typescript

.gitignore

@@ -141,4 +141,8 @@ dist
 .yarn/unplugged
 .yarn/build-state.yml
 .yarn/install-state.gz
-.pnp.*
+.pnp.*
+
+# Custom
+/index.js
+/index.d.ts

.npmignore

@@ -0,0 +1,5 @@
+.github/
+src/
+test/
+.nvmrc
+tsconfig.json

.nvmrc

@@ -0,0 +1 @@
+v16

index.d.ts

@@ -1,60 +0,0 @@
-/**
- * JWT
- *
- * @class
- * @constructor
- * @public
- */
-declare class JWT {
-
-    /**
-     * Signs a payload and returns the token
-     * 
-     * @param {object} payload The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
-     * @param {string} secret A string which is used to sign the payload.
-     * @param {JWTSignOptions | JWTAlgorithm} options The options object or the algorithm.
-     * @throws {Error} If there's a validation issue.
-     * @returns {Promise<string>} Returns token as a `string`.
-     */
-    sign(payload: object, secret: string, options?: JWTSignOptions | JWTAlgorithm): Promise<string>
-
-    /**
-     * Verifies the integrity of the token and returns a boolean value.
-     * 
-     * @param {string} token The token string generated by `jwt.sign()`.
-     * @param {string} secret The string which was used to sign the payload.
-     * @param {JWTVerifyOptions | JWTAlgorithm} options The options object or the algorithm.
-     * @throws {Error | string} Throws an error `string` if the token is invalid or an `Error-Object` if there's a validation issue.
-     * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`. 
-     */
-    verify(token: string, secret: string, options?: JWTVerifyOptions | JWTAlgorithm): Promise<boolean>
-
-    /**
-     * Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
-     * 
-     * @param {string} token The token string generated by `jwt.sign()`.
-     * @returns {JWTDecodeReturn} Returns an `object` containing `header` and `payload`.
-     */
-    decode(token: string): JWTDecodeReturn
-}
-declare const _exports: JWT
-
-type JWTAlgorithm = 'ES256' | 'ES384' | 'ES512' | 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512'
-
-type JWTSignOptions = {
-    algorithm?: JWTAlgorithm,
-    keyid?: string
-    header?: object
-}
-
-type JWTVerifyOptions = {
-    algorithm?: JWTAlgorithm
-    throwError?: boolean
-}
-
-type JWTDecodeReturn = {
-    header: object,
-    payload: object
-}
-
-export = _exports

index.js

@@ -1,128 +0,0 @@
-class Base64URL {
-    static parse(s) {
-        return new Uint8Array(Array.prototype.map.call(atob(s.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '')), c => c.charCodeAt(0)))
-    }
-    static stringify(a) {
-        return btoa(String.fromCharCode.apply(0, a)).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
-    }
-}
-
-class JWT {
-    constructor() {
-        if (typeof crypto === 'undefined' || !crypto.subtle)
-            throw new Error('Crypto not supported!')
-        this.algorithms = {
-            ES256: { name: 'ECDSA', namedCurve: 'P-256', hash: { name: 'SHA-256' } },
-            ES384: { name: 'ECDSA', namedCurve: 'P-384', hash: { name: 'SHA-384' } },
-            ES512: { name: 'ECDSA', namedCurve: 'P-521', hash: { name: 'SHA-512' } },
-            HS256: { name: 'HMAC', hash: { name: 'SHA-256' } },
-            HS384: { name: 'HMAC', hash: { name: 'SHA-384' } },
-            HS512: { name: 'HMAC', hash: { name: 'SHA-512' } },
-            RS256: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-256' } },
-            RS384: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-384' } },
-            RS512: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-512' } },
-        }
-    }
-    _utf8ToUint8Array(str) {
-        return Base64URL.parse(btoa(unescape(encodeURIComponent(str))))
-    }
-    _str2ab(str) {
-        const buf = new ArrayBuffer(str.length);
-        const bufView = new Uint8Array(buf);
-        for (let i = 0, strLen = str.length; i < strLen; i++) {
-            bufView[i] = str.charCodeAt(i);
-        }
-        return buf;
-    }
-    _decodePayload(raw) {
-        switch (raw.length % 4) {
-            case 0:
-                break
-            case 2:
-                raw += '=='
-                break
-            case 3:
-                raw += '='
-                break
-            default:
-                throw new Error('Illegal base64url string!')
-        }
-        try {
-            return JSON.parse(decodeURIComponent(escape(atob(raw))))
-        } catch {
-            return null
-        }
-    }
-    async sign(payload, secret, options = { algorithm: 'HS256', header: { typ: 'JWT' } }) {
-        if (typeof options === 'string')
-            options = { algorithm: options, header: { typ: 'JWT' } }
-        options = { algorithm: 'HS256', header: { typ: 'JWT' }, ...options }
-        if (payload === null || typeof payload !== 'object')
-            throw new Error('payload must be an object')
-        if (typeof secret !== 'string')
-            throw new Error('secret must be a string')
-        if (typeof options.algorithm !== 'string')
-            throw new Error('options.algorithm must be a string')
-        const importAlgorithm = this.algorithms[options.algorithm]
-        if (!importAlgorithm)
-            throw new Error('algorithm not found')
-        payload.iat = Math.floor(Date.now() / 1000)
-        const payloadAsJSON = JSON.stringify(payload)
-        const partialToken = `${Base64URL.stringify(this._utf8ToUint8Array(JSON.stringify({ ...options.header, alg: options.algorithm, kid: options.keyid })))}.${Base64URL.stringify(this._utf8ToUint8Array(payloadAsJSON))}`
-        let keyFormat = 'raw'
-        let keyData
-        if (secret.startsWith('-----BEGIN')) {
-            keyFormat = 'pkcs8'
-            keyData = this._str2ab(atob(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, '')))
-        } else
-            keyData = this._utf8ToUint8Array(secret)
-        const key = await crypto.subtle.importKey(keyFormat, keyData, importAlgorithm, false, ['sign'])
-        const signature = await crypto.subtle.sign(importAlgorithm, key, this._utf8ToUint8Array(partialToken))
-        return `${partialToken}.${Base64URL.stringify(new Uint8Array(signature))}`
-    }
-    async verify(token, secret, options = { algorithm: 'HS256', throwError: false }) {
-        if (typeof options === 'string')
-            options = { algorithm: options }
-        options = { algorithm: 'HS256', throwError: false, ...options }
-        if (typeof token !== 'string')
-            throw new Error('token must be a string')
-        if (typeof secret !== 'string')
-            throw new Error('secret must be a string')
-        if (typeof options.algorithm !== 'string')
-            throw new Error('options.algorithm must be a string')
-        const tokenParts = token.split('.')
-        if (tokenParts.length !== 3)
-            throw new Error('token must consist of 3 parts')
-        const importAlgorithm = this.algorithms[options.algorithm]
-        if (!importAlgorithm)
-            throw new Error('algorithm not found')
-        const { payload } = this.decode(token)
-        if (payload.nbf && payload.nbf > Math.floor(Date.now() / 1000)) {
-            if (options.throwError)
-                throw 'NOT_YET_VALID'
-            return false
-        }
-        if (payload.exp && payload.exp <= Math.floor(Date.now() / 1000)) {
-            if (options.throwError)
-                throw 'EXPIRED'
-            return false
-        }
-        let keyFormat = 'raw'
-        let keyData
-        if (secret.startsWith('-----BEGIN')) {
-            keyFormat = 'spki'
-            keyData = this._str2ab(atob(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, '')))
-        } else
-            keyData = this._utf8ToUint8Array(secret)
-        const key = await crypto.subtle.importKey(keyFormat, keyData, importAlgorithm, false, ['verify'])
-        return await crypto.subtle.verify(importAlgorithm, key, Base64URL.parse(tokenParts[2]), this._utf8ToUint8Array(`${tokenParts[0]}.${tokenParts[1]}`))
-    }
-    decode(token) {
-        return {
-            header: this._decodePayload(token.split('.')[0].replace(/-/g, '+').replace(/_/g, '/')),
-            payload: this._decodePayload(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))
-        }
-    }
-}
-
-module.exports = new JWT

index.test.js

@@ -1,168 +0,0 @@
-const { subtle } = require('node:crypto').webcrypto
-Object.defineProperty(global, 'crypto', {
-    value: { subtle }
-})
-
-const JWT = require('./index')
-const oneDay = (60 * 60 * 24)
-const now = Date.now() / 1000
-
-const secrets = {}
-
-// Keypairs
-for (const algorithm of Object.keys(JWT.algorithms)) {
-    if (algorithm.startsWith('HS'))
-        secrets[algorithm] = 'secret'
-    else if (algorithm.startsWith('RS')) {
-        secrets[algorithm] = {
-            public: `-----BEGIN PUBLIC KEY-----
-MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu1SU1LfVLPHCozMxH2Mo
-4lgOEePzNm0tRgeLezV6ffAt0gunVTLw7onLRnrq0/IzW7yWR7QkrmBL7jTKEn5u
-+qKhbwKfBstIs+bMY2Zkp18gnTxKLxoS2tFczGkPLPgizskuemMghRniWaoLcyeh
-kd3qqGElvW/VDL5AaWTg0nLVkjRo9z+40RQzuVaE8AkAFmxZzow3x+VJYKdjykkJ
-0iT9wCS0DRTXu269V264Vf/3jvredZiKRkgwlL9xNAwxXFg0x/XFw005UWVRIkdg
-cKWTjpBP2dPwVZ4WWC+9aGVd+Gyn1o0CLelf4rEjGoXbAAEgAqeGUxrcIlbjXfbc
-mwIDAQAB
------END PUBLIC KEY-----`,
-            private: `-----BEGIN PRIVATE KEY-----
-MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQC7VJTUt9Us8cKj
-MzEfYyjiWA4R4/M2bS1GB4t7NXp98C3SC6dVMvDuictGeurT8jNbvJZHtCSuYEvu
-NMoSfm76oqFvAp8Gy0iz5sxjZmSnXyCdPEovGhLa0VzMaQ8s+CLOyS56YyCFGeJZ
-qgtzJ6GR3eqoYSW9b9UMvkBpZODSctWSNGj3P7jRFDO5VoTwCQAWbFnOjDfH5Ulg
-p2PKSQnSJP3AJLQNFNe7br1XbrhV//eO+t51mIpGSDCUv3E0DDFcWDTH9cXDTTlR
-ZVEiR2BwpZOOkE/Z0/BVnhZYL71oZV34bKfWjQIt6V/isSMahdsAASACp4ZTGtwi
-VuNd9tybAgMBAAECggEBAKTmjaS6tkK8BlPXClTQ2vpz/N6uxDeS35mXpqasqskV
-laAidgg/sWqpjXDbXr93otIMLlWsM+X0CqMDgSXKejLS2jx4GDjI1ZTXg++0AMJ8
-sJ74pWzVDOfmCEQ/7wXs3+cbnXhKriO8Z036q92Qc1+N87SI38nkGa0ABH9CN83H
-mQqt4fB7UdHzuIRe/me2PGhIq5ZBzj6h3BpoPGzEP+x3l9YmK8t/1cN0pqI+dQwY
-dgfGjackLu/2qH80MCF7IyQaseZUOJyKrCLtSD/Iixv/hzDEUPfOCjFDgTpzf3cw
-ta8+oE4wHCo1iI1/4TlPkwmXx4qSXtmw4aQPz7IDQvECgYEA8KNThCO2gsC2I9PQ
-DM/8Cw0O983WCDY+oi+7JPiNAJwv5DYBqEZB1QYdj06YD16XlC/HAZMsMku1na2T
-N0driwenQQWzoev3g2S7gRDoS/FCJSI3jJ+kjgtaA7Qmzlgk1TxODN+G1H91HW7t
-0l7VnL27IWyYo2qRRK3jzxqUiPUCgYEAx0oQs2reBQGMVZnApD1jeq7n4MvNLcPv
-t8b/eU9iUv6Y4Mj0Suo/AU8lYZXm8ubbqAlwz2VSVunD2tOplHyMUrtCtObAfVDU
-AhCndKaA9gApgfb3xw1IKbuQ1u4IF1FJl3VtumfQn//LiH1B3rXhcdyo3/vIttEk
-48RakUKClU8CgYEAzV7W3COOlDDcQd935DdtKBFRAPRPAlspQUnzMi5eSHMD/ISL
-DY5IiQHbIH83D4bvXq0X7qQoSBSNP7Dvv3HYuqMhf0DaegrlBuJllFVVq9qPVRnK
-xt1Il2HgxOBvbhOT+9in1BzA+YJ99UzC85O0Qz06A+CmtHEy4aZ2kj5hHjECgYEA
-mNS4+A8Fkss8Js1RieK2LniBxMgmYml3pfVLKGnzmng7H2+cwPLhPIzIuwytXywh
-2bzbsYEfYx3EoEVgMEpPhoarQnYPukrJO4gwE2o5Te6T5mJSZGlQJQj9q4ZB2Dfz
-et6INsK0oG8XVGXSpQvQh3RUYekCZQkBBFcpqWpbIEsCgYAnM3DQf3FJoSnXaMhr
-VBIovic5l0xFkEHskAjFTevO86Fsz1C2aSeRKSqGFoOQ0tmJzBEs1R6KqnHInicD
-TQrKhArgLXX4v3CddjfTRJkFWDbE/CkvKZNOrcf1nhaGCPspRJj2KUkj1Fhl9Cnc
-dn/RsYEONbwQSjIfMPkvxF+8HQ==
------END PRIVATE KEY-----`
-        }
-    } else if (algorithm.startsWith('ES')) {
-        if (algorithm === 'ES256') {
-            secrets[algorithm] = {
-                public: `-----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEVs/o5+uQbTjL3chynL4wXgUg2R9
-q9UU8I5mEovUf86QZ7kOBIjJwqnzD1omageEHWwHdBO6B+dFabmdT9POxg==
------END PUBLIC KEY-----`,
-                private: `-----BEGIN PRIVATE KEY-----
-MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgevZzL1gdAFr88hb2
-OF/2NxApJCzGCEDdfSp6VQO30hyhRANCAAQRWz+jn65BtOMvdyHKcvjBeBSDZH2r
-1RTwjmYSi9R/zpBnuQ4EiMnCqfMPWiZqB4QdbAd0E7oH50VpuZ1P087G
------END PRIVATE KEY-----`
-            }
-        } else if (algorithm === 'ES384') {
-            secrets[algorithm] = {
-                public: `-----BEGIN PUBLIC KEY-----
-MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEC1uWSXj2czCDwMTLWV5BFmwxdM6PX9p+
-Pk9Yf9rIf374m5XP1U8q79dBhLSIuaojsvOT39UUcPJROSD1FqYLued0rXiooIii
-1D3jaW6pmGVJFhodzC31cy5sfOYotrzF
------END PUBLIC KEY-----`,
-                private: `-----BEGIN PRIVATE KEY-----
-MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCAHpFQ62QnGCEvYh/p
-E9QmR1C9aLcDItRbslbmhen/h1tt8AyMhskeenT+rAyyPhGhZANiAAQLW5ZJePZz
-MIPAxMtZXkEWbDF0zo9f2n4+T1h/2sh/fviblc/VTyrv10GEtIi5qiOy85Pf1RRw
-8lE5IPUWpgu553SteKigiKLUPeNpbqmYZUkWGh3MLfVzLmx85ii2vMU=
------END PRIVATE KEY-----`
-            }
-        } else if (algorithm === 'ES512') {
-            secrets[algorithm] = {
-                public: `-----BEGIN PUBLIC KEY-----
-MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBgc4HZz+/fBbC7lmEww0AO3NK9wVZ
-PDZ0VEnsaUFLEYpTzb90nITtJUcPUbvOsdZIZ1Q8fnbquAYgxXL5UgHMoywAib47
-6MkyyYgPk0BXZq3mq4zImTRNuaU9slj9TVJ3ScT3L1bXwVuPJDzpr5GOFpaj+WwM
-Al8G7CqwoJOsW7Kddns=
------END PUBLIC KEY-----`,
-                private: `-----BEGIN PRIVATE KEY-----
-MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBiyAa7aRHFDCh2qga
-9sTUGINE5jHAFnmM8xWeT/uni5I4tNqhV5Xx0pDrmCV9mbroFtfEa0XVfKuMAxxf
-Z6LM/yKhgYkDgYYABAGBzgdnP798FsLuWYTDDQA7c0r3BVk8NnRUSexpQUsRilPN
-v3SchO0lRw9Ru86x1khnVDx+duq4BiDFcvlSAcyjLACJvjvoyTLJiA+TQFdmrear
-jMiZNE25pT2yWP1NUndJxPcvVtfBW48kPOmvkY4WlqP5bAwCXwbsKrCgk6xbsp12
-ew==
------END PRIVATE KEY-----`
-            }
-        }
-    }
-}
-
-// Payload
-const testPayload = {
-    sub: "1234567890",
-    name: "John Doe"
-}
-
-// Self test
-test.each(Object.entries(secrets))(`Self test: %s`, async (algorithm, key) => {
-    let privateKey = key
-    let publicKey = key
-    if (typeof key === 'object') {
-        privateKey = key.private
-        publicKey = key.public
-    }
-    
-    const token = await JWT.sign(testPayload, privateKey, { algorithm })
-    expect(token).toMatch(/^[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+$/)
-    
-    const verified = await JWT.verify(token, publicKey, { algorithm })
-    expect(verified).toBeTruthy()
-    
-    const { payload } = JWT.decode(token)
-    expect({
-        sub: payload.sub,
-        name: payload.name
-    }).toMatchObject({
-        sub: testPayload.sub,
-        name: testPayload.name
-    })
-})
-
-// External token test
-const externalTokens = {
-    ES256: 'eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.Ri9u3ZJpyoHf1_i3KpVE5gMggyU3VMYPeEVktAsG1kGLOxFNJBXydQls3WFBaXXH2-sN74IMe-nDcM7NoJ6GMQ',
-    ES384: 'eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.6nmlvcCpsfENb6ssgX3rJ2XSjpFSXD1RPS1CK0iDZFdi6I6Gnmpi456RSW6-0XSSgq2E2XBcWCSYE6TeI63jOGZJTQ6-65g4sndbzBPqYPWbLny00NQ4MQgQXVu6tRzg',
-    ES512: 'eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.AbRwaCPJM2X3XjE2kInClHVGJNIcpL5C4a1ZrgwEM05RTryyNbazWRFbXAEDtHm8crvXpqw3a8JQwYDwvMyoOr4jAJ4RbhJitLgCGEzhKjvNy4xGrg3dV8gGEShFowgDfVz0KqHOX_Bc_DbyL-gtZPdfGTwT2upLkJE-lj47RStPDh0b',
-    HS256: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.XbPfbIHMI6arZ3Y922BhjWgQzWXcXNrz0ogtVhfEd2o',
-    HS384: 'eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.hO2sthNQUSfvI9ylUdMKDxcrm8jB3KL6Rtkd3FOskL-jVqYh2CK1es8FKCQO8_tW',
-    HS512: 'eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.wUVS6tazE2N98_J4SH_djkEe1igXPu0qILAvVXCiO6O20gdf5vZ2sYFWX3c-Hy6L4TD47b3DSAAO9XjSqpJfag',
-    RS256: 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.Eci61G6w4zh_u9oOCk_v1M_sKcgk0svOmW4ZsL-rt4ojGUH2QY110bQTYNwbEVlowW7phCg7vluX_MCKVwJkxJT6tMk2Ij3Plad96Jf2G2mMsKbxkC-prvjvQkBFYWrYnKWClPBRCyIcG0dVfBvqZ8Mro3t5bX59IKwQ3WZ7AtGBYz5BSiBlrKkp6J1UmP_bFV3eEzIHEFgzRa3pbr4ol4TK6SnAoF88rLr2NhEz9vpdHglUMlOBQiqcZwqrI-Z4XDyDzvnrpujIToiepq9bCimPgVkP54VoZzy-mMSGbthYpLqsL_4MQXaI1Uf_wKFAUuAtzVn4-ebgsKOpvKNzVA',
-    RS384: 'eyJhbGciOiJSUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.oPvWzaCp8xUpt5mHhPSn0qLsZfCFj0NVmb4mz4dFQPCCMj-F5zVn9e3zZoj0lIXWM8rxB69QHC3Er47mtDt3BKgysTL3BvvV89kD6UjLoUcAI3lwj0mi7acLoE27i1_TnIBqWNRPAsdvTDawNE0_4lvI5bxEWQCqisJwxCoMDIeJsmDzfyApgU_SAFSVULxXwU2VewaxdQB-41OZdWwUEAxh81iB6DFWrqd2CaJkUYoWjgYpeWsyeC2m_-ECGrHGEz1nKTm9c7BaPxurz7fHD7RJd9Wpx-mKDVsfspO9quWb_OLeGGbxTtAomMvjQjut56kx2fqTleDnNDh_0GE88w',
-    RS512: 'eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.kEZmDAnHHU_0bcGXMd5LA7vF87yQgXNaioPHP4lU4O3JJYuZ54fJdv3HT58xk-MFEDuWro_5fvNIp2VM-PlkZvYWrhQkJ-c-seoSa3ANq_PciC3bGfzYHEdjAE71GrAMI4FlcAGsq3ChkOnCTFqjWDmVwaRYCgMsFQ-U5cjvFhndFMizrkRljTF4v5oFdWytV_J-UafPtNdQXcGND1M74DqObnTHhZHg8aDfNzZcvnIeKcDVGUlUEL5ia1kPMrVhCtOAOJmEU8ivCdWWzt-jMQBf7cZeoCzDKHG72ysTTCfRoBVc1_SrQTHcHDiiBeW9nCazMLkltyP5NeawR_RNlg'
-}
-
-test.each(Object.entries(externalTokens))('Verify external tokens: %s', async (algorithm, token) => {
-    const key = secrets[algorithm]
-    let privateKey = key
-    let publicKey = key
-    if (typeof key === 'object') {
-        privateKey = key.private
-        publicKey = key.public
-    }
-    
-    const verified = await JWT.verify(token, publicKey, { algorithm })
-    expect(verified).toBeTruthy()
-
-    const { payload } = JWT.decode(token)
-    expect({
-        sub: payload.sub,
-        name: payload.name
-    }).toMatchObject({
-        sub: testPayload.sub,
-        name: testPayload.name
-    })
-})

package.json

@@ -3,8 +3,10 @@
   "version": "1.4.4",
   "description": "A lightweight JWT implementation with ZERO dependencies for Cloudflare Worker",
   "main": "index.js",
+  "types": "index.d.ts",
   "scripts": {
-      "test": "jest"
+    "build": "tsc",
+    "test": "ts-jest"
   },
   "repository": {
     "type": "git",
@@ -24,6 +26,7 @@
   },
   "homepage": "https://github.com/tsndr/cloudflare-worker-jwt#readme",
   "devDependencies": {
-    "jest": "^28.1.0"
+    "@cloudflare/workers-types": "^3.13.0",
+    "typescript": "^4.7.4"
   }
 }

src/index.ts

@@ -0,0 +1,240 @@
+enum JwtAlgorithm {
+    ES256 = 'ES256',
+    ES384 = 'ES384',
+    ES512 = 'ES512',
+    HS256 = 'HS256',
+    HS384 = 'HS384',
+    HS512 = 'HS512',
+    RS256 = 'RS256',
+    RS384 = 'RS384',
+    RS512 = 'RS512'
+}
+
+interface JwtImportAlgorithms {
+    [key: string]: SubtleCryptoImportKeyAlgorithm
+}
+
+interface JwtHeader {
+    typ?: string,
+    [key: string]: any
+}
+
+interface JwtPayload {
+    iss?: string
+    sub?: string
+    aud?: string
+    exp?: number
+    nbf?: number
+    iat?: number
+    jti?: string
+    [key: string]: any
+}
+
+/**
+ * @typedef JwtOptions
+ * @property {string} algorithm
+ */
+interface JwtOptions {
+    algorithm: JwtAlgorithm
+}
+
+/**
+ * @typedef JwtSignOptions
+ * @property {JwtHeader} [header]
+ */
+interface JwtSignOptions extends JwtOptions {
+    header?: JwtHeader
+}
+
+/**
+ * @typedef JwtVerifyOptions
+ * @property {boolean} [throwError]
+ */
+interface JwtVerifyOptions extends JwtOptions {
+    throwError?: boolean
+}
+
+interface JwtData {
+    header: JwtHeader
+    payload: JwtPayload
+}
+
+/**
+ * Base64URL
+ * 
+ * @class
+ */
+ class Base64URL {
+    public static parse(s: string): Uint8Array {
+        // @ts-ignore
+        return new Uint8Array(Array.prototype.map.call(atob(s.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '')), c => c.charCodeAt(0)))
+        // return new Uint8Array(Array.from(atob(s.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, ''))).map(c => c.charCodeAt(0)))
+    }
+    public static stringify(a: Uint8Array): string {
+        // @ts-ignore
+        return btoa(String.fromCharCode.apply(0, a)).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
+        // return btoa(String.fromCharCode.apply(0, Array.from(a))).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_')
+    }
+}
+
+/**
+ * Jwt
+ *
+ * @class
+ * @constructor
+ * @public
+ */
+class Jwt {
+
+    protected importAlgorithms: JwtImportAlgorithms = {
+        ES256: { name: 'ECDSA', namedCurve: 'P-256', hash: { name: 'SHA-256' } },
+        ES384: { name: 'ECDSA', namedCurve: 'P-384', hash: { name: 'SHA-384' } },
+        ES512: { name: 'ECDSA', namedCurve: 'P-521', hash: { name: 'SHA-512' } },
+        HS256: { name: 'HMAC', hash: { name: 'SHA-256' } },
+        HS384: { name: 'HMAC', hash: { name: 'SHA-384' } },
+        HS512: { name: 'HMAC', hash: { name: 'SHA-512' } },
+        RS256: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-256' } },
+        RS384: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-384' } },
+        RS512: { name: 'RSASSA-PKCS1-v1_5', hash: { name: 'SHA-512' } }
+    }
+
+    constructor() {
+        if (typeof crypto === 'undefined' || !crypto.subtle)
+            throw new Error('SubtleCrypto not supported!')
+    }
+
+    protected _utf8ToUint8Array(str: string): Uint8Array {
+        return Base64URL.parse(btoa(unescape(encodeURIComponent(str))))
+    }
+
+    protected _str2ab(str: string): ArrayBuffer {
+        str = atob(str)
+        const buf = new ArrayBuffer(str.length);
+        const bufView = new Uint8Array(buf);
+        for (let i = 0, strLen = str.length; i < strLen; i++) {
+            bufView[i] = str.charCodeAt(i);
+        }
+        return buf;
+    }
+
+    protected _decodePayload(raw: string): any {
+        switch (raw.length % 4) {
+            case 0:
+                break
+            case 2:
+                raw += '=='
+                break
+            case 3:
+                raw += '='
+                break
+            default:
+                throw new Error('Illegal base64url string!')
+        }
+        try {
+            return JSON.parse(raw)
+        } catch {
+            return null
+        }
+    }
+
+    /**
+     * Signs a payload and returns the token
+     * 
+     * @param {JwtPayload} payload The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
+     * @param {string} secret A string which is used to sign the payload.
+     * @param {JwtSignOptions | JwtAlgorithm} [options={ algorithm: 'HS256', header: { typ: 'JWT' } }] The options object or the algorithm.
+     * @throws {Error} If there's a validation issue.
+     * @returns {Promise<string>} Returns token as a `string`.
+     */
+    public async sign(payload: JwtPayload, secret: string, options: JwtSignOptions | JwtAlgorithm = { algorithm: JwtAlgorithm.HS256, header: { typ: 'JWT' } }): Promise<string> {
+        if (typeof options === 'string')
+            options = { algorithm: options, header: { typ: 'JWT' } }
+        // @ts-ignore
+        options = { algorithm: JwtAlgorithm.HS256, header: { typ: 'JWT' }, ...options }
+        if (payload === null || typeof payload !== 'object')
+            throw new Error('payload must be an object')
+        if (typeof secret !== 'string')
+            throw new Error('secret must be a string')
+        if (typeof options.algorithm !== 'string')
+            throw new Error('options.algorithm must be a string')
+        const importAlgorithm: SubtleCryptoImportKeyAlgorithm = this.importAlgorithms[options.algorithm]
+        if (!importAlgorithm)
+            throw new Error('algorithm not found')
+        payload.iat = Math.floor(Date.now() / 1000)
+        const payloadAsJSON = JSON.stringify(payload)
+        const partialToken = `${Base64URL.stringify(this._utf8ToUint8Array(JSON.stringify({ ...options.header, alg: options.algorithm })))}.${Base64URL.stringify(this._utf8ToUint8Array(payloadAsJSON))}`
+        let keyFormat = 'raw'
+        let keyData
+        if (secret.startsWith('-----BEGIN')) {
+            keyFormat = 'pkcs8'
+            keyData = this._str2ab(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, ''))
+        } else
+            keyData = this._utf8ToUint8Array(secret)
+        const key = await crypto.subtle.importKey(keyFormat, keyData, importAlgorithm, false, ['sign'])
+        const signature = await crypto.subtle.sign(importAlgorithm, key, this._utf8ToUint8Array(partialToken))
+        return `${partialToken}.${Base64URL.stringify(new Uint8Array(signature))}`
+    }
+
+    /**
+     * Verifies the integrity of the token and returns a boolean value.
+     * 
+     * @param {string} token The token string generated by `jwt.sign()`.
+     * @param {string} secret The string which was used to sign the payload.
+     * @param {JWTVerifyOptions | JWTAlgorithm} options The options object or the algorithm.
+     * @throws {Error | string} Throws an error `string` if the token is invalid or an `Error-Object` if there's a validation issue.
+     * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`. 
+     */
+    async verify(token: string, secret: string, options: JwtVerifyOptions | JwtAlgorithm = { algorithm: JwtAlgorithm.ES256, throwError: false }): Promise<boolean> {
+        if (typeof options === 'string')
+            options = { algorithm: options, throwError: false }
+        // @ts-ignore
+        options = { algorithm: JwtAlgorithm.HS256, throwError: false, ...options }
+        if (typeof token !== 'string')
+            throw new Error('token must be a string')
+        if (typeof secret !== 'string')
+            throw new Error('secret must be a string')
+        if (typeof options.algorithm !== 'string')
+            throw new Error('options.algorithm must be a string')
+        const tokenParts = token.split('.')
+        if (tokenParts.length !== 3)
+            throw new Error('token must consist of 3 parts')
+        const importAlgorithm: SubtleCryptoImportKeyAlgorithm = this.importAlgorithms[options.algorithm]
+        if (!importAlgorithm)
+            throw new Error('algorithm not found')
+        const { payload } = this.decode(token)
+        if (payload.nbf && payload.nbf > Math.floor(Date.now() / 1000)) {
+            if (options.throwError)
+                throw 'NOT_YET_VALID'
+            return false
+        }
+        if (payload.exp && payload.exp <= Math.floor(Date.now() / 1000)) {
+            if (options.throwError)
+                throw 'EXPIRED'
+            return false
+        }
+        let keyFormat = 'raw'
+        let keyData
+        if (secret.startsWith('-----BEGIN')) {
+            keyFormat = 'spki'
+            keyData = this._str2ab(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, ''))
+        } else
+            keyData = this._utf8ToUint8Array(secret)
+        const key = await crypto.subtle.importKey(keyFormat, keyData, importAlgorithm, false, ['verify'])
+        return await crypto.subtle.verify(importAlgorithm, key, Base64URL.parse(tokenParts[2]), this._utf8ToUint8Array(`${tokenParts[0]}.${tokenParts[1]}`))
+    }
+
+    /**
+     * Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
+     * 
+     * @param {string} token The token string generated by `jwt.sign()`.
+     * @returns {JwtData} Returns an `object` containing `header` and `payload`.
+     */
+    public decode(token: string): JwtData {
+        return {
+            header: this._decodePayload(token.split('.')[0].replace(/-/g, '+').replace(/_/g, '/')),
+            payload: this._decodePayload(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))
+        }
+    }
+}
+
+export default new Jwt

tsconfig.json

@@ -0,0 +1,27 @@
+{
+    "compilerOptions": {
+        "outDir": ".",
+        "module": "commonjs",
+        "target": "esnext",
+        "lib": ["esnext"],
+        "declaration": true,
+        "strict": true,
+        "noImplicitAny": true,
+        "strictNullChecks": true,
+        "strictFunctionTypes": true,
+        "strictBindCallApply": true,
+        "strictPropertyInitialization": true,
+        "noImplicitThis": true,
+        "alwaysStrict": true,
+        "noUnusedLocals": true,
+        "noUnusedParameters": true,
+        "noImplicitReturns": true,
+        "noFallthroughCasesInSwitch": true,
+        "esModuleInterop": true,
+        "preserveConstEnums": true,
+        "moduleResolution": "node",
+        "types": ["@cloudflare/workers-types"]
+    },
+    "include": ["src"],
+    "exclude": ["node_modules"]
+}