jose/test/jws/general.test.mjs

import test from 'ava';
import * as crypto from 'crypto';

const root = !('WEBCRYPTO' in process.env) ? '#dist' : '#dist/webcrypto';
Promise.all([import(`${root}/jws/general/sign`), import(`${root}/jws/general/verify`)]).then(
  ([{ GeneralSign }, { generalVerify }]) => {
    test.before(async (t) => {
      const encode = TextEncoder.prototype.encode.bind(new TextEncoder());
      t.context.plaintext = encode('It’s a dangerous business, Frodo, going out your door.');
      t.context.secret = crypto.randomFillSync(new Uint8Array(48));
    });

    test('General JWS signing', async (t) => {
      const sig = new GeneralSign(t.context.plaintext);

      sig
        .addSignature(t.context.secret)
        .setProtectedHeader({ bar: 'baz' })
        .setUnprotectedHeader({ alg: 'HS256' });

      sig
        .addSignature(t.context.secret)
        .setProtectedHeader({ bar: 'baz' })
        .setUnprotectedHeader({ alg: 'HS384' });

      const generalJws = await sig.sign();

      t.is(
        generalJws.payload,
        'SXTigJlzIGEgZGFuZ2Vyb3VzIGJ1c2luZXNzLCBGcm9kbywgZ29pbmcgb3V0IHlvdXIgZG9vci4',
      );
      t.is(generalJws.signatures.length, 2);
    });

    test('General JWS signing b64:false', async (t) => {
      const sig = new GeneralSign(t.context.plaintext);

      sig
        .addSignature(t.context.secret)
        .setProtectedHeader({ bar: 'baz', b64: false, crit: ['b64'] })
        .setUnprotectedHeader({ alg: 'HS256' });

      sig
        .addSignature(t.context.secret)
        .setProtectedHeader({ bar: 'baz', b64: false, crit: ['b64'] })
        .setUnprotectedHeader({ alg: 'HS384' });

      const generalJws = await sig.sign();

      t.is(generalJws.payload, '');
      t.is(generalJws.signatures.length, 2);
    });

    test('General JWS signing validations', async (t) => {
      const sig = new GeneralSign(t.context.plaintext);

      t.throws(
        () => {
          sig
            .addSignature(t.context.secret)
            .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: false, alg: 'HS256' })
            .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: false, alg: 'HS256' });
        },
        { instanceOf: TypeError, message: 'setProtectedHeader can only be called once' },
      );

      t.throws(
        () => {
          sig
            .addSignature(t.context.secret)
            .setProtectedHeader({ bar: 'baz', crit: ['b64'], b64: true, alg: 'HS384' })
            .setUnprotectedHeader({ foo: 'bar' })
            .setUnprotectedHeader({ foo: 'bar' });
        },
        { instanceOf: TypeError, message: 'setUnprotectedHeader can only be called once' },
      );

      await t.throwsAsync(sig.sign(), {
        message: 'inconsistent use of JWS Unencoded Payload Option (RFC7797)',
        code: 'ERR_JWS_INVALID',
      });
    });

    test('General JWS verify format validation', async (t) => {
      const sig = new GeneralSign(t.context.plaintext);

      sig
        .addSignature(t.context.secret)
        .setProtectedHeader({ bar: 'baz' })
        .setUnprotectedHeader({ alg: 'HS256' });

      const generalJws = await sig.sign();

      {
        await t.throwsAsync(generalVerify(null, t.context.secret), {
          message: 'General JWS must be an object',
          code: 'ERR_JWS_INVALID',
        });
      }

      {
        await t.throwsAsync(generalVerify({ signatures: null }, t.context.secret), {
          message: 'JWS Signatures missing or incorrect type',
          code: 'ERR_JWS_INVALID',
        });
      }

      {
        await t.throwsAsync(generalVerify({ signatures: [null] }, t.context.secret), {
          message: 'JWS Signatures missing or incorrect type',
          code: 'ERR_JWS_INVALID',
        });
      }

      {
        const jws = { payload: generalJws.payload, signatures: [] };

        await t.throwsAsync(generalVerify(jws, t.context.secret), {
          message: 'signature verification failed',
          code: 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED',
        });
      }

      {
        await t.notThrowsAsync(generalVerify(generalJws, t.context.secret));
      }

      {
        const { payload, signatures } = generalJws;
        const jws = { payload, signatures: [...signatures, {}] };

        await t.notThrowsAsync(generalVerify(jws, t.context.secret));
      }

      {
        const { payload, signatures } = generalJws;
        const jws = { payload, signatures: [{}, ...signatures] };

        await t.notThrowsAsync(generalVerify(jws, t.context.secret));
      }
    });
  },
  (err) => {
    test('failed to import', (t) => {
      console.error(err);
      t.fail();
    });
  },
);