MDL-76916 Libraries: Upgrade PHP-JWT to 6.4.0

lib/php-jwt/src/CachedKeySet.php

@@ -3,6 +3,7 @@
 namespace Firebase\JWT;
 
 use ArrayAccess;
+use InvalidArgumentException;
 use LogicException;
 use OutOfBoundsException;
 use Psr\Cache\CacheItemInterface;
@@ -10,6 +11,7 @@ use Psr\Cache\CacheItemPoolInterface;
 use Psr\Http\Client\ClientInterface;
 use Psr\Http\Message\RequestFactoryInterface;
 use RuntimeException;
+use UnexpectedValueException;
 
 /**
  * @implements ArrayAccess<string, Key>
@@ -41,7 +43,7 @@ class CachedKeySet implements ArrayAccess
      */
     private $cacheItem;
     /**
-     * @var array<string, Key>
+     * @var array<string, array<mixed>>
      */
     private $keySet;
     /**
@@ -101,7 +103,7 @@ class CachedKeySet implements ArrayAccess
         if (!$this->keyIdExists($keyId)) {
             throw new OutOfBoundsException('Key ID not found');
         }
-        return $this->keySet[$keyId];
+        return JWK::parseKey($this->keySet[$keyId], $this->defaultAlg);
     }
 
     /**
@@ -130,15 +132,43 @@ class CachedKeySet implements ArrayAccess
         throw new LogicException('Method not implemented');
     }
 
+    /**
+     * @return array<mixed>
+     */
+    private function formatJwksForCache(string $jwks): array
+    {
+        $jwks = json_decode($jwks, true);
+
+        if (!isset($jwks['keys'])) {
+            throw new UnexpectedValueException('"keys" member must exist in the JWK Set');
+        }
+
+        if (empty($jwks['keys'])) {
+            throw new InvalidArgumentException('JWK Set did not contain any keys');
+        }
+
+        $keys = [];
+        foreach ($jwks['keys'] as $k => $v) {
+            $kid = isset($v['kid']) ? $v['kid'] : $k;
+            $keys[(string) $kid] = $v;
+        }
+
+        return $keys;
+    }
+
     private function keyIdExists(string $keyId): bool
     {
         if (null === $this->keySet) {
             $item = $this->getCacheItem();
             // Try to load keys from cache
             if ($item->isHit()) {
-                // item found! Return it
-                $jwks = $item->get();
-                $this->keySet = JWK::parseKeySet(json_decode($jwks, true), $this->defaultAlg);
+                // item found! retrieve it
+                $this->keySet = $item->get();
+                // If the cached item is a string, the JWKS response was cached (previous behavior).
+                // Parse this into expected format array<kid, jwk> instead.
+                if (\is_string($this->keySet)) {
+                    $this->keySet = $this->formatJwksForCache($this->keySet);
+                }
             }
         }
 
@@ -146,17 +176,16 @@ class CachedKeySet implements ArrayAccess
             if ($this->rateLimitExceeded()) {
                 return false;
             }
-            $request = $this->httpFactory->createRequest('get', $this->jwksUri);
+            $request = $this->httpFactory->createRequest('GET', $this->jwksUri);
             $jwksResponse = $this->httpClient->sendRequest($request);
-            $jwks = (string) $jwksResponse->getBody();
-            $this->keySet = JWK::parseKeySet(json_decode($jwks, true), $this->defaultAlg);
+            $this->keySet = $this->formatJwksForCache((string) $jwksResponse->getBody());
 
             if (!isset($this->keySet[$keyId])) {
                 return false;
             }
 
             $item = $this->getCacheItem();
-            $item->set($jwks);
+            $item->set($this->keySet);
             if ($this->expiresAfter) {
                 $item->expiresAfter($this->expiresAfter);
             }