== 'Ed25519':
+            case alg === 'ES384' && jwk.crv !== 'P-384':
+            case alg === 'ES512' && jwk.crv !== 'P-521':
+            case alg === 'EdDSA' && !(jwk.crv === 'Ed25519' || jwk.crv === 'Ed448'):
                 return false;
         }
         return true;
@@ -1210,19 +1236,43 @@ function checkRsaKeyAlgorithm(algorithm) {
         throw new OPE(`${algorithm.name} modulusLength must be at least 2048 bits`);
     }
 }
-function subtleAlgorithm(key) {
+function ecdsaHashName(namedCurve) {
+    switch (namedCurve) {
+        case 'P-256':
+            return 'SHA-256';
+        case 'P-384':
+            return 'SHA-384';
+        case 'P-521':
+            return 'SHA-512';
+        default:
+            throw new UnsupportedOperationError();
+    }
+}
+function keyToSubtle(key) {
     switch (key.algorithm.name) {
         case 'ECDSA':
-            return { name: key.algorithm.name, hash: { name: 'SHA-256' } };
-        case 'RSA-PSS':
-            checkRsaKeyAlgorithm(key.algorithm);
             return {
                 name: key.algorithm.name,
-                saltLength: 256 >> 3,
+                hash: { name: ecdsaHashName(key.algorithm.namedCurve) },
             };
+        case 'RSA-PSS': {
+            checkRsaKeyAlgorithm(key.algorithm);
+            switch (key.algorithm.hash.name) {
+                case 'SHA-256':
+                case 'SHA-384':
+                case 'SHA-512':
+                    return {
+                        name: key.algorithm.name,
+                        saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3,
+                    };
+                default:
+                    throw new UnsupportedOperationError();
+            }
+        }
         case 'RSASSA-PKCS1-v1_5':
             checkRsaKeyAlgorithm(key.algorithm);
             return { name: key.algorithm.name };
+        case 'Ed448':
         case 'Ed25519':
             return { name: key.algorithm.name };
     }
@@ -1255,7 +1305,7 @@ async function validateJwt(jws, checkAlg, getKey) {
     if (getKey !== noSignatureCheck) {
         const key = await getKey(header);
         const input = `${protectedHeader}.${payload}`;
-        const verified = await crypto.subtle.verify(subtleAlgorithm(key), key, signature, buf(input));
+        const verified = await crypto.subtle.verify(keyToSubtle(key), key, signature, buf(input));
         if (!verified) {
             throw new OPE('JWT signature verification failed');
         }
@@ -1416,26 +1466,38 @@ export function validateAuthResponse(as, client, parameters, expectedState) {
     }
     return new CallbackParameters(parameters);
 }
-async function importJwk(alg, jwk) {
-    const { ext, key_ops, use, ...key } = jwk;
-    let algorithm;
+function algToSubtle(alg, crv) {
     switch (alg) {
         case 'PS256':
-            algorithm = { name: 'RSA-PSS', hash: { name: 'SHA-256' } };
-            break;
+        case 'PS384':
+        case 'PS512':
+            return { name: 'RSA-PSS', hash: { name: `SHA-${alg.slice(-3)}` } };
         case 'RS256':
-            algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-256' } };
-            break;
+        case 'RS384':
+        case 'RS512':
+            return { name: 'RSASSA-PKCS1-v1_5', hash: { name: `SHA-${alg.slice(-3)}` } };
         case 'ES256':
-            algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
-            break;
-        case 'EdDSA':
-            algorithm = { name: 'Ed25519' };
-            break;
+        case 'ES384':
+            return { name: 'ECDSA', namedCurve: `P-${alg.slice(-3)}` };
+        case 'ES512':
+            return { name: 'ECDSA', namedCurve: 'P-521' };
+        case 'EdDSA': {
+            switch (crv) {
+                case 'Ed25519':
+                    return { name: 'Ed25519' };
+                case 'Ed448':
+                    return { name: 'Ed448' };
+                default:
+                    throw new UnsupportedOperationError();
+            }
+        }
         default:
             throw new UnsupportedOperationError();
     }
-    return crypto.subtle.importKey('jwk', key, algorithm, true, ['verify']);
+}
+async function importJwk(alg, jwk) {
+    const { ext, key_ops, use, ...key } = jwk;
+    return crypto.subtle.importKey('jwk', key, algToSubtle(alg, jwk.crv), true, ['verify']);
 }
 export async function deviceAuthorizationRequest(as, client, parameters, options) {
     assertAs(as);
@@ -1512,35 +1574,15 @@ export async function processDeviceCodeResponse(as, client, response) {
     return processGenericAccessTokenResponse(as, client, response);
 }
 export async function generateKeyPair(alg, options) {
-    let algorithm;
     if (!validateString(alg)) {
         throw new TypeError('"alg" must be a non-empty string');
     }
-    switch (alg) {
-        case 'PS256':
-            algorithm = {
-                name: 'RSA-PSS',
-                hash: { name: 'SHA-256' },
-                modulusLength: options?.modulusLength ?? 2048,
-                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
-            };
-            break;
-        case 'RS256':
-            algorithm = {
-                name: 'RSASSA-PKCS1-v1_5',
-                hash: { name: 'SHA-256' },
-                modulusLength: options?.modulusLength ?? 2048,
-                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
-            };
-            break;
-        case 'ES256':
-            algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
-            break;
-        case 'EdDSA':
-            algorithm = { name: 'Ed25519' };
-            break;
-        default:
-            throw new UnsupportedOperationError();
+    const algorithm = algToSubtle(alg, alg === 'EdDSA' ? options?.crv ?? 'Ed25519' : undefined);
+    if (alg.startsWith('PS') || alg.startsWith('RS')) {
+        Object.assign(algorithm, {
+            modulusLength: options?.modulusLength ?? 2048,
+            publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+        });
     }
     return (crypto.subtle.generateKey(algorithm, options?.extractable ?? false, ['sign', 'verify']));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauth4webapi",
-  "version": "2.0.5",
+  "version": "2.1.0",
   "description": "OAuth 2 / OpenID Connect for Web Platform API JavaScript runtimes",
   "keywords": [
     "auth",
@@ -66,8 +66,8 @@
     "@types/node": "^18.11.9",
     "@types/qunit": "^2.19.3",
     "ava": "^5.1.0",
-    "edge-runtime": "^2.0.2",
-    "esbuild": "^0.16.1",
+    "edge-runtime": "^2.0.4",
+    "esbuild": "^0.17.0",
     "jose": "^4.11.1",
     "patch-package": "^6.5.0",
     "prettier": "^2.8.0",