2.2.3

Think the installation command shouldn't use `-D` as it's used in the production code right, so installing as dev dep would be confusing, right?

Please correct me if I'm wrong 🙏

Also thanks a lot for this package, was just using for a way to sign and verify JWT in Pages ❤️

.editorconfig

@@ -0,0 +1,10 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = false
+
+[src/**/*.ts]
+charset = utf-8
+indent_style = space
+indent_size = 4

README.md

@@ -16,7 +16,7 @@ A lightweight JWT implementation with ZERO dependencies for Cloudflare Workers.
 ## Install
 
 ```
-npm i -D @tsndr/cloudflare-worker-jwt
+npm i @tsndr/cloudflare-worker-jwt
 ```
 
 
@@ -84,7 +84,7 @@ Signs a payload and returns the token.
 
 #### Arguments
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `payload`   | `object` | required | -       | The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
 `secret`    | `string` | required | -       | A string which is used to sign the payload.
@@ -100,11 +100,11 @@ Returns token as a `string`.
 
 Verifies the integrity of the token and returns a boolean value.
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 `secret`    | `string` | required | -       | The string which was used to sign the payload.
-`options`   | `object` | optional | `{ algorithm: 'HS256', throwError: false }` | The options object supporting `algorithm` and `throwError`. (See [Available Algorithms](#available-algorithms))
+`options`   | `object` | optional | `{ algorithm: 'HS256', skipValidation: false, throwError: false }` | The options object supporting `algorithm`, `skipValidation` and `throwError`. (See [Available Algorithms](#available-algorithms))
 
 #### `throws`
 If `options.throwError` is `true` and the token is invalid, an error will be thrown.
@@ -119,7 +119,7 @@ Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherw
 
 Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
 
-Argument    | Type     | Satus    | Default | Description
+Argument    | Type     | Status   | Default | Description
 ----------- | -------- | -------- | ------- | -----------
 `token`     | `string` | required | -       | The token string generated by `jwt.sign()`.
 
@@ -147,4 +147,4 @@ Returns an `object` containing `header` and `payload`:
  - HS512
  - RS256
  - RS384
- - RS512
+ - RS512

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@tsndr/cloudflare-worker-jwt",
-  "version": "2.1.1",
+  "version": "2.2.3",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@tsndr/cloudflare-worker-jwt",
-      "version": "2.1.1",
+      "version": "2.2.3",
       "license": "MIT",
       "devDependencies": {
         "@cloudflare/workers-types": "^3.13.0",
@@ -2542,9 +2542,9 @@
       "dev": true
     },
     "node_modules/json5": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-      "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true,
       "bin": {
         "json5": "lib/cli.js"
@@ -5364,9 +5364,9 @@
       "dev": true
     },
     "json5": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-      "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true
     },
     "kleur": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tsndr/cloudflare-worker-jwt",
-  "version": "2.1.1",
+  "version": "2.2.3",
   "description": "A lightweight JWT implementation with ZERO dependencies for Cloudflare Worker",
   "main": "index.js",
   "types": "index.d.ts",

src/index.ts

@@ -21,7 +21,7 @@ export interface JwtAlgorithms {
 export interface JwtHeader {
     /**
      * Type (default: `"JWT"`)
-     * 
+     *
      * @default "JWT"
      */
     typ?: string
@@ -33,7 +33,7 @@ export interface JwtHeader {
  * @typedef JwtPayload
  * @prop {string} [iss] Issuer
  * @prop {string} [sub] Subject
- * @prop {string} [aud] Audience
+ * @prop {string | string[]} [aud] Audience
  * @prop {string} [exp] Expiration Time
  * @prop {string} [nbf] Not Before
  * @prop {string} [iat] Issued At
@@ -47,7 +47,7 @@ export interface JwtPayload {
     sub?: string
 
     /** Audience */
-    aud?: string
+    aud?: string | string[]
 
     /** Expiration Time */
     exp?: number
@@ -87,9 +87,14 @@ export interface JwtSignOptions extends JwtOptions {
  * @prop {boolean} [throwError=false] If `true` throw error if checks fail. (default: `false`)
  */
 export interface JwtVerifyOptions extends JwtOptions {
+    /**
+     * If `true` all expiry checks will be skipped
+    */
+    skipValidation?: boolean
+
     /**
      * If `true` throw error if checks fail. (default: `false`)
-     * 
+     *
      * @default false
     */
     throwError?: boolean
@@ -169,14 +174,14 @@ function _decodePayload(raw: string): JwtHeader | JwtPayload | null {
 
 /**
  * Signs a payload and returns the token
- * 
+ *
  * @param {JwtPayload} payload The payload object. To use `nbf` (Not Before) and/or `exp` (Expiration Time) add `nbf` and/or `exp` to the payload.
- * @param {string} secret A string which is used to sign the payload.
+ * @param {string | JsonWebKey} secret A string which is used to sign the payload.
  * @param {JwtSignOptions | JwtAlgorithm | string} [options={ algorithm: 'HS256', header: { typ: 'JWT' } }] The options object or the algorithm.
  * @throws {Error} If there's a validation issue.
  * @returns {Promise<string>} Returns token as a `string`.
  */
-export async function sign(payload: JwtPayload, secret: string, options: JwtSignOptions | JwtAlgorithm = { algorithm: 'HS256', header: { typ: 'JWT' } }): Promise<string> {
+export async function sign(payload: JwtPayload, secret: string | JsonWebKey, options: JwtSignOptions | JwtAlgorithm = { algorithm: 'HS256', header: { typ: 'JWT' } }): Promise<string> {
     if (typeof options === 'string')
         options = { algorithm: options, header: { typ: 'JWT' } }
 
@@ -185,8 +190,8 @@ export async function sign(payload: JwtPayload, secret: string, options: JwtSign
     if (payload === null || typeof payload !== 'object')
         throw new Error('payload must be an object')
 
-    if (typeof secret !== 'string')
-        throw new Error('secret must be a string')
+    if (typeof secret !== 'string' && typeof secret !== 'object')
+        throw new Error('secret must be a string or a JWK object')
 
     if (typeof options.algorithm !== 'string')
         throw new Error('options.algorithm must be a string')
@@ -196,17 +201,24 @@ export async function sign(payload: JwtPayload, secret: string, options: JwtSign
     if (!algorithm)
         throw new Error('algorithm not found')
 
-    payload.iat = Math.floor(Date.now() / 1000)
+    if (!payload.iat)
+        payload.iat = Math.floor(Date.now() / 1000)
 
     const payloadAsJSON = JSON.stringify(payload)
     const partialToken = `${base64UrlStringify(_utf8ToUint8Array(JSON.stringify({ ...options.header, alg: options.algorithm })))}.${base64UrlStringify(_utf8ToUint8Array(payloadAsJSON))}`
+
     let keyFormat = 'raw'
     let keyData
-    if (secret.startsWith('-----BEGIN')) {
+
+    if (typeof secret === 'object') {
+        keyFormat = 'jwk'
+        keyData = secret
+    } else if (typeof secret === 'string' && secret.startsWith('-----BEGIN')) {
         keyFormat = 'pkcs8'
         keyData = _str2ab(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, ''))
     } else
         keyData = _utf8ToUint8Array(secret)
+
     const key = await crypto.subtle.importKey(keyFormat, keyData, algorithm, false, ['sign'])
     const signature = await crypto.subtle.sign(algorithm, key, _utf8ToUint8Array(partialToken))
 
@@ -215,24 +227,24 @@ export async function sign(payload: JwtPayload, secret: string, options: JwtSign
 
 /**
  * Verifies the integrity of the token and returns a boolean value.
- * 
+ *
  * @param {string} token The token string generated by `jwt.sign()`.
- * @param {string} secret The string which was used to sign the payload.
+ * @param {string | JsonWebKey} secret The string which was used to sign the payload.
  * @param {JWTVerifyOptions | JWTAlgorithm} options The options object or the algorithm.
  * @throws {Error | string} Throws an error `string` if the token is invalid or an `Error-Object` if there's a validation issue.
- * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`. 
+ * @returns {Promise<boolean>} Returns `true` if signature, `nbf` (if set) and `exp` (if set) are valid, otherwise returns `false`.
  */
-export async function verify(token: string, secret: string, options: JwtVerifyOptions | JwtAlgorithm = { algorithm: 'HS256', throwError: false }): Promise<boolean> {
+export async function verify(token: string, secret: string | JsonWebKey, options: JwtVerifyOptions | JwtAlgorithm = { algorithm: 'HS256', skipValidation: false, throwError: false }): Promise<boolean> {
     if (typeof options === 'string')
         options = { algorithm: options, throwError: false }
 
-    options = { algorithm: 'HS256', throwError: false, ...options }
+    options = { algorithm: 'HS256', skipValidation: false, throwError: false, ...options }
 
     if (typeof token !== 'string')
         throw new Error('token must be a string')
 
-    if (typeof secret !== 'string')
-        throw new Error('secret must be a string')
+    if (typeof secret !== 'string' && typeof secret !== 'object')
+        throw new Error('secret must be a string or a JWK object')
 
     if (typeof options.algorithm !== 'string')
         throw new Error('options.algorithm must be a string')
@@ -249,21 +261,21 @@ export async function verify(token: string, secret: string, options: JwtVerifyOp
 
     const { payload } = decode(token)
 
-    if (!payload) {
+    if (!options.skipValidation && !payload) {
         if (options.throwError)
             throw 'PARSE_ERROR'
 
         return false
     }
 
-    if (payload.nbf && payload.nbf > Math.floor(Date.now() / 1000)) {
+    if (!options.skipValidation && payload.nbf && payload.nbf > Math.floor(Date.now() / 1000)) {
         if (options.throwError)
             throw 'NOT_YET_VALID'
 
         return false
     }
 
-    if (payload.exp && payload.exp <= Math.floor(Date.now() / 1000)) {
+    if (!options.skipValidation && payload.exp && payload.exp <= Math.floor(Date.now() / 1000)) {
         if (options.throwError)
             throw 'EXPIRED'
 
@@ -271,18 +283,24 @@ export async function verify(token: string, secret: string, options: JwtVerifyOp
     }
     let keyFormat = 'raw'
     let keyData
-    if (secret.startsWith('-----BEGIN')) {
+
+    if (typeof secret === 'object') {
+        keyFormat = 'jwk';
+        keyData = secret;
+    } else if (typeof secret === 'string' && secret.startsWith('-----BEGIN')) {
         keyFormat = 'spki'
         keyData = _str2ab(secret.replace(/-----BEGIN.*?-----/g, '').replace(/-----END.*?-----/g, '').replace(/\s/g, ''))
     } else
         keyData = _utf8ToUint8Array(secret)
+
     const key = await crypto.subtle.importKey(keyFormat, keyData, algorithm, false, ['verify'])
+
     return await crypto.subtle.verify(algorithm, key, base64UrlParse(tokenParts[2]), _utf8ToUint8Array(`${tokenParts[0]}.${tokenParts[1]}`))
 }
 
 /**
  * Returns the payload **without** verifying the integrity of the token. Please use `jwt.verify()` first to keep your application secure!
- * 
+ *
  * @param {string} token The token string generated by `jwt.sign()`.
  * @returns {JwtData} Returns an `object` containing `header` and `payload`.
  */