{"version":3,"file":"angular-oauth2-oidc-jwks.mjs","sources":["../../../projects/angular-oauth2-oidc-jwks/src/lib/jwks-validation-handler.ts","../../../projects/angular-oauth2-oidc-jwks/src/angular-oauth2-oidc-jwks.ts"],"sourcesContent":["import * as rs from 'jsrsasign';\nimport {\n  AbstractValidationHandler,\n  ValidationParams,\n} from 'angular-oauth2-oidc';\n\n/**\n * Validates the signature of an id_token against one\n * of the keys of an JSON Web Key Set (jwks).\n *\n * This jwks can be provided by the discovery document.\n */\nexport class JwksValidationHandler extends AbstractValidationHandler {\n  /**\n   * Allowed algorithms\n   */\n  allowedAlgorithms: string[] = [\n    'HS256',\n    'HS384',\n    'HS512',\n    'RS256',\n    'RS384',\n    'RS512',\n    'ES256',\n    'ES384',\n    'PS256',\n    'PS384',\n    'PS512',\n  ];\n\n  /**\n   * Time period in seconds the timestamp in the signature can\n   * differ from the current time.\n   */\n  gracePeriodInSec = 600;\n\n  validateSignature(params: ValidationParams, retry = false): Promise<any> {\n    if (!params.idToken) throw new Error('Parameter idToken expected!');\n    if (!params.idTokenHeader)\n      throw new Error('Parameter idTokenHandler expected.');\n    if (!params.jwks) throw new Error('Parameter jwks expected!');\n\n    if (\n      !params.jwks['keys'] ||\n      !Array.isArray(params.jwks['keys']) ||\n      params.jwks['keys'].length === 0\n    ) {\n      throw new Error('Array keys in jwks missing!');\n    }\n\n    // console.debug('validateSignature: retry', retry);\n\n    let kid: string = params.idTokenHeader['kid'];\n    let keys: object[] = params.jwks['keys'];\n    let key: object;\n\n    let alg = params.idTokenHeader['alg'];\n\n    if (kid) {\n      key = keys.find((k) => k['kid'] === kid /* && k['use'] === 'sig' */);\n    } else {\n      let kty = this.alg2kty(alg);\n      let matchingKeys = keys.filter(\n        (k) => k['kty'] === kty && k['use'] === 'sig'\n      );\n\n      /*\n            if (matchingKeys.length == 0) {\n                let error = 'No matching key found.';\n                console.error(error);\n                return Promise.reject(error);\n            }*/\n      if (matchingKeys.length > 1) {\n        let error =\n          'More than one matching key found. Please specify a kid in the id_token header.';\n        console.error(error);\n        return Promise.reject(error);\n      } else if (matchingKeys.length === 1) {\n        key = matchingKeys[0];\n      }\n    }\n\n    if (!key && !retry && params.loadKeys) {\n      return params\n        .loadKeys()\n        .then((loadedKeys) => (params.jwks = loadedKeys))\n        .then((_) => this.validateSignature(params, true));\n    }\n\n    if (!key && retry && !kid) {\n      let error = 'No matching key found.';\n      console.error(error);\n      return Promise.reject(error);\n    }\n\n    if (!key && retry && kid) {\n      let error =\n        'expected key not found in property jwks. ' +\n        'This property is most likely loaded with the ' +\n        'discovery document. ' +\n        'Expected key id (kid): ' +\n        kid;\n\n      console.error(error);\n      return Promise.reject(error);\n    }\n\n    let keyObj = rs.KEYUTIL.getKey(key);\n    let validationOptions = {\n      alg: this.allowedAlgorithms,\n      gracePeriod: this.gracePeriodInSec,\n    };\n    let isValid = rs.KJUR.jws.JWS.verifyJWT(\n      params.idToken,\n      keyObj,\n      validationOptions\n    );\n\n    if (isValid) {\n      return Promise.resolve();\n    } else {\n      return Promise.reject('Signature not valid');\n    }\n  }\n\n  private alg2kty(alg: string) {\n    switch (alg.charAt(0)) {\n      case 'R':\n        return 'RSA';\n      case 'E':\n        return 'EC';\n      default:\n        throw new Error('Cannot infer kty from alg: ' + alg);\n    }\n  }\n\n  calcHash(valueToHash: string, algorithm: string): Promise<string> {\n    let hashAlg = new rs.KJUR.crypto.MessageDigest({ alg: algorithm });\n    let result = hashAlg.digestString(valueToHash);\n    let byteArrayAsString = this.toByteArrayAsString(result);\n    return Promise.resolve(byteArrayAsString);\n  }\n\n  toByteArrayAsString(hexString: string) {\n    let result = '';\n    for (let i = 0; i < hexString.length; i += 2) {\n      let hexDigit = hexString.charAt(i) + hexString.charAt(i + 1);\n      let num = parseInt(hexDigit, 16);\n      result += String.fromCharCode(num);\n    }\n    return result;\n  }\n}\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":";;;AAMA;;;;;AAKG;AACG,MAAO,qBAAsB,SAAQ,yBAAyB,CAAA;AAApE,IAAA,WAAA,GAAA;;AACE;;AAEG;AACH,QAAA,IAAA,CAAA,iBAAiB,GAAa;YAC5B,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;SACR;AAED;;;AAGG;QACH,IAAgB,CAAA,gBAAA,GAAG,GAAG;;AAEtB,IAAA,iBAAiB,CAAC,MAAwB,EAAE,KAAK,GAAG,KAAK,EAAA;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO;AAAE,YAAA,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,aAAa;AACvB,YAAA,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI;AAAE,YAAA,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC;AAE7D,QAAA,IACE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACpB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAChC;AACA,YAAA,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC;;;QAKhD,IAAI,GAAG,GAAW,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC7C,IAAI,IAAI,GAAa,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;AACxC,QAAA,IAAI,GAAW;QAEf,IAAI,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAErC,IAAI,GAAG,EAAE;AACP,YAAA,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,6BAA6B;;aAC/D;YACL,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YAC3B,IAAI,YAAY,GAAG,IAAI,CAAC,MAAM,CAC5B,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,CAC9C;AAED;;;;;AAKS;AACT,YAAA,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC3B,IAAI,KAAK,GACP,gFAAgF;AAClF,gBAAA,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AACpB,gBAAA,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;AACvB,iBAAA,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;AACpC,gBAAA,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC;;;QAIzB,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE;AACrC,YAAA,OAAO;AACJ,iBAAA,QAAQ;AACR,iBAAA,IAAI,CAAC,CAAC,UAAU,MAAM,MAAM,CAAC,IAAI,GAAG,UAAU,CAAC;AAC/C,iBAAA,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;;QAGtD,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE;YACzB,IAAI,KAAK,GAAG,wBAAwB;AACpC,YAAA,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AACpB,YAAA,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;AAG9B,QAAA,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE;YACxB,IAAI,KAAK,GACP,2CAA2C;gBAC3C,+CAA+C;gBAC/C,sBAAsB;gBACtB,yBAAyB;AACzB,gBAAA,GAAG;AAEL,YAAA,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AACpB,YAAA,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;QAG9B,IAAI,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;AACnC,QAAA,IAAI,iBAAiB,GAAG;YACtB,GAAG,EAAE,IAAI,CAAC,iBAAiB;YAC3B,WAAW,EAAE,IAAI,CAAC,gBAAgB;SACnC;QACD,IAAI,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CACrC,MAAM,CAAC,OAAO,EACd,MAAM,EACN,iBAAiB,CAClB;QAED,IAAI,OAAO,EAAE;AACX,YAAA,OAAO,OAAO,CAAC,OAAO,EAAE;;aACnB;AACL,YAAA,OAAO,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;;;AAIxC,IAAA,OAAO,CAAC,GAAW,EAAA;AACzB,QAAA,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACnB,YAAA,KAAK,GAAG;AACN,gBAAA,OAAO,KAAK;AACd,YAAA,KAAK,GAAG;AACN,gBAAA,OAAO,IAAI;AACb,YAAA;AACE,gBAAA,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,GAAG,CAAC;;;IAI1D,QAAQ,CAAC,WAAmB,EAAE,SAAiB,EAAA;AAC7C,QAAA,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QAClE,IAAI,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,WAAW,CAAC;QAC9C,IAAI,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;AACxD,QAAA,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;;AAG3C,IAAA,mBAAmB,CAAC,SAAiB,EAAA;QACnC,IAAI,MAAM,GAAG,EAAE;AACf,QAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE;AAC5C,YAAA,IAAI,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5D,IAAI,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChC,YAAA,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC;;AAEpC,QAAA,OAAO,MAAM;;AAEhB;;ACxJD;;AAEG;;;;"}