unjwt 0.2.1 → 0.4.0

package/dist/shared/unjwt._GivNhs2.mjs

@@ -0,0 +1,213 @@
+import { t as textEncoder, r as randomBytes, b as base64UrlEncode, a as textDecoder, c as base64UrlDecode, d as concatUint8Arrays } from './unjwt.DPTwlVpK.mjs';
+import { l as lookupAlgorithm, K as KEY_WRAPPING_ALGORITHMS, C as CONTENT_ENCRYPTION_ALGORITHMS } from './unjwt.DD0p18Gd.mjs';
+
+const JWE_DEFAULTS = /* @__PURE__ */ Object.freeze({
+  saltSize: 16,
+  iterations: 2048,
+  alg: "PBES2-HS256+A128KW",
+  enc: "A256GCM"
+});
+async function seal(data, password, options = {}) {
+  const protectedHeader = options.protectedHeader || {};
+  const iterations = protectedHeader.p2c || options.iterations || JWE_DEFAULTS.iterations;
+  const saltSize = options.saltSize || JWE_DEFAULTS.saltSize;
+  const alg = protectedHeader.alg || JWE_DEFAULTS.alg;
+  const enc = protectedHeader.enc || JWE_DEFAULTS.enc;
+  validateKeyWrappingAlgorithm(alg);
+  const encConfig = validateContentEncryptionAlgorithm(enc);
+  const plaintext = typeof data === "string" ? textEncoder.encode(data) : data;
+  const saltInput = randomBytes(saltSize);
+  const header = {
+    alg,
+    enc,
+    p2s: base64UrlEncode(saltInput),
+    p2c: iterations,
+    ...protectedHeader
+  };
+  const encodedHeader = base64UrlEncode(
+    textEncoder.encode(JSON.stringify(header))
+  );
+  const derivedKey = await deriveKeyFromPassword(
+    password,
+    saltInput,
+    iterations,
+    alg
+  );
+  const {
+    wrappedKey,
+    rawCek: _,
+    cek
+  } = await generateAndWrapCEK(derivedKey, encConfig);
+  const iv = randomBytes(encConfig.ivLength);
+  let ciphertext;
+  let tag;
+  if (encConfig.type === "gcm") {
+    const result = await encryptGCM(
+      plaintext,
+      cek,
+      iv,
+      textEncoder.encode(encodedHeader),
+      encConfig
+    );
+    ciphertext = result.ciphertext;
+    tag = result.tag;
+  } else {
+    throw new Error(`Unsupported encryption type: ${encConfig.type}`);
+  }
+  return [
+    encodedHeader,
+    base64UrlEncode(new Uint8Array(wrappedKey)),
+    base64UrlEncode(iv),
+    base64UrlEncode(ciphertext),
+    base64UrlEncode(tag)
+  ].join(".");
+}
+async function unseal(token, password, options = {}) {
+  if (!token) {
+    throw new Error("Missing JWE token");
+  }
+  const textOutput = options.textOutput !== false;
+  const [
+    encodedHeader,
+    encryptedKey,
+    encodedIv,
+    encodedCiphertext,
+    encodedTag
+  ] = token.split(".");
+  const header = JSON.parse(textDecoder.decode(base64UrlDecode(encodedHeader)));
+  const alg = header.alg;
+  const enc = header.enc;
+  validateKeyWrappingAlgorithm(alg);
+  const encConfig = validateContentEncryptionAlgorithm(enc);
+  const iterations = header.p2c;
+  const saltInput = base64UrlDecode(header.p2s);
+  const derivedKey = await deriveKeyFromPassword(
+    password,
+    saltInput,
+    iterations,
+    alg
+  );
+  const wrappedKey = base64UrlDecode(encryptedKey);
+  const iv = base64UrlDecode(encodedIv);
+  const ciphertext = base64UrlDecode(encodedCiphertext);
+  const tag = base64UrlDecode(encodedTag);
+  const cek = await unwrapCEK(wrappedKey, derivedKey, encConfig);
+  let decrypted;
+  if (encConfig.type === "gcm") {
+    decrypted = await decryptGCM(
+      ciphertext,
+      tag,
+      cek,
+      iv,
+      textEncoder.encode(encodedHeader)
+    );
+  } else {
+    throw new Error(`Unsupported encryption type: ${encConfig.type}`);
+  }
+  return textOutput ? textDecoder.decode(decrypted) : decrypted;
+}
+async function deriveKeyFromPassword(password, saltInput, iterations, alg) {
+  if (!password) {
+    throw new Error("Missing password");
+  }
+  const algConfig = validateKeyWrappingAlgorithm(alg);
+  const baseKey = await crypto.subtle.importKey(
+    "raw",
+    typeof password === "string" ? textEncoder.encode(password) : password,
+    { name: "PBKDF2" },
+    false,
+    ["deriveKey"]
+  );
+  const salt = concatUint8Arrays(
+    textEncoder.encode(alg),
+    new Uint8Array([0]),
+    saltInput
+  );
+  return crypto.subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      hash: algConfig.hash,
+      salt,
+      iterations
+    },
+    baseKey,
+    { name: "AES-KW", length: algConfig.keyLength },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+function validateKeyWrappingAlgorithm(alg) {
+  return lookupAlgorithm(alg, KEY_WRAPPING_ALGORITHMS, "key wrapping");
+}
+function validateContentEncryptionAlgorithm(enc) {
+  return lookupAlgorithm(
+    enc,
+    CONTENT_ENCRYPTION_ALGORITHMS,
+    "content encryption"
+  );
+}
+async function generateAndWrapCEK(derivedKey, encConfig) {
+  if (encConfig.type === "gcm") {
+    const cek = await crypto.subtle.generateKey(
+      { name: "AES-GCM", length: encConfig.keyLength },
+      true,
+      ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+    );
+    const wrappedKey = await crypto.subtle.wrapKey("raw", cek, derivedKey, {
+      name: "AES-KW"
+    });
+    return { wrappedKey, rawCek: null, cek };
+  }
+  throw new Error(`Unsupported encryption type: ${encConfig.type}`);
+}
+async function unwrapCEK(wrappedKey, derivedKey, encConfig) {
+  if (encConfig.type === "gcm") {
+    return crypto.subtle.unwrapKey(
+      "raw",
+      wrappedKey,
+      derivedKey,
+      { name: "AES-KW" },
+      { name: "AES-GCM", length: encConfig.keyLength },
+      false,
+      ["decrypt"]
+    );
+  }
+  throw new Error(`Unsupported encryption type: ${encConfig.type}`);
+}
+async function encryptGCM(plaintext, cek, iv, aad, encConfig) {
+  const ciphertext = await crypto.subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      additionalData: aad
+    },
+    cek,
+    plaintext
+  );
+  const encrypted = new Uint8Array(ciphertext);
+  const tag = encrypted.slice(-encConfig.tagLength);
+  const ciphertextOutput = encrypted.slice(0, -encConfig.tagLength);
+  return { ciphertext: ciphertextOutput, tag };
+}
+async function decryptGCM(ciphertext, tag, cek, iv, aad) {
+  const encryptedData = concatUint8Arrays(ciphertext, tag);
+  const decrypted = await crypto.subtle.decrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      additionalData: aad
+    },
+    cek,
+    encryptedData
+  );
+  return new Uint8Array(decrypted);
+}
+
+const jwe = {
+  __proto__: null,
+  JWE_DEFAULTS: JWE_DEFAULTS,
+  seal: seal,
+  unseal: unseal
+};
+
+export { JWE_DEFAULTS as J, jwe as j, seal as s, unseal as u };

package/dist/shared/unjwt.zb2wBNCJ.d.mts

@@ -0,0 +1,82 @@
+/**
+Based on https://github.com/panva/jose/tree/v6.0.10
+Copyright (c) 2018 Filip Skokan.
+https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
+ */
+/** Generic JSON Web Key Parameters. */
+interface JWKParameters {
+    /** JWK "kty" (Key Type) Parameter */
+    kty?: string;
+    /**
+     * JWK "alg" (Algorithm) Parameter
+     *
+     * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
+     */
+    alg?: string;
+    /** JWK "key_ops" (Key Operations) Parameter */
+    key_ops?: string[];
+    /** JWK "ext" (Extractable) Parameter */
+    ext?: boolean;
+    /** JWK "use" (Public Key Use) Parameter */
+    use?: string;
+    /** JWK "x5c" (X.509 Certificate Chain) Parameter */
+    x5c?: string[];
+    /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
+    x5t?: string;
+    /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
+    "x5t#S256"?: string;
+    /** JWK "x5u" (X.509 URL) Parameter */
+    x5u?: string;
+    /** JWK "kid" (Key ID) Parameter */
+    kid?: string;
+}
+/**
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", and "oct"
+ * key types are supported.
+ *
+ * @see {@link JWK_OKP_Public}
+ * @see {@link JWK_OKP_Private}
+ * @see {@link JWK_EC_Public}
+ * @see {@link JWK_EC_Private}
+ * @see {@link JWK_RSA_Public}
+ * @see {@link JWK_RSA_Private}
+ * @see {@link JWK_oct}
+ */
+interface JWK extends JWKParameters {
+    /**
+     * - EC JWK "crv" (Curve) Parameter
+     * - OKP JWK "crv" (The Subtype of Key Pair) Parameter
+     */
+    crv?: string;
+    /**
+     * - Private RSA JWK "d" (Private Exponent) Parameter
+     * - Private EC JWK "d" (ECC Private Key) Parameter
+     * - Private OKP JWK "d" (The Private Key) Parameter
+     */
+    d?: string;
+    /** Private RSA JWK "dp" (First Factor CRT Exponent) Parameter */
+    dp?: string;
+    /** Private RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
+    dq?: string;
+    /** RSA JWK "e" (Exponent) Parameter */
+    e?: string;
+    /** Oct JWK "k" (Key Value) Parameter */
+    k?: string;
+    /** RSA JWK "n" (Modulus) Parameter */
+    n?: string;
+    /** Private RSA JWK "p" (First Prime Factor) Parameter */
+    p?: string;
+    /** Private RSA JWK "q" (Second Prime Factor) Parameter */
+    q?: string;
+    /** Private RSA JWK "qi" (First CRT Coefficient) Parameter */
+    qi?: string;
+    /**
+     * - EC JWK "x" (X Coordinate) Parameter
+     * - OKP JWK "x" (The public key) Parameter
+     */
+    x?: string;
+    /** EC JWK "y" (Y Coordinate) Parameter */
+    y?: string;
+}
+
+export type { JWK as J };

package/dist/shared/unjwt.zb2wBNCJ.d.ts

@@ -0,0 +1,82 @@
+/**
+Based on https://github.com/panva/jose/tree/v6.0.10
+Copyright (c) 2018 Filip Skokan.
+https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
+ */
+/** Generic JSON Web Key Parameters. */
+interface JWKParameters {
+    /** JWK "kty" (Key Type) Parameter */
+    kty?: string;
+    /**
+     * JWK "alg" (Algorithm) Parameter
+     *
+     * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
+     */
+    alg?: string;
+    /** JWK "key_ops" (Key Operations) Parameter */
+    key_ops?: string[];
+    /** JWK "ext" (Extractable) Parameter */
+    ext?: boolean;
+    /** JWK "use" (Public Key Use) Parameter */
+    use?: string;
+    /** JWK "x5c" (X.509 Certificate Chain) Parameter */
+    x5c?: string[];
+    /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
+    x5t?: string;
+    /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
+    "x5t#S256"?: string;
+    /** JWK "x5u" (X.509 URL) Parameter */
+    x5u?: string;
+    /** JWK "kid" (Key ID) Parameter */
+    kid?: string;
+}
+/**
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", and "oct"
+ * key types are supported.
+ *
+ * @see {@link JWK_OKP_Public}
+ * @see {@link JWK_OKP_Private}
+ * @see {@link JWK_EC_Public}
+ * @see {@link JWK_EC_Private}
+ * @see {@link JWK_RSA_Public}
+ * @see {@link JWK_RSA_Private}
+ * @see {@link JWK_oct}
+ */
+interface JWK extends JWKParameters {
+    /**
+     * - EC JWK "crv" (Curve) Parameter
+     * - OKP JWK "crv" (The Subtype of Key Pair) Parameter
+     */
+    crv?: string;
+    /**
+     * - Private RSA JWK "d" (Private Exponent) Parameter
+     * - Private EC JWK "d" (ECC Private Key) Parameter
+     * - Private OKP JWK "d" (The Private Key) Parameter
+     */
+    d?: string;
+    /** Private RSA JWK "dp" (First Factor CRT Exponent) Parameter */
+    dp?: string;
+    /** Private RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
+    dq?: string;
+    /** RSA JWK "e" (Exponent) Parameter */
+    e?: string;
+    /** Oct JWK "k" (Key Value) Parameter */
+    k?: string;
+    /** RSA JWK "n" (Modulus) Parameter */
+    n?: string;
+    /** Private RSA JWK "p" (First Prime Factor) Parameter */
+    p?: string;
+    /** Private RSA JWK "q" (Second Prime Factor) Parameter */
+    q?: string;
+    /** Private RSA JWK "qi" (First CRT Coefficient) Parameter */
+    qi?: string;
+    /**
+     * - EC JWK "x" (X Coordinate) Parameter
+     * - OKP JWK "x" (The public key) Parameter
+     */
+    x?: string;
+    /** EC JWK "y" (Y Coordinate) Parameter */
+    y?: string;
+}
+
+export type { JWK as J };

package/package.json

@@ -1,70 +1,60 @@
 {
   "name": "unjwt",
-  "type": "module",
-  "version": "0.2.1",
-  "packageManager": "pnpm@8.6.12",
-  "description": "Easy creation and verification of JSON Web Tokens (JWT)",
-  "author": "Johann Schopplich <pkg@johannschopplich.com>",
+  "version": "0.4.0",
+  "description": "Low-level JWT utilities",
+  "repository": "sandros94/unjwt",
   "license": "MIT",
-  "homepage": "https://github.com/johannschopplich/unjwt#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/johannschopplich/unjwt.git"
-  },
-  "bugs": {
-    "url": "https://github.com/johannschopplich/unjwt/issues"
-  },
-  "keywords": [
-    "cloudflare",
-    "jwt",
-    "serverless",
-    "token",
-    "worker"
-  ],
   "sideEffects": false,
+  "type": "module",
+  "author": {
+    "name": "Sandro Circi",
+    "email": "sandro.circi@digitoolmedia.com"
+  },
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs"
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    },
+    "./jwe": {
+      "types": "./dist/jwe.d.mts",
+      "default": "./dist/jwe.mjs"
     },
-    "./crypto": {
-      "browser": "./dist/crypto/web.mjs",
-      "bun": "./dist/crypto/web.mjs",
-      "deno": "./dist/crypto/web.mjs",
-      "edge-light": "./dist/crypto/web.mjs",
-      "edge-routine": "./dist/crypto/web.mjs",
-      "lagon": "./dist/crypto/web.mjs",
-      "netlify": "./dist/crypto/web.mjs",
-      "react-native": "./dist/crypto/web.mjs",
-      "wintercg": "./dist/crypto/web.mjs",
-      "worker": "./dist/crypto/web.mjs",
-      "workerd": "./dist/crypto/web.mjs",
-      "node": {
-        "types": "./dist/crypto/node.d.ts",
-        "import": "./dist/crypto/node.mjs"
-      },
-      "types": "./dist/crypto/web.d.ts",
-      "import": "./dist/crypto/web.mjs"
+    "./jwk": {
+      "types": "./dist/jwk.d.mts",
+      "default": "./dist/jwk.mjs"
+    },
+    "./jws": {
+      "types": "./dist/jws.d.mts",
+      "default": "./dist/jws.mjs"
     }
   },
-  "types": "./dist/index.d.ts",
+  "main": "./dist/index.mjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
   "files": [
     "dist"
   ],
   "scripts": {
     "build": "unbuild",
-    "dev": "unbuild --stub",
-    "lint": "eslint .",
-    "lint:fix": "eslint . --fix",
-    "release": "bumpp --commit --push --tag",
-    "test:types": "tsc --noEmit"
+    "dev": "vitest dev",
+    "lint": "eslint . && prettier -c .",
+    "lint:fix": "automd && eslint . --fix && prettier -w .",
+    "prepack": "pnpm build",
+    "release": "pnpm test && pnpm prepack && changelogen --release --push --publish",
+    "test": "pnpm lint && pnpm test:types && vitest run --coverage",
+    "test:types": "tsc --noEmit --skipLibCheck"
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^0.40.2",
-    "@types/node": "^20.5.0",
-    "bumpp": "^9.1.1",
-    "eslint": "^8.47.0",
-    "typescript": "^5.1.6",
-    "unbuild": "^2.0.0-rc.0"
-  }
+    "@types/node": "^22.13.13",
+    "@vitest/coverage-v8": "^3.0.9",
+    "automd": "^0.4.0",
+    "changelogen": "^0.6.1",
+    "eslint": "^9.23.0",
+    "eslint-config-unjs": "^0.4.2",
+    "prettier": "^3.5.3",
+    "typescript": "^5.8.2",
+    "unbuild": "^3.5.0",
+    "vitest": "^3.0.9"
+  },
+  "packageManager": "pnpm@10.7.0"
 }

package/dist/crypto/node.d.mts

@@ -1,5 +0,0 @@
-declare const subtle: Crypto['subtle'];
-declare const randomUUID: Crypto['randomUUID'];
-declare const getRandomValues: Crypto['getRandomValues'];
-
-export { getRandomValues, randomUUID, subtle };

package/dist/crypto/node.d.ts

@@ -1,5 +0,0 @@
-declare const subtle: Crypto['subtle'];
-declare const randomUUID: Crypto['randomUUID'];
-declare const getRandomValues: Crypto['getRandomValues'];
-
-export { getRandomValues, randomUUID, subtle };

package/dist/crypto/node.mjs

@@ -1,11 +0,0 @@
-import nodeCrypto from 'node:crypto';
-
-const subtle = nodeCrypto.webcrypto?.subtle || {};
-const randomUUID = () => {
-  return nodeCrypto.randomUUID();
-};
-const getRandomValues = (array) => {
-  return nodeCrypto.webcrypto.getRandomValues(array);
-};
-
-export { getRandomValues, randomUUID, subtle };

package/dist/crypto/web.d.mts

@@ -1,5 +0,0 @@
-declare const subtle: Crypto['subtle'];
-declare const randomUUID: Crypto['randomUUID'];
-declare const getRandomValues: Crypto['getRandomValues'];
-
-export { getRandomValues, randomUUID, subtle };

package/dist/crypto/web.d.ts

@@ -1,5 +0,0 @@
-declare const subtle: Crypto['subtle'];
-declare const randomUUID: Crypto['randomUUID'];
-declare const getRandomValues: Crypto['getRandomValues'];
-
-export { getRandomValues, randomUUID, subtle };

package/dist/crypto/web.mjs

@@ -1,10 +0,0 @@
-const webCrypto = globalThis.crypto;
-const subtle = webCrypto.subtle;
-const randomUUID = () => {
-  return webCrypto.randomUUID();
-};
-const getRandomValues = (array) => {
-  return webCrypto.getRandomValues(array);
-};
-
-export { getRandomValues, randomUUID, subtle };