@absolutejs/auth 0.55.8 → 0.56.0

package/dist/oidc/keys.d.ts

@@ -1,8 +1,17 @@
-export type SigningKey = {
+type SigningKeyIdentity = {
     kid: string;
-    privateJwk: JsonWebKey;
     publicJwk: JsonWebKey;
 };
+/** ES256 signing material can remain local for development or be delegated to
+ * a non-exportable KMS/HSM adapter. External signers return the 64-byte JOSE
+ * ECDSA signature (r || s), not an ASN.1 DER envelope. */
+export type SigningKey = SigningKeyIdentity & ({
+    privateJwk: JsonWebKey;
+    sign?: never;
+} | {
+    privateJwk?: never;
+    sign: (input: Uint8Array) => Promise<Uint8Array>;
+});
 export declare const generateSigningKey: () => Promise<SigningKey>;
 export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
 export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
@@ -23,3 +32,4 @@ export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promis
         [k: string]: any;
     };
 } | undefined>;
+export {};

package/dist/server.js

@@ -3214,6 +3214,7 @@ init_crypto();
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
 var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var ES256_JOSE_SIGNATURE_BYTES = 64;
 var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
 var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
 var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
@@ -3247,9 +3248,18 @@ var jwkThumbprint = async (jwk) => {
   return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
 };
 var signJwt = async (payload, signing, typ = "JWT") => {
-  const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
   const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ })}.${encodeSegment(payload)}`;
-  const signature = await crypto.subtle.sign(ES256, key, ENCODER.encode(input));
+  const encoded = ENCODER.encode(input);
+  let signature;
+  if (signing.sign !== undefined) {
+    signature = await signing.sign(encoded);
+  } else {
+    const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
+    signature = await crypto.subtle.sign(ES256, key, encoded);
+  }
+  if (signature.byteLength !== ES256_JOSE_SIGNATURE_BYTES) {
+    throw new Error("ES256 signer must return a 64-byte JOSE signature");
+  }
   return `${input}.${toBase64Url(signature)}`;
 };
 var toPublicJwk = (key) => ({
@@ -12214,6 +12224,44 @@ var createSecretCipher = (keyMaterial) => ({
   decrypt: (ciphertext) => decryptSecret(ciphertext, keyMaterial),
   encrypt: (plaintext) => encryptSecret(plaintext, keyMaterial)
 });
+var VERSIONED_CIPHERTEXT_PREFIX = "absolute-vault";
+var VERSIONED_CIPHERTEXT_SEGMENTS = 3;
+var parseVersionedCiphertext = (value) => {
+  const [prefix, encodedVersion, ciphertext] = value.split(":", VERSIONED_CIPHERTEXT_SEGMENTS);
+  if (prefix !== VERSIONED_CIPHERTEXT_PREFIX || !encodedVersion || !ciphertext)
+    return null;
+  const version = Number(encodedVersion);
+  if (!Number.isSafeInteger(version) || version < 1)
+    return null;
+  return { ciphertext, version };
+};
+var createVersionedSecretCipher = ({
+  currentVersion,
+  keys,
+  legacyKey
+}) => {
+  if (!Number.isSafeInteger(currentVersion) || currentVersion < 1)
+    throw new Error("Vault key version must be a positive integer");
+  const currentKey = keys[currentVersion];
+  if (!currentKey)
+    throw new Error(`Vault key version ${currentVersion} is unavailable`);
+  return {
+    decrypt: async (value) => {
+      const envelope = parseVersionedCiphertext(value);
+      if (!envelope) {
+        if (!legacyKey)
+          throw new Error("Legacy vault ciphertext key is unavailable");
+        return decryptSecret(value, legacyKey);
+      }
+      const key = keys[envelope.version];
+      if (!key)
+        throw new Error(`Vault key version ${envelope.version} is unavailable`);
+      return decryptSecret(envelope.ciphertext, key);
+    },
+    encrypt: async (plaintext) => `${VERSIONED_CIPHERTEXT_PREFIX}:${currentVersion}:${await encryptSecret(plaintext, currentKey)}`,
+    needsReencryption: (value) => parseVersionedCiphertext(value)?.version !== currentVersion
+  };
+};
 
 // src/vault/config.ts
 var createVault = ({
@@ -12225,7 +12273,15 @@ var createVault = ({
     const entry = await store.getEntry(ownerId, name);
     if (entry === undefined)
       return;
-    return cipher.decrypt(entry.encryptedValue);
+    const plaintext = await cipher.decrypt(entry.encryptedValue);
+    if (cipher.needsReencryption?.(entry.encryptedValue)) {
+      await store.saveEntry({
+        ...entry,
+        encryptedValue: await cipher.encrypt(plaintext),
+        updatedAt: Date.now()
+      });
+    }
+    return plaintext;
   },
   list: async (ownerId) => (await store.listEntries(ownerId)).map((entry) => entry.name),
   put: async (ownerId, name, value) => {
@@ -12249,11 +12305,12 @@ var rotateVaultKey = async ({
   const newCipher = createSecretCipher(newKey);
   const entries = await store.listAllEntries();
   const now = Date.now();
-  for (const entry of entries) {
+  await entries.reduce(async (pending, entry) => {
+    await pending;
     const plaintext = await oldCipher.decrypt(entry.encryptedValue);
     const encryptedValue = await newCipher.encrypt(plaintext);
     await store.saveEntry({ ...entry, encryptedValue, updatedAt: now });
-  }
+  }, Promise.resolve());
   return { rotated: entries.length };
 };
 // src/vault/inMemoryVaultStore.ts
@@ -29614,5 +29671,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=73EC5483BC26C84964756E2164756E21
+//# debugId=15A591E91DD3DB9A64756E2164756E21
 //# sourceMappingURL=server.js.map