unjwt 0.8.0 → 0.8.2

package/dist/_chunks/_cookie-attributes.d.mts

@@ -0,0 +1,12 @@
+/** The `Set-Cookie` attributes of a session cookie (RFC 6265, RFC 6265bis, CHIPS). */
+export interface CookieAttributes {
+  domain?: string;
+  expires?: Date;
+  httpOnly?: boolean;
+  maxAge?: number;
+  path?: string;
+  priority?: "low" | "medium" | "high";
+  sameSite?: boolean | "lax" | "strict" | "none";
+  secure?: boolean;
+  partitioned?: boolean;
+}

package/dist/_chunks/_jwt-internal.mjs

@@ -68,7 +68,7 @@ function isSymmetricJWK(key) {
 	return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
 }
 function isAsymmetricJWK(key) {
-	return !isSymmetricJWK(key);
+	return isJWK(key) && key.kty !== "oct";
 }
 function isPrivateJWK(key) {
 	if (!isJWK(key) || key.kty === "oct") return false;

package/dist/_chunks/digest.d.mts

@@ -0,0 +1,8 @@
+/** Hash functions the JOSE specs name for digests carried in tokens. */
+export type DigestHash = "SHA-256" | "SHA-384" | "SHA-512";
+/**
+ * The base64url digest of text or bytes, SHA-256 unless `hash` says otherwise: a DPoP `ath`
+ * (RFC 9449 §4.2) over the access token, an `x5t#S256` over a certificate, the last step of a
+ * JWK thumbprint. Text is digested as UTF-8.
+ */
+export declare function digestUrl(data: string | Uint8Array<ArrayBuffer>, hash?: DigestHash): Promise<string>;

package/dist/_chunks/{algorithms.mjs → digest.mjs}

@@ -1,4 +1,5 @@
-import { JWTError, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet } from "./_jwt-internal.mjs";
+import { textEncoder } from "./libs/unsecure.mjs";
+import { JWTError, base64UrlStringify, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet } from "./_jwt-internal.mjs";
 const ECDSA_CURVES = /* @__PURE__ */ Object.freeze({
 	ES256: "P-256",
 	ES384: "P-384",
@@ -7,8 +8,26 @@ const ECDSA_CURVES = /* @__PURE__ */ Object.freeze({
 function jwsHashOf(alg) {
 	return `SHA-${alg.slice(-3)}`;
 }
+const RSA_OAEP_HASH = /* @__PURE__ */ Object.freeze({
+	"RSA-OAEP": "SHA-1",
+	"RSA-OAEP-256": "SHA-256",
+	"RSA-OAEP-384": "SHA-384",
+	"RSA-OAEP-512": "SHA-512"
+});
 function rsaOaepHashOf(alg) {
-	return `SHA-${Number.parseInt(alg.slice(9), 10) || 1}`;
+	return RSA_OAEP_HASH[alg];
+}
+function pbes2HashOf(alg) {
+	return `SHA-${alg.slice(8, 11)}`;
+}
+const SHA_BITS = /* @__PURE__ */ Object.freeze({
+	"SHA-1": 1,
+	"SHA-256": 256,
+	"SHA-384": 384,
+	"SHA-512": 512
+});
+function shaBitsOf(sha) {
+	return SHA_BITS[sha];
 }
 function aesBitsOf(alg) {
 	return Number.parseInt(alg.slice(1, 4), 10);
@@ -51,12 +70,62 @@ const PBES2_ALGORITHMS = [
 	"PBES2-HS384+A192KW",
 	"PBES2-HS512+A256KW"
 ];
+const PBES2_ALGORITHM_SET = /* @__PURE__ */ new Set(PBES2_ALGORITHMS);
+function isPBES2Algorithm(alg) {
+	return PBES2_ALGORITHM_SET.has(alg);
+}
+const JWS_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
+	HS256: true,
+	HS384: true,
+	HS512: true,
+	RS256: true,
+	RS384: true,
+	RS512: true,
+	PS256: true,
+	PS384: true,
+	PS512: true,
+	ES256: true,
+	ES384: true,
+	ES512: true,
+	Ed25519: true,
+	EdDSA: true
+}));
+function isJWSAlgorithm(alg) {
+	return JWS_ALGORITHMS.has(alg);
+}
+const KEY_MANAGEMENT_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
+	"dir": true,
+	"A128KW": true,
+	"A192KW": true,
+	"A256KW": true,
+	"A128GCMKW": true,
+	"A192GCMKW": true,
+	"A256GCMKW": true,
+	"PBES2-HS256+A128KW": true,
+	"PBES2-HS384+A192KW": true,
+	"PBES2-HS512+A256KW": true,
+	"RSA-OAEP": true,
+	"RSA-OAEP-256": true,
+	"RSA-OAEP-384": true,
+	"RSA-OAEP-512": true,
+	"ECDH-ES": true,
+	"ECDH-ES+A128KW": true,
+	"ECDH-ES+A192KW": true,
+	"ECDH-ES+A256KW": true
+}));
+function isKeyManagementAlgorithm(alg) {
+	return KEY_MANAGEMENT_ALGORITHMS.has(alg);
+}
 const ECDH_ES_ALGORITHMS = [
 	"ECDH-ES",
 	"ECDH-ES+A128KW",
 	"ECDH-ES+A192KW",
 	"ECDH-ES+A256KW"
 ];
+const ECDH_ES_ALGORITHM_SET = /* @__PURE__ */ new Set(ECDH_ES_ALGORITHMS);
+function isECDHESAlgorithm(alg) {
+	return ECDH_ES_ALGORITHM_SET.has(alg);
+}
 function inferJWSAllowedAlgorithms(key, options) {
 	if (!key || typeof key === "function") return void 0;
 	if (typeof key === "string" || key instanceof Uint8Array) return void 0;
@@ -92,7 +161,7 @@ function isEd25519Signature(alg) {
 }
 function jwsAlgsFromJWK(jwk) {
 	if (jwk.alg && isEd25519Signature(jwk.alg)) return ["EdDSA", "Ed25519"];
-	if (jwk.alg) return declaredAlgorithm(jwk.alg);
+	if (jwk.alg) return isJWSAlgorithm(jwk.alg) ? [jwk.alg] : void 0;
 	if (jwk.kty === "EC") {
 		const crv = jwk.crv;
 		if (crv === "P-256") return ["ES256"];
@@ -105,7 +174,7 @@ function jwsAlgsFromJWK(jwk) {
 }
 function jweAlgsFromJWK(jwk) {
 	if (jwk.kty === "oct") return jweAlgsFromOctJWK(jwk);
-	if (jwk.alg) return declaredAlgorithm(jwk.alg);
+	if (jwk.alg) return isKeyManagementAlgorithm(jwk.alg) ? [jwk.alg] : void 0;
 	if (jwk.kty === "EC") {
 		const crv = jwk.crv;
 		if (crv === "P-256" || crv === "P-384" || crv === "P-521") return [...ECDH_ES_ALGORITHMS];
@@ -118,7 +187,7 @@ function jweAlgsFromOctJWK(jwk) {
 	const alg = jwk.alg;
 	if (!alg) return void 0;
 	if (isContentEncryptionAlgorithm(alg)) return ["dir"];
-	return declaredAlgorithm(alg);
+	return isKeyManagementAlgorithm(alg) ? [alg] : void 0;
 }
 function isContentEncryptionAlgorithm(alg) {
 	return CONTENT_ENCRYPTION_ALGORITHMS.has(alg);
@@ -180,7 +249,8 @@ function jwsHashBits(hashName) {
 	if (hashName === "SHA-384") return "384";
 	if (hashName === "SHA-512") return "512";
 }
-function declaredAlgorithm(alg) {
-	return [alg];
+async function digestUrl(data, hash = "SHA-256") {
+	const bytes = typeof data === "string" ? textEncoder.encode(data) : data;
+	return base64UrlStringify(new Uint8Array(await crypto.subtle.digest(hash, bytes)));
 }
-export { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, checkKeyUsage, cryptoKeyCurve, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isEd25519Signature, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, rsaOaepHashOf, unusableKey };
+export { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, checkKeyUsage, cryptoKeyCurve, digestUrl, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isECDHESAlgorithm, isEd25519Signature, isJWSAlgorithm, isKeyManagementAlgorithm, isPBES2Algorithm, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, pbes2HashOf, rsaOaepHashOf, shaBitsOf, unusableKey };