From 85542125a0675097085c999326608fcf604a9335 Mon Sep 17 00:00:00 2001
From: Jacob Lee <jacob@phantom.app>
Date: Tue, 30 Sep 2025 21:10:56 +0000
Subject: [PATCH 1/2] feat(jose-jwk): add missing RFC 7515 claims

1. Add missing `jku` and `x5u` claims
2. Implement `Deref` and `DerefMut` for `Protected`
---
 jose-jws/src/head.rs | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/jose-jws/src/head.rs b/jose-jws/src/head.rs
index fe480a3..87029df 100644
--- a/jose-jws/src/head.rs
+++ b/jose-jws/src/head.rs
@@ -3,6 +3,7 @@
 
 use alloc::vec::Vec;
 use alloc::{boxed::Box, string::String};
+use core::ops::{Deref, DerefMut};
 
 use jose_b64::base64ct::Base64;
 use jose_b64::serde::Bytes;
@@ -51,6 +52,20 @@ impl Default for Protected {
     }
 }
 
+impl Deref for Protected {
+    type Target = Unprotected;
+
+    fn deref(&self) -> &Self::Target {
+        &self.oth
+    }
+}
+
+impl DerefMut for Protected {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.oth
+    }
+}
+
 /// The JWS Unprotected Header
 #[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct Unprotected {
@@ -58,6 +73,10 @@ pub struct Unprotected {
     #[serde(skip_serializing_if = "Option::is_none", default)]
     pub alg: Option<Signing>,
 
+    /// RFC 7515 Section 4.1.2
+    #[serde(skip_serializing_if = "Option::is_none", default)]
+    pub jku: Option<String>,
+
     /// RFC 7515 Section 4.1.3
     #[serde(skip_serializing_if = "Option::is_none", default)]
     pub jwk: Option<Jwk>,
@@ -66,6 +85,10 @@ pub struct Unprotected {
     #[serde(skip_serializing_if = "Option::is_none", default)]
     pub kid: Option<String>,
 
+    /// RFC 7515 Section 4.1.5
+    #[serde(skip_serializing_if = "Option::is_none", default)]
+    pub x5u: Option<String>,
+
     /// RFC 7515 Section 4.1.6
     #[serde(skip_serializing_if = "Option::is_none", default)]
     pub x5c: Option<Vec<Bytes<Box<[u8]>, Base64>>>, // base64, not base64url

From 1b8f53caedd3ce16dc2bd44ac42f01deb4072a73 Mon Sep 17 00:00:00 2001
From: Jacob Lee <jacob@phantom.app>
Date: Mon, 6 Oct 2025 19:15:02 +0000
Subject: [PATCH 2/2] remove deref

---
 jose-jws/src/head.rs | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/jose-jws/src/head.rs b/jose-jws/src/head.rs
index 87029df..b8d1970 100644
--- a/jose-jws/src/head.rs
+++ b/jose-jws/src/head.rs
@@ -3,7 +3,6 @@
 
 use alloc::vec::Vec;
 use alloc::{boxed::Box, string::String};
-use core::ops::{Deref, DerefMut};
 
 use jose_b64::base64ct::Base64;
 use jose_b64::serde::Bytes;
@@ -52,20 +51,6 @@ impl Default for Protected {
     }
 }
 
-impl Deref for Protected {
-    type Target = Unprotected;
-
-    fn deref(&self) -> &Self::Target {
-        &self.oth
-    }
-}
-
-impl DerefMut for Protected {
-    fn deref_mut(&mut self) -> &mut Self::Target {
-        &mut self.oth
-    }
-}
-
 /// The JWS Unprotected Header
 #[derive(Clone, Debug, Default, Serialize, Deserialize)]
 pub struct Unprotected {