Function validateClaimsSet

src/lib/jwt_claims_set.ts:104–256

(
  protectedHeader: types.JWEHeaderParameters | types.JWSHeaderParameters,
  encodedPayload: Uint8Array,
  options: types.JWTClaimVerificationOptions = {},
)

}

export function validateClaimsSet(
  protectedHeader: types.JWEHeaderParameters | types.JWSHeaderParameters,
  encodedPayload: Uint8Array,
  options: types.JWTClaimVerificationOptions = {},
) {
  let payload!: { [propName: string]: unknown }
  try {
    payload = JSON.parse(decoder.decode(encodedPayload))
  } catch {
    //
  }

  if (!isObject(payload)) {
    throw new JWTInvalid('JWT Claims Set must be a top-level JSON object')
  }

  const { typ } = options
  if (
    typ &&
    (typeof protectedHeader!.typ !== 'string' ||
      normalizeTyp(protectedHeader!.typ) !== normalizeTyp(typ))
  ) {
    throw new JWTClaimValidationFailed(
      'unexpected "typ" JWT header value',
      payload,
      'typ',
      'check_failed',
    )
  }

  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options

  const presenceCheck = [...requiredClaims]

  if (maxTokenAge !== undefined) presenceCheck.push('iat')
  if (audience !== undefined) presenceCheck.push('aud')
  if (subject !== undefined) presenceCheck.push('sub')
  if (issuer !== undefined) presenceCheck.push('iss')

  for (const claim of new Set(presenceCheck.reverse())) {
    if (!(claim in payload)) {
      throw new JWTClaimValidationFailed(
        `missing required "${claim}" claim`,
        payload,
        claim,
        'missing',
      )
    }
  }

  if (
    issuer &&
    !((Array.isArray(issuer) ? issuer : [issuer]) as unknown[]).includes(payload.iss!)
  ) {
    throw new JWTClaimValidationFailed(
      'unexpected "iss" claim value',
      payload,
      'iss',