Merge pull request #559 from panva/bump-jose

bump jose

Author: Sambego

package-lock.json

@@ -49,7 +49,7 @@
         "highlight.js": "^10.4.1",
         "inject-loader": "^3.0.1",
         "isotope-layout": "^3.0.6",
-        "jose": "^3.19.0",
+        "jose": "^4.0.2",
         "jquery": "^3.4.1",
         "lodash": "^4.17.13",
         "loglevel": "^1.6.2",

package.json

@@ -2,9 +2,7 @@ import b64u from 'base64url';
 import any from 'promise.any';
 import strings from '../strings';
 import log from 'loglevel';
-import * as keyImport from 'jose/key/import'
-import CompactSign from 'jose/jws/compact/sign'
-import compactVerify from 'jose/jws/compact/verify'
+import * as jose from 'jose'
 import { pki } from 'node-forge';
 
 function symmetricSecret(key, alg, base64Secret) {
@@ -37,21 +35,21 @@ function getJoseKey(header, key, base64Secret, type) {
                 key = pki.privateKeyInfoToPem(pki.wrapRsaPrivateKey(pki.privateKeyToAsn1(pki.privateKeyFromPem(key))))
             }
             return any([
-                keyImport.importPKCS8(key, header.alg),
+                jose.importPKCS8(key, header.alg),
                 Promise.resolve().then(() => JSON.parse(key)).then(rawPrivate).then((jwk) => {
                     if (!('d' in jwk)) throw new Error('not a private JWK')
-                    return keyImport.importJWK(jwk, header.alg)
+                    return jose.importJWK(jwk, header.alg)
                 })
             ])
         case types.PUBLIC:
             if (key.startsWith('-----BEGIN RSA PUBLIC KEY-----')) {
                 key = pki.publicKeyToPem(pki.publicKeyFromPem(key))
             }
             return any([
-                keyImport.importSPKI(key, header.alg),
-                keyImport.importX509(key, header.alg),
+                jose.importSPKI(key, header.alg),
+                jose.importX509(key, header.alg),
                 Promise.resolve().then(() => JSON.parse(key)).then(rawPublic).then((jwk) => {
-                    return keyImport.importJWK(jwk, header.alg)
+                    return jose.importJWK(jwk, header.alg)
                 })
             ])
         default:
@@ -73,7 +71,7 @@ export function sign(header,
                 payload = JSON.stringify(payload);
             }
 
-            return new CompactSign(new TextEncoder().encode(payload))
+            return new jose.CompactSign(new TextEncoder().encode(payload))
                 .setProtectedHeader(header)
                 .sign(key);
         }
@@ -93,7 +91,7 @@ export function verify(jwt, secretOrPublicKeyString, base64Secret = false) {
 
     return getJoseKey(decoded.header, secretOrPublicKeyString, base64Secret, types.PUBLIC).then(
         key => {
-            return compactVerify(jwt, key)
+            return jose.compactVerify(jwt, key)
                 .then(() => ({
                     validSignature: true,
                     validBase64: jwt.split('.').reduce((valid, s) => valid = valid && isValidBase64String(s), true)

src/editor/jwt.js

@@ -1,5 +1,4 @@
-import { createRemoteJWKSet } from 'jose/jwks/remote'
-import * as keyExport from 'jose/key/export'
+import * as jose from 'jose'
 
 import { httpGet } from '../utils.js';
 
@@ -25,7 +24,7 @@ function getKeyFromX5Claims(claims) {
 }
 
 function getKeyFromJwkKeySetUrl(header, url) {
-  return createRemoteJWKSet(new URL(url))(header, {}).then(keyExport.exportJWK).then((jwk) => JSON.stringify(jwk, null, 2))
+  return jose.createRemoteJWKSet(new URL(url))(header, {}).then(jose.exportJWK).then((jwk) => JSON.stringify(jwk, null, 2))
 }
 
 export function downloadPublicKeyIfPossible(decodedToken) {

src/editor/public-key-download.js

@@ -3,8 +3,7 @@ const chaiAsPromised = require('chai-as-promised');
 const chaiArrays = require('chai-arrays');
 
 const express = require('express');
-const { importPKCS8 } = require('jose/key/import')
-const { CompactSign } = require('jose/jws/compact/sign')
+const jose = require('jose');
 
 const _ = require('lodash');
 
@@ -558,8 +557,8 @@ describe('Editor', function() {
             });
 
             it('iss URL + .well-known', async function() {
-                const key = await importPKCS8(defaultTokens.rs256.privateKey, 'RS256');
-                const token = await new CompactSign(Buffer.from(JSON.stringify({
+                const key = await jose.importPKCS8(defaultTokens.rs256.privateKey, 'RS256');
+                const token = await new jose.CompactSign(Buffer.from(JSON.stringify({
                     sub: 'test',
                     iss: 'http://localhost:3000/'
                 }))).setProtectedHeader({
@@ -584,8 +583,8 @@ describe('Editor', function() {
             it('jku', async function() {
                 //this.timeout(20000);
 
-                const key = await importPKCS8(defaultTokens.rs256.privateKey, 'RS256');
-                const token = await new CompactSign(Buffer.from(JSON.stringify({
+                const key = await jose.importPKCS8(defaultTokens.rs256.privateKey, 'RS256');
+                const token = await new jose.CompactSign(Buffer.from(JSON.stringify({
                     sub: 'test'
                 }))).setProtectedHeader({
                     alg: 'RS256',
@@ -610,8 +609,8 @@ describe('Editor', function() {
             it('x5c', async function() {
                 //this.timeout(35000);
 
-                const key = await importPKCS8(defaultTokens.rs256.privateKey, 'RS256');
-                const token = await new CompactSign(Buffer.from(JSON.stringify({
+                const key = await jose.importPKCS8(defaultTokens.rs256.privateKey, 'RS256');
+                const token = await new jose.CompactSign(Buffer.from(JSON.stringify({
                     sub: 'test'
                 }))).setProtectedHeader({
                     alg: 'RS256',

test/functional/editor.js

@@ -32,15 +32,5 @@ module.exports = {
             $: "jquery",
             jQuery: "jquery",
         }),
-    ],
-    resolve: {
-        alias: {
-            'jose/key/import': 'jose/dist/browser/key/import',
-            'jose/key/export': 'jose/dist/browser/key/export',
-            'jose/jws/compact/sign': 'jose/dist/browser/jws/compact/sign',
-            'jose/jws/compact/verify': 'jose/dist/browser/jws/compact/verify',
-            'jose/jwks/remote': 'jose/dist/browser/jwks/remote',
-            'jose/jwk/embedded': 'jose/dist/browser/jwk/embedded',
-        }
-    }
+    ]
 };

webpack.common.js

@@ -41,15 +41,5 @@ module.exports = merge(common, {
         }
       }
     }]
-  },
-  resolve: {
-    alias: {
-      'jose/key/import': 'jose/dist/node/cjs/key/import',
-      'jose/key/export': 'jose/dist/node/cjs/key/export',
-      'jose/jws/compact/sign': 'jose/dist/node/cjs/jws/compact/sign',
-      'jose/jws/compact/verify': 'jose/dist/node/cjs/jws/compact/verify',
-      'jose/jwks/remote': 'jose/dist/node/cjs/jwks/remote',
-      'jose/jwk/embedded': 'jose/dist/node/cjs/jwk/embedded',
-    }
   }
 });