.github/workflows/test.yml

@@ -64,7 +64,6 @@ jobs:
         include:
           - experimental: true
             node-version: '>=15'
-            node-options: '--throw-deprecation --pending-deprecation'
 
     runs-on: ubuntu-latest
     steps:
@@ -96,18 +95,12 @@ jobs:
           key: dist-${{ hashFiles('src/**/*.ts') }}-${{ hashFiles('tsconfig/*.json') }}-${{ hashFiles('.github/workflows/*.yml') }}-${{ hashFiles('package.json') }}
       - name: Test Node.js crypto
         run: npm run test
-        env:
-          NODE_OPTIONS: ${{ matrix.node-options }}
       - name: Test Node.js crypto w/ CryptoKey
         run: npm run test-cryptokey
         if: ${{ !startsWith(matrix.node-version, '14') && !startsWith(matrix.node-version, '12')  }}
-        env:
-          NODE_OPTIONS: ${{ matrix.node-options }}
       - name: Test Web Cryptography API
         run: npm run test-webcrypto
         if: ${{ !startsWith(matrix.node-version, '14') && !startsWith(matrix.node-version, '12')  }}
-        env:
-          NODE_OPTIONS: ${{ matrix.node-options }}
       - run: git reset HEAD --hard
 
   test-deno:
@@ -134,6 +127,48 @@ jobs:
         run: npm run test-deno -- --no-check
       - run: git reset HEAD --hard
 
+  test-cloudflare:
+    concurrency: test-cloudflare
+    needs:
+      - build
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - uses: denoland/setup-deno@v1
+        with:
+          deno-version: v1.x
+      - name: Setup node
+        uses: actions/setup-node@v2
+        with:
+          node-version: 16
+      - name: Store node version variable
+        id: node
+        run: |
+          echo "::set-output name=version::$(node -v)"
+      - name: Cache node_modules
+        uses: actions/cache@v2
+        id: node_modules
+        with:
+          path: node_modules
+          key: ${{ runner.os }}-node_modules-${{ hashFiles('package.json') }}-${{ steps.node.outputs.version }}
+      - name: Install dependencies
+        run: npx panva/npm-install-retry
+        if: ${{ steps.node_modules.outputs.cache-hit != 'true' }}
+      - name: Load cached dist
+        uses: actions/cache@v2
+        id: dist
+        with:
+          path: dist
+          key: dist-${{ hashFiles('src/**/*.ts') }}-${{ hashFiles('tsconfig/*.json') }}-${{ hashFiles('.github/workflows/*.yml') }}-${{ hashFiles('package.json') }}
+      - name: Test Cloudflare Workers
+        run: npm run test-cloudflare-workers
+        env:
+          CF_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
+          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+      - run: git reset HEAD --hard
+
   test-electron:
     needs:
       - build
@@ -176,8 +211,8 @@ jobs:
         run: xvfb-maybe electron ./test/.electron
       - run: git reset HEAD --hard
 
-  browserstack:
-    concurrency: ci-${{ github.job }}
+  test-browsers:
+    concurrency: test-browsers
     if: ${{ github.event_name != 'pull_request' }}
     env:
       BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }}
@@ -186,6 +221,9 @@ jobs:
       - build
     runs-on: ubuntu-latest
     steps:
+      - uses: denoland/setup-deno@v1
+        with:
+          deno-version: v1.x
       - name: Checkout
         uses: actions/checkout@v2
       - name: Setup node
@@ -211,15 +249,16 @@ jobs:
         with:
           path: dist
           key: dist-${{ hashFiles('src/**/*.ts') }}-${{ hashFiles('tsconfig/*.json') }}-${{ hashFiles('.github/workflows/*.yml') }}-${{ hashFiles('package.json') }}
-      - run: npx retry-cli npm run test-browser
+      - run: npx retry-cli npm run test-browsers
       - run: git reset HEAD --hard
 
   prepare-release:
     needs:
-      - browserstack
       - test
+      - test-browsers
       - test-electron
       - test-deno
+      - test-cloudflare
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags') && github.repository == 'panva/jose' }}
     steps:

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [3.16.0](https://github.com/panva/jose/compare/v3.15.5...v3.16.0) (2021-09-07)
+
+
+### Features
+
+* **node:** support rsa-pss keys in Node.js >= 16.9.0 for sign/verify ([0b112cf](https://github.com/panva/jose/commit/0b112cf63ed2a859806531853c37486485740f9c))
+
 ## [3.15.5](https://github.com/panva/jose/compare/v3.15.4...v3.15.5) (2021-09-02)
 
 

README.md

@@ -177,7 +177,7 @@ Legend:
 
 - Revised API
 - No dependencies
-- Browser support (using [Web Cryptography API][webcrypto])
+- Browser, Cloudflare Workers, and Deno support (using [Web Cryptography API][webcrypto])
 - Promise-based API
 
 #### v2.x docs?
@@ -190,7 +190,7 @@ Legend:
 
 #### How is it different from [`jws`](https://github.com/brianloveswords/node-jws), [`jwa`](https://github.com/brianloveswords/node-jwa) or [`jsonwebtoken`](https://github.com/auth0/node-jsonwebtoken)?
 
-- it supports the browser runtime
+- it supports the browser, Cloudflare Workers, and Deno runtimes
 - it supports encrypted JWTs (i.e. in JWE format)
 - supports secp256k1, Ed25519, Ed448, X25519, and X448
 - it supports JWK Key Format for all four key types (oct, RSA, EC and OKP)

ava.config.cjs

@@ -0,0 +1,7 @@
+module.exports = {
+  files: [
+    "test/**/*.test.mjs",
+    "test/**/*.test.cjs",
+    "test/**/*.test.js",
+  ],
+};

dist/deno/README.md

@@ -9,30 +9,30 @@ If you or your business use `jose`, please consider becoming a [sponsor][support
 ## Available modules
 
 - JSON Web Tokens (JWT)
-  - [Signing](https://github.com/panva/jose/blob/v3.15.5/docs/classes/jwt_sign.SignJWT.md#readme)
-  - [Verification & Claims Set Validation](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwt_verify.jwtVerify.md#readme)
+  - [Signing](https://github.com/panva/jose/blob/v3.16.0/docs/classes/jwt_sign.SignJWT.md#readme)
+  - [Verification & Claims Set Validation](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwt_verify.jwtVerify.md#readme)
   - Encrypted JSON Web Tokens
-    - [Encryption](https://github.com/panva/jose/blob/v3.15.5/docs/classes/jwt_encrypt.EncryptJWT.md#readme)
-    - [Decryption & Claims Set Validation](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
+    - [Encryption](https://github.com/panva/jose/blob/v3.16.0/docs/classes/jwt_encrypt.EncryptJWT.md#readme)
+    - [Decryption & Claims Set Validation](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
 - JSON Web Encryption (JWE)
-  - Encryption - [Compact](https://github.com/panva/jose/blob/v3.15.5/docs/classes/jwe_compact_encrypt.CompactEncrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.15.5/docs/classes/jwe_flattened_encrypt.FlattenedEncrypt.md#readme)
-  - Decryption - [Compact](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwe_compact_decrypt.compactDecrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwe_flattened_decrypt.flattenedDecrypt.md#readme), [General](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwe_general_decrypt.generalDecrypt.md#readme)
+  - Encryption - [Compact](https://github.com/panva/jose/blob/v3.16.0/docs/classes/jwe_compact_encrypt.CompactEncrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.16.0/docs/classes/jwe_flattened_encrypt.FlattenedEncrypt.md#readme)
+  - Decryption - [Compact](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwe_compact_decrypt.compactDecrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwe_flattened_decrypt.flattenedDecrypt.md#readme), [General](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwe_general_decrypt.generalDecrypt.md#readme)
 - JSON Web Signature (JWS)
-  - Signing - [Compact](https://github.com/panva/jose/blob/v3.15.5/docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.15.5/docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](https://github.com/panva/jose/blob/v3.15.5/docs/classes/jws_general_sign.GeneralSign.md#readme)
-  - Verification - [Compact](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jws_general_verify.generalVerify.md#readme)
+  - Signing - [Compact](https://github.com/panva/jose/blob/v3.16.0/docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.16.0/docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](https://github.com/panva/jose/blob/v3.16.0/docs/classes/jws_general_sign.GeneralSign.md#readme)
+  - Verification - [Compact](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jws_general_verify.generalVerify.md#readme)
 - JSON Web Key (JWK)
-  - [Parsing (JWK to KeyLike)](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwk_parse.parseJwk.md#readme)
-  - [Conversion (KeyLike to JWK)](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwk_from_key_like.fromKeyLike.md#readme)
-  - [Thumbprints](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwk_thumbprint.calculateThumbprint.md#readme)
-  - [EmbeddedJWK](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
+  - [Parsing (JWK to KeyLike)](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwk_parse.parseJwk.md#readme)
+  - [Conversion (KeyLike to JWK)](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwk_from_key_like.fromKeyLike.md#readme)
+  - [Thumbprints](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwk_thumbprint.calculateThumbprint.md#readme)
+  - [EmbeddedJWK](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
 - JSON Web Key Set (JWKS)
-  - [Verify using a remote JWKSet](https://github.com/panva/jose/blob/v3.15.5/docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
+  - [Verify using a remote JWKSet](https://github.com/panva/jose/blob/v3.16.0/docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
 - Key Pair or Secret Generation (Generate KeyLike)
-  - [Asymmetric Key Pair Generation](https://github.com/panva/jose/blob/v3.15.5/docs/functions/util_generate_key_pair.generateKeyPair.md#readme)
-  - [Symmetric Secret Generation](https://github.com/panva/jose/blob/v3.15.5/docs/functions/util_generate_secret.generateSecret.md#readme)
+  - [Asymmetric Key Pair Generation](https://github.com/panva/jose/blob/v3.16.0/docs/functions/util_generate_key_pair.generateKeyPair.md#readme)
+  - [Symmetric Secret Generation](https://github.com/panva/jose/blob/v3.16.0/docs/functions/util_generate_secret.generateSecret.md#readme)
 - Utilities
-  - [Decoding Token's Protected Header](https://github.com/panva/jose/blob/v3.15.5/docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
-- [Unsecured JWT](https://github.com/panva/jose/blob/v3.15.5/docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
-- [JOSE Errors](https://github.com/panva/jose/blob/v3.15.5/docs/modules/util_errors.md#readme)
+  - [Decoding Token's Protected Header](https://github.com/panva/jose/blob/v3.16.0/docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
+- [Unsecured JWT](https://github.com/panva/jose/blob/v3.16.0/docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
+- [JOSE Errors](https://github.com/panva/jose/blob/v3.16.0/docs/modules/util_errors.md#readme)
 
 [support-sponsor]: https://github.com/sponsors/panva

dist/node/cjs/runtime/node_key.js

@@ -4,6 +4,11 @@ const crypto_1 = require("crypto");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const errors_js_1 = require("../util/errors.js");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
+const [major, minor] = process.version
+    .substr(1)
+    .split('.')
+    .map((str) => parseInt(str, 10));
+const rsaPssParams = major >= 17 || (major === 16 && minor >= 9);
 const ecCurveAlgMap = new Map([
     ['ES256', 'P-256'],
     ['ES256K', 'secp256k1'],
@@ -25,9 +30,32 @@ function keyForCrypto(alg, key) {
             }
             (0, check_modulus_length_js_1.default)(key, alg);
             return key;
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
+        case rsaPssParams && 'PS256':
+        case rsaPssParams && 'PS384':
+        case rsaPssParams && 'PS512':
+            if (key.asymmetricKeyType === 'rsa-pss') {
+                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
+                const length = parseInt(alg.substr(-3), 10);
+                if (hashAlgorithm !== undefined &&
+                    (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
+                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${alg}`);
+                }
+                if (saltLength !== undefined && saltLength > length >> 3) {
+                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
+                }
+            }
+            else if (key.asymmetricKeyType !== 'rsa') {
+                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
+            }
+            (0, check_modulus_length_js_1.default)(key, alg);
+            return {
+                key,
+                padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING,
+                saltLength: crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
+            };
+        case !rsaPssParams && 'PS256':
+        case !rsaPssParams && 'PS384':
+        case !rsaPssParams && 'PS512':
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }

dist/node/esm/runtime/node_key.js

@@ -2,6 +2,11 @@ import { constants } from 'crypto';
 import getNamedCurve from './get_named_curve.js';
 import { JOSENotSupported } from '../util/errors.js';
 import checkModulusLength from './check_modulus_length.js';
+const [major, minor] = process.version
+    .substr(1)
+    .split('.')
+    .map((str) => parseInt(str, 10));
+const rsaPssParams = major >= 17 || (major === 16 && minor >= 9);
 const ecCurveAlgMap = new Map([
     ['ES256', 'P-256'],
     ['ES256K', 'secp256k1'],
@@ -23,9 +28,32 @@ export default function keyForCrypto(alg, key) {
             }
             checkModulusLength(key, alg);
             return key;
-        case 'PS256':
-        case 'PS384':
-        case 'PS512':
+        case rsaPssParams && 'PS256':
+        case rsaPssParams && 'PS384':
+        case rsaPssParams && 'PS512':
+            if (key.asymmetricKeyType === 'rsa-pss') {
+                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
+                const length = parseInt(alg.substr(-3), 10);
+                if (hashAlgorithm !== undefined &&
+                    (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
+                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${alg}`);
+                }
+                if (saltLength !== undefined && saltLength > length >> 3) {
+                    throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
+                }
+            }
+            else if (key.asymmetricKeyType !== 'rsa') {
+                throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
+            }
+            checkModulusLength(key, alg);
+            return {
+                key,
+                padding: constants.RSA_PKCS1_PSS_PADDING,
+                saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
+            };
+        case !rsaPssParams && 'PS256':
+        case !rsaPssParams && 'PS384':
+        case !rsaPssParams && 'PS512':
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }

docs/classes/jwe_compact_encrypt.CompactEncrypt.md

@@ -16,7 +16,7 @@ const { CompactEncrypt } = require('jose/jwe/compact/encrypt')
 
 **`example`** Deno import
 ```js
-import { CompactEncrypt } from 'https://deno.land/x/jose@v3.15.5/jwe/compact/encrypt.ts'
+import { CompactEncrypt } from 'https://deno.land/x/jose@v3.16.0/jwe/compact/encrypt.ts'
 ```
 
 **`example`** Usage
@@ -58,7 +58,7 @@ console.log(jwe)
 
 #### Defined in
 
-[jwe/compact/encrypt.ts:44](https://github.com/panva/jose/blob/v3.15.5/src/jwe/compact/encrypt.ts#L44)
+[jwe/compact/encrypt.ts:44](https://github.com/panva/jose/blob/v3.16.0/src/jwe/compact/encrypt.ts#L44)
 
 ## Methods
 
@@ -81,7 +81,7 @@ Encrypts and resolves the value of the Compact JWE string.
 
 #### Defined in
 
-[jwe/compact/encrypt.ts:102](https://github.com/panva/jose/blob/v3.15.5/src/jwe/compact/encrypt.ts#L102)
+[jwe/compact/encrypt.ts:102](https://github.com/panva/jose/blob/v3.16.0/src/jwe/compact/encrypt.ts#L102)
 
 ___
 
@@ -106,7 +106,7 @@ test and vector validation purposes.
 
 #### Defined in
 
-[jwe/compact/encrypt.ts:56](https://github.com/panva/jose/blob/v3.15.5/src/jwe/compact/encrypt.ts#L56)
+[jwe/compact/encrypt.ts:56](https://github.com/panva/jose/blob/v3.16.0/src/jwe/compact/encrypt.ts#L56)
 
 ___
 
@@ -131,7 +131,7 @@ intended for test and vector validation purposes.
 
 #### Defined in
 
-[jwe/compact/encrypt.ts:69](https://github.com/panva/jose/blob/v3.15.5/src/jwe/compact/encrypt.ts#L69)
+[jwe/compact/encrypt.ts:69](https://github.com/panva/jose/blob/v3.16.0/src/jwe/compact/encrypt.ts#L69)
 
 ___
 
@@ -155,7 +155,7 @@ intended for test and vector validation purposes.
 
 #### Defined in
 
-[jwe/compact/encrypt.ts:91](https://github.com/panva/jose/blob/v3.15.5/src/jwe/compact/encrypt.ts#L91)
+[jwe/compact/encrypt.ts:91](https://github.com/panva/jose/blob/v3.16.0/src/jwe/compact/encrypt.ts#L91)
 
 ___
 
@@ -177,4 +177,4 @@ Sets the JWE Protected Header on the CompactEncrypt object.
 
 #### Defined in
 
-[jwe/compact/encrypt.ts:79](https://github.com/panva/jose/blob/v3.15.5/src/jwe/compact/encrypt.ts#L79)
+[jwe/compact/encrypt.ts:79](https://github.com/panva/jose/blob/v3.16.0/src/jwe/compact/encrypt.ts#L79)