@mp-lb/doctrine-secrets 0.0.0

package/README.md

@@ -0,0 +1,28 @@
+# Doctrine Secrets
+
+Decrypt Doctrine encrypted text files from CI or other Node.js runtimes.
+
+## CLI
+
+Store the external recipient secret in your CI secret manager:
+
+```sh
+doctrine-secrets decrypt secrets.enc.json > secrets.json
+```
+
+The CLI reads the recipient secret from `DOCTRINE_RECIPIENT_SECRET` by default.
+
+```sh
+DOCTRINE_RECIPIENT_SECRET='doctrine-recipient-v1_...' doctrine-secrets decrypt secrets.enc.json
+```
+
+## Library
+
+```ts
+import { decryptDoctrineEncryptedFileText } from "@mp-lb/doctrine-secrets";
+
+const plaintext = await decryptDoctrineEncryptedFileText({
+  encryptedText,
+  recipientSecret: process.env.DOCTRINE_RECIPIENT_SECRET!,
+});
+```

package/dist/base64ToBytes.d.ts

@@ -0,0 +1 @@
+export declare const base64ToBytes: (value: string) => Uint8Array;

package/dist/base64ToBytes.js

@@ -0,0 +1 @@
+export const base64ToBytes = (value) => new Uint8Array(Buffer.from(value, "base64"));

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { runCli } from "./runCli.js";
+runCli(process.argv.slice(2)).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(message);
+    process.exitCode = 1;
+});

package/dist/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const doctrineRecipientSecretPrefix = "doctrine-recipient-v1_";
+export declare const encryptedFileCipher = "AES-GCM";
+export declare const encryptedFileVersion = 2;

package/dist/constants.js

@@ -0,0 +1,3 @@
+export const doctrineRecipientSecretPrefix = "doctrine-recipient-v1_";
+export const encryptedFileCipher = "AES-GCM";
+export const encryptedFileVersion = 2;

package/dist/cryptoTypes.d.ts

@@ -0,0 +1,3 @@
+import type { webcrypto } from "node:crypto";
+export type AesCryptoKey = webcrypto.CryptoKey;
+export type AesKeyUsage = webcrypto.KeyUsage;

package/dist/cryptoTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/decryptBytes.d.ts

@@ -0,0 +1,6 @@
+import type { AesCryptoKey } from "./cryptoTypes";
+export declare const decryptBytes: ({ data, iv, key, }: {
+    data: string;
+    iv: string;
+    key: AesCryptoKey;
+}) => Promise<Uint8Array>;

package/dist/decryptBytes.js

@@ -0,0 +1,3 @@
+import { encryptedFileCipher } from "./constants.js";
+import { base64ToBytes } from "./base64ToBytes.js";
+export const decryptBytes = async ({ data, iv, key, }) => new Uint8Array(await crypto.subtle.decrypt({ iv: base64ToBytes(iv), name: encryptedFileCipher }, key, base64ToBytes(data)));

package/dist/decryptDoctrineEncryptedFile.d.ts

@@ -0,0 +1,2 @@
+import type { DecryptDoctrineEncryptedFileInput } from "./types";
+export declare const decryptDoctrineEncryptedFile: ({ encryptedText, recipientSecret, }: DecryptDoctrineEncryptedFileInput) => Promise<Uint8Array>;

package/dist/decryptDoctrineEncryptedFile.js

@@ -0,0 +1,19 @@
+import { decryptBytes } from "./decryptBytes.js";
+import { importAesKey } from "./importAesKey.js";
+import { importRecipientSecretKey } from "./importRecipientSecretKey.js";
+import { parseDoctrineEncryptedFilePayload } from "./parseDoctrineEncryptedFilePayload.js";
+import { unwrapFileKeyBytes } from "./unwrapFileKeyBytes.js";
+export const decryptDoctrineEncryptedFile = async ({ encryptedText, recipientSecret, }) => {
+    const payload = parseDoctrineEncryptedFilePayload(encryptedText);
+    const recipientKey = await importRecipientSecretKey(recipientSecret);
+    const fileKeyBytes = await unwrapFileKeyBytes({
+        recipientKey,
+        recipients: payload.recipients,
+    });
+    const fileKey = await importAesKey(fileKeyBytes, ["decrypt"]);
+    return decryptBytes({
+        data: payload.data,
+        iv: payload.iv,
+        key: fileKey,
+    });
+};

package/dist/decryptDoctrineEncryptedFileText.d.ts

@@ -0,0 +1,2 @@
+import type { DecryptDoctrineEncryptedFileInput } from "./types";
+export declare const decryptDoctrineEncryptedFileText: (input: DecryptDoctrineEncryptedFileInput) => Promise<string>;

package/dist/decryptDoctrineEncryptedFileText.js

@@ -0,0 +1,3 @@
+import { decryptDoctrineEncryptedFile } from "./decryptDoctrineEncryptedFile.js";
+const textDecoder = new TextDecoder();
+export const decryptDoctrineEncryptedFileText = async (input) => textDecoder.decode(await decryptDoctrineEncryptedFile(input));

package/dist/importAesKey.d.ts

@@ -0,0 +1,2 @@
+import type { AesCryptoKey, AesKeyUsage } from "./cryptoTypes";
+export declare const importAesKey: (bytes: Uint8Array, usages: AesKeyUsage[]) => Promise<AesCryptoKey>;

package/dist/importAesKey.js

@@ -0,0 +1,2 @@
+import { encryptedFileCipher } from "./constants.js";
+export const importAesKey = async (bytes, usages) => crypto.subtle.importKey("raw", bytes, { length: 256, name: encryptedFileCipher }, false, usages);

package/dist/importRecipientSecretKey.d.ts

@@ -0,0 +1,2 @@
+import type { AesCryptoKey } from "./cryptoTypes";
+export declare const importRecipientSecretKey: (recipientSecret: string) => Promise<AesCryptoKey>;

package/dist/importRecipientSecretKey.js

@@ -0,0 +1,9 @@
+import { doctrineRecipientSecretPrefix } from "./constants.js";
+import { base64ToBytes } from "./base64ToBytes.js";
+import { importAesKey } from "./importAesKey.js";
+export const importRecipientSecretKey = async (recipientSecret) => {
+    if (!recipientSecret.startsWith(doctrineRecipientSecretPrefix)) {
+        throw new Error("Unsupported Doctrine recipient secret.");
+    }
+    return importAesKey(base64ToBytes(recipientSecret.slice(doctrineRecipientSecretPrefix.length)), ["decrypt"]);
+};

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { doctrineRecipientSecretPrefix, encryptedFileCipher, encryptedFileVersion, } from "./constants";
+export { decryptDoctrineEncryptedFile } from "./decryptDoctrineEncryptedFile";
+export { decryptDoctrineEncryptedFileText } from "./decryptDoctrineEncryptedFileText";
+export { parseDoctrineEncryptedFilePayload } from "./parseDoctrineEncryptedFilePayload";
+export type { DecryptDoctrineEncryptedFileInput, DoctrineEncryptedFilePayload, DoctrineEncryptedRecipient, DoctrineEncryptedValue, } from "./types";

package/dist/index.js

@@ -0,0 +1,4 @@
+export { doctrineRecipientSecretPrefix, encryptedFileCipher, encryptedFileVersion, } from "./constants.js";
+export { decryptDoctrineEncryptedFile } from "./decryptDoctrineEncryptedFile.js";
+export { decryptDoctrineEncryptedFileText } from "./decryptDoctrineEncryptedFileText.js";
+export { parseDoctrineEncryptedFilePayload } from "./parseDoctrineEncryptedFilePayload.js";

package/dist/parseDoctrineEncryptedFilePayload.d.ts

@@ -0,0 +1,2 @@
+import type { DoctrineEncryptedFilePayload } from "./types";
+export declare const parseDoctrineEncryptedFilePayload: (encryptedText: string) => DoctrineEncryptedFilePayload;

package/dist/parseDoctrineEncryptedFilePayload.js

@@ -0,0 +1,12 @@
+import { encryptedFileCipher, encryptedFileVersion } from "./constants.js";
+export const parseDoctrineEncryptedFilePayload = (encryptedText) => {
+    const parsed = JSON.parse(encryptedText);
+    if (parsed.doctrineEncryptedFile !== encryptedFileVersion ||
+        parsed.cipher !== encryptedFileCipher ||
+        typeof parsed.data !== "string" ||
+        typeof parsed.iv !== "string" ||
+        !Array.isArray(parsed.recipients)) {
+        throw new Error("Unsupported Doctrine encrypted file format.");
+    }
+    return parsed;
+};

package/dist/readEncryptedFile.d.ts

@@ -0,0 +1 @@
+export declare const readEncryptedFile: (filePath: string) => Promise<string>;

package/dist/readEncryptedFile.js

@@ -0,0 +1,2 @@
+import { readFile } from "node:fs/promises";
+export const readEncryptedFile = async (filePath) => readFile(filePath, "utf8");

package/dist/readRecipientSecretFromEnv.d.ts

@@ -0,0 +1 @@
+export declare const readRecipientSecretFromEnv: () => string;

package/dist/readRecipientSecretFromEnv.js

@@ -0,0 +1,7 @@
+export const readRecipientSecretFromEnv = () => {
+    const recipientSecret = process.env.DOCTRINE_RECIPIENT_SECRET;
+    if (!recipientSecret) {
+        throw new Error("DOCTRINE_RECIPIENT_SECRET is required.");
+    }
+    return recipientSecret;
+};

package/dist/runCli.d.ts

@@ -0,0 +1 @@
+export declare const runCli: (args: string[]) => Promise<void>;

package/dist/runCli.js

@@ -0,0 +1,19 @@
+import { decryptDoctrineEncryptedFileText } from "./decryptDoctrineEncryptedFileText.js";
+import { readEncryptedFile } from "./readEncryptedFile.js";
+import { readRecipientSecretFromEnv } from "./readRecipientSecretFromEnv.js";
+import { usage } from "./usage.js";
+export const runCli = async (args) => {
+    const [command, filePath] = args;
+    if (command === "--help" || command === "-h") {
+        process.stdout.write(usage);
+        return;
+    }
+    if (command !== "decrypt" || !filePath) {
+        throw new Error(usage);
+    }
+    const plaintext = await decryptDoctrineEncryptedFileText({
+        encryptedText: await readEncryptedFile(filePath),
+        recipientSecret: readRecipientSecretFromEnv(),
+    });
+    process.stdout.write(plaintext);
+};

package/dist/types.d.ts

@@ -0,0 +1,22 @@
+import type { encryptedFileCipher, encryptedFileVersion } from "./constants";
+export type DoctrineEncryptedValue = {
+    cipher: typeof encryptedFileCipher;
+    data: string;
+    iv: string;
+};
+export type DoctrineEncryptedRecipient = {
+    label?: string;
+    recipientId: string;
+    wrappedDataKey: DoctrineEncryptedValue;
+};
+export type DoctrineEncryptedFilePayload = {
+    cipher: typeof encryptedFileCipher;
+    data: string;
+    doctrineEncryptedFile: typeof encryptedFileVersion;
+    iv: string;
+    recipients: DoctrineEncryptedRecipient[];
+};
+export type DecryptDoctrineEncryptedFileInput = {
+    encryptedText: string;
+    recipientSecret: string;
+};

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/unwrapFileKeyBytes.d.ts

@@ -0,0 +1,6 @@
+import type { DoctrineEncryptedRecipient } from "./types";
+import type { AesCryptoKey } from "./cryptoTypes";
+export declare const unwrapFileKeyBytes: ({ recipientKey, recipients, }: {
+    recipientKey: AesCryptoKey;
+    recipients: DoctrineEncryptedRecipient[];
+}) => Promise<Uint8Array>;

package/dist/unwrapFileKeyBytes.js

@@ -0,0 +1,16 @@
+import { decryptBytes } from "./decryptBytes.js";
+export const unwrapFileKeyBytes = async ({ recipientKey, recipients, }) => {
+    for (const recipient of recipients) {
+        try {
+            return await decryptBytes({
+                data: recipient.wrappedDataKey.data,
+                iv: recipient.wrappedDataKey.iv,
+                key: recipientKey,
+            });
+        }
+        catch {
+            // Only one recipient should match a given external recipient secret.
+        }
+    }
+    throw new Error("No recipient matched the Doctrine recipient secret.");
+};

package/dist/usage.d.ts

@@ -0,0 +1 @@
+export declare const usage = "Doctrine Secrets\n\nUsage:\n  doctrine-secrets decrypt <secrets.enc.json>\n\nEnvironment:\n  DOCTRINE_RECIPIENT_SECRET  External recipient secret for the encrypted file\n";

package/dist/usage.js

@@ -0,0 +1,8 @@
+export const usage = `Doctrine Secrets
+
+Usage:
+  doctrine-secrets decrypt <secrets.enc.json>
+
+Environment:
+  DOCTRINE_RECIPIENT_SECRET  External recipient secret for the encrypted file
+`;

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@mp-lb/doctrine-secrets",
+  "version": "0.0.0",
+  "private": false,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mp-lb/hyperstore.git",
+    "directory": "packages/doctrine-secrets"
+  },
+  "bin": {
+    "doctrine-secrets": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "package.json"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc --project tsconfig.build.json && node scripts/fix-esm-imports.mjs && chmod +x dist/cli.js",
+    "dev": "tsc --watch --project tsconfig.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}