two-stroke 7.9.0 → 7.10.0

package/package.json

@@ -12,7 +12,7 @@
   "dependencies": {
     "@cloudflare/vitest-pool-workers": "^0.18.0",
     "@sentry/cli": "^3.6.0",
-    "@typescript-eslint/eslint-plugin": "^8.62.1",
+    "@typescript-eslint/eslint-plugin": "^8.63.0",
     "@typescript-eslint/parser": "^8.62.1",
     "@vitest/runner": "^4.1.8",
     "@vitest/snapshot": "^4.1.8",
@@ -20,13 +20,11 @@
     "eslint-config-two-stroke": "^1.5.7",
     "eslint-config-typescript": "^3.0.0",
     "jose": "^6.2.3",
-    "jwk-subtle": "^1.1.8",
     "mime": "^4.1.0",
     "miniflare": "^4.20260701.0",
     "msw": "^2.14.6",
     "openapi-fetch": "^0.17.0",
     "openapi-typescript": "^7.13.0",
-    "pbkdf-subtle": "^1.1.8",
     "toucan-js": "^4.1.1",
     "zod": "^4.4.3"
   },
@@ -58,12 +56,12 @@
     "url": "https://github.com/change-engine/two-stroke"
   },
   "type": "module",
-  "version": "7.9.0",
+  "version": "7.10.0",
   "devDependencies": {
     "@types/eslint": "^9.6.1",
     "eslint": "^10.6.0",
     "prettier": "^3.9.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.10"
   }
 }

package/src/index.ts

@@ -1,9 +1,9 @@
-import { verify as jwkVerify } from "jwk-subtle";
-import { verify as pbkdfVerify } from "pbkdf-subtle";
 import { Toucan } from "toucan-js";
 import { type ZodSafeParseResult, z, ZodObject, ZodType } from "zod/v4";
 import { openAPI } from "./open-api";
 import { type Handler, type Route } from "./types";
+import type { JSONWebKeySet } from "jose";
+import { pbkdfVerify, jwkVerifyMulti } from "./util";
 
 // eslint-disable-next-line @typescript-eslint/require-await
 const noAuth = async () => null;
@@ -301,7 +301,7 @@ export function twoStroke<T>(
     },
     noAuth,
     pbkdf:
-      (k: keyof T, customHeaderName: string = "Authorization") =>
+      (k: keyof T, customHeaderName = "Authorization") =>
       async ({ req, env }: { req: Request; env: T }) => {
         const [scheme, token] = (req.headers.get(customHeaderName) ?? " ").split(" ");
         if (
@@ -309,20 +309,28 @@ export function twoStroke<T>(
           (await pbkdfVerify(env[k] as string, token ?? ""))
         )
           return;
-        throw Error("Invalid");
+        throw new Error("Invalid");
       },
     jwt:
       <J>(k: keyof T, ak: keyof T) =>
       async ({ req, env }: { req: Request; env: T }) => {
         const [scheme, token] = (req.headers.get("Authorization") ?? " ").split(" ");
         if (scheme === "Bearer") {
-          const claims = await jwkVerify<J>(token ?? "", env[k] as string, env[ak] as string);
+          const rawIssuer = env[k] as string;
+          const rawAudience = env[ak] as string;
+          const issuer = rawIssuer.startsWith("{")
+            ? (JSON.parse(rawIssuer) as Record<string, JSONWebKeySet | true>)
+            : { [rawIssuer]: true as const };
+          const audience = rawAudience.startsWith("[")
+            ? (JSON.parse(rawAudience) as string[])
+            : [rawAudience];
+          const claims = await jwkVerifyMulti<J>(token ?? "", issuer, audience);
           if (!claims) {
-            throw Error("Invalid");
+            throw new Error("Invalid");
           }
           return claims;
         }
-        throw Error("Invalid");
+        throw new Error("Invalid");
       },
     queueHandler<I extends ZodType>(
       input: I,

package/src/util.ts

@@ -0,0 +1,77 @@
+import {
+  type FlattenedJWSInput,
+  type JSONWebKeySet,
+  type JWSHeaderParameters,
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  decodeJwt,
+  jwtVerify,
+} from "jose";
+
+export async function pbkdfVerify(key: string, password: string) {
+  return (
+    [
+      ...new Uint8Array(
+        await crypto.subtle.deriveBits(
+          {
+            name: "PBKDF2",
+            hash: "SHA-256",
+            salt: new Uint8Array([...atob(key).slice(3, 19)].map((ch) => ch.charCodeAt(0))),
+            iterations: parseInt(
+              [...atob(key).slice(19, 22)].map((ch) => ch.charCodeAt(0).toString(16)).join(""),
+              16,
+            ),
+          },
+          await crypto.subtle.importKey(
+            "raw",
+            new TextEncoder().encode(password),
+            "PBKDF2",
+            false,
+            ["deriveBits"],
+          ),
+          256,
+        ),
+      ),
+    ]
+      .map((byte) => String.fromCharCode(byte))
+      .join("") === atob(key).slice(22, 54)
+  );
+}
+
+export async function jwkVerifyMulti<J>(
+  token: string,
+  issuers: Record<string, JSONWebKeySet | true>,
+  audiences: string[],
+) {
+  const unverifiedClaims = decodeJwt(token);
+  if (!unverifiedClaims.iss) throw new Error("Invalid");
+  const issuer = issuers[unverifiedClaims.iss];
+  if (!issuer) throw new Error("Invalid");
+
+  let JWKS: (
+    protectedHeader?: JWSHeaderParameters,
+    token?: FlattenedJWSInput,
+  ) => Promise<CryptoKey>;
+
+  if (issuer === true) {
+    // OIDC
+    const oidcRequest = await fetch(
+      `${unverifiedClaims.iss}${unverifiedClaims.iss.endsWith("/") ? "" : "/"}.well-known/openid-configuration`,
+    );
+    const oidc = await oidcRequest.json<{ jwks_uri: string }>();
+    JWKS = createRemoteJWKSet(new URL(oidc.jwks_uri));
+  } else {
+    JWKS = createLocalJWKSet(issuer);
+  }
+
+  const claims = (
+    await jwtVerify<J>(token ?? "", JWKS, {
+      algorithms: ["RS256", "ES256"],
+      audience: audiences,
+    })
+  ).payload;
+  if (!claims) {
+    throw new Error("Invalid");
+  }
+  return claims;
+}