@blamejs/pki 0.6.38 → 0.6.40

package/lib/guard-list.js

@@ -4,6 +4,21 @@
 // @internal
 
 var _freeze = require("./guard-intrinsic").freeze;
+var _defineProperty = require("./guard-intrinsic").defineProperty;
+var _isArray = require("./guard-intrinsic").isArray;
+
+var MAX_ARRAY_LENGTH = 4294967295;
+
+// @enforced-by guard-shape-reinlined
+// @guard-shape defineProperty\(\s*\w+\s*,\s*\w+\.length\s*,\s*\{\s*value:
+// @guard-via guard\.list\.append\(
+function append(list, value) {
+  if (!_isArray(list)) throw new TypeError("guard.list.append: the receiver must be an array");
+  var n = list.length;
+  if (n >= MAX_ARRAY_LENGTH) throw new RangeError("guard.list.append: the array is at its maximum length");
+  _defineProperty(list, n, { value: value, writable: true, enumerable: true, configurable: true });
+  return list;
+}
 
 // @enforced-by behavioral -- `.indexOf(x) !== -1` has no rename-proof form that separates a
 function contains(list, value) {
@@ -34,6 +49,7 @@ function allMatch(list, predicate) {
 }
 
 module.exports = _freeze({
+  append: append,
   contains: contains,
   containsAll: containsAll,
   anyMatches: anyMatches,

package/lib/guard-parsed.js

@@ -20,7 +20,7 @@ var _weakSet = require("./guard-intrinsic").weakSet;
 var _weakHas = require("./guard-intrinsic").weakHas;
 var _WeakMap = require("./guard-intrinsic").WeakMap;
 var _defineProperty = require("./guard-intrinsic").defineProperty;
-function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
+var _append = require("./guard-list").append;
 
 function _isBytes(x) {
   return bytes.isByteSource(x);

package/lib/guard-verdict.js

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+// @internal
+
+var _freeze = require("./guard-intrinsic").freeze;
+var _keys = require("./guard-intrinsic").keys;
+var _defineProperty = require("./guard-intrinsic").defineProperty;
+var _getOwnPropertyDescriptor = require("./guard-intrinsic").getOwnPropertyDescriptor;
+var _hasOwn = require("./guard-intrinsic").hasOwn;
+var _Object = require("./guard-intrinsic").Object;
+
+function _copyOwn(out, src) {
+  var keys = _keys(src);
+  for (var i = 0; i < keys.length; i++) {
+    var d = _getOwnPropertyDescriptor(src, keys[i]);
+    if (!d) continue;
+    var value = _hasOwn(d, "value") ? d.value : src[keys[i]];
+    _defineProperty(out, keys[i], { value: value, enumerable: true, configurable: true, writable: true });
+  }
+}
+
+// @enforced-by behavioral -- the defect is the ABSENCE of this call at a construction site, not a
+function of(src, extras) {
+  var out = {};
+  _copyOwn(out, src);
+  if (extras != null) _copyOwn(out, extras);
+  /** @internal Resolving a promise reads `then` off the value, so an inherited accessor would run
+   * with the verdict as its receiver and could rewrite a field or hand the caller a different
+   * object. An own `then` ends that lookup, and is non-enumerable so keys, JSON, a spread and a
+   * deep-equality comparison do not see it. */
+  _defineProperty(out, "then", { value: undefined, enumerable: false, configurable: true, writable: true });
+  return out;
+}
+
+// @enforced-by behavioral -- Object.hasOwn and hasOwnProperty are replaceable at any time, and a
+function carries(obj, key) {
+  return obj != null && _hasOwn(_Object(obj), key);
+}
+
+// @enforced-by behavioral -- for a target that cannot be rebuilt, an Error carrying a field a
+function set(target, key, value) {
+  _defineProperty(target, key, { value: value, enumerable: true, configurable: true, writable: true });
+  return target;
+}
+
+module.exports = _freeze({ of: of, carries: carries, set: set });

package/lib/ip-utils.js

@@ -15,7 +15,7 @@ var _bufferFrom = intrinsic.bufferFrom;
 var _bufferAlloc = intrinsic.bufferAlloc;
 var _defineProperty = intrinsic.defineProperty;
 var _Number = intrinsic.Number;
-function _push(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
+var _push = require("./guard-list").append;
 function _splitOn(str, sep) {
   var out = [], from = 0, at;
   while ((at = _indexOf(str, sep, from)) !== -1) { _push(out, _slice(str, from, at)); from = at + sep.length; }

package/lib/ocsp-verify.js

@@ -121,19 +121,33 @@ function makeOcspVerify(deps) {
 
   function isOctetAligned(bitString) { return !!bitString && bitString.unusedBits === 0; }
 
+  /**
+   * @internal Every field the callers decide on is present on every return, so a field an early
+   * return would have left absent is read from the response that was evaluated rather than from
+   * whatever a polluted Object.prototype answers: a rejected response would otherwise be able to
+   * report `sawGood`, and a certificate with no authoritative response would read as good.
+   */
+  function _evaluation(extras) {
+    return guard.verdict.of({
+      applicable: false, matched: false, responderAuthorized: false, signatureValid: false,
+      revoked: null, sawGood: false, sawUnknownStatus: false,
+      thisUpdate: null, nextUpdate: null, reason: "",
+    }, extras);
+  }
+
   async function evaluateResponse(resp, cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical) {
-    if (resp.responseStatus.code !== 0) return { applicable: false, matched: false, reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" };
+    if (resp.responseStatus.code !== 0) return _evaluation({ reason: "non-successful OCSP responseStatus (" + resp.responseStatus.code + ")" });
     var br = resp.basicResponse;
-    if (!br) return { applicable: false, matched: false, reason: "successful OCSP response carries no BasicOCSPResponse" };
+    if (!br) return _evaluation({ reason: "successful OCSP response carries no BasicOCSPResponse" });
     var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
-    if (!signerSpki) return { applicable: true, matched: false, responderAuthorized: false, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" };
+    if (!signerSpki) return _evaluation({ applicable: true, reason: "no authorized OCSP responder signs this response (RFC 6960 sec. 4.2.2.2)" });
     if (!(await verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) {
-      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: false, reason: "the OCSP response signature does not verify over tbsResponseData" };
+      return _evaluation({ applicable: true, responderAuthorized: true, reason: "the OCSP response signature does not verify over tbsResponseData" });
     }
     if (ocspHasCriticalExtension(br.responseExtensions)) {
-      return { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, reason: "the OCSP response carries an unrecognized critical extension" };
+      return _evaluation({ applicable: true, responderAuthorized: true, signatureValid: true, reason: "the OCSP response carries an unrecognized critical extension" });
     }
-    var out = { applicable: true, matched: false, responderAuthorized: true, signatureValid: true, revoked: null, sawGood: false, sawUnknownStatus: false, reason: "no current SingleResponse names this certificate" };
+    var out = _evaluation({ applicable: true, responderAuthorized: true, signatureValid: true, reason: "no current SingleResponse names this certificate" });
     for (var s = 0; s < br.responses.length; s++) {
       var sr = br.responses[s];
       if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;

package/lib/ocsp.js

@@ -374,7 +374,7 @@ function buildErrorResponse(status) {
 
 /**
  * @primitive pki.ocsp.verify
- * @signature pki.ocsp.verify(response, opts) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>
+ * @signature pki.ocsp.verify(response, opts) -> Promise<{ valid, status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>
  * @since 0.2.22
  * @status stable
  * @spec RFC 6960, RFC 9654, RFC 5019
@@ -389,6 +389,11 @@ function buildErrorResponse(status) {
  * unauthorized, stale, or CertID-mismatched response is a `"unknown"` verdict (never a silent
  * accept); a malformed response's parse fault surfaces as the parser's `ocsp/*` / `asn1/*`.
  *
+ * `valid` is the toolkit-wide verdict alias the other verify verbs carry, and it is true only when
+ * `status` is `"good"`. Because every failure this verb detects already collapses to `"unknown"`,
+ * `valid` states exactly what `status === "good"` does and hides no unrun check. A revoked
+ * certificate is `valid: false`; which of the two it was stays in `status`.
+ *
  * The request-nonce check is reported, and downgrades `good` alone. Every verdict carries
  * `nonceMatched` (true / false / null when the client sent no nonce). An unmatched nonce turns a
  * `good` into `"unknown"`, because a response that is not an answer to this request cannot be relied
@@ -437,16 +442,20 @@ function verify(response, opts) {
     time = opts.time == null ? new Date() : _asDate(opts.time);
   } catch (e) { return Promise.reject(e); }
   return pathValidate.verifyOcspResponse(parsed, cert, issuerCert, time, { historicalMode: opts.historicalMode === true }).then(function (verdict) {
-    if (opts.requestNonce == null) return Object.assign({}, verdict, { nonceMatched: null });
-    var respNonce = _responseNonce(parsed);
-    var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
-      ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
-    var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
-    var out = Object.assign({}, verdict, { nonceMatched: matched });
-    if (!matched && verdict.status === "good") {
-      return Object.assign(out, { status: "unknown", reason: "the OCSP response nonce does not echo the request nonce (RFC 9654)" });
+    var out;
+    if (opts.requestNonce == null) {
+      out = guard.verdict.of(verdict, { nonceMatched: null });
+    } else {
+      var respNonce = _responseNonce(parsed);
+      var reqNonce = guard.bytes.isByteSource(opts.requestNonce)
+        ? guard.bytes.snapshotSource(opts.requestNonce, OcspError, "ocsp/bad-input", "opts.requestNonce") : null;
+      var matched = respNonce != null && reqNonce != null && guard.crypto.constantTimeEqual(respNonce, reqNonce);
+      out = guard.verdict.of(verdict, { nonceMatched: matched });
+      if (!matched && out.status === "good") {
+        out = guard.verdict.of(out, { status: "unknown", reason: "the OCSP response nonce does not echo the request nonce (RFC 9654)" });
+      }
     }
-    return out;
+    return guard.verdict.of(out, { valid: out.status === "good" });
   });
 }
 function _responseNonce(parsed) {
@@ -462,7 +471,7 @@ function _requestFromBytes(request) {
   return ocspSchema.parseRequest(request);
 }
 function _reqVerdict(parsed, extra) {
-  return {
+  return guard.verdict.of({
     valid: extra.signed === true && extra.signatureValid === true,
     signed: extra.signed, signatureValid: extra.signatureValid,
     signerCert: extra.signerCert != null ? extra.signerCert : null,
@@ -472,7 +481,7 @@ function _reqVerdict(parsed, extra) {
     requestorName: parsed.requestorName, requestList: parsed.requestList,
     requestExtensions: parsed.requestExtensions, version: parsed.version,
     reason: extra.reason != null ? extra.reason : null,
-  };
+  });
 }
 async function _findRequestSigners(candidates, strict, parsed, sig, sigBits) {
   var parsedList = [];