@florianjs/opaque 0.1.0

package/dist/index.d.mts

@@ -0,0 +1,47 @@
+//#region src/types.d.ts
+interface OpaqueConfig {
+  vaultUrl: string;
+  privateKey: string;
+  project: string;
+  env?: string;
+}
+type SecretsRecord = Record<string, string>;
+//#endregion
+//#region src/fetch.d.ts
+declare function fetchSecrets(config: OpaqueConfig): Promise<SecretsRecord>;
+//#endregion
+//#region src/inject.d.ts
+declare function injectEnv(secrets: SecretsRecord, target: Record<string, string | undefined>, options?: {
+  force?: boolean;
+}): void;
+//#endregion
+//#region src/watch.d.ts
+interface WatchOptions extends OpaqueConfig {
+  interval?: number;
+  onUpdate: (secrets: SecretsRecord) => void;
+  onError?: (err: Error) => void;
+}
+declare function watchSecrets(opts: WatchOptions): () => void;
+//#endregion
+//#region src/rotate.d.ts
+interface RotateKeyResult {
+  privateKey: string;
+  publicKey: string;
+}
+declare function rotateKey(config: OpaqueConfig, adminToken: string): Promise<RotateKeyResult>;
+//#endregion
+//#region src/crypto.d.ts
+interface SignRequestParams {
+  method: string;
+  url: string;
+  privateKey: string;
+  projectId: string;
+}
+interface SignedHeaders {
+  signature: string;
+  "signature-input": string;
+  "signature-agent": string;
+}
+declare function signRequest(params: SignRequestParams): Promise<SignedHeaders>;
+//#endregion
+export { type OpaqueConfig, type RotateKeyResult, type SecretsRecord, type SignRequestParams, type SignedHeaders, type WatchOptions, fetchSecrets, injectEnv, rotateKey, signRequest, watchSecrets };

package/dist/index.mjs

@@ -0,0 +1,131 @@
+import * as ed from "@noble/ed25519";
+//#region src/crypto.ts
+ed.etc.sha512Sync = (..._msgs) => {
+	throw new Error("opaque: use async ed25519 methods only");
+};
+ed.etc.sha512Async = async (...msgs) => {
+	const data = new Uint8Array(msgs.reduce((acc, m) => acc + m.length, 0));
+	let offset = 0;
+	for (const msg of msgs) {
+		data.set(msg, offset);
+		offset += msg.length;
+	}
+	const hash = await crypto.subtle.digest("SHA-512", data);
+	return new Uint8Array(hash);
+};
+function bytesToHex(bytes) {
+	return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function bytesToBase64(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+function base64ToBytes(b64) {
+	const binary = atob(b64);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+function parseJwkPrivateKey(jwkString) {
+	const jwk = JSON.parse(jwkString);
+	if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519") throw new Error("opaque: invalid private key JWK — expected OKP Ed25519");
+	if (!jwk.d) throw new Error("opaque: invalid private key JWK — missing d parameter");
+	const b64 = jwk.d.replace(/-/g, "+").replace(/_/g, "/");
+	return base64ToBytes(b64 + "=".repeat((4 - b64.length % 4) % 4));
+}
+function buildCanonicalMessage(method, url, created, expires, nonce, keyId) {
+	const authority = new URL(url).host;
+	const targetUri = url;
+	const components = [
+		`"@method": ${method.toUpperCase()}`,
+		`"@authority": ${authority}`,
+		`"@target-uri": ${targetUri}`
+	];
+	const sigParams = `("@method" "@authority" "@target-uri");created=${created};expires=${expires};nonce="${nonce}";keyid="${keyId}"`;
+	return [...components, `"@signature-params": ${sigParams}`].join("\n");
+}
+function generateNonce() {
+	const bytes = new Uint8Array(16);
+	if (typeof crypto !== "undefined" && crypto.getRandomValues) crypto.getRandomValues(bytes);
+	else for (let i = 0; i < bytes.length; i++) bytes[i] = Math.floor(Math.random() * 256);
+	return bytesToHex(bytes);
+}
+async function signRequest(params) {
+	const { method, url, privateKey, projectId } = params;
+	const privateKeyBytes = parseJwkPrivateKey(privateKey);
+	const publicKeyHex = bytesToHex(await ed.getPublicKeyAsync(privateKeyBytes));
+	const created = Math.floor(Date.now() / 1e3);
+	const expires = created + 300;
+	const nonce = generateNonce();
+	const keyId = `${projectId}.agents.opaque.local`;
+	const canonicalMessage = buildCanonicalMessage(method, url, created, expires, nonce, keyId);
+	const messageBytes = new TextEncoder().encode(canonicalMessage);
+	const signatureBase64 = bytesToBase64(await ed.signAsync(messageBytes, privateKeyBytes));
+	const sigParams = `("@method" "@authority" "@target-uri");created=${created};expires=${expires};nonce="${nonce}";keyid="${keyId}"`;
+	return {
+		signature: `sig1=:${signatureBase64}:`,
+		"signature-input": `sig1=${sigParams}`,
+		"signature-agent": `sig1=${keyId};pubkey="${publicKeyHex}"`
+	};
+}
+//#endregion
+//#region src/fetch.ts
+async function fetchSecrets(config) {
+	const env = config.env ?? (typeof process !== "undefined" ? process.env.NODE_ENV : "production") ?? "production";
+	const url = `${config.vaultUrl}/v1/secrets?env=${env}`;
+	const headers = await signRequest({
+		method: "GET",
+		url,
+		privateKey: config.privateKey,
+		projectId: config.project
+	});
+	const res = await fetch(url, {
+		method: "GET",
+		headers
+	});
+	if (!res.ok) {
+		const body = await res.text();
+		throw new Error(`opaque: failed to fetch secrets (${res.status}) — ${body}`);
+	}
+	return res.json();
+}
+//#endregion
+//#region src/inject.ts
+function injectEnv(secrets, target, options) {
+	for (const [key, value] of Object.entries(secrets)) if (options?.force || target[key] === void 0) target[key] = value;
+}
+//#endregion
+//#region src/watch.ts
+function watchSecrets(opts) {
+	const interval = opts.interval ?? 6e4;
+	const poll = async () => {
+		try {
+			opts.onUpdate(await fetchSecrets(opts));
+		} catch (err) {
+			opts.onError?.(err);
+		}
+	};
+	poll();
+	const timer = setInterval(() => void poll(), interval);
+	return () => clearInterval(timer);
+}
+//#endregion
+//#region src/rotate.ts
+async function rotateKey(config, adminToken) {
+	const url = `${config.vaultUrl}/v1/admin/projects/${encodeURIComponent(config.project)}/rotate`;
+	const res = await fetch(url, {
+		method: "PUT",
+		headers: {
+			authorization: `Bearer ${adminToken}`,
+			"content-type": "application/json"
+		}
+	});
+	if (!res.ok) {
+		const body = await res.text();
+		throw new Error(`opaque: failed to rotate key (${res.status}) — ${body}`);
+	}
+	return await res.json();
+}
+//#endregion
+export { fetchSecrets, injectEnv, rotateKey, signRequest, watchSecrets };

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@florianjs/opaque",
+  "version": "0.1.0",
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": "./dist/index.mjs",
+      "types": "./dist/index.d.mts"
+    }
+  },
+  "dependencies": {
+    "@noble/ed25519": "^2.2.3"
+  },
+  "scripts": {
+    "pack": "vp pack"
+  }
+}