@noy-db/at-azure-keyvault 0.6.0 → 0.7.0-pre.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -6
- package/dist/index.d.ts +8 -8
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -35,14 +35,14 @@ az keyvault set-policy --name my-noydb-vault \
|
|
|
35
35
|
```ts
|
|
36
36
|
// 3. In your app:
|
|
37
37
|
import { createNoydb } from '@noy-db/hub'
|
|
38
|
-
import {
|
|
38
|
+
import { atAzureKeyvault } from '@noy-db/at-azure-keyvault'
|
|
39
39
|
import { shamirRecoveryProvider } from '@noy-db/on-shamir'
|
|
40
40
|
|
|
41
41
|
const db = await createNoydb({
|
|
42
42
|
store,
|
|
43
43
|
user: 'alice',
|
|
44
44
|
secretMode: 'managed',
|
|
45
|
-
sealingKey:
|
|
45
|
+
sealingKey: atAzureKeyvault({
|
|
46
46
|
keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',
|
|
47
47
|
}),
|
|
48
48
|
shamirRecovery: shamirRecoveryProvider(),
|
|
@@ -65,7 +65,7 @@ const vault = await db.openVault('acme')
|
|
|
65
65
|
## When NOT to use this provider
|
|
66
66
|
|
|
67
67
|
- Non-Azure or multi-cloud deployments where adding an Azure dependency is undesirable. Use [`@noy-db/at-env`](../at-env) for a zero-extra-dependency option.
|
|
68
|
-
- Local dev / CI where you don't want real Key Vault calls or Azure credentials in CI. Use [`@noy-db/at-env`](../at-env) or `
|
|
68
|
+
- Local dev / CI where you don't want real Key Vault calls or Azure credentials in CI. Use [`@noy-db/at-env`](../at-env) or `MemorySealer` from `@noy-db/hub` instead.
|
|
69
69
|
|
|
70
70
|
## Key rotation
|
|
71
71
|
|
|
@@ -86,16 +86,16 @@ This is a deliberate migration step — not transparent rotation. Treat it the s
|
|
|
86
86
|
## API
|
|
87
87
|
|
|
88
88
|
```ts
|
|
89
|
-
function
|
|
89
|
+
function atAzureKeyvault(opts: {
|
|
90
90
|
keyId: string // Full key identifier URL
|
|
91
91
|
algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP' // default: 'RSA-OAEP-256'
|
|
92
92
|
cryptographyClient?: CryptoLike // optional pre-built client (useful for tests)
|
|
93
|
-
}):
|
|
93
|
+
}): NoydbSealer
|
|
94
94
|
```
|
|
95
95
|
|
|
96
96
|
Never pass raw Azure credentials in the options — inject a pre-configured `CryptographyClient` for non-default auth. The default builds a `CryptographyClient` with `DefaultAzureCredential`.
|
|
97
97
|
|
|
98
|
-
Returns a [`
|
|
98
|
+
Returns a [`NoydbSealer`](../hub/src/port/at/index.ts) — importable as `@noy-db/hub/at` — the contract `@noy-db/hub`'s managed-secret mode consumes.
|
|
99
99
|
|
|
100
100
|
## License
|
|
101
101
|
|
package/dist/index.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { NoydbSealer } from '@noy-db/hub/at';
|
|
2
2
|
import { RsaEncryptParameters, EncryptResult, RsaDecryptParameters, DecryptResult } from '@azure/keyvault-keys';
|
|
3
3
|
|
|
4
4
|
/**
|
|
@@ -42,14 +42,14 @@ import { RsaEncryptParameters, EncryptResult, RsaDecryptParameters, DecryptResul
|
|
|
42
42
|
* ```ts
|
|
43
43
|
* // 3. In your app:
|
|
44
44
|
* import { createNoydb } from '@noy-db/hub'
|
|
45
|
-
* import {
|
|
45
|
+
* import { atAzureKeyvault } from '@noy-db/at-azure-keyvault'
|
|
46
46
|
* import { shamirRecoveryProvider } from '@noy-db/on-shamir'
|
|
47
47
|
*
|
|
48
48
|
* const db = await createNoydb({
|
|
49
49
|
* store,
|
|
50
50
|
* user: 'alice',
|
|
51
51
|
* secretMode: 'managed',
|
|
52
|
-
* sealingKey:
|
|
52
|
+
* sealingKey: atAzureKeyvault({
|
|
53
53
|
* keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',
|
|
54
54
|
* }),
|
|
55
55
|
* shamirRecovery: shamirRecoveryProvider(),
|
|
@@ -59,12 +59,12 @@ import { RsaEncryptParameters, EncryptResult, RsaDecryptParameters, DecryptResul
|
|
|
59
59
|
* @packageDocumentation
|
|
60
60
|
*/
|
|
61
61
|
|
|
62
|
-
/** Minimal client surface required by {@link
|
|
62
|
+
/** Minimal client surface required by {@link atAzureKeyvault}. */
|
|
63
63
|
interface CryptoLike {
|
|
64
64
|
encrypt(params: RsaEncryptParameters): Promise<EncryptResult>;
|
|
65
65
|
decrypt(params: RsaDecryptParameters): Promise<DecryptResult>;
|
|
66
66
|
}
|
|
67
|
-
/** Options for {@link
|
|
67
|
+
/** Options for {@link atAzureKeyvault}. */
|
|
68
68
|
interface AzureKeyVaultSealingProviderOptions {
|
|
69
69
|
/**
|
|
70
70
|
* Full **versioned** key identifier URL, e.g.
|
|
@@ -87,7 +87,7 @@ interface AzureKeyVaultSealingProviderOptions {
|
|
|
87
87
|
readonly cryptographyClient?: CryptoLike;
|
|
88
88
|
}
|
|
89
89
|
/**
|
|
90
|
-
* Build a {@link
|
|
90
|
+
* Build a {@link NoydbSealer} backed by Azure Key Vault Encrypt / Decrypt.
|
|
91
91
|
*
|
|
92
92
|
* Credentials are resolved via `DefaultAzureCredential` — managed identities
|
|
93
93
|
* on Azure hosts, `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET`
|
|
@@ -99,6 +99,6 @@ interface AzureKeyVaultSealingProviderOptions {
|
|
|
99
99
|
* SDK-response shapes). Any Key Vault API error (Forbidden, NotFound, etc.)
|
|
100
100
|
* propagates as-is.
|
|
101
101
|
*/
|
|
102
|
-
declare function
|
|
102
|
+
declare function atAzureKeyvault(opts: AzureKeyVaultSealingProviderOptions): NoydbSealer;
|
|
103
103
|
|
|
104
|
-
export { type AzureKeyVaultSealingProviderOptions,
|
|
104
|
+
export { type AzureKeyVaultSealingProviderOptions, atAzureKeyvault };
|
package/dist/index.js
CHANGED
|
@@ -3,7 +3,7 @@ import {
|
|
|
3
3
|
CryptographyClient
|
|
4
4
|
} from "@azure/keyvault-keys";
|
|
5
5
|
import { DefaultAzureCredential } from "@azure/identity";
|
|
6
|
-
function
|
|
6
|
+
function atAzureKeyvault(opts) {
|
|
7
7
|
const algorithm = opts.algorithm ?? "RSA-OAEP-256";
|
|
8
8
|
const client = opts.cryptographyClient ?? new CryptographyClient(opts.keyId, new DefaultAzureCredential());
|
|
9
9
|
return {
|
|
@@ -23,6 +23,6 @@ function azureKeyVaultSealingProvider(opts) {
|
|
|
23
23
|
};
|
|
24
24
|
}
|
|
25
25
|
export {
|
|
26
|
-
|
|
26
|
+
atAzureKeyvault
|
|
27
27
|
};
|
|
28
28
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-azure-keyvault** — Azure Key Vault sealing key provider for noy-db\n * managed-secret mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * secret via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is\n * an authenticated Key Vault API call, giving you an Azure Monitor / Key Vault\n * audit-log-backed access record of every time a user's vault is opened —\n * no additional instrumentation required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n * with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on Azure where a Key Vault RSA key costs less\n * than engineering an equivalent audit trail.\n * - Any case where you need an auditable, Azure-native key custody record\n * for every vault open.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a Key Vault and an RSA key (one-time):\n * az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus\n * az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048\n * # Note the full key identifier URL from the output (id field).\n *\n * # 2. Grant the host's managed identity or service principal the\n * # encrypt + decrypt (or wrapKey + unwrapKey) permissions on the key:\n * az keyvault set-policy --name my-noydb-vault \\\n * --object-id <MANAGED_IDENTITY_OBJECT_ID> \\\n * --key-permissions encrypt decrypt\n * # Credentials are resolved automatically via DefaultAzureCredential:\n * # managed identity attached to the Azure host, AZURE_CLIENT_ID /\n * # AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for\n * # local dev.\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import {
|
|
1
|
+
{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-azure-keyvault** — Azure Key Vault sealing key provider for noy-db\n * managed-secret mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * secret via Azure Key Vault Encrypt / Decrypt. Every seal and unseal is\n * an authenticated Key Vault API call, giving you an Azure Monitor / Key Vault\n * audit-log-backed access record of every time a user's vault is opened —\n * no additional instrumentation required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n * with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on Azure where a Key Vault RSA key costs less\n * than engineering an equivalent audit trail.\n * - Any case where you need an auditable, Azure-native key custody record\n * for every vault open.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a Key Vault and an RSA key (one-time):\n * az keyvault create --name my-noydb-vault --resource-group my-rg --location eastus\n * az keyvault key create --vault-name my-noydb-vault --name noydb-sealing --kty RSA --size 2048\n * # Note the full key identifier URL from the output (id field).\n *\n * # 2. Grant the host's managed identity or service principal the\n * # encrypt + decrypt (or wrapKey + unwrapKey) permissions on the key:\n * az keyvault set-policy --name my-noydb-vault \\\n * --object-id <MANAGED_IDENTITY_OBJECT_ID> \\\n * --key-permissions encrypt decrypt\n * # Credentials are resolved automatically via DefaultAzureCredential:\n * # managed identity attached to the Azure host, AZURE_CLIENT_ID /\n * # AZURE_TENANT_ID / AZURE_CLIENT_SECRET env vars, or `az login` for\n * # local dev.\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { atAzureKeyvault } from '@noy-db/at-azure-keyvault'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n * store,\n * user: 'alice',\n * secretMode: 'managed',\n * sealingKey: atAzureKeyvault({\n * keyId: 'https://my-noydb-vault.vault.azure.net/keys/noydb-sealing/<version>',\n * }),\n * shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { NoydbSealer } from '@noy-db/hub/at'\nimport {\n CryptographyClient,\n type EncryptResult,\n type DecryptResult,\n type RsaEncryptParameters,\n type RsaDecryptParameters,\n} from '@azure/keyvault-keys'\nimport { DefaultAzureCredential } from '@azure/identity'\n\n/** Minimal client surface required by {@link atAzureKeyvault}. */\ninterface CryptoLike {\n encrypt(params: RsaEncryptParameters): Promise<EncryptResult>\n decrypt(params: RsaDecryptParameters): Promise<DecryptResult>\n}\n\n/** Options for {@link atAzureKeyvault}. */\nexport interface AzureKeyVaultSealingProviderOptions {\n /**\n * Full **versioned** key identifier URL, e.g.\n * `https://<vault>.vault.azure.net/keys/<name>/<version>`.\n *\n * Azure RSA decrypt is version-bound: the `CryptographyClient` resolves the\n * key version at construction time and every decrypt call is pinned to it.\n * A versionless URL (`.../keys/<name>`) resolves to \"latest\" — if the key\n * auto-rotates, all secrets sealed under the previous version become\n * **permanently undecryptable**. Always pin to an explicit version.\n */\n readonly keyId: string\n /** RSA encryption algorithm. Defaults to `'RSA-OAEP-256'`. */\n readonly algorithm?: 'RSA-OAEP-256' | 'RSA-OAEP'\n /**\n * Optional pre-built CryptographyClient (DI for tests).\n * Default: builds one with `DefaultAzureCredential`.\n * Never pass raw Azure credentials in these options.\n */\n readonly cryptographyClient?: CryptoLike\n}\n\n/**\n * Build a {@link NoydbSealer} backed by Azure Key Vault Encrypt / Decrypt.\n *\n * Credentials are resolved via `DefaultAzureCredential` — managed identities\n * on Azure hosts, `AZURE_CLIENT_ID` / `AZURE_TENANT_ID` / `AZURE_CLIENT_SECRET`\n * env vars, or `az login` for local dev. Never pass raw credentials in the\n * options; inject a pre-configured `CryptographyClient` for non-default auth\n * instead.\n *\n * @throws Error when Key Vault returns no result (guards against unexpected\n * SDK-response shapes). Any Key Vault API error (Forbidden, NotFound, etc.)\n * propagates as-is.\n */\nexport function atAzureKeyvault(opts: AzureKeyVaultSealingProviderOptions): NoydbSealer {\n const algorithm = opts.algorithm ?? 'RSA-OAEP-256'\n const client: CryptoLike = opts.cryptographyClient\n ?? new CryptographyClient(opts.keyId, new DefaultAzureCredential())\n\n return {\n id: `azure-kv:${opts.keyId}`,\n\n async seal(secret) {\n const res = await client.encrypt({ algorithm, plaintext: secret })\n const c = res?.result\n if (!c) throw new Error('@noy-db/at-azure-keyvault: Key Vault encrypt returned no result')\n return c instanceof Uint8Array ? c : new Uint8Array(c)\n },\n\n async unseal(sealed) {\n const res = await client.decrypt({ algorithm, ciphertext: sealed })\n const p = res?.result\n if (!p) throw new Error('@noy-db/at-azure-keyvault: Key Vault decrypt returned no result')\n return p instanceof Uint8Array ? p : new Uint8Array(p)\n },\n }\n}\n"],"mappings":";AA2DA;AAAA,EACE;AAAA,OAKK;AACP,SAAS,8BAA8B;AA4ChC,SAAS,gBAAgB,MAAwD;AACtF,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,SAAqB,KAAK,sBAC3B,IAAI,mBAAmB,KAAK,OAAO,IAAI,uBAAuB,CAAC;AAEpE,SAAO;AAAA,IACL,IAAI,YAAY,KAAK,KAAK;AAAA,IAE1B,MAAM,KAAK,QAAQ;AACjB,YAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,WAAW,WAAW,OAAO,CAAC;AACjE,YAAM,IAAI,KAAK;AACf,UAAI,CAAC,EAAG,OAAM,IAAI,MAAM,iEAAiE;AACzF,aAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC;AAAA,IACvD;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,WAAW,YAAY,OAAO,CAAC;AAClE,YAAM,IAAI,KAAK;AACf,UAAI,CAAC,EAAG,OAAM,IAAI,MAAM,iEAAiE;AACzF,aAAO,aAAa,aAAa,IAAI,IAAI,WAAW,CAAC;AAAA,IACvD;AAAA,EACF;AACF;","names":[]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@noy-db/at-azure-keyvault",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.7.0-pre.0",
|
|
4
4
|
"description": "Azure Key Vault sealing key provider for noy-db managed-secret mode.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "vLannaAi <vicio@lanna.ai>",
|
|
@@ -34,15 +34,15 @@
|
|
|
34
34
|
"peerDependencies": {
|
|
35
35
|
"@azure/keyvault-keys": "^4.0.0",
|
|
36
36
|
"@azure/identity": "^4.0.0",
|
|
37
|
-
"@noy-db/hub": "0.
|
|
37
|
+
"@noy-db/hub": "0.7.0-pre.0"
|
|
38
38
|
},
|
|
39
39
|
"devDependencies": {
|
|
40
40
|
"@types/node": "^22.0.0",
|
|
41
41
|
"@azure/keyvault-keys": "^4.0.0",
|
|
42
42
|
"@azure/identity": "^4.0.0",
|
|
43
|
-
"@noy-db/hub": "0.
|
|
44
|
-
"@noy-db/to-memory": "0.
|
|
45
|
-
"@noy-db/on-shamir": "0.
|
|
43
|
+
"@noy-db/hub": "0.7.0-pre.0",
|
|
44
|
+
"@noy-db/to-memory": "0.7.0-pre.0",
|
|
45
|
+
"@noy-db/on-shamir": "0.7.0-pre.0"
|
|
46
46
|
},
|
|
47
47
|
"keywords": [
|
|
48
48
|
"noy-db",
|