panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
MIT License
1.83k stars 392 forks source link

Export jose instance #226

Closed foray1010 closed 4 years ago

foray1010 commented 4 years ago

Is your feature request related to a problem? Please describe. I am using following version

{
    "jose": "1.22.1",
    "openid-client": "3.12.2"
}

As openid-client doesn't support logout token validation by default, I will have to install jose and call jose.JWT.LogoutToken.verify manually. This function requires a key that I would like to get by issuer.keystore(), but the problem is as my jose version is not sync with openid-client one because the openid-client is installed a few days ago and still using jose v1.22.0, jose.JWT.LogoutToken.verify will throw key must be an instance of a key instantiated by JWK.asKey, a valid JWK.asKey input, or a JWKS.KeyStore instance

Describe the solution you'd like exports.jose = require('jose') so that I can reuse the same jose instance

Describe alternatives you've considered maybe peer dependency? or do not use instanceof but use like class name for checking?

Additional context

panva commented 4 years ago

I intentionally don't expose the dependency, i had that before and it was still messy.

If you want to work with the keys returned by keystore in your own code, i suggest you key.toJWK() and then jose.JWK.asKey(jwk).

foray1010 commented 4 years ago

I was able to reuse the keystore by jose.JWKS.asKeyStore(keystore.toJWKS()), thank you!

panva commented 4 years ago

That works too.