jwa - npm Package Compare versions

Comparing version 1.0.2 to 1.1.0

index.js

@@ -9,3 +9,4 @@ const bufferEqual = require('buffer-equal-constant-time');
 const MSG_INVALID_SECRET = 'secret must be a string or buffer';
-const MSG_INVALID_KEY = 'key must be a string or buffer';
+const MSG_INVALID_VERIFIER_KEY = 'key must be a string or a buffer';
+const MSG_INVALID_SIGNER_KEY = 'key must be a string, a buffer or an object';
 
@@ -47,5 +48,5 @@ function typeError(template) {
 function createKeySigner(bits) {
-  return function sign(thing, privateKey) {
-    if (!bufferOrString(privateKey))
-      throw typeError(MSG_INVALID_KEY);
+ return function sign(thing, privateKey) {
+    if (!bufferOrString(privateKey) && !(typeof privateKey === 'object'))
+      throw typeError(MSG_INVALID_SIGNER_KEY);
     thing = normalizeInput(thing);
@@ -63,3 +64,3 @@ // Even though we are specifying "RSA" here, this works with ECDSA
     if (!bufferOrString(publicKey))
-      throw typeError(MSG_INVALID_KEY);
+      throw typeError(MSG_INVALID_VERIFIER_KEY);
     thing = normalizeInput(thing);
@@ -66,0 +67,0 @@ signature = base64url.toBase64(signature);

package.json

 {
   "name": "jwa",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "JWA implementation (supports all JWS algorithms)",
@@ -15,2 +15,3 @@ "main": "index.js",
   "devDependencies": {
+    "semver": "^4.3.6",
     "tap": "~0.3.3"
@@ -17,0 +18,0 @@ },

README.md

@@ -66,4 +66,4 @@ # node-jwa [![Build Status](https://travis-ci.org/brianloveswords/node-jwa.png?branch=master)](https://travis-ci.org/brianloveswords/node-jwa)
 For the HMAC algorithm, `secretOrPrivateKey` should be a string or a
-buffer. For ECDSA and RSA, the value should be a string represented a
-PEM encoded **private** key.
+buffer. For ECDSA and RSA, the value should be a string representing a
+PEM encoded **private** key. 
 
@@ -78,3 +78,6 @@ Output [base64url](http://en.wikipedia.org/wiki/Base64#URL_applications)
 
+As of nodejs *v0.11.8*, SPKAC support was introduce. If your nodeJs
+version satisfies, then you can pass an object `{ key: '..', passphrase: '...' }`
 
+
 ## jwa#verify(input, signature, secretOrPublicKey)
@@ -81,0 +84,0 @@

test/jwa.test.js

@@ -5,2 +5,3 @@ const path = require('path');
 const spawn = require('child_process').spawn;
+const semver = require('semver');
 const fs = require('fs');
@@ -10,5 +11,9 @@ const test = require('tap').test;
 
+const nodeVersion = semver.clean(process.version);
+
 // these key files will be generated as part of `make test`
 const rsaPrivateKey = fs.readFileSync(__dirname + '/rsa-private.pem').toString();
 const rsaPublicKey = fs.readFileSync(__dirname + '/rsa-public.pem').toString();
+const rsaPrivateKeyWithPassphrase = fs.readFileSync(__dirname + '/rsa-passphrase-private.pem').toString();
+const rsaPublicKeyWithPassphrase = fs.readFileSync(__dirname + '/rsa-passphrase-public.pem').toString();
 const rsaWrongPublicKey = fs.readFileSync(__dirname + '/rsa-wrong-public.pem').toString();
@@ -57,2 +62,17 @@ const ecdsaPrivateKey = {
 
+// run only on nodejs version >= 0.11.8 
+if (semver.gte(nodeVersion, '0.11.8')) {
+  test('RSA with passphrase signing, verifying', function (t) {
+  const input = 'test input';
+  BIT_DEPTHS.forEach(function (bits) {
+    const algo = jwa('rs'+bits);
+    const secret = 'test_pass';
+    const sig = algo.sign(input, {key: rsaPrivateKeyWithPassphrase, passphrase: secret});
+    t.ok(algo.verify(input, sig, rsaPublicKeyWithPassphrase), 'should verify');
+  });
+  t.end();
+  });
+}
+
+
 BIT_DEPTHS.forEach(function (bits) {
@@ -59,0 +79,0 @@ test('RS'+bits+': openssl sign -> js verify', function (t) {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

21845

increased by6.36%

Lines of code

362

increased by5.23%

Number of lines in readme file

146

increased by2.1%

Number of medium supply chain risk alerts

1

decreased by-50%

Worsened metrics

Dev dependency count

2

increased by100%

No dependency changes