feat: keystore .all and .get operation option

panva · Mar 11, 2019 · d349ba9 · d349ba9
1 parent ed7c38b
commit d349ba9
Show file tree

Hide file tree

Showing 8 changed files with 16 additions and 12 deletions.
diff --git a/docs/README.md b/docs/README.md
@@ -485,6 +485,8 @@ specified by the parameters are first.
  - `alg`: `<string>` Key supported algorithm to filter for.
  - `use`: `<string>` Key use to filter for.
  - `kid`: `<string>` Key ID to filter for.
+ - `operation`: `<string>` Further specify the operation a given alg must be valid for. Must be one
+ of 'encrypt', 'decrypt', 'sign', 'verify', 'wrapKey', 'unwrapKey'
 - Returns: `<Key[]>` Array of key instances or an empty array when none are matching the parameters.
 
 ---
@@ -499,6 +501,8 @@ parameters is returned.
  - `alg`: `<string>` Key supported algorithm to filter for.
  - `use`: `<string>` Key use to filter for.
  - `kid`: `<string>` Key ID to filter for.
+ - `operation`: `<string>` Further specify the operation a given alg must be valid for. Must be one
+ of 'encrypt', 'decrypt', 'sign', 'verify', 'wrapKey', 'unwrapKey'
 - Returns: `<JWK.RSAKey>` &vert; `<JWK.ECKey>` &vert; `<JWK.OctKey>` &vert; `<undefined>`
 
 ---

diff --git a/lib/index.d.ts b/lib/index.d.ts
@@ -10,9 +10,9 @@ interface KeyParameters {
 }
 type curve = 'P-256' | 'P-384' | 'P-521'
 type keyType = 'RSA' | 'EC' | 'oct'
+type keyOperation = 'encrypt' | 'decrypt' | 'sign' | 'verify' | 'wrapKey' | 'unwrapKey'
 
 export namespace JWK {
- type keyOperation = 'encrypt' | 'decrypt' | 'sign' | 'verify' | 'wrapKey' | 'unwrapKey'
 
  class Key {
  kty: keyType
@@ -104,6 +104,7 @@ export namespace JWK {
 export namespace JWKS {
  interface KeyQuery extends KeyParameters {
  kty: keyType
+ operation: keyOperation
  }
 
  class KeyStore {

diff --git a/lib/jwe/decrypt.js b/lib/jwe/decrypt.js
@@ -94,9 +94,9 @@ const jweDecrypt = (skipValidateHeaders, serialization, jwe, key, { crit = [], c
  const keystore = key
  let keys
  if (opts.alg === 'dir') {
- keys = keystore.all({ ...opts, alg: opts.enc })
+ keys = keystore.all({ kid: opts.kid, alg: opts.enc, operation: 'decrypt' })
  } else {
- keys = keystore.all(opts)
+ keys = keystore.all({ kid: opts.kid, alg: opts.alg, operation: 'unwrapKey' })
  }
  switch (keys.length) {
  case 0:

diff --git a/lib/jwk/key/ec.js b/lib/jwk/key/ec.js
@@ -83,11 +83,10 @@ class ECKey extends Key {
 
  return new Set(WRAP_ALGS)
  case undefined:
+ // just the ops needed to return all algs regardless of its use
  return new Set([
- ...this.algorithms('sign'),
  ...this.algorithms('verify'),
- ...this.algorithms('wrapKey'),
- ...this.algorithms('unwrapKey')
+ ...this.algorithms('wrapKey')
  ])
  default:
  throw new TypeError('invalid key operation')

diff --git a/lib/jwk/key/oct.js b/lib/jwk/key/oct.js
@@ -128,6 +128,7 @@ class OctKey extends Key {
  return algs
  case undefined:
  return new Set([
+ // just the ops needed to return all algs regardless of its use - symmetric keys
  ...this.algorithms('encrypt'),
  ...this.algorithms('sign'),
  ...this.algorithms('wrapKey')

diff --git a/lib/jwk/key/rsa.js b/lib/jwk/key/rsa.js
@@ -90,11 +90,10 @@ class RSAKey extends Key {
 
  return new Set(WRAP_ALGS)
  case undefined:
+ // just the ops needed to return all algs regardless of its use
  return new Set([
- ...this.algorithms('sign'),
  ...this.algorithms('verify'),
- ...this.algorithms('wrapKey'),
- ...this.algorithms('unwrapKey')
+ ...this.algorithms('wrapKey')
  ])
  default:
  throw new TypeError('invalid key operation')

diff --git a/lib/jwks/keystore.js b/lib/jwks/keystore.js
@@ -45,12 +45,12 @@ class KeyStore {
  return new KeyStore(...keys)
  }
 
- all ({ alg, kid, use, kty } = {}) {
+ all ({ alg, kid, use, kty, operation } = {}) {
  return [...this[KEYS]]
  .filter((key) => {
  let candidate = true
 
- if (alg !== undefined && !key.algorithms().has(alg)) {
+ if (alg !== undefined && !key.algorithms(operation).has(alg)) {
  candidate = false
  }
 

diff --git a/lib/jws/verify.js b/lib/jws/verify.js
@@ -79,7 +79,7 @@ const jwsVerify = (skipDisjointCheck, serialization, jws, key, { crit = [], comp
 
  if (key instanceof KeyStore) {
  const keystore = key
- const keys = keystore.all(combinedHeader)
+ const keys = keystore.all({ kid: combinedHeader.kid, alg: combinedHeader.alg, operation: 'verify' })
  switch (keys.length) {
  case 0:
  throw new errors.JWKSNoMatchingKey()