jose/dist/node/esm/runtime/verify.js

Universal 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies

import { verify as oneShotVerify, timingSafeEqual, KeyObject } from 'crypto';
import nodeDigest from './dsa_digest.js';
import nodeKey from './node_key.js';
import sign from './sign.js';
import { isCryptoKey, getKeyObject } from './webcrypto.js';
const verify = async (alg, key, signature, data) => {
    if (alg.startsWith('HS')) {
        const expected = await sign(alg, key, data);
        const actual = signature;
        try {
            return timingSafeEqual(actual, expected);
        }
        catch {
            return false;
        }
    }
    const algorithm = nodeDigest(alg);
    if (isCryptoKey(key)) {
        key = getKeyObject(key);
    }
    else if (!(key instanceof KeyObject)) {
        throw new TypeError('invalid key object type provided');
    }
    return oneShotVerify(algorithm, data, nodeKey(alg, key), signature);
};
export default verify;