1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
import type QUnit from 'qunit'import * as lib from '../src/index.js'import { isDeno, isNode } from './env.js'import * as jose from 'jose'
const issuer = { issuer: 'https://op.example.com' }const client = { client_id: 'client_id' }const rsa = {  hash: { name: 'SHA-256' },  modulusLength: 2048,  publicExponent: new Uint8Array([0x01, 0x00, 0x01]),}const usages: KeyUsage[] = ['sign', 'verify']
const keys: Record<string, CryptoKeyPair> = {  RS256: await crypto.subtle.generateKey(    {      name: 'RSASSA-PKCS1-v1_5',      ...rsa,    },    false,    usages,  ),  PS256: await crypto.subtle.generateKey(    {      name: 'RSA-PSS',      ...rsa,    },    false,    usages,  ),  ES256: await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, usages),}
if (isNode || isDeno) {  keys.EdDSA = <CryptoKeyPair>await crypto.subtle.generateKey({ name: 'Ed25519' }, false, usages)}
export default (QUnit: QUnit) => {  const { module, test } = QUnit  module('request_object.ts')
  test('issueRequestObject()', async (t) => {    const kp = keys.ES256    const jwt = await lib.issueRequestObject(      issuer,      client,      new URLSearchParams({ response_type: 'code', resource: 'urn:example:resource' }),      { key: kp.privateKey },    )
    const { payload, protectedHeader } = await jose.jwtVerify(jwt, kp.publicKey)    t.propEqual(protectedHeader, { alg: 'ES256', typ: 'oauth-authz-req+jwt' })    const { exp, iat, nbf, jti, ...claims } = payload    t.equal(typeof exp, 'number')    t.equal(typeof nbf, 'number')    t.equal(typeof iat, 'number')    t.equal(typeof jti, 'string')    t.propEqual(claims, {      iss: client.client_id,      aud: issuer.issuer,      response_type: 'code',      resource: 'urn:example:resource',      client_id: client.client_id,    })  })
  test('issueRequestObject() - multiple resource parameters', async (t) => {    const kp = keys.ES256    const jwt = await lib.issueRequestObject(      issuer,      client,      new URLSearchParams([        ['resource', 'urn:example:resource'],        ['resource', 'urn:example:resource-2'],      ]),      { key: kp.privateKey },    )
    const { payload, protectedHeader } = await jose.jwtVerify(jwt, kp.publicKey)    t.propEqual(protectedHeader, { alg: 'ES256', typ: 'oauth-authz-req+jwt' })    const { resource } = payload    t.propEqual(resource, ['urn:example:resource', 'urn:example:resource-2'])  })
  for (const alg of Object.keys(keys)) {    test(`issueRequestObject() signed using ${alg}`, async (t) => {      const kp = keys[alg]      const jwt = await lib.issueRequestObject(issuer, client, new URLSearchParams(), {        key: kp.privateKey,      })      const { protectedHeader } = await jose.jwtVerify(jwt, kp.publicKey)      t.equal(protectedHeader.alg, alg)    })  }
  test('issueRequestObject() signature kid', async (t) => {    const kp = keys.ES256    const jwt = await lib.issueRequestObject(issuer, client, new URLSearchParams(), {      key: kp.privateKey,      kid: 'kid-1',    })    const protectedHeader = jose.decodeProtectedHeader(jwt)    t.equal(protectedHeader.kid, 'kid-1')  })}