diff --git a/.changeset/fix-signer-unsupported-algorithm-error.md b/.changeset/fix-signer-unsupported-algorithm-error.md new file mode 100644 index 0000000..3ee5dbf --- /dev/null +++ b/.changeset/fix-signer-unsupported-algorithm-error.md @@ -0,0 +1,12 @@ +--- +"@agentcommercekit/jwt": patch +--- + +`createJwtSigner` now reports which curve it could not handle. + +The `default` branch called `new Error("Unsupported algorithm", keypair.curve)`. +`Error`'s second argument is an `ErrorOptions` object (`{ cause }`), not a +message part, so passing a string there is silently dropped at runtime and +fails to type-check under `strict` TypeScript. The curve is now interpolated +into the message instead, so the thrown error actually names the unsupported +curve. diff --git a/packages/jwt/src/signer.test.ts b/packages/jwt/src/signer.test.ts index 9a47cf6..6d16a0a 100644 --- a/packages/jwt/src/signer.test.ts +++ b/packages/jwt/src/signer.test.ts @@ -1,6 +1,5 @@ import { generateKeypair } from "@agentcommercekit/keys" import { describe, expect, test } from "vitest" - import { createJwtSigner } from "./signer" describe("createJwtSigner", () => { @@ -68,6 +67,24 @@ describe("createJwtSigner", () => { expect(signature1).not.toBe(signature2) }) + test("throws a descriptive error for an unsupported curve", async () => { + const keypair = await generateKeypair("secp256k1") + // Simulate a Keypair with an invalid/unsupported curve, e.g. one that + // arrived from untrusted or future data and was never runtime-validated. + const invalidKeypair = { + ...keypair, + curve: "invalid-curve", + } + // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- intentionally passing invalid input to exercise runtime validation + const signerInput = invalidKeypair as unknown as Parameters< + typeof createJwtSigner + >[0] + + expect(() => createJwtSigner(signerInput)).toThrow( + "Unsupported algorithm: invalid-curve", + ) + }) + test("handles both string and Uint8Array input", async () => { const keypair = await generateKeypair("secp256k1") const signer = createJwtSigner(keypair) diff --git a/packages/jwt/src/signer.ts b/packages/jwt/src/signer.ts index bf61792..727d984 100644 --- a/packages/jwt/src/signer.ts +++ b/packages/jwt/src/signer.ts @@ -22,6 +22,6 @@ export function createJwtSigner(keypair: Keypair): JwtSigner { case "Ed25519": return EdDSASigner(keypair.privateKey) default: - throw new Error("Unsupported algorithm", keypair.curve) + throw new Error(`Unsupported algorithm: ${String(keypair.curve)}`) } }