wkd-checker 2.3.0 → 2.4.0

package/dist/index.js

@@ -186,26 +186,24 @@ const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, v
         result.keyTypeValid = keyType === KeyType.BinaryKey;
         if (key) {
             const identities = yield key.getUserIDs();
-            // Spec Section 5: "The mail provider MUST make sure to publish a key in a way that only the mail address belonging to the requested user is part of the User ID packets included in the returned key."
-            // "Other User ID packets and their associated binding signatures MUST be removed before publication."
-            result.emailInKey = identities.length > 0;
-            for (const id of identities) {
-                const match = id.match(/<(.+)>/);
-                const emailInId = match ? match[1] : id;
-                if (emailInId.trim() !== email) {
-                    result.emailInKey = false;
-                    break;
-                }
-            }
+            // Helper to extract email address from User ID string ("Name <email@domain>" or "email@domain")
+            const extractEmail = (id) => {
+                const match = id.match(/<([^>]+)>/);
+                return (match ? match[1] : id).trim().toLowerCase();
+            };
+            const targetEmail = email.trim().toLowerCase();
+            const emailsInKey = identities.map(extractEmail);
+            // Spec Section 3.1 & Section 5: The key needs to carry a User ID packet with that mail address.
+            // Client MUST check that the received key has the requested User-Id and MUST drop all other User-Ids.
+            result.emailInKey = emailsInKey.includes(targetEmail);
             // Check policy compliance
             if (((_c = result.policy) === null || _c === void 0 ? void 0 : _c.mailboxOnly) && identities.length > 0) {
                 for (const id of identities) {
-                    // If mailbox-only, the ID MUST 
-                    const match = id.match(/<(.+)>/);
-                    const emailInId = match ? match[1] : id;
-                    const expected = [`<${emailInId.trim()}>`, emailInId.trim()];
-                    if (!expected.includes(id.trim())) {
+                    const emailInId = extractEmail(id);
+                    const expected = [`<${emailInId}>`, emailInId];
+                    if (!expected.includes(id.trim().toLowerCase())) {
                         result.policyCompliant = false;
+                        break;
                     }
                 }
             }
@@ -320,6 +318,9 @@ exports.getKey = getKey;
  * @returns {Promise<{ advanced: KeyCheckResult, direct: KeyCheckResult }>} Results for both lookup methods.
  */
 const checkKey = (email) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!(0, exports.validateEmail)(email)) {
+        throw new WKDError('Invalid e-mail address.');
+    }
     const { advancedUrl, directUrl, advancedPolicyUrl, directPolicyUrl } = yield generateWkdUrls(email);
     const options = {
         headers: { "User-Agent": USER_AGENT }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkd-checker",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Web Key Directory library for Node.js. Retreive OpenPGP keys from WKD servers and validate them.",
   "repository": {
     "type": "git",