packages/@git/url_9ef654c66d34ab8f5527/0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug
OpenID Connect login application · Dependency source and specification
This is the exact dependency version used by this example.
Code
// Generated by aug spec. This is a copy of the installed dependency source.
// aug-spec: "jose.aug.md" explains this file. Read it before changes; refresh with aug spec.
import Crypto from contracts
import parse from "https://github.com/GreenPandaStudios/augscript/src/stdlib/json#v0.19.0"
/** A failed JOSE validation reveals no unverified claims. */
JwtError() implements Error:
pass
/** This profile accepts only RS256, a configured key id, and an explicit token type. */
record JwtHeader(string alg, string kid, string typ)
/** Public signing-key metadata in RFC 7517 / RFC 7518 form. */
record RsaJwk(string kty, string kid, string alg, string use, string n, string e)
record RsaJwks(List<RsaJwk> keys)
/** Export public parameters. Private key material never enters the JSON document. */
rsaJwk(RsaPublicKey publicKey, string kid, resolve Crypto crypto):
(modulus, exponent) = crypto.exportRsa(publicKey)
return RsaJwk(
kty="RSA",
kid=kid,
alg="RS256",
use="sig",
n=modulus.base64url(),
e=exponent.base64url()
)
/** Import only an RSA signing key for RS256. The transport caller selects the trusted JWKS URL. */
importJwk(RsaJwk jwk, resolve Crypto crypto):
if jwk.kty != "RSA" or jwk.alg != "RS256" or jwk.use != "sig":
throw JwtError()
try:
modulus = crypto.decodeBase64url(input=jwk.n)
exponent = crypto.decodeBase64url(input=jwk.e)
return crypto.importRsa(modulus, exponent)
catch CryptoError error:
throw JwtError()
/** Sign immutable JSON with an explicit key id and token type. Claims are validated by the protocol that consumes the token. */
signJwt(RsaPrivateKey key, Json claims, string kid, string tokenType, resolve Crypto crypto):
try:
header = Json(value=JwtHeader(alg="RS256", kid=kid, typ=tokenType)).stringify()
payload = claims.stringify()
signing = header.bytes().base64url() + "." + payload.bytes().base64url()
signature = crypto.signRsa(key=key, input=signing.bytes())
return signing + "." + signature.base64url()
catch CryptoError error:
throw JwtError()
catch JsonError error:
throw JwtError()
/** Verify the signature and configured algorithm, key id, and type before exposing the JSON payload. Never follows token-supplied URLs. */
verifyJwt(string token, RsaPublicKey publicKey, string kid, string tokenType, resolve Crypto crypto):
if token.length() > 16384:
throw JwtError()
parts = token.split(separator=".")
if parts.length() != 3:
throw JwtError()
try:
first = parts.get(index=0)
second = parts.get(index=1)
third = parts.get(index=2)
header = parse(input=crypto.decodeBase64url(input=first).text()).decode<JwtHeader>()
if header.alg != "RS256" or header.kid != kid or header.typ != tokenType:
throw JwtError()
signature = crypto.decodeBase64url(input=third)
if not crypto.verifyRsa(
publicKey=publicKey,
input=(first + "." + second).bytes(),
signature=signature
):
throw JwtError()
return parse(input=crypto.decodeBase64url(input=second).text())
catch CryptoError error:
throw JwtError()
catch ConversionError error:
throw JwtError()
catch JsonError error:
throw JwtError()
catch IndexError error:
throw JwtError()// Generated by aug spec. This is a copy of the installed dependency source.
// aug-spec: "jose.aug.md" explains this file. Read it before changes; refresh with aug spec.
import Crypto from contracts
import parse from "https://github.com/GreenPandaStudios/augscript/src/stdlib/json#v0.19.0"
/** A failed JOSE validation reveals no unverified claims. */
JwtError() implements Error {
pass
}
/** This profile accepts only RS256, a configured key id, and an explicit token type. */
record JwtHeader(string alg, string kid, string typ)
/** Public signing-key metadata in RFC 7517 / RFC 7518 form. */
record RsaJwk(string kty, string kid, string alg, string use, string n, string e)
record RsaJwks(List<RsaJwk> keys)
/** Export public parameters. Private key material never enters the JSON document. */
rsaJwk(RsaPublicKey publicKey, string kid, resolve Crypto crypto) {
(modulus, exponent) = crypto.exportRsa(publicKey)
return RsaJwk(
kty="RSA",
kid=kid,
alg="RS256",
use="sig",
n=modulus.base64url(),
e=exponent.base64url()
)
}
/** Import only an RSA signing key for RS256. The transport caller selects the trusted JWKS URL. */
importJwk(RsaJwk jwk, resolve Crypto crypto) {
if jwk.kty != "RSA" or jwk.alg != "RS256" or jwk.use != "sig" {
throw JwtError()
}
try {
modulus = crypto.decodeBase64url(input=jwk.n)
exponent = crypto.decodeBase64url(input=jwk.e)
return crypto.importRsa(modulus, exponent)
}
catch CryptoError error {
throw JwtError()
}
}
/** Sign immutable JSON with an explicit key id and token type. Claims are validated by the protocol that consumes the token. */
signJwt(RsaPrivateKey key, Json claims, string kid, string tokenType, resolve Crypto crypto) {
try {
header = Json(value=JwtHeader(alg="RS256", kid=kid, typ=tokenType)).stringify()
payload = claims.stringify()
signing = header.bytes().base64url() + "." + payload.bytes().base64url()
signature = crypto.signRsa(key=key, input=signing.bytes())
return signing + "." + signature.base64url()
}
catch CryptoError error {
throw JwtError()
}
catch JsonError error {
throw JwtError()
}
}
/** Verify the signature and configured algorithm, key id, and type before exposing the JSON payload. Never follows token-supplied URLs. */
verifyJwt(string token, RsaPublicKey publicKey, string kid, string tokenType, resolve Crypto crypto) {
if token.length() > 16384 {
throw JwtError()
}
parts = token.split(separator=".")
if parts.length() != 3 {
throw JwtError()
}
try {
first = parts.get(index=0)
second = parts.get(index=1)
third = parts.get(index=2)
header = parse(input=crypto.decodeBase64url(input=first).text()).decode<JwtHeader>()
if header.alg != "RS256" or header.kid != kid or header.typ != tokenType {
throw JwtError()
}
signature = crypto.decodeBase64url(input=third)
if not crypto.verifyRsa(
publicKey=publicKey,
input=(first + "." + second).bytes(),
signature=signature
) {
throw JwtError()
}
return parse(input=crypto.decodeBase64url(input=second).text())
}
catch CryptoError error {
throw JwtError()
}
catch ConversionError error {
throw JwtError()
}
catch JsonError error {
throw JwtError()
}
catch IndexError error {
throw JwtError()
}
}Compiled specification
JwtError · class · source
A failed JOSE validation reveals no unverified claims. It implements Error.
JwtHeader · immutable record · source
This profile accepts only RS256, a configured key id, and an explicit token type. It takes alg, kid, and typ as strings, kept read-only.
RsaJwk · immutable record · source
Public signing-key metadata in RFC 7517 / RFC 7518 form. It takes kty, kid, alg, use, n, and e as strings, kept read-only.
RsaJwks · immutable record · source
It takes keys as List<RsaJwk>, kept read-only.
rsaJwk · source
Export public parameters. Private key material never enters the JSON document. It takes publicKey as RsaPublicKey and kid as a string. It gets crypto (Crypto) from dependency injection.
It can call Crypto.exportRsa. Failures can raise CryptoError. It reads crypto.exportRsa with publicKey once and binds [0] as modulus and [1] as exponent. It returns a RsaJwk with kty "RSA", kid, alg "RS256", use "sig", n from the URL-safe base64 encoding of modulus, and e from the URL-safe base64 encoding of exponent. source
Checked interface
rsaJwk(RsaPublicKey publicKey, string kid, resolve Crypto crypto) returns RsaJwk unless CryptoError uses Crypto.exportRsaIt takes publicKey as RsaPublicKey and kid as a string. It gets crypto (Crypto) from dependency injection. It can call Crypto.exportRsa. Failures can raise CryptoError.
importJwk · source
Import only an RSA signing key for RS256. The transport caller selects the trusted JWKS URL. It takes jwk as RsaJwk. It gets crypto (Crypto) from dependency injection.
It can call Crypto.decodeBase64url and Crypto.importRsa. Failures can raise JwtError. It checks that jwk.kty equals "RSA" and jwk.alg equals "RS256" and jwk.use equals "sig". It raises a JwtError at the first failed check. source
It tries to set modulus to crypto.decodeBase64url with input from jwk.n, then set exponent to crypto.decodeBase64url with input from jwk.e, then return crypto.importRsa with modulus and exponent. If this work raises CryptoError, it raises a JwtError. source
Checked interface
importJwk(RsaJwk jwk, resolve Crypto crypto) returns RsaPublicKey unless JwtError uses Crypto.decodeBase64url, Crypto.importRsaIt takes jwk as RsaJwk. It gets crypto (Crypto) from dependency injection. It can call Crypto.decodeBase64url and Crypto.importRsa. Failures can raise JwtError.
signJwt · source
Sign immutable JSON with an explicit key id and token type. Claims are validated by the protocol that consumes the token. It takes key as RsaPrivateKey, claims as Json, and kid and tokenType as strings. It gets crypto (Crypto) from dependency injection.
It can call Crypto.signRsa. Failures can raise JwtError.
It sets header to stringify on a Json with value from a JwtHeader with alg "RS256", kid, and typ from tokenType. It sets payload to claims.stringify. It builds signing as the text {the URL-safe base64 encoding of the UTF-8 bytes of header}.{the URL-safe base64 encoding of the UTF-8 bytes of payload}. It sets signature to crypto.signRsa with key and input from the UTF-8 bytes of signing. source
It returns the text {signing}.{the URL-safe base64 encoding of signature}. If this work raises CryptoError, it raises a JwtError. If this work raises JsonError, it raises a JwtError. source
Checked interface
signJwt(RsaPrivateKey key, Json claims, string kid, string tokenType, resolve Crypto crypto) returns string unless JwtError uses Crypto.signRsaIt takes key as RsaPrivateKey, claims as Json, and kid and tokenType as strings. It gets crypto (Crypto) from dependency injection. It can call Crypto.signRsa. Failures can raise JwtError.
verifyJwt · source
Verify the signature and configured algorithm, key id, and type before exposing the JSON payload. Never follows token-supplied URLs. It takes token as a string, publicKey as RsaPublicKey, and kid and tokenType as strings. It gets crypto (Crypto) from dependency injection.
It can call Crypto.decodeBase64url and Crypto.verifyRsa. Failures can raise JwtError.
It checks that the byte length of token is at most 16384. It raises a JwtError at the first failed check. It sets parts to token.split with separator ".". source
It checks that the number of elements in parts equals 3. It raises a JwtError at the first failed check. It sets first to the item at index 0 in parts. It sets second to the item at index 1 in parts. source
It sets third to the item at index 2 in parts. It sets header to decode on parse with input from text on crypto.decodeBase64url with input from first for JwtHeader. It checks that header.alg equals "RS256" and header.kid equals kid and header.typ equals tokenType. It raises a JwtError at the first failed check. source
It sets signature to crypto.decodeBase64url with input from third. It checks that crypto.verifyRsa with publicKey, input from the UTF-8 bytes of the text {first}.{second}, and signature returns true. It raises a JwtError at the first failed check. It returns parse with input from text on crypto.decodeBase64url with input from second. source
If this work raises CryptoError, it raises a JwtError. If this work raises ConversionError, it raises a JwtError. If this work raises JsonError, it raises a JwtError. If this work raises IndexError, it raises a JwtError. source
Checked interface
verifyJwt(string token, RsaPublicKey publicKey, string kid, string tokenType, resolve Crypto crypto) returns Json unless JwtError uses Crypto.decodeBase64url, Crypto.verifyRsaIt takes token as a string, publicKey as RsaPublicKey, and kid and tokenType as strings. It gets crypto (Crypto) from dependency injection. It can call Crypto.decodeBase64url and Crypto.verifyRsa. Failures can raise JwtError.
Dependencies
It uses parse from https://github.com/GreenPandaStudios/augscript/src/stdlib/json#v0.19.0. It uses Crypto (decodeBase64url, exportRsa, importRsa, signRsa, and verifyRsa) from contracts.
Built-in operations follow the language reference.