unjwt 0.5.38 → 0.5.40

package/dist/_chunks/jwe.d.mts

@@ -0,0 +1,43 @@
+import { $ as JWK_Private, A as JWK, B as JWK_Asymmetric_Algorithm, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWK_AES_CBC_HMAC, G as JWK_EC_Public, H as JWK_ECDH_ES, I as JWK_AES_GCM, J as JWK_OKP_Private, K as JWK_HMAC, L as JWK_AES_GCM_KW, M as JWKPEMAlgorithm, N as JWKParameters, O as GenerateKeyOptions, P as JWKSet, Q as JWK_Pair, R as JWK_AES_KW, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_ECDSA, V as JWK_EC, W as JWK_EC_Private, X as JWK_OKP_SIGN, Y as JWK_OKP_Public, Z as JWK_PBES2, _ as JWT, a as JWEEncryptOptions, at as JWK_RSA_Public, b as JoseHeaderParameters, c as JWEKeyManagementHeaderParameters, ct as JWK_Symmetric_Algorithm, dt as UnwrapKeyOptions, et as JWK_Public, ft as WrapKeyOptions, i as JWEDecryptResult, it as JWK_RSA_Private, j as JWKAlgorithm, k as GenerateKeyReturn, lt as JWK_oct, nt as JWK_RSA_ENC, o as JWEHeaderParameters, ot as JWK_RSA_SIGN, pt as WrapKeyResult, q as JWK_OKP, r as JWEDecryptOptions, rt as JWK_RSA_PSS, s as JWEKeyLookupFunction, st as JWK_Symmetric, tt as JWK_RSA, ut as KeyManagementAlgorithm, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_Asymmetric } from "./index.mjs";
+
+//#region src/core/jwe.d.ts
+declare namespace jwe_d_exports {
+  export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, decrypt, encrypt };
+}
+/**
+* Encrypts a payload to produce a JWE Compact Serialization string.
+*
+* @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
+* @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
+* @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
+* @returns A Promise resolving to the JWE Compact Serialization string.
+*/
+declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
+  alg: KeyManagementAlgorithm;
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
+  alg: KeyManagementAlgorithm;
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
+  alg: KeyManagementAlgorithm;
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+/**
+* Decrypts a JWE Compact Serialization string.
+*
+* @param jwe The JWE Compact Serialization string.
+* @param key The key decryption key (KEK) or a function to look up the key.
+* @param options JWE decryption options.
+* @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
+* @throws If JWE is invalid, decryption fails, or options are not met.
+*/
+declare function decrypt<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jwe: string, key: CryptoKey | JWK_Symmetric | JWK_Private | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWK_Symmetric | JWK_Private | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options: JWEDecryptOptions & {
+  forceUint8Array: true;
+}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
+//#endregion
+export { encrypt as n, jwe_d_exports as r, decrypt as t };

package/dist/_chunks/jwe.mjs

@@ -0,0 +1,132 @@
+import { t as __exportAll } from "./chunk.mjs";
+import { A as validateCriticalHeadersJWE, C as computeJwtTimeClaims, D as decodePayloadFromBytes, M as validateJwtClaims, O as getPlaintextBytes, a as base64UrlEncode, b as sanitizeObject, c as isCryptoKey, g as randomBytes, i as base64UrlDecode, l as isCryptoKeyPair, u as isJWK, v as textEncoder, x as applyTypCtyDefaults } from "./utils.mjs";
+import { d as unwrapKey, g as generateIV, h as encrypt$1, l as importKey, m as decrypt$1, p as encryptKey } from "./jwk.mjs";
+//#region src/core/jwe.ts
+var jwe_exports = /* @__PURE__ */ __exportAll({
+	decrypt: () => decrypt,
+	encrypt: () => encrypt
+});
+async function encrypt(payload, key, options = {}) {
+	const { protectedHeader: additionalProtectedHeader, cek: providedCek, contentEncryptionIV: providedContentIV, keyManagementIV, p2s, p2c, ecdh } = options;
+	let { alg, enc } = options;
+	if (!alg) {
+		if (typeof key === "string" || key instanceof Uint8Array) alg = "PBES2-HS256+A128KW";
+		else if (isJWK(key)) alg = key.alg === "A128GCM" || key.alg === "A192GCM" || key.alg === "A256GCM" ? `${key.alg}KW` : key.alg;
+	}
+	if (!alg) throw new TypeError("JWE \"alg\" (Key Management Algorithm) must be provided in options or inferable from the key");
+	if (!enc) enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+	const jweKeyManagementParams = {};
+	if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
+	if (p2s) jweKeyManagementParams.p2s = p2s;
+	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2s = randomBytes(16);
+	if (p2c) jweKeyManagementParams.p2c = p2c;
+	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2c = 2048;
+	if (ecdh?.partyUInfo) jweKeyManagementParams.apu = ecdh.partyUInfo;
+	if (ecdh?.partyVInfo) jweKeyManagementParams.apv = ecdh.partyVInfo;
+	if (ecdh?.ephemeralKey) {
+		const { epk, epkPrivateKey } = parseEphemeralKey(ecdh.ephemeralKey);
+		jweKeyManagementParams.epk = epk;
+		jweKeyManagementParams.epkPrivateKey = epkPrivateKey;
+	}
+	const wrappingKeyMaterial = await importKey(key, alg);
+	const { cek: finalCek, encryptedKey: jweEncryptedKey, parameters: keyManagementHeaderParams } = await encryptKey(alg, enc, wrappingKeyMaterial, providedCek, jweKeyManagementParams);
+	const jweProtectedHeader = {
+		...additionalProtectedHeader,
+		...keyManagementHeaderParams,
+		alg,
+		enc
+	};
+	if (isJWK(key) && key.kid) jweProtectedHeader.kid = key.kid;
+	const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
+	const plaintextBytes = getPlaintextBytes(computeJwtTimeClaims(payload, protectedHeader.typ, options.expiresIn, options.currentDate) || payload);
+	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
+	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+	const contentIVBytes = providedContentIV ?? generateIV(enc);
+	const { ciphertext: contentCiphertext, tag: contentAuthTag, iv: actualContentIV } = await encrypt$1(enc, plaintextBytes, finalCek, contentIVBytes, aadBytes);
+	if (!actualContentIV) throw new Error("Content encryption IV was not generated or returned.");
+	if (!contentAuthTag) throw new Error("Content encryption auth tag was not generated or returned.");
+	return [
+		protectedHeaderEncoded,
+		jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "",
+		base64UrlEncode(actualContentIV),
+		base64UrlEncode(contentCiphertext),
+		base64UrlEncode(contentAuthTag)
+	].join(".");
+}
+async function decrypt(jwe, key, options = {}) {
+	const parts = jwe.split(".");
+	if (parts.length !== 5) throw new Error("Invalid JWE: Must contain five sections (RFC7516, section-3).");
+	const [protectedHeaderEncoded, encryptedKeyEncoded, ivEncoded, ciphertextEncoded, authTagEncoded] = parts;
+	let protectedHeader;
+	try {
+		const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
+		protectedHeader = sanitizeObject(JSON.parse(protectedHeaderJson));
+	} catch {
+		throw new Error("Invalid JWE: Protected header could not be decoded.");
+	}
+	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) throw new Error("Invalid JWE: Protected header must be an object with \"alg\" and \"enc\" properties.");
+	const alg = protectedHeader.alg;
+	const enc = protectedHeader.enc;
+	if (options?.algorithms && !options.algorithms.includes(alg)) throw new Error(`Key management algorithm not allowed: ${alg}`);
+	if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) throw new Error(`Content encryption algorithm not allowed: ${enc}`);
+	const unwrappingKey = await importKey(typeof key === "function" ? await key(protectedHeader, jwe) : key, alg);
+	const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
+	const contentIVBytes = base64UrlDecode(ivEncoded, false);
+	const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
+	const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
+	const unwrapKeyOpts = {
+		enc,
+		returnAs: enc.includes("GCM"),
+		keyUsage: options?.keyUsage || ["decrypt"]
+	};
+	if (protectedHeader.iv) unwrapKeyOpts.iv = protectedHeader.iv;
+	if (protectedHeader.tag) unwrapKeyOpts.tag = protectedHeader.tag;
+	if (protectedHeader.p2s) unwrapKeyOpts.p2s = protectedHeader.p2s;
+	if (protectedHeader.p2c) unwrapKeyOpts.p2c = protectedHeader.p2c;
+	if (protectedHeader.epk) unwrapKeyOpts.epk = protectedHeader.epk;
+	if (protectedHeader.apu) unwrapKeyOpts.apu = protectedHeader.apu;
+	if (protectedHeader.apv) unwrapKeyOpts.apv = protectedHeader.apv;
+	if (options?.unwrappedKeyAlgorithm) unwrapKeyOpts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
+	if (options?.extractable) unwrapKeyOpts.extractable = options.extractable;
+	const cek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
+	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+	const payload = decodePayloadFromBytes(await decrypt$1(enc, cek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes), protectedHeader, options?.forceUint8Array);
+	if (protectedHeader.crit || options?.critical?.length || options?.requiredHeaders?.length) validateCriticalHeadersJWE(protectedHeader, [...options?.critical || [], ...options?.requiredHeaders || []]);
+	if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
+	const result = {
+		payload,
+		protectedHeader
+	};
+	if (options.returnCek) {
+		result.cek = isCryptoKey(cek) ? new Uint8Array(await crypto.subtle.exportKey("raw", cek)) : cek;
+		result.aad = aadBytes;
+	}
+	return result;
+}
+function parseEphemeralKey(ephemeralKey) {
+	let epk;
+	let epkPrivateKey;
+	if (isCryptoKeyPair(ephemeralKey)) {
+		epk = ephemeralKey.publicKey;
+		epkPrivateKey = ephemeralKey.privateKey;
+	} else if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
+		const candidate = ephemeralKey;
+		if (!candidate.publicKey || !candidate.privateKey) throw new TypeError("ECDH-ES custom ephemeral key must include both publicKey and privateKey.");
+		epk = candidate.publicKey;
+		epkPrivateKey = candidate.privateKey;
+	} else if (isCryptoKey(ephemeralKey)) {
+		if (ephemeralKey.type !== "private") throw new TypeError("ECDH-ES custom ephemeral CryptoKey must include private key material.");
+		epk = ephemeralKey;
+		epkPrivateKey = ephemeralKey;
+	} else if (isJWK(ephemeralKey)) {
+		if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") throw new TypeError("ECDH-ES custom ephemeral JWK must include private parameter \"d\".");
+		epk = ephemeralKey;
+		epkPrivateKey = ephemeralKey;
+	} else throw new TypeError("Unsupported ECDH-ES ephemeral key material provided in options.");
+	return {
+		epk,
+		epkPrivateKey
+	};
+}
+//#endregion
+export { encrypt as n, jwe_exports as r, decrypt as t };