unjwt 0.6.0 → 0.7.0

package/README.md

@@ -409,8 +409,7 @@ const accessConfig = {
 
 ## Credits
 
-Originally developed by [Johann Schopplich](https://github.com/johannschopplich/unjwt).
-Heavily inspired by [Filip Skokan's work](https://github.com/panva/jose).
+Originally visioned by [Johann Schopplich](https://github.com/johannschopplich/unjwt), heavily inspired by [Filip Skokan's `jose`](https://github.com/panva/jose) internal cryptographic primitives, and initially sponsored by [JAMflow](https://jamflow.cloud) — thanks to all three for making this project possible.
 
 ## License
 

package/dist/THIRD-PARTY-LICENSES.md

@@ -0,0 +1,63 @@
+# Licenses of Bundled Dependencies
+
+The published artifact additionally contains code with the following licenses:
+MIT
+
+# Bundled Dependencies
+
+## rou3
+
+License: MIT
+Repository: https://github.com/h3js/rou3
+
+> MIT License
+> 
+> Copyright (c) Pooya Parsa <pooya@pi0.io>
+> 
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+> 
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+> 
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+
+---------------------------------------
+
+## unsecure
+
+License: MIT
+By: Sandro Circi
+Repository: https://github.com/sandros94/unsecure
+
+> MIT License
+> 
+> Copyright (c) 2025 Sandro Circi
+> 
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+> 
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+> 
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.

package/dist/_chunks/_internal.mjs

@@ -0,0 +1,88 @@
+import { D as JWTError, E as inferJWSAllowedAlgorithms, T as inferJWEAllowedAlgorithms, a as isCryptoKeyPair, i as isCryptoKey, o as isJWK, v as decodePayloadFromB64UrlSegment, w as validateJwtClaims } from "./utils.mjs";
+import { c as safeJsonParse, i as base64UrlDecode, s as textEncoder } from "./libs/unsecure.mjs";
+function buildJWKSetFilter(header) {
+	const kid = header?.kid;
+	const alg = header?.alg;
+	return (k) => (!kid || k.kid === kid) && (!k.alg || k.alg === alg);
+}
+function parseEphemeralKey(ephemeralKey) {
+	if (isCryptoKeyPair(ephemeralKey)) return {
+		epk: ephemeralKey.publicKey,
+		epkPrivateKey: ephemeralKey.privateKey
+	};
+	if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
+		if (!ephemeralKey.publicKey || !ephemeralKey.privateKey) throw new JWTError("ECDH-ES custom ephemeral key must include both publicKey and privateKey.", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey.publicKey,
+			epkPrivateKey: ephemeralKey.privateKey
+		};
+	}
+	if (isCryptoKey(ephemeralKey)) {
+		if (ephemeralKey.type !== "private") throw new JWTError("ECDH-ES custom ephemeral CryptoKey must include private key material.", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey,
+			epkPrivateKey: ephemeralKey
+		};
+	}
+	if (isJWK(ephemeralKey)) {
+		if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") throw new JWTError("ECDH-ES custom ephemeral JWK must include private parameter \"d\".", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey,
+			epkPrivateKey: ephemeralKey
+		};
+	}
+	throw new JWTError("Unsupported ECDH-ES ephemeral key material provided.", "ERR_JWK_INVALID");
+}
+async function resolveSigningKey(alg, key, usage) {
+	if (key instanceof Uint8Array) {
+		const minBytes = Number.parseInt(alg.slice(2), 10) / 8;
+		if (key.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes`, "ERR_JWK_INVALID");
+		return crypto.subtle.importKey("raw", key, {
+			name: "HMAC",
+			hash: `SHA-${alg.slice(-3)}`
+		}, false, [usage]);
+	}
+	if (alg.startsWith("RS") || alg.startsWith("PS")) {
+		const { modulusLength } = key.algorithm;
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
+	}
+	return key;
+}
+function validateJwtClaimsIfJsonPayload(payload, options) {
+	if (payload && typeof payload === "object" && !(payload instanceof Uint8Array) && !options.forceUint8Array && options.validateClaims !== false) validateJwtClaims(payload, options);
+}
+const JWS_ALG_CTX = /* @__PURE__ */ Object.freeze({
+	infer: inferJWSAllowedAlgorithms,
+	octAliasing: false,
+	errorCode: "ERR_JWS_ALG_NOT_ALLOWED",
+	label: "Algorithm"
+});
+const JWE_ALG_CTX = /* @__PURE__ */ Object.freeze({
+	infer: inferJWEAllowedAlgorithms,
+	octAliasing: true,
+	errorCode: "ERR_JWE_ALG_NOT_ALLOWED",
+	label: "Key management algorithm"
+});
+function checkAlgAllowed(alg, key, explicit, ctx) {
+	if (explicit) return explicit.includes(alg) ? void 0 : notAllowed(alg, ctx);
+	if (isJWK(key) && typeof key.alg === "string" && (!ctx.octAliasing || key.kty !== "oct")) return key.alg === alg ? void 0 : notAllowed(alg, ctx);
+	const inferred = ctx.infer(key);
+	if (!inferred) return new JWTError(`Cannot infer allowed ${ctx.label.toLowerCase()}s from this key; pass "options.algorithms" explicitly.`, ctx.errorCode);
+	return inferred.includes(alg) ? void 0 : notAllowed(alg, ctx);
+}
+function notAllowed(alg, ctx) {
+	return new JWTError(`${ctx.label} not allowed: ${alg}`, ctx.errorCode);
+}
+function decodeProtectedHeader(encoded, family) {
+	if (!encoded) return {};
+	try {
+		return safeJsonParse(base64UrlDecode(encoded));
+	} catch {
+		throw new JWTError(`Invalid ${family}: Protected header could not be decoded.`, `ERR_${family}_INVALID`);
+	}
+}
+function decodeJWSPayload(payloadSegment, useB64, forceUint8Array) {
+	if (useB64) return decodePayloadFromB64UrlSegment(payloadSegment, forceUint8Array);
+	return forceUint8Array ? textEncoder.encode(payloadSegment) : payloadSegment;
+}
+export { decodeJWSPayload as a, resolveSigningKey as c, checkAlgAllowed as i, validateJwtClaimsIfJsonPayload as l, JWS_ALG_CTX as n, decodeProtectedHeader as o, buildJWKSetFilter as r, parseEphemeralKey as s, JWE_ALG_CTX as t };