CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [3.19.0](https://github.com/panva/jose/compare/v3.18.0...v3.19.0) (2021-09-26)
+
+
+### Features
+
+* return resolved key when verify and decrypt resolve functions are used ([49fb62c](https://github.com/panva/jose/commit/49fb62cb96cd9afc854f5102313f16e27c0eb2b4))
+
 ## [3.18.0](https://github.com/panva/jose/compare/v3.17.0...v3.18.0) (2021-09-22)
 
 

dist/browser/jwe/compact/decrypt.js

@@ -19,7 +19,11 @@ async function compactDecrypt(jwe, key, options) {
         tag: (tag || undefined),
         encrypted_key: encryptedKey || undefined,
     }, key, options);
-    return { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 export { compactDecrypt };
 export default compactDecrypt;

dist/browser/jwe/flattened/decrypt.js

@@ -92,8 +92,10 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.encrypted_key !== undefined) {
         encryptedKey = base64url(jwe.encrypted_key);
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jwe);
+        resolvedKey = true;
     }
     let cek;
     try {
@@ -132,6 +134,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.header !== undefined) {
         result.unprotectedHeader = jwe.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 export { flattenedDecrypt };

dist/browser/jwk/embedded.js

@@ -1,4 +1,4 @@
-import parseJwk from './parse.js';
+import { importJWK } from '../key/import.js';
 import isObject from '../lib/is_object.js';
 import { JWSInvalid } from '../util/errors.js';
 async function EmbeddedJWK(protectedHeader, token) {
@@ -9,7 +9,7 @@ async function EmbeddedJWK(protectedHeader, token) {
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await parseJwk(joseHeader.jwk, joseHeader.alg, true);
+    const key = (await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true));
     if (key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

dist/browser/jwk/from_key_like.js

@@ -1,6 +1,6 @@
-import asJWK from '../runtime/key_to_jwk.js';
+import { exportJWK } from '../key/export.js';
 async function fromKeyLike(key) {
-    return asJWK(key);
+    return exportJWK(key);
 }
 export { fromKeyLike };
 export default fromKeyLike;

dist/browser/jwk/parse.js

@@ -1,35 +1,6 @@
-import { decode as base64url } from '../runtime/base64url.js';
-import asKeyObject from '../runtime/jwk_to_key.js';
-import { JOSENotSupported } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
+import { importJWK } from '../key/import.js';
 async function parseJwk(jwk, alg, octAsKeyObject) {
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return asKeyObject({ ...jwk, alg, ext: false });
-            }
-            return base64url(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return asKeyObject({ ...jwk, alg });
-        default:
-            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-    }
+    return importJWK(jwk, alg, octAsKeyObject);
 }
 export { parseJwk };
 export default parseJwk;

dist/browser/jwks/remote.js

@@ -93,7 +93,7 @@ class RemoteJWKSet {
         }
         const cached = this._cached.get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await parseJWK({ ...jwk, alg: protectedHeader.alg });
+            const keyObject = (await parseJWK({ ...jwk, alg: protectedHeader.alg, ext: true }));
             if (keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }

dist/browser/jws/compact/verify.js

@@ -17,7 +17,11 @@ async function compactVerify(jws, key, options) {
         protected: protectedHeader || undefined,
         signature: (signature || undefined),
     }, key, options);
-    return { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 export { compactVerify };
 export default compactVerify;

dist/browser/jws/flattened/verify.js

@@ -70,8 +70,10 @@ async function flattenedVerify(jws, key, options) {
     else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
         throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
+        resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
@@ -97,6 +99,9 @@ async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined) {
         result.unprotectedHeader = jws.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 export { flattenedVerify };

dist/browser/jwt/decrypt.js

@@ -15,7 +15,11 @@ async function jwtDecrypt(jwt, key, options) {
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
         throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
     }
-    return { payload, protectedHeader };
+    const result = { payload, protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 export { jwtDecrypt };
 export default jwtDecrypt;

dist/browser/jwt/verify.js

@@ -8,7 +8,11 @@ async function jwtVerify(jwt, key, options) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
-    return { payload, protectedHeader: verified.protectedHeader };
+    const result = { payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 export { jwtVerify };
 export default jwtVerify;

dist/browser/key/export.js

@@ -1,10 +1,12 @@
 import { toSPKI as exportPublic } from '../runtime/asn1.js';
 import { toPKCS8 as exportPrivate } from '../runtime/asn1.js';
-import { fromKeyLike } from '../jwk/from_key_like.js';
+import keyToJWK from '../runtime/key_to_jwk.js';
 export async function exportSPKI(key) {
     return exportPublic(key);
 }
 export async function exportPKCS8(key) {
     return exportPrivate(key);
 }
-export const exportJWK = (...args) => fromKeyLike(...args);
+export async function exportJWK(key) {
+    return keyToJWK(key);
+}

dist/browser/key/import.js

@@ -1,8 +1,10 @@
-import { encodeBase64, decodeBase64 } from '../runtime/base64url.js';
+import { decode as decodeBase64URL, encodeBase64, decodeBase64 } from '../runtime/base64url.js';
 import { fromSPKI as importPublic } from '../runtime/asn1.js';
 import { fromPKCS8 as importPrivate } from '../runtime/asn1.js';
+import asKeyObject from '../runtime/jwk_to_key.js';
+import { JOSENotSupported } from '../util/errors.js';
 import formatPEM from '../lib/format_pem.js';
-import { parseJwk as importJwk } from '../jwk/parse.js';
+import isObject from '../lib/is_object.js';
 function getElement(seq) {
     let result = [];
     let next = 0;
@@ -86,4 +88,32 @@ export async function importPKCS8(pkcs8, alg, options) {
     }
     return importPrivate(pkcs8, alg, options);
 }
-export const importJWK = (...args) => importJwk(...args);
+export async function importJWK(jwk, alg, octAsKeyObject) {
+    if (!isObject(jwk)) {
+        throw new TypeError('JWK must be an object');
+    }
+    alg || (alg = jwk.alg);
+    if (typeof alg !== 'string' || !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    switch (jwk.kty) {
+        case 'oct':
+            if (typeof jwk.k !== 'string' || !jwk.k) {
+                throw new TypeError('missing "k" (Key Value) Parameter value');
+            }
+            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
+            if (octAsKeyObject) {
+                return asKeyObject({ ...jwk, alg, ext: false });
+            }
+            return decodeBase64URL(jwk.k);
+        case 'RSA':
+            if (jwk.oth !== undefined) {
+                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+            }
+        case 'EC':
+        case 'OKP':
+            return asKeyObject({ ...jwk, alg });
+        default:
+            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+}

dist/browser/lib/decrypt_key_management.js

@@ -6,7 +6,7 @@ import { unwrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { decode as base64url } from '../runtime/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLengths as cekLengths } from '../lib/cek.js';
-import { parseJwk } from '../jwk/parse.js';
+import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 function assertEnryptedKey(encryptedKey) {
     if (!encryptedKey) {
@@ -38,7 +38,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
             if (!ECDH.ecdhAllowed(key)) {
                 throw new JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
             }
-            const epk = await parseJwk(joseHeader.epk, alg);
+            const epk = await importJWK(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined)

dist/deno/README.md

@@ -9,37 +9,37 @@ If you or your business use `jose`, please consider becoming a [sponsor][support
 ## Available modules
 
 - JSON Web Tokens (JWT)
-  - [Signing](https://github.com/panva/jose/blob/v3.18.0/docs/classes/jwt_sign.SignJWT.md#readme)
-  - [Verification & Claims Set Validation](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jwt_verify.jwtVerify.md#readme)
+  - [Signing](https://github.com/panva/jose/blob/v3.19.0/docs/classes/jwt_sign.SignJWT.md#readme)
+  - [Verification & Claims Set Validation](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jwt_verify.jwtVerify.md#readme)
   - Encrypted JSON Web Tokens
-    - [Encryption](https://github.com/panva/jose/blob/v3.18.0/docs/classes/jwt_encrypt.EncryptJWT.md#readme)
-    - [Decryption & Claims Set Validation](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
+    - [Encryption](https://github.com/panva/jose/blob/v3.19.0/docs/classes/jwt_encrypt.EncryptJWT.md#readme)
+    - [Decryption & Claims Set Validation](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
 - Key Import
-  - [JWK Import](https://github.com/panva/jose/blob/v3.18.0/docs/functions/key_import.importJWK.md#readme)
-  - [Public Key Import (SPKI)](https://github.com/panva/jose/blob/v3.18.0/docs/functions/key_import.importSPKI.md#readme)
-  - [Public Key Import (X.509 Certificate)](https://github.com/panva/jose/blob/v3.18.0/docs/functions/key_import.importX509.md#readme)
-  - [Private Key Import (PKCS #8)](https://github.com/panva/jose/blob/v3.18.0/docs/functions/key_import.importPKCS8.md#readme)
+  - [JWK Import](https://github.com/panva/jose/blob/v3.19.0/docs/functions/key_import.importJWK.md#readme)
+  - [Public Key Import (SPKI)](https://github.com/panva/jose/blob/v3.19.0/docs/functions/key_import.importSPKI.md#readme)
+  - [Public Key Import (X.509 Certificate)](https://github.com/panva/jose/blob/v3.19.0/docs/functions/key_import.importX509.md#readme)
+  - [Private Key Import (PKCS #8)](https://github.com/panva/jose/blob/v3.19.0/docs/functions/key_import.importPKCS8.md#readme)
 - JSON Web Encryption (JWE)
-  - Encryption - [Compact](https://github.com/panva/jose/blob/v3.18.0/docs/classes/jwe_compact_encrypt.CompactEncrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.18.0/docs/classes/jwe_flattened_encrypt.FlattenedEncrypt.md#readme)
-  - Decryption - [Compact](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jwe_compact_decrypt.compactDecrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jwe_flattened_decrypt.flattenedDecrypt.md#readme), [General](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jwe_general_decrypt.generalDecrypt.md#readme)
+  - Encryption - [Compact](https://github.com/panva/jose/blob/v3.19.0/docs/classes/jwe_compact_encrypt.CompactEncrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.19.0/docs/classes/jwe_flattened_encrypt.FlattenedEncrypt.md#readme)
+  - Decryption - [Compact](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jwe_compact_decrypt.compactDecrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jwe_flattened_decrypt.flattenedDecrypt.md#readme), [General](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jwe_general_decrypt.generalDecrypt.md#readme)
 - JSON Web Signature (JWS)
-  - Signing - [Compact](https://github.com/panva/jose/blob/v3.18.0/docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.18.0/docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](https://github.com/panva/jose/blob/v3.18.0/docs/classes/jws_general_sign.GeneralSign.md#readme)
-  - Verification - [Compact](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jws_general_verify.generalVerify.md#readme)
+  - Signing - [Compact](https://github.com/panva/jose/blob/v3.19.0/docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.19.0/docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](https://github.com/panva/jose/blob/v3.19.0/docs/classes/jws_general_sign.GeneralSign.md#readme)
+  - Verification - [Compact](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jws_general_verify.generalVerify.md#readme)
 - JSON Web Key (JWK)
-  - [Thumbprints](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jwk_thumbprint.calculateThumbprint.md#readme)
-  - [EmbeddedJWK](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
+  - [Thumbprints](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jwk_thumbprint.calculateThumbprint.md#readme)
+  - [EmbeddedJWK](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
 - JSON Web Key Set (JWKS)
-  - [Verify using a remote JWKSet](https://github.com/panva/jose/blob/v3.18.0/docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
+  - [Verify using a remote JWKSet](https://github.com/panva/jose/blob/v3.19.0/docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
 - Key Pair or Secret Generation
-  - [Asymmetric Key Pair Generation](https://github.com/panva/jose/blob/v3.18.0/docs/functions/util_generate_key_pair.generateKeyPair.md#readme)
-  - [Symmetric Secret Generation](https://github.com/panva/jose/blob/v3.18.0/docs/functions/util_generate_secret.generateSecret.md#readme)
+  - [Asymmetric Key Pair Generation](https://github.com/panva/jose/blob/v3.19.0/docs/functions/util_generate_key_pair.generateKeyPair.md#readme)
+  - [Symmetric Secret Generation](https://github.com/panva/jose/blob/v3.19.0/docs/functions/util_generate_secret.generateSecret.md#readme)
 - Key Export
-  - [JWK Export](https://github.com/panva/jose/blob/v3.18.0/docs/functions/key_export.exportJWK.md#readme)
-  - [Private Key Export](https://github.com/panva/jose/blob/v3.18.0/docs/functions/key_export.exportPKCS8.md#readme)
-  - [Public Key Export](https://github.com/panva/jose/blob/v3.18.0/docs/functions/key_export.exportSPKI.md#readme)
+  - [JWK Export](https://github.com/panva/jose/blob/v3.19.0/docs/functions/key_export.exportJWK.md#readme)
+  - [Private Key Export](https://github.com/panva/jose/blob/v3.19.0/docs/functions/key_export.exportPKCS8.md#readme)
+  - [Public Key Export](https://github.com/panva/jose/blob/v3.19.0/docs/functions/key_export.exportSPKI.md#readme)
 - Utilities
-  - [Decoding Token's Protected Header](https://github.com/panva/jose/blob/v3.18.0/docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
-- [Unsecured JWT](https://github.com/panva/jose/blob/v3.18.0/docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
-- [JOSE Errors](https://github.com/panva/jose/blob/v3.18.0/docs/modules/util_errors.md#readme)
+  - [Decoding Token's Protected Header](https://github.com/panva/jose/blob/v3.19.0/docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
+- [Unsecured JWT](https://github.com/panva/jose/blob/v3.19.0/docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
+- [JOSE Errors](https://github.com/panva/jose/blob/v3.19.0/docs/modules/util_errors.md#readme)
 
 [support-sponsor]: https://github.com/sponsors/panva

dist/deno/jwe/compact/decrypt.ts

@@ -8,6 +8,7 @@ import type {
   GetKeyFunction,
   FlattenedJWE,
   CompactDecryptResult,
+  ResolvedKey,
 } from '../../types.d.ts'
 
 /**
@@ -20,7 +21,7 @@ export interface CompactDecryptGetKey extends GetKeyFunction<JWEHeaderParameters
  * Decrypts a Compact JWE.
  *
  * @param jwe Compact JWE.
- * @param key Private Key or Secret, or a function resolving one, to decrypt the JWE with.
+ * @param key Private Key or Secret to decrypt the JWE with.
  * @param options JWE Decryption options.
  *
  * @example ESM import
@@ -49,11 +50,26 @@ export interface CompactDecryptGetKey extends GetKeyFunction<JWEHeaderParameters
  * console.log(decoder.decode(plaintext))
  * ```
  */
+async function compactDecrypt(
+  jwe: string | Uint8Array,
+  key: KeyLike,
+  options?: DecryptOptions,
+): Promise<CompactDecryptResult>
+/**
+ * @param jwe Compact JWE.
+ * @param getKey Function resolving Private Key or Secret to decrypt the JWE with.
+ * @param options JWE Decryption options.
+ */
+async function compactDecrypt(
+  jwe: string | Uint8Array,
+  getKey: CompactDecryptGetKey,
+  options?: DecryptOptions,
+): Promise<CompactDecryptResult & ResolvedKey>
 async function compactDecrypt(
   jwe: string | Uint8Array,
   key: KeyLike | CompactDecryptGetKey,
   options?: DecryptOptions,
-): Promise<CompactDecryptResult> {
+) {
   if (jwe instanceof Uint8Array) {
     jwe = decoder.decode(jwe)
   }
@@ -86,7 +102,13 @@ async function compactDecrypt(
     options,
   )
 
-  return { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader! }
+  const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader! }
+
+  if (typeof key === 'function') {
+    return { ...result, key: decrypted.key }
+  }
+
+  return result
 }
 
 export { compactDecrypt }