unjwt 0.5.5 → 0.5.7

package/README.md

@@ -97,6 +97,8 @@ import {
 } from "https://esm.sh/unjwt/utils";
 ```
 
+---
+
 ### JWS (JSON Web Signature, [RFC 7515](https://datatracker.ietf.org/doc/html/rfc7515))
 
 Functions to sign and verify data according to the JWS specification.
@@ -110,6 +112,8 @@ Creates a JWS token.
 - `options`:
   - `alg`: (Required) The JWS algorithm (e.g., `"HS256"`, `"RS256"`, `"ES256"`, `"PS256"`).
   - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
+  - `expiresIn`: Sets an expiration time in seconds (e.g., `3600` for 1 hour). If `iat` is missing it will be set to the current time. If `exp` is missing it will be set to `iat + expiresIn`. This is only applied if `payload` is a JWT.
+  - `currentDate`: The current date for computing `expiresIn` option. Defaults to `new Date()`.
 
 Returns a `Promise<string>` resolving to the JWS token in Compact Serialization format.
 
@@ -191,6 +195,8 @@ const { payload } = await verify(token, keyLookup, { algorithms: ["RS256"] });
 console.log(payload); // { userId: 123, permissions: ["read"] }
 ```
 
+---
+
 ### JWE (JSON Web Encryption, [RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516))
 
 Functions to encrypt and decrypt data according to the JWE specification.
@@ -293,6 +299,8 @@ async function decryptData(jweToken: string, kek: CryptoKey) {
 }
 ```
 
+---
+
 ### JWK (JSON Web Key, [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517))
 
 Utilities for working with JSON Web Keys.
@@ -591,6 +599,8 @@ console.log(rsaPublicSpki);
 // -----END PUBLIC KEY-----
 ```
 
+---
+
 ### Utility Functions
 
 `unjwt/utils` exports several helpful functions:

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
 export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BvIkEGGz.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.CGkRbYL2.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.D_Mabhgz.mjs';
 export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.8w7jp2aw.mjs';
 export { i as utils } from './shared/unjwt.CbvzYE-m.mjs';
 export { j as jwk } from './shared/unjwt.DH1p_WL8.mjs';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.js';
 export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.c10n3uM8.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.RZpKLLLg.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.w-IAnI15.js';
 export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.CoSilGqk.js';
 export { i as utils } from './shared/unjwt.D4DUiNeM.js';
 export { j as jwk } from './shared/unjwt.CrcUJklb.js';

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export { i as utils } from './shared/unjwt.BHpknTpg.mjs';
 export { j as jwe } from './shared/unjwt.B2olxeGL.mjs';
 export { j as jwk } from './shared/unjwt.DRUXIabl.mjs';
-export { j as jws } from './shared/unjwt.BY2vKT86.mjs';
+export { j as jws } from './shared/unjwt.DqUOpdA-.mjs';
 import './shared/unjwt.Ca03jPX3.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,3 @@
 import './shared/unjwt.D9da8HQF.mjs';
 import './shared/unjwt.BvIkEGGz.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.CGkRbYL2.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.D_Mabhgz.mjs';

package/dist/jws.d.ts

@@ -1,3 +1,3 @@
 import './shared/unjwt.D9da8HQF.js';
 import './shared/unjwt.c10n3uM8.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.RZpKLLLg.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.w-IAnI15.js';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
 import './shared/unjwt.DRUXIabl.mjs';
 import './shared/unjwt.BHpknTpg.mjs';
 import './shared/unjwt.Ca03jPX3.mjs';
-export { s as sign, v as verify } from './shared/unjwt.BY2vKT86.mjs';
+export { s as sign, v as verify } from './shared/unjwt.DqUOpdA-.mjs';

package/dist/shared/{unjwt.CGkRbYL2.d.mts → unjwt.D_Mabhgz.d.mts}

@@ -31,6 +31,12 @@ interface JWSSignOptions {
      * `typ` defaults to "JWT" if not provided.
      */
     protectedHeader?: JWSHeaderParameters;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /**
+     * Time at which the JWS should expire, if no `exp` was already provided.
+     */
+    expiresIn?: number;
 }
 /** Result of JWS verification */
 interface JWSVerifyResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
@@ -45,8 +51,6 @@ interface JWSVerifyOptions {
     algorithms?: JWSAlgorithm[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
-    /** List of critical header parameters that must be understood and processed. */
-    requiredHeaders?: string[];
     /**
      * Expected JWT "aud" (Audience) Claim value(s).
      *
@@ -86,6 +90,8 @@ interface JWSVerifyOptions {
     typ?: string;
     /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
     currentDate?: Date;
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
     /**
      * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
      * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the

package/dist/shared/{unjwt.BY2vKT86.mjs → unjwt.DqUOpdA-.mjs}

@@ -12,6 +12,7 @@ async function sign(payload, key, options = {}) {
       throw new TypeError('JWS "alg" (Algorithm) must be provided in options');
     }
   }
+  validateKeyLength(key, alg);
   const signingKey = await importKey(key, alg);
   const protectedHeader = {
     ...additionalProtectedHeader,
@@ -26,6 +27,13 @@ async function sign(payload, key, options = {}) {
   if (protectedHeader.b64 === true) {
     delete protectedHeader.b64;
   }
+  let computedPayload = void 0;
+  if (options.expiresIn !== void 0 && protectedHeader.typ === "JWT" && typeof payload === "object" && !(payload instanceof Uint8Array) && !payload.exp) {
+    computedPayload = { ...payload };
+    const iat = typeof payload.iat === "number" ? payload.iat : Math.round((options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+    computedPayload.iat = iat;
+    computedPayload.exp = iat + options.expiresIn;
+  }
   const protectedHeaderString = JSON.stringify(protectedHeader);
   const protectedHeaderEncoded = base64UrlEncode(protectedHeaderString);
   let payloadBytes;
@@ -34,7 +42,9 @@ async function sign(payload, key, options = {}) {
   } else if (typeof payload === "string") {
     payloadBytes = textEncoder.encode(payload);
   } else if (typeof payload === "object" && payload !== null) {
-    payloadBytes = textEncoder.encode(JSON.stringify(payload));
+    payloadBytes = textEncoder.encode(
+      JSON.stringify(computedPayload || payload)
+    );
   } else {
     throw new TypeError(
       "Payload must be a string, Uint8Array, or a JSON-serializable object."
@@ -160,11 +170,12 @@ async function verify(jws, key, options = {}) {
       );
     }
   }
-  if (payload && typeof payload === "object" && !options.forceUint8Array) {
+  if (payload && typeof payload === "object" && protectedHeader.typ === "JWT" && !options.forceUint8Array) {
     const jwtClaims = payload;
-    const clockTolerance = (options.clockTolerance ?? 0) * 1e3;
-    const currentDate = options.currentDate ?? /* @__PURE__ */ new Date();
-    const currentTime = currentDate.getTime();
+    const clockTolerance = options.clockTolerance ?? 0;
+    const currentTime = Math.round(
+      (options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3
+    );
     const allRequiredClaims = new Set(options.requiredClaims || []);
     const missingClaims = /* @__PURE__ */ new Set();
     if (options.issuer) allRequiredClaims.add("iss");
@@ -203,12 +214,12 @@ async function verify(jws, key, options = {}) {
         );
       }
     }
-    if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf * 1e3 > currentTime + clockTolerance) {
+    if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) {
       throw new Error(
         `JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${new Date(jwtClaims.nbf * 1e3).toISOString()})`
       );
     }
-    if (typeof jwtClaims.exp === "number" && jwtClaims.exp * 1e3 <= currentTime - clockTolerance) {
+    if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) {
       throw new Error(
         `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(jwtClaims.exp * 1e3).toISOString()})`
       );
@@ -219,12 +230,12 @@ async function verify(jws, key, options = {}) {
           'JWT "iat" (Issued At) Claim must be a number when maxTokenAge is set.'
         );
       }
-      if (jwtClaims.iat * 1e3 > currentTime + clockTolerance) {
+      if (jwtClaims.iat > currentTime + clockTolerance) {
         throw new Error(
           `JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
         );
       }
-      if (jwtClaims.iat * 1e3 < currentTime - options.maxTokenAge * 1e3 - clockTolerance) {
+      if (jwtClaims.iat < currentTime - options.maxTokenAge - clockTolerance) {
         throw new Error(
           `JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
         );
@@ -236,6 +247,24 @@ async function verify(jws, key, options = {}) {
     protectedHeader
   };
 }
+function validateKeyLength(key, alg) {
+  if (!alg || isJWK(key)) return;
+  if (alg.startsWith("HS") && key instanceof Uint8Array) {
+    const algLength = Number.parseInt(alg.slice(2)) / 8;
+    if (key.length < algLength) {
+      throw new TypeError(
+        `${alg} requires key length to be ${algLength} bytes or larger`
+      );
+    }
+  } else if ((alg.startsWith("RS") || alg.startsWith("PS")) && key instanceof CryptoKey) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== "number" || modulusLength < 2048) {
+      throw new TypeError(
+        `${alg} requires key modulusLength to be 2048 bits or larger`
+      );
+    }
+  }
+}
 
 const jws = {
   __proto__: null,

package/dist/shared/{unjwt.RZpKLLLg.d.ts → unjwt.w-IAnI15.d.ts}

@@ -31,6 +31,12 @@ interface JWSSignOptions {
      * `typ` defaults to "JWT" if not provided.
      */
     protectedHeader?: JWSHeaderParameters;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /**
+     * Time at which the JWS should expire, if no `exp` was already provided.
+     */
+    expiresIn?: number;
 }
 /** Result of JWS verification */
 interface JWSVerifyResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
@@ -45,8 +51,6 @@ interface JWSVerifyOptions {
     algorithms?: JWSAlgorithm[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
-    /** List of critical header parameters that must be understood and processed. */
-    requiredHeaders?: string[];
     /**
      * Expected JWT "aud" (Audience) Claim value(s).
      *
@@ -86,6 +90,8 @@ interface JWSVerifyOptions {
     typ?: string;
     /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
     currentDate?: Date;
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
     /**
      * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
      * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",