@freedomofpress/webcat 0.0.0-stage → 3.0.1

package/dist/lib/webcat/hookbuilder.d.ts

@@ -0,0 +1,47 @@
+import { KVStore } from "../browser/kvstore";
+/** @internal @inline */
+export type HookBuilderConfig = {
+    /**
+     * The path to the static hook content script file, relative to the
+     * extension root directory.
+     */
+    staticHookPath: string;
+};
+/**
+ * Builds hooks using unique cryptographic keys.
+ */
+export declare class HookBuilder {
+    #private;
+    /**
+     * @param store A key-value store for persisting the builder's cryptographic
+     *   key and salt.
+     */
+    constructor(store: KVStore, config: HookBuilderConfig);
+    /**
+     * @returns The path to the static content script file.
+     */
+    getStaticHookPath(): string;
+    /**
+     * @param wasm An array of hashes to validate WASM modules against.
+     * @param firstParty The first-party origin of the associated page.
+     * @param sameOrigin true if the target document is same-origin with the
+     *   first party.
+     * @returns A Promise that resolves to hook code ready to be injected
+     *   directly to a script file.
+     */
+    getPageHooks(wasm: string[], firstParty: string, sameOrigin: boolean): Promise<string>;
+    /**
+     * @param wasm An array of hashes to validate WASM modules against.
+     * @param firstParty The first-party origin of the associated page.
+     * @param sameOrigin true if the target document is same-origin with the
+     *   first party.
+     * @returns A Promise that resolves to hook code ready to be included in a
+     *   content script.
+     */
+    getContentScriptHooks(wasm: string[], firstParty: string, sameOrigin: boolean): Promise<[func: (data: string) => void, args: [data: string]]>;
+    /**
+     * @param url A URL with an encrypted fragment added via a hook.
+     * @returns The decrypted fragment.
+     */
+    decryptFragment(url: string): Promise<string>;
+}

package/dist/lib/webcat/hookbuilder.js

@@ -0,0 +1,170 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var _staticHookPath, _firstPartyKey, _firstPartySalt, _HookBuilder_instances, get_fn;
+const pageHooks = '(function(){"use strict";const o=Symbol("WEBCAT internal"),H=Symbol("WEBCAT hooked"),s=globalThis.self||globalThis,S=Reflect.apply,U=typeof globalThis.exportFunction=="function";function n(r){return U?XPCNativeWrapper.unwrap(r):r}function b(r,e=s,t=void 0){if(U){const i={};return t!==void 0&&(i.defineAs=t),exportFunction(r,XPCNativeWrapper.unwrap(e),i)}else t!==void 0&&(e[t]=r);return r}function R(r){const e=n(new s.Object);for(const t of Object.keys(r))e[t]=r[t];return e.listeners=new Map,e}function T(r,e){return function(t,i){const c=t;if(c.hooks||(c.hooks={}),r in c.hooks){console.log(`[WEBCAT] Hook already injected: ${r}`),c.hooks[r].data=i;return}const{promise:l,resolve:a}=s.Promise.withResolvers();c.hooks[r]={ready:l,data:i},Object.defineProperty(c.hooks[r],"data",{set:d=>{i=d,a()},get:()=>i}),typeof i=="object"&&(c.hooks[r].data=i),e(l.then(()=>i),c.hooks[r])}}function $(r,e,t){return r.has(e)?r.get(e):(r.set(e,t),t)}function B(r){const e=n(r);return e&&(typeof e=="object"||typeof e=="function")?e:{capture:!!e}}function _(r,e){return b((...t)=>S(r,e,t))}function q(r,e,t,i){const c=n(e[1]),{once:l}=B(e[2]);return e[1]=b((...a)=>{l&&t[i]===e&&delete t[i];const d=typeof c=="function"?c:c?.handleEvent;return d&&S(d,r,a)}),e}function C(r,e){const{get:t,set:i}=Object.getOwnPropertyDescriptor(r,e);function c(){return o in n(this)?n(this)[o][e]:t&&S(t,this,[])}function l(a){o in n(this)?(n(this)[o][e]=a,n(this)[o].instance&&(n(this)[o].instance[e]=typeof a=="function"?_(a,n(this)):null)):i&&S(i,this,[a])}Object.defineProperty(r,e,{get:b(c),set:b(l)})}function x(r){const e=Object.keys(r[o]).filter(t=>t.startsWith("on"));for(const t of e){const i=r[o][t];r[o].instance[t]=typeof i=="function"?_(i,r):null}for(const t of r[o].listeners.values())for(const{nonCapturingArgs:i,capturingArgs:c}of t.values())i&&r[o].instance.addEventListener(...i),c&&r[o].instance.addEventListener(...c)}const z=T("EventTarget",function(){const{value:r}=Object.getOwnPropertyDescriptor(n(s.EventTarget.prototype),"addEventListener");function e(...a){const[d,m,u]=a;if(this&&o in n(this)){const{capture:f,once:v,passive:k,signal:p}=B(u),h=n(new s.Object);h.capture=!!f,h.once=!!v,h.passive=k===void 0?void 0:!!k,h.signal=p;const W=$($(n(this)[o].listeners,d,new Map),m,{}),P=f?"capturingArgs":"nonCapturingArgs",w=W[P];if(!w||B(w[2]).signal?.aborted){const L=q(n(this),[d,m,h],W,P);W[P]=L,n(this)[o].instance&&n(this)[o].instance.addEventListener(...L)}}else S(r,this,a)}Object.defineProperty(n(s.EventTarget.prototype),"addEventListener",{value:b(e)});const{value:t}=Object.getOwnPropertyDescriptor(n(s.EventTarget.prototype),"removeEventListener");function i(...a){const[d,m,u]=a;if(this&&o in n(this)){const f=n(this)[o].listeners.get(d)?.get(m),v=B(u).capture?"capturingArgs":"nonCapturingArgs";f?.[v]&&(n(this)[o].instance&&n(this)[o].instance.removeEventListener(...f[v]),delete f[v])}else S(t,this,a)}Object.defineProperty(n(s.EventTarget.prototype),"removeEventListener",{value:b(i)});const{value:c}=Object.getOwnPropertyDescriptor(n(s.EventTarget.prototype),"dispatchEvent");function l(...a){return this&&o in n(this)?n(this)[o].instance?n(this)[o].instance.dispatchEvent(...a):!0:S(c,this,a)}Object.defineProperty(n(s.EventTarget.prototype),"dispatchEvent",{value:b(l)})}),G=T("Event",function(){for(const t of["target","currentTarget","originalTarget","explicitOriginalTarget","srcElement"]){let i=function(){const l=n(S(c,this,[]));return l?.[H]??l};const{get:c}=Object.getOwnPropertyDescriptor(n(s.Event.prototype),t)??{};c&&Object.defineProperty(n(s.Event.prototype),t,{get:b(i)})}const{value:r}=Object.getOwnPropertyDescriptor(n(s.Event.prototype),"composedPath");function e(){const t=n(S(r,this,[]));for(let i=0;i<t.length;i++){const c=t[i];t[i]=c?.[H]??c}return t}Object.defineProperty(n(s.Event.prototype),"composedPath",{value:b(e)})}),N=new Uint32Array([1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298]);function I(r,e,t,i,c){let l,a,d,m,u,f,v,k,p,h,W,P,w;for(;c>=64;){for(l=e[0],a=e[1],d=e[2],m=e[3],u=e[4],f=e[5],v=e[6],k=e[7],h=0;h<16;h++)W=i+h*4,r[h]=(t[W]&255)<<24|(t[W+1]&255)<<16|(t[W+2]&255)<<8|t[W+3]&255;for(h=16;h<64;h++)p=r[h-2],P=(p>>>17|p<<15)^(p>>>19|p<<13)^p>>>10,p=r[h-15],w=(p>>>7|p<<25)^(p>>>18|p<<14)^p>>>3,r[h]=(P+r[h-7]|0)+(w+r[h-16]|0);for(h=0;h<64;h++)P=(((u>>>6|u<<26)^(u>>>11|u<<21)^(u>>>25|u<<7))+(u&f^~u&v)|0)+(k+(N[h]+r[h]|0)|0)|0,w=((l>>>2|l<<30)^(l>>>13|l<<19)^(l>>>22|l<<10))+(l&a^l&d^a&d)|0,k=v,v=f,f=u,u=m+P|0,m=d,d=a,a=l,l=P+w|0;e[0]+=l,e[1]+=a,e[2]+=d,e[3]+=m,e[4]+=u,e[5]+=f,e[6]+=v,e[7]+=k,i+=64,c-=64}return i}class V{constructor(){this.digestLength=32,this.blockSize=64,this.state=new Int32Array(8),this.temp=new Int32Array(64),this.buffer=new Uint8Array(128),this.bufferLength=0,this.bytesHashed=0,this.finished=!1,this.reset()}reset(){return this.state[0]=1779033703,this.state[1]=3144134277,this.state[2]=1013904242,this.state[3]=2773480762,this.state[4]=1359893119,this.state[5]=2600822924,this.state[6]=528734635,this.state[7]=1541459225,this.bufferLength=0,this.bytesHashed=0,this.finished=!1,this}clean(){for(let e=0;e<this.buffer.length;e++)this.buffer[e]=0;for(let e=0;e<this.temp.length;e++)this.temp[e]=0;this.reset()}update(e,t=e.length){if(this.finished)throw new Error("SHA256: can\'t update because hash was finished.");let i=0;if(this.bytesHashed+=t,this.bufferLength>0){for(;this.bufferLength<64&&t>0;)this.buffer[this.bufferLength++]=e[i++],t--;this.bufferLength===64&&(I(this.temp,this.state,this.buffer,0,64),this.bufferLength=0)}for(t>=64&&(i=I(this.temp,this.state,e,i,t),t%=64);t>0;)this.buffer[this.bufferLength++]=e[i++],t--;return this}finish(e){if(!this.finished){const t=this.bytesHashed,i=this.bufferLength,c=t/536870912|0,l=t<<3,a=t%64<56?64:128;this.buffer[i]=128;for(let d=i+1;d<a-8;d++)this.buffer[d]=0;this.buffer[a-8]=c>>>24&255,this.buffer[a-7]=c>>>16&255,this.buffer[a-6]=c>>>8&255,this.buffer[a-5]=c>>>0&255,this.buffer[a-4]=l>>>24&255,this.buffer[a-3]=l>>>16&255,this.buffer[a-2]=l>>>8&255,this.buffer[a-1]=l>>>0&255,I(this.temp,this.state,this.buffer,0,a),this.finished=!0}for(let t=0;t<8;t++)e[t*4+0]=this.state[t]>>>24&255,e[t*4+1]=this.state[t]>>>16&255,e[t*4+2]=this.state[t]>>>8&255,e[t*4+3]=this.state[t]>>>0&255;return this}digest(){const e=new Uint8Array(this.digestLength);return this.finish(e),e}_saveState(e){for(let t=0;t<this.state.length;t++)e[t]=this.state[t]}_restoreState(e,t){for(let i=0;i<this.state.length;i++)this.state[i]=e[i];this.bytesHashed=t,this.finished=!1,this.bufferLength=0}}function F(r){const e=new V().update(new Uint8Array(r)),t=e.digest();return e.clean(),t}const X=T("WASM",function(r,e){const t=n(s.WebAssembly);if(!t)return;function i(y){const E=y instanceof Uint8Array?y:new Uint8Array(y),g=new s.Object;return g.alphabet="base64url",g.omitPadding=!0,E.toBase64(g)}function c(y){return r.then(({hashes:E})=>{if(!("crypto"in globalThis))return Promise.resolve(l(y));const g=a(y);return crypto.subtle.digest("SHA-256",g).then(A=>{const O=i(A);if(!E?.includes(O))throw new s.Error(`[WEBCAT] Unauthorized WebAssembly bytecode: ${O}`);return console.log(`[WEBCAT] Verified WASM (async) ${O}`),g})})}function l(y){const E=a(y),g=i(F(E));if(!e.data.hashes?.includes(g))throw new s.Error(`[WEBCAT] Unauthorized WebAssembly bytecode: ${g}`);return console.log(`[WEBCAT] Verified WASM (sync) ${g}`),E}function a(y){return s.ArrayBuffer.isView(y)?y.buffer.slice():y.slice()}const d=t.instantiate;function m(y,E,g){return y instanceof t.Module?d.call(this,y,E,g):c(y).then(A=>d.call(this,A,E,g))}b(m,t,"instantiate");const u=t.compile;function f(y,E){return c(y).then(g=>u.call(this,g,E))}b(f,t,"compile");const v=t.validate;function k(y){const E=l(y);return v.call(this,E)}b(k,t,"validate");const p=t.instantiateStreaming;function h(y,E,g){return s.Promise.resolve(y).then(A=>Promise.all([A.clone().arrayBuffer(),A.headers])).then(([A,O])=>Promise.all([c(A),O])).then(([A,O])=>p.call(this,new Response(A,{headers:O}),E,g))}b(h,t,"instantiateStreaming");const W=t.compileStreaming;function P(y,E){return s.Promise.resolve(y).then(g=>Promise.all([g.clone().arrayBuffer(),g.headers])).then(([g,A])=>Promise.all([c(g),A])).then(([g,A])=>W.call(this,new Response(g,{headers:A}),E))}b(P,t,"compileStreaming");const w=t.Module;function L(y){if(!(this instanceof L))throw new s.TypeError("[WEBCAT] Constructor WebAssembly.Module requires \'new\'");const E=l(y);return new w(E)}const D=L;D.customSections=w.customSections.bind(w),D.exports=w.exports.bind(w),D.imports=w.imports.bind(w),b(D,t,"Module"),w.prototype.constructor=t.Module,t.Module.prototype=w.prototype,console.log("[WEBCAT] WebAssembly successfully hooked: all bytecode entry points now require authorization.")}),K=T("SharedWorker",function(r){if(!s.SharedWorker)return;const e=n(s.MessagePort),t=e.prototype.postMessage;function i(...k){if(o in n(this))if(n(this)[o].instance)t.call(n(this)[o].instance,...k);else{let p=k[1];if(p&&s.Symbol.iterator in p){const h=p;p=new s.Object,p.transfer=h}k[0]=s.structuredClone(k[0],p),n(this)[o].messages.push(k)}else t.call(this,...k)}b(i,e.prototype,"postMessage");const c=e.prototype.start;function l(){o in n(this)?n(this)[o].instance?c.call(n(this)[o].instance):n(this)[o].started=!0:c.call(this)}b(l,e.prototype,"start");const a=e.prototype.close;function d(){o in n(this)?n(this)[o].instance?a.call(n(this)[o].instance):n(this)[o].closed=!0:a.call(this)}b(d,e.prototype,"close"),C(e.prototype,"onmessage"),C(e.prototype,"onmessageerror");const m=n(s.SharedWorker);function u(...k){if(!(this instanceof u))throw new s.TypeError("SharedWorker constructor: \'new\' is required");if(k.length===0)throw new s.TypeError("SharedWorker constructor: At least 1 argument required, but only 0 passed");const p=n(s.Object).create(m.prototype),h=n(s.Object).create(e.prototype);return h[o]=R({onmessage:null,messages:[],onmessageerror:null,started:!1,closed:!1}),p[o]=R({port:h,onerror:null}),r.then(({firstParty:W})=>{k[0]=`${k[0]}#${W}`,p[o].instance=new m(...k),p[o].instance[H]=p,x(p),h[o].instance=p[o].instance.port,h[o].instance[H]=h,x(h),h[o].started&&h[o].instance.start(),h[o].closed&&h[o].instance.close(),h[o].messages.forEach(P=>{h[o].instance?.postMessage(...P)})}),p}b(u,s,"SharedWorker"),m.prototype.constructor=n(s.SharedWorker),n(s).SharedWorker.prototype=m.prototype;const{get:f}=Object.getOwnPropertyDescriptor(m.prototype,"port");function v(){return o in this?this[o].port:f?.apply(this)}Object.defineProperty(m.prototype,"port",{get:b(v,s)}),C(m.prototype,"onerror")}),J=T("ServiceWorker",function(r,{data:e}){if(typeof e=="string")try{Object.hasOwn(s.top||{},"name");return}catch{}else if(e===!0)return;delete n((s.Navigator||s.WorkerNavigator||s.Object).prototype).serviceWorker,delete n(s).ServiceWorker,delete n(s).ServiceWorkerContainer,delete n(s).ServiceWorkerRegistration}),Q=T("Worker",function(r){if(!s.SharedWorker)return;const e=n(s.Worker),t=n(s.EventTarget),i=n(s.Reflect).construct.bind(n(s.Reflect));function c(...u){if(!(this instanceof c))throw new TypeError("Worker constructor: \'new\' is required");if(u.length===0)throw new s.TypeError("Worker constructor: At least 1 argument required, but only 0 passed");const f=i(t,new s.Array,e);return f[o]=R({onmessage:null,messages:[],onerror:null}),r.then(({firstParty:v})=>{u[0]=`${u[0]}#${v}`,f[o].instance=new e(...u),f[o].instance[H]=f,f[o].terminated&&f[o].instance.terminate(),x(f),f[o].messages.forEach(k=>{f[o].instance?.postMessage(...k)})}),f}b(c,s,"Worker"),e.prototype.constructor=n(s.Worker),n(s).Worker.prototype=e.prototype;const l=e.prototype.postMessage;function a(...u){if(o in n(this))if(n(this)[o].instance)l.call(n(this)[o].instance,...u);else{let f=u[1];if(f&&s.Symbol.iterator in f){const v=f;f=new s.Object,f.transfer=v}u[0]=s.structuredClone(u[0],f),n(this)[o].messages.push(u)}else l.call(this,...u)}b(a,e.prototype,"postMessage");const d=e.prototype.terminate;function m(){o in n(this)?n(this)[o].instance?d.call(n(this)[o].instance):n(this)[o].terminated=!0:d.call(this)}b(m,e.prototype,"terminate"),C(e.prototype,"onmessage"),C(e.prototype,"onerror"),C(e.prototype,"onmessageerror")});console.log("[WEBCAT] Installing page hook");const j="__DATA_PLACEHOLDER__",M={};X(M,j),K(M,j),J(M,j),Q(M,j),z(M,j),G(M,j)})();\n';
+const hooks = {
+  content_script: '"__DATA_PLACEHOLDER__"',
+  page: pageHooks
+};
+class HookBuilder {
+  /**
+   * @param store A key-value store for persisting the builder's cryptographic
+   *   key and salt.
+   */
+  constructor(store, config) {
+    __privateAdd(this, _HookBuilder_instances);
+    __privateAdd(this, _staticHookPath);
+    __privateAdd(this, _firstPartyKey);
+    __privateAdd(this, _firstPartySalt);
+    __privateSet(this, _staticHookPath, config.staticHookPath);
+    __privateSet(this, _firstPartyKey, store.get("firstPartyKey", "session").then(async (raw) => {
+      let key;
+      const algorithm = { name: "AES-GCM", length: 256 };
+      const extractable = true;
+      const usages = ["encrypt", "decrypt"];
+      if (!raw) {
+        key = await crypto.subtle.generateKey(algorithm, extractable, usages);
+        store.set(
+          {
+            firstPartyKey: await crypto.subtle.exportKey("raw", key)
+          },
+          "session"
+        );
+      } else {
+        key = await crypto.subtle.importKey(
+          "raw",
+          raw,
+          algorithm,
+          extractable,
+          usages
+        );
+      }
+      return key;
+    }));
+    __privateSet(this, _firstPartySalt, store.get("firstPartySalt", "session").then((salt) => {
+      if (!salt) {
+        salt = crypto.getRandomValues(
+          new Uint8Array(256 / 8)
+          // SHA-256 length
+        );
+        store.set(
+          {
+            firstPartySalt: salt
+          },
+          "session"
+        );
+      }
+      return salt;
+    }));
+  }
+  /**
+   * @returns The path to the static content script file.
+   */
+  getStaticHookPath() {
+    return __privateGet(this, _staticHookPath);
+  }
+  /**
+   * @param wasm An array of hashes to validate WASM modules against.
+   * @param firstParty The first-party origin of the associated page.
+   * @param sameOrigin true if the target document is same-origin with the
+   *   first party.
+   * @returns A Promise that resolves to hook code ready to be injected
+   *   directly to a script file.
+   */
+  async getPageHooks(wasm, firstParty, sameOrigin) {
+    return __privateMethod(this, _HookBuilder_instances, get_fn).call(this, "page", wasm, firstParty, sameOrigin);
+  }
+  /**
+   * @param wasm An array of hashes to validate WASM modules against.
+   * @param firstParty The first-party origin of the associated page.
+   * @param sameOrigin true if the target document is same-origin with the
+   *   first party.
+   * @returns A Promise that resolves to hook code ready to be included in a
+   *   content script.
+   */
+  async getContentScriptHooks(wasm, firstParty, sameOrigin) {
+    const data = await __privateMethod(this, _HookBuilder_instances, get_fn).call(this, "content_script", wasm, firstParty, sameOrigin);
+    return [
+      function(data2) {
+        const scope = window;
+        for (const name in scope.hooks) {
+          console.log(`[WEBCAT] Updating hook: ${name}`);
+          scope.hooks[name].data = JSON.parse(data2);
+        }
+      },
+      [data]
+    ];
+  }
+  /**
+   * @param url A URL with an encrypted fragment added via a hook.
+   * @returns The decrypted fragment.
+   */
+  async decryptFragment(url) {
+    const markerIndex = url.lastIndexOf("#");
+    if (markerIndex === -1) {
+      throw new Error("no fragment present when decrypting");
+    }
+    const efpo = Uint8Array.fromBase64(url.substring(markerIndex + 1), {
+      alphabet: "base64url"
+    });
+    const fpo = await crypto.subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv: efpo.slice(0, 12)
+      },
+      await __privateGet(this, _firstPartyKey),
+      efpo.slice(12)
+    );
+    return new TextDecoder().decode(fpo);
+  }
+}
+_staticHookPath = new WeakMap();
+_firstPartyKey = new WeakMap();
+_firstPartySalt = new WeakMap();
+_HookBuilder_instances = new WeakSet();
+get_fn = async function(type, wasm, firstParty, sameOrigin) {
+  const iv = await crypto.subtle.deriveBits(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: await __privateGet(this, _firstPartySalt),
+      info: new ArrayBuffer()
+    },
+    await crypto.subtle.importKey(
+      "raw",
+      new TextEncoder().encode(firstParty),
+      { name: "HKDF" },
+      false,
+      ["deriveBits"]
+    ),
+    96
+  );
+  const ct = new Uint8Array(
+    await crypto.subtle.encrypt(
+      { name: "AES-GCM", iv },
+      await __privateGet(this, _firstPartyKey),
+      new TextEncoder().encode(firstParty)
+    )
+  );
+  const efpo = new Uint8Array(iv.byteLength + ct.byteLength);
+  efpo.set(new Uint8Array(iv));
+  efpo.set(ct, iv.byteLength);
+  const efpoBase64 = efpo.toBase64({ alphabet: "base64url" });
+  return hooks[type].replace(
+    '"__DATA_PLACEHOLDER__"',
+    JSON.stringify({
+      hashes: wasm,
+      firstParty: efpoBase64,
+      sameOriginWithFirstParty: sameOrigin
+    })
+  );
+};
+export {
+  HookBuilder
+};

package/dist/lib/webcat/interfaces/bundle.d.ts

@@ -0,0 +1,46 @@
+import { SigstoreBundle, TrustedRoot } from "@freedomofpress/sigstore-browser";
+export declare enum EnrollmentTypes {
+    Sigsum = "sigsum",
+    Sigstore = "sigstore"
+}
+export interface BaseEnrollment {
+    max_age: number;
+}
+export interface SigsumEnrollment extends BaseEnrollment {
+    type: EnrollmentTypes.Sigsum;
+    signers: string[];
+    threshold: number;
+    policy: string;
+    cas_url: string;
+    logs: Record<string, string>;
+}
+export interface SigstoreEnrollment extends BaseEnrollment {
+    type: EnrollmentTypes.Sigstore;
+    trusted_root: TrustedRoot;
+    claims: Record<string, string>;
+}
+export type Enrollment = SigsumEnrollment | SigstoreEnrollment;
+export interface Manifest {
+    name: string;
+    version: string;
+    default_csp: string;
+    extra_csp: {
+        [matchPrefix: string]: string;
+    };
+    default_index: string;
+    default_fallback: string;
+    timestamp?: string;
+    files: {
+        [filePath: string]: string;
+    };
+    wasm: string[];
+}
+export interface SigsumSignatures {
+    [pubKey: string]: string;
+}
+export type SigstoreSignatures = SigstoreBundle[];
+export interface Bundle {
+    enrollment: Enrollment;
+    manifest: Manifest;
+    signatures: SigsumSignatures | SigstoreSignatures;
+}

package/dist/lib/webcat/interfaces/bundle.js

@@ -0,0 +1,8 @@
+var EnrollmentTypes = /* @__PURE__ */ ((EnrollmentTypes2) => {
+  EnrollmentTypes2["Sigsum"] = "sigsum";
+  EnrollmentTypes2["Sigstore"] = "sigstore";
+  return EnrollmentTypes2;
+})(EnrollmentTypes || {});
+export {
+  EnrollmentTypes
+};

package/dist/lib/webcat/interfaces/database.d.ts

@@ -0,0 +1,68 @@
+import { CacheKey, LRUCache, LRUSet } from "../cache";
+import { CachePartition, OriginState } from "./originstate";
+export interface BlockMeta {
+    blockTime: number;
+    rootHash: string;
+}
+/**
+ * A persistence interface for enrollment information and origin states.
+ */
+export interface Database {
+    /**
+     * A partitioned LRU cache of origin states.
+     */
+    readonly origins: LRUCache<CacheKey<CachePartition>, OriginState>;
+    /**
+     * A partitioned LRU set of fully-qualified domain names not enrolled in
+     * WEBCAT.
+     */
+    readonly nonOrigins: LRUSet<CacheKey<CachePartition>>;
+    /**
+     * Updates the list of enrolled fully-qualified domain names.
+     */
+    updateList(leaves: readonly (readonly [string, string])[], meta: BlockMeta): Promise<void>;
+    /**
+     * Reads block metadata from the database.
+     *
+     * @returns A Promise that resolves the metadata for the most recently
+     *   applied block.
+     */
+    getBlockMeta(): Promise<BlockMeta | null>;
+    /**
+     * Reads fully-qualified domain names of enrolled origins from the database.
+     *
+     * @returns A Promise that resolves to an array of the FQDNs whose enrollment
+     *   is persisted locally.
+     */
+    listAllFQDNs(): Promise<string[]>;
+    /**
+     * Reads an enrollment hash from the database.
+     *
+     * @param fqdn The fully-qualified domain name whose enrollment hash to read.
+     * @param cachePartition The cache partition to use for cache lookups.
+     * @returns A Promise that resolves to the locally persisted enrollment hash
+     *   corresponding to fqdn.
+     */
+    getFQDNEnrollment(fqdn: string, cachePartition: CachePartition): Promise<Uint8Array>;
+    /**
+     * Persists current time as the time of the latest enrollment update attempt.
+     */
+    setLastChecked(): Promise<void>;
+    /**
+     * Reads the timestamp of the most recent enrollment update attempt.
+     *
+     * @returns A Promise that resolves to a time in milliseconds.
+     */
+    getLastChecked(): Promise<number | null>;
+    /**
+     * Persists the current time as the time of the latest successful enrollment
+     * update.
+     */
+    setLastUpdated(): Promise<void>;
+    /**
+     * Reads the timestamp of the most recent successful enrollment update.
+     *
+     * @returns A Promise that resolves to a time in milliseconds.
+     */
+    getLastUpdated(): Promise<number | null>;
+}

package/dist/lib/webcat/interfaces/database.js

@@ -0,0 +1 @@
+