@blamejs/pki 0.1.15 → 0.1.17

package/lib/schema-engine.js

@@ -93,39 +93,49 @@ function _assertArity(schema, kids, ctx) {
 // the OID / INTEGER / string reads). `decode(fn)` hands the whole node to fn,
 // which owns its try/catch and code mapping. `any()` yields the node itself.
 
-function oidLeaf()        { return { kind: "leaf", read: asn1.read.oid }; }
-function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer }; }
-function boolean()        { return { kind: "leaf", read: asn1.read.boolean }; }
-function octetString()    { return { kind: "leaf", read: asn1.read.octetString }; }
-function bitString()      { return { kind: "leaf", read: function (n) { var b = asn1.read.bitString(n); return { unusedBits: b.unusedBits, bytes: b.bytes }; } }; }
+// Leaves carry BOTH directions: `read(node) -> value` and `write(value) -> DER TLV`,
+// so a single leaf definition drives decode (walk) and encode (build). A [tag]
+// IMPLICIT leaf's write emits the context-tagged TLV directly, mirroring its read.
+function _implicitIntContent(v) { return asn1.decode(asn1.build.integer(v)).content; }
+function oidLeaf()        { return { kind: "leaf", read: asn1.read.oid, write: function (v) { return asn1.build.oid(v); } }; }
+function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer, write: function (v) { return asn1.build.integer(v); } }; }
+function boolean()        { return { kind: "leaf", read: asn1.read.boolean, write: function (v) { return asn1.build.boolean(v); } }; }
+function octetString()    { return { kind: "leaf", read: asn1.read.octetString, write: function (v) { return asn1.build.octetString(v); } }; }
+function bitString()      { return { kind: "leaf", read: function (n) { var b = asn1.read.bitString(n); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.bitString(v.bytes, v.unusedBits); } }; }
 // A [tag] IMPLICIT BIT STRING leaf (context-class primitive) — the primitive-leaf
 // counterpart to implicitSetOf, for e.g. the PKCS#8 publicKey [1] (RFC 5958 §2).
-function implicitBitString(tag) { return { kind: "leaf", read: function (n) { var b = asn1.read.bitStringImplicit(n, tag); return { unusedBits: b.unusedBits, bytes: b.bytes }; } }; }
+function implicitBitString(tag) { return { kind: "leaf", read: function (n) { var b = asn1.read.bitStringImplicit(n, tag); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.contextPrimitive(tag, Buffer.concat([Buffer.from([v.unusedBits]), v.bytes])); } }; }
 // A [tag] IMPLICIT OCTET STRING leaf (context-class primitive) — the sibling of
 // implicitBitString, for e.g. the CMS SignerIdentifier subjectKeyIdentifier [0]
 // (RFC 5652 §5.3). Yields the raw content bytes.
-function implicitOctetString(tag) { return { kind: "leaf", read: function (n) { return asn1.read.octetStringImplicit(n, tag); } }; }
+function implicitOctetString(tag) { return { kind: "leaf", read: function (n) { return asn1.read.octetStringImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, v); } }; }
 // A [tag] IMPLICIT NULL leaf (context-class primitive, empty content) — the sibling
 // of implicitBitString/implicitOctetString, for e.g. the OCSP CertStatus good [0] /
 // unknown [2] arms (RFC 6960 §4.2.1). Yields null; rejects a constructed or
 // non-empty [tag] node fail-closed.
-function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); } }; }
+function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); }, write: function () { return asn1.build.contextPrimitive(tag, Buffer.alloc(0)); } }; }
 // A [tag] IMPLICIT INTEGER leaf (context-class primitive) — the integer sibling of
 // implicitBitString, for the RFC 3161 Accuracy millis [0] / micros [1] fields
 // (context-tagged primitive INTEGERs). Yields a BigInt; a constructed or wrong-tag
 // node fails asn1/* at the codec.
-function implicitInteger(tag) { return { kind: "leaf", read: function (n) { return asn1.read.integerImplicit(n, tag); } }; }
+function implicitInteger(tag) { return { kind: "leaf", read: function (n) { return asn1.read.integerImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, _implicitIntContent(v)); } }; }
 function any()            { return { kind: "any" }; }
-function decode(fn)       { return { kind: "decode", fn: fn }; }
+// decode(fn, write?): a custom decode leaf; `write` is its optional paired encoder
+// (value -> DER TLV) so the same leaf drives both directions.
+function decode(fn, write) { return { kind: "decode", fn: fn, write: write }; }
 
 // time(ns): a UTCTime / GeneralizedTime value, asserting the tag before the
-// codec reads it (mirrors _parseValidityTime's x509/bad-time guard).
+// codec reads it (mirrors _parseValidityTime's x509/bad-time guard). Encodes as
+// UTCTime for years 1950..2049 and GeneralizedTime otherwise (RFC 5280 §4.1.2.5).
 function time(ns) {
   return decode(function (n, ctx) {
     if (n.tagClass !== "universal" || (n.tagNumber !== TAGS.UTC_TIME && n.tagNumber !== TAGS.GENERALIZED_TIME)) {
       _fail(ctx, ns.prefix + "/bad-time", "time must be UTCTime or GeneralizedTime");
     }
     return asn1.read.time(n);
+  }, function (date) {
+    var y = date.getUTCFullYear();
+    return (y >= 1950 && y < 2050) ? asn1.build.utcTime(date) : asn1.build.generalizedTime(date);
   });
 }
 
@@ -136,6 +146,10 @@ function optional(name, schema, opts) {
   opts = opts || {};
   // How the optional field is recognized at its position:
   //   - default:       a context [tag] (the certificate version [0] shape).
+  //   - tags:          a context tag in the set — an OPTIONAL field whose type is
+  //     itself a CHOICE of several context alternatives, e.g. the CRMF CertReqMsg
+  //     popo ProofOfPossession ([0]..[3]) sitting before the universal-SEQUENCE
+  //     regInfo (RFC 4211 §3), where ANY of the CHOICE's tags marks it present.
   //   - whenUniversal: the next element iff its UNIVERSAL tag is in the set —
   //     the CRL TBSCertList shape (bare INTEGER version, Time nextUpdate,
   //     SEQUENCE revokedCertificates), disambiguated by tag, not a context [n].
@@ -147,7 +161,9 @@ function optional(name, schema, opts) {
     ? function () { return true; }
     : opts.whenUniversal
       ? function (n) { return n.tagClass === "universal" && opts.whenUniversal.indexOf(n.tagNumber) !== -1; }
-      : function (n) { return n.tagClass === "context" && n.tagNumber === opts.tag; };
+      : opts.tags
+        ? function (n) { return n.tagClass === "context" && opts.tags.indexOf(n.tagNumber) !== -1; }
+        : function (n) { return n.tagClass === "context" && n.tagNumber === opts.tag; };
   return { fkind: "optional", name: name, schema: schema, tag: opts.tag, match: match,
            explicit: !!opts.explicit, emptyCode: opts.emptyCode, hasDefault: ("default" in opts), def: opts.default };
 }
@@ -218,7 +234,7 @@ function implicitSeqOf(tag, item, opts) {
  * @primitive  pki.schema.engine.walk
  * @signature  pki.schema.engine.walk(schema, node, ctx) -> value
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       X.690, X.680
  * @related    pki.asn1.decode, pki.schema.x509.parse
  *
@@ -389,6 +405,124 @@ function _consumeTrailing(fld, kids, start, fields, ctx) {
   }
 }
 
+// ---- the encode engine (the inverse of walk) -------------------------
+// encode(schema, value) is the constructor direction of the SAME schema walk
+// decodes: it interprets the schema against a plain structural value and emits
+// canonical DER. A single schema definition therefore drives both directions, so
+// context-tag (EXPLICIT/IMPLICIT) handling cannot diverge between them — the class
+// of bug where a decoder reads a [tag] IMPLICIT field but an ad-hoc encoder emits
+// the wrong tag is structurally retired. Encode errors are authoring faults (a bad
+// value / an un-encodable schema), thrown as plain Errors, not parse verdicts.
+
+function _encFail(message) { throw new Error("schema.encode: " + message); }
+
+/**
+ * @primitive  pki.schema.engine.encode
+ * @signature  pki.schema.engine.encode(schema, value, ctx) -> Buffer
+ * @since      0.1.17
+ * @status     experimental
+ * @spec       X.690, X.680
+ * @related    pki.schema.engine.walk
+ *
+ * Encode a structural value to canonical DER by interpreting the SAME schema
+ * `walk` decodes — the constructor direction. `value` mirrors the schema: a `seq`
+ * takes `{ fieldName: value }`, a leaf its natural JS value (an OID string, a
+ * BigInt, a `{ unusedBits, bytes }` BIT STRING, a `Date`), a `repeat` an array, a
+ * `choice` `{ arm, value }`. EXPLICIT wrappers and IMPLICIT `[tag]` retagging are
+ * applied by the engine, so `walk(schema, decode(encode(schema, v)))` round-trips.
+ *
+ * @example
+ *   var S = pki.schema.engine;
+ *   var der = S.encode(S.seq([S.field("n", S.integerLeaf())]), { n: 42n });
+ */
+function encode(schema, value, ctx) {
+  switch (schema.kind) {
+    case "leaf":     return schema.write(value);
+    case "any":      return Buffer.isBuffer(value) ? value : value.bytes;
+    case "decode":
+      if (typeof schema.write !== "function") _encFail("this decode leaf has no paired encoder (decode(fn, write))");
+      return schema.write(value, ctx);
+    case "seq":      return _encodeSeq(schema, value, ctx);
+    case "explicit": return asn1.build.explicit(schema.tag, encode(schema.schema, value, ctx));
+    case "repeat":   return _encodeRepeat(schema, value, ctx);
+    case "choice":   return _encodeChoice(schema, value, ctx);
+    default:         _encFail("cannot encode schema kind " + JSON.stringify(schema.kind));
+  }
+  return undefined;
+}
+
+function _wrapConstructed(schema, parts) {
+  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
+  var mode = schema.assert || "sequence";
+  if (mode === "set") return asn1.build.set(parts);
+  // "constructed" is a DECODE-time leniency (accept any constructed shape); the
+  // canonical encoding is a universal SEQUENCE, same as "sequence".
+  if (mode === "sequence" || mode === "constructed") return asn1.build.sequence(parts);
+  _encFail("cannot encode a seq/repeat with assert " + JSON.stringify(mode));
+  return undefined;
+}
+
+function _present(v) { return v !== undefined && v !== null; }
+
+function _encodeSeq(schema, value, ctx) {
+  value = value || {};
+  var parts = [];
+  for (var f = 0; f < schema.fields.length; f++) {
+    var fld = schema.fields[f];
+    if (fld.fkind === "required") {
+      parts.push(encode(fld.schema, value[fld.name], ctx));
+    } else if (fld.fkind === "optional") {
+      if (_present(value[fld.name])) {
+        var enc = encode(fld.schema, value[fld.name], ctx);
+        parts.push(fld.explicit ? asn1.build.explicit(fld.tag, enc) : enc);
+      }
+    } else if (fld.fkind === "trailing") {
+      // Emit present members in strictly-increasing tag order (the walk's rule).
+      var members = fld.members.slice().sort(function (a, b) { return a.tag - b.tag; });
+      for (var i = 0; i < members.length; i++) {
+        var mm = members[i];
+        if (_present(value[mm.name])) {
+          var menc = encode(mm.schema, value[mm.name], ctx);
+          parts.push(mm.explicit ? asn1.build.explicit(mm.tag, menc) : menc);
+        }
+      }
+    }
+  }
+  return _wrapConstructed(schema, parts);
+}
+
+function _encodeRepeat(schema, items, ctx) {
+  if (!Array.isArray(items)) _encFail("a repeat value must be an array");
+  // Enforce the SAME constraints walk enforces, so encode never emits DER its own
+  // decoder rejects (the walk(decode(encode)) invariant): the SIZE minimum, and
+  // semantic uniqueness (the key computed exactly as walk does, off the round-tripped
+  // item — a duplicate is an authoring fault, not a parse verdict).
+  if (schema.min != null && items.length < schema.min) {
+    _encFail("this repeat requires at least " + schema.min + " element(s) but got " + items.length);
+  }
+  var parts = items.map(function (it) { return encode(schema.item, it, ctx); });
+  if (schema.unique) {
+    var seen = new Set();
+    parts.forEach(function (tlv) {
+      var item = { node: asn1.decode(tlv) };
+      item.value = walk(schema.item, item.node, ctx);
+      var key = schema.unique(item);
+      if (seen.has(key)) _encFail("this repeat requires unique elements but got a duplicate key: " + key);
+      seen.add(key);
+    });
+  }
+  if (schema.derSetOrder) parts = parts.slice().sort(Buffer.compare);
+  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
+  return schema.assert === "set" ? asn1.build.set(parts) : asn1.build.sequence(parts);
+}
+
+function _encodeChoice(schema, value, ctx) {
+  if (!value || typeof value.arm !== "number" || value.arm < 0 || value.arm >= schema.alts.length) {
+    _encFail("a choice value must be { arm: <index>, value: <arm value> }");
+  }
+  return encode(schema.alts[value.arm].schema, value.value, ctx);
+}
+
 module.exports = {
   // structural
   seq: seq, field: field, optional: optional, explicit: explicit, trailing: trailing,
@@ -399,5 +533,5 @@ module.exports = {
   implicitNull: implicitNull, implicitInteger: implicitInteger,
   any: any, decode: decode, time: time,
   // engine
-  walk: walk,
+  walk: walk, encode: encode,
 };

package/lib/schema-ocsp.js

@@ -425,7 +425,7 @@ var OCSP_REQUEST = schema.seq([
  * @primitive  pki.schema.ocsp.parseRequest
  * @signature  pki.schema.ocsp.parseRequest(input) -> ocspRequest
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6960
  * @related    pki.schema.ocsp.parseResponse, pki.schema.parse
  *
@@ -447,7 +447,7 @@ var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemErro
  * @primitive  pki.schema.ocsp.parseResponse
  * @signature  pki.schema.ocsp.parseResponse(input) -> ocspResponse
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6960
  * @related    pki.schema.ocsp.parseRequest, pki.schema.parse
  *
@@ -471,7 +471,7 @@ var parseResponse = pkix.makeParser({ pemLabel: "OCSP RESPONSE", PemError: PemEr
  * @primitive  pki.schema.ocsp.pemDecode
  * @signature  pki.schema.ocsp.pemDecode(text, label?) -> Buffer
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 6960
  * @related    pki.schema.ocsp.parseResponse
  *

package/lib/schema-pkcs8.js

@@ -102,7 +102,7 @@ var ENCRYPTED_PRIVATE_KEY_INFO = schema.seq([
  * @primitive  pki.schema.pkcs8.parse
  * @signature  pki.schema.pkcs8.parse(input) -> privateKey
  * @since      0.1.9
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5208, RFC 5958
  * @related    pki.schema.parse, pki.schema.x509.parse
  *
@@ -124,7 +124,7 @@ var parse = pkix.makeParser({ pemLabel: "PRIVATE KEY", PemError: PemError, Error
  * @primitive  pki.schema.pkcs8.parseEncrypted
  * @signature  pki.schema.pkcs8.parseEncrypted(input) -> encrypted
  * @since      0.1.9
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5958, RFC 5208
  * @related    pki.schema.pkcs8.parse
  *
@@ -143,7 +143,7 @@ var parseEncrypted = pkix.makeParser({ pemLabel: "ENCRYPTED PRIVATE KEY", PemErr
  * @primitive  pki.schema.pkcs8.pemDecode
  * @signature  pki.schema.pkcs8.pemDecode(text, label?) -> Buffer
  * @since      0.1.9
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5958
  * @related    pki.schema.pkcs8.parse
  *
@@ -160,7 +160,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "PRIVATE
  * @primitive  pki.schema.pkcs8.pemEncode
  * @signature  pki.schema.pkcs8.pemEncode(der, label?) -> string
  * @since      0.1.9
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.pkcs8.pemDecode
  *