jsontokens - npm Package Compare versions

Comparing version 3.0.0 to 3.1.0

lib/cryptoClients/index.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.cryptoClients = exports.SECP256K1Client = void 0;
 const secp256k1_1 = require("./secp256k1");
-exports.SECP256K1Client = secp256k1_1.SECP256K1Client;
+Object.defineProperty(exports, "SECP256K1Client", { enumerable: true, get: function () { return secp256k1_1.SECP256K1Client; } });
 const cryptoClients = {
-    ES256K: secp256k1_1.SECP256K1Client
+    ES256K: secp256k1_1.SECP256K1Client,
 };
 exports.cryptoClients = cryptoClients;
 //# sourceMappingURL=index.js.map

lib/cryptoClients/secp256k1.d.ts

 /// <reference types="node" />
-import { ec as EC, BNInput } from 'elliptic';
+/// <reference types="node" />
 export declare class SECP256K1Client {
-    static ec: EC;
     static algorithmName: string;
-    constructor();
-    static loadPrivateKey(rawPrivateKey: string): EC.KeyPair;
-    static loadPublicKey(rawPublicKey: string | Buffer): EC.KeyPair;
     static derivePublicKey(privateKey: string, compressed?: boolean): string;
-    static signHash(signingInputHash: string | Buffer, rawPrivateKey: string, format?: string): string;
+    static signHash(signingInputHash: string | Buffer, privateKey: string, format?: string): string;
     static loadSignature(joseSignature: string | Buffer): Buffer;
-    static verifyHash(signingInputHash: BNInput, derSignatureBuffer: string | Buffer, rawPublicKey: string | Buffer): boolean;
+    static verifyHash(signingInputHash: Buffer, derSignatureBuffer: string | Buffer, publicKey: string | Buffer): boolean;
 }

lib/cryptoClients/secp256k1.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const elliptic_1 = require("elliptic");
+exports.SECP256K1Client = void 0;
+const hmac_1 = require("@noble/hashes/hmac");
+const sha256_1 = require("@noble/hashes/sha256");
+const secp = require("@noble/secp256k1");
 const ecdsa_sig_formatter_1 = require("ecdsa-sig-formatter");
 const errors_1 = require("../errors");
+// required to use noble secp https://github.com/paulmillr/noble-secp256k1
+secp.utils.hmacSha256Sync = (key, ...msgs) => {
+    const h = hmac_1.hmac.create(sha256_1.sha256, key);
+    msgs.forEach(msg => h.update(msg));
+    return h.digest();
+};
 class SECP256K1Client {
-    constructor() {
-    }
-    static loadPrivateKey(rawPrivateKey) {
-        if (rawPrivateKey.length === 66) {
-            rawPrivateKey = rawPrivateKey.slice(0, 64);
-        }
-        return SECP256K1Client.ec.keyFromPrivate(rawPrivateKey);
-    }
-    static loadPublicKey(rawPublicKey) {
-        return SECP256K1Client.ec.keyFromPublic(rawPublicKey, 'hex');
-    }
     static derivePublicKey(privateKey, compressed = true) {
-        if (typeof privateKey !== 'string') {
-            throw Error('private key must be a string');
-        }
-        if (!(/^[0-9A-F]+$/i.test(privateKey))) {
-            throw Error('private key must be a hex string');
-        }
-        if (privateKey.length == 66) {
+        if (privateKey.length === 66) {
             privateKey = privateKey.slice(0, 64);
         }
-        else if (privateKey.length <= 64) {
-            // do nothing
+        if (privateKey.length < 64) {
+            // backward compatibly accept too short private keys
+            privateKey = privateKey.padStart(64, '0');
         }
-        else {
-            throw Error('private key must be 66 characters or less');
-        }
-        const keypair = SECP256K1Client.ec.keyFromPrivate(privateKey);
-        return keypair.getPublic(compressed, 'hex');
+        return Buffer.from(secp.getPublicKey(privateKey, compressed)).toString('hex');
     }
-    static signHash(signingInputHash, rawPrivateKey, format = 'jose') {
+    static signHash(signingInputHash, privateKey, format = 'jose') {
         // make sure the required parameters are provided
-        if (!(signingInputHash && rawPrivateKey)) {
+        if (!signingInputHash || !privateKey) {
             throw new errors_1.MissingParametersError('a signing input hash and private key are all required');
         }
-        // prepare the private key
-        const privateKeyObject = SECP256K1Client.loadPrivateKey(rawPrivateKey);
-        // calculate the signature
-        const signatureObject = privateKeyObject.sign(signingInputHash);
-        const derSignature = Buffer.from(signatureObject.toDER());
-        if (format === 'der') {
+        const derSignature = Buffer.from(secp.signSync(signingInputHash, privateKey, { der: true, canonical: false }));
+        if (format === 'der')
             return derSignature.toString('hex');
-        }
-        else if (format === 'jose') {
-            // return the JOSE-formatted signature
-            return ecdsa_sig_formatter_1.derToJose(derSignature, 'ES256');
-        }
-        else {
-            throw Error('Invalid signature format');
-        }
+        if (format === 'jose')
+            return (0, ecdsa_sig_formatter_1.derToJose)(derSignature, 'ES256');
+        throw Error('Invalid signature format');
     }
     static loadSignature(joseSignature) {
         // create and return the DER-formatted signature buffer
-        return ecdsa_sig_formatter_1.joseToDer(joseSignature, 'ES256');
+        return (0, ecdsa_sig_formatter_1.joseToDer)(joseSignature, 'ES256');
     }
-    static verifyHash(signingInputHash, derSignatureBuffer, rawPublicKey) {
+    static verifyHash(signingInputHash, derSignatureBuffer, publicKey) {
         // make sure the required parameters are provided
-        if (!(signingInputHash && derSignatureBuffer && rawPublicKey)) {
+        if (!signingInputHash || !derSignatureBuffer || !publicKey) {
             throw new errors_1.MissingParametersError('a signing input hash, der signature, and public key are all required');
         }
-        // prepare the public key
-        const publicKeyObject = SECP256K1Client.loadPublicKey(rawPublicKey);
-        // verify the token
-        return publicKeyObject.verify(signingInputHash, derSignatureBuffer);
+        return secp.verify(derSignatureBuffer, signingInputHash, publicKey, { strict: false });
     }
 }
 exports.SECP256K1Client = SECP256K1Client;
-SECP256K1Client.ec = new elliptic_1.ec('secp256k1');
 SECP256K1Client.algorithmName = 'ES256K';
 //# sourceMappingURL=secp256k1.js.map

lib/cryptoClients/sha256.d.ts

 /// <reference types="node" />
+/// <reference types="node" />
 export declare function hashSha256(input: Buffer | string): Buffer;
 export declare function hashSha256Async(input: Buffer | string): Promise<Buffer>;

lib/cryptoClients/sha256.js

@@ -12,6 +12,6 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const sha_js_1 = require("sha.js");
+exports.hashSha256Async = exports.hashSha256 = void 0;
+const sha256_1 = require("@noble/hashes/sha256");
 function hashSha256(input) {
-    const hashFunction = new sha_js_1.sha256();
-    return hashFunction.update(input).digest();
+    return Buffer.from((0, sha256_1.sha256)(input));
 }
@@ -18,0 +18,0 @@ exports.hashSha256 = hashSha256;

lib/decode.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeToken = void 0;
 const base64url_1 = require("base64url");
@@ -15,3 +16,3 @@ function decodeToken(token) {
             payload: payload,
-            signature: signature
+            signature: signature,
         };
@@ -35,3 +36,3 @@ }
             payload: JSON.parse(payload),
-            signature: token.signature
+            signature: token.signature,
         };
@@ -38,0 +39,0 @@ }

lib/errors.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidTokenError = exports.MissingParametersError = void 0;
 class MissingParametersError extends Error {
@@ -7,3 +8,3 @@ constructor(message) {
         this.name = 'MissingParametersError';
-        this.message = (message || '');
+        this.message = message || '';
     }
@@ -16,3 +17,3 @@ }
         this.name = 'InvalidTokenError';
-        this.message = (message || '');
+        this.message = message || '';
     }
@@ -19,0 +20,0 @@ }

lib/index.js

 "use strict";
-function __export(m) {
-    for (var p in m) if (!exports.hasOwnProperty(p)) exports[p] = m[p];
-}
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-__export(require("./signer"));
-__export(require("./verifier"));
-__export(require("./decode"));
-__export(require("./errors"));
-__export(require("./cryptoClients"));
+__exportStar(require("./signer"), exports);
+__exportStar(require("./verifier"), exports);
+__exportStar(require("./decode"), exports);
+__exportStar(require("./errors"), exports);
+__exportStar(require("./cryptoClients"), exports);
 //# sourceMappingURL=index.js.map

lib/signer.d.ts

 /// <reference types="node" />
+/// <reference types="node" />
 import { SECP256K1Client } from './cryptoClients';
@@ -3,0 +4,0 @@ import { Json } from './decode';

lib/signer.js

@@ -12,2 +12,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenSigner = exports.createUnsecuredToken = void 0;
 const base64url_1 = require("base64url");
@@ -52,4 +53,3 @@ const cryptoClients_1 = require("./cryptoClients");
     header(header = {}) {
-        const defaultHeader = { typ: this.tokenType,
-            alg: this.cryptoClient.algorithmName };
+        const defaultHeader = { typ: this.tokenType, alg: this.cryptoClient.algorithmName };
         return Object.assign({}, defaultHeader, header);
@@ -62,3 +62,3 @@ }
         const signingInput = createSigningInput(payload, header);
-        const signingInputHash = sha256_1.hashSha256(signingInput);
+        const signingInputHash = (0, sha256_1.hashSha256)(signingInput);
         return this.createWithSignedHash(payload, expanded, header, signingInput, signingInputHash);
@@ -72,3 +72,3 @@ }
             const signingInput = createSigningInput(payload, header);
-            const signingInputHash = yield sha256_1.hashSha256Async(signingInput);
+            const signingInputHash = yield (0, sha256_1.hashSha256Async)(signingInput);
             return this.createWithSignedHash(payload, expanded, header, signingInput, signingInputHash);
@@ -82,9 +82,5 @@ });
             const signedToken = {
-                'header': [
-                    base64url_1.default.encode(JSON.stringify(header))
-                ],
-                'payload': JSON.stringify(payload),
-                'signature': [
-                    signature
-                ]
+                header: [base64url_1.default.encode(JSON.stringify(header))],
+                payload: JSON.stringify(payload),
+                signature: [signature],
             };
@@ -91,0 +87,0 @@ return signedToken;

lib/verifier.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenVerifier = void 0;
 const base64url_1 = require("base64url");
@@ -31,3 +32,3 @@ const cryptoClients_1 = require("./cryptoClients");
         else {
-            false;
+            return false;
         }
@@ -58,6 +59,6 @@ }
         if (async) {
-            return sha256_1.hashSha256Async(signingInput).then(signingInputHash => performVerify(signingInputHash));
+            return (0, sha256_1.hashSha256Async)(signingInput).then(signingInputHash => performVerify(signingInputHash));
         }
         else {
-            const signingInputHash = sha256_1.hashSha256(signingInput);
+            const signingInputHash = (0, sha256_1.hashSha256)(signingInput);
             return performVerify(signingInputHash);
@@ -67,6 +68,3 @@ }
     verifyExpanded(token, async) {
-        const signingInput = [
-            token['header'].join('.'),
-            base64url_1.default.encode(token['payload'])
-        ].join('.');
+        const signingInput = [token['header'].join('.'), base64url_1.default.encode(token['payload'])].join('.');
         let verified = true;
@@ -84,6 +82,6 @@ const performVerify = (signingInputHash) => {
         if (async) {
-            return sha256_1.hashSha256Async(signingInput).then(signingInputHash => performVerify(signingInputHash));
+            return (0, sha256_1.hashSha256Async)(signingInput).then(signingInputHash => performVerify(signingInputHash));
         }
         else {
-            const signingInputHash = sha256_1.hashSha256(signingInput);
+            const signingInputHash = (0, sha256_1.hashSha256)(signingInput);
             return performVerify(signingInputHash);
@@ -90,0 +88,0 @@ }

package.json

 {
   "name": "jsontokens",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "node.js library for encoding, decoding, and verifying JSON Web Tokens (JWTs)",
@@ -11,3 +11,3 @@ "main": "lib/index.js",
   },
-  "prettier": "@blockstack/prettier-config",
+  "prettier": "@stacks/prettier-config",
   "scripts": {
@@ -20,7 +20,8 @@ "webpack": "rimraf lib dist && webpack --mode=production",
     "codecovUpload": "codecov",
-    "prepublishOnly": "npm run lint && npm run test && npm run webpack && npm run build"
+    "prepublishOnly": "npm run lint && npm run test && npm run webpack && npm run build",
+    "prepare": "husky install .github/husky"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/blockstack/jsontokens-js.git"
+    "url": "git+https://github.com/stacks-network/jsontokens-js.git"
   },
@@ -46,39 +47,86 @@ "keywords": [
   "bugs": {
-    "url": "https://github.com/blockstack/jsontokens-js/issues"
+    "url": "https://github.com/stacks-network/jsontokens-js/issues"
   },
-  "homepage": "https://github.com/blockstack/jsontokens-js#readme",
+  "homepage": "https://github.com/stacks-network/jsontokens-js#readme",
+  "dependencies": {
+    "@noble/hashes": "^1.0.0",
+    "@noble/secp256k1": "^1.5.5",
+    "base64url": "^3.0.1",
+    "ecdsa-sig-formatter": "^1.0.11"
+  },
   "devDependencies": {
-    "@babel/core": "^7.7.5",
-    "@babel/preset-env": "^7.7.5",
-    "@blockstack/prettier-config": "0.0.4",
+    "@babel/core": "^7.17.10",
+    "@babel/preset-env": "^7.17.10",
+    "@commitlint/cli": "^16.2.4",
+    "@commitlint/config-conventional": "^16.2.4",
     "@peculiar/webcrypto": "^1.0.21",
-    "@types/jest": "^24.0.23",
+    "@stacks/eslint-config": "^1.2.0",
+    "@stacks/prettier-config": "^0.0.10",
+    "@types/jest": "^27.5.0",
     "@types/node": "^12.12.7",
-    "@types/sha.js": "^2.4.0",
-    "@typescript-eslint/eslint-plugin": "^2.7.0",
-    "@typescript-eslint/parser": "^2.7.0",
-    "babel-loader": "^8.0.6",
-    "codecov": "^3.6.1",
+    "@typescript-eslint/eslint-plugin": "^5.22.0",
+    "@typescript-eslint/parser": "^5.22.0",
+    "babel-loader": "^8.2.5",
+    "buffer": "^6.0.3",
+    "codecov": "^3.8.3",
     "cross-env": "^6.0.3",
-    "eslint": "^6.6.0",
-    "eslint-plugin-jest": "^23.0.3",
-    "jest": "^24.9.0",
-    "prettier": "^1.19.1",
+    "eslint": "^8.15.0",
+    "eslint-import-resolver-typescript": "^2.7.1",
+    "eslint-plugin-jest": "^26.1.5",
+    "eslint-plugin-prettier": "^4.0.0",
+    "husky": "^8.0.1",
+    "jest": "^28.1.0",
+    "prettier": "^2.6.2",
     "rimraf": "^3.0.0",
     "source-map-support": "^0.5.16",
-    "ts-jest": "^24.1.0",
-    "ts-loader": "^6.2.1",
-    "ts-node": "^8.5.0",
-    "typescript": "^3.7.2",
-    "webpack": "^4.41.2",
-    "webpack-cli": "^3.3.10"
+    "ts-jest": "^28.0.2",
+    "ts-loader": "^9.3.0",
+    "ts-node": "^10.7.0",
+    "typescript": "^4.6.4",
+    "webpack": "^5.72.0",
+    "webpack-cli": "^4.9.2"
   },
-  "dependencies": {
-    "@types/elliptic": "^6.4.9",
-    "asn1.js": "^5.0.1",
-    "base64url": "^3.0.1",
-    "ecdsa-sig-formatter": "^1.0.11",
-    "elliptic": "^6.4.1",
-    "sha.js": "^2.4.11"
+  "files": [
+    "dist",
+    "lib"
+  ],
+  "commitlint": {
+    "extends": [
+      "@commitlint/config-conventional"
+    ]
+  },
+  "release": {
+    "branches": "master",
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      [
+        "@semantic-release/exec",
+        {
+          "prepareCmd": "npm ci"
+        }
+      ],
+      [
+        "@semantic-release/npm",
+        {
+          "npmPublish": true
+        }
+      ],
+      [
+        "@semantic-release/changelog",
+        {
+          "changelogTitle": "# Changelog\nAll notable changes to the project will be documented in this file."
+        }
+      ],
+      [
+        "@semantic-release/git",
+        {
+          "message": "chore: release ${nextRelease.version}",
+          "assets": [
+            "**/*.{json,md}"
+          ]
+        }
+      ]
+    ]
   }
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Unidentified License

License

(Experimental) Something that seems like a license was found, but its contents could not be matched with a known license.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Dependency count

4

decreased by-33.33%

Worsened metrics

Total package byte prevSize

134638

decreased by-45.31%

Dev dependency count

30

increased by25%

Number of package files

29

decreased by-40.82%

Number of low license alerts

1

increased byInfinity%

License quality

80

decreased by-20%

Lines of code

455

decreased by-65.89%

Number of medium supply chain risk alerts

2

increased byInfinity%

Dependency changes

• + Added@noble/hashes@^1.0.0

• + Added@noble/secp256k1@^1.5.5

• + Added@noble/hashes@1.6.1(transitive)

• + Added@noble/secp256k1@1.7.1(transitive)

• - Removed@types/elliptic@^6.4.9

• - Removedasn1.js@^5.0.1

• - Removedelliptic@^6.4.1

• - Removedsha.js@^2.4.11

• - Removed@types/bn.js@5.1.6(transitive)

• - Removed@types/elliptic@6.4.18(transitive)

• - Removed@types/node@22.10.1(transitive)

• - Removedasn1.js@5.4.1(transitive)

• - Removedbn.js@4.12.1(transitive)

• - Removedbrorand@1.1.0(transitive)

• - Removedelliptic@6.6.1(transitive)

• - Removedhash.js@1.1.7(transitive)

• - Removedhmac-drbg@1.0.1(transitive)

• - Removedinherits@2.0.4(transitive)

• - Removedminimalistic-assert@1.0.1(transitive)

• - Removedminimalistic-crypto-utils@1.0.1(transitive)

• - Removedsafer-buffer@2.1.2(transitive)

• - Removedsha.js@2.4.11(transitive)

• - Removedundici-types@6.20.0(transitive)