@catbee/utils 2.0.1 → 2.0.3

package/crypto/index.mjs

@@ -22,7 +22,7 @@
  * SOFTWARE.
  */
 
-import { pbkdf2, scrypt, createHmac, createHash, randomBytes, timingSafeEqual, createCipheriv, createDecipheriv } from 'crypto';
+import { pbkdf2, scrypt, webcrypto, createHmac, createHash, randomBytes, timingSafeEqual, createCipheriv, createDecipheriv } from 'crypto';
 import { promisify } from 'util';
 import { uuid } from '@catbee/utils/id';
 
@@ -54,6 +54,287 @@ function md5(input) {
   return hash("md5", input);
 }
 __name(md5, "md5");
+var DEFAULT_SIGNATURE_ENCODING = "base64url";
+var subtle = globalThis.crypto?.subtle ?? webcrypto.subtle;
+function getDigestLength(hash2) {
+  switch (hash2) {
+    case "SHA-256":
+      return 32;
+    case "SHA-384":
+      return 48;
+    case "SHA-512":
+      return 64;
+    default:
+      return 32;
+  }
+}
+__name(getDigestLength, "getDigestLength");
+function resolveKeyAlgorithm({ type = "RSA-PSS", modulusLength = 2048, hash: hash2 = "SHA-256", namedCurve = "P-256" }) {
+  switch (type) {
+    case "RSA":
+      if (!Number.isInteger(modulusLength) || modulusLength < 2048) {
+        throw new Error("RSA modulusLength must be an integer greater than or equal to 2048");
+      }
+      return {
+        name: "RSASSA-PKCS1-v1_5",
+        modulusLength,
+        publicExponent: new Uint8Array([
+          1,
+          0,
+          1
+        ]),
+        hash: hash2
+      };
+    case "RSA-PSS":
+      if (!Number.isInteger(modulusLength) || modulusLength < 2048) {
+        throw new Error("RSA-PSS modulusLength must be an integer greater than or equal to 2048");
+      }
+      return {
+        name: "RSA-PSS",
+        modulusLength,
+        publicExponent: new Uint8Array([
+          1,
+          0,
+          1
+        ]),
+        hash: hash2
+      };
+    case "ECDSA":
+      return {
+        name: "ECDSA",
+        namedCurve
+      };
+    case "Ed25519":
+      return {
+        name: "Ed25519"
+      };
+    default:
+      throw new Error(`Unsupported key type: ${type}. Supported types: RSA, RSA-PSS, ECDSA, Ed25519`);
+  }
+}
+__name(resolveKeyAlgorithm, "resolveKeyAlgorithm");
+function toBase64(buffer) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(buffer).toString("base64");
+  }
+  let binary = "";
+  const bytes = new Uint8Array(buffer);
+  const chunkSize = 32768;
+  for (let i = 0; i < bytes.length; i += chunkSize) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + chunkSize));
+  }
+  return btoa(binary);
+}
+__name(toBase64, "toBase64");
+function toPEM(base64, type, formatPemLines, addPrefixSuffix) {
+  const formattedBase64 = formatPemLines ? base64.match(/.{1,64}/g)?.join("\n") ?? base64 : base64;
+  if (!addPrefixSuffix) {
+    return formattedBase64;
+  }
+  const prefix = `-----BEGIN ${type}-----`;
+  const suffix = `-----END ${type}-----`;
+  return `${prefix}
+${formattedBase64}
+${suffix}`;
+}
+__name(toPEM, "toPEM");
+function fromPEM(pem) {
+  const trimmedPem = pem.trim();
+  const format = trimmedPem.includes("BEGIN PRIVATE KEY") ? "pkcs8" : trimmedPem.includes("BEGIN PUBLIC KEY") ? "spki" : void 0;
+  if (!format) {
+    throw new Error("Unsupported PEM format. Expected PUBLIC KEY or PRIVATE KEY PEM block");
+  }
+  const base64 = trimmedPem.replace(/-----BEGIN [A-Z ]+-----/g, "").replace(/-----END [A-Z ]+-----/g, "").replace(/\s+/g, "");
+  return {
+    format,
+    binary: toArrayBuffer(Buffer.from(base64, "base64"))
+  };
+}
+__name(fromPEM, "fromPEM");
+function toBinary(data, encoding = "utf8") {
+  if (typeof data === "string") {
+    return Uint8Array.from(Buffer.from(data, encoding));
+  }
+  if (Buffer.isBuffer(data)) {
+    return Uint8Array.from(data);
+  }
+  return data;
+}
+__name(toBinary, "toBinary");
+function toArrayBuffer(data) {
+  const byteView = data instanceof Uint8Array ? data : Uint8Array.from(data);
+  const copy = new Uint8Array(byteView.byteLength);
+  copy.set(byteView);
+  return copy.buffer;
+}
+__name(toArrayBuffer, "toArrayBuffer");
+function inferKeyTypeFromJwk(jwk, fallback) {
+  if (fallback) {
+    return fallback;
+  }
+  const keyType = typeof jwk.kty === "string" ? jwk.kty : void 0;
+  const curve = typeof jwk.crv === "string" ? jwk.crv : void 0;
+  const algorithm = typeof jwk.alg === "string" ? jwk.alg : void 0;
+  if (keyType === "OKP" && curve === "Ed25519") {
+    return "Ed25519";
+  }
+  if (keyType === "EC") {
+    return "ECDSA";
+  }
+  if (keyType === "RSA") {
+    return algorithm?.startsWith("PS") ? "RSA-PSS" : "RSA";
+  }
+  throw new Error("Unable to infer key type from JWK. Provide import options with an explicit type");
+}
+__name(inferKeyTypeFromJwk, "inferKeyTypeFromJwk");
+function resolveDefaultUsages(format, usages) {
+  return usages ?? (format === "pkcs8" ? [
+    "sign"
+  ] : [
+    "verify"
+  ]);
+}
+__name(resolveDefaultUsages, "resolveDefaultUsages");
+function inferJwkUsages(jwk, usages) {
+  if (usages) {
+    return usages;
+  }
+  if (Array.isArray(jwk.key_ops)) {
+    const inferredFromKeyOps = jwk.key_ops.filter((usage) => usage === "sign" || usage === "verify");
+    if (inferredFromKeyOps.length === 0) {
+      throw new Error("JWK key_ops must include at least one of sign or verify when provided");
+    }
+    return inferredFromKeyOps;
+  }
+  if (typeof jwk.d === "string" && jwk.d.length > 0) {
+    return [
+      "sign"
+    ];
+  }
+  return [
+    "verify"
+  ];
+}
+__name(inferJwkUsages, "inferJwkUsages");
+function resolveSignAlgorithm(key, options = {}) {
+  const hash2 = options.hash ?? "SHA-256";
+  switch (key.algorithm.name) {
+    case "RSASSA-PKCS1-v1_5":
+      return "RSASSA-PKCS1-v1_5";
+    case "RSA-PSS": {
+      const keyAlgorithm = key.algorithm;
+      const pssHash = options.hash ?? keyAlgorithm.hash.name;
+      return {
+        name: "RSA-PSS",
+        saltLength: options.saltLength ?? getDigestLength(pssHash)
+      };
+    }
+    case "ECDSA":
+      return {
+        name: "ECDSA",
+        hash: hash2
+      };
+    case "Ed25519":
+      return "Ed25519";
+    default:
+      throw new Error(`Unsupported signing key algorithm: ${key.algorithm.name}`);
+  }
+}
+__name(resolveSignAlgorithm, "resolveSignAlgorithm");
+function arrayBufferToBuffer(buffer) {
+  return Buffer.from(buffer);
+}
+__name(arrayBufferToBuffer, "arrayBufferToBuffer");
+async function generateKeys(options = {}) {
+  const { type = "RSA-PSS", modulusLength = 2048, hash: hash2 = "SHA-256", namedCurve = "P-256", extractable = false, includeCryptoKeys = false, formatPemLines = true, addPrefixSuffix = true } = options;
+  const algorithm = resolveKeyAlgorithm({
+    type,
+    modulusLength,
+    hash: hash2,
+    namedCurve
+  });
+  const usages = [
+    "sign",
+    "verify"
+  ];
+  const keyPair = await subtle.generateKey(algorithm, extractable, usages);
+  const [publicKeyBuf, privateKeyBuf] = await Promise.all([
+    subtle.exportKey("spki", keyPair.publicKey),
+    extractable ? subtle.exportKey("pkcs8", keyPair.privateKey) : Promise.resolve(void 0)
+  ]);
+  const publicKeyBase64 = toBase64(publicKeyBuf);
+  const privateKeyBase64 = privateKeyBuf ? toBase64(privateKeyBuf) : void 0;
+  const result = {
+    type,
+    publicKey: toPEM(publicKeyBase64, "PUBLIC KEY", formatPemLines, addPrefixSuffix),
+    publicKeyBuffer: publicKeyBuf
+  };
+  if (privateKeyBase64 && privateKeyBuf) {
+    result.privateKey = toPEM(privateKeyBase64, "PRIVATE KEY", formatPemLines, addPrefixSuffix);
+    result.privateKeyBuffer = privateKeyBuf;
+  }
+  if (includeCryptoKeys) {
+    result.privateKeyCrypto = keyPair.privateKey;
+    result.publicKeyCrypto = keyPair.publicKey;
+  }
+  return result;
+}
+__name(generateKeys, "generateKeys");
+async function sign(data, privateKeyCrypto, options = {}) {
+  const algorithm = resolveSignAlgorithm(privateKeyCrypto, options);
+  const signature = await subtle.sign(algorithm, privateKeyCrypto, toArrayBuffer(toBinary(data, options.inputEncoding)));
+  return arrayBufferToBuffer(signature).toString(options.outputEncoding ?? DEFAULT_SIGNATURE_ENCODING);
+}
+__name(sign, "sign");
+async function verify(data, signature, publicKeyCrypto, options = {}) {
+  const algorithm = resolveSignAlgorithm(publicKeyCrypto, options);
+  const signatureBytes = typeof signature === "string" ? Uint8Array.from(Buffer.from(signature, options.signatureEncoding ?? DEFAULT_SIGNATURE_ENCODING)) : toBinary(signature);
+  return subtle.verify(algorithm, publicKeyCrypto, toArrayBuffer(signatureBytes), toArrayBuffer(toBinary(data, options.inputEncoding)));
+}
+__name(verify, "verify");
+async function importKey(key, options = {}) {
+  const extractable = options.extractable ?? false;
+  if (typeof key === "string") {
+    if (!options.type) {
+      throw new Error("Key type is required when importing PEM keys");
+    }
+    const { format, binary } = fromPEM(key);
+    const algorithm2 = resolveKeyAlgorithm({
+      type: options.type,
+      hash: options.hash,
+      namedCurve: options.namedCurve
+    });
+    return subtle.importKey(format, binary, algorithm2, extractable, resolveDefaultUsages(format, options.usages));
+  }
+  const keyType = inferKeyTypeFromJwk(key, options.type);
+  const algorithm = resolveKeyAlgorithm({
+    type: keyType,
+    hash: options.hash,
+    namedCurve: options.namedCurve
+  });
+  return subtle.importKey("jwk", key, algorithm, extractable, inferJwkUsages(key, options.usages));
+}
+__name(importKey, "importKey");
+async function exportKey(key, format = "jwk", options = {}) {
+  if (format === "jwk") {
+    return subtle.exportKey("jwk", key);
+  }
+  const binary = key.type === "private" ? await subtle.exportKey("pkcs8", key) : await subtle.exportKey("spki", key);
+  return toPEM(toBase64(binary), key.type === "private" ? "PRIVATE KEY" : "PUBLIC KEY", options.formatPemLines ?? true, options.addPrefixSuffix ?? true);
+}
+__name(exportKey, "exportKey");
+async function fingerprint(publicKey, encoding = "base64url") {
+  if (publicKey.type !== "public") {
+    throw new Error("fingerprint requires a public key");
+  }
+  const spki = await subtle.exportKey("spki", publicKey);
+  return createHash("sha256").update(arrayBufferToBuffer(spki)).digest(encoding);
+}
+__name(fingerprint, "fingerprint");
+async function getKeyId(publicKey) {
+  return fingerprint(publicKey, "base64url");
+}
+__name(getKeyId, "getKeyId");
 function randomString() {
   return sha256(uuid());
 }
@@ -208,4 +489,4 @@ async function verifyPassword(password, hash2) {
 }
 __name(verifyPassword, "verifyPassword");
 
-export { createSignedToken, decrypt, encrypt, generateApiKey, generateNonce, generateRandomBytes, generateRandomBytesAsString, hash, hashPassword, hmac, md5, pbkdf2Hash, randomString, safeCompare, secureRandomInt, sha1, sha256, sha256Hmac, verifyPassword, verifySignedToken };
+export { createSignedToken, decrypt, encrypt, exportKey, fingerprint, generateApiKey, generateKeys, generateNonce, generateRandomBytes, generateRandomBytesAsString, getKeyId, hash, hashPassword, hmac, importKey, md5, pbkdf2Hash, randomString, safeCompare, secureRandomInt, sha1, sha256, sha256Hmac, sign, verify, verifyPassword, verifySignedToken };