unjwt 0.5.0 → 0.5.2

package/dist/shared/{unjwt.DKq5VF7t.mjs → unjwt.ZsOShfhX.mjs}

@@ -1,4 +1,4 @@
-import { g as isCryptoKey, e as concatUint8Arrays, b as base64UrlEncode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode } from './unjwt.CjHZv3F3.mjs';
+import { g as isCryptoKey, e as concatUint8Arrays, b as base64UrlEncode, h as base64Decode, j as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode } from './unjwt.DOI5UE8K.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -113,7 +113,7 @@ function isAlgorithm(algorithm, name) {
 function getHashLength(hash) {
   return Number.parseInt(hash.name.slice(4), 10);
 }
-function getNamedCurve(alg) {
+function getNamedCurve$1(alg) {
   switch (alg) {
     case "ES256": {
       return "P-256";
@@ -182,7 +182,7 @@ function checkSigCryptoKey(key, alg, usage) {
     case "ES512": {
       if (!isAlgorithm(key.algorithm, "ECDSA"))
         throw unusable("ECDSA");
-      const expected = getNamedCurve(alg);
+      const expected = getNamedCurve$1(alg);
       const actual = key.algorithm.namedCurve;
       if (actual !== expected) throw unusable(expected, "algorithm.namedCurve");
       break;
@@ -511,6 +511,251 @@ async function decryptIV(alg, key, encryptedKey, iv, tag) {
   return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
 }
 
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/asn1.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+const formatPEM = (b64, descriptor) => {
+  const newlined = (b64.match(/.{1,64}/g) || []).join("\n");
+  return `-----BEGIN ${descriptor}-----
+${newlined}
+-----END ${descriptor}-----`;
+};
+const genericExport = async (keyType, keyFormat, key) => {
+  if (!isCryptoKey(key)) {
+    throw new TypeError(`Key must be ${key} of type CryptoKey`);
+  }
+  if (!key.extractable) {
+    throw new TypeError("CryptoKey is not extractable");
+  }
+  if (key.type !== keyType) {
+    throw new TypeError(`key is not a ${keyType} key`);
+  }
+  return formatPEM(
+    base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))),
+    `${keyType.toUpperCase()} KEY`
+  );
+};
+const toSPKI = (key) => {
+  return genericExport("public", "spki", key);
+};
+const toPKCS8 = (key) => {
+  return genericExport("private", "pkcs8", key);
+};
+const findOid = (keyData, oid, from = 0) => {
+  if (from === 0) {
+    oid.unshift(oid.length);
+    oid.unshift(6);
+  }
+  const i = keyData.indexOf(oid[0], from);
+  if (i === -1) return false;
+  const sub = keyData.subarray(i, i + oid.length);
+  if (sub.length !== oid.length) return false;
+  return sub.every((value, index) => value === oid[index]) || findOid(keyData, oid, i + 1);
+};
+const getNamedCurve = (keyData) => {
+  switch (true) {
+    case findOid(keyData, [42, 134, 72, 206, 61, 3, 1, 7]): {
+      return "P-256";
+    }
+    case findOid(keyData, [43, 129, 4, 0, 34]): {
+      return "P-384";
+    }
+    case findOid(keyData, [43, 129, 4, 0, 35]): {
+      return "P-521";
+    }
+    default: {
+      return void 0;
+    }
+  }
+};
+const genericImport = async (replace, keyFormat, pem, alg, options) => {
+  let algorithm;
+  let keyUsages;
+  const cleanedPem = pem.replace(replace, "");
+  const keyData = base64Decode(cleanedPem, false);
+  const isPublic = keyFormat === "spki";
+  switch (alg) {
+    case "PS256":
+    case "PS384":
+    case "PS512": {
+      algorithm = { name: "RSA-PSS", hash: `SHA-${alg.slice(-3)}` };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "RS256":
+    case "RS384":
+    case "RS512": {
+      algorithm = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${alg.slice(-3)}` };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      algorithm = {
+        name: "RSA-OAEP",
+        hash: `SHA-${Number.parseInt(alg.slice(-3), 10) || 1}`
+      };
+      keyUsages = isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+      break;
+    }
+    case "ES256": {
+      algorithm = { name: "ECDSA", namedCurve: "P-256" };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "ES384": {
+      algorithm = { name: "ECDSA", namedCurve: "P-384" };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "ES512": {
+      algorithm = { name: "ECDSA", namedCurve: "P-521" };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      const namedCurve = getNamedCurve(keyData);
+      algorithm = namedCurve?.startsWith("P-") ? { name: "ECDH", namedCurve } : { name: "X25519" };
+      keyUsages = isPublic ? [] : ["deriveBits"];
+      break;
+    }
+    case "Ed25519":
+    case "EdDSA": {
+      algorithm = { name: "Ed25519" };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    default: {
+      throw new Error('Invalid or unsupported "alg" (Algorithm) value');
+    }
+  }
+  return crypto.subtle.importKey(
+    keyFormat,
+    keyData,
+    algorithm,
+    options?.extractable ?? (isPublic ? true : false),
+    keyUsages
+  );
+};
+const fromPKCS8 = (pem, alg, options) => {
+  return genericImport(
+    /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,
+    "pkcs8",
+    pem,
+    alg,
+    options
+  );
+};
+const fromSPKI = (pem, alg, options) => {
+  return genericImport(
+    /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g,
+    "spki",
+    pem,
+    alg,
+    options
+  );
+};
+function getElement(seq) {
+  const result = [];
+  let next = 0;
+  while (next < seq.length) {
+    const nextPart = parseElement(seq.subarray(next));
+    result.push(nextPart);
+    next += nextPart.byteLength;
+  }
+  return result;
+}
+function parseElement(bytes) {
+  let position = 0;
+  let tag = bytes[0] & 31;
+  position++;
+  if (tag === 31) {
+    tag = 0;
+    while (bytes[position] >= 128) {
+      tag = tag * 128 + bytes[position] - 128;
+      position++;
+    }
+    tag = tag * 128 + bytes[position] - 128;
+    position++;
+  }
+  let length = 0;
+  if (bytes[position] < 128) {
+    length = bytes[position];
+    position++;
+  } else if (length === 128) {
+    length = 0;
+    while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+      if (length > bytes.byteLength) {
+        throw new TypeError("invalid indefinite form length");
+      }
+      length++;
+    }
+    const byteLength2 = position + length + 2;
+    return {
+      byteLength: byteLength2,
+      contents: bytes.subarray(position, position + length),
+      raw: bytes.subarray(0, byteLength2)
+    };
+  } else {
+    const numberOfDigits = bytes[position] & 127;
+    position++;
+    length = 0;
+    for (let i = 0; i < numberOfDigits; i++) {
+      length = length * 256 + bytes[position];
+      position++;
+    }
+  }
+  const byteLength = position + length;
+  return {
+    byteLength,
+    contents: bytes.subarray(position, byteLength),
+    raw: bytes.subarray(0, byteLength)
+  };
+}
+function spkiFromX509(buf) {
+  const tbsCertificate = getElement(
+    getElement(parseElement(buf).contents)[0].contents
+  );
+  return base64Encode(
+    tbsCertificate[tbsCertificate[0].raw[0] === 160 ? 6 : 5].raw
+  );
+}
+let createPublicKey;
+function getSPKI(x509) {
+  try {
+    createPublicKey ??= globalThis.process?.getBuiltinModule?.("node:crypto")?.createPublicKey;
+  } catch {
+    createPublicKey = 0;
+  }
+  if (createPublicKey) {
+    try {
+      return new createPublicKey(x509).export({ format: "pem", type: "spki" });
+    } catch {
+    }
+  }
+  const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, "");
+  const raw = base64Decode(pem, false);
+  return formatPEM(spkiFromX509(raw), "PUBLIC KEY");
+}
+const fromX509 = (pem, alg, options) => {
+  let spki;
+  try {
+    spki = getSPKI(pem);
+  } catch (error_) {
+    throw new TypeError("Failed to parse the X.509 certificate", {
+      cause: error_
+    });
+  }
+  return fromSPKI(spki, alg, options);
+};
+
 /**
  * This is a fork of Jose library's utility functions.
  * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/jwt_to_key.ts
@@ -1064,6 +1309,80 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
   );
   return finalKey;
 }
+async function importJWKFromPEM(pem, pemType, alg, importOptions, jwkExtras) {
+  let cryptoKey;
+  const defaultExtractable = importOptions?.extractable !== false;
+  switch (pemType) {
+    case "pkcs8": {
+      cryptoKey = await fromPKCS8(pem, alg, {
+        ...importOptions,
+        extractable: defaultExtractable
+      });
+      break;
+    }
+    case "spki": {
+      cryptoKey = await fromSPKI(pem, alg, {
+        ...importOptions,
+        extractable: defaultExtractable
+      });
+      break;
+    }
+    case "x509": {
+      cryptoKey = await fromX509(pem, alg, {
+        ...importOptions,
+        extractable: defaultExtractable
+      });
+      break;
+    }
+    default: {
+      throw new TypeError(`Unsupported PEM type: ${pemType}`);
+    }
+  }
+  const finalJWKExtras = { alg, ...jwkExtras };
+  return exportKey(cryptoKey, finalJWKExtras);
+}
+async function exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport) {
+  if (jwk.kty === "oct") {
+    throw new TypeError(
+      "Octet (symmetric) JWKs (kty: 'oct') cannot be exported to PKCS8 or SPKI PEM formats."
+    );
+  }
+  const effectiveAlg = jwk.alg || algForCryptoKeyImport;
+  if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) {
+    throw new TypeError(
+      "Algorithm (alg) must be provided in the JWK or as a parameter for converting this JWK type to a CryptoKey."
+    );
+  }
+  const jwkForImport = { ...jwk, ext: true };
+  const cryptoKeyCandidate = await importKey(jwkForImport, effectiveAlg);
+  if (!isCryptoKey(cryptoKeyCandidate)) {
+    throw new Error(
+      "Failed to convert JWK to a CryptoKey instance suitable for PEM export."
+    );
+  }
+  const cryptoKey = cryptoKeyCandidate;
+  switch (pemFormat) {
+    case "pkcs8": {
+      if (cryptoKey.type !== "private") {
+        throw new TypeError(
+          `Only 'private' type CryptoKeys can be exported to PKCS8 PEM format. Key type is '${cryptoKey.type}'.`
+        );
+      }
+      return toPKCS8(cryptoKey);
+    }
+    case "spki": {
+      if (cryptoKey.type !== "public") {
+        throw new TypeError(
+          `Only 'public' type CryptoKeys can be exported to SPKI PEM format. Key type is '${cryptoKey.type}'.`
+        );
+      }
+      return toSPKI(cryptoKey);
+    }
+    default: {
+      throw new TypeError(`Unsupported PEM format: ${pemFormat}`);
+    }
+  }
+}
 function getGenerateKeyParams(alg, options) {
   let algorithm;
   let keyUsages;
@@ -1176,11 +1495,13 @@ function getGenerateKeyParams(alg, options) {
 const jwk = {
   __proto__: null,
   deriveKeyFromPassword: deriveKeyFromPassword,
+  exportJWKToPEM: exportJWKToPEM,
   exportKey: exportKey,
   generateKey: generateKey,
+  importJWKFromPEM: importJWKFromPEM,
   importKey: importKey,
   unwrapKey: unwrapKey,
   wrapKey: wrapKey
 };
 
-export { checkEncCryptoKey as a, bitLengthCEK as b, checkSigCryptoKey as c, jwkTokey as d, encryptIV as e, generateIV as f, generateCEK as g, encrypt as h, importKey as i, jwk as j, keyToJWK as k, unwrapKey as l, decrypt as m, generateKey as n, deriveKeyFromPassword as o, exportKey as p, wrapKey as q, uint32be as u, wrap as w };
+export { checkEncCryptoKey as a, bitLengthCEK as b, checkSigCryptoKey as c, jwkTokey as d, encryptIV as e, generateIV as f, generateCEK as g, encrypt as h, importKey as i, jwk as j, keyToJWK as k, unwrapKey as l, decrypt as m, generateKey as n, deriveKeyFromPassword as o, exportKey as p, wrapKey as q, importJWKFromPEM as r, exportJWKToPEM as s, uint32be as u, wrap as w };

package/dist/shared/{unjwt.DYFIh1YE.d.mts → unjwt.kiNPBQh0.d.mts}

@@ -1,5 +1,5 @@
-import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.C0bBN0AC.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.D90BbcE1.mjs';
+import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.CxhGjEAX.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.Cd9nTEWg.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -43,10 +43,63 @@ interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
 interface JWSVerifyOptions {
     /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
     algorithms?: JWSAlgorithm[];
-    /** List of critical header parameters that must be understood and processed. */
-    critical?: string[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
+    /**
+     * Expected JWT "aud" (Audience) Claim value(s).
+     *
+     * This option makes the JWT "aud" (Audience) Claim presence required.
+     */
+    audience?: string | string[];
+    /**
+     * Clock skew tolerance (in seconds) for validating JWT claims.
+     *
+     * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
+     * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
+     */
+    clockTolerance?: number;
+    /**
+     * Expected JWT "iss" (Issuer) Claim value(s).
+     *
+     * This option makes the JWT "iss" (Issuer) Claim presence required.
+     */
+    issuer?: string | string[];
+    /**
+     * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
+     *
+     * This option makes the JWT "iat" (Issued At) Claim presence required.
+     */
+    maxTokenAge?: number;
+    /**
+     * Expected JWT "sub" (Subject) Claim value.
+     *
+     * This option makes the JWT "sub" (Subject) Claim presence required.
+     */
+    subject?: string;
+    /**
+     * Expected JWT "typ" (Type) Header Parameter value.
+     *
+     * This option makes the JWT "typ" (Type) Header Parameter presence required.
+     */
+    typ?: string;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /**
+     * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
+     * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
+     * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
+     * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
+     * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
+     * present.
+     */
+    requiredClaims?: string[];
+    /**
+     * List of critical header parameters that must be understood and processed.
+     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+     */
+    critical?: string[];
 }
 
 /**

package/dist/shared/{unjwt.sux3_Z19.mjs → unjwt.z_U3fRJ-.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.DKq5VF7t.mjs';
+import { c as checkSigCryptoKey } from './unjwt.ZsOShfhX.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.C0bBN0AC.mjs';
-export { f as assertCryptoKey, c as base64UrlDecode, b as base64UrlEncode, d as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, e as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.CJ_ohCFC.mjs';
+import './shared/unjwt.CxhGjEAX.mjs';
+export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.BJEchXrM.mjs';

package/dist/utils.d.ts

@@ -1,2 +1,2 @@
-import './shared/unjwt.C0bBN0AC.js';
-export { f as assertCryptoKey, c as base64UrlDecode, b as base64UrlEncode, d as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, e as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.mc4AEAT7.js';
+import './shared/unjwt.CxhGjEAX.js';
+export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.B5N3dPN9.js';

package/dist/utils.mjs

@@ -1 +1 @@
-export { f as assertCryptoKey, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, a as isJWK, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.CjHZv3F3.mjs';
+export { f as assertCryptoKey, h as base64Decode, j as base64Encode, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, k as isCryptoKeyPair, a as isJWK, m as maybeArray, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.DOI5UE8K.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",