unjwt 0.1.1 → 0.1.2

package/README.md

@@ -27,7 +27,7 @@ yarn add unjwt
 ## Usage
 
 ```ts
-import { signJWT, verifyJWT } from 'unjwt'
+import { decodeJWT, signJWT, verifyJWT } from 'unjwt'
 
 interface JWTUserClaims {
   email: string

package/dist/index.d.mts

@@ -44,7 +44,10 @@ interface JWTRegisteredClaims {
     iat?: number;
 }
 
-declare function signJWT<T extends Record<string, any> = Record<string, any>>({ payload, secret, issuer, audience, expires, header, signatureMethod, hashMethod, }: {
+declare function decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): (JWTRegisteredClaims & T) | undefined;
+declare function _decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): JWTRegisteredClaims & T;
+
+declare function signJWT<T extends Record<string, any> = Record<string, any>>({ payload, secret, issuer, audience, expires, signatureMethod, hashMethod, }: {
     payload?: T;
     secret: string;
     issuer: string;
@@ -54,13 +57,12 @@ declare function signJWT<T extends Record<string, any> = Record<string, any>>({
      * @default 30
      */
     expires?: number;
-    /** @default { typ: 'JWT', alg: 'HS256' } */
-    header?: Record<string, any>;
     /** @default 'HMAC' */
     signatureMethod?: string;
     /** @default 'SHA-256' */
     hashMethod?: string;
 }): Promise<string>;
+
 declare function verifyJWT({ token, secret, issuer, audience, leeway, signatureMethod, hashMethod, }: {
     token: string;
     secret: string;
@@ -73,6 +75,5 @@ declare function verifyJWT({ token, secret, issuer, audience, leeway, signatureM
     /** @default 'SHA-256' */
     hashMethod?: string;
 }): Promise<void>;
-declare function decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): JWTRegisteredClaims & T;
 
-export { JWTRegisteredClaims, decodeJWT, signJWT, verifyJWT };
+export { JWTRegisteredClaims, _decodeJWT, decodeJWT, signJWT, verifyJWT };

package/dist/index.d.ts

@@ -44,7 +44,10 @@ interface JWTRegisteredClaims {
     iat?: number;
 }
 
-declare function signJWT<T extends Record<string, any> = Record<string, any>>({ payload, secret, issuer, audience, expires, header, signatureMethod, hashMethod, }: {
+declare function decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): (JWTRegisteredClaims & T) | undefined;
+declare function _decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): JWTRegisteredClaims & T;
+
+declare function signJWT<T extends Record<string, any> = Record<string, any>>({ payload, secret, issuer, audience, expires, signatureMethod, hashMethod, }: {
     payload?: T;
     secret: string;
     issuer: string;
@@ -54,13 +57,12 @@ declare function signJWT<T extends Record<string, any> = Record<string, any>>({
      * @default 30
      */
     expires?: number;
-    /** @default { typ: 'JWT', alg: 'HS256' } */
-    header?: Record<string, any>;
     /** @default 'HMAC' */
     signatureMethod?: string;
     /** @default 'SHA-256' */
     hashMethod?: string;
 }): Promise<string>;
+
 declare function verifyJWT({ token, secret, issuer, audience, leeway, signatureMethod, hashMethod, }: {
     token: string;
     secret: string;
@@ -73,6 +75,5 @@ declare function verifyJWT({ token, secret, issuer, audience, leeway, signatureM
     /** @default 'SHA-256' */
     hashMethod?: string;
 }): Promise<void>;
-declare function decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): JWTRegisteredClaims & T;
 
-export { JWTRegisteredClaims, decodeJWT, signJWT, verifyJWT };
+export { JWTRegisteredClaims, _decodeJWT, decodeJWT, signJWT, verifyJWT };

package/dist/index.mjs

@@ -42,13 +42,31 @@ function decodeFromBase64UrlToBuffer(base64Url) {
   return buffer.buffer;
 }
 
+function decodeJWT(token) {
+  try {
+    return _decodeJWT(token);
+  } catch {
+  }
+}
+function _decodeJWT(token) {
+  const parts = String(token).split(".");
+  if (parts.length !== 3)
+    throw new Error("Invalid token format");
+  const [, payload] = parts;
+  return JSON.parse(decodeFromBase64Url(payload));
+}
+
+const headerAlgMap = {
+  HMAC: "HS",
+  RSA: "RS",
+  ECDSA: "ES"
+};
 async function signJWT({
   payload = {},
   secret,
   issuer,
   audience,
   expires = 30,
-  header = { typ: "JWT", alg: "HS256" },
   signatureMethod = DEFAULT_SIGNATURE_METHOD,
   hashMethod = DEFAULT_HASH_METHODS
 }) {
@@ -57,6 +75,10 @@ async function signJWT({
     name: signatureMethod,
     hash: hashMethod
   });
+  const header = {
+    typ: "JWT",
+    alg: `${headerAlgMap[signatureMethod]}${hashMethod.split("-")[1]}`
+  };
   const iat = Math.floor(Date.now() / 1e3);
   const exp = iat + expires * 24 * 60 * 60;
   const jwtPayload = {
@@ -75,6 +97,7 @@ async function signJWT({
     jwtPayload
   )}.${signature}`;
 }
+
 async function verifyJWT({
   token,
   secret,
@@ -99,19 +122,15 @@ async function verifyJWT({
   );
   if (!isValid)
     throw new Error("Invalid JWT signature");
-  const decodedPayload = JSON.parse(
-    decodeFromBase64Url(payload)
-  );
+  let decodedPayload;
+  try {
+    decodedPayload = JSON.parse(decodeFromBase64Url(payload));
+  } catch {
+    throw new Error("Invalid JWT payload");
+  }
   const now = Math.floor(Date.now() / 1e3);
   if (issuer !== decodedPayload.iss || (Array.isArray(decodedPayload.aud) ? !decodedPayload.aud.includes(audience) : audience !== decodedPayload.aud) || decodedPayload.exp && now > decodedPayload.exp + leeway || decodedPayload.nbf && now < decodedPayload.nbf - leeway)
     throw new Error("Invalid JWT claims");
 }
-function decodeJWT(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3)
-    throw new Error("Invalid token format");
-  const [, payload] = parts;
-  return JSON.parse(decodeFromBase64Url(payload));
-}
 
-export { decodeJWT, signJWT, verifyJWT };
+export { _decodeJWT, decodeJWT, signJWT, verifyJWT };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "unjwt",
   "type": "module",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "packageManager": "pnpm@8.6.12",
   "description": "Easy creation and verification of JSON Web Tokens (JWT)",
   "author": "Johann Schopplich <pkg@johannschopplich.com>",