@atproto/jwk
Version:
A library for working with JSON Web Keys (JWKs) in TypeScript. This is meant to be extended by environment-specific libraries like @atproto/jwk-jose.
413 lines • 16.2 kB
TypeScript
import type { PrivateKeyUsage } from './jwk.js';
import type { JwksPub } from './jwks.js';
import type { VerifyOptions, VerifyResult } from './jwt-verify.js';
import type { JwtHeader, JwtPayload, SignedJwt } from './jwt.js';
import type { ActivityCheckOptions, Key, KeyMatchOptions } from './key.js';
import { type Override } from './util.js';
export type { ActivityCheckOptions, KeyMatchOptions };
export type FindKeyOptions = KeyMatchOptions & ActivityCheckOptions;
export type JwtSignHeader = Override<JwtHeader, Pick<FindKeyOptions, 'alg' | 'kid'>>;
export type JwtPayloadGetter<P = JwtPayload> = (header: JwtHeader, key: Key) => P | PromiseLike<P>;
export declare class Keyset<K extends Key = Key> implements Iterable<K> {
/**
* The preferred algorithms to use when signing a JWT using this keyset.
*
* @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1}
*/
readonly preferredSigningAlgorithms: readonly string[];
private readonly keys;
constructor(iterable: Iterable<K | null | undefined | false>,
/**
* The preferred algorithms to use when signing a JWT using this keyset.
*
* @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1}
*/
preferredSigningAlgorithms?: readonly string[]);
get size(): number;
get signAlgorithms(): readonly string[];
get publicJwks(): Readonly<{
keys: readonly (Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "RSA";
alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
n: string;
e: string;
d?: string | undefined;
p?: string | undefined;
q?: string | undefined;
dp?: string | undefined;
dq?: string | undefined;
qi?: string | undefined;
oth?: {
r?: string | undefined;
d?: string | undefined;
t?: string | undefined;
}[] | undefined;
} & {
kid: NonNullable<unknown>;
} & {
d?: never;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256" | "ES384" | "ES512" | undefined;
crv: "P-256" | "P-384" | "P-521";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
} & {
d?: never;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256K" | undefined;
crv: "secp256k1";
x: string;
y: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
} & {
d?: never;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "OKP";
alg?: "EdDSA" | undefined;
crv: "Ed25519" | "Ed448";
x: string;
d?: string | undefined;
} & {
kid: NonNullable<unknown>;
} & {
d?: never;
}>)[];
}>;
get privateJwks(): Readonly<{
keys: readonly (Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "RSA";
alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
n: string;
e: string;
d?: string | undefined;
p?: string | undefined;
q?: string | undefined;
dp?: string | undefined;
dq?: string | undefined;
qi?: string | undefined;
oth?: {
r?: string | undefined;
d?: string | undefined;
t?: string | undefined;
}[] | undefined;
} & {
k: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "RSA";
alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
n: string;
e: string;
d?: string | undefined;
p?: string | undefined;
q?: string | undefined;
dp?: string | undefined;
dq?: string | undefined;
qi?: string | undefined;
oth?: {
r?: string | undefined;
d?: string | undefined;
t?: string | undefined;
}[] | undefined;
} & {
d: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256" | "ES384" | "ES512" | undefined;
crv: "P-256" | "P-384" | "P-521";
x: string;
y: string;
d?: string | undefined;
} & {
k: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256" | "ES384" | "ES512" | undefined;
crv: "P-256" | "P-384" | "P-521";
x: string;
y: string;
d?: string | undefined;
} & {
d: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256K" | undefined;
crv: "secp256k1";
x: string;
y: string;
d?: string | undefined;
} & {
k: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "EC";
alg?: "ES256K" | undefined;
crv: "secp256k1";
x: string;
y: string;
d?: string | undefined;
} & {
d: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "OKP";
alg?: "EdDSA" | undefined;
crv: "Ed25519" | "Ed448";
x: string;
d?: string | undefined;
} & {
k: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "OKP";
alg?: "EdDSA" | undefined;
crv: "Ed25519" | "Ed448";
x: string;
d?: string | undefined;
} & {
d: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "oct";
alg?: "HS256" | "HS384" | "HS512" | undefined;
k: string;
} & {
k: NonNullable<unknown>;
}> | Readonly<{
kid?: string | undefined;
use?: "enc" | "sig" | undefined;
key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
x5c?: string[] | undefined;
x5t?: string | undefined;
'x5t#S256'?: string | undefined;
x5u?: string | undefined;
ext?: boolean | undefined;
iat?: number | undefined;
exp?: number | undefined;
nbf?: number | undefined;
revoked?: {
revoked_at: number;
reason?: string | undefined;
} | undefined;
kty: "oct";
alg?: "HS256" | "HS384" | "HS512" | undefined;
k: string;
} & {
d: NonNullable<unknown>;
}>)[];
}>;
has(kid: string): boolean;
get(options: FindKeyOptions): K;
find(options: FindKeyOptions): K | undefined;
list<O extends FindKeyOptions>(options: O): Generator<K, void, unknown>;
findPrivateKey({ kid, alg, usage, ...options }: FindKeyOptions & {
usage: PrivateKeyUsage;
}): {
key: Key;
alg: string;
};
[Symbol.iterator](): IterableIterator<K>;
createJwt({ alg: sAlg, kid: sKid, ...header }: JwtSignHeader, payload: JwtPayload | JwtPayloadGetter): Promise<SignedJwt>;
verifyJwt<C extends string = never>(token: SignedJwt, options?: ActivityCheckOptions & VerifyOptions<C>): Promise<VerifyResult<C> & {
key: K;
}>;
toJSON(): JwksPub;
}
//# sourceMappingURL=keyset.d.ts.map