-
-
Notifications
You must be signed in to change notification settings - Fork 299
/
validate_crit.ts
57 lines (48 loc) · 1.77 KB
/
validate_crit.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.ts'
interface CritCheckHeader {
b64?: boolean
crit?: string[]
[propName: string]: unknown
}
function validateCrit(
Err: typeof JWEInvalid | typeof JWSInvalid,
recognizedDefault: Map<string, boolean>,
recognizedOption: { [propName: string]: boolean } | undefined,
protectedHeader: CritCheckHeader | undefined,
joseHeader: CritCheckHeader,
) {
if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {
throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected')
}
if (!protectedHeader || protectedHeader.crit === undefined) {
return new Set()
}
if (
!Array.isArray(protectedHeader.crit) ||
protectedHeader.crit.length === 0 ||
protectedHeader.crit.some((input: string) => typeof input !== 'string' || input.length === 0)
) {
throw new Err(
'"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present',
)
}
let recognized: Map<string, boolean>
if (recognizedOption !== undefined) {
recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()])
} else {
recognized = recognizedDefault
}
for (const parameter of protectedHeader.crit) {
if (!recognized.has(parameter)) {
throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`)
}
if (joseHeader[parameter] === undefined) {
throw new Err(`Extension Header Parameter "${parameter}" is missing`)
}
if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`)
}
}
return new Set(protectedHeader.crit)
}
export default validateCrit