@haex-space/vault-sdk 2.5.106 → 2.5.108

package/dist/index.mjs

@@ -2742,6 +2742,184 @@ async function verifyExtensionSignature(files, manifest) {
   }
 }
 
+// src/crypto/userKeypair.ts
+var SIGNING_ALGO = { name: "ECDSA", namedCurve: "P-256" };
+var KEY_AGREEMENT_ALGO = { name: "ECDH", namedCurve: "P-256" };
+async function generateUserKeypairAsync() {
+  const keypair = await crypto.subtle.generateKey(SIGNING_ALGO, true, ["sign", "verify"]);
+  return { publicKey: keypair.publicKey, privateKey: keypair.privateKey };
+}
+async function exportUserKeypairAsync(keypair) {
+  const pub = await crypto.subtle.exportKey("spki", keypair.publicKey);
+  const priv = await crypto.subtle.exportKey("pkcs8", keypair.privateKey);
+  return { publicKey: arrayBufferToBase64(pub), privateKey: arrayBufferToBase64(priv) };
+}
+async function importUserPublicKeyAsync(base64) {
+  return crypto.subtle.importKey("spki", base64ToArrayBuffer(base64), SIGNING_ALGO, true, ["verify"]);
+}
+async function importUserPrivateKeyAsync(base64) {
+  return crypto.subtle.importKey("pkcs8", base64ToArrayBuffer(base64), SIGNING_ALGO, true, ["sign"]);
+}
+async function importPublicKeyForKeyAgreementAsync(base64) {
+  return crypto.subtle.importKey("spki", base64ToArrayBuffer(base64), KEY_AGREEMENT_ALGO, true, []);
+}
+async function importPrivateKeyForKeyAgreementAsync(base64) {
+  return crypto.subtle.importKey("pkcs8", base64ToArrayBuffer(base64), KEY_AGREEMENT_ALGO, true, ["deriveBits"]);
+}
+async function encryptPrivateKeyAsync(privateKeyBase64, password) {
+  const salt = crypto.getRandomValues(new Uint8Array(32));
+  const derivedKey = await deriveKeyFromPassword(password, salt);
+  const nonce = crypto.getRandomValues(new Uint8Array(12));
+  const encrypted = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv: nonce },
+    derivedKey,
+    new TextEncoder().encode(privateKeyBase64)
+  );
+  return {
+    encryptedPrivateKey: arrayBufferToBase64(encrypted),
+    nonce: arrayBufferToBase64(nonce),
+    salt: arrayBufferToBase64(salt)
+  };
+}
+async function decryptPrivateKeyAsync(encryptedPrivateKey, nonce, salt, password) {
+  const derivedKey = await deriveKeyFromPassword(password, base64ToArrayBuffer(salt));
+  const decrypted = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: base64ToArrayBuffer(nonce) },
+    derivedKey,
+    base64ToArrayBuffer(encryptedPrivateKey)
+  );
+  return new TextDecoder().decode(decrypted);
+}
+
+// src/crypto/spaceKey.ts
+function generateSpaceKey() {
+  return generateVaultKey();
+}
+async function encryptSpaceKeyForRecipientAsync(spaceKey, recipientPublicKeyBase64) {
+  const ephemeral = await crypto.subtle.generateKey(KEY_AGREEMENT_ALGO, true, ["deriveBits"]);
+  const recipientKey = await importPublicKeyForKeyAgreementAsync(recipientPublicKeyBase64);
+  const sharedBits = await crypto.subtle.deriveBits(
+    { name: "ECDH", public: recipientKey },
+    ephemeral.privateKey,
+    256
+  );
+  const aesKey = await crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: new TextEncoder().encode("haex-space-key")
+    },
+    await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]),
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt"]
+  );
+  const nonce = crypto.getRandomValues(new Uint8Array(12));
+  const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce }, aesKey, spaceKey);
+  const ephPub = await crypto.subtle.exportKey("spki", ephemeral.publicKey);
+  return {
+    encryptedSpaceKey: arrayBufferToBase64(encrypted),
+    keyNonce: arrayBufferToBase64(nonce),
+    ephemeralPublicKey: arrayBufferToBase64(ephPub)
+  };
+}
+async function decryptSpaceKeyAsync(encrypted, ownPrivateKeyBase64) {
+  const ephPubKey = await crypto.subtle.importKey(
+    "spki",
+    base64ToArrayBuffer(encrypted.ephemeralPublicKey),
+    KEY_AGREEMENT_ALGO,
+    true,
+    []
+  );
+  const ownPrivKey = await importPrivateKeyForKeyAgreementAsync(ownPrivateKeyBase64);
+  const sharedBits = await crypto.subtle.deriveBits(
+    { name: "ECDH", public: ephPubKey },
+    ownPrivKey,
+    256
+  );
+  const aesKey = await crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: new TextEncoder().encode("haex-space-key")
+    },
+    await crypto.subtle.importKey("raw", sharedBits, "HKDF", false, ["deriveKey"]),
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["decrypt"]
+  );
+  const decrypted = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: base64ToArrayBuffer(encrypted.keyNonce) },
+    aesKey,
+    base64ToArrayBuffer(encrypted.encryptedSpaceKey)
+  );
+  return new Uint8Array(decrypted);
+}
+
+// src/crypto/recordSigning.ts
+function canonicalize(record) {
+  const parts = [
+    record.tableName,
+    record.rowPks,
+    record.columnName === null ? "
NULL" : record.columnName,
+    record.encryptedValue === null ? "
NULL" : record.encryptedValue,
+    record.hlcTimestamp
+  ].join("\0");
+  return new TextEncoder().encode(parts);
+}
+async function signRecordAsync(record, privateKeyBase64) {
+  const key = await importUserPrivateKeyAsync(privateKeyBase64);
+  const sig = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, key, canonicalize(record));
+  return arrayBufferToBase64(sig);
+}
+async function verifyRecordSignatureAsync(record, signatureBase64, publicKeyBase64) {
+  const key = await importUserPublicKeyAsync(publicKeyBase64);
+  return crypto.subtle.verify(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    base64ToArrayBuffer(signatureBase64),
+    canonicalize(record)
+  );
+}
+var CHALLENGE_MAX_AGE_MS = 3e4;
+function canonicalizeChallenge(spaceId, timestamp) {
+  return new TextEncoder().encode(`${spaceId}\0${timestamp}`).buffer;
+}
+async function signSpaceChallengeAsync(spaceId, privateKeyBase64) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const key = await importUserPrivateKeyAsync(privateKeyBase64);
+  const sig = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    canonicalizeChallenge(spaceId, timestamp)
+  );
+  return { signature: arrayBufferToBase64(sig), timestamp };
+}
+async function verifySpaceChallengeAsync(spaceId, timestamp, signatureBase64, publicKeyBase64) {
+  const tsMs = new Date(timestamp).getTime();
+  if (Number.isNaN(tsMs)) {
+    return { valid: false, error: "Invalid timestamp format" };
+  }
+  const age = Date.now() - tsMs;
+  if (age < 0 || age > CHALLENGE_MAX_AGE_MS) {
+    return { valid: false, error: "Challenge timestamp expired or in the future" };
+  }
+  try {
+    const key = await importUserPublicKeyAsync(publicKeyBase64);
+    const isValid = await crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      key,
+      base64ToArrayBuffer(signatureBase64),
+      canonicalizeChallenge(spaceId, timestamp)
+    );
+    return isValid ? { valid: true } : { valid: false, error: "Invalid challenge signature" };
+  } catch {
+    return { valid: false, error: "Challenge verification failed" };
+  }
+}
+
 // src/crypto/passkey.ts
 function toArrayBuffer(data) {
   if (data instanceof ArrayBuffer) {
@@ -2912,6 +3090,6 @@ function createHaexVaultSdk(config = {}) {
   return new HaexVaultSdk(config);
 }
 
-export { COSE_ALGORITHM, DEFAULT_TIMEOUT, DatabaseAPI, EXTERNAL_EVENTS, ErrorCode, ExternalConnectionErrorCode, ExternalConnectionState, FilesystemAPI, HAEXSPACE_MESSAGE_TYPES, HAEXTENSION_EVENTS, HaexVaultSdk, HaexVaultSdkError, LOCALSEND_EVENTS, LocalSendAPI, PermissionErrorCode, PermissionStatus, PermissionsAPI, RemoteStorageAPI, TABLE_SEPARATOR, TAURI_COMMANDS, WebAPI, arrayBufferToBase64, base64ToArrayBuffer, canExternalClientSendRequests, createHaexVaultSdk, decryptCrdtData, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptString, encryptVaultKey, exportKeyPairAsync, exportPrivateKeyAsync, exportPublicKeyAsync, exportPublicKeyCoseAsync, generateCredentialId, generatePasskeyPairAsync, generateVaultKey, getTableName, hexToBytes, importPrivateKeyAsync, importPublicKeyAsync, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, isExternalClientConnected, isPermissionDeniedError, isPermissionError, isPermissionPromptError, signWithPasskeyAsync, sortObjectKeysRecursively, unwrapKey, verifyExtensionSignature, verifyWithPasskeyAsync, wrapKey };
+export { COSE_ALGORITHM, DEFAULT_TIMEOUT, DatabaseAPI, EXTERNAL_EVENTS, ErrorCode, ExternalConnectionErrorCode, ExternalConnectionState, FilesystemAPI, HAEXSPACE_MESSAGE_TYPES, HAEXTENSION_EVENTS, HaexVaultSdk, HaexVaultSdkError, KEY_AGREEMENT_ALGO, LOCALSEND_EVENTS, LocalSendAPI, PermissionErrorCode, PermissionStatus, PermissionsAPI, RemoteStorageAPI, SIGNING_ALGO, TABLE_SEPARATOR, TAURI_COMMANDS, WebAPI, arrayBufferToBase64, base64ToArrayBuffer, canExternalClientSendRequests, createHaexVaultSdk, decryptCrdtData, decryptPrivateKeyAsync, decryptSpaceKeyAsync, decryptString, decryptVaultKey, decryptVaultName, deriveKeyFromPassword, encryptCrdtData, encryptPrivateKeyAsync, encryptSpaceKeyForRecipientAsync, encryptString, encryptVaultKey, exportKeyPairAsync, exportPrivateKeyAsync, exportPublicKeyAsync, exportPublicKeyCoseAsync, exportUserKeypairAsync, generateCredentialId, generatePasskeyPairAsync, generateSpaceKey, generateUserKeypairAsync, generateVaultKey, getTableName, hexToBytes, importPrivateKeyAsync, importPrivateKeyForKeyAgreementAsync, importPublicKeyAsync, importPublicKeyForKeyAgreementAsync, importUserPrivateKeyAsync, importUserPublicKeyAsync, installBaseTag, installCookiePolyfill, installHistoryPolyfill, installLocalStoragePolyfill, installPolyfills, installSessionStoragePolyfill, isExternalClientConnected, isPermissionDeniedError, isPermissionError, isPermissionPromptError, signRecordAsync, signSpaceChallengeAsync, signWithPasskeyAsync, sortObjectKeysRecursively, unwrapKey, verifyExtensionSignature, verifyRecordSignatureAsync, verifySpaceChallengeAsync, verifyWithPasskeyAsync, wrapKey };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map