unjwt 0.8.3 → 0.8.4

package/dist/_chunks/_codec-jws.mjs

@@ -1,6 +1,6 @@
 import { sanitizeObjectCopy } from "./libs/unsecure.mjs";
 import { JWTError, computeDurationInSeconds, expiredClaimMessage, isCryptoKey, isJWK, isJWKSet, isJWTError, isPlainObject, isPrivateJWK, isPublicJWK, isSymmetricJWK } from "./_jwt-internal.mjs";
-import { importKey, quoteTokenValue } from "./jwk.mjs";
+import { importKey, quoteTokenValue } from "./_import-key.mjs";
 import { sign, verify } from "./jws.mjs";
 import { decrypt, encrypt } from "./jwe.mjs";
 const RESERVED_CLAIMS = [
@@ -46,8 +46,8 @@ function rethrowAsInvalidToken(error, options) {
 const TOKEN = /^[!#$%&'*+\-.^_`|~\w]+$/;
 const CHUNK_SUFFIX = /\.\d+$/;
 function assertSessionName(name, options) {
-	if (!isToken(name)) throw invalidConfigError(`${options.prefix} Session "name" must be a cookie name (RFC 6265 §4.1.1): letters, digits and !#$%&'*+-.^_\`|~ only. Got ${quoteTokenValue(name)}.`);
-	if (CHUNK_SUFFIX.test(name)) throw invalidConfigError(`${options.prefix} Session "name" cannot end in a dot and digits: ${quoteTokenValue(name)} is the cookie holding a chunk of the session named ${quoteTokenValue(name.replace(CHUNK_SUFFIX, ""))}.`);
+	if (!isToken(name)) throw invalidConfigError(`${options.prefix} Session "name" must be a valid cookie name (got ${quoteTokenValue(name)}).`);
+	if (CHUNK_SUFFIX.test(name)) throw invalidConfigError(`${options.prefix} Session "name" ${quoteTokenValue(name)} cannot end in a dot and digits.`);
 }
 function isToken(value) {
 	return typeof value === "string" && TOKEN.test(value);
@@ -57,7 +57,7 @@ function assertCookiePrefix(name, attrs, options) {
 	const host = lower.startsWith("__host-");
 	if (!host && !lower.startsWith("__secure-")) return;
 	const rule = host ? "\"__Host-\" cookie must be Secure, with Path=/ and no Domain" : "\"__Secure-\" cookie must be Secure";
-	if (attrs.secure === false || host && (attrs.domain !== void 0 || attrs.path !== void 0 && attrs.path !== "/")) throw invalidConfigError(`${options.prefix} Session ${quoteTokenValue(name)}: a ${rule} (RFC 6265bis §4.1.3).`);
+	if (attrs.secure === false || host && (attrs.domain !== void 0 || attrs.path !== void 0 && attrs.path !== "/")) throw invalidConfigError(`${options.prefix} Session ${quoteTokenValue(name)}: a ${rule}.`);
 }
 function assertRolling(config, options) {
 	const { rolling } = config;
@@ -65,10 +65,10 @@ function assertRolling(config, options) {
 	if (config.maxAge === void 0) throw invalidConfigError(`${options.prefix} "rolling" needs a "maxAge" to extend.`);
 	if (rolling === true) return;
 	if (!isExpiresIn(rolling)) throw new JWTError(`${options.prefix} "rolling" must be true or a duration.`, "ERR_INVALID_OPTION");
-	if (computeDurationInSeconds(rolling) >= computeDurationInSeconds(config.maxAge)) throw invalidConfigError(`${options.prefix} "rolling" must be shorter than "maxAge": the session would expire before it rolls.`);
+	if (computeDurationInSeconds(rolling) >= computeDurationInSeconds(config.maxAge)) throw invalidConfigError(`${options.prefix} "rolling" must be shorter than "maxAge".`);
 }
 function assertKeyMaterial(key, options) {
-	if (typeof key === "string") throw invalidKeyError(`${options.prefix} Session "key" must be a JWK or a CryptoKey, not a password string. Derive one once with deriveJWKFromPassword() and pass the result.`);
+	if (typeof key === "string") throw invalidKeyError(`${options.prefix} Session "key" cannot be a string, use deriveJWKFromPassword().`);
 	if (!key) throw invalidKeyError(`${options.prefix} Session "key" is required.`);
 }
 async function assertImportableKey(key, options) {
@@ -109,7 +109,7 @@ function sessionRequiredClaims(configured, options) {
 	return [...required];
 }
 function sanitizeSessionUpdate(update, options) {
-	if (!isPlainObject(update)) throw new JWTError(`${options.prefix} Session data must be a plain object, got ${Array.isArray(update) ? "an array" : typeof update}.`, "ERR_INVALID_OPTION");
+	if (!isPlainObject(update)) throw new JWTError(`${options.prefix} Session data must be a plain object.`, "ERR_INVALID_OPTION");
 	const sanitized = Object.create(null);
 	for (const key of Object.keys(update)) {
 		if (FORBIDDEN_KEYS.includes(key)) throw new JWTError(`${options.prefix} Session data cannot carry the key "${key}".`, "ERR_INVALID_OPTION");
@@ -205,7 +205,7 @@ function assertKeyPair(pair, options) {
 	if (!options.isPublic(pair.publicKey)) throw invalidKeyError(`${prefix} Invalid ${family} key: "publicKey" must be ${options.publicHalf}.`, pair);
 }
 function assertPinnedCryptoKey(key, options) {
-	if (isCryptoKey(key) && !options.pinned) throw invalidConfigError(`${options.prefix} A CryptoKey session key carries no algorithm: set ${options.hint}.`);
+	if (isCryptoKey(key) && !options.pinned) throw invalidConfigError(`${options.prefix} A CryptoKey session key carries no algorithm, set ${options.hint}.`);
 }
 function sessionPayload(state) {
 	const iat = Math.floor(state.createdAt / 1e3);
@@ -219,7 +219,7 @@ function sessionPayload(state) {
 }
 function assertNotFromTheFuture(payload, options) {
 	const tolerance = options.clockTolerance === void 0 ? 0 : computeDurationInSeconds(options.clockTolerance);
-	if (payload.iat > Math.floor(options.now / 1e3) + tolerance) throw invalidTokenError(`${options.prefix} Invalid session token: issued in the future (iat: ${(/* @__PURE__ */ new Date(payload.iat * 1e3)).toISOString()}).`);
+	if (payload.iat > Math.floor(options.now / 1e3) + tolerance) throw invalidTokenError(`${options.prefix} Invalid session token: "iat" is in the future (${(/* @__PURE__ */ new Date(payload.iat * 1e3)).toISOString()}).`);
 }
 function openedSession(payload) {
 	const data = Object.create(null);
@@ -294,7 +294,7 @@ function getEncryptKey(config, prefix) {
 		assertJWEKeyPair(key, prefix);
 		resolved = key.publicKey;
 	}
-	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key. It must be a JWK or a CryptoKey.`, key);
+	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key, expected a JWK or a CryptoKey.`, key);
 	assertPinnedAlgEnc(resolved, config, prefix);
 	return resolved;
 }
@@ -307,7 +307,7 @@ function getDecryptKey(config, prefix) {
 		assertJWEKeyPair(key, prefix);
 		resolved = key.privateKey;
 	}
-	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key. It must be a JWK, a private JWK, or a CryptoKey.`, key);
+	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key, expected a JWK, a private JWK or a CryptoKey.`, key);
 	assertPinnedAlgEnc(resolved, config, prefix);
 	return resolved;
 }
@@ -448,7 +448,7 @@ function resolveTransport(driver, event, options) {
 	return transport;
 }
 function assertTokenSource(transport, options) {
-	if (!transport.read) throw invalidConfigError(`${options.prefix} Session has no token source: "cookie" and "sessionHeader" are both disabled.`);
+	if (!transport.read) throw invalidConfigError(`${options.prefix} Session has no token source, enable "cookie" or "sessionHeader".`);
 }
 function assertWritable(transport, options) {
 	const { operation, prefix } = options;
@@ -458,7 +458,7 @@ function assertWritable(transport, options) {
 function assertSessionHeader(header, options) {
 	if (header === void 0 || typeof header === "boolean") return;
 	if (isToken(header)) return;
-	throw invalidConfigError(`${options.prefix} Session "sessionHeader" must be true, false or a header name: letters, digits and !#$%&'*+-.^_\`|~ only. Got ${quoteTokenValue(header)}.`);
+	throw invalidConfigError(`${options.prefix} Session "sessionHeader" must be true, false or a header name (got ${quoteTokenValue(header)}).`);
 }
 function sessionHeaderName(sessionName, configured) {
 	if (typeof configured === "string") return configured.toLowerCase();
@@ -561,7 +561,7 @@ function claimSessionName(record, options) {
 		return;
 	}
 	if (held === family) return;
-	throw invalidConfigError(`${prefix} Session name "${name}" is already used by a ${held.toUpperCase()} session on this request; a name is one cookie, so give this session a "name" of its own.`);
+	throw invalidConfigError(`${prefix} Session name "${name}" is already used by a ${held.toUpperCase()} session on this request.`);
 }
 const kSessionPending = Symbol("unjwt_session_pending");
 function sessionInstant(source) {
@@ -914,7 +914,7 @@ function getSignKey(config, prefix) {
 		assertJWSKeyPair(key, prefix);
 		resolved = key.privateKey;
 	}
-	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWS key. It must be a symmetric JWK, a private JWK, or a CryptoKey.`, key);
+	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWS key, expected a symmetric JWK, a private JWK or a CryptoKey.`, key);
 	assertPinnedAlg(resolved, config, prefix);
 	return resolved;
 }
@@ -927,7 +927,7 @@ function getVerifyKey(config, prefix) {
 		assertJWSKeyPair(key, prefix);
 		resolved = Array.isArray(key.publicKey) ? { keys: key.publicKey } : key.publicKey;
 	}
-	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWS key. It must be a symmetric JWK, a public JWK/set, or a CryptoKey.`, key);
+	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWS key, expected a symmetric JWK, a public JWK/set or a CryptoKey.`, key);
 	assertPinnedAlg(resolved, config, prefix);
 	return resolved;
 }
@@ -936,7 +936,7 @@ function assertJWSKeyPair(key, prefix) {
 		prefix,
 		family: "JWS",
 		isPublic: (half) => isCryptoKey(half) || isPublicJWK(half) || isPublicKeyList(Array.isArray(half) ? half : isJWKSet(half) ? half.keys : void 0),
-		publicHalf: "a public JWK, a non-empty list or set of public JWKs, or a CryptoKey"
+		publicHalf: "a public JWK, a non-empty JWK set or a CryptoKey"
 	});
 }
 function isPublicKeyList(keys) {