ts-jose/dist/cjs/jwt.cjs

Wrap functions of JOSE in steady interface

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.JWT = void 0;
const jose_1 = require("jose");
const error_js_1 = require("./error.cjs");
const jwe_js_1 = require("./jwe.cjs");
const jws_js_1 = require("./jws.cjs");
class JWT {
    static async verify(token, jwk, options) {
        const key = await jws_js_1.JWS.getKeyFrom(token, jwk, options);
        const result = (await (typeof key === 'function'
            ? (0, jose_1.jwtVerify)(token, key, options)
            : (0, jose_1.jwtVerify)(token, key, options)));
        this.verifyJWTClaims(result.payload, options);
        return options?.complete
            ? {
                payload: result.payload,
                header: result.protectedHeader,
                key: result.key,
            }
            : result.payload;
    }
    static sign(payload, key, options) {
        const jwk = key.getKey({
            kid: options?.kid,
            use: 'sig',
            alg: options?.alg,
        });
        const jwt = new jose_1.SignJWT(payload);
        jwt.setProtectedHeader({
            typ: options?.typ ?? 'jwt',
            kid: options?.kid ?? jwk.kid,
            alg: options?.alg ?? jwk.alg ?? '',
            jwk: options?.jwk ? jwk.toObject() : undefined,
        });
        this.setupJwt(jwt, options ?? {});
        return jwt.sign(jwk.key);
    }
    static async decrypt(cypher, key, options) {
        const jwk = await jwe_js_1.JWE.getKeyFrom(cypher, key, options);
        if (typeof options?.enc === 'string')
            options.enc = [options.enc];
        if (typeof options?.alg === 'string')
            options.alg = [options.alg];
        const result = await (0, jose_1.jwtDecrypt)(cypher, jwk.key, {
            contentEncryptionAlgorithms: options?.enc,
            keyManagementAlgorithms: options?.alg,
            ...options,
        });
        this.verifyJWTClaims(result.payload, options);
        return options?.complete
            ? {
                payload: result.payload,
                header: result.protectedHeader,
            }
            : result.payload;
    }
    static async encrypt(payload, key, options) {
        const jwk = await key
            .getKey({
            kid: options.kid,
            use: 'enc',
        })
            .toPublic();
        const jwt = new jose_1.EncryptJWT(payload);
        this.setupJwt(jwt, options);
        jwt.setProtectedHeader({
            alg: options.alg,
            enc: options.enc,
            kid: options.kid ?? jwk.kid,
            typ: options.typ ?? 'jwt',
        });
        return jwt.encrypt(jwk.key);
    }
    static setupJwt(jwt, options) {
        options.issuer && jwt.setIssuer(options.issuer);
        options.audience && jwt.setAudience(options.audience);
        options.subject && jwt.setSubject(options.subject);
        options.exp && jwt.setExpirationTime(options.exp);
        options.jti && jwt.setJti(options.jti);
        options.notBefore && jwt.setNotBefore(options.notBefore);
        options.iat && jwt.setIssuedAt(options.iat);
    }
    static verifyJWTClaims(payload, options) {
        if (options === undefined)
            return;
        if (options.jti && options.jti !== payload.jti) {
            throw new error_js_1.JoseError('Claim', 'jti', payload.jti, options.jti);
        }
    }
}
exports.JWT = JWT;
//# sourceMappingURL=jwt.js.map