unjwt 0.5.16 → 0.5.17

package/dist/shared/unjwt.BZ3B0Ak8.mjs

@@ -1,395 +0,0 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.D1MC63Yb.mjs';
-import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
-import { c as checkKeyLength } from './unjwt.BpusjhPR.mjs';
-
-function lengthAndInput(input) {
-  return concatUint8Arrays(uint32be(input.length), input);
-}
-async function concatKdf(secret, bits, value) {
-  const iterations = Math.ceil((bits >> 3) / 32);
-  const res = new Uint8Array(iterations * 32);
-  for (let iter = 0; iter < iterations; iter++) {
-    const buf = new Uint8Array(4 + secret.length + value.length);
-    buf.set(uint32be(iter + 1));
-    buf.set(secret, 4);
-    buf.set(value, 4 + secret.length);
-    res.set(await digest("sha256", buf), iter * 32);
-  }
-  return res.slice(0, bits >> 3);
-}
-async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
-  checkEncCryptoKey(publicKey, "ECDH");
-  checkEncCryptoKey(privateKey, "ECDH", "deriveBits");
-  const value = concatUint8Arrays(
-    lengthAndInput(textEncoder.encode(algorithm)),
-    lengthAndInput(apu),
-    lengthAndInput(apv),
-    uint32be(keyLength)
-  );
-  const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(
-    Number.parseInt(
-      publicKey.algorithm.namedCurve.slice(-3),
-      10
-    ) / 8
-  ) << 3;
-  const sharedSecret = new Uint8Array(
-    await crypto.subtle.deriveBits(
-      {
-        name: publicKey.algorithm.name,
-        public: publicKey
-      },
-      privateKey,
-      length
-    )
-  );
-  return concatKdf(sharedSecret, keyLength, value);
-}
-function allowed(key) {
-  switch (key.algorithm.namedCurve) {
-    case "P-256":
-    case "P-384":
-    case "P-521": {
-      return true;
-    }
-    default: {
-      return key.algorithm.name === "X25519";
-    }
-  }
-}
-async function digest(algorithm, data) {
-  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
-  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
-}
-
-const subtleAlgorithm = (alg) => {
-  switch (alg) {
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      return "RSA-OAEP";
-    }
-    default: {
-      throw new Error(
-        `alg ${alg} is not supported either by JOSE or your javascript runtime`
-      );
-    }
-  }
-};
-async function encryptRSAES(alg, key, cek) {
-  checkEncCryptoKey(key, alg, "encrypt");
-  checkKeyLength(alg, key);
-  return new Uint8Array(
-    await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek)
-  );
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/encrypt_key_management.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
-  let encryptedKey;
-  let parameters = {};
-  let cek;
-  switch (alg) {
-    case "dir": {
-      cek = key;
-      break;
-    }
-    case "ECDH-ES":
-    case "ECDH-ES+A128KW":
-    case "ECDH-ES+A192KW":
-    case "ECDH-ES+A256KW": {
-      assertCryptoKey(key);
-      if (!allowed(key)) {
-        throw new Error(
-          "ECDH with the provided key is not allowed or not supported by your javascript runtime"
-        );
-      }
-      const { apu, apv } = providedParameters;
-      const ephemeralKey = providedParameters.epk ? await normalizeKey(providedParameters.epk, alg) : (await crypto.subtle.generateKey(
-        key.algorithm,
-        true,
-        ["deriveBits"]
-      )).privateKey;
-      const { x, y, crv, kty } = await keyToJWK(ephemeralKey);
-      const sharedSecret = await deriveECDHESKey(
-        key,
-        ephemeralKey,
-        alg === "ECDH-ES" ? enc : alg,
-        alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10),
-        apu,
-        apv
-      );
-      parameters = { epk: { x, y, crv, kty } };
-      if (apu) parameters.apu = base64UrlEncode(apu);
-      if (apv) parameters.apv = base64UrlEncode(apv);
-      if (alg === "ECDH-ES") {
-        cek = sharedSecret;
-        break;
-      }
-      cek = providedCek || generateCEK(enc);
-      const kwAlg = alg.slice(-6);
-      encryptedKey = (await wrap(kwAlg, sharedSecret, cek)).encryptedKey;
-      break;
-    }
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      cek = providedCek || generateCEK(enc);
-      assertCryptoKey(key);
-      encryptedKey = await encryptRSAES(alg, key, cek);
-      break;
-    }
-    case "PBES2-HS256+A128KW":
-    case "PBES2-HS384+A192KW":
-    case "PBES2-HS512+A256KW": {
-      cek = providedCek || generateCEK(enc);
-      const { p2c, p2s } = providedParameters;
-      ({ encryptedKey, ...parameters } = await wrap(alg, key, cek, p2c, p2s));
-      break;
-    }
-    case "A128KW":
-    case "A192KW":
-    case "A256KW": {
-      cek = providedCek || generateCEK(enc);
-      encryptedKey = (await wrap(alg, key, cek)).encryptedKey;
-      break;
-    }
-    case "A128GCMKW":
-    case "A192GCMKW":
-    case "A256GCMKW": {
-      cek = providedCek || generateCEK(enc);
-      const { iv } = providedParameters;
-      ({ encryptedKey, ...parameters } = await encryptIV(alg, key, cek, iv));
-      break;
-    }
-    default: {
-      throw new Error(
-        'Invalid or unsupported "alg" (JWE Algorithm) header value'
-      );
-    }
-  }
-  return { cek, encryptedKey, parameters };
-}
-async function normalizeKey(key, alg) {
-  if (key instanceof Uint8Array) {
-    return key;
-  }
-  if (isCryptoKey(key)) {
-    return key;
-  }
-  if (isJWK(key)) {
-    const safeJwk = sanitizeObject(key);
-    if ("k" in safeJwk && safeJwk.k) {
-      return base64UrlDecode(safeJwk.k, false);
-    }
-    return jwkTokey({ ...safeJwk, alg });
-  }
-  throw new Error("unreachable");
-}
-
-async function encrypt(payload, key, options = {}) {
-  const {
-    protectedHeader: additionalProtectedHeader,
-    cek: providedCek,
-    contentEncryptionIV: providedContentIV,
-    keyManagementIV,
-    p2s = randomBytes(16),
-    p2c = 2048,
-    ecdhPartyUInfo,
-    ecdhPartyVInfo
-  } = options;
-  let { alg, enc } = options;
-  if (!alg) {
-    if (typeof key === "string" || key instanceof Uint8Array) {
-      alg = "PBES2-HS256+A128KW";
-    } else if (isJWK(key)) {
-      alg = key.alg;
-    }
-  }
-  if (!alg) {
-    throw new TypeError(
-      'JWE "alg" (Key Management Algorithm) must be provided in options or inferable from the key'
-    );
-  }
-  if (!enc) {
-    enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
-  }
-  const jweKeyManagementParams = {};
-  if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
-  if (p2s) jweKeyManagementParams.p2s = p2s;
-  if (p2c) jweKeyManagementParams.p2c = p2c;
-  if (ecdhPartyUInfo) jweKeyManagementParams.apu = ecdhPartyUInfo;
-  if (ecdhPartyVInfo) jweKeyManagementParams.apv = ecdhPartyVInfo;
-  if (additionalProtectedHeader?.epk instanceof CryptoKey) {
-    jweKeyManagementParams.epk = additionalProtectedHeader.epk;
-  }
-  const wrappingKeyMaterial = await importKey(key, alg);
-  const {
-    cek: finalCek,
-    // This is the CEK (CryptoKey | Uint8Array) to be used for content encryption
-    encryptedKey: jweEncryptedKey,
-    // This is the JWE Encrypted Key (Uint8Array | undefined)
-    parameters: keyManagementHeaderParams
-    // JWE header params from key encryption (e.g., epk, p2s, iv, tag)
-  } = await encryptKey(
-    alg,
-    enc,
-    wrappingKeyMaterial,
-    providedCek,
-    jweKeyManagementParams
-  );
-  const baseProtectedHeader = { ...additionalProtectedHeader };
-  delete baseProtectedHeader.alg;
-  delete baseProtectedHeader.enc;
-  const jweProtectedHeader = sanitizeObject({
-    ...baseProtectedHeader,
-    ...keyManagementHeaderParams,
-    alg,
-    enc
-  });
-  const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
-  const computedPayload = computeJwtTimeClaims(
-    payload,
-    protectedHeader.typ,
-    options.expiresIn,
-    options.currentDate
-  );
-  const plaintextBytes = getPlaintextBytes(computedPayload || payload);
-  const protectedHeaderSerialized = JSON.stringify(protectedHeader);
-  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
-  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
-  const contentIVBytes = providedContentIV ?? generateIV(enc);
-  const {
-    ciphertext: contentCiphertext,
-    tag: contentAuthTag,
-    iv: actualContentIV
-  } = await encrypt$1(
-    enc,
-    plaintextBytes,
-    finalCek,
-    contentIVBytes,
-    aadBytes
-  );
-  if (!actualContentIV) {
-    throw new Error("Content encryption IV was not generated or returned.");
-  }
-  if (!contentAuthTag) {
-    throw new Error(
-      "Content encryption auth tag was not generated or returned."
-    );
-  }
-  const encryptedKeyEncoded = jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "";
-  const jweParts = [
-    protectedHeaderEncoded,
-    encryptedKeyEncoded,
-    base64UrlEncode(actualContentIV),
-    base64UrlEncode(contentCiphertext),
-    base64UrlEncode(contentAuthTag)
-  ];
-  return jweParts.join(".");
-}
-async function decrypt(jwe, key, options = {}) {
-  const parts = jwe.split(".");
-  if (parts.length !== 5) {
-    throw new Error(
-      "Invalid JWE: Must contain five sections (RFC7516, section-3)."
-    );
-  }
-  const [
-    protectedHeaderEncoded,
-    encryptedKeyEncoded,
-    ivEncoded,
-    ciphertextEncoded,
-    authTagEncoded
-  ] = parts;
-  let protectedHeader;
-  try {
-    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = sanitizeObject(
-      JSON.parse(protectedHeaderJson)
-    );
-  } catch (error_) {
-    throw new Error(
-      `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
-    );
-  }
-  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) {
-    throw new Error(
-      'Invalid JWE: Protected header must be an object with "alg" and "enc" properties.'
-    );
-  }
-  const alg = protectedHeader.alg;
-  const enc = protectedHeader.enc;
-  if (options?.algorithms && !options.algorithms.includes(alg)) {
-    throw new Error(`Key management algorithm not allowed: ${alg}`);
-  }
-  if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
-    throw new Error(`Content encryption algorithm not allowed: ${enc}`);
-  }
-  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
-  const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
-  const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
-  const contentIVBytes = base64UrlDecode(ivEncoded, false);
-  const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
-  const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
-  const unwrapKeyOpts = {
-    iv: protectedHeader.iv,
-    tag: protectedHeader.tag,
-    p2s: protectedHeader.p2s,
-    p2c: protectedHeader.p2c,
-    epk: protectedHeader.epk,
-    apu: protectedHeader.apu,
-    apv: protectedHeader.apv,
-    unwrappedKeyAlgorithm: options?.unwrappedKeyAlgorithm,
-    keyUsage: options?.keyUsage,
-    extractable: options?.extractable,
-    returnAs: false
-    // Returning CEK as Uint8Array<ArrayBuffer>
-  };
-  const cekBytes = await unwrapKey(
-    alg,
-    encryptedKeyBytes,
-    unwrappingKey,
-    unwrapKeyOpts
-  );
-  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
-  const plaintextBytes = await decrypt$1(
-    enc,
-    cekBytes,
-    ciphertextBytes,
-    contentIVBytes,
-    contentAuthTagBytes,
-    aadBytes
-  );
-  const payload = decodePayloadFromBytes(
-    plaintextBytes,
-    protectedHeader,
-    options?.forceUint8Array
-  );
-  validateCriticalHeadersJWE(protectedHeader, [
-    ...options?.critical || [],
-    ...options?.requiredHeaders || []
-  ]);
-  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
-    validateJwtClaims(payload, options);
-  }
-  return {
-    payload,
-    protectedHeader,
-    cek: cekBytes,
-    aad: aadBytes
-  };
-}
-
-const jwe = {
-  __proto__: null,
-  decrypt: decrypt,
-  encrypt: encrypt
-};
-
-export { decrypt as d, encrypt as e, jwe as j };

package/dist/shared/unjwt.BpusjhPR.mjs

@@ -1,101 +0,0 @@
-import { c as checkSigCryptoKey } from './unjwt.D1MC63Yb.mjs';
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/sign.ts
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/verify.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-async function sign(alg, key, data) {
-  const cryptoKey = await getSignVerifyKey(alg, key, "sign");
-  checkKeyLength(alg, cryptoKey);
-  const signature = await crypto.subtle.sign(
-    subtleAlgorithm(alg, cryptoKey.algorithm),
-    cryptoKey,
-    data
-  );
-  return new Uint8Array(signature);
-}
-async function verify(alg, key, signature, data) {
-  const cryptoKey = await getSignVerifyKey(alg, key, "verify");
-  checkKeyLength(alg, cryptoKey);
-  const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
-  try {
-    return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
-  } catch {
-    return false;
-  }
-}
-function checkKeyLength(alg, key) {
-  if (alg.startsWith("RS") || alg.startsWith("PS")) {
-    const { modulusLength } = key.algorithm;
-    if (typeof modulusLength !== "number" || modulusLength < 2048) {
-      throw new TypeError(
-        `${alg} requires key modulusLength to be 2048 bits or larger`
-      );
-    }
-  }
-}
-async function getSignVerifyKey(alg, key, usage) {
-  if (key instanceof Uint8Array) {
-    if (!alg.startsWith("HS")) {
-      throw new TypeError(
-        `Key must be ${key} of type: CryptoKey or JSON Web Key`
-      );
-    }
-    return crypto.subtle.importKey(
-      "raw",
-      key,
-      { hash: `SHA-${alg.slice(-3)}`, name: "HMAC" },
-      false,
-      [usage]
-    );
-  }
-  checkSigCryptoKey(key, alg, usage);
-  return key;
-}
-function subtleAlgorithm(alg, algorithm) {
-  const hash = `SHA-${alg.slice(-3)}`;
-  switch (alg) {
-    case "HS256":
-    case "HS384":
-    case "HS512": {
-      return { hash, name: "HMAC" };
-    }
-    case "PS256":
-    case "PS384":
-    case "PS512": {
-      return {
-        hash,
-        name: "RSA-PSS",
-        saltLength: Number.parseInt(alg.slice(-3), 10) >> 3
-      };
-    }
-    case "RS256":
-    case "RS384":
-    case "RS512": {
-      return { hash, name: "RSASSA-PKCS1-v1_5" };
-    }
-    case "ES256":
-    case "ES384":
-    case "ES512": {
-      return {
-        hash,
-        name: "ECDSA",
-        namedCurve: algorithm.namedCurve
-      };
-    }
-    case "Ed25519":
-    // Fall through
-    case "EdDSA": {
-      return { name: "Ed25519" };
-    }
-    default: {
-      throw new Error(
-        `alg ${alg} is not supported either by JOSE or your javascript runtime`
-      );
-    }
-  }
-}
-
-export { checkKeyLength as c, sign as s, verify as v };