feat: upgrade jose dependency to v6 (#486)

package.json

@@ -14,7 +14,7 @@
   "dependencies": {
     "@types/jsonwebtoken": "^9.0.4",
     "debug": "^4.3.4",
-    "jose": "^4.15.4",
+    "jose": "^6.1.3",
     "limiter": "^1.1.5",
     "lru-memoizer": "^2.2.0"
   },

src/integrations/config.js

@@ -6,7 +6,6 @@ const allowedSignatureAlg = [
   'PS384',
   'PS512',
   'ES256',
-  'ES256K',
   'ES384',
   'ES512',
   'EdDSA'

src/utils.js

@@ -14,8 +14,6 @@ function resolveAlg(jwk) {
     switch (jwk.crv) {
       case 'P-256':
         return 'ES256';
-      case 'secp256k1':
-        return 'ES256K';
       case 'P-384':
         return 'ES384';
       case 'P-521':

tests/utils.tests.js

@@ -0,0 +1,29 @@
+const { expect } = require('chai');
+
+const { retrieveSigningKeys } = require('../src/utils');
+const { x5cSingle } = require('./keys');
+
+describe('utils - retrieveSigningKeys', () => {
+  it('Ignores keys signed with unsupported algorithms', async () => {
+    const es256k = {
+      alg: 'ES256K',
+      kty: 'EC',
+      use: 'sig',
+      crv: 'secp256k1',
+      x: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      y: 'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB',
+      kid: 'es256k-test'
+    };
+
+    const rsa = x5cSingle.keys[0];
+    const jwks = [ es256k, rsa ];
+    const keys = await retrieveSigningKeys(jwks);
+
+    // Unsupported (ES256K) key should be ignored
+    expect(keys.find(k => k.kid === 'es256k-test')).to.be.undefined;
+
+    // Supported RSA key should be resolved.
+    expect(keys).to.have.lengthOf(1);
+    expect(keys[0].kid).to.equal(rsa.kid);
+  });
+});