Use Webcrypto for nodejs as well

[seriousme]

I noticed that this project uses 2 source trees for the runtime:

• https://github.com/panva/jose/tree/main/src/runtime/browser
• https://github.com/panva/jose/tree/main/src/runtime/node

However NodeJS as of v18.17 has full support for Webcrypto

v20.0.0, v18.17.0 Arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations.
https://nodejs.org/docs/latest/api/webcrypto.html#web-crypto-api -> history

Maybe its an idea to remove the special handing of node:crypto and switch to webcrypto for Nodejs as well.
I replaced runtime/node by a symlink to runtime/browser, ran:

• npm run build:browser
• npm run build:node-esm
• npm run build:node-cjs
• npm run tap:node

and all tests passed.

I also noticed:

jose/.node_flags.sh

Lines 7 to 9 in 8916c26

	if [[ $NODE_VERSION -eq 18 ]]; then
	export NODE_OPTIONS+=' --experimental-global-webcrypto'
	fi

Which is not so relevant anymore ;-)

Kind regards,
Hans

[panva]

Hello @seriousme

Your assessment is somewhat incorrect.

The plan is to drop the Node.js special handling in a new major release when all Active / Maintained Node.js LTS releases have WebCryptoAPI non-experimental and global-enabled. The earliest that statement is true is April 2025 (https://github.com/nodejs/Release/) since LTS/18 does not have webcrypto enabled as global (which is why that test flag IS relevant and needed)

[seriousme]

I just tried 18.20.4:

$ node
Welcome to Node.js v18.20.4.
Type ".help" for more information.
> const { subtle} = crypto;
undefined
> subtle
SubtleCrypto {}
> 

[panva]

It's a bit more nuanced than opening node's eval. Only starting with Node.js 19.x does Node.js have the right globals

node --print SubtleCrypto

[seriousme]

Interesting! You are right, in a script it behaves differently.
I learned something new, thanks for that.