@lifeready/core 1.0.0 → 1.0.1

package/src/lib/api/key-exchange.types.ts

@@ -0,0 +1,235 @@
+import { Key } from '../cryptography/cryptography.types';
+import { AccessLevel } from '../category/category.types';
+import { JWK } from 'node-jose';
+import { ContactCardName, TrustedPartyDetails } from '../users/profile.types';
+
+// Will be encrypted using the root key of the initiator
+export interface PlainInitiatorRootKeyCipher {
+  nonce: string;
+  oneTimePrk: object; // onetime public encryption key responder use to send data back to initiator
+  otKey: object;
+  initiatorContactCard?: {
+    // Owner only access to this data
+    plainOwnerCipherDataJson: any;
+    // Shared read access between owner and receiver. Only the owner has write access.
+    plainSharedCipherDataJson: any;
+  };
+  initiator: {
+    message?: KeyExchangeMessage;
+    contactCard?: {
+      // Shared read access between owner and receiver. Only the owner has write access.
+      plainSharedCipherDataJson: TrustedPartyDetails;
+    };
+  };
+}
+
+export interface SharedContactCardInput {
+  plainCipherDataJson?: any;
+  plainSharedCipherDataJson?: any;
+  sharedCipherKey?: object;
+}
+
+export interface PreparedPermissions {
+  categories?: { categoryId: string; accessLevel: AccessLevel }[];
+  records?: { recordId: string; accessLevel: AccessLevel }[];
+}
+
+export interface KeyExchangeMessage {
+  name?: string;
+  email?: string;
+  message?: string;
+  permissions?: PreparedPermissions;
+}
+
+export interface PlainOtKeyCipher {
+  nonce: string;
+  initiator: {
+    oneTimePbk: object; // onetime public encryption key responder use to send data back to initiator
+    pbk: object; // public encryption key
+    sigPbk: object; // public signing key
+    profile?: {
+      username?: string;
+    };
+    message?: KeyExchangeMessage;
+    contactCard?: {
+      // Shared read access between owner and receiver. Only the owner has write access.
+      plainSharedCipherDataJson: TrustedPartyDetails;
+    };
+  };
+}
+
+export interface DecryptedOtk {
+  plainOtKeyCipher: PlainOtKeyCipher;
+  otKey: JWK.Key; // The one-time key
+}
+
+export interface PlainInitiatorOneTimePbkCipher {
+  nonce: string;
+  sharedKey: object;
+  mkSharedKey: object;
+  responder: {
+    pbk: object;
+    sigPbk: object;
+    profile?: {
+      username?: string;
+    };
+    message?: KeyExchangeMessage;
+    contactCard?: {
+      plainSharedCipherDataJson: TrustedPartyDetails;
+      // Note that this is _not_ the same key as the sharedKey. The sharedKey wraps
+      // this key in the key graph. But because this key has not been entered into
+      // the key graph then the responder calls the API, we pass the JWK directly here.
+      sharedCipherKey: object;
+    };
+  };
+}
+
+export enum OtkState {
+  OTK_INITIATED = 'OTK_INITIATED',
+  OTK_ACCEPTED = 'OTK_ACCEPTED',
+  OTK_COMPLETED = 'OTK_COMPLETED',
+}
+
+export interface KeyExchangeContactCardInput {
+  // Accessible by the server and initiator. Server side notification emails need to know some
+  // information about the initiator.
+  ownerPlainData?: {
+    name: ContactCardName;
+  };
+  // Owner only access to this data
+  plainOwnerCipherDataJson: any;
+  // Shared read access between owner and receiver. Only the owner has write access.
+  plainSharedCipherDataJson: TrustedPartyDetails;
+}
+
+export interface InitiateOtkInput {
+  email?: string;
+  message?: KeyExchangeMessage;
+  contactCard?: KeyExchangeContactCardInput;
+  upgrade?: boolean;
+}
+
+export interface RespondOtkInput {
+  id: string;
+  token: string;
+  decryptedOtk: DecryptedOtk;
+  message?: KeyExchangeMessage;
+  initiatorContactCard?: {
+    plainReceiverCipherDataJson: any;
+  };
+  responderContactCard?: KeyExchangeContactCardInput;
+}
+
+export enum KeyExchangeState {
+  IN_PROGRESS = 'IN_PROGRESS',
+  COMPLETED = 'COMPLETED',
+  DECLINED = 'DECLINED',
+  CANCELLED = 'CANCELLED',
+}
+
+export enum KeyExchangeMode {
+  OTK = 'OTK',
+}
+
+export interface Otk {
+  id: string;
+  state: OtkState;
+  otKeyParams: string;
+  otKeyCipher: string;
+  sharedKey: Key;
+  mkSharedKey: Key;
+  initiatorSigPxk: Key;
+  responderSigPxk: Key;
+  // Encrypted
+  initiatorOneTimePbkCipher: string; // single time use public key created by the initiator.
+  responderPbkCipher?: string; // responderPbk is the long lived Pbk of the responder.
+}
+
+export interface KeyExchange {
+  id: string;
+  state: KeyExchangeState;
+  mode: KeyExchangeMode;
+  created: string;
+  modified: string;
+  isInitiator: boolean;
+  initiator: {
+    id: string;
+    username: string;
+  };
+  responder: {
+    id: string;
+    username: string;
+  };
+  initiatorActionRequired?: boolean;
+  responderActionRequired?: boolean;
+  responderEmailAddress?: string;
+  token?: string;
+  tokenExpiryTime?: string;
+  isExpired?: boolean;
+  otk?: Otk;
+  initiatorRootKeyCipher: string;
+}
+
+export interface DecryptedKeyExchange extends KeyExchange {
+  decryptedOtk?: DecryptedOtk;
+  message?: KeyExchangeMessage;
+  contactCard?: TrustedPartyDetails;
+  myMessage?: KeyExchangeMessage;
+  myContactCard?: TrustedPartyDetails;
+}
+
+export interface GetKeyExchangeOptions {
+  // The otKey as a raw string. i.e. key.toJSON(true).k
+  otKeyK?: string;
+  // User need the token if they have not responded to the key exchange yet.
+  // Once they've responded (hence proven they have the OOB Key) they become
+  // the "responder" of this exchange, and can access it when signed in.
+  token?: string;
+}
+
+export interface RespondOtk {
+  keyExchange: KeyExchange;
+  userSharedKey: UserSharedKey;
+  tp: {
+    id: string;
+  };
+}
+
+export interface CompleteOtk {
+  keyExchange: KeyExchange;
+  userSharedKey: UserSharedKey;
+  tp: {
+    id: string;
+  };
+}
+
+export interface UserSharedKey {
+  userSigPrk: Key;
+  sharedKey: Key;
+  mkSharedKey?: Key;
+  mkPxk?: Key;
+  mkReshareRequestCipher?: string;
+  mkReshareResponseCipher?: string;
+  mkReshareRequestSent?: boolean;
+  mkReshareResponseSent?: boolean;
+}
+
+export interface GetKeyExchangeListOptions {
+  orderBy?:
+    | 'created'
+    | '-created'
+    | 'modified'
+    | '-modified'
+    | 'expiry_time'
+    | '-expiry_time';
+  isExpired?: boolean;
+  initiatorActionRequired?: boolean;
+  responderActionRequired?: boolean;
+  initiator?: string;
+  responder?: string;
+  state?: 'IN_PROGRESS' | 'COMPLETED' | 'DECLINED' | 'CANCELLED';
+}
+
+export interface PlainResponderPbkCipher {
+  otKey: object;
+}

package/src/lib/api/key-exchange2.gql.ts

@@ -0,0 +1,310 @@
+import gql from 'graphql-tag';
+import { JWK } from 'node-jose';
+import { gqlTyped } from '../_common/ast';
+import {
+  Connection,
+  DateTime,
+  ID,
+  LrEmail,
+  OtKeyCipherClearJson2,
+} from './types';
+
+export type KeyExchangeState2 =
+  | 'IN_PROGRESS'
+  | 'COMPLETED'
+  | 'DECLINED'
+  | 'CANCELLED'
+  | 'DELETED';
+
+export interface KeyExchangeFragment {
+  id: ID;
+  token: string;
+  state: KeyExchangeState2;
+  mode: 'OTK';
+  isInitiator: boolean;
+  initiator: {
+    id: ID;
+    username: string;
+  };
+  responder: {
+    id: ID;
+    username: string;
+  };
+  created: DateTime;
+  modified: DateTime;
+  tokenExpiryTime: DateTime;
+  isExpired: boolean;
+  initiatorRootKeyCipher: string;
+  initiatorRootKeyCipherClearJson: any;
+  initiatorActionRequired: boolean;
+  responderActionRequired: boolean;
+  responderEmailAddress: LrEmail;
+  otk: {
+    state: 'OTK_INITIATED' | 'OTK_ACCEPTED' | 'OTK_COMPLETED';
+    otKeyParams: string;
+    otKeyCipher: string;
+    otKey?: JWK.Key;
+    otKeyCipherClearJson?: OtKeyCipherClearJson2;
+    sharedKey: {
+      id: ID;
+    };
+    mkSharedKey: {
+      id: ID;
+    };
+    initiatorSigPxk: {
+      id: ID;
+    };
+    responderSigPxk: {
+      id: ID;
+    };
+    initiatorOneTimePbkCipher: string;
+    initiatorOneTimePbkCipherClearJson: any;
+    responderPbkCipher: string;
+  };
+}
+export const KeyExchangeFragment = gqlTyped<KeyExchangeFragment>`
+fragment KeyExchangeFragment on KeyExchangeNode {
+  id
+  token
+  state
+  mode
+  isInitiator
+  initiator {
+    id
+    username
+  }
+  responder {
+    id
+    username
+  }
+  created
+  modified
+  tokenExpiryTime
+  isExpired
+  initiatorRootKeyCipher
+  initiatorActionRequired
+  responderActionRequired
+  responderEmailAddress
+  otk {
+    state
+    otKeyParams
+    otKeyCipher
+    sharedKey {
+      id
+    }
+    mkSharedKey {
+      id
+    }
+    initiatorSigPxk {
+      id
+    }
+    responderSigPxk {
+      id
+    }
+    initiatorOneTimePbkCipher
+    responderPbkCipher
+  }
+}
+`;
+
+export interface UserSharedKeyFragment {
+  userSigPrk: {
+    id: ID;
+  };
+  otherSigPbk: {
+    id: ID;
+  };
+  sharedKey: {
+    id: ID;
+  };
+  mkSharedKey: {
+    id: ID;
+  };
+}
+export const UserSharedKeyFragment = gqlTyped<UserSharedKeyFragment>`
+fragment UserSharedKeyFragment on UserSharedKeyNode {
+  userSigPrk {
+    id
+  }
+  otherSigPbk {
+    id
+  }
+  sharedKey {
+    id
+  }
+  mkSharedKey {
+    id
+  }
+}`;
+
+export interface KeyExchangesQuery2 {
+  keyExchanges: Connection<KeyExchangeFragment>;
+}
+export const KeyExchangesQuery2 = gqlTyped<KeyExchangesQuery2>`
+query KeyExchangesQuery2($state: String) {
+  keyExchanges(state: $state) {
+    edges {
+      node {
+        ...KeyExchangeFragment
+      }
+    }
+  }
+}
+${KeyExchangeFragment}
+`;
+
+export interface KeyExchangeQuery2 {
+  keyExchange: KeyExchangeFragment;
+}
+export const KeyExchangeQuery2 = gqlTyped<KeyExchangeQuery2>`
+query KeyExchangeQuery2($id: LrRelayIdInput!) {
+  keyExchange(id: $id) {
+    ...KeyExchangeFragment
+  }
+}
+${KeyExchangeFragment}
+`;
+
+// Key graph is only available for authenticated users. This query
+// is for unauthenticated users.
+export interface KeyExchangeTokenQuery2 {
+  keyExchange: KeyExchangeFragment;
+}
+export const KeyExchangeTokenQuery2 = gqlTyped<KeyExchangeTokenQuery2>`
+query KeyExchangeTokenQuery2($id: LrRelayIdInput!, $token: String) {
+  keyExchange(id: $id, token: $token) {
+    ...KeyExchangeFragment
+  }
+}
+${KeyExchangeFragment}
+`;
+
+export interface CancelKeyExchangeMutation {
+  cancelKeyExchange: {
+    keyExchange: {
+      id: ID;
+    };
+  };
+}
+export const CancelKeyExchangeMutation = gqlTyped<CancelKeyExchangeMutation>`
+mutation CancelKeyExchangeMutation($input: CancelKeyExchangeInput!) {
+  cancelKeyExchange(input: $input) {
+    keyExchange {
+      id
+    }
+  }
+}
+`;
+
+export interface DeclineKeyExchangeMutation {
+  declineKeyExchange: {
+    keyExchange: {
+      id: ID;
+    };
+  };
+}
+export const DeclineKeyExchangeMutation = gqlTyped<DeclineKeyExchangeMutation>`
+mutation DeclineKeyExchangeMutation($input: DeclineKeyExchangeInput!) {
+  declineKeyExchange(input: $input) {
+    keyExchange {
+      id
+    }
+  }
+}
+`;
+
+export interface InitiateKeyExchangeOtkMutation {
+  initiateKeyExchangeOtk: {
+    keyExchange: KeyExchangeFragment;
+  };
+}
+export const InitiateKeyExchangeOtkMutation = gqlTyped<InitiateKeyExchangeOtkMutation>`
+mutation InitiateKeyExchangeOtkMutation(
+  $input: InitiateKeyExchangeOtkInput!
+) {
+  initiateKeyExchangeOtk(input: $input) {
+    keyExchange {
+      ...KeyExchangeFragment
+    }
+  }
+}
+${KeyExchangeFragment}
+`;
+
+export interface RespondKeyExchangeOtkMutation {
+  respondKeyExchangeOtk: {
+    keyExchange: KeyExchangeFragment;
+    userSharedKey: UserSharedKeyFragment;
+    tp: {
+      id: ID;
+    };
+  };
+}
+export const RespondKeyExchangeOtkMutation = gqlTyped<RespondKeyExchangeOtkMutation>`
+mutation RespondKeyExchangeOtkMutation($input: RespondKeyExchangeOtkInput!) {
+  respondKeyExchangeOtk(input: $input) {
+    keyExchange {
+      ...KeyExchangeFragment
+    }
+    userSharedKey {
+      ...UserSharedKeyFragment
+    }
+    tp {
+      id
+    }
+  }
+}
+${KeyExchangeFragment}
+${UserSharedKeyFragment}
+`;
+
+export interface CompleteKeyExchangeOtkMutation {
+  completeKeyExchangeOtk: {
+    keyExchange: KeyExchangeFragment;
+    userSharedKey: UserSharedKeyFragment;
+    tp: {
+      id: ID;
+    };
+  };
+}
+export const CompleteKeyExchangeOtkMutation = gqlTyped<CompleteKeyExchangeOtkMutation>`
+mutation CompleteKeyExchangeOtkMutation(
+  $input: CompleteKeyExchangeOtkInput!
+) {
+  completeKeyExchangeOtk(input: $input) {
+    keyExchange {
+      ...KeyExchangeFragment
+    }
+    userSharedKey {
+      ...UserSharedKeyFragment
+    }
+    tp {
+      id
+    }
+  }
+}
+${KeyExchangeFragment}
+${UserSharedKeyFragment}
+`;
+
+export interface CurrentUserSharedKeyQuery2 {
+  currentUserSharedKey: {
+    userSharedKey: UserSharedKeyFragment;
+  };
+}
+export const CurrentUserSharedKeyQuery2 = gqlTyped<CurrentUserSharedKeyQuery2>`
+query CurrentUserSharedKeyQuery2(
+  $username: String
+  $userId: LrRelayIdInput
+) {
+  currentUserSharedKey(
+    username: $username
+    userId: $userId
+  ) {
+    userSharedKey {
+      ...UserSharedKeyFragment
+    }
+  }
+}
+${UserSharedKeyFragment}
+`;