feat: removes atob usage and fixes #24

package.json

@@ -10,6 +10,7 @@
     "test": "cross-env NODE_OPTIONS=--experimental-vm-modules vitest run"
   },
   "dependencies": {
+    "@cfworker/base64url": "^1.12.5",
     "@tsndr/cloudflare-worker-jwt": "^2.5.1",
     "itty-router": "^4.0.27",
     "zod": "^3.22.4"

src/auth.ts

@@ -1,3 +1,5 @@
+import { decode } from "@cfworker/base64url";
+
 export type RegistryTokenCapability = "push" | "pull";
 export type RegistryAuthProtocolTokenPayload = {
   username: string;
@@ -38,10 +40,7 @@ export function stripUsernamePasswordFromHeader(r: Request): [string, string] |
   }
 
   // Decodes the base64 value and performs unicode normalization.
-  // @see https://datatracker.ietf.org/doc/html/rfc7613#section-3.3.2 (and #section-4.2.2)
-  // @see https://dev.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String/normalize
-  const buffer = Uint8Array.from(atob(encoded), (character) => character.charCodeAt(0));
-  const decoded = new TextDecoder().decode(buffer).normalize();
+  const decoded = decode(encoded);
 
   // The username & password are split by the first colon.
   //=> example: "username:password"

src/token.ts

@@ -1,3 +1,4 @@
+import { decode } from "@cfworker/base64url";
 import jwt from "@tsndr/cloudflare-worker-jwt";
 import {
   RegistryTokenCapability,
@@ -8,11 +9,7 @@ import {
 
 export function importKeyFromBase64(key: string): JsonWebKey {
   // Decodes the base64 value and performs unicode normalization.
-  // @see https://datatracker.ietf.org/doc/html/rfc7613#section-3.3.2 (and #section-4.2.2)
-  // @see https://dev.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String/normalize
-  const buffer = Uint8Array.from(atob(key), (character) => character.charCodeAt(0));
-  const decoded = new TextDecoder().decode(buffer).normalize();
-  return JSON.parse(decoded);
+  return JSON.parse(decode(key));
 }
 
 export async function newRegistryTokens(jwtPublicKey: string): Promise<RegistryTokens> {