unjwt 0.5.9 → 0.5.11

package/dist/shared/unjwt.wHjOCapq.mjs

@@ -1,279 +0,0 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.DRUXIabl.mjs';
-import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode, e as isJWKSet, m as maybeArray } from './unjwt.BHpknTpg.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.Ca03jPX3.mjs';
-
-async function sign(payload, key, options = {}) {
-  const { protectedHeader: additionalProtectedHeader } = options;
-  let { alg } = options;
-  if (!alg) {
-    if (isJWK(key) && key.alg) {
-      alg = key.alg;
-    } else {
-      throw new TypeError('JWS "alg" (Algorithm) must be provided in options');
-    }
-  }
-  validateKeyLength(key, alg);
-  const signingKey = await importKey(key, alg);
-  const protectedHeader = {
-    ...additionalProtectedHeader,
-    ...isJWK(key) && key.kid ? { kid: additionalProtectedHeader?.kid || key.kid } : {},
-    // Include kid if available
-    alg,
-    typ: additionalProtectedHeader?.typ ?? (typeof payload === "object" && !(payload instanceof Uint8Array) ? "JWT" : void 0)
-    // Default typ to JWT for objects
-  };
-  if (protectedHeader.typ === void 0 && typeof payload === "object" && !(payload instanceof Uint8Array)) {
-    protectedHeader.typ = "JWT";
-    protectedHeader.cty ||= "json";
-  }
-  if (protectedHeader.b64 === true) {
-    delete protectedHeader.b64;
-  }
-  let computedPayload = void 0;
-  if (options.expiresIn !== void 0 && protectedHeader.typ === "JWT" && typeof payload === "object" && !(payload instanceof Uint8Array) && !payload.exp) {
-    computedPayload = { ...payload };
-    const currentTime = Math.round(
-      (options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3
-    );
-    computedPayload.iat ||= currentTime;
-    computedPayload.exp = currentTime + options.expiresIn;
-  }
-  const protectedHeaderString = JSON.stringify(protectedHeader);
-  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderString);
-  let payloadBytes;
-  if (payload instanceof Uint8Array) {
-    payloadBytes = payload;
-  } else if (typeof payload === "string") {
-    payloadBytes = textEncoder.encode(payload);
-  } else if (typeof payload === "object" && payload !== null) {
-    payloadBytes = textEncoder.encode(
-      JSON.stringify(computedPayload || payload)
-    );
-  } else {
-    throw new TypeError(
-      "Payload must be a string, Uint8Array, or a JSON-serializable object."
-    );
-  }
-  const useB64 = protectedHeader.b64 !== false;
-  const payloadEncoded = useB64 ? base64UrlEncode(payloadBytes) : textDecoder.decode(payloadBytes);
-  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
-  const signingInputBytes = textEncoder.encode(signingInputString);
-  const signatureBytes = await sign$1(alg, signingKey, signingInputBytes);
-  const signatureEncoded = base64UrlEncode(signatureBytes);
-  return `${signingInputString}.${signatureEncoded}`;
-}
-async function verify(jws, key, options = {}) {
-  const parts = jws.split(".");
-  if (parts.length !== 3) {
-    throw new Error("Invalid JWS: Must contain three parts separated by dots.");
-  }
-  const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
-  let protectedHeader;
-  try {
-    const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderString);
-  } catch (error_) {
-    throw new Error(
-      `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
-    );
-  }
-  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) {
-    throw new Error(
-      'Invalid JWS: Protected header must be an object with an "alg" property.'
-    );
-  }
-  const alg = protectedHeader.alg;
-  if (options.algorithms && !options.algorithms.includes(alg)) {
-    throw new Error(`Algorithm not allowed: ${alg}`);
-  }
-  if (options.typ && protectedHeader.typ !== options.typ) {
-    throw new Error(
-      `Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`
-    );
-  }
-  let signatureBytes;
-  try {
-    signatureBytes = base64UrlDecode(signatureEncoded, false);
-  } catch (error_) {
-    throw new Error(
-      `Invalid JWS: Signature is not valid Base64URL (${error_ instanceof Error ? error_.message : error_})`
-    );
-  }
-  const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
-  const resolvedKey = isJWKSet(keyInput) ? getJWKFromSet(keyInput, protectedHeader) : keyInput;
-  const verificationKey = await importKey(resolvedKey, alg);
-  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
-  const signingInputBytes = textEncoder.encode(signingInputString);
-  const isValid = await verify$1(
-    alg,
-    verificationKey,
-    signatureBytes,
-    signingInputBytes
-  );
-  if (!isValid) {
-    throw new Error("JWS signature verification failed.");
-  }
-  const useB64 = protectedHeader.b64 !== false;
-  let payload;
-  try {
-    if (useB64) {
-      if (options.forceUint8Array) {
-        payload = base64UrlDecode(payloadEncoded, false);
-      } else {
-        const cty = protectedHeader.cty?.toLowerCase();
-        const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
-        const decodedString = base64UrlDecode(payloadEncoded);
-        if (isJsonOutput) {
-          if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
-            try {
-              payload = JSON.parse(decodedString);
-            } catch {
-              payload = decodedString;
-            }
-          } else {
-            payload = decodedString;
-          }
-        } else {
-          payload = decodedString;
-        }
-      }
-    } else {
-      payload = options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
-    }
-  } catch (error_) {
-    throw new Error(
-      `Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`
-    );
-  }
-  if (protectedHeader.crit) {
-    const missingHeaderParams = /* @__PURE__ */ new Set();
-    const recognizedParams = /* @__PURE__ */ new Set([
-      ...options.critical || [],
-      // TODO: remove deprecated option
-      ...options.requiredHeaders || [],
-      "alg",
-      "typ",
-      "cty",
-      "kid",
-      "jwk",
-      "jku",
-      "x5c",
-      "x5t",
-      "x5u",
-      "b64"
-    ]);
-    for (const param of protectedHeader.crit) {
-      if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) {
-        continue;
-      }
-      missingHeaderParams.add(param);
-    }
-    if (missingHeaderParams.size > 0) {
-      throw new Error(
-        `Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`
-      );
-    }
-  }
-  if (payload && typeof payload === "object" && protectedHeader.typ === "JWT" && !options.forceUint8Array) {
-    const jwtClaims = payload;
-    const clockTolerance = options.clockTolerance ?? 0;
-    const currentTime = Math.round(
-      (options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3
-    );
-    const allRequiredClaims = new Set(options.requiredClaims || []);
-    const missingClaims = /* @__PURE__ */ new Set();
-    if (options.issuer) allRequiredClaims.add("iss");
-    if (options.audience) allRequiredClaims.add("aud");
-    if (options.subject) allRequiredClaims.add("sub");
-    if (options.maxTokenAge) allRequiredClaims.add("iat");
-    for (const claimName of allRequiredClaims) {
-      if (!(claimName in jwtClaims)) {
-        missingClaims.add(claimName);
-      }
-    }
-    if (missingClaims.size > 0) {
-      throw new Error(
-        `Missing required JWT Claims: ${[...missingClaims].join(", ")}`
-      );
-    }
-    if (options.issuer) {
-      const expectedIssuers = maybeArray(options.issuer);
-      if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) {
-        throw new Error(
-          `Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`
-        );
-      }
-    }
-    if (options.subject && jwtClaims.sub !== options.subject) {
-      throw new Error(
-        `Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`
-      );
-    }
-    if (options.audience) {
-      const expectedAudiences = maybeArray(options.audience);
-      const claimAudience = maybeArray(jwtClaims.aud || []);
-      if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) {
-        throw new Error(
-          `Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`
-        );
-      }
-    }
-    if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) {
-      throw new Error(
-        `JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${new Date(jwtClaims.nbf * 1e3).toISOString()})`
-      );
-    }
-    if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) {
-      throw new Error(
-        `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(jwtClaims.exp * 1e3).toISOString()})`
-      );
-    }
-    if (options.maxTokenAge) {
-      if (typeof jwtClaims.iat !== "number") {
-        throw new TypeError(
-          'JWT "iat" (Issued At) Claim must be a number when maxTokenAge is set.'
-        );
-      }
-      if (jwtClaims.iat > currentTime + clockTolerance) {
-        throw new Error(
-          `JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
-        );
-      }
-      if (jwtClaims.iat < currentTime - options.maxTokenAge - clockTolerance) {
-        throw new Error(
-          `JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
-        );
-      }
-    }
-  }
-  return {
-    payload,
-    protectedHeader
-  };
-}
-function validateKeyLength(key, alg) {
-  if (!alg || isJWK(key)) return;
-  if (alg.startsWith("HS") && key instanceof Uint8Array) {
-    const algLength = Number.parseInt(alg.slice(2)) / 8;
-    if (key.length < algLength) {
-      throw new TypeError(
-        `${alg} requires key length to be ${algLength} bytes or larger`
-      );
-    }
-  } else if ((alg.startsWith("RS") || alg.startsWith("PS")) && key instanceof CryptoKey) {
-    const { modulusLength } = key.algorithm;
-    if (typeof modulusLength !== "number" || modulusLength < 2048) {
-      throw new TypeError(
-        `${alg} requires key modulusLength to be 2048 bits or larger`
-      );
-    }
-  }
-}
-
-const jws = {
-  __proto__: null,
-  sign: sign,
-  verify: verify
-};
-
-export { jws as j, sign as s, verify as v };