feat: allow JWKS.KeyStore .all and .get to filter for key curves

panva · Nov 26, 2019 · ea60338 · ea60338
1 parent f1f3977
commit ea60338
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 19 deletions.
diff --git a/docs/README.md b/docs/README.md
@@ -625,6 +625,7 @@ specified by the parameters are first.
 
 - `parameters`: `<Object>`
  - `kty`: `<string>` Key Type to filter for.
+ - `crv`: `<string>` Key Curve to filter for. (for EC and OKP keys)
  - `alg`: `<string>` Key supported algorithm to filter for.
  - `kid`: `<string>` Key ID to filter for.
  - `use`: `<string>` Filter keys with the specified use defined. Keys missing "use" parameter will
@@ -643,6 +644,7 @@ parameters is returned.
 
 - `parameters`: `<Object>`
  - `kty`: `<string>` Key Type to filter for.
+ - `crv`: `<string>` Key Curve to filter for. (for EC and OKP keys)
  - `alg`: `<string>` Key supported algorithm to filter for.
  - `kid`: `<string>` Key ID to filter for.
  - `use`: `<string>` Filter keys with the specified use defined. Keys missing "use" parameter will

diff --git a/lib/jwks/keystore.js b/lib/jwks/keystore.js
@@ -6,25 +6,13 @@ const Key = require('../jwk/key/base')
 const importKey = require('../jwk/import')
 const { USES_MAPPING } = require('../help/consts')
 
-const keyscore = (key, { alg, kid, use, ops, x5t, x5t256 }) => {
+const keyscore = (key, { alg, use, ops }) => {
  let score = 0
 
  if (alg && key.alg) {
  score++
  }
 
- if (kid && key.kid) {
- score++
- }
-
- if (x5t && key.x5t) {
- score++
- }
-
- if (x5t256 && key['x5t#S256']) {
- score++
- }
-
  if (use && key.use) {
  score++
  }
@@ -64,20 +52,16 @@ class KeyStore {
  i(this).keys = new Set(keys)
  }
 
- all ({ alg, kid, use, kty, key_ops: ops, x5t, 'x5t#S256': x5t256 } = {}) {
+ all ({ alg, kid, use, kty, key_ops: ops, x5t, 'x5t#S256': x5t256, crv } = {}) {
  if (ops !== undefined && (!Array.isArray(ops) || !ops.length || ops.some(x => typeof x !== 'string'))) {
  throw new TypeError('`key_ops` must be a non-empty array of strings')
  }
 
- const search = { alg, kid, use, ops, x5t, x5t256 }
+ const search = { alg, use, ops }
  return [...i(this).keys]
  .filter((key) => {
  let candidate = true
 
- if (alg !== undefined && !key.algorithms().has(alg)) {
- candidate = false
- }
-
  if (candidate && kid !== undefined && key.kid !== kid) {
  candidate = false
  }
@@ -94,6 +78,14 @@ class KeyStore {
  candidate = false
  }
 
+ if (candidate && crv !== undefined && (key.crv !== crv)) {
+ candidate = false
+ }
+
+ if (alg !== undefined && !key.algorithms().has(alg)) {
+ candidate = false
+ }
+
  if (candidate && use !== undefined && (key.use !== undefined && key.use !== use)) {
  candidate = false
  }

diff --git a/test/jwks/keystore.test.js b/test/jwks/keystore.test.js
@@ -149,6 +149,18 @@ test('.all() and .get() use sort', t => {
  t.is(ks.get({ use: 'sig' }), k2)
 })
 
+test('.all() and .get() crv filter', t => {
+ const k = generateSync('EC', 'P-256')
+ const k2 = generateSync('EC', 'P-384')
+ const ks = new KeyStore(k, k2)
+ t.deepEqual(ks.all({ crv: 'P-256' }), [k])
+ t.deepEqual(ks.all({ crv: 'P-384' }), [k2])
+ t.deepEqual(ks.all({ crv: 'P-521' }), [])
+ t.is(ks.get({ crv: 'P-256' }), k)
+ t.is(ks.get({ crv: 'P-384' }), k2)
+ t.is(ks.get({ crv: 'P-521' }), undefined)
+})
+
 test('.all() and .get() kid filter', t => {
  const k = generateSync('RSA', undefined, { kid: 'foobar' })
  const ks = new KeyStore(k)

diff --git a/types/index.d.ts b/types/index.d.ts
@@ -180,6 +180,7 @@ export namespace JWKS {
  kty?: keyType;
  x5t?: string;
  'x5t#S256'?: string;
+ crv?: string;
  }
 
  class KeyStore {