initial commit
This commit is contained in:
166
server/node_modules/jose/dist/node/esm/jwe/flattened/decrypt.js
generated
vendored
Normal file
166
server/node_modules/jose/dist/node/esm/jwe/flattened/decrypt.js
generated
vendored
Normal file
@@ -0,0 +1,166 @@
|
||||
import { decode as base64url } from '../../runtime/base64url.js';
|
||||
import decrypt from '../../runtime/decrypt.js';
|
||||
import { inflate } from '../../runtime/zlib.js';
|
||||
import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
|
||||
import isDisjoint from '../../lib/is_disjoint.js';
|
||||
import isObject from '../../lib/is_object.js';
|
||||
import decryptKeyManagement from '../../lib/decrypt_key_management.js';
|
||||
import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
|
||||
import generateCek from '../../lib/cek.js';
|
||||
import validateCrit from '../../lib/validate_crit.js';
|
||||
import validateAlgorithms from '../../lib/validate_algorithms.js';
|
||||
export async function flattenedDecrypt(jwe, key, options) {
|
||||
var _a;
|
||||
if (!isObject(jwe)) {
|
||||
throw new JWEInvalid('Flattened JWE must be an object');
|
||||
}
|
||||
if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
|
||||
throw new JWEInvalid('JOSE Header missing');
|
||||
}
|
||||
if (typeof jwe.iv !== 'string') {
|
||||
throw new JWEInvalid('JWE Initialization Vector missing or incorrect type');
|
||||
}
|
||||
if (typeof jwe.ciphertext !== 'string') {
|
||||
throw new JWEInvalid('JWE Ciphertext missing or incorrect type');
|
||||
}
|
||||
if (typeof jwe.tag !== 'string') {
|
||||
throw new JWEInvalid('JWE Authentication Tag missing or incorrect type');
|
||||
}
|
||||
if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
|
||||
throw new JWEInvalid('JWE Protected Header incorrect type');
|
||||
}
|
||||
if (jwe.encrypted_key !== undefined && typeof jwe.encrypted_key !== 'string') {
|
||||
throw new JWEInvalid('JWE Encrypted Key incorrect type');
|
||||
}
|
||||
if (jwe.aad !== undefined && typeof jwe.aad !== 'string') {
|
||||
throw new JWEInvalid('JWE AAD incorrect type');
|
||||
}
|
||||
if (jwe.header !== undefined && !isObject(jwe.header)) {
|
||||
throw new JWEInvalid('JWE Shared Unprotected Header incorrect type');
|
||||
}
|
||||
if (jwe.unprotected !== undefined && !isObject(jwe.unprotected)) {
|
||||
throw new JWEInvalid('JWE Per-Recipient Unprotected Header incorrect type');
|
||||
}
|
||||
let parsedProt;
|
||||
if (jwe.protected) {
|
||||
try {
|
||||
const protectedHeader = base64url(jwe.protected);
|
||||
parsedProt = JSON.parse(decoder.decode(protectedHeader));
|
||||
}
|
||||
catch {
|
||||
throw new JWEInvalid('JWE Protected Header is invalid');
|
||||
}
|
||||
}
|
||||
if (!isDisjoint(parsedProt, jwe.header, jwe.unprotected)) {
|
||||
throw new JWEInvalid('JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint');
|
||||
}
|
||||
const joseHeader = {
|
||||
...parsedProt,
|
||||
...jwe.header,
|
||||
...jwe.unprotected,
|
||||
};
|
||||
validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
|
||||
if (joseHeader.zip !== undefined) {
|
||||
if (!parsedProt || !parsedProt.zip) {
|
||||
throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
|
||||
}
|
||||
if (joseHeader.zip !== 'DEF') {
|
||||
throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
|
||||
}
|
||||
}
|
||||
const { alg, enc } = joseHeader;
|
||||
if (typeof alg !== 'string' || !alg) {
|
||||
throw new JWEInvalid('missing JWE Algorithm (alg) in JWE Header');
|
||||
}
|
||||
if (typeof enc !== 'string' || !enc) {
|
||||
throw new JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
|
||||
}
|
||||
const keyManagementAlgorithms = options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms);
|
||||
const contentEncryptionAlgorithms = options &&
|
||||
validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
|
||||
if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
|
||||
throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
|
||||
}
|
||||
if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc)) {
|
||||
throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter not allowed');
|
||||
}
|
||||
let encryptedKey;
|
||||
if (jwe.encrypted_key !== undefined) {
|
||||
try {
|
||||
encryptedKey = base64url(jwe.encrypted_key);
|
||||
}
|
||||
catch {
|
||||
throw new JWEInvalid('Failed to base64url decode the encrypted_key');
|
||||
}
|
||||
}
|
||||
let resolvedKey = false;
|
||||
if (typeof key === 'function') {
|
||||
key = await key(parsedProt, jwe);
|
||||
resolvedKey = true;
|
||||
}
|
||||
let cek;
|
||||
try {
|
||||
cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options);
|
||||
}
|
||||
catch (err) {
|
||||
if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
|
||||
throw err;
|
||||
}
|
||||
cek = generateCek(enc);
|
||||
}
|
||||
let iv;
|
||||
let tag;
|
||||
try {
|
||||
iv = base64url(jwe.iv);
|
||||
}
|
||||
catch {
|
||||
throw new JWEInvalid('Failed to base64url decode the iv');
|
||||
}
|
||||
try {
|
||||
tag = base64url(jwe.tag);
|
||||
}
|
||||
catch {
|
||||
throw new JWEInvalid('Failed to base64url decode the tag');
|
||||
}
|
||||
const protectedHeader = encoder.encode((_a = jwe.protected) !== null && _a !== void 0 ? _a : '');
|
||||
let additionalData;
|
||||
if (jwe.aad !== undefined) {
|
||||
additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(jwe.aad));
|
||||
}
|
||||
else {
|
||||
additionalData = protectedHeader;
|
||||
}
|
||||
let ciphertext;
|
||||
try {
|
||||
ciphertext = base64url(jwe.ciphertext);
|
||||
}
|
||||
catch {
|
||||
throw new JWEInvalid('Failed to base64url decode the ciphertext');
|
||||
}
|
||||
let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
|
||||
if (joseHeader.zip === 'DEF') {
|
||||
plaintext = await ((options === null || options === void 0 ? void 0 : options.inflateRaw) || inflate)(plaintext);
|
||||
}
|
||||
const result = { plaintext };
|
||||
if (jwe.protected !== undefined) {
|
||||
result.protectedHeader = parsedProt;
|
||||
}
|
||||
if (jwe.aad !== undefined) {
|
||||
try {
|
||||
result.additionalAuthenticatedData = base64url(jwe.aad);
|
||||
}
|
||||
catch {
|
||||
throw new JWEInvalid('Failed to base64url decode the aad');
|
||||
}
|
||||
}
|
||||
if (jwe.unprotected !== undefined) {
|
||||
result.sharedUnprotectedHeader = jwe.unprotected;
|
||||
}
|
||||
if (jwe.header !== undefined) {
|
||||
result.unprotectedHeader = jwe.header;
|
||||
}
|
||||
if (resolvedKey) {
|
||||
return { ...result, key };
|
||||
}
|
||||
return result;
|
||||
}
|
||||
175
server/node_modules/jose/dist/node/esm/jwe/flattened/encrypt.js
generated
vendored
Normal file
175
server/node_modules/jose/dist/node/esm/jwe/flattened/encrypt.js
generated
vendored
Normal file
@@ -0,0 +1,175 @@
|
||||
import { encode as base64url } from '../../runtime/base64url.js';
|
||||
import encrypt from '../../runtime/encrypt.js';
|
||||
import { deflate } from '../../runtime/zlib.js';
|
||||
import generateIv from '../../lib/iv.js';
|
||||
import encryptKeyManagement from '../../lib/encrypt_key_management.js';
|
||||
import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
|
||||
import isDisjoint from '../../lib/is_disjoint.js';
|
||||
import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
|
||||
import validateCrit from '../../lib/validate_crit.js';
|
||||
export const unprotected = Symbol();
|
||||
export class FlattenedEncrypt {
|
||||
constructor(plaintext) {
|
||||
if (!(plaintext instanceof Uint8Array)) {
|
||||
throw new TypeError('plaintext must be an instance of Uint8Array');
|
||||
}
|
||||
this._plaintext = plaintext;
|
||||
}
|
||||
setKeyManagementParameters(parameters) {
|
||||
if (this._keyManagementParameters) {
|
||||
throw new TypeError('setKeyManagementParameters can only be called once');
|
||||
}
|
||||
this._keyManagementParameters = parameters;
|
||||
return this;
|
||||
}
|
||||
setProtectedHeader(protectedHeader) {
|
||||
if (this._protectedHeader) {
|
||||
throw new TypeError('setProtectedHeader can only be called once');
|
||||
}
|
||||
this._protectedHeader = protectedHeader;
|
||||
return this;
|
||||
}
|
||||
setSharedUnprotectedHeader(sharedUnprotectedHeader) {
|
||||
if (this._sharedUnprotectedHeader) {
|
||||
throw new TypeError('setSharedUnprotectedHeader can only be called once');
|
||||
}
|
||||
this._sharedUnprotectedHeader = sharedUnprotectedHeader;
|
||||
return this;
|
||||
}
|
||||
setUnprotectedHeader(unprotectedHeader) {
|
||||
if (this._unprotectedHeader) {
|
||||
throw new TypeError('setUnprotectedHeader can only be called once');
|
||||
}
|
||||
this._unprotectedHeader = unprotectedHeader;
|
||||
return this;
|
||||
}
|
||||
setAdditionalAuthenticatedData(aad) {
|
||||
this._aad = aad;
|
||||
return this;
|
||||
}
|
||||
setContentEncryptionKey(cek) {
|
||||
if (this._cek) {
|
||||
throw new TypeError('setContentEncryptionKey can only be called once');
|
||||
}
|
||||
this._cek = cek;
|
||||
return this;
|
||||
}
|
||||
setInitializationVector(iv) {
|
||||
if (this._iv) {
|
||||
throw new TypeError('setInitializationVector can only be called once');
|
||||
}
|
||||
this._iv = iv;
|
||||
return this;
|
||||
}
|
||||
async encrypt(key, options) {
|
||||
if (!this._protectedHeader && !this._unprotectedHeader && !this._sharedUnprotectedHeader) {
|
||||
throw new JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
|
||||
}
|
||||
if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, this._sharedUnprotectedHeader)) {
|
||||
throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
|
||||
}
|
||||
const joseHeader = {
|
||||
...this._protectedHeader,
|
||||
...this._unprotectedHeader,
|
||||
...this._sharedUnprotectedHeader,
|
||||
};
|
||||
validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
|
||||
if (joseHeader.zip !== undefined) {
|
||||
if (!this._protectedHeader || !this._protectedHeader.zip) {
|
||||
throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
|
||||
}
|
||||
if (joseHeader.zip !== 'DEF') {
|
||||
throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
|
||||
}
|
||||
}
|
||||
const { alg, enc } = joseHeader;
|
||||
if (typeof alg !== 'string' || !alg) {
|
||||
throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
|
||||
}
|
||||
if (typeof enc !== 'string' || !enc) {
|
||||
throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
|
||||
}
|
||||
let encryptedKey;
|
||||
if (alg === 'dir') {
|
||||
if (this._cek) {
|
||||
throw new TypeError('setContentEncryptionKey cannot be called when using Direct Encryption');
|
||||
}
|
||||
}
|
||||
else if (alg === 'ECDH-ES') {
|
||||
if (this._cek) {
|
||||
throw new TypeError('setContentEncryptionKey cannot be called when using Direct Key Agreement');
|
||||
}
|
||||
}
|
||||
let cek;
|
||||
{
|
||||
let parameters;
|
||||
({ cek, encryptedKey, parameters } = await encryptKeyManagement(alg, enc, key, this._cek, this._keyManagementParameters));
|
||||
if (parameters) {
|
||||
if (options && unprotected in options) {
|
||||
if (!this._unprotectedHeader) {
|
||||
this.setUnprotectedHeader(parameters);
|
||||
}
|
||||
else {
|
||||
this._unprotectedHeader = { ...this._unprotectedHeader, ...parameters };
|
||||
}
|
||||
}
|
||||
else {
|
||||
if (!this._protectedHeader) {
|
||||
this.setProtectedHeader(parameters);
|
||||
}
|
||||
else {
|
||||
this._protectedHeader = { ...this._protectedHeader, ...parameters };
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
this._iv || (this._iv = generateIv(enc));
|
||||
let additionalData;
|
||||
let protectedHeader;
|
||||
let aadMember;
|
||||
if (this._protectedHeader) {
|
||||
protectedHeader = encoder.encode(base64url(JSON.stringify(this._protectedHeader)));
|
||||
}
|
||||
else {
|
||||
protectedHeader = encoder.encode('');
|
||||
}
|
||||
if (this._aad) {
|
||||
aadMember = base64url(this._aad);
|
||||
additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(aadMember));
|
||||
}
|
||||
else {
|
||||
additionalData = protectedHeader;
|
||||
}
|
||||
let ciphertext;
|
||||
let tag;
|
||||
if (joseHeader.zip === 'DEF') {
|
||||
const deflated = await ((options === null || options === void 0 ? void 0 : options.deflateRaw) || deflate)(this._plaintext);
|
||||
({ ciphertext, tag } = await encrypt(enc, deflated, cek, this._iv, additionalData));
|
||||
}
|
||||
else {
|
||||
;
|
||||
({ ciphertext, tag } = await encrypt(enc, this._plaintext, cek, this._iv, additionalData));
|
||||
}
|
||||
const jwe = {
|
||||
ciphertext: base64url(ciphertext),
|
||||
iv: base64url(this._iv),
|
||||
tag: base64url(tag),
|
||||
};
|
||||
if (encryptedKey) {
|
||||
jwe.encrypted_key = base64url(encryptedKey);
|
||||
}
|
||||
if (aadMember) {
|
||||
jwe.aad = aadMember;
|
||||
}
|
||||
if (this._protectedHeader) {
|
||||
jwe.protected = decoder.decode(protectedHeader);
|
||||
}
|
||||
if (this._sharedUnprotectedHeader) {
|
||||
jwe.unprotected = this._sharedUnprotectedHeader;
|
||||
}
|
||||
if (this._unprotectedHeader) {
|
||||
jwe.header = this._unprotectedHeader;
|
||||
}
|
||||
return jwe;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user