@keeper-security/keeperapi 16.0.1 → 16.0.2

package/src/company.ts

@@ -0,0 +1,244 @@
+import {Auth} from "./auth";
+import {
+    EnterpriseAllocateIdsCommand,
+    EnterpriseDataInclude,
+    GetEnterpriseDataCommand,
+    GetEnterpriseDataResponse,
+    NodeAddCommand,
+    RoleAddCommand,
+    TeamAddCommand,
+    EnterpriseUserAddCommand
+} from "./commands";
+import {
+    decryptFromStorage,
+    decryptObjectFromStorage,
+    encryptForStorage,
+    encryptObjectForStorage,
+    encryptKey,
+    decryptKey,
+    generateUid,
+    generateEncryptionKey,
+    webSafe64FromBytes, normal64Bytes
+} from "./utils";
+import {platform} from "./platform";
+
+export class Company {
+
+    private _data: GetEnterpriseDataResponse;
+    private treeKey: Uint8Array;
+
+    constructor(private auth: Auth) {
+    }
+
+    async load(include: EnterpriseDataInclude[]) {
+        let getEnterpriseDataCommand = new GetEnterpriseDataCommand();
+        getEnterpriseDataCommand.include = include;
+
+        this._data = await this.auth.executeCommand(getEnterpriseDataCommand);
+
+        if (this._data.msp_key) {
+            let key4TreeKey
+            switch (this._data.msp_key.encrypted_msp_tree_key_type) {
+                case 'encrypted_by_data_key':
+                    key4TreeKey = decryptFromStorage(this._data.msp_key.encrypted_msp_tree_key, this.auth.dataKey);
+                    break;
+                case 'encrypted_by_public_key':
+                    key4TreeKey = platform.privateDecrypt(normal64Bytes(this._data.msp_key.encrypted_msp_tree_key), this.auth.privateKey)
+                    break;
+                case 'no_key':
+                    throw new Error('invalid value for encrypted_msp_tree_key_type')
+            }
+            this.treeKey = await decryptKey(this._data.tree_key, key4TreeKey);
+        } else {
+            if (this._data.key_type_id === 1) {
+                this.treeKey = await decryptFromStorage(this._data.tree_key, this.auth.dataKey);
+            }
+            else {
+                this.treeKey = platform.privateDecrypt(normal64Bytes(this._data.tree_key), this.auth.privateKey)
+            }
+        }
+
+        if (!this._data.roles)
+            this._data.roles = [];
+        if (!this._data.teams)
+            this._data.teams = [];
+        if (!this._data.users)
+            this._data.users = [];
+
+        for (let node of this._data.nodes) {
+            node.displayName = (await decryptObjectFromStorage<EncryptedData>(node.encrypted_data, this.treeKey)).displayname;
+            if (node.parent_id) {
+                let parent = this._data.nodes.find(x => x.node_id == node.parent_id);
+                if (!parent) {
+                    throw new Error(`Unable to find parent for node:${node.parent_id}`)
+                }
+
+                if (!parent.nodes) {
+                    parent.nodes = []
+                }
+                parent.nodes.push(node);
+            }
+        }
+
+        for (let role of this._data.roles) {
+
+            if (role.role_type === "pool_manager") {
+                role.displayName = "License Purchaser"
+            }
+            else {
+                switch (role.key_type) {
+                    case "encrypted_by_data_key":
+                        role.displayName = (await decryptObjectFromStorage<EncryptedData>(role.encrypted_data, this.treeKey)).displayname;
+                        break;
+                    case "encrypted_by_public_key":
+                        throw "Not Implemented";
+                    case "no_key":
+                        role.displayName = role.encrypted_data;
+                        break;
+                }
+            }
+
+            let node = this._data.nodes.find(x => x.node_id == role.node_id);
+            if (!node) {
+                throw new Error(`Unable to find node for role:${role.node_id}`)
+            }
+
+            if (!node.roles) {
+                node.roles = []
+            }
+            node.roles.push(role);
+        }
+
+        for (let team of this._data.teams) {
+            let node = this._data.nodes.find(x => x.node_id == team.node_id);
+            if (!node) {
+                throw new Error(`Unable to find node for team:${team.node_id}`)
+            }
+
+            if (!node.teams) {
+                node.teams = []
+            }
+            node.teams.push(team);
+        }
+
+        for (let user of this._data.users) {
+            switch (user.key_type) {
+                case "encrypted_by_data_key":
+                    user.displayName = (await decryptObjectFromStorage<EncryptedData>(user.encrypted_data, this.treeKey)).displayname;
+                    break;
+                case "encrypted_by_public_key":
+                    throw "Not Implemented";
+                case "no_key":
+                    user.displayName = user.encrypted_data;
+                    break;
+            }
+
+            let node = this._data.nodes.find(x => x.node_id == user.node_id);
+            if (!node) {
+                throw new Error(`Unable to find node for user:${user.node_id}`)
+            }
+
+            if (!node.users) {
+                node.users = []
+            }
+            for (let user_role of this._data.role_users || []) {
+                if (user_role.enterprise_user_id == user.enterprise_user_id) {
+                    if (!user.roles) {
+                        user.roles = []
+                    }
+
+                    const role = this._data.roles.find(x => x.role_id === user_role.role_id)
+                    if (!role) {
+                        throw new Error(`Unable to find role for user_role:${user_role.role_id}`)
+                    }
+
+                    user.roles.push(role)
+                }
+            }
+            for (let user_team of this._data.team_users || []) {
+                if (user_team.enterprise_user_id == user.enterprise_user_id) {
+                    if (!user.teams) {
+                        user.teams = []
+                    }
+
+                    const team = this._data.teams.find(x => x.team_uid === user_team.team_uid)
+                    if (!team) {
+                        throw new Error(`Unable to find team for user_team:${user_team.team_uid}`)
+                    }
+
+                    user.teams.push(team)
+                }
+            }
+            node.users.push(user);
+        }
+    }
+
+    get data(): GetEnterpriseDataResponse {
+        return this._data;
+    }
+
+    encryptDisplayName(displayName: string): Promise<string> {
+        return encryptObjectForStorage<EncryptedData>({
+            displayname: displayName
+        }, this.treeKey);
+    }
+
+    encryptForStorage(data: Uint8Array): Promise<string> {
+        return encryptForStorage(data, this.treeKey);
+    }
+
+    async encryptKey(key: Uint8Array): Promise<string> {
+        return encryptKey(key, this.treeKey);
+    }
+
+    async encryptKeyAsBytes(key: Uint8Array): Promise<Uint8Array> {
+        return platform.aesGcmEncrypt(key, this.treeKey)
+    }
+
+    async decryptKey(encryptedKey: string): Promise<Uint8Array> {
+        return decryptKey(encryptedKey, this.treeKey);
+    }
+
+    async allocateIDs(count: number): Promise<number> {
+        let allocateCommand = new EnterpriseAllocateIdsCommand();
+        allocateCommand.number_requested = count;
+        let response = await this.auth.executeCommand(allocateCommand);
+        return response.base_id;
+    }
+
+    async addNode(parentNodeId: number, nodeName: string): Promise<number> {
+        let nodeId = await this.allocateIDs(1);
+        let nodeAddCommand = new NodeAddCommand(nodeId, parentNodeId, await this.encryptDisplayName(nodeName));
+        let response = await this.auth.executeCommand(nodeAddCommand);
+        return nodeId;
+    }
+
+    async addRole(nodeId: number, roleName: string): Promise<number> {
+        let roleId = await this.allocateIDs(1);
+        let roleAddCommand = new RoleAddCommand(roleId, nodeId, await this.encryptDisplayName(roleName));
+        let response = await this.auth.executeCommand(roleAddCommand);
+        return roleId;
+    }
+
+    async addTeam(nodeId: number, teamName: string) {
+        let teamUid = generateUid();
+        let teamKeyBytes = generateEncryptionKey();
+        let {privateKey, publicKey} = await platform.generateRSAKeyPair();
+        let publicKey64 = webSafe64FromBytes(publicKey);
+        let encryptedPrivateKey = encryptForStorage(privateKey, teamKeyBytes);
+        let teamKey = await encryptForStorage(teamKeyBytes, this.auth.dataKey);
+        let encryptedTeamKey = await this.encryptKey(teamKeyBytes);
+        let teamAddCommand = new TeamAddCommand(teamUid, teamName, nodeId, publicKey64, await encryptedPrivateKey, teamKey, encryptedTeamKey);
+        let response = await this.auth.executeCommand(teamAddCommand);
+    }
+
+    async addUser(nodeId: number, email: string, userName: string): Promise<{userId: number; verification_code: string}> {
+        let userId = await this.allocateIDs(1);
+        let userAddCommand = new EnterpriseUserAddCommand(userId, email, nodeId, await this.encryptDisplayName(userName));
+        let response = await this.auth.executeCommand(userAddCommand);
+        let verification_code = response.verification_code;
+        return {userId, verification_code};
+    }
+}
+
+export type EncryptedData = {displayname: string}

package/src/configuration.ts

@@ -0,0 +1,125 @@
+import {KeeperEnvironment} from "./endpoint";
+import {Authentication} from './proto';
+import TwoFactorExpiration = Authentication.TwoFactorExpiration;
+import TwoFactorPushType = Authentication.TwoFactorPushType;
+import TwoFactorChannelType = Authentication.TwoFactorChannelType;
+import {KeyWrapper} from './platform';
+import {SessionParams} from "./auth";
+
+export type KeeperHost = KeeperEnvironment | string
+
+export interface ClientConfiguration {
+    authUI?: AuthUI
+    authUI3?: AuthUI3
+    clientVersion?: string
+    deviceConfig?: DeviceConfig // v15+ device config
+    deviceToken?: Uint8Array // pre - v15 device token
+    host: KeeperHost,
+    onCommandFailure?: (error: KeeperError) => void,
+    onDeviceConfig?: (deviceConfig: DeviceConfig, host: KeeperHost) => void // event to store device config
+    onDeviceToken?: (deviceToken: Uint8Array) => void  // event to store device token
+    onRegionChanged?: (newRegion: string) => void,
+    onDeviceVerified?: (isDeviceVerified: boolean) => void
+    sessionStorage?: SessionStorage
+    kvs?: KeyValueStorage;
+    useSessionResumption?: boolean
+    iterations?: number
+    salt?: Uint8Array
+}
+export interface ClientConfigurationInternal extends ClientConfiguration {
+    deviceConfig: DeviceConfig // v15+ device config
+}
+
+export type KeeperError = {
+    additional_info?: string
+    error?: string
+    location?: string
+    message?: string
+    path?: string
+    result_code?: string
+    key_id?: number
+    region_host?: string
+}
+
+export interface DeviceConfig {
+    deviceName: string | null
+    deviceToken: Uint8Array | null
+    privateKey: Uint8Array | null
+    publicKey: Uint8Array | null
+    transmissionKeyId: number | null
+}
+
+export interface SessionStorage {
+    lastUsername: string;
+    getCloneCode(host: KeeperEnvironment, username: string): Promise<Uint8Array | null>;
+    saveCloneCode(host: KeeperEnvironment, username: string, cloneCode: Uint8Array): Promise<void>;
+    getSessionParameters(): Promise<SessionParams | null>;
+    /**
+     * Important: implementation of this function should retain these values in memory only, never to disk.
+     */
+    saveSessionParameters(sessionParams: SessionParams): Promise<void>;
+}
+
+export interface KeyValueStorage {
+    getValue(key: string): string | null;
+    saveValue(key: string, value: string): void;
+}
+
+export interface VendorConfiguration {
+    host: KeeperHost;
+    vendorId: string;
+    privateKey: string;
+}
+
+export interface TransmissionKey {
+    key: Uint8Array
+    publicKeyId: number
+    encryptedKey: Uint8Array
+}
+
+export interface AuthUI {
+    getTwoFactorCode(errorMessage?: string): Promise<string>;
+    displayDialog(): Promise<boolean>;
+}
+
+export interface AuthUI3 {
+    waitForDeviceApproval(channels: DeviceApprovalChannel[], isCloud: boolean): Promise<boolean>
+    waitForTwoFactorCode(channels: TwoFactorChannelData[], cancel: Promise<void>): Promise<boolean>
+    getPassword?(): Promise<string | KeyWrapper>
+    getSSOToken?(redirectUrl: string): Promise<Uint8Array>
+    redirectCallback?(url: string): void
+    ssoLogin?(url: string): Promise<any>
+    idpLogout?(url: string): Promise<void>
+}
+
+export type TwoFactorInput = {
+    twoFactorCode: string
+    desiredExpiration: TwoFactorExpiration
+}
+
+export enum DeviceVerificationMethods {
+    Email,
+    KeeperPush,
+    TFA,
+    AdminApproval,
+}
+
+export type DeviceApprovalChannel = {
+    channel: DeviceVerificationMethods
+    sendApprovalRequest: () => Promise<void>
+    validateCode?: (code: string) => Promise<void>
+    setExpiration?: (expiration: TwoFactorExpiration) => void
+}
+
+export type TwoFactorChannelData = {
+    availablePushes?: TwoFactorPushType[],
+    channel: Authentication.ITwoFactorChannelInfo
+    sendPush?: (type: TwoFactorPushType) => void
+    sendCode: (code: string) => void
+    setExpiration: (expiration: TwoFactorExpiration) => void
+}
+
+export type LoginError = {
+    error: string;
+    message: string;
+}