unjwt 0.7.2 → 0.8.0

package/dist/_chunks/utils.mjs

@@ -1,390 +0,0 @@
-import { base64UrlDecode, safeJsonParse, textDecoder, textEncoder } from "./libs/unsecure.mjs";
-var JWTError = class extends Error {
-	code;
-	cause;
-	constructor(message, code, cause) {
-		super(message);
-		this.name = "JWTError";
-		this.code = code;
-		this.cause = cause;
-	}
-};
-function isJWTError(error, code) {
-	if (!(error instanceof JWTError)) return false;
-	return code === void 0 || error.code === code;
-}
-function inferJWSAllowedAlgorithms(key) {
-	if (!key || typeof key === "function") return void 0;
-	if (typeof key === "string" || key instanceof Uint8Array) return void 0;
-	if (typeof key !== "object") return void 0;
-	if (isCryptoKeyPair(key)) return inferJWSAllowedAlgorithms(key.publicKey);
-	if (isJWKSet(key)) return unionFromJWKSet(key.keys, jwsAlgsFromJWK);
-	if (isCryptoKey(key)) return jwsAlgsFromCryptoKey(key);
-	if (isJWK(key)) return jwsAlgsFromJWK(key);
-}
-function inferJWEAllowedAlgorithms(key) {
-	if (!key || typeof key === "function") return void 0;
-	if (typeof key === "string" || key instanceof Uint8Array) return [
-		"PBES2-HS256+A128KW",
-		"PBES2-HS384+A192KW",
-		"PBES2-HS512+A256KW",
-		"dir"
-	];
-	if (typeof key !== "object") return void 0;
-	if (isCryptoKeyPair(key)) return inferJWEAllowedAlgorithms(key.privateKey);
-	if (isJWKSet(key)) return unionFromJWKSet(key.keys, jweAlgsFromJWK);
-	if (isCryptoKey(key)) return jweAlgsFromCryptoKey(key);
-	if (isJWK(key)) return jweAlgsFromJWK(key);
-}
-function unionFromJWKSet(keys, mapper) {
-	const algs = /* @__PURE__ */ new Set();
-	for (const k of keys) {
-		const mapped = mapper(k);
-		if (!mapped) return void 0;
-		for (const a of mapped) algs.add(a);
-	}
-	return algs.size > 0 ? [...algs] : void 0;
-}
-function jwsAlgsFromJWK(jwk) {
-	if (jwk.alg) return [jwk.alg];
-	if (jwk.kty === "EC") {
-		const crv = jwk.crv;
-		if (crv === "P-256") return ["ES256"];
-		if (crv === "P-384") return ["ES384"];
-		if (crv === "P-521") return ["ES512"];
-	}
-	if (jwk.kty === "OKP") {
-		const crv = jwk.crv;
-		if (crv === "Ed25519") return ["Ed25519", "EdDSA"];
-		if (crv === "Ed448") return ["EdDSA"];
-	}
-}
-function jweAlgsFromJWK(jwk) {
-	if (jwk.kty === "oct") return jweAlgsFromOctJWK(jwk);
-	if (jwk.alg) return [jwk.alg];
-	if (jwk.kty === "EC") {
-		const crv = jwk.crv;
-		if (crv === "P-256" || crv === "P-384" || crv === "P-521") return [
-			"ECDH-ES",
-			"ECDH-ES+A128KW",
-			"ECDH-ES+A192KW",
-			"ECDH-ES+A256KW"
-		];
-	}
-	if (jwk.kty === "OKP") {
-		const crv = jwk.crv;
-		if (crv === "X25519" || crv === "X448") return [
-			"ECDH-ES",
-			"ECDH-ES+A128KW",
-			"ECDH-ES+A192KW",
-			"ECDH-ES+A256KW"
-		];
-	}
-}
-function jweAlgsFromOctJWK(jwk) {
-	const alg = jwk.alg;
-	if (!alg) return void 0;
-	if (alg === "A128GCM") return ["A128GCMKW", "dir"];
-	if (alg === "A192GCM") return ["A192GCMKW", "dir"];
-	if (alg === "A256GCM") return ["A256GCMKW", "dir"];
-	if (alg === "A128KW" || alg === "A192KW" || alg === "A256KW") return [alg, "dir"];
-	if (alg === "A128GCMKW" || alg === "A192GCMKW" || alg === "A256GCMKW") return [alg, "dir"];
-	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") return ["dir"];
-	if (alg === "dir") return ["dir"];
-	return [alg];
-}
-function jwsAlgsFromCryptoKey(key) {
-	const name = key.algorithm.name;
-	const hashName = key.algorithm.hash?.name;
-	const hashBits = hashName?.startsWith("SHA-") ? hashName.slice(4) : void 0;
-	switch (name) {
-		case "HMAC": return hashBits ? [`HS${hashBits}`] : void 0;
-		case "RSASSA-PKCS1-v1_5": return hashBits ? [`RS${hashBits}`] : void 0;
-		case "RSA-PSS": return hashBits ? [`PS${hashBits}`] : void 0;
-		case "ECDSA": {
-			const curve = key.algorithm.namedCurve;
-			if (curve === "P-256") return ["ES256"];
-			if (curve === "P-384") return ["ES384"];
-			if (curve === "P-521") return ["ES512"];
-			return;
-		}
-		case "Ed25519": return ["Ed25519", "EdDSA"];
-		default: return;
-	}
-}
-function jweAlgsFromCryptoKey(key) {
-	const name = key.algorithm.name;
-	const hashName = key.algorithm.hash?.name;
-	const length = key.algorithm.length;
-	switch (name) {
-		case "AES-KW":
-			if (length === 128) return ["A128KW", "dir"];
-			if (length === 192) return ["A192KW", "dir"];
-			if (length === 256) return ["A256KW", "dir"];
-			return;
-		case "AES-GCM":
-			if (length === 128) return ["A128GCMKW", "dir"];
-			if (length === 192) return ["A192GCMKW", "dir"];
-			if (length === 256) return ["A256GCMKW", "dir"];
-			return;
-		case "RSA-OAEP":
-			if (hashName === "SHA-1") return ["RSA-OAEP"];
-			if (hashName === "SHA-256") return ["RSA-OAEP-256"];
-			if (hashName === "SHA-384") return ["RSA-OAEP-384"];
-			if (hashName === "SHA-512") return ["RSA-OAEP-512"];
-			return;
-		case "ECDH":
-		case "X25519":
-		case "X448": return [
-			"ECDH-ES",
-			"ECDH-ES+A128KW",
-			"ECDH-ES+A192KW",
-			"ECDH-ES+A256KW"
-		];
-		default: return;
-	}
-}
-function applyTypCtyDefaults(header, payload) {
-	if (!(typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array))) return header;
-	let typ = header.typ;
-	if (typ === void 0) header.typ = typ = "JWT";
-	if (typ === "JWT" || typ === "jwt" || typ.toLowerCase().includes("jwt")) header.cty ||= "application/json";
-	return header;
-}
-function isJWTContent(header) {
-	if (!header) return false;
-	if (header.typ?.toLowerCase().includes("jwt")) return true;
-	const cty = header.cty?.toLowerCase();
-	return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
-}
-function decodeMaybeJWTString(decodedString) {
-	if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) try {
-		return safeJsonParse(decodedString);
-	} catch {}
-	return decodedString;
-}
-function decodePayloadFromBytes(bytes, forceUint8Array) {
-	if (forceUint8Array) return bytes;
-	return decodeMaybeJWTString(textDecoder.decode(bytes));
-}
-function decodePayloadFromB64UrlSegment(payloadEncoded, forceUint8Array) {
-	if (forceUint8Array) return base64UrlDecode(payloadEncoded, { returnAs: "uint8array" });
-	return decodeMaybeJWTString(base64UrlDecode(payloadEncoded));
-}
-function getPlaintextBytes(payload) {
-	if (payload instanceof Uint8Array) return payload;
-	if (typeof payload === "string") return textEncoder.encode(payload);
-	if (typeof payload === "object" && payload !== null) return textEncoder.encode(JSON.stringify(payload));
-	throw new TypeError("Plaintext must be a string, Uint8Array, or a JSON-serializable object.");
-}
-const TIME_CONSTANTS = Object.freeze({
-	s: 1,
-	second: 1,
-	seconds: 1,
-	m: 60,
-	minute: 60,
-	minutes: 60,
-	h: 3600,
-	hour: 3600,
-	hours: 3600,
-	D: 86400,
-	day: 86400,
-	days: 86400,
-	W: 604800,
-	week: 604800,
-	weeks: 604800,
-	M: 2592e3,
-	month: 2592e3,
-	months: 2592e3,
-	Y: 31536e3,
-	year: 31536e3,
-	years: 31536e3
-});
-const DURATION_REGEX = /^(\d+)(s|second|seconds|m|minute|minutes|h|hour|hours|D|day|days|W|week|weeks|M|month|months|Y|year|years)?$/;
-function _parseDurationSeconds(value) {
-	if (typeof value === "number") {
-		if (!Number.isInteger(value)) throw new TypeError("Duration must be an integer number of seconds.");
-		return value;
-	}
-	if (typeof value === "string") {
-		const match = value.match(DURATION_REGEX);
-		if (!match || !match[1]) throw new TypeError("Invalid duration format. Must be an integer or a string like '10m', '2h', '7D', etc.");
-		return Number.parseInt(match[1], 10) * TIME_CONSTANTS[match[2] || "s"];
-	}
-	throw new TypeError("Duration must be a number or a string representing time.");
-}
-function computeDurationInSeconds(duration) {
-	const seconds = _parseDurationSeconds(duration);
-	if (seconds <= 0) throw new TypeError("Duration must be a positive integer number of seconds.");
-	return seconds;
-}
-const computeExpiresInSeconds = computeDurationInSeconds;
-const computeMaxTokenAgeSeconds = computeDurationInSeconds;
-function computeJwtTimeClaims(payload, options) {
-	const { currentDate, expiresIn, expiresAt, notBeforeIn, notBeforeAt } = options ?? {};
-	if (expiresIn !== void 0 && expiresAt !== void 0) throw new JWTError("\"expiresIn\" and \"expiresAt\" are mutually exclusive; pass only one.", "ERR_JWT_CLAIM_INVALID");
-	if (notBeforeIn !== void 0 && notBeforeAt !== void 0) throw new JWTError("\"notBeforeIn\" and \"notBeforeAt\" are mutually exclusive; pass only one.", "ERR_JWT_CLAIM_INVALID");
-	const hasExpHint = expiresIn !== void 0 || expiresAt !== void 0;
-	const hasNbfHint = notBeforeIn !== void 0 || notBeforeAt !== void 0;
-	if (!hasExpHint && !hasNbfHint) return void 0;
-	if (!payload || typeof payload !== "object" || payload instanceof Uint8Array) return void 0;
-	const typedPayload = payload;
-	const wantsExp = hasExpHint && typedPayload.exp === void 0;
-	const wantsNbf = hasNbfHint && typedPayload.nbf === void 0;
-	if (!wantsExp && !wantsNbf) return void 0;
-	const now = Math.round((currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
-	const claims = { ...typedPayload };
-	claims.iat ||= now;
-	if (wantsExp) if (expiresAt !== void 0) {
-		const expMs = expiresAt.getTime();
-		if (!Number.isFinite(expMs)) throw new JWTError("\"expiresAt\" must be a valid Date.", "ERR_JWT_CLAIM_INVALID");
-		claims.exp = Math.floor(expMs / 1e3);
-	} else claims.exp = claims.iat + computeDurationInSeconds(expiresIn);
-	if (wantsNbf) if (notBeforeAt !== void 0) {
-		const nbfMs = notBeforeAt.getTime();
-		if (!Number.isFinite(nbfMs)) throw new JWTError("\"notBeforeAt\" must be a valid Date.", "ERR_JWT_CLAIM_INVALID");
-		claims.nbf = Math.floor(nbfMs / 1e3);
-	} else {
-		const offset = _parseDurationSeconds(notBeforeIn);
-		if (offset < 0) throw new JWTError("\"notBeforeIn\" must be zero or a positive duration.", "ERR_JWT_CLAIM_INVALID");
-		claims.nbf = claims.iat + offset;
-	}
-	return claims;
-}
-function validateJwtClaims(jwtClaims, options = {}) {
-	const clockTolerance = options.clockTolerance ?? 0;
-	const currentTime = Math.round((options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
-	if (options.requiredClaims || options.issuer || options.audience || options.subject || options.maxTokenAge) {
-		const allRequiredClaims = new Set(options.requiredClaims || []);
-		if (options.issuer) allRequiredClaims.add("iss");
-		if (options.audience) allRequiredClaims.add("aud");
-		if (options.subject) allRequiredClaims.add("sub");
-		if (options.maxTokenAge) allRequiredClaims.add("iat");
-		const missingClaims = [];
-		for (const claimName of allRequiredClaims) if (!(claimName in jwtClaims)) missingClaims.push(claimName);
-		if (missingClaims.length > 0) throw new JWTError(`Missing required JWT Claims: ${missingClaims.join(", ")}`, "ERR_JWT_CLAIM_MISSING");
-	}
-	if (jwtClaims.exp !== void 0 && !Number.isFinite(jwtClaims.exp)) throw new JWTError("JWT \"exp\" (Expiration Time) Claim must be a number.", "ERR_JWT_CLAIM_INVALID");
-	if (jwtClaims.nbf !== void 0 && !Number.isFinite(jwtClaims.nbf)) throw new JWTError("JWT \"nbf\" (Not Before) Claim must be a number.", "ERR_JWT_CLAIM_INVALID");
-	if (jwtClaims.iat !== void 0 && !Number.isFinite(jwtClaims.iat)) throw new JWTError("JWT \"iat\" (Issued At) Claim must be a number.", "ERR_JWT_CLAIM_INVALID");
-	if (options.issuer) {
-		const expectedIssuers = maybeArray(options.issuer);
-		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new JWTError(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`, "ERR_JWT_CLAIM_INVALID");
-	}
-	if (options.subject && jwtClaims.sub !== options.subject) throw new JWTError(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`, "ERR_JWT_CLAIM_INVALID");
-	if (options.audience) {
-		const expectedAudiences = maybeArray(options.audience);
-		const claimAudience = maybeArray(jwtClaims.aud || []);
-		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new JWTError(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`, "ERR_JWT_CLAIM_INVALID");
-	}
-	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new JWTError(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`, "ERR_JWT_NBF");
-	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
-		jti: jwtClaims.jti,
-		iat: jwtClaims.iat,
-		exp: jwtClaims.exp
-	});
-	if (options.maxTokenAge) {
-		if (typeof jwtClaims.iat !== "number") throw new JWTError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.", "ERR_JWT_CLAIM_INVALID");
-		if (jwtClaims.iat > currentTime + clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_CLAIM_INVALID");
-		if (jwtClaims.iat < currentTime - computeDurationInSeconds(options.maxTokenAge) - clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
-			jti: jwtClaims.jti,
-			iat: jwtClaims.iat,
-			exp: jwtClaims.exp
-		});
-	}
-}
-const BASE_PROCESSED_JWS = [
-	"alg",
-	"typ",
-	"cty",
-	"kid",
-	"b64"
-];
-const BASE_PROCESSED_JWE = [
-	"alg",
-	"enc",
-	"typ",
-	"cty",
-	"kid",
-	"iv",
-	"tag",
-	"p2s",
-	"p2c",
-	"epk",
-	"apu",
-	"apv"
-];
-function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders = []) {
-	if (!protectedHeader.crit) return;
-	const missingHeaderParams = /* @__PURE__ */ new Set();
-	const recognizedParams = new Set([...recognizedHeaders, ...BASE_PROCESSED_JWS]);
-	for (const param of protectedHeader.crit) {
-		if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) continue;
-		missingHeaderParams.add(param);
-	}
-	if (missingHeaderParams.size > 0) throw new JWTError(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`, "ERR_JWS_INVALID");
-}
-function validateCriticalHeadersJWE(protectedHeader, recognizedHeaders) {
-	if (!protectedHeader.crit) return;
-	const understoodParams = new Set([...recognizedHeaders || [], ...BASE_PROCESSED_JWE]);
-	for (const critParam of protectedHeader.crit) {
-		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new JWTError(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`, "ERR_JWE_INVALID");
-		if (!understoodParams.has(critParam)) throw new JWTError(`Unprocessed critical header parameters: ${critParam}`, "ERR_JWE_INVALID");
-	}
-}
-function concatUint8Arrays(...arrays) {
-	const totalLength = arrays.reduce((length, arr) => length + arr.length, 0);
-	const result = new Uint8Array(totalLength);
-	let offset = 0;
-	for (const arr of arrays) {
-		result.set(arr, offset);
-		offset += arr.length;
-	}
-	return result;
-}
-function maybeArray(item) {
-	return Array.isArray(item) ? item : [item];
-}
-function isJWK(key) {
-	return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
-}
-function isJWKSet(key) {
-	return key && typeof key === "object" && "keys" in key && Array.isArray(key.keys);
-}
-function assertCryptoKey(key) {
-	if (!isCryptoKey(key)) throw new Error("CryptoKey instance expected");
-}
-function isCryptoKey(key) {
-	return key?.[Symbol.toStringTag] === "CryptoKey";
-}
-const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(key.publicKey) && isCryptoKey(key.privateKey);
-function isSymmetricJWK(key) {
-	return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
-}
-function isAsymmetricJWK(key) {
-	return !isSymmetricJWK(key);
-}
-function isPrivateJWK(key) {
-	if (!isJWK(key)) return false;
-	if (key.kty === "EC") return typeof key.d === "string";
-	if (key.kty === "OKP") return typeof key.d === "string";
-	if (key.kty === "RSA") return typeof key.d === "string";
-	return false;
-}
-function isPublicJWK(key) {
-	if (!isJWK(key)) return false;
-	if (key.kty === "EC") {
-		const ec = key;
-		return typeof ec.x === "string" && typeof ec.y === "string" && typeof ec.d !== "string";
-	}
-	if (key.kty === "OKP") {
-		const okp = key;
-		return typeof okp.x === "string" && typeof okp.d !== "string";
-	}
-	if (key.kty === "RSA") {
-		const rsa = key;
-		return typeof rsa.n === "string" && typeof rsa.e === "string" && typeof rsa.d !== "string";
-	}
-	return false;
-}
-export { JWTError, applyTypCtyDefaults, assertCryptoKey, computeDurationInSeconds, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };