ts-jose/dist/mjs/jwt.js

Wrap functions of JOSE in steady interface

import { EncryptJWT, jwtDecrypt, jwtVerify, SignJWT, } from 'jose';
import { JoseError } from './error.js';
import { JWE } from './jwe.js';
import { JWS } from './jws.js';
export class JWT {
    static async verify(token, jwk, options) {
        const key = await JWS.getKeyFrom(token, jwk, options);
        const result = (await (typeof key === 'function'
            ? jwtVerify(token, key, options)
            : jwtVerify(token, key, options)));
        this.verifyJWTClaims(result.payload, options);
        return options?.complete
            ? {
                payload: result.payload,
                header: result.protectedHeader,
                key: result.key,
            }
            : result.payload;
    }
    static sign(payload, key, options) {
        const jwk = key.getKey({
            kid: options?.kid,
            use: 'sig',
            alg: options?.alg,
        });
        const jwt = new SignJWT(payload);
        jwt.setProtectedHeader({
            typ: options?.typ ?? 'jwt',
            kid: options?.kid ?? jwk.kid,
            alg: options?.alg ?? jwk.alg ?? '',
            jwk: options?.jwk ? jwk.toObject() : undefined,
        });
        this.setupJwt(jwt, options ?? {});
        return jwt.sign(jwk.key);
    }
    static async decrypt(cypher, key, options) {
        const jwk = await JWE.getKeyFrom(cypher, key, options);
        if (typeof options?.enc === 'string')
            options.enc = [options.enc];
        if (typeof options?.alg === 'string')
            options.alg = [options.alg];
        const result = await jwtDecrypt(cypher, jwk.key, {
            contentEncryptionAlgorithms: options?.enc,
            keyManagementAlgorithms: options?.alg,
            ...options,
        });
        this.verifyJWTClaims(result.payload, options);
        return options?.complete
            ? {
                payload: result.payload,
                header: result.protectedHeader,
            }
            : result.payload;
    }
    static async encrypt(payload, key, options) {
        const jwk = await key
            .getKey({
            kid: options.kid,
            use: 'enc',
        })
            .toPublic();
        const jwt = new EncryptJWT(payload);
        this.setupJwt(jwt, options);
        jwt.setProtectedHeader({
            alg: options.alg,
            enc: options.enc,
            kid: options.kid ?? jwk.kid,
            typ: options.typ ?? 'jwt',
        });
        return jwt.encrypt(jwk.key);
    }
    static setupJwt(jwt, options) {
        options.issuer && jwt.setIssuer(options.issuer);
        options.audience && jwt.setAudience(options.audience);
        options.subject && jwt.setSubject(options.subject);
        options.exp && jwt.setExpirationTime(options.exp);
        options.jti && jwt.setJti(options.jti);
        options.notBefore && jwt.setNotBefore(options.notBefore);
        options.iat && jwt.setIssuedAt(options.iat);
    }
    static verifyJWTClaims(payload, options) {
        if (options === undefined)
            return;
        if (options.jti && options.jti !== payload.jti) {
            throw new JoseError('Claim', 'jti', payload.jti, options.jti);
        }
    }
}
//# sourceMappingURL=jwt.js.map