@byearlybird/crypto 0.3.0 → 0.4.0

package/dist/index.d.mts

@@ -10,6 +10,16 @@ type AuthPayload = {
   timestamp: number;
   bodyHash?: string;
 };
+type ParseSuccess = {
+  ok: true;
+  data: AuthPayload;
+  signature: string;
+};
+type ParseFailure = {
+  ok: false;
+  message: string;
+};
+type ParseResult = ParseSuccess | ParseFailure;
 type ValidateSuccess = {
   ok: true;
   data: AuthPayload;
@@ -27,8 +37,8 @@ declare function createAuthHeader(args: {
   serializedBody?: string;
   privateKey: CryptoKey;
 }): Promise<string>;
-declare function validateAuthHeader(header: string, options: {
-  publicKey: CryptoKey;
+declare function parseAuthHeader(header: string): ParseResult;
+declare function validateAuthPayload(payload: AuthPayload, options: {
   vaultId: string;
   method: string;
   path: string;
@@ -57,4 +67,4 @@ declare function bytesToBase64(bytes: Uint8Array): string;
 declare function base64ToBytes(base64: string): Uint8Array;
 declare function hashString(value: string): Promise<string>;
 //#endregion
-export { type AuthPayload, type ValidateFailure, type ValidateResult, type ValidateSuccess, base64ToBytes, bytesToBase64, createAuthHeader, decrypt, deriveVaultId, encrypt, exportEncryptionKey, exportPrivateKey, exportPublicKey, generateEncryptionKey, generateSigningKeyPair, hashString, importEncryptionKey, importPrivateKey, importPublicKey, sign, validateAuthHeader, verify };
+export { AuthPayload, ParseFailure, ParseResult, ParseSuccess, ValidateFailure, ValidateResult, ValidateSuccess, base64ToBytes, bytesToBase64, createAuthHeader, decrypt, deriveVaultId, encrypt, exportEncryptionKey, exportPrivateKey, exportPublicKey, generateEncryptionKey, generateSigningKeyPair, hashString, importEncryptionKey, importPrivateKey, importPublicKey, parseAuthHeader, sign, validateAuthPayload, verify };

package/dist/index.mjs

@@ -54,54 +54,50 @@ async function createAuthHeader(args) {
 	const payload = await generateAuthPayload(payloadArgs);
 	return makeAuthHeader(payload, await sign(makeCanonicalString(payload), privateKey));
 }
-async function validateAuthHeader(header, options) {
-	let parsed;
+function parseAuthHeader(header) {
 	try {
-		parsed = parseAuthHeader(header);
+		return parseAuthHeaderInternal(header);
 	} catch {
 		return {
 			ok: false,
 			message: "Malformed auth header"
 		};
 	}
-	const { signature,...payload } = parsed;
-	if (parsed.vaultId !== options.vaultId) return {
+}
+async function validateAuthPayload(payload, options) {
+	if (payload.vaultId !== options.vaultId) return {
 		ok: false,
 		message: "Vault id mismatch"
 	};
-	if (parsed.method !== options.method) return {
+	if (payload.method !== options.method) return {
 		ok: false,
 		message: "Method mismatch"
 	};
-	if (parsed.pathWithQuery !== options.path) return {
+	if (payload.pathWithQuery !== options.path) return {
 		ok: false,
 		message: "Path mismatch"
 	};
-	if (Math.abs(Date.now() - parsed.timestamp) > options.ttl) return {
+	if (Math.abs(Date.now() - payload.timestamp) > options.ttl) return {
 		ok: false,
 		message: "Expired"
 	};
-	if (parsed.bodyHash) {
+	if (payload.bodyHash) {
 		if (!options.body) return {
 			ok: false,
 			message: "Body hash mismatch"
 		};
 		const serverHash = await hashString(options.body);
-		if (parsed.bodyHash !== serverHash) return {
+		if (payload.bodyHash !== serverHash) return {
 			ok: false,
 			message: "Body hash mismatch"
 		};
 	}
-	if (!await verify(makeCanonicalString(payload), signature, options.publicKey)) return {
-		ok: false,
-		message: "Invalid signature"
-	};
 	return {
 		ok: true,
 		data: payload
 	};
 }
-function parseAuthHeader(header) {
+function parseAuthHeaderInternal(header) {
 	const spaceIdx = header.indexOf(" ");
 	if (spaceIdx === -1) throw new Error("Malformed auth header: missing scheme separator");
 	const scheme = header.slice(0, spaceIdx);
@@ -122,18 +118,21 @@ function parseAuthHeader(header) {
 	if (!vid || !n || !m || !p || !t || !sig) throw new Error("Malformed auth header: missing required params");
 	const timestamp = Number(t);
 	if (Number.isNaN(timestamp)) throw new Error("Malformed auth header: timestamp is not a number");
-	const result = {
+	const data = {
 		scheme,
 		vaultId: vid,
 		nonce: n,
 		method: m,
 		pathWithQuery: p,
-		timestamp,
-		signature: sig
+		timestamp
 	};
 	const bh = params.get("bh");
-	if (bh) result.bodyHash = bh;
-	return result;
+	if (bh) data.bodyHash = bh;
+	return {
+		ok: true,
+		data,
+		signature: sig
+	};
 }
 async function generateAuthPayload(args) {
 	const { serializedBody,...rest } = args;
@@ -211,4 +210,4 @@ async function decrypt(encoded, key) {
 }
 
 //#endregion
-export { base64ToBytes, bytesToBase64, createAuthHeader, decrypt, deriveVaultId, encrypt, exportEncryptionKey, exportPrivateKey, exportPublicKey, generateEncryptionKey, generateSigningKeyPair, hashString, importEncryptionKey, importPrivateKey, importPublicKey, sign, validateAuthHeader, verify };
+export { base64ToBytes, bytesToBase64, createAuthHeader, decrypt, deriveVaultId, encrypt, exportEncryptionKey, exportPrivateKey, exportPublicKey, generateEncryptionKey, generateSigningKeyPair, hashString, importEncryptionKey, importPrivateKey, importPublicKey, parseAuthHeader, sign, validateAuthPayload, verify };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@byearlybird/crypto",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "Lightweight E2EE toolkit for web apps - zero dependencies + vault key security",
 	"type": "module",
 	"license": "MIT",