@interop/was-client 0.30.0 → 0.32.0

package/dist/edv/epochMac.js

@@ -1,148 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * Authenticated epoch configuration for multi-recipient encrypted Collections:
- * a MAC over a Collection `encryption` descriptor's epoch configuration, keyed
- * from the current epoch's secret (which the server never holds). It lets a
- * reader detect a server-side rollback of `currentEpoch` or a fabricated epoch
- * list -- a malicious server cannot forge a valid MAC without the epoch secret.
- *
- * The MAC covers only `scheme`, `version`, `currentEpoch`, and the ordered list
- * of epoch ids -- deliberately NOT the recipient entries, so adding a recipient
- * (which cannot be forged without the epoch secret anyway) does not invalidate
- * the MAC. Covering `version` makes stripping the descriptor's scheme version
- * MAC-detectable.
- *
- * Documented limitation (mirrors Cryptomator's versionMac): a server can still
- * replay an ENTIRE prior consistent configuration (an old epoch list with its
- * matching old MAC). Detecting that needs client-side monotonic state, which is
- * out of scope here.
- */
-import { base64urlnopad } from '@scure/base';
-import { ENCODER } from '../internal/content.js';
-/**
- * The HKDF `info` string binding the derived key to this MAC construction.
- */
-const MAC_KEY_INFO = ENCODER.encode('was-epoch-config-mac/v1');
-/**
- * The domain-separation prefix prepended to the JSON payload before it is MACed.
- */
-const MAC_PAYLOAD_PREFIX = 'was-epoch-config/v1.';
-/**
- * The domain-separation prefix of the detached `epochsSig` signature payload --
- * distinct from the MAC prefix so a signature can never be replayed as a MAC
- * input or vice versa.
- */
-const SIG_PAYLOAD_PREFIX = 'was-epoch-config-sig/v1.';
-/**
- * Derives the HMAC-SHA256 key from a 32-byte epoch secret:
- * HKDF-SHA256(ikm = the epoch secret, salt = empty, info =
- * "was-epoch-config-mac/v1", length 32 bytes). Uses WebCrypto (`crypto.subtle`)
- * so it works unchanged in Node 24 and browsers.
- *
- * @param epochSecret {Uint8Array}   the 32-byte current epoch secret
- * @returns {Promise<CryptoKey>}   the derived HMAC key (sign + verify)
- */
-async function deriveMacKey(epochSecret) {
-    const ikm = await crypto.subtle.importKey('raw', epochSecret, 'HKDF', false, ['deriveKey']);
-    return crypto.subtle.deriveKey({
-        name: 'HKDF',
-        hash: 'SHA-256',
-        salt: new Uint8Array(0),
-        info: MAC_KEY_INFO
-    }, ikm, { name: 'HMAC', hash: 'SHA-256', length: 256 }, false, ['sign', 'verify']);
-}
-/**
- * The canonical JSON text of a descriptor's epoch configuration -- the part
- * both the MAC and the detached signature cover: `{ scheme, version,
- * currentEpoch, epochs }`, with `version` normalized to `null` when absent and
- * `epochs` the ordered list of epoch id strings. The object member order is
- * fixed so both sides serialize identically.
- *
- * @param descriptor {CollectionEncryption}   the descriptor whose epoch
- *   configuration is being authenticated
- * @returns {string}
- */
-function epochsConfigJson(descriptor) {
-    return JSON.stringify({
-        scheme: descriptor.scheme,
-        version: descriptor.version ?? null,
-        currentEpoch: descriptor.currentEpoch,
-        epochs: (descriptor.epochs ?? []).map(epoch => epoch.id)
-    });
-}
-/**
- * Builds the MACed payload bytes for a descriptor's epoch configuration:
- * `UTF8("was-epoch-config/v1." + epochsConfigJson(descriptor))`.
- *
- * @param descriptor {CollectionEncryption}   the descriptor whose epoch configuration is
- *   being authenticated
- * @returns {ArrayBuffer}
- */
-function macPayload(descriptor) {
-    const bytes = ENCODER.encode(MAC_PAYLOAD_PREFIX + epochsConfigJson(descriptor));
-    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-}
-/**
- * Builds the payload bytes an `epochsSig` signs: `UTF8(
- * "was-epoch-config-sig/v1." + epochsConfigJson(descriptor))` -- the same
- * epoch configuration the MAC covers, under its own domain-separation prefix.
- * Exported so a signing caller and a verifying reader construct
- * byte-identical input from the descriptor alone.
- *
- * @param descriptor {CollectionEncryption}   the descriptor whose epoch
- *   configuration is being signed or verified
- * @returns {Uint8Array}
- */
-export function epochsSigPayload(descriptor) {
-    return ENCODER.encode(SIG_PAYLOAD_PREFIX + epochsConfigJson(descriptor));
-}
-/**
- * Computes the `epochsMac` field for a descriptor under the current epoch's
- * secret. Compute this over the exact descriptor state being written (member
- * fields already stamped), since a compare-and-swap retry re-reads the
- * descriptor.
- *
- * @param options {object}
- * @param options.descriptor {CollectionEncryption}   the descriptor being written
- * @param options.epochSecret {Uint8Array}   the 32-byte current epoch secret
- * @returns {Promise<CollectionEncryptionEpochsMac>}
- */
-export async function computeEpochsMac({ descriptor, epochSecret }) {
-    const key = await deriveMacKey(epochSecret);
-    const signature = await crypto.subtle.sign('HMAC', key, macPayload(descriptor));
-    return {
-        v: 1,
-        alg: 'HS256',
-        mac: base64urlnopad.encode(new Uint8Array(signature))
-    };
-}
-/**
- * Verifies a descriptor's `epochsMac` against a recomputation from the current
- * epoch's secret. Returns `false` on any mismatch (or a malformed `mac`); the
- * caller decides the error semantics. The MAC construction's own version/alg
- * (`v` / `alg`) is validated by the caller before this is called.
- *
- * @param options {object}
- * @param options.descriptor {CollectionEncryption}   the descriptor to verify (its
- *   `epochsMac.mac` is the tag under test)
- * @param options.epochSecret {Uint8Array}   the 32-byte current epoch secret
- * @returns {Promise<boolean>}
- */
-export async function verifyEpochsMac({ descriptor, epochSecret }) {
-    const epochsMac = descriptor.epochsMac;
-    if (!epochsMac) {
-        return false;
-    }
-    let mac;
-    try {
-        mac = base64urlnopad.decode(epochsMac.mac);
-    }
-    catch {
-        return false;
-    }
-    const key = await deriveMacKey(epochSecret);
-    return crypto.subtle.verify('HMAC', key, mac, macPayload(descriptor));
-}
-//# sourceMappingURL=epochMac.js.map

package/dist/edv/epochMac.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"epochMac.js","sourceRoot":"","sources":["../../src/edv/epochMac.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAA;AAOhD;;GAEG;AACH,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAE9D;;GAEG;AACH,MAAM,kBAAkB,GAAG,sBAAsB,CAAA;AAEjD;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,0BAA0B,CAAA;AAcrD;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,WAAuB;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,WAAqC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,YAAY;KACnB,EACD,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,UAAgC;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;QACnC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACzD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,UAAgC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAC1B,kBAAkB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAClD,CAAA;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CACvB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CACrB,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAgC;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,GAAG,EACH,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;IACD,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,WAAW,EAIZ;IACC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,GAAe,CAAA;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CACzB,MAAM,EACN,GAAG,EACH,GAA6B,EAC7B,UAAU,CAAC,UAAU,CAAC,CACvB,CAAA;AACH,CAAC"}