ES256 support

[ivn-cote]

Description

This PR contains POC for ES256 support. ES256 is similar to RS256, but uses elliptic curve (EC) based crypto instead of RSA.

From implementation side, we've chosen jose library to convert JWK format to PEM because other libraries do not support EC keys.

I understand this library provides only RSA support for now, but I'd like to promote changes since library is part of JWT validation ecosystem, and plays a vital role as such on many projects. It means providing more general validation would be beneficial for the community.

References

https://github.com/auth0/node-jwks-rsa/issues?q=is%3Aissue+ec

Testing

More tests should be added.

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not master

[Harmelodic]

If this should be removed, then it should be removed, not commented out.

[ivn-cote]

sorry for that, it was in not up to date branch I pushed first.

[Harmelodic]

Not sure how this would affect the auth0 release/package management, if we're changing version in their master branch

[ivn-cote]

It is a proposal for now, I actually don't know the release process here and need a guidance.

[panva]

we should remove the version proposal from the changeset.

[ivn-cote]

@lbalmaceda @damieng @sandrinodimattia can I have your input here? Thank you!

[panva]

package.json engines entry would be greatly valuable since the jose dependency does come with runtime requirements that should be made clear to the module's consumers.

Furthermore the whole implementation could be made way simpler, the rsa utils bundled can get removed and to get all the keys (not just RSA or EC ones, also OKP) all in one go, no need to duplicate code for each key type.

let jwks = JSON.parse(jwks_uri_response)
let keystore = jose.JWKS.asKeyStore(jwks, { ignoreErrors: true })
let signingKeys = keystore.all({ use: 'sig' }).map((key) => {
  return {
	kid: key.kid,
    get publicKey() { return key.toPEM(false) },
    getPublicKey() { return key.toPEM(false) },
    get keyObject() { return key.keyObject }
  }
})

[panva]

jose@2 is already available

[davidpatrick]

@ivn-cote thanks for taking the time to raise this PR. Would you be willing to contribute @panva's suggested improvements? We are currently evaluating whether setting the engine in a minor or major makes most sense for this library. Jose will bump us to Node 10 which more than likely will cut a new major for this library considering we still have about 15% of users on Node 8.x.

[ivn-cote]

@davidpatrick yes I aim to apply: 1) jose@2, 2) updating engines, 3) keeping a major bump, 4) refactor the code proposal.

[ivn-cote]

@davidpatrick @panva I've updated the PR with the recommendations provided earlier.

[panva]

I think we should be testing with a matrix here, 10, 12, 14.

[panva]

we should remove the version proposal from the changeset.

[davidpatrick]

@ivn-cote I just wanted to give you a heads up that I'll be revisiting this PR after our last planned minor for 1.x.