unjwt 0.8.1 → 0.8.3

package/dist/_chunks/_cookie-attributes.d.mts

@@ -0,0 +1,12 @@
+/** The `Set-Cookie` attributes of a session cookie (RFC 6265, RFC 6265bis, CHIPS). */
+export interface CookieAttributes {
+  domain?: string;
+  expires?: Date;
+  httpOnly?: boolean;
+  maxAge?: number;
+  path?: string;
+  priority?: "low" | "medium" | "high";
+  sameSite?: boolean | "lax" | "strict" | "none";
+  secure?: boolean;
+  partitioned?: boolean;
+}

package/dist/_chunks/_jwt-internal.mjs

@@ -283,29 +283,32 @@ function getPlaintextBytes(payload) {
 	throw new JWTError("Plaintext must be a string, Uint8Array, or a JSON-serializable object.", "ERR_INVALID_OPTION");
 }
 function computeJwtTimeClaims(payload, options) {
-	const { currentDate, expiresIn, expiresAt, notBeforeIn, notBeforeAt } = options ?? {};
+	const { currentDate, issuedAt, expiresIn, expiresAt, notBeforeIn, notBeforeAt } = options ?? {};
+	if (issuedAt !== void 0 && typeof issuedAt !== "boolean" && !(issuedAt instanceof Date)) throw new JWTError("\"issuedAt\" must be a boolean or a Date.", "ERR_INVALID_OPTION");
 	if (expiresIn !== void 0 && expiresAt !== void 0) throw new JWTError("\"expiresIn\" and \"expiresAt\" are mutually exclusive; pass only one.", "ERR_JWT_CLAIM_INVALID");
 	if (notBeforeIn !== void 0 && notBeforeAt !== void 0) throw new JWTError("\"notBeforeIn\" and \"notBeforeAt\" are mutually exclusive; pass only one.", "ERR_JWT_CLAIM_INVALID");
 	const hasExpHint = expiresIn !== void 0 || expiresAt !== void 0;
 	const hasNbfHint = notBeforeIn !== void 0 || notBeforeAt !== void 0;
-	if (!hasExpHint && !hasNbfHint) return void 0;
+	const hasIatHint = issuedAt === true || issuedAt instanceof Date;
+	if (!hasExpHint && !hasNbfHint && !hasIatHint) return void 0;
 	if (!payload || typeof payload !== "object" || payload instanceof Uint8Array) return void 0;
 	const wantsExp = hasExpHint && (!("exp" in payload) || payload.exp === void 0);
 	const wantsNbf = hasNbfHint && (!("nbf" in payload) || payload.nbf === void 0);
-	if (!wantsExp && !wantsNbf) return void 0;
+	const wantsIat = hasIatHint && (!("iat" in payload) || payload.iat === void 0);
+	if (!wantsExp && !wantsNbf && !wantsIat) return void 0;
 	const now = Math.round((currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
 	const claims = { ...payload };
-	claims.iat ||= now;
+	claims.iat ||= issuedAt instanceof Date ? Math.floor(_instantOf(issuedAt, "issuedAt") / 1e3) : now;
 	if (wantsExp) {
 		if (expiresAt !== void 0) claims.exp = Math.floor(_instantOf(expiresAt, "expiresAt") / 1e3);
-		else if (expiresIn !== void 0) claims.exp = claims.iat + computeDurationInSeconds(expiresIn);
+		else if (expiresIn !== void 0) claims.exp = now + computeDurationInSeconds(expiresIn);
 	}
 	if (wantsNbf) {
 		if (notBeforeAt !== void 0) claims.nbf = Math.floor(_instantOf(notBeforeAt, "notBeforeAt") / 1e3);
 		else if (notBeforeIn !== void 0) {
 			const offset = parseDurationSeconds(notBeforeIn);
 			if (offset < 0) throw new JWTError("\"notBeforeIn\" must be zero or a positive duration.", "ERR_JWT_CLAIM_INVALID");
-			claims.nbf = claims.iat + offset;
+			claims.nbf = now + offset;
 		}
 	}
 	return claims;

package/dist/_chunks/digest.d.mts

@@ -0,0 +1,8 @@
+/** Hash functions the JOSE specs name for digests carried in tokens. */
+export type DigestHash = "SHA-256" | "SHA-384" | "SHA-512";
+/**
+ * The base64url digest of text or bytes, SHA-256 unless `hash` says otherwise: a DPoP `ath`
+ * (RFC 9449 §4.2) over the access token, an `x5t#S256` over a certificate, the last step of a
+ * JWK thumbprint. Text is digested as UTF-8.
+ */
+export declare function digestUrl(data: string | Uint8Array<ArrayBuffer>, hash?: DigestHash): Promise<string>;

package/dist/_chunks/{algorithms.mjs → digest.mjs}

@@ -1,4 +1,5 @@
-import { JWTError, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet } from "./_jwt-internal.mjs";
+import { textEncoder } from "./libs/unsecure.mjs";
+import { JWTError, base64UrlStringify, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet } from "./_jwt-internal.mjs";
 const ECDSA_CURVES = /* @__PURE__ */ Object.freeze({
 	ES256: "P-256",
 	ES384: "P-384",
@@ -7,8 +8,26 @@ const ECDSA_CURVES = /* @__PURE__ */ Object.freeze({
 function jwsHashOf(alg) {
 	return `SHA-${alg.slice(-3)}`;
 }
+const RSA_OAEP_HASH = /* @__PURE__ */ Object.freeze({
+	"RSA-OAEP": "SHA-1",
+	"RSA-OAEP-256": "SHA-256",
+	"RSA-OAEP-384": "SHA-384",
+	"RSA-OAEP-512": "SHA-512"
+});
 function rsaOaepHashOf(alg) {
-	return `SHA-${Number.parseInt(alg.slice(9), 10) || 1}`;
+	return RSA_OAEP_HASH[alg];
+}
+function pbes2HashOf(alg) {
+	return `SHA-${alg.slice(8, 11)}`;
+}
+const SHA_BITS = /* @__PURE__ */ Object.freeze({
+	"SHA-1": 1,
+	"SHA-256": 256,
+	"SHA-384": 384,
+	"SHA-512": 512
+});
+function shaBitsOf(sha) {
+	return SHA_BITS[sha];
 }
 function aesBitsOf(alg) {
 	return Number.parseInt(alg.slice(1, 4), 10);
@@ -51,12 +70,62 @@ const PBES2_ALGORITHMS = [
 	"PBES2-HS384+A192KW",
 	"PBES2-HS512+A256KW"
 ];
+const PBES2_ALGORITHM_SET = /* @__PURE__ */ new Set(PBES2_ALGORITHMS);
+function isPBES2Algorithm(alg) {
+	return PBES2_ALGORITHM_SET.has(alg);
+}
+const JWS_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
+	HS256: true,
+	HS384: true,
+	HS512: true,
+	RS256: true,
+	RS384: true,
+	RS512: true,
+	PS256: true,
+	PS384: true,
+	PS512: true,
+	ES256: true,
+	ES384: true,
+	ES512: true,
+	Ed25519: true,
+	EdDSA: true
+}));
+function isJWSAlgorithm(alg) {
+	return JWS_ALGORITHMS.has(alg);
+}
+const KEY_MANAGEMENT_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
+	"dir": true,
+	"A128KW": true,
+	"A192KW": true,
+	"A256KW": true,
+	"A128GCMKW": true,
+	"A192GCMKW": true,
+	"A256GCMKW": true,
+	"PBES2-HS256+A128KW": true,
+	"PBES2-HS384+A192KW": true,
+	"PBES2-HS512+A256KW": true,
+	"RSA-OAEP": true,
+	"RSA-OAEP-256": true,
+	"RSA-OAEP-384": true,
+	"RSA-OAEP-512": true,
+	"ECDH-ES": true,
+	"ECDH-ES+A128KW": true,
+	"ECDH-ES+A192KW": true,
+	"ECDH-ES+A256KW": true
+}));
+function isKeyManagementAlgorithm(alg) {
+	return KEY_MANAGEMENT_ALGORITHMS.has(alg);
+}
 const ECDH_ES_ALGORITHMS = [
 	"ECDH-ES",
 	"ECDH-ES+A128KW",
 	"ECDH-ES+A192KW",
 	"ECDH-ES+A256KW"
 ];
+const ECDH_ES_ALGORITHM_SET = /* @__PURE__ */ new Set(ECDH_ES_ALGORITHMS);
+function isECDHESAlgorithm(alg) {
+	return ECDH_ES_ALGORITHM_SET.has(alg);
+}
 function inferJWSAllowedAlgorithms(key, options) {
 	if (!key || typeof key === "function") return void 0;
 	if (typeof key === "string" || key instanceof Uint8Array) return void 0;
@@ -92,7 +161,7 @@ function isEd25519Signature(alg) {
 }
 function jwsAlgsFromJWK(jwk) {
 	if (jwk.alg && isEd25519Signature(jwk.alg)) return ["EdDSA", "Ed25519"];
-	if (jwk.alg) return declaredAlgorithm(jwk.alg);
+	if (jwk.alg) return isJWSAlgorithm(jwk.alg) ? [jwk.alg] : void 0;
 	if (jwk.kty === "EC") {
 		const crv = jwk.crv;
 		if (crv === "P-256") return ["ES256"];
@@ -105,7 +174,7 @@ function jwsAlgsFromJWK(jwk) {
 }
 function jweAlgsFromJWK(jwk) {
 	if (jwk.kty === "oct") return jweAlgsFromOctJWK(jwk);
-	if (jwk.alg) return declaredAlgorithm(jwk.alg);
+	if (jwk.alg) return isKeyManagementAlgorithm(jwk.alg) ? [jwk.alg] : void 0;
 	if (jwk.kty === "EC") {
 		const crv = jwk.crv;
 		if (crv === "P-256" || crv === "P-384" || crv === "P-521") return [...ECDH_ES_ALGORITHMS];
@@ -118,7 +187,7 @@ function jweAlgsFromOctJWK(jwk) {
 	const alg = jwk.alg;
 	if (!alg) return void 0;
 	if (isContentEncryptionAlgorithm(alg)) return ["dir"];
-	return declaredAlgorithm(alg);
+	return isKeyManagementAlgorithm(alg) ? [alg] : void 0;
 }
 function isContentEncryptionAlgorithm(alg) {
 	return CONTENT_ENCRYPTION_ALGORITHMS.has(alg);
@@ -180,7 +249,8 @@ function jwsHashBits(hashName) {
 	if (hashName === "SHA-384") return "384";
 	if (hashName === "SHA-512") return "512";
 }
-function declaredAlgorithm(alg) {
-	return [alg];
+async function digestUrl(data, hash = "SHA-256") {
+	const bytes = typeof data === "string" ? textEncoder.encode(data) : data;
+	return base64UrlStringify(new Uint8Array(await crypto.subtle.digest(hash, bytes)));
 }
-export { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, checkKeyUsage, cryptoKeyCurve, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isEd25519Signature, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, rsaOaepHashOf, unusableKey };
+export { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, checkKeyUsage, cryptoKeyCurve, digestUrl, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isECDHESAlgorithm, isEd25519Signature, isJWSAlgorithm, isKeyManagementAlgorithm, isPBES2Algorithm, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, pbes2HashOf, rsaOaepHashOf, shaBitsOf, unusableKey };