unjwt 0.1.1 → 0.2.0

package/README.md

@@ -6,8 +6,8 @@ You may just use [Jose](https://github.com/panva/jose) or one of the other libra
 
 ## Features
 
-- 💨 Zero dependencies
-- 📦 Works in every context supporting the Web Crypto API
+- 📦 Works in Node, browser and workers
+- 💨 Zero dependencies except [`uncrypto`](https://github.com/unjs/uncrypto) for conditional Web Crypto API support
 
 ## Installation
 
@@ -27,7 +27,7 @@ yarn add unjwt
 ## Usage
 
 ```ts
-import { signJWT, verifyJWT } from 'unjwt'
+import { decodeJWT, signJWT, verifyJWT } from 'unjwt'
 
 interface JWTUserClaims {
   email: string

package/dist/index.d.mts

@@ -44,7 +44,10 @@ interface JWTRegisteredClaims {
     iat?: number;
 }
 
-declare function signJWT<T extends Record<string, any> = Record<string, any>>({ payload, secret, issuer, audience, expires, header, signatureMethod, hashMethod, }: {
+declare function decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): (JWTRegisteredClaims & T) | undefined;
+declare function _decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): JWTRegisteredClaims & T;
+
+declare function signJWT<T extends Record<string, any> = Record<string, any>>(options: {
     payload?: T;
     secret: string;
     issuer: string;
@@ -54,14 +57,13 @@ declare function signJWT<T extends Record<string, any> = Record<string, any>>({
      * @default 30
      */
     expires?: number;
-    /** @default { typ: 'JWT', alg: 'HS256' } */
-    header?: Record<string, any>;
     /** @default 'HMAC' */
     signatureMethod?: string;
     /** @default 'SHA-256' */
     hashMethod?: string;
 }): Promise<string>;
-declare function verifyJWT({ token, secret, issuer, audience, leeway, signatureMethod, hashMethod, }: {
+
+declare function verifyJWT(options: {
     token: string;
     secret: string;
     issuer: string;
@@ -73,6 +75,5 @@ declare function verifyJWT({ token, secret, issuer, audience, leeway, signatureM
     /** @default 'SHA-256' */
     hashMethod?: string;
 }): Promise<void>;
-declare function decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): JWTRegisteredClaims & T;
 
-export { JWTRegisteredClaims, decodeJWT, signJWT, verifyJWT };
+export { JWTRegisteredClaims, _decodeJWT, decodeJWT, signJWT, verifyJWT };

package/dist/index.d.ts

@@ -44,7 +44,10 @@ interface JWTRegisteredClaims {
     iat?: number;
 }
 
-declare function signJWT<T extends Record<string, any> = Record<string, any>>({ payload, secret, issuer, audience, expires, header, signatureMethod, hashMethod, }: {
+declare function decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): (JWTRegisteredClaims & T) | undefined;
+declare function _decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): JWTRegisteredClaims & T;
+
+declare function signJWT<T extends Record<string, any> = Record<string, any>>(options: {
     payload?: T;
     secret: string;
     issuer: string;
@@ -54,14 +57,13 @@ declare function signJWT<T extends Record<string, any> = Record<string, any>>({
      * @default 30
      */
     expires?: number;
-    /** @default { typ: 'JWT', alg: 'HS256' } */
-    header?: Record<string, any>;
     /** @default 'HMAC' */
     signatureMethod?: string;
     /** @default 'SHA-256' */
     hashMethod?: string;
 }): Promise<string>;
-declare function verifyJWT({ token, secret, issuer, audience, leeway, signatureMethod, hashMethod, }: {
+
+declare function verifyJWT(options: {
     token: string;
     secret: string;
     issuer: string;
@@ -73,6 +75,5 @@ declare function verifyJWT({ token, secret, issuer, audience, leeway, signatureM
     /** @default 'SHA-256' */
     hashMethod?: string;
 }): Promise<void>;
-declare function decodeJWT<T extends Record<string, any> = Record<string, any>>(token: string): JWTRegisteredClaims & T;
 
-export { JWTRegisteredClaims, decodeJWT, signJWT, verifyJWT };
+export { JWTRegisteredClaims, _decodeJWT, decodeJWT, signJWT, verifyJWT };

package/dist/index.mjs

@@ -1,19 +1,22 @@
+import { subtle } from 'uncrypto';
+
 const DEFAULT_SIGNATURE_METHOD = "HMAC";
 const DEFAULT_HASH_METHODS = "SHA-256";
 const textEncoder = new TextEncoder();
 async function createSignature(key, algorithm, data) {
   const encoded = textEncoder.encode(data);
-  const signature = await crypto.subtle.sign(algorithm, key, encoded);
+  const signature = await subtle.sign(algorithm, key, encoded);
   return encodeToBase64Url(signature);
 }
-async function importKey({
-  secret,
-  usage = "sign",
-  name = DEFAULT_SIGNATURE_METHOD,
-  hash = DEFAULT_HASH_METHODS
-}) {
+async function importKey(options) {
+  const {
+    secret,
+    usage = "sign",
+    name = DEFAULT_SIGNATURE_METHOD,
+    hash = DEFAULT_HASH_METHODS
+  } = { ...options };
   const encodedKey = textEncoder.encode(secret);
-  return await crypto.subtle.importKey(
+  return await subtle.importKey(
     "raw",
     encodedKey,
     { name, hash },
@@ -42,21 +45,44 @@ function decodeFromBase64UrlToBuffer(base64Url) {
   return buffer.buffer;
 }
 
-async function signJWT({
-  payload = {},
-  secret,
-  issuer,
-  audience,
-  expires = 30,
-  header = { typ: "JWT", alg: "HS256" },
-  signatureMethod = DEFAULT_SIGNATURE_METHOD,
-  hashMethod = DEFAULT_HASH_METHODS
-}) {
+function decodeJWT(token) {
+  try {
+    return _decodeJWT(token);
+  } catch {
+  }
+}
+function _decodeJWT(token) {
+  const parts = String(token).split(".");
+  if (parts.length !== 3)
+    throw new Error("Invalid token format");
+  const [, payload] = parts;
+  return JSON.parse(decodeFromBase64Url(payload));
+}
+
+const headerAlgMap = {
+  HMAC: "HS",
+  RSA: "RS",
+  ECDSA: "ES"
+};
+async function signJWT(options) {
+  const {
+    payload = {},
+    secret,
+    issuer,
+    audience,
+    expires = 30,
+    signatureMethod = DEFAULT_SIGNATURE_METHOD,
+    hashMethod = DEFAULT_HASH_METHODS
+  } = { ...options };
   const key = await importKey({
     secret,
     name: signatureMethod,
     hash: hashMethod
   });
+  const header = {
+    typ: "JWT",
+    alg: `${headerAlgMap[signatureMethod]}${hashMethod.split("-")[1]}`
+  };
   const iat = Math.floor(Date.now() / 1e3);
   const exp = iat + expires * 24 * 60 * 60;
   const jwtPayload = {
@@ -75,23 +101,25 @@ async function signJWT({
     jwtPayload
   )}.${signature}`;
 }
-async function verifyJWT({
-  token,
-  secret,
-  issuer,
-  audience,
-  leeway = 60,
-  signatureMethod = DEFAULT_SIGNATURE_METHOD,
-  hashMethod = DEFAULT_HASH_METHODS
-}) {
-  const [header, payload, signature] = token.split(".");
+
+async function verifyJWT(options) {
+  const {
+    token,
+    secret,
+    issuer,
+    audience,
+    leeway = 60,
+    signatureMethod = DEFAULT_SIGNATURE_METHOD,
+    hashMethod = DEFAULT_HASH_METHODS
+  } = { ...options };
+  const [header, payload, signature] = String(token).split(".");
   const key = await importKey({
     secret,
     usage: "verify",
     name: signatureMethod,
     hash: hashMethod
   });
-  const isValid = await crypto.subtle.verify(
+  const isValid = await subtle.verify(
     signatureMethod,
     key,
     decodeFromBase64UrlToBuffer(signature),
@@ -99,19 +127,15 @@ async function verifyJWT({
   );
   if (!isValid)
     throw new Error("Invalid JWT signature");
-  const decodedPayload = JSON.parse(
-    decodeFromBase64Url(payload)
-  );
+  let decodedPayload;
+  try {
+    decodedPayload = JSON.parse(decodeFromBase64Url(payload));
+  } catch {
+    throw new Error("Invalid JWT payload");
+  }
   const now = Math.floor(Date.now() / 1e3);
   if (issuer !== decodedPayload.iss || (Array.isArray(decodedPayload.aud) ? !decodedPayload.aud.includes(audience) : audience !== decodedPayload.aud) || decodedPayload.exp && now > decodedPayload.exp + leeway || decodedPayload.nbf && now < decodedPayload.nbf - leeway)
     throw new Error("Invalid JWT claims");
 }
-function decodeJWT(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3)
-    throw new Error("Invalid token format");
-  const [, payload] = parts;
-  return JSON.parse(decodeFromBase64Url(payload));
-}
 
-export { decodeJWT, signJWT, verifyJWT };
+export { _decodeJWT, decodeJWT, signJWT, verifyJWT };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "unjwt",
   "type": "module",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "packageManager": "pnpm@8.6.12",
   "description": "Easy creation and verification of JSON Web Tokens (JWT)",
   "author": "Johann Schopplich <pkg@johannschopplich.com>",
@@ -40,6 +40,9 @@
     "release": "bumpp --commit --push --tag",
     "test:types": "tsc --noEmit"
   },
+  "dependencies": {
+    "uncrypto": "^0.1.3"
+  },
   "devDependencies": {
     "@antfu/eslint-config": "^0.40.2",
     "bumpp": "^9.1.1",