unjwt 0.5.38 → 0.5.40

package/dist/_chunks/jws2.mjs

@@ -0,0 +1,598 @@
+import { d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, n as verify, r as decrypt, t as sign, u as isPublicJWK } from "./jws.mjs";
+import { isEvent, setCookie } from "h3";
+import { parse } from "cookie-es";
+//#region src/adapters/h3v1/session/jwe.ts
+const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
+const DEFAULT_NAME$1 = "h3-jwe";
+const DEFAULT_COOKIE$1 = {
+	path: "/",
+	secure: true,
+	httpOnly: true
+};
+/**
+* Create a session manager for the current request.
+*/
+async function useJWESession(event, config) {
+	const sessionName = config.name || DEFAULT_NAME$1;
+	await getJWESession(event, config);
+	const sessionManager = {
+		get id() {
+			return event.context.sessions?.[sessionName]?.id;
+		},
+		get createdAt() {
+			return event.context.sessions?.[sessionName]?.createdAt || Date.now();
+		},
+		get expiresAt() {
+			return event.context.sessions?.[sessionName]?.expiresAt;
+		},
+		get data() {
+			return event.context.sessions?.[sessionName]?.data || {};
+		},
+		get token() {
+			return getJWESessionToken(event, config);
+		},
+		update: async (update) => {
+			if (!isEvent(event)) throw new Error("[h3] Cannot update read-only session.");
+			await updateJWESession(event, config, update);
+			return sessionManager;
+		},
+		clear: async () => {
+			if (!isEvent(event)) throw new Error("[h3] Cannot clear read-only session.");
+			await clearJWESession(event, config);
+			return sessionManager;
+		}
+	};
+	return sessionManager;
+}
+/**
+* Get (and lazily initialize) the session for the current request.
+*/
+async function getJWESession(event, config) {
+	const sessionName = config.name || DEFAULT_NAME$1;
+	if (!event.context.sessions) event.context.sessions = Object.create(null);
+	const existingSession = event.context.sessions[sessionName];
+	if (existingSession) {
+		const session = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
+		/**
+		* We check if a session is expired before returning it. If it is expired we clear it and create a new one,
+		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
+		* the cookie/header (like in a websocket upgrade)
+		*/
+		if (session.expiresAt !== void 0 && session.expiresAt < Date.now() && isEvent(event)) {
+			await config.hooks?.onExpire?.({
+				event,
+				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				config
+			});
+			return clearJWESession(event, config).then(() => getJWESession(event, config));
+		}
+		await config.hooks?.onRead?.({
+			event,
+			session,
+			config
+		});
+		return session;
+	}
+	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	const session = {
+		id: void 0,
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+		data: Object.create(null)
+	};
+	event.context.sessions[sessionName] = session;
+	const token = getJWESessionToken(event, config);
+	if (token) {
+		const promise = unsealJWESession(event, config, token).catch(async (error_) => {
+			if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+				await config.hooks?.onExpire?.({
+					event,
+					error: error_,
+					config
+				});
+				return;
+			}
+			await config.hooks?.onError?.({
+				event,
+				error: error_,
+				config
+			});
+		}).then((unsealed) => {
+			if (unsealed) Object.assign(session, unsealed);
+			delete event.context.sessions[sessionName][kGetSessionPromise$1];
+			return session;
+		});
+		event.context.sessions[sessionName][kGetSessionPromise$1] = promise;
+		await promise;
+	}
+	await config.hooks?.onRead?.({
+		event,
+		session,
+		config
+	});
+	return session;
+}
+function getJWESessionToken(event, config) {
+	const sessionName = config.name || DEFAULT_NAME$1;
+	let token;
+	if (config.sessionHeader !== false) {
+		const headerValue = _getReqHeader$1(event, typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`);
+		if (typeof headerValue === "string") token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+	}
+	if (config.cookie !== false) {
+		const setCookie = _getResHeader$1(event, "set-cookie");
+		if (typeof setCookie === "string") token = findSetCookie$1(setCookie, sessionName);
+		else if (Array.isArray(setCookie)) for (const sc of setCookie) {
+			token = findSetCookie$1(sc, sessionName);
+			if (token) break;
+		}
+	}
+	if (!token) {
+		const cookieHeader = _getReqHeader$1(event, "cookie");
+		if (cookieHeader) token = parse(String(cookieHeader))[sessionName];
+	}
+	return token;
+}
+function _getReqHeader$1(event, name) {
+	if (event.node) return event.node?.req.headers[name];
+	if (event.request) return event.request.headers?.get(name);
+	if (event.headers) return event.headers.get(name);
+}
+function _getResHeader$1(event, name) {
+	if (event.node) return event.node?.res.getHeader(name);
+	if (event.response) return event.response.headers?.get(name);
+}
+/**
+* Update the session (optionally mutating the session data) and re-issue the JWE token.
+*/
+async function updateJWESession(event, config, update) {
+	if (!isEvent(event)) throw new Error("Cannot update a new session. Use `useSession(event)` within the main handler.");
+	const sessionName = config.name || DEFAULT_NAME$1;
+	const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
+	if (typeof update === "function") update = update(session.data);
+	if (update) {
+		const oldSession = {
+			...session,
+			data: { ...session.data }
+		};
+		Object.assign(session.data, update);
+		await config.hooks?.onUpdate?.({
+			session,
+			oldSession,
+			event,
+			config
+		});
+	}
+	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	Object.assign(session, {
+		id: config.generateId?.() || crypto.randomUUID(),
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+	});
+	if (config.cookie !== false) setCookie(event, sessionName, await sealJWESession(event, config), {
+		...DEFAULT_COOKIE$1,
+		...config.cookie,
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3)
+	});
+	return session;
+}
+/**
+* Produce a JWE for the current session.
+* Payload structure:
+* {
+*   jti: string;
+*   iat: number; (seconds)
+*   exp?: number; (seconds)
+*   data: Record<string, any>;
+* }
+*/
+async function sealJWESession(event, config) {
+	const key = getEncryptKey(config.key || config.secret);
+	const sessionName = config.name || DEFAULT_NAME$1;
+	const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
+	const iat = Math.floor(session.createdAt / 1e3);
+	const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
+	const payload = {
+		...session.data,
+		jti: session.id,
+		iat
+	};
+	if (exp) payload.exp = exp;
+	let typ = void 0;
+	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
+	return await encrypt(payload, key, {
+		...config.jwe?.encryptOptions,
+		expiresIn: void 0,
+		protectedHeader: {
+			...config.jwe?.encryptOptions?.protectedHeader,
+			kid: typeof key === "string" ? void 0 : key.kid,
+			typ: typ || "JWT",
+			cty: "application/json"
+		}
+	});
+}
+/**
+* Decrypt the JWE and return a Session-compatible object.
+*/
+async function unsealJWESession(event, config, sealed) {
+	const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
+		header,
+		event,
+		config
+	}) : getDecryptKey(config.key || config.secret);
+	const alg = config.jwe?.encryptOptions?.alg;
+	const enc = config.jwe?.encryptOptions?.enc;
+	let typ = void 0;
+	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
+	const { payload } = await decrypt(sealed, key, {
+		...config.jwe?.decryptOptions,
+		requiredClaims: [...new Set([
+			...config.jwe?.decryptOptions?.requiredClaims || [],
+			"jti",
+			"iat"
+		])],
+		typ: typ || "JWT",
+		maxTokenAge: config.maxAge,
+		algorithms: alg ? [alg] : void 0,
+		encryptionAlgorithms: enc ? [enc] : void 0,
+		unwrappedKeyAlgorithm: void 0,
+		keyUsage: void 0,
+		forceUint8Array: false,
+		validateJWT: true
+	}).catch((error_) => {
+		if (error_ instanceof Error) {
+			const message = error_.message;
+			throw new Error(`Invalid session token: ${message}`);
+		}
+		throw new Error(error_);
+	});
+	const { jti, iat, exp, ...data } = payload;
+	return {
+		id: jti,
+		createdAt: iat * 1e3,
+		expiresAt: exp ? exp * 1e3 : void 0,
+		data: data && typeof data === "object" ? data : Object.create(null)
+	};
+}
+/**
+* Clear the session (delete from context and drop cookie).
+*/
+async function clearJWESession(event, config) {
+	const sessionName = config.name || DEFAULT_NAME$1;
+	let session = event.context.sessions?.[sessionName];
+	if (session && session[kGetSessionPromise$1]) session = await session[kGetSessionPromise$1];
+	if (event.context.sessions?.[sessionName]) delete event.context.sessions[sessionName];
+	setCookie(event, sessionName, "", {
+		...DEFAULT_COOKIE$1,
+		...config.cookie,
+		expires: /* @__PURE__ */ new Date(0),
+		maxAge: void 0
+	});
+	await config.hooks?.onClear?.({
+		session,
+		event,
+		config
+	});
+}
+function getEncryptKey(key) {
+	if (!key) throw new Error("Session: JWE key is required.");
+	let _key;
+	if (typeof key === "string") _key = key;
+	else if (isSymmetricJWK(key) || isPrivateJWK(key)) _key = key;
+	else if ("publicKey" in key && isPublicJWK(key.publicKey)) _key = key.publicKey;
+	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
+	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or valid JWK.", { cause: key });
+	return _key;
+}
+function getDecryptKey(key) {
+	if (!key) throw new Error("Session: JWE key is required.");
+	let _key = void 0;
+	if (typeof key === "string") _key = key;
+	else if (isSymmetricJWK(key)) _key = key;
+	else if ("privateKey" in key) _key = key.privateKey;
+	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or a valid private JWK.", { cause: key });
+	return _key;
+}
+function findSetCookie$1(setCookie, name) {
+	const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
+	const match = setCookie.match(regex);
+	return match ? match[1] : void 0;
+}
+//#endregion
+//#region src/adapters/h3v1/session/jws.ts
+const kGetSessionPromise = Symbol("h3_jws_getSession");
+const DEFAULT_NAME = "h3-jws";
+const DEFAULT_COOKIE = {
+	path: "/",
+	secure: true,
+	httpOnly: false
+};
+/**
+* Create a session manager for the current request using JWS (signed only, not encrypted).
+* NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
+*/
+async function useJWSSession(event, config) {
+	const sessionName = config.name || DEFAULT_NAME;
+	await getJWSSession(event, config);
+	const sessionManager = {
+		get id() {
+			return event.context.sessions?.[sessionName]?.id;
+		},
+		get createdAt() {
+			return event.context.sessions?.[sessionName]?.createdAt || Date.now();
+		},
+		get expiresAt() {
+			return event.context.sessions?.[sessionName]?.expiresAt;
+		},
+		get data() {
+			return event.context.sessions?.[sessionName]?.data || {};
+		},
+		get token() {
+			return getJWSSessionToken(event, config);
+		},
+		update: async (update) => {
+			if (!isEvent(event)) throw new Error("[h3] Cannot update read-only session.");
+			await updateJWSSession(event, config, update);
+			return sessionManager;
+		},
+		clear: async () => {
+			if (!isEvent(event)) throw new Error("[h3] Cannot clear read-only session.");
+			await clearJWSSession(event, config);
+			return sessionManager;
+		}
+	};
+	return sessionManager;
+}
+/**
+* Retrieve (and lazily initialize) the session.
+*/
+async function getJWSSession(event, config) {
+	const sessionName = config.name || DEFAULT_NAME;
+	if (!event.context.sessions) event.context.sessions = Object.create(null);
+	const existingSession = event.context.sessions[sessionName];
+	if (existingSession) {
+		const session = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
+		/**
+		* We check if a session is expired before returning it. If it is expired we clear it and create a new one,
+		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
+		* the cookie/header (like in a websocket upgrade)
+		*/
+		if (session.expiresAt !== void 0 && session.expiresAt < Date.now() && isEvent(event)) {
+			await config.hooks?.onExpire?.({
+				event,
+				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				config
+			});
+			return clearJWSSession(event, config).then(() => getJWSSession(event, config));
+		}
+		await config.hooks?.onRead?.({
+			event,
+			session,
+			config
+		});
+		return session;
+	}
+	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	const session = {
+		id: void 0,
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+		data: Object.create(null)
+	};
+	event.context.sessions[sessionName] = session;
+	const token = getJWSSessionToken(event, config);
+	if (token) {
+		const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
+			if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+				await config.hooks?.onExpire?.({
+					event,
+					error: error_,
+					config
+				});
+				return;
+			}
+			await config.hooks?.onError?.({
+				event,
+				error: error_,
+				config
+			});
+		}).then((unsealed) => {
+			if (unsealed) Object.assign(session, unsealed);
+			delete event.context.sessions[sessionName][kGetSessionPromise];
+			return session;
+		});
+		session[kGetSessionPromise] = promise;
+		await promise;
+	}
+	await config.hooks?.onRead?.({
+		event,
+		session,
+		config
+	});
+	return session;
+}
+function getJWSSessionToken(event, config) {
+	const sessionName = config.name || DEFAULT_NAME;
+	let token;
+	if (config.sessionHeader !== false) {
+		const headerValue = _getReqHeader(event, typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`);
+		if (typeof headerValue === "string") token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+	}
+	if (config.cookie !== false) {
+		const setCookie = _getResHeader(event, "set-cookie");
+		if (typeof setCookie === "string") token = findSetCookie(setCookie, sessionName);
+		else if (Array.isArray(setCookie)) for (const sc of setCookie) {
+			token = findSetCookie(sc, sessionName);
+			if (token) break;
+		}
+	}
+	if (!token) {
+		const cookieHeader = _getReqHeader(event, "cookie");
+		if (cookieHeader) token = parse(String(cookieHeader))[sessionName];
+	}
+	return token;
+}
+function _getReqHeader(event, name) {
+	if (event.node) return event.node.req.headers[name];
+	if (event.request) return event.request.headers.get(name);
+	if (event.headers) return event.headers.get(name);
+}
+function _getResHeader(event, name) {
+	if (event.node) return event.node?.res.getHeader(name);
+	if (event.response) return event.response.headers?.get(name);
+}
+/**
+* Update session data (if provided) and reissue JWS.
+*/
+async function updateJWSSession(event, config, update) {
+	if (!isEvent(event)) throw new Error("Cannot update a new session. Use `useSession(event)` within the main handler.");
+	const sessionName = config.name || DEFAULT_NAME;
+	const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
+	if (typeof update === "function") update = update(session.data);
+	if (update) {
+		const oldSession = {
+			...session,
+			data: { ...session.data }
+		};
+		Object.assign(session.data, update);
+		await config.hooks?.onUpdate?.({
+			session,
+			oldSession,
+			event,
+			config
+		});
+	}
+	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	Object.assign(session, {
+		id: config.generateId?.() || crypto.randomUUID(),
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+	});
+	if (config.cookie !== false) setCookie(event, sessionName, await signJWSSession(event, config), {
+		...DEFAULT_COOKIE,
+		...config.cookie,
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3)
+	});
+	return session;
+}
+/**
+* Sign current session as a compact JWS.
+* Payload claims:
+*  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
+*/
+async function signJWSSession(event, config) {
+	const key = getSignKey(config.key);
+	const sessionName = config.name || DEFAULT_NAME;
+	const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
+	const iat = Math.floor(session.createdAt / 1e3);
+	const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
+	const payload = {
+		...session.data,
+		jti: session.id,
+		iat
+	};
+	if (exp) payload.exp = exp;
+	let typ = void 0;
+	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
+	return await sign(payload, key, {
+		...config.jws?.signOptions,
+		expiresIn: void 0,
+		protectedHeader: {
+			...config.jws?.signOptions?.protectedHeader,
+			kid: key.kid,
+			typ: typ || "JWT",
+			cty: "application/json"
+		}
+	});
+}
+/**
+* Verify and parse a compact JWS into a Session structure.
+* Performs:
+*  - cryptographic signature verification
+*  - (optional) standard claim checks if validateJWT true
+*  - ensures jti & iat presence
+*  - enforces maxAge if provided
+*/
+async function verifyJWSSession(event, config, token) {
+	const alg = config.jws?.signOptions?.alg;
+	const jwk = config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
+		header,
+		event,
+		config
+	}) : getVerifyKey(config.key);
+	let typ = void 0;
+	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
+	const { payload } = await verify(token, jwk, {
+		...config.jws?.verifyOptions,
+		requiredClaims: [...new Set([
+			...config.jws?.verifyOptions?.requiredClaims || [],
+			"jti",
+			"iat"
+		])],
+		typ: typ || "JWT",
+		algorithms: alg ? [alg] : void 0,
+		forceUint8Array: false,
+		validateJWT: true
+	}).catch((error_) => {
+		const message = error_ instanceof Error ? error_.message : String(error_);
+		throw new Error(`Invalid session token: ${message}`);
+	});
+	const { jti, iat, exp, ...data } = payload;
+	return {
+		id: jti,
+		createdAt: iat * 1e3,
+		expiresAt: exp ? exp * 1e3 : void 0,
+		data: data && typeof data === "object" ? data : Object.create(null)
+	};
+}
+/**
+* Destroy the session (context + cookie).
+*/
+async function clearJWSSession(event, config) {
+	const sessionName = config.name || DEFAULT_NAME;
+	let session = event.context.sessions?.[sessionName];
+	if (session && session[kGetSessionPromise]) session = await session[kGetSessionPromise];
+	if (event.context.sessions?.[sessionName]) delete event.context.sessions[sessionName];
+	setCookie(event, sessionName, "", {
+		...DEFAULT_COOKIE,
+		...config.cookie,
+		expires: /* @__PURE__ */ new Date(0),
+		maxAge: void 0
+	});
+	await config.hooks?.onClear?.({
+		session,
+		event,
+		config
+	});
+}
+function getSignKey(key) {
+	if (!key) throw new Error("Session: JWS key is required.");
+	let _key = void 0;
+	if (isSymmetricJWK(key)) _key = key;
+	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
+	if (!_key) throw new Error("Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.", { cause: key });
+	return _key;
+}
+function getVerifyKey(key) {
+	if (!key) throw new Error("Session: JWS key is required.");
+	let _key = void 0;
+	if (isSymmetricJWK(key)) _key = key;
+	else if ("publicKey" in key && isPublicJWK(key.publicKey)) _key = key.publicKey;
+	else if ("publicKey" in key && Array.isArray(key.publicKey)) {
+		const keys = key.publicKey.filter((k) => isPublicJWK(k));
+		if (keys && keys.length > 0) _key = { keys };
+	}
+	if (!_key) throw new Error("Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.", { cause: key });
+	return _key;
+}
+function findSetCookie(setCookie, name) {
+	const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
+	const match = setCookie.match(regex);
+	return match ? match[1] : void 0;
+}
+//#endregion
+export { useJWSSession as a, getJWESession as c, unsealJWESession as d, updateJWESession as f, updateJWSSession as i, getJWESessionToken as l, getJWSSession as n, verifyJWSSession as o, useJWESession as p, signJWSSession as r, clearJWESession as s, clearJWSSession as t, sealJWESession as u };