@harperfast/harper 5.0.0-alpha.10

package/dist/security/certificateVerification/configValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configValidation.js","sourceRoot":"","sources":["../../../security/certificateVerification/configValidation.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;AA2FH,sGAaC;AAtGD,8CAAsB;AAGT,QAAA,oBAAoB,GAAG,aAAa,CAAC,CAAC,8CAA8C;AAEjG,wCAAwC;AAC3B,QAAA,aAAa,GAAiB;IAC1C,OAAO,EAAE,IAAI,EAAE,YAAY;IAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS;IAC5B,aAAa,EAAE,MAAM,EAAE,0CAA0C;IACjE,WAAW,EAAE,aAAa;CAC1B,CAAC;AAEF,uCAAuC;AAC1B,QAAA,YAAY,GAAgB;IACxC,OAAO,EAAE,KAAK,EAAE,aAAa;IAC7B,QAAQ,EAAE,QAAQ,EAAE,WAAW;IAC/B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,QAAQ,EAAE,4BAA4B;CACnD,CAAC;AAEF,MAAM,iBAAiB,GAAG,aAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAEzE,qEAAqE;AACrE,MAAM,eAAe,GAAG,aAAG,CAAC,YAAY,EAAE,CAAC,GAAG;AAC7C,oEAAoE;AACpE,aAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IAC9B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IACD,mCAAmC;IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,oBAAY,EAAE,CAAC;AAC3C,CAAC,CAAC;AACF,sCAAsC;AACtC,aAAG,CAAC,MAAM,CAAC;IACV,OAAO,EAAE,aAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,OAAO,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,oBAAY,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACtE,YAAY,EAAE,gDAAgD;KAC9D,CAAC;IACF,QAAQ,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,oBAAY,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;QACxE,YAAY,EAAE,iDAAiD;KAC/D,CAAC;IACF,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,oBAAY,CAAC,WAAW,CAAC;IAChE,WAAW,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAY,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;QAC3E,YAAY,EAAE,sCAAsC;KACpD,CAAC;CACF,CAAC,CACF,CAAC;AAEF,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,aAAG,CAAC,YAAY,EAAE,CAAC,GAAG;AAC9C,oEAAoE;AACpE,aAAG,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IAC9B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;IACD,mCAAmC;IACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,qBAAa,EAAE,CAAC;AAC5C,CAAC,CAAC;AACF,sCAAsC;AACtC,aAAG,CAAC,MAAM,CAAC;IACV,OAAO,EAAE,aAAG,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,OAAO,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAa,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvE,YAAY,EAAE,iDAAiD;KAC/D,CAAC;IACF,QAAQ,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;QACzE,YAAY,EAAE,kDAAkD;KAChE,CAAC;IACF,aAAa,EAAE,aAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAa,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC;QACnF,YAAY,EAAE,uDAAuD;KACrE,CAAC;IACF,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,qBAAa,CAAC,WAAW,CAAC;CACjE,CAAC,CACF,CAAC;AAEF,uCAAuC;AACvC,wEAAwE;AACxE,MAAM,6BAA6B,GAAG,aAAG,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,4BAAoB,CAAC;IAC5D,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,oBAAY,EAAE,CAAC;IAChE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,qBAAa,EAAE,CAAC;CACnE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAgB,6CAA6C,CAAC,MAAe;IAC5E,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,6BAA6B,CAAC,QAAQ,CAAC,MAAM,EAAE;QACvE,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;KACnB,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mDAAmD,YAAY,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,4EAA4E;IAC5E,OAAO,KAAsC,CAAC;AAC/C,CAAC"}

package/dist/security/certificateVerification/crlVerification.d.ts

@@ -0,0 +1,29 @@
+/**
+ * CRL (Certificate Revocation List) verification
+ */
+import type { CertificateVerificationResult, CRLCheckResult, CRLConfig } from './types.ts';
+/**
+ * Custom error for CRL signature verification failures
+ * This distinguishes security failures (invalid signatures) from operational failures (network, timeout)
+ */
+export declare class CRLSignatureVerificationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Verify CRL status of a client certificate
+ * @param certPem - Client certificate as Buffer (DER format)
+ * @param issuerPem - Issuer (CA) certificate as Buffer (DER format)
+ * @param config - CRL configuration
+ * @param crlUrls - Optional pre-extracted CRL distribution point URLs (avoids re-parsing)
+ * @returns Promise resolving to verification result
+ */
+export declare function verifyCRL(certPem: Buffer, issuerPem: Buffer, config?: CRLConfig, crlUrls?: string[]): Promise<CertificateVerificationResult>;
+/**
+ * Perform the actual CRL check by looking up the certificate in the revoked certificates table
+ * @param certPem - Certificate in PEM format
+ * @param issuerPem - Issuer certificate in PEM format
+ * @param config - CRL configuration
+ * @param crlUrls - Optional pre-extracted CRL distribution point URLs (avoids re-parsing)
+ * @returns CRL check result
+ */
+export declare function performCRLCheck(certPem: string, issuerPem: string, config: CRLConfig, crlUrls?: string[]): Promise<CRLCheckResult>;

package/dist/security/certificateVerification/crlVerification.js

@@ -0,0 +1,564 @@
+"use strict";
+/**
+ * CRL (Certificate Revocation List) verification
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CRLSignatureVerificationError = void 0;
+exports.verifyCRL = verifyCRL;
+exports.performCRLCheck = performCRLCheck;
+const pkijs = __importStar(require("pkijs"));
+const logger_ts_1 = require("../../utility/logging/logger.js");
+const databases_ts_1 = require("../../resources/databases.js");
+const Resource_ts_1 = require("../../resources/Resource.js");
+const verificationUtils_ts_1 = require("./verificationUtils.js");
+const verificationConfig_ts_1 = require("./verificationConfig.js");
+/**
+ * Custom error for CRL signature verification failures
+ * This distinguishes security failures (invalid signatures) from operational failures (network, timeout)
+ */
+class CRLSignatureVerificationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CRLSignatureVerificationError';
+    }
+}
+exports.CRLSignatureVerificationError = CRLSignatureVerificationError;
+const certificateVerificationSource_ts_1 = require("./certificateVerificationSource.js");
+const logger = (0, logger_ts_1.loggerWithTag)('crl-verification');
+// Lazy-load the certificate verification cache table with CRL source configured
+let certCacheTable;
+function getCertificateCacheTable() {
+    if (!certCacheTable) {
+        certCacheTable = (0, verificationUtils_ts_1.getCertificateCacheTable)();
+        // Configure the caching source using the shared CertificateVerificationSource class
+        certCacheTable.sourcedFrom(certificateVerificationSource_ts_1.CertificateVerificationSource);
+    }
+    return certCacheTable;
+}
+/**
+ * CRL fetching and validation source
+ */
+class CertificateRevocationListSource extends Resource_ts_1.Resource {
+    async get(id) {
+        const context = this.getContext();
+        const requestContext = context?.requestContext;
+        if (!requestContext?.distributionPoint || !requestContext?.issuerPem) {
+            throw new Error(`No CRL data provided for cache key: ${id}`);
+        }
+        const { distributionPoint, issuerPem: issuerPemStr, config } = requestContext;
+        try {
+            const result = await downloadAndParseCRL(distributionPoint, issuerPemStr, config.timeout);
+            // Set expiration - use the CRL's nextUpdate time or configured TTL, whichever is sooner
+            const crlExpiry = result.next_update;
+            const configExpiry = Date.now() + config.cacheTtl;
+            const expiresAt = Math.min(crlExpiry, configExpiry);
+            return {
+                ...result,
+                expiresAt,
+            };
+        }
+        catch (error) {
+            logger.error?.(`CRL fetch error for: ${distributionPoint} - ${error}`);
+            // Check failure mode
+            if (config.failureMode === 'fail-closed') {
+                // Cache the error for faster recovery
+                const expiresAt = Date.now() + verificationConfig_ts_1.ERROR_CACHE_TTL;
+                return {
+                    crl_id: id,
+                    distribution_point: distributionPoint,
+                    issuer_dn: 'unknown',
+                    crl_blob: Buffer.alloc(0),
+                    this_update: Date.now(),
+                    next_update: expiresAt,
+                    signature_valid: false,
+                    expiresAt,
+                };
+            }
+            // Fail open - return null to not cache
+            logger.warn?.('CRL fetch failed, not caching (fail-open mode)');
+            return null;
+        }
+    }
+}
+// Lazy-load Harper tables
+let crlCacheTable;
+let revokedCertificateTable;
+function getCRLCacheTable() {
+    if (!crlCacheTable) {
+        crlCacheTable = (0, databases_ts_1.table)({
+            table: 'hdb_crl_cache',
+            database: 'system',
+            attributes: [
+                {
+                    name: 'distribution_point',
+                    isPrimaryKey: true,
+                },
+                {
+                    name: 'issuer_dn',
+                },
+                {
+                    name: 'crl_blob',
+                },
+                {
+                    name: 'this_update',
+                },
+                {
+                    name: 'next_update',
+                },
+                {
+                    name: 'signature_valid',
+                },
+                {
+                    name: 'expiresAt',
+                    expiresAt: true,
+                    indexed: true,
+                },
+            ],
+        });
+        // Configure the caching source
+        crlCacheTable.sourcedFrom(CertificateRevocationListSource);
+    }
+    return crlCacheTable;
+}
+function getRevokedCertificateTable() {
+    if (!revokedCertificateTable) {
+        revokedCertificateTable = (0, databases_ts_1.table)({
+            table: 'hdb_revoked_certificates',
+            database: 'system',
+            attributes: [
+                {
+                    name: 'composite_id',
+                    isPrimaryKey: true,
+                },
+                {
+                    name: 'serial_number',
+                    indexed: true,
+                },
+                {
+                    name: 'issuer_key_id',
+                    indexed: true,
+                },
+                {
+                    name: 'revocation_date',
+                },
+                {
+                    name: 'revocation_reason',
+                },
+                {
+                    name: 'crl_source',
+                    indexed: true, // Links to CRL cache
+                },
+                {
+                    name: 'crl_next_update',
+                },
+                {
+                    name: 'expiresAt',
+                    expiresAt: true,
+                    indexed: true,
+                },
+            ],
+        });
+    }
+    return revokedCertificateTable;
+}
+/**
+ * Verify CRL status of a client certificate
+ * @param certPem - Client certificate as Buffer (DER format)
+ * @param issuerPem - Issuer (CA) certificate as Buffer (DER format)
+ * @param config - CRL configuration
+ * @param crlUrls - Optional pre-extracted CRL distribution point URLs (avoids re-parsing)
+ * @returns Promise resolving to verification result
+ */
+async function verifyCRL(certPem, issuerPem, config, crlUrls) {
+    // Check if CRL verification is disabled
+    if (config?.enabled === false) {
+        return { valid: true, status: 'disabled', method: 'disabled' };
+    }
+    try {
+        // Convert DER buffers to PEM strings for certificate parsing libraries
+        // PKI.js and other certificate utilities expect PEM format for extension extraction
+        const certPemStr = (0, verificationUtils_ts_1.bufferToPem)(certPem, 'CERTIFICATE');
+        const issuerPemStr = (0, verificationUtils_ts_1.bufferToPem)(issuerPem, 'CERTIFICATE');
+        // Extract CRL distribution points from the certificate (if not already provided)
+        const distributionPoints = crlUrls ?? (0, verificationUtils_ts_1.extractCRLDistributionPoints)(certPemStr);
+        if (distributionPoints.length === 0) {
+            return { valid: true, status: 'no-crl-distribution-points', method: 'crl' };
+        }
+        // Create a cache key that includes all verification parameters
+        const cacheKey = (0, verificationUtils_ts_1.createCacheKey)(certPemStr, issuerPemStr, 'crl');
+        // Pass certificate data as context - Harper will make it available as requestContext in the source
+        const cacheEntry = await getCertificateCacheTable().get(cacheKey, {
+            certPem: certPemStr,
+            issuerPem: issuerPemStr,
+            distributionPoint: distributionPoints[0], // Use first distribution point for CRL fetch
+            config: { crl: config ?? {} },
+        });
+        if (!cacheEntry) {
+            // This should not happen if the source is configured correctly but handle it gracefully
+            logger.error?.('Cache fetch returned null - this indicates a source configuration issue');
+            if (config.failureMode === 'fail-closed') {
+                return { valid: false, status: 'error', error: 'Cache fetch failed', method: 'crl' };
+            }
+            logger.warn?.('CRL cache fetch failed, allowing connection (fail-open mode)');
+            return { valid: true, status: 'error-allowed', method: 'crl' };
+        }
+        const cached = cacheEntry;
+        const wasLoadedFromSource = cacheEntry.wasLoadedFromSource?.();
+        logger.trace?.(`CRL ${wasLoadedFromSource ? 'source fetch' : 'cache hit'} for certificate`);
+        return {
+            valid: cached.status === 'good',
+            status: cached.status,
+            cached: !wasLoadedFromSource,
+            method: cached.method || 'crl',
+        };
+    }
+    catch (error) {
+        logger.error?.(`CRL verification error: ${error}`);
+        // Check failure mode
+        if (config.failureMode === 'fail-closed') {
+            return { valid: false, status: 'error', error: error.message, method: 'crl' };
+        }
+        // Fail open - allow connection on CRL errors
+        logger.warn?.('CRL check failed, allowing connection (fail-open mode)');
+        return { valid: true, status: 'error-allowed', method: 'crl' };
+    }
+}
+/**
+ * Perform the actual CRL check by looking up the certificate in the revoked certificates table
+ * @param certPem - Certificate in PEM format
+ * @param issuerPem - Issuer certificate in PEM format
+ * @param config - CRL configuration
+ * @param crlUrls - Optional pre-extracted CRL distribution point URLs (avoids re-parsing)
+ * @returns CRL check result
+ */
+async function performCRLCheck(certPem, issuerPem, config, crlUrls) {
+    // Extract CRL distribution points from the certificate (if not already provided)
+    const distributionPoints = crlUrls ?? (0, verificationUtils_ts_1.extractCRLDistributionPoints)(certPem);
+    if (distributionPoints.length === 0) {
+        return { status: 'good' };
+    }
+    // Extract certificate identifiers for lookup
+    const serialNumber = (0, verificationUtils_ts_1.extractSerialNumber)(certPem);
+    const issuerKeyId = (0, verificationUtils_ts_1.extractIssuerKeyId)(issuerPem);
+    const compositeId = (0, verificationUtils_ts_1.createRevokedCertificateId)(issuerKeyId, serialNumber);
+    try {
+        // Get the revoked certificates table
+        const revokedTable = getRevokedCertificateTable();
+        // Look up the certificate in the revoked list
+        const revokedEntry = await revokedTable.get(compositeId);
+        if (revokedEntry) {
+            // Check if CRL data is still valid (within grace period if expired)
+            const now = Date.now();
+            const entry = revokedEntry;
+            if (entry.crl_next_update > now) {
+                // CRL is still valid
+                return {
+                    status: 'revoked',
+                    reason: entry.revocation_reason || 'unspecified',
+                    source: entry.crl_source,
+                };
+            }
+            else if (entry.crl_next_update + config.gracePeriod > now) {
+                // CRL is expired but within grace period
+                logger.warn?.('Using expired CRL data within grace period');
+                return {
+                    status: 'revoked',
+                    reason: entry.revocation_reason || 'unspecified',
+                    source: entry.crl_source,
+                };
+            }
+            else {
+                // CRL is too old, treat as unknown
+                logger.warn?.('CRL data is too old, treating as unknown');
+                return {
+                    status: 'unknown',
+                    reason: 'crl-expired',
+                };
+            }
+        }
+        // Certificate not found in revocation list - check if we have current CRL data
+        // This requires checking if CRLs for the distribution points are up to date
+        const crlStatus = await checkCRLFreshness(distributionPoints, issuerPem, config);
+        if (crlStatus.upToDate) {
+            // We have current CRL data and certificate is not in it
+            return {
+                status: 'good',
+                source: crlStatus.source,
+            };
+        }
+        else {
+            // CRL data is stale or missing
+            logger.warn?.('CRL data is stale or missing, treating as unknown');
+            return {
+                status: 'unknown',
+                reason: crlStatus.reason || 'crl-unavailable',
+            };
+        }
+    }
+    catch (error) {
+        logger.error?.(`CRL lookup error: ${error}`);
+        return {
+            status: 'unknown',
+            reason: error.message,
+        };
+    }
+}
+/**
+ * Check if CRL data is fresh for the given distribution points, and fetch if needed
+ * @param distributionPoints - Array of CRL distribution point URLs
+ * @param issuerPem - Issuer certificate for CRL signature verification
+ * @param config - CRL configuration
+ * @returns Status of CRL freshness
+ */
+async function checkCRLFreshness(distributionPoints, issuerPem, config) {
+    const now = Date.now();
+    // Check each distribution point
+    for (const distributionPoint of distributionPoints) {
+        try {
+            // First, check if we have a cached CRL that's still valid
+            const crlTable = getCRLCacheTable();
+            let crlData = null;
+            let cachedCRL = null;
+            try {
+                const cached = await crlTable.get(distributionPoint);
+                cachedCRL = cached;
+                if (cachedCRL && cachedCRL.next_update > now) {
+                    crlData = cachedCRL;
+                }
+                else if (cachedCRL && cachedCRL.next_update + config.gracePeriod > now) {
+                    crlData = cachedCRL;
+                }
+            }
+            catch {
+                // Failed to check cache, continue
+            }
+            // If no valid cached CRL, download and parse fresh
+            if (!crlData) {
+                crlData = await downloadAndParseCRL(distributionPoint, issuerPem, config.timeout);
+            }
+            // Check if CRL is current
+            const crlExpiry = crlData.next_update;
+            if (crlExpiry > now) {
+                // Store in cache for future use (only if we downloaded it fresh)
+                if (!cachedCRL) {
+                    try {
+                        await crlTable.put(distributionPoint, crlData);
+                    }
+                    catch {
+                        // Failed to cache, but continue anyway
+                    }
+                }
+                return { upToDate: true, source: distributionPoint };
+            }
+            else if (crlExpiry + config.gracePeriod > now) {
+                return { upToDate: true, source: distributionPoint };
+            }
+            else {
+                return { upToDate: false, reason: 'crl-expired' };
+            }
+        }
+        catch (error) {
+            // Signature verification failures are security failures, not operational failures
+            // Rethrow them so they don't get swallowed as "unknown" status
+            if (error instanceof CRLSignatureVerificationError) {
+                throw error;
+            }
+            // Operational failures (network, timeout, parse errors) - continue to next distribution point
+        }
+    }
+    return { upToDate: false, reason: 'no-current-crl-data' };
+}
+/**
+ * Download and parse a CRL from a distribution point
+ * @param distributionPoint - CRL URL
+ * @param issuerPemStr - Issuer certificate for signature verification
+ * @param timeout - Download timeout in milliseconds
+ * @returns Parsed CRL entry for caching
+ */
+async function downloadAndParseCRL(distributionPoint, issuerPemStr, timeout) {
+    // Download the CRL
+    // Note: Using fetch here since CRL downloads are cached and infrequent
+    // (typically one per CA), so this is not a hot path
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+        const response = await fetch(distributionPoint, {
+            signal: controller.signal,
+            headers: {
+                'User-Agent': verificationConfig_ts_1.CRL_USER_AGENT,
+            },
+        });
+        clearTimeout(timeoutId);
+        if (!response.ok) {
+            throw new Error(`CRL download failed: ${response.status}`);
+        }
+        const crlBuffer = Buffer.from(await response.arrayBuffer());
+        // Convert PEM to DER format if needed (PKI.js expects DER)
+        let crlDerBuffer;
+        const crlText = crlBuffer.toString('utf8');
+        if (crlText.includes('-----BEGIN X509 CRL-----')) {
+            crlDerBuffer = Buffer.from((0, verificationUtils_ts_1.pemToBuffer)(crlText));
+        }
+        else {
+            crlDerBuffer = crlBuffer;
+        }
+        // Parse and validate the CRL
+        const crl = pkijs.CertificateRevocationList.fromBER(crlDerBuffer);
+        // Verify CRL signature
+        const issuerCert = pkijs.Certificate.fromBER((0, verificationUtils_ts_1.pemToBuffer)(issuerPemStr));
+        const signatureValid = await crl.verify({ issuerCertificate: issuerCert });
+        if (!signatureValid) {
+            // Invalid signature is a security failure - always reject regardless of fail-open/fail-closed mode
+            // Fail-open mode is for operational failures (network issues, timeouts), not security validation failures
+            const msg = `CRL signature verification failed for: ${distributionPoint}`;
+            logger.error?.(msg);
+            throw new CRLSignatureVerificationError(msg);
+        }
+        // Extract timing information
+        const thisUpdate = crl.thisUpdate.value.getTime();
+        const nextUpdate = crl.nextUpdate?.value.getTime() ?? thisUpdate + verificationConfig_ts_1.CRL_DEFAULT_VALIDITY_PERIOD;
+        // Extract issuer DN
+        const issuerDN = issuerCert.issuer.typesAndValues.map((tv) => `${tv.type}=${tv.value.valueBlock.value}`).join(',');
+        const cacheEntry = {
+            distribution_point: distributionPoint,
+            issuer_dn: issuerDN,
+            crl_blob: crlBuffer,
+            this_update: thisUpdate,
+            next_update: nextUpdate,
+            signature_valid: signatureValid,
+            expiresAt: nextUpdate,
+        };
+        // Process revoked certificates in the background
+        processRevokedCertificates(crl, issuerPemStr, distributionPoint, nextUpdate).catch((error) => {
+            logger.error?.(`Error processing revoked certificates: ${error}`);
+        });
+        return cacheEntry;
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
+/**
+ * Process revoked certificates from CRL and store them in the revoked certificates table
+ * @param crl - Parsed CRL object
+ * @param issuerPemStr - Issuer certificate PEM
+ * @param distributionPoint - CRL distribution point URL
+ * @param nextUpdate - When this CRL expires
+ */
+async function processRevokedCertificates(crl, issuerPemStr, distributionPoint, nextUpdate) {
+    const revokedTable = getRevokedCertificateTable();
+    const issuerKeyId = (0, verificationUtils_ts_1.extractIssuerKeyId)(issuerPemStr);
+    const cacheKey = distributionPoint;
+    // Clear existing entries for this CRL to ensure data consistency
+    // This prevents stale revocation data when certificates are removed from updated CRLs
+    try {
+        await clearExistingCRLEntries(revokedTable, cacheKey);
+    }
+    catch (error) {
+        logger.warn?.(`Failed to clear existing CRL entries: ${error}`);
+        // Continue with processing - partial cleanup is better than no update
+    }
+    // Add new revoked certificates
+    if (crl.revokedCertificates) {
+        for (const revokedCert of crl.revokedCertificates) {
+            try {
+                // Extract serial number using PKI.js - same method as extractSerialNumber() function
+                // This gives us the clean serial number without ASN.1 encoding
+                const serialHex = revokedCert.userCertificate.valueBlock.valueHexView;
+                if (!serialHex) {
+                    logger.warn?.('Could not extract serial number from revoked certificate');
+                    continue;
+                }
+                const serialNumber = Array.from(serialHex)
+                    .map((b) => b.toString(16).padStart(2, '0'))
+                    .join('');
+                const compositeId = (0, verificationUtils_ts_1.createRevokedCertificateId)(issuerKeyId, serialNumber);
+                // Extract revocation date
+                const revocationDate = revokedCert.revocationDate.value.getTime();
+                // For now, skip complex extension parsing and just use default reason
+                const revocationReason = 'unspecified';
+                const entry = {
+                    composite_id: compositeId,
+                    serial_number: serialNumber,
+                    issuer_key_id: issuerKeyId,
+                    revocation_date: revocationDate,
+                    revocation_reason: revocationReason,
+                    crl_source: cacheKey,
+                    crl_next_update: nextUpdate,
+                    expiresAt: nextUpdate,
+                };
+                await revokedTable.create(entry.composite_id, entry);
+            }
+            catch (error) {
+                logger.warn?.(`Failed to process revoked certificate: ${error}`);
+                // Continue with other certificates
+            }
+        }
+    }
+}
+/**
+ * Clear existing revoked certificate entries for a specific CRL source
+ * This ensures data consistency when CRLs are updated and certificates are removed
+ * @param revokedTable - Harper table for revoked certificates
+ * @param crlSource - CRL cache key to identify entries to remove
+ */
+async function clearExistingCRLEntries(revokedTable, crlSource) {
+    // We need to find all entries with the matching crl_source and delete them individually
+    try {
+        // Use Harper's search capabilities to find entries by crl_source
+        // Note: This assumes the crl_source field is indexed (which it is)
+        const existingEntries = revokedTable.search([
+            {
+                attribute: 'crl_source',
+                value: crlSource,
+            },
+        ]);
+        for await (const entry of existingEntries) {
+            try {
+                await revokedTable.delete(entry.composite_id);
+            }
+            catch (deleteError) {
+                logger.warn?.(`Failed to delete revoked certificate entry: ${deleteError}`);
+                // Continue with other entries
+            }
+        }
+    }
+    catch (searchError) {
+        logger.error?.(`Failed to search for existing CRL entries: ${searchError}`);
+        throw searchError;
+    }
+}
+//# sourceMappingURL=crlVerification.js.map

package/dist/security/certificateVerification/crlVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crlVerification.js","sourceRoot":"","sources":["../../../security/certificateVerification/crlVerification.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwMH,8BAoEC;AAUD,0CAgFC;AApWD,6CAA+B;AAC/B,+DAAgE;AAChE,+DAAqD;AACrD,6DAAuD;AAEvD,iEASgC;AAChC,mEAAuG;AAYvG;;;GAGG;AACH,MAAa,6BAA8B,SAAQ,KAAK;IACvD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC7C,CAAC;CACD;AALD,sEAKC;AACD,yFAAmF;AAEnF,MAAM,MAAM,GAAG,IAAA,yBAAa,EAAC,kBAAkB,CAAC,CAAC;AAEjD,gFAAgF;AAChF,IAAI,cAAiE,CAAC;AACtE,SAAS,wBAAwB;IAChC,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,cAAc,GAAG,IAAA,+CAA8B,GAAE,CAAC;QAClD,oFAAoF;QACnF,cAAsB,CAAC,WAAW,CAAC,gEAA6B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,+BAAgC,SAAQ,sBAAQ;IACrD,KAAK,CAAC,GAAG,CAAC,EAAU;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAA2C,CAAC;QAC3E,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,CAAC;QAE/C,IAAI,CAAC,cAAc,EAAE,iBAAiB,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC;QAE9E,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAE1F,wFAAwF;YACxF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC;YACrC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;YAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAEpD,OAAO;gBACN,GAAG,MAAM;gBACT,SAAS;aACT,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,EAAE,CAAC,wBAAwB,iBAAiB,MAAM,KAAK,EAAE,CAAC,CAAC;YAEvE,qBAAqB;YACrB,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,sCAAsC;gBACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uCAAe,CAAC;gBAE/C,OAAO;oBACN,MAAM,EAAE,EAAE;oBACV,kBAAkB,EAAE,iBAAiB;oBACrC,SAAS,EAAE,SAAS;oBACpB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;oBACvB,WAAW,EAAE,SAAS;oBACtB,eAAe,EAAE,KAAK;oBACtB,SAAS;iBACT,CAAC;YACH,CAAC;YAED,uCAAuC;YACvC,MAAM,CAAC,IAAI,EAAE,CAAC,gDAAgD,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD;AAED,0BAA0B;AAC1B,IAAI,aAAuC,CAAC;AAC5C,IAAI,uBAAiD,CAAC;AAEtD,SAAS,gBAAgB;IACxB,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,aAAa,GAAG,IAAA,oBAAK,EAAC;YACrB,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE;gBACX;oBACC,IAAI,EAAE,oBAAoB;oBAC1B,YAAY,EAAE,IAAI;iBAClB;gBACD;oBACC,IAAI,EAAE,WAAW;iBACjB;gBACD;oBACC,IAAI,EAAE,UAAU;iBAChB;gBACD;oBACC,IAAI,EAAE,aAAa;iBACnB;gBACD;oBACC,IAAI,EAAE,aAAa;iBACnB;gBACD;oBACC,IAAI,EAAE,iBAAiB;iBACvB;gBACD;oBACC,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,IAAI;iBACb;aACD;SACD,CAAC,CAAC;QAEH,+BAA+B;QAC9B,aAAqB,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,SAAS,0BAA0B;IAClC,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC9B,uBAAuB,GAAG,IAAA,oBAAK,EAAC;YAC/B,KAAK,EAAE,0BAA0B;YACjC,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE;gBACX;oBACC,IAAI,EAAE,cAAc;oBACpB,YAAY,EAAE,IAAI;iBAClB;gBACD;oBACC,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,IAAI;iBACb;gBACD;oBACC,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,IAAI;iBACb;gBACD;oBACC,IAAI,EAAE,iBAAiB;iBACvB;gBACD;oBACC,IAAI,EAAE,mBAAmB;iBACzB;gBACD;oBACC,IAAI,EAAE,YAAY;oBAClB,OAAO,EAAE,IAAI,EAAE,qBAAqB;iBACpC;gBACD;oBACC,IAAI,EAAE,iBAAiB;iBACvB;gBACD;oBACC,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,IAAI;iBACb;aACD;SACD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,uBAAuB,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,SAAS,CAC9B,OAAe,EACf,SAAiB,EACjB,MAAkB,EAClB,OAAkB;IAElB,wCAAwC;IACxC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC;QACJ,uEAAuE;QACvE,oFAAoF;QACpF,MAAM,UAAU,GAAG,IAAA,kCAAW,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,IAAA,kCAAW,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAE3D,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,IAAI,IAAA,mDAA4B,EAAC,UAAU,CAAC,CAAC;QAE/E,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC7E,CAAC;QAED,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAA,qCAAc,EAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAEjE,mGAAmG;QACnG,MAAM,UAAU,GAAG,MAAO,wBAAwB,EAAU,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC1E,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,YAAY;YACvB,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,6CAA6C;YACvF,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE;SACK,CAAC,CAAC;QAErC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,wFAAwF;YACxF,MAAM,CAAC,KAAK,EAAE,CAAC,yEAAyE,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACtF,CAAC;YAED,MAAM,CAAC,IAAI,EAAE,CAAC,8DAA8D,CAAC,CAAC;YAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,UAA8C,CAAC;QAC9D,MAAM,mBAAmB,GAAI,UAAkB,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,kBAAkB,CAAC,CAAC;QAE5F,OAAO;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,CAAC,mBAAmB;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,KAAK;SAC9B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QAEnD,qBAAqB;QACrB,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,6CAA6C;QAC7C,MAAM,CAAC,IAAI,EAAE,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CACpC,OAAe,EACf,SAAiB,EACjB,MAAiB,EACjB,OAAkB;IAElB,iFAAiF;IACjF,MAAM,kBAAkB,GAAG,OAAO,IAAI,IAAA,mDAA4B,EAAC,OAAO,CAAC,CAAC;IAE5E,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,6CAA6C;IAC7C,MAAM,YAAY,GAAG,IAAA,0CAAmB,EAAC,OAAO,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,yCAAkB,EAAC,SAAS,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,iDAA0B,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAE1E,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAElD,8CAA8C;QAC9C,MAAM,YAAY,GAAG,MAAO,YAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAElE,IAAI,YAAY,EAAE,CAAC;YAClB,oEAAoE;YACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,MAAM,KAAK,GAAG,YAAmB,CAAC;YAClC,IAAI,KAAK,CAAC,eAAe,GAAG,GAAG,EAAE,CAAC;gBACjC,qBAAqB;gBACrB,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,aAAa;oBAChD,MAAM,EAAE,KAAK,CAAC,UAAU;iBACxB,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;gBAC7D,yCAAyC;gBACzC,MAAM,CAAC,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;gBAC5D,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,aAAa;oBAChD,MAAM,EAAE,KAAK,CAAC,UAAU;iBACxB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,mCAAmC;gBACnC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAA0C,CAAC,CAAC;gBAC1D,OAAO;oBACN,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,aAAa;iBACrB,CAAC;YACH,CAAC;QACF,CAAC;QAED,+EAA+E;QAC/E,4EAA4E;QAC5E,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAEjF,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,wDAAwD;YACxD,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,SAAS,CAAC,MAAM;aACxB,CAAC;QACH,CAAC;aAAM,CAAC;YACP,+BAA+B;YAC/B,MAAM,CAAC,IAAI,EAAE,CAAC,mDAAmD,CAAC,CAAC;YACnE,OAAO;gBACN,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,iBAAiB;aAC7C,CAAC;QACH,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;QAC7C,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,MAAM,EAAG,KAAe,CAAC,OAAO;SAChC,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC/B,kBAA4B,EAC5B,SAAiB,EACjB,MAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,gCAAgC;IAChC,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;QACpD,IAAI,CAAC;YACJ,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YACpC,IAAI,OAAO,GAAyB,IAAI,CAAC;YACzC,IAAI,SAAS,GAAyB,IAAI,CAAC;YAE3C,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAO,QAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;gBAC9D,SAAS,GAAG,MAAkC,CAAC;gBAC/C,IAAI,SAAS,IAAI,SAAS,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBAC9C,OAAO,GAAG,SAAS,CAAC;gBACrB,CAAC;qBAAM,IAAI,SAAS,IAAI,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;oBAC1E,OAAO,GAAG,SAAS,CAAC;gBACrB,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,kCAAkC;YACnC,CAAC;YAED,mDAAmD;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACnF,CAAC;YAED,0BAA0B;YAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;gBACrB,iEAAiE;gBACjE,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACJ,MAAO,QAAgB,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;oBACzD,CAAC;oBAAC,MAAM,CAAC;wBACR,uCAAuC;oBACxC,CAAC;gBACF,CAAC;gBAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACtD,CAAC;iBAAM,IAAI,SAAS,GAAG,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;gBACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACP,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACnD,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,kFAAkF;YAClF,+DAA+D;YAC/D,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC;YACb,CAAC;YACD,8FAA8F;QAC/F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CACjC,iBAAyB,EACzB,YAAoB,EACpB,OAAe;IAEf,mBAAmB;IACnB,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAEhE,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YAC/C,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACR,YAAY,EAAE,sCAAc;aAC5B;SACD,CAAC,CAAC;QAEH,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAE5D,2DAA2D;QAC3D,IAAI,YAAoB,CAAC;QACzB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAClD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,kCAAW,EAAC,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACP,YAAY,GAAG,SAAS,CAAC;QAC1B,CAAC;QAED,6BAA6B;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAElE,uBAAuB;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,IAAA,kCAAW,EAAC,YAAY,CAAC,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,CAAC;QAE3E,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,mGAAmG;YACnG,0GAA0G;YAC1G,MAAM,GAAG,GAAG,0CAA0C,iBAAiB,EAAE,CAAC;YAC1E,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,6BAA6B;QAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,UAAU,GAAG,mDAA2B,CAAC;QAE/F,oBAAoB;QACpB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnH,MAAM,UAAU,GAAkB;YACjC,kBAAkB,EAAE,iBAAiB;YACrC,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,UAAU;YACvB,eAAe,EAAE,cAAc;YAC/B,SAAS,EAAE,UAAU;SACrB,CAAC;QAEF,iDAAiD;QACjD,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5F,MAAM,CAAC,KAAK,EAAE,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACnB,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,0BAA0B,CACxC,GAAoC,EACpC,YAAoB,EACpB,iBAAyB,EACzB,UAAkB;IAElB,MAAM,YAAY,GAAG,0BAA0B,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,IAAA,yCAAkB,EAAC,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IAEnC,iEAAiE;IACjE,sFAAsF;IACtF,IAAI,CAAC;QACJ,MAAM,uBAAuB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,EAAE,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;QAChE,sEAAsE;IACvE,CAAC;IAED,+BAA+B;IAC/B,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC7B,KAAK,MAAM,WAAW,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACnD,IAAI,CAAC;gBACJ,qFAAqF;gBACrF,+DAA+D;gBAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC;gBAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,EAAE,CAAC,0DAA0D,CAAC,CAAC;oBAC1E,SAAS;gBACV,CAAC;gBAED,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;qBACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;qBAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;gBAEX,MAAM,WAAW,GAAG,IAAA,iDAA0B,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;gBAE1E,0BAA0B;gBAC1B,MAAM,cAAc,GAAG,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAElE,sEAAsE;gBACtE,MAAM,gBAAgB,GAAG,aAAa,CAAC;gBAEvC,MAAM,KAAK,GAA4B;oBACtC,YAAY,EAAE,WAAW;oBACzB,aAAa,EAAE,YAAY;oBAC3B,aAAa,EAAE,WAAW;oBAC1B,eAAe,EAAE,cAAc;oBAC/B,iBAAiB,EAAE,gBAAgB;oBACnC,UAAU,EAAE,QAAQ;oBACpB,eAAe,EAAE,UAAU;oBAC3B,SAAS,EAAE,UAAU;iBACrB,CAAC;gBAEF,MAAO,YAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,EAAE,CAAC,0CAA0C,KAAK,EAAE,CAAC,CAAC;gBACjE,mCAAmC;YACpC,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACrC,YAA2D,EAC3D,SAAiB;IAEjB,wFAAwF;IACxF,IAAI,CAAC;QACJ,iEAAiE;QACjE,mEAAmE;QACnE,MAAM,eAAe,GAAI,YAAoB,CAAC,MAAM,CAAC;YACpD;gBACC,SAAS,EAAE,YAAY;gBACvB,KAAK,EAAE,SAAS;aAChB;SACD,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACJ,MAAO,YAAoB,CAAC,MAAM,CAAE,KAAa,CAAC,YAAY,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,EAAE,CAAC,+CAA+C,WAAW,EAAE,CAAC,CAAC;gBAC5E,8BAA8B;YAC/B,CAAC;QACF,CAAC;IACF,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,EAAE,CAAC,8CAA8C,WAAW,EAAE,CAAC,CAAC;QAC5E,MAAM,WAAW,CAAC;IACnB,CAAC;AACF,CAAC"}

package/dist/security/certificateVerification/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Certificate verification for mTLS authentication
+ *
+ * This module provides certificate revocation checking for client certificates
+ * in mutual TLS (mTLS) connections. Supports both OCSP (Online Certificate
+ * Status Protocol) and CRL (Certificate Revocation List) verification methods
+ * with automatic method selection.
+ *
+ * Features:
+ * - OCSP verification with caching
+ * - CRL verification with caching
+ * - CRL-first with OCSP fallback for optimal performance
+ * - Background CRL refresh with exponential backoff
+ * - Graceful degradation during network outages
+ * - Ed25519/Ed448 certificate support
+ *
+ * Default behavior:
+ * - Certificate verification: disabled (must be explicitly enabled)
+ * - Verification approach: CRL-first (with OCSP fallback)
+ * - CRL timeout: 10 seconds, cache TTL: 24 hours
+ * - OCSP timeout: 5 seconds, cache TTL: 1 hour
+ * - Failure mode: fail-closed (rejects connections if verification fails)
+ */
+import type { PeerCertificate, CertificateVerificationResult } from './types.ts';
+/**
+ * Verify certificate revocation status using OCSP and/or CRL
+ * @param peerCertificate - Peer certificate object from TLS connection
+ * @param mtlsConfig - The mTLS configuration from the request
+ * @returns Promise resolving to verification result
+ */
+export declare function verifyCertificate(peerCertificate: PeerCertificate, mtlsConfig?: boolean | Record<string, any> | null): Promise<CertificateVerificationResult>;