@kokuin/browser 0.1.0

package/README.md

@@ -0,0 +1,7 @@
+# @kokuin/browser
+
+## Installation
+
+```sh
+npm install @kokuin/browser
+```

package/lib/entry.d.ts

@@ -0,0 +1,11 @@
+import type { KeyEntry } from '@kokuin/token';
+export type GetStore = (mode?: IDBTransactionMode) => IDBObjectStore;
+export declare class BrowserKeyEntry implements KeyEntry<CryptoKeyPair> {
+    #private;
+    constructor(keyID: string, getStore: GetStore);
+    get keyID(): string;
+    getAsync(): Promise<CryptoKeyPair | null>;
+    setAsync(keyPair: CryptoKeyPair): Promise<void>;
+    provideAsync(): Promise<CryptoKeyPair>;
+    removeAsync(): Promise<void>;
+}

package/lib/entry.js

@@ -0,0 +1,42 @@
+import { randomKeyPair } from './utils.js';
+export class BrowserKeyEntry {
+    #getStore;
+    #keyID;
+    constructor(keyID, getStore){
+        this.#getStore = getStore;
+        this.#keyID = keyID;
+    }
+    get keyID() {
+        return this.#keyID;
+    }
+    getAsync() {
+        return new Promise((resolve, reject)=>{
+            const request = this.#getStore().get(this.#keyID);
+            request.onerror = ()=>reject(request.error);
+            request.onsuccess = ()=>resolve(request.result ?? null);
+        });
+    }
+    setAsync(keyPair) {
+        return new Promise((resolve, reject)=>{
+            const request = this.#getStore('readwrite').put(keyPair, this.#keyID);
+            request.onerror = ()=>reject(request.error);
+            request.onsuccess = ()=>resolve();
+        });
+    }
+    async provideAsync() {
+        const existing = await this.getAsync();
+        if (existing != null) {
+            return existing;
+        }
+        const keyPair = await randomKeyPair();
+        await this.setAsync(keyPair);
+        return keyPair;
+    }
+    removeAsync() {
+        return new Promise((resolve, reject)=>{
+            const request = this.#getStore('readwrite').delete(this.#keyID);
+            request.onerror = ()=>reject(request.error);
+            request.onsuccess = ()=>resolve();
+        });
+    }
+}

package/lib/identity.d.ts

@@ -0,0 +1,3 @@
+import { type SigningIdentity } from '@kokuin/token';
+import { BrowserKeyStore } from './store.js';
+export declare function provideSigningIdentity(keyID: string, useStore?: BrowserKeyStore | Promise<BrowserKeyStore> | string): Promise<SigningIdentity>;

package/lib/identity.js

@@ -0,0 +1,72 @@
+import { CODECS, getDID } from '@kokuin/token';
+import { b64uFromJSON, fromUTF, toB64U } from '@sozai/codec';
+import { getLogger } from '@sozai/log';
+import { AttributeKeys, createTracer, SpanNames, withSpan } from '@sozai/otel';
+import { BrowserKeyStore } from './store.js';
+import { getPublicKey } from './utils.js';
+const tracer = createTracer('keystore.browser');
+const logger = getLogger([
+    'kokuin',
+    'browser'
+]);
+async function createBrowserSigningIdentity(keyPair) {
+    const publicKey = await getPublicKey(keyPair);
+    const id = getDID(CODECS.ES256, publicKey);
+    async function signToken(payload, options = {}) {
+        if (payload.iss != null && payload.iss !== id) {
+            throw new Error('Invalid payload: issuer does not match signer');
+        }
+        const fullHeader = {
+            ...options.header ?? {},
+            typ: 'JWT',
+            alg: 'ES256'
+        };
+        const fullPayload = {
+            ...payload,
+            iss: id
+        };
+        const data = `${b64uFromJSON(fullHeader)}.${b64uFromJSON(fullPayload)}`;
+        const messageBytes = fromUTF(data);
+        const signatureBuffer = await globalThis.crypto.subtle.sign({
+            name: 'ECDSA',
+            hash: 'SHA-256'
+        }, keyPair.privateKey, messageBytes.buffer);
+        return {
+            header: fullHeader,
+            payload: fullPayload,
+            signature: toB64U(new Uint8Array(signatureBuffer)),
+            data
+        };
+    }
+    return {
+        id,
+        publicKey,
+        signToken
+    };
+}
+export async function provideSigningIdentity(keyID, useStore) {
+    return withSpan(tracer, SpanNames.KEYSTORE_GET_OR_CREATE, {
+        attributes: {
+            [AttributeKeys.KEYSTORE_STORE_TYPE]: 'browser'
+        }
+    }, async (span)=>{
+        const storePromise = useStore == null || typeof useStore === 'string' ? BrowserKeyStore.open(useStore) : Promise.resolve(useStore);
+        const store = await storePromise;
+        const entry = store.entry(keyID);
+        const existing = await entry.getAsync();
+        if (existing != null) {
+            const identity = await createBrowserSigningIdentity(existing);
+            span.setAttribute(AttributeKeys.AUTH_DID, identity.id);
+            span.setAttribute(AttributeKeys.KEYSTORE_KEY_CREATED, false);
+            return identity;
+        }
+        const keyPair = await entry.provideAsync();
+        const identity = await createBrowserSigningIdentity(keyPair);
+        span.setAttribute(AttributeKeys.AUTH_DID, identity.id);
+        span.setAttribute(AttributeKeys.KEYSTORE_KEY_CREATED, true);
+        logger.info('New identity generated: {did}', {
+            did: identity.id
+        });
+        return identity;
+    });
+}

package/lib/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Key store for browser.
+ *
+ * ## Installation
+ *
+ * ```sh
+ * npm install @kokuin/browser
+ * ```
+ *
+ * @module browser-keystore
+ */
+export { BrowserKeyEntry } from './entry.js';
+export { provideSigningIdentity } from './identity.js';
+export { BrowserKeyStore } from './store.js';
+export { getPublicKey, randomKeyPair } from './utils.js';

package/lib/index.js

@@ -0,0 +1,14 @@
+/**
+ * Key store for browser.
+ *
+ * ## Installation
+ *
+ * ```sh
+ * npm install @kokuin/browser
+ * ```
+ *
+ * @module browser-keystore
+ */ export { BrowserKeyEntry } from './entry.js';
+export { provideSigningIdentity } from './identity.js';
+export { BrowserKeyStore } from './store.js';
+export { getPublicKey, randomKeyPair } from './utils.js';

package/lib/store.d.ts

@@ -0,0 +1,8 @@
+import type { KeyStore } from '@kokuin/token';
+import { BrowserKeyEntry } from './entry.js';
+export declare class BrowserKeyStore implements KeyStore<CryptoKeyPair, BrowserKeyEntry> {
+    #private;
+    static open(name?: string): Promise<BrowserKeyStore>;
+    constructor(db: IDBDatabase);
+    entry(keyID: string): BrowserKeyEntry;
+}

package/lib/store.js

@@ -0,0 +1,45 @@
+import { defer } from '@sozai/async';
+import { BrowserKeyEntry } from './entry.js';
+const DEFAULT_DB_NAME = 'kokuin:key-store';
+const STORE_NAME = 'keys';
+function createGetStore(db) {
+    return function getStore(mode = 'readonly') {
+        return db.transaction(STORE_NAME, mode).objectStore(STORE_NAME);
+    };
+}
+export class BrowserKeyStore {
+    static #byName = {};
+    static open(name = DEFAULT_DB_NAME) {
+        const existing = BrowserKeyStore.#byName[name];
+        if (existing != null) {
+            return existing;
+        }
+        const { promise, reject, resolve } = defer();
+        BrowserKeyStore.#byName[name] = promise;
+        if (typeof globalThis.crypto.subtle === 'undefined') {
+            reject(new Error('Unable to open KeyStore: SubtleCrypto is not available'));
+            return promise;
+        }
+        if (typeof globalThis.indexedDB === 'undefined') {
+            reject(new Error('Unable to open KeyStore: IndexedDB is not available'));
+            return promise;
+        }
+        const request = indexedDB.open(name, 1);
+        request.onerror = ()=>reject(request.error);
+        request.onsuccess = ()=>resolve(new BrowserKeyStore(request.result));
+        request.onupgradeneeded = (event)=>{
+            ;
+            event.target.result.createObjectStore(STORE_NAME);
+        };
+        return promise;
+    }
+    #entries = {};
+    #getStore;
+    constructor(db){
+        this.#getStore = createGetStore(db);
+    }
+    entry(keyID) {
+        this.#entries[keyID] ??= new BrowserKeyEntry(keyID, this.#getStore);
+        return this.#entries[keyID];
+    }
+}

package/lib/utils.d.ts

@@ -0,0 +1,2 @@
+export declare function getPublicKey(keyPair: CryptoKeyPair): Promise<Uint8Array>;
+export declare function randomKeyPair(): Promise<CryptoKeyPair>;

package/lib/utils.js

@@ -0,0 +1,18 @@
+function ecPointCompress(x, y) {
+    const out = new Uint8Array(x.length + 1);
+    out[0] = 2 + (y[y.length - 1] & 1);
+    out.set(x, 1);
+    return out;
+}
+export async function getPublicKey(keyPair) {
+    const rawKey = await globalThis.crypto.subtle.exportKey('raw', keyPair.publicKey);
+    return ecPointCompress(new Uint8Array(rawKey.slice(1, 33)), new Uint8Array(rawKey.slice(33, 65)));
+}
+export async function randomKeyPair() {
+    return await globalThis.crypto.subtle.generateKey({
+        name: 'ECDSA',
+        namedCurve: 'P-256'
+    }, false, [
+        'sign'
+    ]);
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@kokuin/browser",
+  "version": "0.1.0",
+  "license": "MIT",
+  "description": "Key store for browser",
+  "keywords": [
+    "cryptography",
+    "key-management",
+    "browser",
+    "storage"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TairuFramework/kokuin",
+    "directory": "packages/browser"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib/*"
+  ],
+  "sideEffects": false,
+  "dependencies": {
+    "@sozai/async": "^0.1.0",
+    "@sozai/codec": "^0.1.0",
+    "@sozai/log": "^0.1.0",
+    "@sozai/otel": "^0.1.0",
+    "@kokuin/token": "^0.1.0"
+  },
+  "scripts": {
+    "build:clean": "del lib",
+    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
+    "test:types": "tsc --noEmit --skipLibCheck -p tsconfig.test.json",
+    "test:unit": "vitest run",
+    "test": "pnpm run test:types && pnpm run test:unit"
+  }
+}