@noy-db/at-gcp-kms 0.4.0-pre.4 → 0.4.0-pre.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -6
- package/dist/index.d.ts +3 -3
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/package.json +7 -7
package/README.md
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
# @noy-db/at-gcp-kms
|
|
2
2
|
|
|
3
|
-
**Google Cloud KMS sealing key provider for noy-db [managed-
|
|
3
|
+
**Google Cloud KMS sealing key provider for noy-db [managed-secret mode](https://github.com/vLannaAi/noy-db/issues/14).**
|
|
4
4
|
|
|
5
|
-
An `at-*` provider that seals and unseals the hub-generated random
|
|
5
|
+
An `at-*` provider that seals and unseals the hub-generated random secret via Google Cloud KMS Encrypt / Decrypt. Every seal and unseal is an authenticated KMS API call — giving you a Cloud Audit Logs-backed access log of every time a user's vault is opened, with no additional instrumentation required.
|
|
6
6
|
|
|
7
7
|
Like all `at-*` providers, this is a *trusted host* provider: the host you deploy it on CAN decrypt what it unseals. The security boundary is your GCP IAM policy — access is controlled by which service accounts hold `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the KMS key, not by a secret the host keeps in memory.
|
|
8
8
|
|
|
@@ -45,7 +45,7 @@ import { shamirRecoveryProvider } from '@noy-db/on-shamir'
|
|
|
45
45
|
const db = await createNoydb({
|
|
46
46
|
store,
|
|
47
47
|
user: 'alice',
|
|
48
|
-
|
|
48
|
+
secretMode: 'managed',
|
|
49
49
|
sealingKey: gcpKmsSealingProvider({
|
|
50
50
|
keyName: 'projects/my-project/locations/global/keyRings/noy-db-ring/cryptoKeys/noy-db-sealing',
|
|
51
51
|
}),
|
|
@@ -54,7 +54,7 @@ const db = await createNoydb({
|
|
|
54
54
|
|
|
55
55
|
const vault = await db.openVault('acme')
|
|
56
56
|
// Hub generated a 256-bit random on first open, sealed it via KMS Encrypt,
|
|
57
|
-
// and persisted to _meta/sealed-
|
|
57
|
+
// and persisted to _meta/sealed-secret. The user never sees a secret.
|
|
58
58
|
// On reopen, at-gcp-kms calls KMS Decrypt transparently.
|
|
59
59
|
// Cloud Audit Logs record every Encrypt/Decrypt call with caller identity + key resource name.
|
|
60
60
|
```
|
|
@@ -72,7 +72,7 @@ const vault = await db.openVault('acme')
|
|
|
72
72
|
|
|
73
73
|
## Key rotation
|
|
74
74
|
|
|
75
|
-
Cloud KMS supports automatic key version rotation for symmetric keys. Enable it on the crypto key and KMS handles the rest — your `keyName` stays the same, no app changes needed. Cross-key migration (moving sealed
|
|
75
|
+
Cloud KMS supports automatic key version rotation for symmetric keys. Enable it on the crypto key and KMS handles the rest — your `keyName` stays the same, no app changes needed. Cross-key migration (moving sealed secrets to a different key) requires manual re-sealing with `unseal` + `seal` under the new key.
|
|
76
76
|
|
|
77
77
|
## API
|
|
78
78
|
|
|
@@ -85,7 +85,7 @@ function gcpKmsSealingProvider(opts: {
|
|
|
85
85
|
|
|
86
86
|
Never pass raw GCP credentials in the options — inject a pre-configured `KeyManagementServiceClient` for non-default auth. The default `new KeyManagementServiceClient()` resolves credentials via Application Default Credentials.
|
|
87
87
|
|
|
88
|
-
Returns a [`SealingKeyProvider`](../hub/src/team/managed-
|
|
88
|
+
Returns a [`SealingKeyProvider`](../hub/src/team/managed-secret.ts) — the contract `@noy-db/hub`'s managed-secret mode consumes.
|
|
89
89
|
|
|
90
90
|
## License
|
|
91
91
|
|
package/dist/index.d.ts
CHANGED
|
@@ -3,10 +3,10 @@ import { protos } from '@google-cloud/kms';
|
|
|
3
3
|
|
|
4
4
|
/**
|
|
5
5
|
* **@noy-db/at-gcp-kms** — Google Cloud KMS sealing key provider for noy-db
|
|
6
|
-
* managed-
|
|
6
|
+
* managed-secret mode.
|
|
7
7
|
*
|
|
8
8
|
* An `at-*` provider that seals and unseals the hub-generated random
|
|
9
|
-
*
|
|
9
|
+
* secret via Google Cloud KMS Encrypt / Decrypt. Every seal and unseal is
|
|
10
10
|
* an authenticated KMS API call, giving you a Cloud Audit Logs-backed access
|
|
11
11
|
* log of every time a user's vault is opened — no additional instrumentation
|
|
12
12
|
* required.
|
|
@@ -51,7 +51,7 @@ import { protos } from '@google-cloud/kms';
|
|
|
51
51
|
* const db = await createNoydb({
|
|
52
52
|
* store,
|
|
53
53
|
* user: 'alice',
|
|
54
|
-
*
|
|
54
|
+
* secretMode: 'managed',
|
|
55
55
|
* sealingKey: gcpKmsSealingProvider({
|
|
56
56
|
* keyName: 'projects/my-project/locations/global/keyRings/noy-db-ring/cryptoKeys/noy-db-sealing',
|
|
57
57
|
* }),
|
package/dist/index.js
CHANGED
|
@@ -9,8 +9,8 @@ function gcpKmsSealingProvider(opts) {
|
|
|
9
9
|
const client = opts.client ?? new KeyManagementServiceClient();
|
|
10
10
|
return {
|
|
11
11
|
id: `gcp-kms:${opts.keyName}`,
|
|
12
|
-
async seal(
|
|
13
|
-
const [resp] = await client.encrypt({ name: opts.keyName, plaintext:
|
|
12
|
+
async seal(secret) {
|
|
13
|
+
const [resp] = await client.encrypt({ name: opts.keyName, plaintext: secret });
|
|
14
14
|
const blob = toUint8Array(resp?.ciphertext);
|
|
15
15
|
if (!blob) throw new Error("@noy-db/at-gcp-kms: KMS encrypt returned no ciphertext");
|
|
16
16
|
return blob;
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-gcp-kms** — Google Cloud KMS sealing key provider for noy-db\n * managed-
|
|
1
|
+
{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-gcp-kms** — Google Cloud KMS sealing key provider for noy-db\n * managed-secret mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * secret via Google Cloud KMS Encrypt / Decrypt. Every seal and unseal is\n * an authenticated KMS API call, giving you a Cloud Audit Logs-backed access\n * log of every time a user's vault is opened — no additional instrumentation\n * required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n * with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on GCP where a Cloud KMS key costs less than\n * engineering an equivalent audit trail.\n * - Any case where you want automatic key rotation without rotating your\n * app's sealing key material manually.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a key ring and symmetric crypto key once:\n * gcloud kms keyrings create noy-db-ring --location global\n * gcloud kms keys create noy-db-sealing \\\n * --location global \\\n * --keyring noy-db-ring \\\n * --purpose encryption\n * # Note the full resource name from the output.\n *\n * # 2. Grant your host's service account the Cloud KMS CryptoKey Encrypter/Decrypter role:\n * gcloud kms keys add-iam-policy-binding noy-db-sealing \\\n * --location global \\\n * --keyring noy-db-ring \\\n * --member serviceAccount:HOST_SA@PROJECT.iam.gserviceaccount.com \\\n * --role roles/cloudkms.cryptoKeyEncrypterDecrypter\n * # Credentials are picked up automatically via Application Default Credentials\n * # (ADC): service account attached to GCE/GKE, GOOGLE_APPLICATION_CREDENTIALS\n * # env var, or `gcloud auth application-default login` for local dev.\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { gcpKmsSealingProvider } from '@noy-db/at-gcp-kms'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n * store,\n * user: 'alice',\n * secretMode: 'managed',\n * sealingKey: gcpKmsSealingProvider({\n * keyName: 'projects/my-project/locations/global/keyRings/noy-db-ring/cryptoKeys/noy-db-sealing',\n * }),\n * shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider } from '@noy-db/hub'\nimport { KeyManagementServiceClient } from '@google-cloud/kms'\nimport type { protos } from '@google-cloud/kms'\n\ntype IEncryptRequest = protos.google.cloud.kms.v1.IEncryptRequest\ntype IDecryptRequest = protos.google.cloud.kms.v1.IDecryptRequest\ntype IEncryptResponse = protos.google.cloud.kms.v1.IEncryptResponse\ntype IDecryptResponse = protos.google.cloud.kms.v1.IDecryptResponse\n\n/** Minimal client surface required by {@link gcpKmsSealingProvider}. */\ninterface KmsClientLike {\n encrypt(request: IEncryptRequest): Promise<[IEncryptResponse, IEncryptRequest | undefined, unknown]>\n decrypt(request: IDecryptRequest): Promise<[IDecryptResponse, IDecryptRequest | undefined, unknown]>\n}\n\n/** Options for {@link gcpKmsSealingProvider}. */\nexport interface GcpKmsSealingProviderOptions {\n /**\n * Full crypto-key resource name, e.g.\n * `projects/PROJECT/locations/LOCATION/keyRings/RING/cryptoKeys/KEY`.\n */\n readonly keyName: string\n /** Optional pre-built client (DI for tests). Default: `new KeyManagementServiceClient()` (ambient ADC). */\n readonly client?: KmsClientLike\n}\n\nfunction toUint8Array(value: Uint8Array | string | null | undefined): Uint8Array | undefined {\n if (value == null) return undefined\n if (value instanceof Uint8Array) return value\n // protobuf may return a base64 string in some environments\n return Buffer.from(value, 'base64')\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by Google Cloud KMS Encrypt / Decrypt.\n *\n * Credentials are resolved via Application Default Credentials (ADC) — attached\n * service accounts, `GOOGLE_APPLICATION_CREDENTIALS`, or local gcloud login.\n * Never pass raw credentials in the options; inject a pre-configured client for\n * non-default auth instead.\n *\n * @throws Error when KMS returns no ciphertext or no plaintext (guards\n * against unexpected SDK-response shapes).\n * Any KMS API error (PermissionDenied, NotFound, etc.) propagates as-is.\n */\nexport function gcpKmsSealingProvider(opts: GcpKmsSealingProviderOptions): SealingKeyProvider {\n const client: KmsClientLike = opts.client ?? new KeyManagementServiceClient()\n return {\n id: `gcp-kms:${opts.keyName}`,\n\n async seal(secret) {\n const [resp] = await client.encrypt({ name: opts.keyName, plaintext: secret })\n const blob = toUint8Array(resp?.ciphertext)\n if (!blob) throw new Error('@noy-db/at-gcp-kms: KMS encrypt returned no ciphertext')\n return blob\n },\n\n async unseal(sealed) {\n const [resp] = await client.decrypt({ name: opts.keyName, ciphertext: sealed })\n const pt = toUint8Array(resp?.plaintext)\n if (!pt) throw new Error('@noy-db/at-gcp-kms: KMS decrypt returned no plaintext')\n return pt\n },\n }\n}\n"],"mappings":";AA8DA,SAAS,kCAAkC;AAyB3C,SAAS,aAAa,OAAuE;AAC3F,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,WAAY,QAAO;AAExC,SAAO,OAAO,KAAK,OAAO,QAAQ;AACpC;AAcO,SAAS,sBAAsB,MAAwD;AAC5F,QAAM,SAAwB,KAAK,UAAU,IAAI,2BAA2B;AAC5E,SAAO;AAAA,IACL,IAAI,WAAW,KAAK,OAAO;AAAA,IAE3B,MAAM,KAAK,QAAQ;AACjB,YAAM,CAAC,IAAI,IAAI,MAAM,OAAO,QAAQ,EAAE,MAAM,KAAK,SAAS,WAAW,OAAO,CAAC;AAC7E,YAAM,OAAO,aAAa,MAAM,UAAU;AAC1C,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,wDAAwD;AACnF,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,CAAC,IAAI,IAAI,MAAM,OAAO,QAAQ,EAAE,MAAM,KAAK,SAAS,YAAY,OAAO,CAAC;AAC9E,YAAM,KAAK,aAAa,MAAM,SAAS;AACvC,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,uDAAuD;AAChF,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@noy-db/at-gcp-kms",
|
|
3
|
-
"version": "0.4.0-pre.
|
|
4
|
-
"description": "Google Cloud KMS sealing key provider for noy-db managed-
|
|
3
|
+
"version": "0.4.0-pre.6",
|
|
4
|
+
"description": "Google Cloud KMS sealing key provider for noy-db managed-secret mode.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "vLannaAi <vicio@lanna.ai>",
|
|
7
7
|
"homepage": "https://github.com/vLannaAi/noy-db/tree/main/packages/at-gcp-kms#readme",
|
|
@@ -33,14 +33,14 @@
|
|
|
33
33
|
},
|
|
34
34
|
"peerDependencies": {
|
|
35
35
|
"@google-cloud/kms": "^4.0.0",
|
|
36
|
-
"@noy-db/hub": "0.4.0-pre.
|
|
36
|
+
"@noy-db/hub": "0.4.0-pre.6"
|
|
37
37
|
},
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"@types/node": "^22.0.0",
|
|
40
40
|
"@google-cloud/kms": "^4.0.0",
|
|
41
|
-
"@noy-db/
|
|
42
|
-
"@noy-db/
|
|
43
|
-
"@noy-db/
|
|
41
|
+
"@noy-db/on-shamir": "0.4.0-pre.6",
|
|
42
|
+
"@noy-db/to-memory": "0.4.0-pre.6",
|
|
43
|
+
"@noy-db/hub": "0.4.0-pre.6"
|
|
44
44
|
},
|
|
45
45
|
"keywords": [
|
|
46
46
|
"noy-db",
|
|
@@ -48,7 +48,7 @@
|
|
|
48
48
|
"gcp-kms",
|
|
49
49
|
"kms",
|
|
50
50
|
"sealing-key-provider",
|
|
51
|
-
"managed-
|
|
51
|
+
"managed-secret",
|
|
52
52
|
"encryption",
|
|
53
53
|
"zero-knowledge"
|
|
54
54
|
],
|