@de-otio/chaoskb-server 0.2.11 → 0.2.12

package/dist/lib/handler/middleware/ssh-auth.d.ts

@@ -33,7 +33,14 @@ export declare function buildCanonicalString(method: string, path: string, times
  * is strictly greater than the stored highest-seen sequence.
  */
 export declare function checkSequence(ddb: DynamoDBDocumentClient, tableName: string, tenantId: string, fingerprint: string, sequence: number): Promise<void>;
-export declare function verifyEd25519Signature(publicKeyBase64: string, canonicalString: string, signatureBase64: string): boolean;
+/**
+ * Verify an SSH signature against a canonical string.
+ * The public key is the base64-encoded SSH wire-format blob from the request header.
+ * Supports Ed25519, RSA (PKCS#1 v1.5 SHA-256), and ECDSA (SHA-256).
+ */
+export declare function verifySSHSignature(publicKeyBase64: string, canonicalString: string, signatureBase64: string): boolean;
+/** @deprecated Use verifySSHSignature instead. */
+export declare const verifyEd25519Signature: typeof verifySSHSignature;
 export declare function authenticateRequest(event: {
     requestContext: {
         http: {

package/dist/lib/handler/middleware/ssh-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-auth.d.ts","sourceRoot":"","sources":["../../../../lib/handler/middleware/ssh-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAA+B,MAAM,uBAAuB,CAAC;AAG5F,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,SAAU,SAAQ,KAAK;aAGhB,UAAU,EAAE,MAAM;gBADlC,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM;CAKrC;AAED,UAAU,gBAAgB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CA4BlF;AA6BD,uEAAuE;AACvE,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAWvD;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAKR;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,GACtB,OAAO,CAqBT;AAOD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE;IACL,cAAc,EAAE;QAAE,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,EACD,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CA8HrB"}
+{"version":3,"file":"ssh-auth.d.ts","sourceRoot":"","sources":["../../../../lib/handler/middleware/ssh-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAA+B,MAAM,uBAAuB,CAAC;AAG5F,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,SAAU,SAAQ,KAAK;aAGhB,UAAU,EAAE,MAAM;gBADlC,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM;CAKrC;AAED,UAAU,gBAAgB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAKD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,CA4BlF;AA6BD,uEAAuE;AACvE,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAWvD;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,MAAM,CAKR;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAqCf;AA4GD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,GACtB,OAAO,CAcT;AAED,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,2BAAqB,CAAC;AAOzD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE;IACL,cAAc,EAAE;QAAE,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,EACD,GAAG,EAAE,sBAAsB,EAC3B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CA8HrB"}

package/dist/lib/handler/middleware/ssh-auth.js

@@ -33,13 +33,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthError = void 0;
+exports.verifyEd25519Signature = exports.AuthError = void 0;
 exports.parseAuthHeaders = parseAuthHeaders;
 exports.fingerprintFromPublicKey = fingerprintFromPublicKey;
 exports.verifyTimestamp = verifyTimestamp;
 exports.buildCanonicalString = buildCanonicalString;
 exports.checkSequence = checkSequence;
-exports.verifyEd25519Signature = verifyEd25519Signature;
+exports.verifySSHSignature = verifySSHSignature;
 exports.authenticateRequest = authenticateRequest;
 const crypto = __importStar(require("crypto"));
 const lib_dynamodb_1 = require("@aws-sdk/lib-dynamodb");
@@ -167,27 +167,123 @@ async function checkSequence(ddb, tableName, tenantId, fingerprint, sequence) {
         throw error;
     }
 }
-function verifyEd25519Signature(publicKeyBase64, canonicalString, signatureBase64) {
-    try {
-        const publicKeyBuffer = Buffer.from(publicKeyBase64, 'base64');
-        const signatureBuffer = Buffer.from(signatureBase64, 'base64');
-        const data = Buffer.from(canonicalString);
-        // Create Ed25519 public key object from raw bytes
-        const keyObject = crypto.createPublicKey({
-            key: Buffer.concat([
-                // Ed25519 DER prefix for a 32-byte public key
-                Buffer.from('302a300506032b6570032100', 'hex'),
-                publicKeyBuffer,
-            ]),
+/**
+ * Read an SSH wire-format string (uint32 length + bytes) from a buffer.
+ */
+function readSSHString(buf, offset) {
+    const len = buf.readUInt32BE(offset);
+    return { data: buf.subarray(offset + 4, offset + 4 + len), next: offset + 4 + len };
+}
+// --- DER / ASN.1 encoding helpers ---
+function derLength(length) {
+    if (length < 128)
+        return Buffer.from([length]);
+    if (length < 256)
+        return Buffer.from([0x81, length]);
+    const buf = Buffer.alloc(3);
+    buf[0] = 0x82;
+    buf.writeUInt16BE(length, 1);
+    return buf;
+}
+function derWrap(tag, content) {
+    return Buffer.concat([Buffer.from([tag]), derLength(content.length), content]);
+}
+function derSequence(...items) {
+    return derWrap(0x30, Buffer.concat(items));
+}
+function derInteger(data) {
+    // Strip leading zeros, but keep padding zero if high bit is set
+    let start = 0;
+    while (start < data.length - 1 && data[start] === 0 && !(data[start + 1] & 0x80)) {
+        start++;
+    }
+    let buf = data.subarray(start);
+    if (buf[0] & 0x80) {
+        buf = Buffer.concat([Buffer.from([0x00]), buf]);
+    }
+    return derWrap(0x02, buf);
+}
+function derBitString(data) {
+    return derWrap(0x03, Buffer.concat([Buffer.from([0x00]), data]));
+}
+function derOid(encoded) {
+    return derWrap(0x06, encoded);
+}
+const DER_NULL = Buffer.from([0x05, 0x00]);
+/**
+ * Build a crypto.KeyObject from an SSH public key blob (base64-encoded wire format).
+ * Supports ssh-ed25519, ssh-rsa, and ecdsa-sha2-nistp{256,384,521}.
+ */
+function createPublicKeyFromSSHBlob(publicKeyBase64) {
+    const blob = Buffer.from(publicKeyBase64, 'base64');
+    const { data: keyTypeBytes, next: off1 } = readSSHString(blob, 0);
+    const keyType = keyTypeBytes.toString('utf-8');
+    if (keyType === 'ssh-ed25519') {
+        const { data: rawKey } = readSSHString(blob, off1);
+        const spki = Buffer.concat([
+            Buffer.from('302a300506032b6570032100', 'hex'),
+            rawKey,
+        ]);
+        return crypto.createPublicKey({ key: spki, format: 'der', type: 'spki' });
+    }
+    if (keyType === 'ssh-rsa') {
+        const { data: e, next: off2 } = readSSHString(blob, off1);
+        const { data: n } = readSSHString(blob, off2);
+        // OID 1.2.840.113549.1.1.1 (rsaEncryption)
+        const rsaOid = derOid(Buffer.from('2a864886f70d010101', 'hex'));
+        const algorithmId = derSequence(rsaOid, DER_NULL);
+        const rsaPublicKey = derSequence(derInteger(n), derInteger(e));
+        return crypto.createPublicKey({
+            key: derSequence(algorithmId, derBitString(rsaPublicKey)),
+            format: 'der',
+            type: 'spki',
+        });
+    }
+    if (keyType.startsWith('ecdsa-sha2-')) {
+        const { data: curveNameBytes, next: off2 } = readSSHString(blob, off1);
+        const { data: point } = readSSHString(blob, off2);
+        const curve = curveNameBytes.toString('utf-8');
+        const curveOids = {
+            'nistp256': '2a8648ce3d030107', // 1.2.840.10045.3.1.7
+            'nistp384': '2b81040022', // 1.3.132.0.34
+            'nistp521': '2b81040023', // 1.3.132.0.35
+        };
+        const oidHex = curveOids[curve];
+        if (!oidHex)
+            throw new Error(`Unsupported ECDSA curve: ${curve}`);
+        // OID 1.2.840.10045.2.1 (ecPublicKey)
+        const ecOid = derOid(Buffer.from('2a8648ce3d0201', 'hex'));
+        const algorithmId = derSequence(ecOid, derOid(Buffer.from(oidHex, 'hex')));
+        return crypto.createPublicKey({
+            key: derSequence(algorithmId, derBitString(point)),
             format: 'der',
             type: 'spki',
         });
-        return crypto.verify(null, data, keyObject, signatureBuffer);
+    }
+    throw new Error(`Unsupported SSH key type: ${keyType}`);
+}
+/**
+ * Verify an SSH signature against a canonical string.
+ * The public key is the base64-encoded SSH wire-format blob from the request header.
+ * Supports Ed25519, RSA (PKCS#1 v1.5 SHA-256), and ECDSA (SHA-256).
+ */
+function verifySSHSignature(publicKeyBase64, canonicalString, signatureBase64) {
+    try {
+        const keyObject = createPublicKeyFromSSHBlob(publicKeyBase64);
+        const signatureBuffer = Buffer.from(signatureBase64, 'base64');
+        const data = Buffer.from(canonicalString);
+        // Ed25519/Ed448 infer the algorithm; RSA and ECDSA use SHA-256
+        const algorithm = keyObject.asymmetricKeyType === 'ed25519' || keyObject.asymmetricKeyType === 'ed448'
+            ? null
+            : 'sha256';
+        return crypto.verify(algorithm, data, keyObject, signatureBuffer);
     }
     catch {
         return false;
     }
 }
+/** @deprecated Use verifySSHSignature instead. */
+exports.verifyEd25519Signature = verifySSHSignature;
 function tenantIdFromPublicKey(publicKeyBase64) {
     const hash = crypto.createHash('sha256').update(publicKeyBase64).digest('hex');
     return hash.slice(0, 32);
@@ -229,7 +325,7 @@ async function authenticateRequest(event, ddb, tableName) {
             // Perform a dummy signature verification to equalize timing
             const dummyKey = Buffer.alloc(32, 0x01).toString('base64');
             try {
-                verifyEd25519Signature(dummyKey, 'dummy', 'dummy');
+                verifySSHSignature(dummyKey, 'dummy', 'dummy');
             }
             catch {
                 // Expected to fail — timing equalization only
@@ -280,7 +376,7 @@ async function authenticateRequest(event, ddb, tableName) {
     }
     // Verify the SSH signature against the canonical string (includes sequence)
     const canonicalString = buildCanonicalString(event.requestContext.http.method, event.requestContext.http.path, parsed.timestamp, parsed.sequence, event.body);
-    const valid = verifyEd25519Signature(publicKey, canonicalString, parsed.signature);
+    const valid = verifySSHSignature(publicKey, canonicalString, parsed.signature);
     if (!valid) {
         logger_js_1.logger.warn('Signature verification failed', { tenantId });
         throw new AuthError('Invalid signature', 401);

package/dist/lib/handler/middleware/ssh-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-auth.js","sourceRoot":"","sources":["../../../../lib/handler/middleware/ssh-auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,4CA4BC;AA8BD,4DAEC;AAED,0CAWC;AAED,oDAWC;AAQD,sCA2CC;AAED,wDAyBC;AAOD,kDAsIC;AAtVD,+CAAiC;AACjC,wDAA4F;AAC5F,4CAAsC;AAQtC,MAAa,SAAU,SAAQ,KAAK;IAGhB;IAFlB,YACE,OAAe,EACC,UAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,eAAU,GAAV,UAAU,CAAQ;QAGlC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AARD,8BAQC;AAQD,uFAAuF;AACvF,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,OAA+B;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,yCAAyC;QACzC,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,OAAO,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnF,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAC5B,MAAc,EACd,OAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC;QACvB,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAgB,wBAAwB,CAAC,eAAuB;IAC9D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACrG,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,sBAAsB,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAgB,oBAAoB,CAClC,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,QAAgB,EAChB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI;QACnB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,iBAAiB,MAAM,IAAI,IAAI,KAAK,SAAS,KAAK,QAAQ,KAAK,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,aAAa,CACjC,GAA2B,EAC3B,SAAiB,EACjB,QAAgB,EAChB,WAAmB,EACnB,QAAgB;IAEhB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,SAAS,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;YAChB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE;gBACH,EAAE,EAAE,UAAU,QAAQ,EAAE;gBACxB,EAAE,EAAE,YAAY,WAAW,EAAE;aAC9B;YACD,gBAAgB,EAAE,uBAAuB;YACzC,mBAAmB,EACjB,uDAAuD;YACzD,yBAAyB,EAAE;gBACzB,MAAM,EAAE,QAAQ;aACjB;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,iCAAiC,EAChD,CAAC;YACD,kBAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBAC3D,QAAQ;gBACR,WAAW;gBACX,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,IAAI,SAAS,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,eAAuB,EACvB,eAAuB,EACvB,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE1C,kDAAkD;QAClD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;YACvC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;gBACjB,8CAA8C;gBAC9C,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC;gBAC9C,eAAe;aAChB,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,eAAuB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAIC,EACD,GAA2B,EAC3B,SAAiB;IAEjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAElC,yDAAyD;IACzD,6FAA6F;IAC7F,gEAAgE;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAExD,gDAAgD;IAChD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,IAAI,2BAAY,CAAC;QACf,SAAS,EAAE,SAAS;QACpB,sBAAsB,EAAE,uBAAuB;QAC/C,yBAAyB,EAAE;YACzB,KAAK,EAAE,UAAU,QAAQ,EAAE;YAC3B,KAAK,EAAE,MAAM;SACd;QACD,KAAK,EAAE,CAAC;KACT,CAAC,CACH,CAAC;IAEF,IAAI,gBAAgB,GAAG,QAAQ,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,+EAA+E;QAC/E,mFAAmF;QACnF,+CAA+C;QAC/C,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,CAChC,IAAI,2BAAY,CAAC;YACf,SAAS,EAAE,SAAS;YACpB,sBAAsB,EAAE,uBAAuB;YAC/C,yBAAyB,EAAE;gBACzB,KAAK,EAAE,aAAa,QAAQ,EAAE;gBAC9B,KAAK,EAAE,MAAM;aACd;YACD,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,iCAAiC;QACjC,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAW,CAAC;QAEtE,oCAAoC;QACpC,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,IAAI,CACnC,IAAI,2BAAY,CAAC;YACf,SAAS,EAAE,SAAS;YACpB,sBAAsB,EAAE,uBAAuB;YAC/C,yBAAyB,EAAE;gBACzB,KAAK,EAAE,UAAU,gBAAgB,EAAE;gBACnC,KAAK,EAAE,MAAM;aACd;YACD,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,cAAc,CAAuB,CAAC;QACnE,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,eAAe,CAAC,KAAK,kBAAkB,EAAE,CAAC;YACrE,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAW,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/F,oFAAoF;YACpF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAuB,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,kBAAkB,EAAE,CAAC;gBAC7D,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;gBACrG,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,eAAe,GAAG,oBAAoB,CAC1C,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAChC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAC9B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,QAAQ,EACf,KAAK,CAAC,IAAI,CACX,CAAC;IAEF,MAAM,KAAK,GAAG,sBAAsB,CAClC,SAAS,EACT,eAAe,EACf,MAAM,CAAC,SAAS,CACjB,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,kBAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA+B;IACvD,oBAAoB;IACpB,MAAM,YAAY,GAAG,OAAO,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtF,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,yDAAyD;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,IAAI,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"ssh-auth.js","sourceRoot":"","sources":["../../../../lib/handler/middleware/ssh-auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,4CA4BC;AA8BD,4DAEC;AAED,0CAWC;AAED,oDAWC;AAQD,sCA2CC;AAiHD,gDAkBC;AAUD,kDAsIC;AAjcD,+CAAiC;AACjC,wDAA4F;AAC5F,4CAAsC;AAQtC,MAAa,SAAU,SAAQ,KAAK;IAGhB;IAFlB,YACE,OAAe,EACC,UAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,eAAU,GAAV,UAAU,CAAQ;QAGlC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AARD,8BAQC;AAQD,uFAAuF;AACvF,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,OAA+B;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,yCAAyC;QACzC,IAAI,UAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,OAAO,qBAAqB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnF,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,SAAS,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAC5B,MAAc,EACd,OAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnF,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC;QACxB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC;QACvB,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAgB,wBAAwB,CAAC,eAAuB;IAC9D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACrG,CAAC;AAED,SAAgB,eAAe,CAAC,SAAiB;IAC/C,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,sBAAsB,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAgB,oBAAoB,CAClC,MAAc,EACd,IAAY,EACZ,SAAiB,EACjB,QAAgB,EAChB,IAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI;QACnB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,iBAAiB,MAAM,IAAI,IAAI,KAAK,SAAS,KAAK,QAAQ,KAAK,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,aAAa,CACjC,GAA2B,EAC3B,SAAiB,EACjB,QAAgB,EAChB,WAAmB,EACnB,QAAgB;IAEhB,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,SAAS,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,4BAAa,CAAC;YAChB,SAAS,EAAE,SAAS;YACpB,GAAG,EAAE;gBACH,EAAE,EAAE,UAAU,QAAQ,EAAE;gBACxB,EAAE,EAAE,YAAY,WAAW,EAAE;aAC9B;YACD,gBAAgB,EAAE,uBAAuB;YACzC,mBAAmB,EACjB,uDAAuD;YACzD,yBAAyB,EAAE;gBACzB,MAAM,EAAE,QAAQ;aACjB;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,iCAAiC,EAChD,CAAC;YACD,kBAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBAC3D,QAAQ;gBACR,WAAW;gBACX,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,IAAI,SAAS,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,MAAc;IAChD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;AACtF,CAAC;AAED,uCAAuC;AAEvC,SAAS,SAAS,CAAC,MAAc;IAC/B,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACd,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,OAAe;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,KAAe;IACrC,OAAO,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,gEAAgE;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;QACjF,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAClB,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3C;;;GAGG;AACH,SAAS,0BAA0B,CAAC,eAAuB;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE/C,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC;YAC9C,MAAM;SACP,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,2CAA2C;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,YAAY,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,eAAe,CAAC;YAC5B,GAAG,EAAE,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,SAAS,GAA2B;YACxC,UAAU,EAAE,kBAAkB,EAAI,sBAAsB;YACxD,UAAU,EAAE,YAAY,EAAW,eAAe;YAClD,UAAU,EAAE,YAAY,EAAW,eAAe;SACnD,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QAClE,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC,eAAe,CAAC;YAC5B,GAAG,EAAE,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,eAAuB,EACvB,eAAuB,EACvB,eAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,0BAA0B,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,+DAA+D;QAC/D,MAAM,SAAS,GACb,SAAS,CAAC,iBAAiB,KAAK,SAAS,IAAI,SAAS,CAAC,iBAAiB,KAAK,OAAO;YAClF,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,QAAQ,CAAC;QACf,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,kDAAkD;AACrC,QAAA,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,SAAS,qBAAqB,CAAC,eAAuB;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAIC,EACD,GAA2B,EAC3B,SAAiB;IAEjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAElC,yDAAyD;IACzD,6FAA6F;IAC7F,gEAAgE;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAExD,gDAAgD;IAChD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,IAAI,2BAAY,CAAC;QACf,SAAS,EAAE,SAAS;QACpB,sBAAsB,EAAE,uBAAuB;QAC/C,yBAAyB,EAAE;YACzB,KAAK,EAAE,UAAU,QAAQ,EAAE;YAC3B,KAAK,EAAE,MAAM;SACd;QACD,KAAK,EAAE,CAAC;KACT,CAAC,CACH,CAAC;IAEF,IAAI,gBAAgB,GAAG,QAAQ,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,+EAA+E;QAC/E,mFAAmF;QACnF,+CAA+C;QAC/C,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,CAChC,IAAI,2BAAY,CAAC;YACf,SAAS,EAAE,SAAS;YACpB,sBAAsB,EAAE,uBAAuB;YAC/C,yBAAyB,EAAE;gBACzB,KAAK,EAAE,aAAa,QAAQ,EAAE;gBAC9B,KAAK,EAAE,MAAM;aACd;YACD,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,iCAAiC;QACjC,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAW,CAAC;QAEtE,oCAAoC;QACpC,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,IAAI,CACnC,IAAI,2BAAY,CAAC;YACf,SAAS,EAAE,SAAS;YACpB,sBAAsB,EAAE,uBAAuB;YAC/C,yBAAyB,EAAE;gBACzB,KAAK,EAAE,UAAU,gBAAgB,EAAE;gBACnC,KAAK,EAAE,MAAM;aACd;YACD,KAAK,EAAE,CAAC;SACT,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,cAAc,CAAuB,CAAC;QACnE,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,eAAe,CAAC,KAAK,kBAAkB,EAAE,CAAC;YACrE,MAAM,IAAI,SAAS,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAW,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/F,oFAAoF;YACpF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAuB,CAAC;YAC3D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,eAAe,CAAC,KAAK,kBAAkB,EAAE,CAAC;gBAC7D,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;gBACrG,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,eAAe,GAAG,oBAAoB,CAC1C,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAChC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAC9B,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,QAAQ,EACf,KAAK,CAAC,IAAI,CACX,CAAC;IAEF,MAAM,KAAK,GAAG,kBAAkB,CAC9B,SAAS,EACT,eAAe,EACf,MAAM,CAAC,SAAS,CACjB,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,kBAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAA+B;IACvD,oBAAoB;IACpB,MAAM,YAAY,GAAG,OAAO,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtF,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,yDAAyD;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,IAAI,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC"}

package/dist/lib/handler/middleware/ssh-auth.ts

@@ -174,33 +174,140 @@ export async function checkSequence(
   }
 }
 
-export function verifyEd25519Signature(
+/**
+ * Read an SSH wire-format string (uint32 length + bytes) from a buffer.
+ */
+function readSSHString(buf: Buffer, offset: number): { data: Buffer; next: number } {
+  const len = buf.readUInt32BE(offset);
+  return { data: buf.subarray(offset + 4, offset + 4 + len), next: offset + 4 + len };
+}
+
+// --- DER / ASN.1 encoding helpers ---
+
+function derLength(length: number): Buffer {
+  if (length < 128) return Buffer.from([length]);
+  if (length < 256) return Buffer.from([0x81, length]);
+  const buf = Buffer.alloc(3);
+  buf[0] = 0x82;
+  buf.writeUInt16BE(length, 1);
+  return buf;
+}
+
+function derWrap(tag: number, content: Buffer): Buffer {
+  return Buffer.concat([Buffer.from([tag]), derLength(content.length), content]);
+}
+
+function derSequence(...items: Buffer[]): Buffer {
+  return derWrap(0x30, Buffer.concat(items));
+}
+
+function derInteger(data: Buffer): Buffer {
+  // Strip leading zeros, but keep padding zero if high bit is set
+  let start = 0;
+  while (start < data.length - 1 && data[start] === 0 && !(data[start + 1] & 0x80)) {
+    start++;
+  }
+  let buf = data.subarray(start);
+  if (buf[0] & 0x80) {
+    buf = Buffer.concat([Buffer.from([0x00]), buf]);
+  }
+  return derWrap(0x02, buf);
+}
+
+function derBitString(data: Buffer): Buffer {
+  return derWrap(0x03, Buffer.concat([Buffer.from([0x00]), data]));
+}
+
+function derOid(encoded: Buffer): Buffer {
+  return derWrap(0x06, encoded);
+}
+
+const DER_NULL = Buffer.from([0x05, 0x00]);
+
+/**
+ * Build a crypto.KeyObject from an SSH public key blob (base64-encoded wire format).
+ * Supports ssh-ed25519, ssh-rsa, and ecdsa-sha2-nistp{256,384,521}.
+ */
+function createPublicKeyFromSSHBlob(publicKeyBase64: string): crypto.KeyObject {
+  const blob = Buffer.from(publicKeyBase64, 'base64');
+  const { data: keyTypeBytes, next: off1 } = readSSHString(blob, 0);
+  const keyType = keyTypeBytes.toString('utf-8');
+
+  if (keyType === 'ssh-ed25519') {
+    const { data: rawKey } = readSSHString(blob, off1);
+    const spki = Buffer.concat([
+      Buffer.from('302a300506032b6570032100', 'hex'),
+      rawKey,
+    ]);
+    return crypto.createPublicKey({ key: spki, format: 'der', type: 'spki' });
+  }
+
+  if (keyType === 'ssh-rsa') {
+    const { data: e, next: off2 } = readSSHString(blob, off1);
+    const { data: n } = readSSHString(blob, off2);
+    // OID 1.2.840.113549.1.1.1 (rsaEncryption)
+    const rsaOid = derOid(Buffer.from('2a864886f70d010101', 'hex'));
+    const algorithmId = derSequence(rsaOid, DER_NULL);
+    const rsaPublicKey = derSequence(derInteger(n), derInteger(e));
+    return crypto.createPublicKey({
+      key: derSequence(algorithmId, derBitString(rsaPublicKey)),
+      format: 'der',
+      type: 'spki',
+    });
+  }
+
+  if (keyType.startsWith('ecdsa-sha2-')) {
+    const { data: curveNameBytes, next: off2 } = readSSHString(blob, off1);
+    const { data: point } = readSSHString(blob, off2);
+    const curve = curveNameBytes.toString('utf-8');
+    const curveOids: Record<string, string> = {
+      'nistp256': '2a8648ce3d030107',   // 1.2.840.10045.3.1.7
+      'nistp384': '2b81040022',          // 1.3.132.0.34
+      'nistp521': '2b81040023',          // 1.3.132.0.35
+    };
+    const oidHex = curveOids[curve];
+    if (!oidHex) throw new Error(`Unsupported ECDSA curve: ${curve}`);
+    // OID 1.2.840.10045.2.1 (ecPublicKey)
+    const ecOid = derOid(Buffer.from('2a8648ce3d0201', 'hex'));
+    const algorithmId = derSequence(ecOid, derOid(Buffer.from(oidHex, 'hex')));
+    return crypto.createPublicKey({
+      key: derSequence(algorithmId, derBitString(point)),
+      format: 'der',
+      type: 'spki',
+    });
+  }
+
+  throw new Error(`Unsupported SSH key type: ${keyType}`);
+}
+
+/**
+ * Verify an SSH signature against a canonical string.
+ * The public key is the base64-encoded SSH wire-format blob from the request header.
+ * Supports Ed25519, RSA (PKCS#1 v1.5 SHA-256), and ECDSA (SHA-256).
+ */
+export function verifySSHSignature(
   publicKeyBase64: string,
   canonicalString: string,
   signatureBase64: string,
 ): boolean {
   try {
-    const publicKeyBuffer = Buffer.from(publicKeyBase64, 'base64');
+    const keyObject = createPublicKeyFromSSHBlob(publicKeyBase64);
     const signatureBuffer = Buffer.from(signatureBase64, 'base64');
     const data = Buffer.from(canonicalString);
-
-    // Create Ed25519 public key object from raw bytes
-    const keyObject = crypto.createPublicKey({
-      key: Buffer.concat([
-        // Ed25519 DER prefix for a 32-byte public key
-        Buffer.from('302a300506032b6570032100', 'hex'),
-        publicKeyBuffer,
-      ]),
-      format: 'der',
-      type: 'spki',
-    });
-
-    return crypto.verify(null, data, keyObject, signatureBuffer);
+    // Ed25519/Ed448 infer the algorithm; RSA and ECDSA use SHA-256
+    const algorithm =
+      keyObject.asymmetricKeyType === 'ed25519' || keyObject.asymmetricKeyType === 'ed448'
+        ? null
+        : 'sha256';
+    return crypto.verify(algorithm, data, keyObject, signatureBuffer);
   } catch {
     return false;
   }
 }
 
+/** @deprecated Use verifySSHSignature instead. */
+export const verifyEd25519Signature = verifySSHSignature;
+
 function tenantIdFromPublicKey(publicKeyBase64: string): string {
   const hash = crypto.createHash('sha256').update(publicKeyBase64).digest('hex');
   return hash.slice(0, 32);
@@ -260,7 +367,7 @@ export async function authenticateRequest(
       // Perform a dummy signature verification to equalize timing
       const dummyKey = Buffer.alloc(32, 0x01).toString('base64');
       try {
-        verifyEd25519Signature(dummyKey, 'dummy', 'dummy');
+        verifySSHSignature(dummyKey, 'dummy', 'dummy');
       } catch {
         // Expected to fail — timing equalization only
       }
@@ -323,7 +430,7 @@ export async function authenticateRequest(
     event.body,
   );
 
-  const valid = verifyEd25519Signature(
+  const valid = verifySSHSignature(
     publicKey,
     canonicalString,
     parsed.signature,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@de-otio/chaoskb-server",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "ChaosKB server - CDK construct library for the hosted backend",
   "license": "MIT",
   "repository": {