RSA/EC JWK Normalizer

Utility to normalize inbound JWK payloads using the target JOSE library to complete RSA private details and enforce EC curve constraints.

Capabilities

Completes RSA CRT parameters

• An RSA private JWK containing base64url n, e, and d only is normalized so the returned JWK includes matching n, e, d plus derived p, q, dp, dq, and qi fields. The result retains the same modulus/exponent values and stays serializable back to JSON. @test
• If an RSA private JWK includes any CRT field while others are missing (for example p without q), normalization raises a validation error instead of emitting a partially filled key. @test

Enforces EC curve and coordinate sizes

• A P-256 EC JWK with 32-byte base64url-encoded x and y coordinates and a supported curve label is accepted and returned unchanged apart from normalization that ensures kty, crv, and coordinates are preserved as provided. @test
• A JWK claiming curve P-256 but providing coordinates with incorrect byte lengths, or specifying an unsupported curve name, results in a validation error. @test

Normalizes JWK sets

• Processing a list of mixed RSA and EC JWK dictionaries returns an object with a keys array containing normalized entries in the original order, and aborts the whole operation if any member fails validation. @test

Implementation

@generates

API

from typing import Any, Dict, List, Mapping, Sequence

def normalize_jwk(jwk_data: Mapping[str, Any]) -> Mapping[str, Any]:
    """
    Normalize a single RSA or EC JWK dictionary.
    - Returns a dict including all reconstructed RSA CRT values when only n/e/d were supplied.
    - Preserves provided RSA values and rejects incomplete CRT sets.
    - Validates EC curve names and coordinate byte lengths.
    - Raises a ValueError (or a library-specific deserialization error) when validation fails.
    """

def normalize_jwk_set(jwks: Sequence[Mapping[str, Any]]) -> Dict[str, List[Mapping[str, Any]]]:
    """
    Normalize multiple JWK entries, preserving order.
    - Returns {"keys": [normalized_jwk, ...]}.
    - Propagates the first validation failure instead of returning partial results.
    """

Dependencies { .dependencies }

josepy { .dependency }

Provides JOSE JWK parsing, RSA CRT reconstruction, and EC curve validation. @satisfied-by