@intlayer/backend 7.1.4 → 7.1.6

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/xmlenc.cjs

@@ -1,231 +0,0 @@
-const require_rolldown_runtime = require('../../../../_virtual/rolldown_runtime.cjs');
-const require_xpath$1 = require('../../../xpath/xpath.cjs');
-const require_index = require('../../../@xmldom/xmldom/lib/index.cjs');
-const require_utils$1 = require('./utils.cjs');
-
-//#region ../../node_modules/@authenio/xml-encryption/lib/xmlenc.js
-var require_xmlenc = /* @__PURE__ */ require_rolldown_runtime.__commonJS({ "../../node_modules/@authenio/xml-encryption/lib/xmlenc.js": ((exports, module) => {
-	var crypto = require("crypto");
-	var xmldom = require_index.default;
-	var xpath = require_xpath$1.default;
-	var utils = require_utils$1.default;
-	const insecureAlgorithms = ["http://www.w3.org/2001/04/xmlenc#rsa-1_5", "http://www.w3.org/2001/04/xmlenc#tripledes-cbc"];
-	function encryptKeyInfoWithScheme(symmetricKey, options, scheme, callback$1) {
-		const padding = scheme === "RSA-OAEP" ? crypto.constants.RSA_PKCS1_OAEP_PADDING : crypto.constants.RSA_PKCS1_PADDING;
-		const symmetricKeyBuffer = Buffer.isBuffer(symmetricKey) ? symmetricKey : Buffer.from(symmetricKey, "utf-8");
-		try {
-			var params = {
-				encryptedKey: crypto.publicEncrypt({
-					key: options.rsa_pub,
-					padding
-				}, symmetricKeyBuffer).toString("base64"),
-				encryptionPublicCert: "<X509Data><X509Certificate>" + utils.pemToCert(options.pem.toString()) + "</X509Certificate></X509Data>",
-				keyEncryptionMethod: options.keyEncryptionAlgorithm
-			};
-			callback$1(null, utils.renderTemplate("keyinfo", params));
-		} catch (e) {
-			callback$1(e);
-		}
-	}
-	function encryptKeyInfo(symmetricKey, options, callback$1) {
-		if (!options) return callback$1(/* @__PURE__ */ new Error("must provide options"));
-		if (!options.rsa_pub) return callback$1(/* @__PURE__ */ new Error("must provide options.rsa_pub with public key RSA"));
-		if (!options.pem) return callback$1(/* @__PURE__ */ new Error("must provide options.pem with certificate"));
-		if (!options.keyEncryptionAlgorithm) return callback$1(/* @__PURE__ */ new Error("encryption without encrypted key is not supported yet"));
-		if (options.disallowEncryptionWithInsecureAlgorithm && insecureAlgorithms.indexOf(options.keyEncryptionAlgorithm) >= 0) return callback$1(/* @__PURE__ */ new Error("encryption algorithm " + options.keyEncryptionAlgorithm + "is not secure"));
-		switch (options.keyEncryptionAlgorithm) {
-			case "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p": return encryptKeyInfoWithScheme(symmetricKey, options, "RSA-OAEP", callback$1);
-			case "http://www.w3.org/2001/04/xmlenc#rsa-1_5":
-				utils.warnInsecureAlgorithm(options.keyEncryptionAlgorithm, options.warnInsecureAlgorithm);
-				return encryptKeyInfoWithScheme(symmetricKey, options, "RSAES-PKCS1-V1_5", callback$1);
-			default: return callback$1(/* @__PURE__ */ new Error("encryption key algorithm not supported"));
-		}
-	}
-	function encrypt(content, options, callback$1) {
-		if (!options) return callback$1(/* @__PURE__ */ new Error("must provide options"));
-		if (!content) return callback$1(/* @__PURE__ */ new Error("must provide content to encrypt"));
-		if (!options.rsa_pub) return callback$1(/* @__PURE__ */ new Error("rsa_pub option is mandatory and you should provide a valid RSA public key"));
-		if (!options.pem) return callback$1(/* @__PURE__ */ new Error("pem option is mandatory and you should provide a valid x509 certificate encoded as PEM"));
-		if (options.disallowEncryptionWithInsecureAlgorithm && (insecureAlgorithms.indexOf(options.keyEncryptionAlgorithm) >= 0 || insecureAlgorithms.indexOf(options.encryptionAlgorithm) >= 0)) return callback$1(/* @__PURE__ */ new Error("encryption algorithm " + options.keyEncryptionAlgorithm + " is not secure"));
-		options.input_encoding = options.input_encoding || "utf8";
-		function generate_symmetric_key(cb) {
-			switch (options.encryptionAlgorithm) {
-				case "http://www.w3.org/2001/04/xmlenc#aes128-cbc":
-					crypto.randomBytes(16, cb);
-					break;
-				case "http://www.w3.org/2001/04/xmlenc#aes256-cbc":
-					crypto.randomBytes(32, cb);
-					break;
-				case "http://www.w3.org/2009/xmlenc11#aes128-gcm":
-					crypto.randomBytes(16, cb);
-					break;
-				case "http://www.w3.org/2009/xmlenc11#aes256-gcm":
-					crypto.randomBytes(32, cb);
-					break;
-				case "http://www.w3.org/2001/04/xmlenc#tripledes-cbc":
-					utils.warnInsecureAlgorithm(options.encryptionAlgorithm, options.warnInsecureAlgorithm);
-					crypto.randomBytes(24, cb);
-					break;
-				default: crypto.randomBytes(32, cb);
-			}
-		}
-		function encrypt_content(symmetricKey, cb) {
-			switch (options.encryptionAlgorithm) {
-				case "http://www.w3.org/2001/04/xmlenc#aes128-cbc":
-					encryptWithAlgorithm("aes-128-cbc", symmetricKey, 16, content, options.input_encoding, function(err, encryptedContent) {
-						if (err) return cb(err);
-						cb(null, encryptedContent);
-					});
-					break;
-				case "http://www.w3.org/2001/04/xmlenc#aes256-cbc":
-					encryptWithAlgorithm("aes-256-cbc", symmetricKey, 16, content, options.input_encoding, function(err, encryptedContent) {
-						if (err) return cb(err);
-						cb(null, encryptedContent);
-					});
-					break;
-				case "http://www.w3.org/2009/xmlenc11#aes128-gcm":
-					encryptWithAlgorithm("aes-128-gcm", symmetricKey, 12, content, options.input_encoding, function(err, encryptedContent) {
-						if (err) return cb(err);
-						cb(null, encryptedContent);
-					});
-					break;
-				case "http://www.w3.org/2009/xmlenc11#aes256-gcm":
-					encryptWithAlgorithm("aes-256-gcm", symmetricKey, 12, content, options.input_encoding, function(err, encryptedContent) {
-						if (err) return cb(err);
-						cb(null, encryptedContent);
-					});
-					break;
-				case "http://www.w3.org/2001/04/xmlenc#tripledes-cbc":
-					utils.warnInsecureAlgorithm(options.encryptionAlgorithm, options.warnInsecureAlgorithm);
-					encryptWithAlgorithm("des-ede3-cbc", symmetricKey, 8, content, options.input_encoding, function(err, encryptedContent) {
-						if (err) return cb(err);
-						cb(null, encryptedContent);
-					});
-					break;
-				default: cb(/* @__PURE__ */ new Error("encryption algorithm not supported"));
-			}
-		}
-		function encrypt_key(symmetricKey, encryptedContent, cb) {
-			encryptKeyInfo(symmetricKey, options, function(err, keyInfo) {
-				if (err) return cb(err);
-				cb(null, utils.renderTemplate("encrypted-key", {
-					encryptedContent: encryptedContent.toString("base64"),
-					keyInfo,
-					contentEncryptionMethod: options.encryptionAlgorithm
-				}));
-			});
-		}
-		generate_symmetric_key(function(genKeyError, symmetricKey) {
-			if (genKeyError) return callback$1(genKeyError);
-			encrypt_content(symmetricKey, function(encryptContentError, encryptedContent) {
-				if (encryptContentError) return callback$1(encryptContentError);
-				encrypt_key(symmetricKey, encryptedContent, function(encryptKeyError, result) {
-					if (encryptKeyError) return callback$1(encryptKeyError);
-					callback$1(null, result);
-				});
-			});
-		});
-	}
-	function decrypt(xml, options, callback$1) {
-		if (!options) return callback$1(/* @__PURE__ */ new Error("must provide options"));
-		if (!xml) return callback$1(/* @__PURE__ */ new Error("must provide XML to encrypt"));
-		if (!options.key) return callback$1(/* @__PURE__ */ new Error("key option is mandatory and you should provide a valid RSA private key"));
-		try {
-			var doc = typeof xml === "string" ? new xmldom.DOMParser().parseFromString(xml) : xml;
-			var symmetricKey = decryptKeyInfo(doc, options);
-			var encryptionAlgorithm = xpath.select("//*[local-name(.)='EncryptedData']/*[local-name(.)='EncryptionMethod']", doc)[0].getAttribute("Algorithm");
-			if (options.disallowDecryptionWithInsecureAlgorithm && insecureAlgorithms.indexOf(encryptionAlgorithm) >= 0) return callback$1(/* @__PURE__ */ new Error("encryption algorithm " + encryptionAlgorithm + " is not secure, fail to decrypt"));
-			var encryptedContent = xpath.select("//*[local-name(.)='EncryptedData']/*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']", doc)[0];
-			var encrypted = Buffer.from(encryptedContent.textContent, "base64");
-			switch (encryptionAlgorithm) {
-				case "http://www.w3.org/2001/04/xmlenc#aes128-cbc": return callback$1(null, decryptWithAlgorithm("aes-128-cbc", symmetricKey, 16, encrypted));
-				case "http://www.w3.org/2001/04/xmlenc#aes256-cbc": return callback$1(null, decryptWithAlgorithm("aes-256-cbc", symmetricKey, 16, encrypted));
-				case "http://www.w3.org/2001/04/xmlenc#tripledes-cbc":
-					utils.warnInsecureAlgorithm(encryptionAlgorithm, options.warnInsecureAlgorithm);
-					return callback$1(null, decryptWithAlgorithm("des-ede3-cbc", symmetricKey, 8, encrypted));
-				case "http://www.w3.org/2009/xmlenc11#aes128-gcm": return callback$1(null, decryptWithAlgorithm("aes-128-gcm", symmetricKey, 12, encrypted));
-				case "http://www.w3.org/2009/xmlenc11#aes256-gcm": return callback$1(null, decryptWithAlgorithm("aes-256-gcm", symmetricKey, 12, encrypted));
-				default: return callback$1(/* @__PURE__ */ new Error("encryption algorithm " + encryptionAlgorithm + " not supported"));
-			}
-		} catch (e) {
-			return callback$1(e);
-		}
-	}
-	function decryptKeyInfo(doc, options) {
-		if (typeof doc === "string") doc = new xmldom.DOMParser().parseFromString(doc);
-		var keyRetrievalMethodUri;
-		var keyInfo = xpath.select("//*[local-name(.)='KeyInfo' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']", doc)[0];
-		var keyEncryptionMethod = xpath.select("//*[local-name(.)='KeyInfo']/*[local-name(.)='EncryptedKey']/*[local-name(.)='EncryptionMethod']", doc)[0];
-		if (!keyEncryptionMethod) {
-			var keyRetrievalMethod = xpath.select("//*[local-name(.)='EncryptedData']/*[local-name(.)='KeyInfo']/*[local-name(.)='RetrievalMethod']", doc)[0];
-			keyRetrievalMethodUri = keyRetrievalMethod ? keyRetrievalMethod.getAttribute("URI") : null;
-			keyEncryptionMethod = keyRetrievalMethodUri ? xpath.select("//*[local-name(.)='EncryptedKey' and @Id='" + keyRetrievalMethodUri.substring(1) + "']/*[local-name(.)='EncryptionMethod']", doc)[0] : null;
-		}
-		if (!keyEncryptionMethod) throw new Error("cant find encryption algorithm");
-		var keyEncryptionAlgorithm = keyEncryptionMethod.getAttribute("Algorithm");
-		if (options.disallowDecryptionWithInsecureAlgorithm && insecureAlgorithms.indexOf(keyEncryptionAlgorithm) >= 0) throw new Error("encryption algorithm " + keyEncryptionAlgorithm + " is not secure, fail to decrypt");
-		var encryptedKey = keyRetrievalMethodUri ? xpath.select("//*[local-name(.)='EncryptedKey' and @Id='" + keyRetrievalMethodUri.substring(1) + "']/*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']", keyInfo)[0] : xpath.select("//*[local-name(.)='CipherValue']", keyInfo)[0];
-		switch (keyEncryptionAlgorithm) {
-			case "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p": return decryptKeyInfoWithScheme(encryptedKey, options, "RSA-OAEP");
-			case "http://www.w3.org/2001/04/xmlenc#rsa-1_5":
-				utils.warnInsecureAlgorithm(keyEncryptionAlgorithm, options.warnInsecureAlgorithm);
-				return decryptKeyInfoWithScheme(encryptedKey, options, "RSAES-PKCS1-V1_5");
-			default: throw new Error("key encryption algorithm " + keyEncryptionAlgorithm + " not supported");
-		}
-	}
-	function decryptKeyInfoWithScheme(encryptedKey, options, scheme) {
-		var padding = scheme === "RSA-OAEP" ? crypto.constants.RSA_PKCS1_OAEP_PADDING : crypto.constants.RSA_PKCS1_PADDING;
-		var key = Buffer.from(encryptedKey.textContent, "base64");
-		var decrypted = crypto.privateDecrypt({
-			key: options.key,
-			padding
-		}, key);
-		return Buffer.from(decrypted, "binary");
-	}
-	function encryptWithAlgorithm(algorithm, symmetricKey, ivLength, content, encoding, callback$1) {
-		crypto.randomBytes(ivLength, function(err, iv) {
-			if (err) return callback$1(err);
-			var cipher = crypto.createCipheriv(algorithm, symmetricKey, iv);
-			var encrypted = cipher.update(content, encoding, "binary") + cipher.final("binary");
-			var authTag = algorithm.slice(-3) === "gcm" ? cipher.getAuthTag() : Buffer.from("");
-			return callback$1(null, Buffer.concat([
-				iv,
-				Buffer.from(encrypted, "binary"),
-				authTag
-			]));
-		});
-	}
-	function decryptWithAlgorithm(algorithm, symmetricKey, ivLength, content) {
-		var decipher = crypto.createDecipheriv(algorithm, symmetricKey, content.slice(0, ivLength));
-		decipher.setAutoPadding(false);
-		if (algorithm.slice(-3) === "gcm") {
-			decipher.setAuthTag(content.slice(-16));
-			content = content.slice(0, -16);
-		}
-		var decrypted = decipher.update(content.slice(ivLength), null, "binary") + decipher.final("binary");
-		if (algorithm.slice(-3) !== "gcm") {
-			var padding = decrypted.charCodeAt(decrypted.length - 1);
-			if (1 <= padding && padding <= ivLength) decrypted = decrypted.substr(0, decrypted.length - padding);
-			else {
-				callback(/* @__PURE__ */ new Error("padding length invalid"));
-				return;
-			}
-		}
-		return Buffer.from(decrypted, "binary").toString("utf8");
-	}
-	exports = module.exports = {
-		decrypt,
-		encrypt,
-		encryptKeyInfo,
-		decryptKeyInfo
-	};
-}) });
-
-//#endregion
-Object.defineProperty(exports, 'default', {
-  enumerable: true,
-  get: function () {
-    return require_xmlenc();
-  }
-});
-//# sourceMappingURL=xmlenc.cjs.map

package/dist/cjs/node_modules/@authenio/xml-encryption/lib/xmlenc.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"xmlenc.cjs","names":["callback"],"sources":["../../../../../../../../node_modules/@authenio/xml-encryption/lib/xmlenc.js"],"sourcesContent":["var crypto  = require('crypto');\nvar xmldom  = require('@xmldom/xmldom');\nvar xpath   = require('xpath');\nvar utils   = require('./utils');\n\nconst insecureAlgorithms = [\n  //https://www.w3.org/TR/xmlenc-core1/#rsav15note\n  'http://www.w3.org/2001/04/xmlenc#rsa-1_5',\n  //https://csrc.nist.gov/News/2017/Update-to-Current-Use-and-Deprecation-of-TDEA\n  'http://www.w3.org/2001/04/xmlenc#tripledes-cbc'];\n\nfunction encryptKeyInfoWithScheme(symmetricKey, options, scheme, callback) {\n  const padding = scheme === 'RSA-OAEP' ? crypto.constants.RSA_PKCS1_OAEP_PADDING : crypto.constants.RSA_PKCS1_PADDING;\n  const symmetricKeyBuffer = Buffer.isBuffer(symmetricKey) ? symmetricKey : Buffer.from(symmetricKey, 'utf-8');\n\n  try {\n    var encrypted = crypto.publicEncrypt({\n      key: options.rsa_pub,\n      padding: padding\n    }, symmetricKeyBuffer);\n    var base64EncodedEncryptedKey = encrypted.toString('base64');\n\n    var params = {\n      encryptedKey:  base64EncodedEncryptedKey,\n      encryptionPublicCert: '<X509Data><X509Certificate>' + utils.pemToCert(options.pem.toString()) + '</X509Certificate></X509Data>',\n      keyEncryptionMethod: options.keyEncryptionAlgorithm\n    };\n\n    var result = utils.renderTemplate('keyinfo', params);\n    callback(null, result);\n  } catch (e) {\n    callback(e);\n  }\n}\n\nfunction encryptKeyInfo(symmetricKey, options, callback) {\n  if (!options)\n    return callback(new Error('must provide options'));\n  if (!options.rsa_pub)\n    return callback(new Error('must provide options.rsa_pub with public key RSA'));\n  if (!options.pem)\n    return callback(new Error('must provide options.pem with certificate'));\n\n  if (!options.keyEncryptionAlgorithm)\n    return callback(new Error('encryption without encrypted key is not supported yet'));\n  if (options.disallowEncryptionWithInsecureAlgorithm\n    && insecureAlgorithms.indexOf(options.keyEncryptionAlgorithm) >= 0) {\n    return callback(new Error('encryption algorithm ' + options.keyEncryptionAlgorithm + 'is not secure'));\n  }\n  switch (options.keyEncryptionAlgorithm) {\n    case 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p':\n      return encryptKeyInfoWithScheme(symmetricKey, options, 'RSA-OAEP', callback);\n\n    case 'http://www.w3.org/2001/04/xmlenc#rsa-1_5':\n      utils.warnInsecureAlgorithm(options.keyEncryptionAlgorithm, options.warnInsecureAlgorithm);\n      return encryptKeyInfoWithScheme(symmetricKey, options, 'RSAES-PKCS1-V1_5', callback);\n\n    default:\n      return callback(new Error('encryption key algorithm not supported'));\n  }\n}\n\nfunction encrypt(content, options, callback) {\n  if (!options)\n    return callback(new Error('must provide options'));\n  if (!content)\n    return callback(new Error('must provide content to encrypt'));\n  if (!options.rsa_pub)\n    return callback(new Error('rsa_pub option is mandatory and you should provide a valid RSA public key'));\n  if (!options.pem)\n    return callback(new Error('pem option is mandatory and you should provide a valid x509 certificate encoded as PEM'));\n  if (options.disallowEncryptionWithInsecureAlgorithm\n    && (insecureAlgorithms.indexOf(options.keyEncryptionAlgorithm) >= 0\n      || insecureAlgorithms.indexOf(options.encryptionAlgorithm) >= 0)) {\n    return callback(new Error('encryption algorithm ' + options.keyEncryptionAlgorithm + ' is not secure'));\n  }\n  options.input_encoding = options.input_encoding || 'utf8';\n\n  function generate_symmetric_key(cb) {\n    switch (options.encryptionAlgorithm) {\n      case 'http://www.w3.org/2001/04/xmlenc#aes128-cbc':\n        crypto.randomBytes(16, cb); // generate a symmetric random key 16 bytes length\n        break;\n      case 'http://www.w3.org/2001/04/xmlenc#aes256-cbc':\n        crypto.randomBytes(32, cb); // generate a symmetric random key 32 bytes length\n        break;\n      case 'http://www.w3.org/2009/xmlenc11#aes128-gcm':\n        crypto.randomBytes(16, cb); // generate a symmetric random key 16 bytes length\n        break;\n      case 'http://www.w3.org/2009/xmlenc11#aes256-gcm':\n        crypto.randomBytes(32, cb); // generate a symmetric random key 32 bytes length\n        break;\n      case 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc':\n        utils.warnInsecureAlgorithm(options.encryptionAlgorithm, options.warnInsecureAlgorithm);\n        crypto.randomBytes(24, cb); // generate a symmetric random key 24 bytes (192 bits) length\n        break;\n      default:\n        crypto.randomBytes(32, cb); // generate a symmetric random key 32 bytes length\n    }\n  }\n\n  function encrypt_content(symmetricKey, cb) {\n    switch (options.encryptionAlgorithm) {\n      case 'http://www.w3.org/2001/04/xmlenc#aes128-cbc':\n        encryptWithAlgorithm('aes-128-cbc', symmetricKey, 16, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      case 'http://www.w3.org/2001/04/xmlenc#aes256-cbc':\n        encryptWithAlgorithm('aes-256-cbc', symmetricKey, 16, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      case 'http://www.w3.org/2009/xmlenc11#aes128-gcm':\n        encryptWithAlgorithm('aes-128-gcm', symmetricKey, 12, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      case 'http://www.w3.org/2009/xmlenc11#aes256-gcm':\n        encryptWithAlgorithm('aes-256-gcm', symmetricKey, 12, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      case 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc':\n        utils.warnInsecureAlgorithm(options.encryptionAlgorithm, options.warnInsecureAlgorithm);\n        encryptWithAlgorithm('des-ede3-cbc', symmetricKey, 8, content, options.input_encoding, function (err, encryptedContent) {\n          if (err) return cb(err);\n          cb(null, encryptedContent);\n        });\n        break;\n      default:\n        cb(new Error('encryption algorithm not supported'));\n    }\n  }\n\n  function encrypt_key(symmetricKey, encryptedContent, cb) {\n    encryptKeyInfo(symmetricKey, options, function(err, keyInfo) {\n      if (err) return cb(err);\n      var result = utils.renderTemplate('encrypted-key', {\n        encryptedContent: encryptedContent.toString('base64'),\n        keyInfo: keyInfo,\n        contentEncryptionMethod: options.encryptionAlgorithm\n      });\n\n      cb(null, result);\n    });\n  }\n\n\n  generate_symmetric_key(function (genKeyError, symmetricKey) {\n    if (genKeyError) {\n      return callback(genKeyError);\n    }\n\n    encrypt_content(symmetricKey, function(encryptContentError, encryptedContent) {\n      if (encryptContentError) {\n        return callback(encryptContentError);\n      }\n\n      encrypt_key(symmetricKey, encryptedContent, function (encryptKeyError, result) {\n        if (encryptKeyError) {\n          return callback(encryptKeyError);\n        }\n\n        callback(null, result);\n      });\n\n    });\n\n  });\n}\n\nfunction decrypt(xml, options, callback) {\n  if (!options)\n    return callback(new Error('must provide options'));\n  if (!xml)\n    return callback(new Error('must provide XML to encrypt'));\n  if (!options.key)\n    return callback(new Error('key option is mandatory and you should provide a valid RSA private key'));\n  try {\n    var doc = typeof xml === 'string' ? new xmldom.DOMParser().parseFromString(xml) : xml;\n\n    var symmetricKey = decryptKeyInfo(doc, options);\n    var encryptionMethod = xpath.select(\"//*[local-name(.)='EncryptedData']/*[local-name(.)='EncryptionMethod']\", doc)[0];\n    var encryptionAlgorithm = encryptionMethod.getAttribute('Algorithm');\n\n    if (options.disallowDecryptionWithInsecureAlgorithm\n      && insecureAlgorithms.indexOf(encryptionAlgorithm) >= 0) {\n      return callback(new Error('encryption algorithm ' + encryptionAlgorithm + ' is not secure, fail to decrypt'));\n    }\n    var encryptedContent = xpath.select(\"//*[local-name(.)='EncryptedData']/*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']\", doc)[0];\n\n    var encrypted = Buffer.from(encryptedContent.textContent, 'base64');\n    switch (encryptionAlgorithm) {\n      case 'http://www.w3.org/2001/04/xmlenc#aes128-cbc':\n        return callback(null, decryptWithAlgorithm('aes-128-cbc', symmetricKey, 16, encrypted));\n      case 'http://www.w3.org/2001/04/xmlenc#aes256-cbc':\n        return callback(null, decryptWithAlgorithm('aes-256-cbc', symmetricKey, 16, encrypted));\n      case 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc':\n        utils.warnInsecureAlgorithm(encryptionAlgorithm, options.warnInsecureAlgorithm);\n        return callback(null, decryptWithAlgorithm('des-ede3-cbc', symmetricKey, 8, encrypted));\n      case 'http://www.w3.org/2009/xmlenc11#aes128-gcm':\n        return callback(null, decryptWithAlgorithm('aes-128-gcm', symmetricKey, 12, encrypted));\n      case 'http://www.w3.org/2009/xmlenc11#aes256-gcm':\n        return callback(null, decryptWithAlgorithm('aes-256-gcm', symmetricKey, 12, encrypted));\n      default:\n        return callback(new Error('encryption algorithm ' + encryptionAlgorithm + ' not supported'));\n    }\n  } catch (e) {\n    return callback(e);\n  }\n}\n\nfunction decryptKeyInfo(doc, options) {\n  if (typeof doc === 'string') doc = new xmldom.DOMParser().parseFromString(doc);\n\n  var keyRetrievalMethodUri;\n  var keyInfo = xpath.select(\"//*[local-name(.)='KeyInfo' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']\", doc)[0];\n  var keyEncryptionMethod = xpath.select(\"//*[local-name(.)='KeyInfo']/*[local-name(.)='EncryptedKey']/*[local-name(.)='EncryptionMethod']\", doc)[0];\n\n  if (!keyEncryptionMethod) { // try with EncryptedData->KeyInfo->RetrievalMethod\n    var keyRetrievalMethod = xpath.select(\"//*[local-name(.)='EncryptedData']/*[local-name(.)='KeyInfo']/*[local-name(.)='RetrievalMethod']\", doc)[0];\n    keyRetrievalMethodUri = keyRetrievalMethod ? keyRetrievalMethod.getAttribute('URI') : null;\n    keyEncryptionMethod = keyRetrievalMethodUri ? xpath.select(\"//*[local-name(.)='EncryptedKey' and @Id='\" + keyRetrievalMethodUri.substring(1) + \"']/*[local-name(.)='EncryptionMethod']\", doc)[0] : null;\n  }\n\n  if (!keyEncryptionMethod) {\n    throw new Error('cant find encryption algorithm');\n  }\n\n  var keyEncryptionAlgorithm = keyEncryptionMethod.getAttribute('Algorithm');\n  if (options.disallowDecryptionWithInsecureAlgorithm\n    && insecureAlgorithms.indexOf(keyEncryptionAlgorithm) >= 0) {\n    throw new Error('encryption algorithm ' + keyEncryptionAlgorithm + ' is not secure, fail to decrypt');\n  }\n  var encryptedKey = keyRetrievalMethodUri ?\n    xpath.select(\"//*[local-name(.)='EncryptedKey' and @Id='\" + keyRetrievalMethodUri.substring(1) + \"']/*[local-name(.)='CipherData']/*[local-name(.)='CipherValue']\", keyInfo)[0] :\n    xpath.select(\"//*[local-name(.)='CipherValue']\", keyInfo)[0];\n\n  switch (keyEncryptionAlgorithm) {\n    case 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p':\n      return decryptKeyInfoWithScheme(encryptedKey, options, 'RSA-OAEP');\n    case 'http://www.w3.org/2001/04/xmlenc#rsa-1_5':\n      utils.warnInsecureAlgorithm(keyEncryptionAlgorithm, options.warnInsecureAlgorithm);\n      return decryptKeyInfoWithScheme(encryptedKey, options, 'RSAES-PKCS1-V1_5');\n    default:\n      throw new Error('key encryption algorithm ' + keyEncryptionAlgorithm + ' not supported');\n  }\n}\n\nfunction decryptKeyInfoWithScheme(encryptedKey, options, scheme) {\n  var padding = scheme === 'RSA-OAEP' ? crypto.constants.RSA_PKCS1_OAEP_PADDING : crypto.constants.RSA_PKCS1_PADDING;\n  var key = Buffer.from(encryptedKey.textContent, 'base64');\n  var decrypted = crypto.privateDecrypt({ key: options.key, padding: padding}, key);\n  return Buffer.from(decrypted, 'binary');\n}\n\nfunction encryptWithAlgorithm(algorithm, symmetricKey, ivLength, content, encoding, callback) {\n  // create a random iv for algorithm\n  crypto.randomBytes(ivLength, function(err, iv) {\n    if (err) return callback(err);\n\n    var cipher = crypto.createCipheriv(algorithm, symmetricKey, iv);\n    // encrypted content\n    var encrypted = cipher.update(content, encoding, 'binary') + cipher.final('binary');\n    var authTag = algorithm.slice(-3) === \"gcm\" ? cipher.getAuthTag() : Buffer.from(\"\");\n    //Format mentioned: https://www.w3.org/TR/xmlenc-core1/#sec-AES-GCM\n    var r = Buffer.concat([iv, Buffer.from(encrypted, 'binary'), authTag]);\n    return callback(null, r);\n  });\n}\n\nfunction decryptWithAlgorithm(algorithm, symmetricKey, ivLength, content) {\n  var decipher = crypto.createDecipheriv(algorithm, symmetricKey, content.slice(0,ivLength));\n  decipher.setAutoPadding(false);\n\n  if (algorithm.slice(-3) === \"gcm\") {\n    decipher.setAuthTag(content.slice(-16));\n    content = content.slice(0,-16);\n  }\n  var decrypted = decipher.update(content.slice(ivLength), null, 'binary') + decipher.final('binary');\n\nif (algorithm.slice(-3) !== \"gcm\") {\n  // Remove padding bytes equal to the value of the last byte of the returned data.\n  // Padding for GCM not required per: https://www.w3.org/TR/xmlenc-core1/#sec-AES-GCM\n  var padding = decrypted.charCodeAt(decrypted.length - 1);\n  if (1 <= padding && padding <= ivLength) {\n    decrypted = decrypted.substr(0, decrypted.length - padding);\n  } else {\n    callback(new Error('padding length invalid'));\n    return;\n  }\n}\n\n  return Buffer.from(decrypted, 'binary').toString('utf8');\n}\n\nexports = module.exports = {\n  decrypt: decrypt,\n  encrypt: encrypt,\n  encryptKeyInfo: encryptKeyInfo,\n  decryptKeyInfo: decryptKeyInfo\n};\n"],"x_google_ignoreList":[0],"mappings":";;;;;;;CAAA,IAAI,SAAU,QAAQ,SAAS;CAC/B,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,MAAM,qBAAqB,CAEzB,4CAEA,iDAAiD;CAEnD,SAAS,yBAAyB,cAAc,SAAS,QAAQ,YAAU;EACzE,MAAM,UAAU,WAAW,aAAa,OAAO,UAAU,yBAAyB,OAAO,UAAU;EACnG,MAAM,qBAAqB,OAAO,SAAS,aAAa,GAAG,eAAe,OAAO,KAAK,cAAc,QAAQ;AAE5G,MAAI;GAOF,IAAI,SAAS;IACX,cAPc,OAAO,cAAc;KACnC,KAAK,QAAQ;KACJ;KACV,EAAE,mBAAmB,CACoB,SAAS,SAAS;IAI1D,sBAAsB,gCAAgC,MAAM,UAAU,QAAQ,IAAI,UAAU,CAAC,GAAG;IAChG,qBAAqB,QAAQ;IAC9B;AAGD,cAAS,MADI,MAAM,eAAe,WAAW,OAAO,CAC9B;WACf,GAAG;AACV,cAAS,EAAE;;;CAIf,SAAS,eAAe,cAAc,SAAS,YAAU;AACvD,MAAI,CAAC,QACH,QAAOA,2BAAS,IAAI,MAAM,uBAAuB,CAAC;AACpD,MAAI,CAAC,QAAQ,QACX,QAAOA,2BAAS,IAAI,MAAM,mDAAmD,CAAC;AAChF,MAAI,CAAC,QAAQ,IACX,QAAOA,2BAAS,IAAI,MAAM,4CAA4C,CAAC;AAEzE,MAAI,CAAC,QAAQ,uBACX,QAAOA,2BAAS,IAAI,MAAM,wDAAwD,CAAC;AACrF,MAAI,QAAQ,2CACP,mBAAmB,QAAQ,QAAQ,uBAAuB,IAAI,EACjE,QAAOA,2BAAS,IAAI,MAAM,0BAA0B,QAAQ,yBAAyB,gBAAgB,CAAC;AAExG,UAAQ,QAAQ,wBAAhB;GACE,KAAK,kDACH,QAAO,yBAAyB,cAAc,SAAS,YAAYA,WAAS;GAE9E,KAAK;AACH,UAAM,sBAAsB,QAAQ,wBAAwB,QAAQ,sBAAsB;AAC1F,WAAO,yBAAyB,cAAc,SAAS,oBAAoBA,WAAS;GAEtF,QACE,QAAOA,2BAAS,IAAI,MAAM,yCAAyC,CAAC;;;CAI1E,SAAS,QAAQ,SAAS,SAAS,YAAU;AAC3C,MAAI,CAAC,QACH,QAAOA,2BAAS,IAAI,MAAM,uBAAuB,CAAC;AACpD,MAAI,CAAC,QACH,QAAOA,2BAAS,IAAI,MAAM,kCAAkC,CAAC;AAC/D,MAAI,CAAC,QAAQ,QACX,QAAOA,2BAAS,IAAI,MAAM,4EAA4E,CAAC;AACzG,MAAI,CAAC,QAAQ,IACX,QAAOA,2BAAS,IAAI,MAAM,yFAAyF,CAAC;AACtH,MAAI,QAAQ,4CACN,mBAAmB,QAAQ,QAAQ,uBAAuB,IAAI,KAC7D,mBAAmB,QAAQ,QAAQ,oBAAoB,IAAI,GAChE,QAAOA,2BAAS,IAAI,MAAM,0BAA0B,QAAQ,yBAAyB,iBAAiB,CAAC;AAEzG,UAAQ,iBAAiB,QAAQ,kBAAkB;EAEnD,SAAS,uBAAuB,IAAI;AAClC,WAAQ,QAAQ,qBAAhB;IACE,KAAK;AACH,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,KAAK;AACH,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,KAAK;AACH,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,KAAK;AACH,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,KAAK;AACH,WAAM,sBAAsB,QAAQ,qBAAqB,QAAQ,sBAAsB;AACvF,YAAO,YAAY,IAAI,GAAG;AAC1B;IACF,QACE,QAAO,YAAY,IAAI,GAAG;;;EAIhC,SAAS,gBAAgB,cAAc,IAAI;AACzC,WAAQ,QAAQ,qBAAhB;IACE,KAAK;AACH,0BAAqB,eAAe,cAAc,IAAI,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,KAAK;AACH,0BAAqB,eAAe,cAAc,IAAI,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,KAAK;AACH,0BAAqB,eAAe,cAAc,IAAI,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,KAAK;AACH,0BAAqB,eAAe,cAAc,IAAI,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,KAAK;AACH,WAAM,sBAAsB,QAAQ,qBAAqB,QAAQ,sBAAsB;AACvF,0BAAqB,gBAAgB,cAAc,GAAG,SAAS,QAAQ,gBAAgB,SAAU,KAAK,kBAAkB;AACtH,UAAI,IAAK,QAAO,GAAG,IAAI;AACvB,SAAG,MAAM,iBAAiB;OAC1B;AACF;IACF,QACE,oBAAG,IAAI,MAAM,qCAAqC,CAAC;;;EAIzD,SAAS,YAAY,cAAc,kBAAkB,IAAI;AACvD,kBAAe,cAAc,SAAS,SAAS,KAAK,SAAS;AAC3D,QAAI,IAAK,QAAO,GAAG,IAAI;AAOvB,OAAG,MANU,MAAM,eAAe,iBAAiB;KACjD,kBAAkB,iBAAiB,SAAS,SAAS;KAC5C;KACT,yBAAyB,QAAQ;KAClC,CAAC,CAEc;KAChB;;AAIJ,yBAAuB,SAAU,aAAa,cAAc;AAC1D,OAAI,YACF,QAAOA,WAAS,YAAY;AAG9B,mBAAgB,cAAc,SAAS,qBAAqB,kBAAkB;AAC5E,QAAI,oBACF,QAAOA,WAAS,oBAAoB;AAGtC,gBAAY,cAAc,kBAAkB,SAAU,iBAAiB,QAAQ;AAC7E,SAAI,gBACF,QAAOA,WAAS,gBAAgB;AAGlC,gBAAS,MAAM,OAAO;MACtB;KAEF;IAEF;;CAGJ,SAAS,QAAQ,KAAK,SAAS,YAAU;AACvC,MAAI,CAAC,QACH,QAAOA,2BAAS,IAAI,MAAM,uBAAuB,CAAC;AACpD,MAAI,CAAC,IACH,QAAOA,2BAAS,IAAI,MAAM,8BAA8B,CAAC;AAC3D,MAAI,CAAC,QAAQ,IACX,QAAOA,2BAAS,IAAI,MAAM,yEAAyE,CAAC;AACtG,MAAI;GACF,IAAI,MAAM,OAAO,QAAQ,WAAW,IAAI,OAAO,WAAW,CAAC,gBAAgB,IAAI,GAAG;GAElF,IAAI,eAAe,eAAe,KAAK,QAAQ;GAE/C,IAAI,sBADmB,MAAM,OAAO,0EAA0E,IAAI,CAAC,GACxE,aAAa,YAAY;AAEpE,OAAI,QAAQ,2CACP,mBAAmB,QAAQ,oBAAoB,IAAI,EACtD,QAAOA,2BAAS,IAAI,MAAM,0BAA0B,sBAAsB,kCAAkC,CAAC;GAE/G,IAAI,mBAAmB,MAAM,OAAO,mGAAmG,IAAI,CAAC;GAE5I,IAAI,YAAY,OAAO,KAAK,iBAAiB,aAAa,SAAS;AACnE,WAAQ,qBAAR;IACE,KAAK,8CACH,QAAOA,WAAS,MAAM,qBAAqB,eAAe,cAAc,IAAI,UAAU,CAAC;IACzF,KAAK,8CACH,QAAOA,WAAS,MAAM,qBAAqB,eAAe,cAAc,IAAI,UAAU,CAAC;IACzF,KAAK;AACH,WAAM,sBAAsB,qBAAqB,QAAQ,sBAAsB;AAC/E,YAAOA,WAAS,MAAM,qBAAqB,gBAAgB,cAAc,GAAG,UAAU,CAAC;IACzF,KAAK,6CACH,QAAOA,WAAS,MAAM,qBAAqB,eAAe,cAAc,IAAI,UAAU,CAAC;IACzF,KAAK,6CACH,QAAOA,WAAS,MAAM,qBAAqB,eAAe,cAAc,IAAI,UAAU,CAAC;IACzF,QACE,QAAOA,2BAAS,IAAI,MAAM,0BAA0B,sBAAsB,iBAAiB,CAAC;;WAEzF,GAAG;AACV,UAAOA,WAAS,EAAE;;;CAItB,SAAS,eAAe,KAAK,SAAS;AACpC,MAAI,OAAO,QAAQ,SAAU,OAAM,IAAI,OAAO,WAAW,CAAC,gBAAgB,IAAI;EAE9E,IAAI;EACJ,IAAI,UAAU,MAAM,OAAO,0FAA0F,IAAI,CAAC;EAC1H,IAAI,sBAAsB,MAAM,OAAO,oGAAoG,IAAI,CAAC;AAEhJ,MAAI,CAAC,qBAAqB;GACxB,IAAI,qBAAqB,MAAM,OAAO,oGAAoG,IAAI,CAAC;AAC/I,2BAAwB,qBAAqB,mBAAmB,aAAa,MAAM,GAAG;AACtF,yBAAsB,wBAAwB,MAAM,OAAO,+CAA+C,sBAAsB,UAAU,EAAE,GAAG,0CAA0C,IAAI,CAAC,KAAK;;AAGrM,MAAI,CAAC,oBACH,OAAM,IAAI,MAAM,iCAAiC;EAGnD,IAAI,yBAAyB,oBAAoB,aAAa,YAAY;AAC1E,MAAI,QAAQ,2CACP,mBAAmB,QAAQ,uBAAuB,IAAI,EACzD,OAAM,IAAI,MAAM,0BAA0B,yBAAyB,kCAAkC;EAEvG,IAAI,eAAe,wBACjB,MAAM,OAAO,+CAA+C,sBAAsB,UAAU,EAAE,GAAG,mEAAmE,QAAQ,CAAC,KAC7K,MAAM,OAAO,oCAAoC,QAAQ,CAAC;AAE5D,UAAQ,wBAAR;GACE,KAAK,kDACH,QAAO,yBAAyB,cAAc,SAAS,WAAW;GACpE,KAAK;AACH,UAAM,sBAAsB,wBAAwB,QAAQ,sBAAsB;AAClF,WAAO,yBAAyB,cAAc,SAAS,mBAAmB;GAC5E,QACE,OAAM,IAAI,MAAM,8BAA8B,yBAAyB,iBAAiB;;;CAI9F,SAAS,yBAAyB,cAAc,SAAS,QAAQ;EAC/D,IAAI,UAAU,WAAW,aAAa,OAAO,UAAU,yBAAyB,OAAO,UAAU;EACjG,IAAI,MAAM,OAAO,KAAK,aAAa,aAAa,SAAS;EACzD,IAAI,YAAY,OAAO,eAAe;GAAE,KAAK,QAAQ;GAAc;GAAQ,EAAE,IAAI;AACjF,SAAO,OAAO,KAAK,WAAW,SAAS;;CAGzC,SAAS,qBAAqB,WAAW,cAAc,UAAU,SAAS,UAAU,YAAU;AAE5F,SAAO,YAAY,UAAU,SAAS,KAAK,IAAI;AAC7C,OAAI,IAAK,QAAOA,WAAS,IAAI;GAE7B,IAAI,SAAS,OAAO,eAAe,WAAW,cAAc,GAAG;GAE/D,IAAI,YAAY,OAAO,OAAO,SAAS,UAAU,SAAS,GAAG,OAAO,MAAM,SAAS;GACnF,IAAI,UAAU,UAAU,MAAM,GAAG,KAAK,QAAQ,OAAO,YAAY,GAAG,OAAO,KAAK,GAAG;AAGnF,UAAOA,WAAS,MADR,OAAO,OAAO;IAAC;IAAI,OAAO,KAAK,WAAW,SAAS;IAAE;IAAQ,CAAC,CAC9C;IACxB;;CAGJ,SAAS,qBAAqB,WAAW,cAAc,UAAU,SAAS;EACxE,IAAI,WAAW,OAAO,iBAAiB,WAAW,cAAc,QAAQ,MAAM,GAAE,SAAS,CAAC;AAC1F,WAAS,eAAe,MAAM;AAE9B,MAAI,UAAU,MAAM,GAAG,KAAK,OAAO;AACjC,YAAS,WAAW,QAAQ,MAAM,IAAI,CAAC;AACvC,aAAU,QAAQ,MAAM,GAAE,IAAI;;EAEhC,IAAI,YAAY,SAAS,OAAO,QAAQ,MAAM,SAAS,EAAE,MAAM,SAAS,GAAG,SAAS,MAAM,SAAS;AAErG,MAAI,UAAU,MAAM,GAAG,KAAK,OAAO;GAGjC,IAAI,UAAU,UAAU,WAAW,UAAU,SAAS,EAAE;AACxD,OAAI,KAAK,WAAW,WAAW,SAC7B,aAAY,UAAU,OAAO,GAAG,UAAU,SAAS,QAAQ;QACtD;AACL,6BAAS,IAAI,MAAM,yBAAyB,CAAC;AAC7C;;;AAIF,SAAO,OAAO,KAAK,WAAW,SAAS,CAAC,SAAS,OAAO;;AAG1D,WAAU,OAAO,UAAU;EAChB;EACA;EACO;EACA;EACjB"}