126 lines
3.8 KiB
JavaScript
126 lines
3.8 KiB
JavaScript
var bufferEqual = require('buffer-equal-constant-time');
|
|
var base64url = require('base64url');
|
|
var Buffer = require('safe-buffer').Buffer;
|
|
var crypto = require('crypto');
|
|
var formatEcdsa = require('ecdsa-sig-formatter');
|
|
var util = require('util');
|
|
|
|
var MSG_INVALID_ALGORITHM = '"%s" is not a valid algorithm.\n Supported algorithms are:\n "HS256", "HS384", "HS512", "RS256", "RS384", "RS512" and "none".'
|
|
var MSG_INVALID_SECRET = 'secret must be a string or buffer';
|
|
var MSG_INVALID_VERIFIER_KEY = 'key must be a string or a buffer';
|
|
var MSG_INVALID_SIGNER_KEY = 'key must be a string, a buffer or an object';
|
|
|
|
function typeError(template) {
|
|
var args = [].slice.call(arguments, 1);
|
|
var errMsg = util.format.bind(util, template).apply(null, args);
|
|
return new TypeError(errMsg);
|
|
}
|
|
|
|
function bufferOrString(obj) {
|
|
return Buffer.isBuffer(obj) || typeof obj === 'string';
|
|
}
|
|
|
|
function normalizeInput(thing) {
|
|
if (!bufferOrString(thing))
|
|
thing = JSON.stringify(thing);
|
|
return thing;
|
|
}
|
|
|
|
function createHmacSigner(bits) {
|
|
return function sign(thing, secret) {
|
|
if (!bufferOrString(secret))
|
|
throw typeError(MSG_INVALID_SECRET);
|
|
thing = normalizeInput(thing);
|
|
var hmac = crypto.createHmac('sha' + bits, secret);
|
|
var sig = (hmac.update(thing), hmac.digest('base64'))
|
|
return base64url.fromBase64(sig);
|
|
}
|
|
}
|
|
|
|
function createHmacVerifier(bits) {
|
|
return function verify(thing, signature, secret) {
|
|
var computedSig = createHmacSigner(bits)(thing, secret);
|
|
return bufferEqual(Buffer.from(signature), Buffer.from(computedSig));
|
|
}
|
|
}
|
|
|
|
function createKeySigner(bits) {
|
|
return function sign(thing, privateKey) {
|
|
if (!bufferOrString(privateKey) && !(typeof privateKey === 'object'))
|
|
throw typeError(MSG_INVALID_SIGNER_KEY);
|
|
thing = normalizeInput(thing);
|
|
// Even though we are specifying "RSA" here, this works with ECDSA
|
|
// keys as well.
|
|
var signer = crypto.createSign('RSA-SHA' + bits);
|
|
var sig = (signer.update(thing), signer.sign(privateKey, 'base64'));
|
|
return base64url.fromBase64(sig);
|
|
}
|
|
}
|
|
|
|
function createKeyVerifier(bits) {
|
|
return function verify(thing, signature, publicKey) {
|
|
if (!bufferOrString(publicKey))
|
|
throw typeError(MSG_INVALID_VERIFIER_KEY);
|
|
thing = normalizeInput(thing);
|
|
signature = base64url.toBase64(signature);
|
|
var verifier = crypto.createVerify('RSA-SHA' + bits);
|
|
verifier.update(thing);
|
|
return verifier.verify(publicKey, signature, 'base64');
|
|
}
|
|
}
|
|
|
|
function createECDSASigner(bits) {
|
|
var inner = createKeySigner(bits);
|
|
return function sign() {
|
|
var signature = inner.apply(null, arguments);
|
|
signature = formatEcdsa.derToJose(signature, 'ES' + bits);
|
|
return signature;
|
|
};
|
|
}
|
|
|
|
function createECDSAVerifer(bits) {
|
|
var inner = createKeyVerifier(bits);
|
|
return function verify(thing, signature, publicKey) {
|
|
signature = formatEcdsa.joseToDer(signature, 'ES' + bits).toString('base64');
|
|
var result = inner(thing, signature, publicKey);
|
|
return result;
|
|
};
|
|
}
|
|
|
|
function createNoneSigner() {
|
|
return function sign() {
|
|
return '';
|
|
}
|
|
}
|
|
|
|
function createNoneVerifier() {
|
|
return function verify(thing, signature) {
|
|
return signature === '';
|
|
}
|
|
}
|
|
|
|
module.exports = function jwa(algorithm) {
|
|
var signerFactories = {
|
|
hs: createHmacSigner,
|
|
rs: createKeySigner,
|
|
es: createECDSASigner,
|
|
none: createNoneSigner,
|
|
}
|
|
var verifierFactories = {
|
|
hs: createHmacVerifier,
|
|
rs: createKeyVerifier,
|
|
es: createECDSAVerifer,
|
|
none: createNoneVerifier,
|
|
}
|
|
var match = algorithm.match(/^(RS|ES|HS)(256|384|512)$|^(none)$/i);
|
|
if (!match)
|
|
throw typeError(MSG_INVALID_ALGORITHM, algorithm);
|
|
var algo = (match[1] || match[3]).toLowerCase();
|
|
var bits = match[2];
|
|
|
|
return {
|
|
sign: signerFactories[algo](bits),
|
|
verify: verifierFactories[algo](bits),
|
|
}
|
|
};
|