@futdevpro/fsm-dynamo 1.20.92 → 1.20.93

package/build-esm/_modules/crypto/_services/artifact-signature.control-service.js

@@ -0,0 +1,276 @@
+const dyfm_base64UrlAlphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+const dyfm_checksumPattern = /^[a-f0-9]{64}$/u;
+const dyfm_keyIdPattern = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,119}$/u;
+const dyfm_signatureEvidenceKeys = [
+    'algorithm',
+    'contractVersion',
+    'encoding',
+    'hash',
+    'keyId',
+    'namedCurve',
+    'publicKeyFingerprint',
+    'signature',
+    'signedAt',
+    'subjectChecksum',
+];
+/** Cross-runtime ECDSA artifact signing and verification using the platform Web Crypto implementation. */
+export class DyFM_ArtifactSignature_ControlService {
+    /** Signs exact bytes with server-only PKCS#8 material and verifies the configured public/private pair. */
+    async sign(set) {
+        this.validateSubject(set.subjectBytes);
+        this.validateChecksum(set.subjectChecksum, 'SUBJECT_CHECKSUM_INVALID');
+        this.validateKeyId(set.keyId);
+        this.validateTimestamp(set.signedAt);
+        const subtle = this.getSubtleCrypto();
+        const subjectBytes = new Uint8Array(set.subjectBytes);
+        const actualChecksum = await this.checksum(subjectBytes);
+        if (actualChecksum !== set.subjectChecksum) {
+            throw this.buildError('SUBJECT_CHECKSUM_MISMATCH');
+        }
+        const privateKeyBytes = this.decodeBase64UrlStrict(set.privateKeyPkcs8Base64Url);
+        if (privateKeyBytes.byteLength < 64 || privateKeyBytes.byteLength > 512) {
+            throw this.buildError('PRIVATE_KEY_LENGTH_INVALID');
+        }
+        const publicKeyJwk = this.validatePublicJwk(set.publicKeyJwk);
+        const publicKeyFingerprint = await this.getPublicKeyFingerprint(publicKeyJwk);
+        let privateKey;
+        let publicKey;
+        try {
+            privateKey = await subtle.importKey('pkcs8', privateKeyBytes, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+            publicKey = await subtle.importKey('jwk', publicKeyJwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+        }
+        catch {
+            throw this.buildError('KEY_IMPORT_FAILED');
+        }
+        finally {
+            privateKeyBytes.fill(0);
+        }
+        let signatureBytes;
+        try {
+            signatureBytes = new Uint8Array(await subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, privateKey, subjectBytes));
+        }
+        catch {
+            throw this.buildError('SIGN_FAILED');
+        }
+        if (signatureBytes.byteLength !== 64) {
+            throw this.buildError('SIGNATURE_ENCODING_INVALID');
+        }
+        const isPairValid = await subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, publicKey, signatureBytes, subjectBytes);
+        if (!isPairValid) {
+            throw this.buildError('KEY_PAIR_MISMATCH');
+        }
+        return Object.freeze({
+            contractVersion: 'dyfm-artifact-signature/1',
+            subjectChecksum: actualChecksum,
+            algorithm: 'ECDSA',
+            namedCurve: 'P-256',
+            hash: 'SHA-256',
+            encoding: 'ieee-p1363',
+            keyId: set.keyId,
+            publicKeyFingerprint: publicKeyFingerprint,
+            signedAt: set.signedAt,
+            signature: this.encodeBase64Url(signatureBytes),
+        });
+    }
+    /** Verifies exact bytes and content-free evidence with an allowlisted public JWK. */
+    async verify(set) {
+        const evidenceCode = this.getEvidenceValidationCode(set.evidence);
+        if (evidenceCode) {
+            return this.result(set.evidence, false, evidenceCode);
+        }
+        if (!(set.subjectBytes instanceof Uint8Array) || !set.subjectBytes.byteLength) {
+            return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|SUBJECT_INVALID');
+        }
+        const subjectBytes = new Uint8Array(set.subjectBytes);
+        const actualChecksum = await this.checksum(subjectBytes);
+        if (actualChecksum !== set.evidence.subjectChecksum) {
+            return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|SUBJECT_CHECKSUM_MISMATCH');
+        }
+        let publicKeyJwk;
+        let signatureBytes;
+        try {
+            publicKeyJwk = this.validatePublicJwk(set.publicKeyJwk);
+            signatureBytes = this.decodeBase64UrlStrict(set.evidence.signature);
+        }
+        catch {
+            return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|PUBLIC_INPUT_INVALID');
+        }
+        if (signatureBytes.byteLength !== 64) {
+            return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|SIGNATURE_ENCODING_INVALID');
+        }
+        const publicKeyFingerprint = await this.getPublicKeyFingerprint(publicKeyJwk);
+        if (publicKeyFingerprint !== set.evidence.publicKeyFingerprint) {
+            return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|PUBLIC_KEY_FINGERPRINT_MISMATCH');
+        }
+        try {
+            const publicKey = await this.getSubtleCrypto().importKey('jwk', publicKeyJwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+            const isVerified = await this.getSubtleCrypto().verify({ name: 'ECDSA', hash: 'SHA-256' }, publicKey, signatureBytes, subjectBytes);
+            return this.result(set.evidence, isVerified, isVerified ? 'DYFM|ARTIFACT_SIGNATURE|VERIFIED' : 'DYFM|ARTIFACT_SIGNATURE|SIGNATURE_MISMATCH');
+        }
+        catch {
+            return this.result(set.evidence, false, 'DYFM|ARTIFACT_SIGNATURE|VERIFY_FAILED');
+        }
+    }
+    /** Calculates the canonical SHA-256 fingerprint of a public P-256 JWK. */
+    async getPublicKeyFingerprint(publicKeyJwkValue) {
+        const publicKeyJwk = this.validatePublicJwk(publicKeyJwkValue);
+        const canonicalJwk = JSON.stringify({
+            crv: publicKeyJwk.crv,
+            kty: publicKeyJwk.kty,
+            x: publicKeyJwk.x,
+            y: publicKeyJwk.y,
+        });
+        return this.checksum(new TextEncoder().encode(canonicalJwk));
+    }
+    async checksum(bytes) {
+        const digest = await this.getSubtleCrypto().digest('SHA-256', bytes);
+        return [...new Uint8Array(digest)]
+            .map((value) => value.toString(16).padStart(2, '0'))
+            .join('');
+    }
+    decodeBase64UrlStrict(value) {
+        if (!value || !/^[A-Za-z0-9_-]+$/u.test(value) || value.length % 4 === 1) {
+            throw this.buildError('BASE64URL_INVALID');
+        }
+        const bytes = [];
+        for (let index = 0; index < value.length; index += 4) {
+            const first = dyfm_base64UrlAlphabet.indexOf(value[index]);
+            const second = dyfm_base64UrlAlphabet.indexOf(value[index + 1]);
+            const third = index + 2 < value.length
+                ? dyfm_base64UrlAlphabet.indexOf(value[index + 2])
+                : 0;
+            const fourth = index + 3 < value.length
+                ? dyfm_base64UrlAlphabet.indexOf(value[index + 3])
+                : 0;
+            const combined = (first << 18) | (second << 12) | (third << 6) | fourth;
+            bytes.push((combined >>> 16) & 255);
+            if (index + 2 < value.length) {
+                bytes.push((combined >>> 8) & 255);
+            }
+            if (index + 3 < value.length) {
+                bytes.push(combined & 255);
+            }
+        }
+        const decoded = new Uint8Array(bytes);
+        if (this.encodeBase64Url(decoded) !== value) {
+            throw this.buildError('BASE64URL_NON_CANONICAL');
+        }
+        return decoded;
+    }
+    encodeBase64Url(bytes) {
+        let encoded = '';
+        for (let index = 0; index < bytes.length; index += 3) {
+            const remaining = bytes.length - index;
+            const combined = (bytes[index] << 16)
+                | ((remaining > 1 ? bytes[index + 1] : 0) << 8)
+                | (remaining > 2 ? bytes[index + 2] : 0);
+            encoded += dyfm_base64UrlAlphabet[(combined >>> 18) & 63];
+            encoded += dyfm_base64UrlAlphabet[(combined >>> 12) & 63];
+            if (remaining > 1) {
+                encoded += dyfm_base64UrlAlphabet[(combined >>> 6) & 63];
+            }
+            if (remaining > 2) {
+                encoded += dyfm_base64UrlAlphabet[combined & 63];
+            }
+        }
+        return encoded;
+    }
+    getEvidenceValidationCode(evidence) {
+        if (!evidence || typeof evidence !== 'object') {
+            return 'DYFM|ARTIFACT_SIGNATURE|EVIDENCE_INVALID';
+        }
+        const keys = Object.keys(evidence).sort();
+        if (JSON.stringify(keys) !== JSON.stringify(dyfm_signatureEvidenceKeys)) {
+            return 'DYFM|ARTIFACT_SIGNATURE|EVIDENCE_SHAPE_INVALID';
+        }
+        if (evidence.contractVersion !== 'dyfm-artifact-signature/1'
+            || evidence.algorithm !== 'ECDSA'
+            || evidence.namedCurve !== 'P-256'
+            || evidence.hash !== 'SHA-256'
+            || evidence.encoding !== 'ieee-p1363') {
+            return 'DYFM|ARTIFACT_SIGNATURE|EVIDENCE_CONTRACT_INVALID';
+        }
+        if (!dyfm_checksumPattern.test(evidence.subjectChecksum)) {
+            return 'DYFM|ARTIFACT_SIGNATURE|SUBJECT_CHECKSUM_INVALID';
+        }
+        if (!dyfm_checksumPattern.test(evidence.publicKeyFingerprint)) {
+            return 'DYFM|ARTIFACT_SIGNATURE|PUBLIC_KEY_FINGERPRINT_INVALID';
+        }
+        if (!dyfm_keyIdPattern.test(evidence.keyId)) {
+            return 'DYFM|ARTIFACT_SIGNATURE|KEY_ID_INVALID';
+        }
+        if (!this.isCanonicalTimestamp(evidence.signedAt)) {
+            return 'DYFM|ARTIFACT_SIGNATURE|SIGNED_AT_INVALID';
+        }
+        if (!/^[A-Za-z0-9_-]{86}$/u.test(evidence.signature)) {
+            return 'DYFM|ARTIFACT_SIGNATURE|SIGNATURE_ENCODING_INVALID';
+        }
+        return '';
+    }
+    getSubtleCrypto() {
+        if (!globalThis.crypto?.subtle) {
+            throw this.buildError('WEB_CRYPTO_UNAVAILABLE');
+        }
+        return globalThis.crypto.subtle;
+    }
+    isCanonicalTimestamp(value) {
+        const timestamp = Date.parse(value);
+        return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
+    }
+    result(evidence, isVerified, code) {
+        return Object.freeze({
+            contractVersion: 'dyfm-artifact-signature-verification/1',
+            isVerified: isVerified,
+            code: code,
+            subjectChecksum: typeof evidence?.subjectChecksum === 'string' ? evidence.subjectChecksum : '',
+            keyId: typeof evidence?.keyId === 'string' ? evidence.keyId : '',
+        });
+    }
+    validateChecksum(value, code) {
+        if (!dyfm_checksumPattern.test(value)) {
+            throw this.buildError(code);
+        }
+    }
+    validateKeyId(value) {
+        if (!dyfm_keyIdPattern.test(value)) {
+            throw this.buildError('KEY_ID_INVALID');
+        }
+    }
+    validatePublicJwk(value) {
+        if (!value
+            || typeof value !== 'object'
+            || value.kty !== 'EC'
+            || value.crv !== 'P-256'
+            || typeof value.x !== 'string'
+            || typeof value.y !== 'string'
+            || Object.prototype.hasOwnProperty.call(value, 'd')) {
+            throw this.buildError('PUBLIC_KEY_INVALID');
+        }
+        const xBytes = this.decodeBase64UrlStrict(value.x);
+        const yBytes = this.decodeBase64UrlStrict(value.y);
+        if (xBytes.byteLength !== 32 || yBytes.byteLength !== 32) {
+            throw this.buildError('PUBLIC_KEY_COORDINATE_INVALID');
+        }
+        return Object.freeze({
+            kty: 'EC',
+            crv: 'P-256',
+            x: value.x,
+            y: value.y,
+            ext: true,
+            key_ops: ['verify'],
+        });
+    }
+    validateSubject(value) {
+        if (!(value instanceof Uint8Array) || !value.byteLength) {
+            throw this.buildError('SUBJECT_INVALID');
+        }
+    }
+    validateTimestamp(value) {
+        if (!this.isCanonicalTimestamp(value)) {
+            throw this.buildError('SIGNED_AT_INVALID');
+        }
+    }
+    buildError(code) {
+        return new TypeError(`DYFM|ARTIFACT_SIGNATURE|${code}`);
+    }
+}

package/build-esm/_modules/crypto/index.js

@@ -0,0 +1,11 @@
+/* try {
+  //require.resolve('crypto-js');
+  import('crypto-js');
+} catch {
+  console.log(
+    '❌ crypto-js package not found, please install it with: pnpm add crypto-js'
+  );
+} */
+export * from './_collections/crypto.util';
+export * from './_models/artifact-signature.interface';
+export * from './_services/artifact-signature.control-service';

package/build-esm/_modules/custom-data/_collections/cud-module-settings.const.js

@@ -0,0 +1,18 @@
+/**
+ * Routes available in the Custom Data module.
+ */
+export var DyFM_CustomRoute;
+(function (DyFM_CustomRoute) {
+    DyFM_CustomRoute["getCustomData"] = "getCustomData";
+    DyFM_CustomRoute["modifyCustomData"] = "modifyCustomData";
+})(DyFM_CustomRoute || (DyFM_CustomRoute = {}));
+/**
+ * Default settings for the Custom Data module.
+ */
+export const DyFM_customDataModule_settings = {
+    mainRoute: '/custom',
+    endPoints: {
+        [DyFM_CustomRoute.getCustomData]: '/get/:customId',
+        [DyFM_CustomRoute.modifyCustomData]: '/post',
+    },
+};

package/build-esm/_modules/custom-data/_models/cud.data-model.js

@@ -0,0 +1,30 @@
+import { DyFM_DataModel_Params } from '../../../_models/control-models/data-model-params.control-model';
+import { DyFM_Metadata } from '../../../_models/data-models/metadata.data-model';
+/**
+ * Generic data container that can store custom information.
+ *
+ * @example
+ * ```ts
+ * const customData: DyFM_Cud_DataModel<{ name: string }> = new DyFM_Cud_DataModel({
+ *   data: { name: 'John Doe' },
+ * });
+ * ```
+ */
+export class DyFM_Cud_DataModel extends DyFM_Metadata {
+    data;
+    constructor(set) {
+        super(set);
+        if (set) {
+            Object.assign(this, set);
+        }
+    }
+}
+export const DyFM_customData_dataParams = new DyFM_DataModel_Params({
+    dataName: 'custom_data',
+    properties: {
+        data: { key: 'data', type: 'string', required: true },
+    },
+});
+Object.defineProperty(DyFM_Cud_DataModel, 'name', { value: 'DyFM_CustomData' });
+/** @deprecated Use DyFM_Cud_DataModel. Same constructor; no API removal. */
+export { DyFM_Cud_DataModel as DyFM_CustomData };

package/build-esm/_modules/custom-data/index.js

@@ -0,0 +1,4 @@
+// COLLECTIONS
+export * from './_collections/cud-module-settings.const';
+// MODELS
+export * from './_models/cud.data-model';

package/build-esm/_modules/data-handler/_models/data-handler-settings.control-model.js

@@ -0,0 +1,78 @@
+/**
+ * DyFM_DataHandler_Settings
+ * @param apiService any service can be used as apiService
+ * as long as the function, you pass in getDataFunctionName exists,
+ * uses (or not uses an ID as input) and returns the data as Promise<Type>
+ * @param getDataFunctionName the function name on the apiService,
+ * that will be used as get api call
+ *
+ * @param successfulReloadCallBack you can create direct callback for successful reloads
+ * by passing it here
+ *
+ * @param getPostPreprocessLoad post processes can be implemented to ensure special conditions on data
+ *
+ * @param defaultValue you can set default value that will be used before any load
+ * @param noId this flag needs to be true, when using api function without id
+ *
+ * @example
+ * personalInformationDH = new DynamoDataHandler<PersonalInformation>({
+ *   apiService: this.accountApiService,
+ *   getDataFunctionName: 'getPersonalInformation',
+ * });
+ */
+export class DyFM_DataHandlerSettings_ControlModel {
+    static {
+        Object.defineProperty(this, 'name', { value: 'DyFM_DataHandler_Settings' });
+    }
+    name;
+    /** this will be used to get the data from the API
+     * while creating arrow function for this, dont forget to use async n await! */
+    get;
+    /** this will be used to set the data to the data handler
+     * while creating arrow function for this, dont forget to use async n await! */
+    set;
+    /* patch?: (data: T) => Promise<T>; */
+    // TODO
+    /* directApiSetup?: { set, get,}; */
+    // AVAGY
+    /* apiCallSettings?: DyNX_ApiCall_Settings; */
+    /* successfulLoadCallBack?: (data: T) => void; */
+    /**
+     * post processes will be called as pipes after data is loaded by get function,
+     * but before data is set to data handler by data_$.set (after get, before Signal triggers)
+     */
+    getPostProcess;
+    dependencyDataHandler;
+    dependentDataHandlers;
+    defaultValue;
+    defaultLoadBy;
+    /** @deprecated Use isIdOmitted; noId remains the serialized compatibility key. */
+    noId;
+    /** @deprecated Use isDebugLogEnabled; debugLog remains the serialized compatibility key. */
+    debugLog;
+}
+Object.defineProperty(DyFM_DataHandlerSettings_ControlModel.prototype, 'isIdOmitted', {
+    configurable: true,
+    enumerable: false,
+    get: function () {
+        return this.noId;
+    },
+    set: function (isValue) {
+        this.noId = isValue;
+    },
+});
+Object.defineProperty(DyFM_DataHandlerSettings_ControlModel.prototype, 'isDebugLogEnabled', {
+    configurable: true,
+    enumerable: false,
+    get: function () {
+        return this.debugLog;
+    },
+    set: function (isValue) {
+        this.debugLog = isValue;
+    },
+});
+/** @deprecated Use DyFM_DataHandlerSettings_ControlModel. Same constructor; no API removal. */
+export { DyFM_DataHandlerSettings_ControlModel as DyFM_DataHandler_Settings };
+// BFR-FUTDEVPRO-021: the subclass settings models are exported by the entry index DIRECTLY — re-exporting them from
+// HERE made a module cycle (they EXTEND this file's class): harmless in CommonJS, but in an ES-module build the
+// hoisted re-export evaluates the subclass BEFORE its base ("Class extends value undefined").