Comparing version 1.0.2 to 1.1.0
11
index.js
@@ -9,3 +9,4 @@ const bufferEqual = require('buffer-equal-constant-time'); | ||
const MSG_INVALID_SECRET = 'secret must be a string or buffer'; | ||
const MSG_INVALID_KEY = 'key must be a string or buffer'; | ||
const MSG_INVALID_VERIFIER_KEY = 'key must be a string or a buffer'; | ||
const MSG_INVALID_SIGNER_KEY = 'key must be a string, a buffer or an object'; | ||
@@ -47,5 +48,5 @@ function typeError(template) { | ||
function createKeySigner(bits) { | ||
return function sign(thing, privateKey) { | ||
if (!bufferOrString(privateKey)) | ||
throw typeError(MSG_INVALID_KEY); | ||
return function sign(thing, privateKey) { | ||
if (!bufferOrString(privateKey) && !(typeof privateKey === 'object')) | ||
throw typeError(MSG_INVALID_SIGNER_KEY); | ||
thing = normalizeInput(thing); | ||
@@ -63,3 +64,3 @@ // Even though we are specifying "RSA" here, this works with ECDSA | ||
if (!bufferOrString(publicKey)) | ||
throw typeError(MSG_INVALID_KEY); | ||
throw typeError(MSG_INVALID_VERIFIER_KEY); | ||
thing = normalizeInput(thing); | ||
@@ -66,0 +67,0 @@ signature = base64url.toBase64(signature); |
{ | ||
"name": "jwa", | ||
"version": "1.0.2", | ||
"version": "1.1.0", | ||
"description": "JWA implementation (supports all JWS algorithms)", | ||
@@ -15,2 +15,3 @@ "main": "index.js", | ||
"devDependencies": { | ||
"semver": "^4.3.6", | ||
"tap": "~0.3.3" | ||
@@ -17,0 +18,0 @@ }, |
@@ -66,4 +66,4 @@ # node-jwa [![Build Status](https://travis-ci.org/brianloveswords/node-jwa.png?branch=master)](https://travis-ci.org/brianloveswords/node-jwa) | ||
For the HMAC algorithm, `secretOrPrivateKey` should be a string or a | ||
buffer. For ECDSA and RSA, the value should be a string represented a | ||
PEM encoded **private** key. | ||
buffer. For ECDSA and RSA, the value should be a string representing a | ||
PEM encoded **private** key. | ||
@@ -78,3 +78,6 @@ Output [base64url](http://en.wikipedia.org/wiki/Base64#URL_applications) | ||
As of nodejs *v0.11.8*, SPKAC support was introduce. If your nodeJs | ||
version satisfies, then you can pass an object `{ key: '..', passphrase: '...' }` | ||
## jwa#verify(input, signature, secretOrPublicKey) | ||
@@ -81,0 +84,0 @@ |
@@ -5,2 +5,3 @@ const path = require('path'); | ||
const spawn = require('child_process').spawn; | ||
const semver = require('semver'); | ||
const fs = require('fs'); | ||
@@ -10,5 +11,9 @@ const test = require('tap').test; | ||
const nodeVersion = semver.clean(process.version); | ||
// these key files will be generated as part of `make test` | ||
const rsaPrivateKey = fs.readFileSync(__dirname + '/rsa-private.pem').toString(); | ||
const rsaPublicKey = fs.readFileSync(__dirname + '/rsa-public.pem').toString(); | ||
const rsaPrivateKeyWithPassphrase = fs.readFileSync(__dirname + '/rsa-passphrase-private.pem').toString(); | ||
const rsaPublicKeyWithPassphrase = fs.readFileSync(__dirname + '/rsa-passphrase-public.pem').toString(); | ||
const rsaWrongPublicKey = fs.readFileSync(__dirname + '/rsa-wrong-public.pem').toString(); | ||
@@ -57,2 +62,17 @@ const ecdsaPrivateKey = { | ||
// run only on nodejs version >= 0.11.8 | ||
if (semver.gte(nodeVersion, '0.11.8')) { | ||
test('RSA with passphrase signing, verifying', function (t) { | ||
const input = 'test input'; | ||
BIT_DEPTHS.forEach(function (bits) { | ||
const algo = jwa('rs'+bits); | ||
const secret = 'test_pass'; | ||
const sig = algo.sign(input, {key: rsaPrivateKeyWithPassphrase, passphrase: secret}); | ||
t.ok(algo.verify(input, sig, rsaPublicKeyWithPassphrase), 'should verify'); | ||
}); | ||
t.end(); | ||
}); | ||
} | ||
BIT_DEPTHS.forEach(function (bits) { | ||
@@ -59,0 +79,0 @@ test('RS'+bits+': openssl sign -> js verify', function (t) { |
Sorry, the diff of this file is not supported yet
Sorry, the diff of this file is not supported yet
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
New author
Supply chain riskA new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.
Found 1 instance in 1 package
21845
362
146
1
2