@opengovsg/formsg-sdk 0.10.0 → 0.12.0-alpha.1

package/.github/workflows/ci.yml

@@ -6,13 +6,13 @@ on:
 jobs:
   build:
     name: build
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
       - name: Use Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: '10.x'
+          node-version: 18
       - name: Cache Node.js modules
         uses: actions/cache@v2
         with:
@@ -27,13 +27,13 @@ jobs:
       - run: npm run build
   test:
     name: test
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
       - name: Use Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: '10.x'
+          node-version: 18
       - name: Cache Node.js modules
         uses: actions/cache@v2
         with:
@@ -45,6 +45,8 @@ jobs:
             ${{ runner.OS }}-
       - run: npm ci
       - run: npm run test-ci
+        env:
+          NODE_OPTIONS: '--max-old-space-size=8192'
       - name: Submit test coverage to Coveralls
         uses: coverallsapp/github-action@v1.1.2
         with:

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Open Government Products
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -7,6 +7,10 @@ _Please note that this is an SDK for webhooks integration, and_ **_not_** _the F
 
 This SDK provides convenient utilities for verifying FormSG webhooks and decrypting submissions in JavaScript and Node.js.
 
+Not using Javascript? Check out our sister SDKs:
+- [formsg-python-sdk](https://github.com/opengovsg/formsg-python-sdk)
+- [formsg-ruby-sdk](https://github.com/opengovsg/formsg-ruby-sdk)
+
 ## Installation
 
 Install the package with
@@ -132,7 +136,7 @@ of the returned object.
 Note that due to end-to-end encryption, FormSG servers are unable to verify the data format.
 
 However, the `decrypt` function exposed by this library [validates](https://github.com/opengovsg/formsg-javascript-sdk/blob/master/src/util/validate.ts) the decrypted content and will **return `null` if the
-decrypted content does not fit the schema displayed below.**
+decrypted content does not contain all of the fields displayed in the schema below.**
 
 | Key         | Type     | Description                                                                                              |
 | ----------- | -------- | -------------------------------------------------------------------------------------------------------- |
@@ -142,6 +146,9 @@ decrypted content does not fit the schema displayed below.**
 | fieldType   | string   | The type of field for the question.                                                                      |
 | \_id        | string   | A unique identifier of the form field. WARNING: Changes when new fields are created/removed in the form. |
 
+**Important Note: **
+Additional internal fields may be included in webhooks from time to time, which will then be published as part of our official schema once it is stable for public consumption. If you are applying your own validation, you should account for this e.g. by not rejecting the webhook if there are additional fields included.
+
 The full schema can be viewed in
 [`validate.ts`](https://github.com/opengovsg/formsg-javascript-sdk/tree/master/src/util/validate.ts).
 

package/dist/crypto-base.d.ts

@@ -0,0 +1,25 @@
+import { EncryptedFileContent } from './types';
+export default class CryptoBase {
+    /**
+     * Generates a new keypair for encryption.
+     * @returns The generated keypair.
+     */
+    generate: () => import("./types").Keypair;
+    /**
+     * Encrypt given binary file with a unique keypair for each submission.
+     * @param binary The file to encrypt, should be a blob that is converted to Uint8Array binary
+     * @param publicKey The base-64 encoded public key
+     * @returns Promise holding the encrypted file
+     * @throws error if any of the encrypt methods fail
+     */
+    encryptFile: (binary: Uint8Array, publicKey: string) => Promise<EncryptedFileContent>;
+    /**
+     * Decrypt the given encrypted file content.
+     * @param secretKey Secret key as a base-64 string
+     * @param encrypted Object returned from encryptFile function
+     * @param encrypted.submissionPublicKey The file's public key as a base-64 string
+     * @param encrypted.nonce The nonce as a base-64 string
+     * @param encrypted.blob The encrypted file as a Blob object
+     */
+    decryptFile: (secretKey: string, { submissionPublicKey: filePublicKey, nonce, binary: encryptedBinary, }: EncryptedFileContent) => Promise<Uint8Array | null>;
+}

package/dist/crypto-base.js

@@ -0,0 +1,93 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var tweetnacl_1 = __importDefault(require("tweetnacl"));
+var tweetnacl_util_1 = require("tweetnacl-util");
+var crypto_1 = require("./util/crypto");
+var CryptoBase = /** @class */ (function () {
+    function CryptoBase() {
+        var _this = this;
+        /**
+         * Generates a new keypair for encryption.
+         * @returns The generated keypair.
+         */
+        this.generate = crypto_1.generateKeypair;
+        /**
+         * Encrypt given binary file with a unique keypair for each submission.
+         * @param binary The file to encrypt, should be a blob that is converted to Uint8Array binary
+         * @param publicKey The base-64 encoded public key
+         * @returns Promise holding the encrypted file
+         * @throws error if any of the encrypt methods fail
+         */
+        this.encryptFile = function (binary, publicKey) { return __awaiter(_this, void 0, void 0, function () {
+            var fileKeypair, nonce;
+            return __generator(this, function (_a) {
+                fileKeypair = this.generate();
+                nonce = tweetnacl_1.default.randomBytes(24);
+                return [2 /*return*/, {
+                        //! NOTE: submissionPublicKey here is a misnomer as a new keypair is generated per file.
+                        // The naming is only retained for backward-compatibility purposes.
+                        submissionPublicKey: fileKeypair.publicKey,
+                        nonce: (0, tweetnacl_util_1.encodeBase64)(nonce),
+                        binary: tweetnacl_1.default.box(binary, nonce, (0, tweetnacl_util_1.decodeBase64)(publicKey), (0, tweetnacl_util_1.decodeBase64)(fileKeypair.secretKey)),
+                    }];
+            });
+        }); };
+        /**
+         * Decrypt the given encrypted file content.
+         * @param secretKey Secret key as a base-64 string
+         * @param encrypted Object returned from encryptFile function
+         * @param encrypted.submissionPublicKey The file's public key as a base-64 string
+         * @param encrypted.nonce The nonce as a base-64 string
+         * @param encrypted.blob The encrypted file as a Blob object
+         */
+        this.decryptFile = function (secretKey, _a) {
+            var filePublicKey = _a.submissionPublicKey, nonce = _a.nonce, encryptedBinary = _a.binary;
+            return __awaiter(_this, void 0, void 0, function () {
+                return __generator(this, function (_b) {
+                    return [2 /*return*/, tweetnacl_1.default.box.open(encryptedBinary, (0, tweetnacl_util_1.decodeBase64)(nonce), (0, tweetnacl_util_1.decodeBase64)(filePublicKey), (0, tweetnacl_util_1.decodeBase64)(secretKey))];
+                });
+            });
+        };
+    }
+    return CryptoBase;
+}());
+exports.default = CryptoBase;

package/dist/crypto-v3.d.ts

@@ -0,0 +1,37 @@
+import CryptoBase from './crypto-base';
+import { DecryptedContentV3, DecryptParams, DecryptParamsV3, EncryptedContentV3 } from './types';
+export default class CryptoV3 extends CryptoBase {
+    constructor();
+    /**
+     * Encrypt input with a unique keypair for each submission.
+     * @param msg The message to encrypt, will be stringified.
+     * @param form The base-64 encoded form public key for encrypting.
+     * @returns The encrypted basestring.
+     */
+    encrypt: (msg: any, formPublicKey: string) => EncryptedContentV3;
+    /**
+     * Decrypts an encrypted submission and returns it.
+     * @param submissionSecretKey The base-64 encoded secret key for decrypting.
+     * @param decryptParams The params containing encrypted content and information.
+     * @param decryptParams.encryptedContent The encrypted content encoded with base-64.
+     * @param decryptParams.version The version of the payload.
+     * @returns The decrypted content if successful. Else, null will be returned.
+     */
+    decryptFromSubmissionKey: (submissionSecretKey: string, decryptParams: DecryptParams) => DecryptedContentV3 | null;
+    /**
+     * Decrypts an encrypted submission and returns it.
+     * @param formSecretKey The base-64 encoded form secret key for decrypting the submission.
+     * @param decryptParams The params containing encrypted content, encrypted submission key and information.
+     * @param decryptParams.encryptedContent The encrypted content encoded with base-64.
+     * @param decryptParams.encryptedSubmissionSecretKey The encrypted submission secret key encoded with base-64.
+     * @param decryptParams.version The version of the payload. Used to determine the decryption process to decrypt the content with.
+     * @returns The decrypted content if successful. Else, null will be returned.
+     */
+    decrypt: (formSecretKey: string, decryptParams: DecryptParamsV3) => DecryptedContentV3 | null;
+    /**
+     * Returns true if a pair of public & secret keys are associated with each other
+     * @param publicKey The public key to verify against.
+     * @param secretKey The private key to verify against.
+     */
+    valid: (publicKey: string, secretKey: string) => boolean;
+}

package/dist/crypto-v3.js

@@ -0,0 +1,134 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var tweetnacl_util_1 = require("tweetnacl-util");
+var crypto_1 = require("./util/crypto");
+var validate_1 = require("./util/validate");
+var crypto_base_1 = __importDefault(require("./crypto-base"));
+var CryptoV3 = /** @class */ (function (_super) {
+    __extends(CryptoV3, _super);
+    function CryptoV3() {
+        var _this = _super.call(this) || this;
+        /**
+         * Encrypt input with a unique keypair for each submission.
+         * @param msg The message to encrypt, will be stringified.
+         * @param form The base-64 encoded form public key for encrypting.
+         * @returns The encrypted basestring.
+         */
+        _this.encrypt = function (msg, formPublicKey) {
+            var submissionKeypair = (0, crypto_1.generateKeypair)();
+            var encryptedSubmissionSecretKey = (0, crypto_1.encryptMessage)((0, tweetnacl_util_1.decodeBase64)(submissionKeypair.secretKey), formPublicKey);
+            var processedMsg = (0, tweetnacl_util_1.decodeUTF8)(JSON.stringify(msg));
+            var encryptedContent = (0, crypto_1.encryptMessage)(processedMsg, submissionKeypair.publicKey);
+            return {
+                submissionPublicKey: submissionKeypair.publicKey,
+                submissionSecretKey: submissionKeypair.secretKey,
+                encryptedContent: encryptedContent,
+                encryptedSubmissionSecretKey: encryptedSubmissionSecretKey,
+            };
+        };
+        /**
+         * Decrypts an encrypted submission and returns it.
+         * @param submissionSecretKey The base-64 encoded secret key for decrypting.
+         * @param decryptParams The params containing encrypted content and information.
+         * @param decryptParams.encryptedContent The encrypted content encoded with base-64.
+         * @param decryptParams.version The version of the payload.
+         * @returns The decrypted content if successful. Else, null will be returned.
+         */
+        _this.decryptFromSubmissionKey = function (submissionSecretKey, decryptParams) {
+            try {
+                var encryptedContent = decryptParams.encryptedContent;
+                // Do not return the transformed object in `_decrypt` function as a signed
+                // object is not encoded in UTF8 and is encoded in Base-64 instead.
+                var decryptedContent = (0, crypto_1.decryptContent)(submissionSecretKey, encryptedContent);
+                if (!decryptedContent) {
+                    throw new Error('Failed to decrypt content');
+                }
+                var decryptedObject = JSON.parse((0, tweetnacl_util_1.encodeUTF8)(decryptedContent));
+                if (!(0, validate_1.determineIsFormFieldsV3)(decryptedObject)) {
+                    throw new Error('Decrypted object does not fit expected shape');
+                }
+                var returnedObject = {
+                    submissionSecretKey: submissionSecretKey,
+                    responses: decryptedObject,
+                };
+                return returnedObject;
+            }
+            catch (err) {
+                return null;
+            }
+        };
+        /**
+         * Decrypts an encrypted submission and returns it.
+         * @param formSecretKey The base-64 encoded form secret key for decrypting the submission.
+         * @param decryptParams The params containing encrypted content, encrypted submission key and information.
+         * @param decryptParams.encryptedContent The encrypted content encoded with base-64.
+         * @param decryptParams.encryptedSubmissionSecretKey The encrypted submission secret key encoded with base-64.
+         * @param decryptParams.version The version of the payload. Used to determine the decryption process to decrypt the content with.
+         * @returns The decrypted content if successful. Else, null will be returned.
+         */
+        _this.decrypt = function (formSecretKey, decryptParams) {
+            var encryptedSubmissionSecretKey = decryptParams.encryptedSubmissionSecretKey, rest = __rest(decryptParams, ["encryptedSubmissionSecretKey"]);
+            var submissionSecretKey = (0, crypto_1.decryptContent)(formSecretKey, encryptedSubmissionSecretKey);
+            if (submissionSecretKey === null)
+                return null;
+            return _this.decryptFromSubmissionKey((0, tweetnacl_util_1.encodeBase64)(submissionSecretKey), rest);
+        };
+        /**
+         * Returns true if a pair of public & secret keys are associated with each other
+         * @param publicKey The public key to verify against.
+         * @param secretKey The private key to verify against.
+         */
+        _this.valid = function (publicKey, secretKey) {
+            var _a;
+            var testResponse = {};
+            var internalValidationVersion = 3;
+            var cipherResponse = _this.encrypt(testResponse, publicKey);
+            // Use toString here since the return should be an empty array.
+            return (testResponse.toString() ===
+                ((_a = _this.decrypt(secretKey, __assign(__assign({}, cipherResponse), { version: internalValidationVersion }))) === null || _a === void 0 ? void 0 : _a.responses.toString()));
+        };
+        return _this;
+    }
+    return CryptoV3;
+}(crypto_base_1.default));
+exports.default = CryptoV3;

package/dist/crypto.d.ts

@@ -1,5 +1,6 @@
-import { DecryptedContent, DecryptedContentAndAttachments, DecryptParams, EncryptedFileContent } from './types';
-export default class Crypto {
+import CryptoBase from './crypto-base';
+import { DecryptedContent, DecryptedContentAndAttachments, DecryptParams, EncryptedContent } from './types';
+export default class Crypto extends CryptoBase {
     signingPublicKey?: string;
     constructor({ signingPublicKey }?: {
         signingPublicKey?: string;
@@ -11,7 +12,7 @@ export default class Crypto {
      * @param signingPrivateKey Optional. Must be a base-64 encoded private key. If given, will be used to signing the given msg param prior to encrypting.
      * @returns The encrypted basestring.
      */
-    encrypt: (msg: any, encryptionPublicKey: string, signingPrivateKey?: string | undefined) => string;
+    encrypt: (msg: any, encryptionPublicKey: string, signingPrivateKey?: string) => EncryptedContent;
     /**
      * Decrypts an encrypted submission and returns it.
      * @param formSecretKey The base-64 secret key of the form to decrypt with.
@@ -23,34 +24,12 @@ export default class Crypto {
      * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
      */
     decrypt: (formSecretKey: string, decryptParams: DecryptParams) => DecryptedContent | null;
-    /**
-     * Generates a new keypair for encryption.
-     * @returns The generated keypair.
-     */
-    generate: () => import("./types").Keypair;
     /**
      * Returns true if a pair of public & secret keys are associated with each other
      * @param publicKey The public key to verify against.
      * @param secretKey The private key to verify against.
      */
     valid: (publicKey: string, secretKey: string) => boolean;
-    /**
-     * Encrypt given binary file with a unique keypair for each submission.
-     * @param binary The file to encrypt, should be a blob that is converted to Uint8Array binary
-     * @param formPublicKey The base-64 encoded public key
-     * @returns Promise holding the encrypted file
-     * @throws error if any of the encrypt methods fail
-     */
-    encryptFile: (binary: Uint8Array, formPublicKey: string) => Promise<EncryptedFileContent>;
-    /**
-     * Decrypt the given encrypted file content.
-     * @param formSecretKey Secret key as a base-64 string
-     * @param encrypted Object returned from encryptFile function
-     * @param encrypted.submissionPublicKey The submission public key as a base-64 string
-     * @param encrypted.nonce The nonce as a base-64 string
-     * @param encrypted.blob The encrypted file as a Blob object
-     */
-    decryptFile: (formSecretKey: string, { submissionPublicKey, nonce, binary: encryptedBinary, }: EncryptedFileContent) => Promise<Uint8Array | null>;
     /**
      * Decrypts an encrypted submission, and also download and decrypt any attachments alongside it.
      * @param formSecretKey Secret key as a base-64 string

package/dist/crypto.js

@@ -1,4 +1,19 @@
 "use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -14,7 +29,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     function verb(n) { return function (v) { return step([n, v]); }; }
     function step(op) {
         if (f) throw new TypeError("Generator is already executing.");
-        while (_) try {
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
             if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
             if (y = 0, t) op = [op[0] & 2, t.value];
             switch (op[0]) {
@@ -44,11 +59,13 @@ var tweetnacl_1 = __importDefault(require("tweetnacl"));
 var tweetnacl_util_1 = require("tweetnacl-util");
 var crypto_1 = require("./util/crypto");
 var validate_1 = require("./util/validate");
+var crypto_base_1 = __importDefault(require("./crypto-base"));
 var errors_1 = require("./errors");
-var Crypto = /** @class */ (function () {
+var Crypto = /** @class */ (function (_super) {
+    __extends(Crypto, _super);
     function Crypto(_a) {
-        var _this = this;
-        var signingPublicKey = (_a === void 0 ? {} : _a).signingPublicKey;
+        var _b = _a === void 0 ? {} : _a, signingPublicKey = _b.signingPublicKey;
+        var _this = _super.call(this) || this;
         /**
          * Encrypt input with a unique keypair for each submission
          * @param encryptionPublicKey The base-64 encoded public key for encrypting.
@@ -56,12 +73,12 @@ var Crypto = /** @class */ (function () {
          * @param signingPrivateKey Optional. Must be a base-64 encoded private key. If given, will be used to signing the given msg param prior to encrypting.
          * @returns The encrypted basestring.
          */
-        this.encrypt = function (msg, encryptionPublicKey, signingPrivateKey) {
-            var processedMsg = tweetnacl_util_1.decodeUTF8(JSON.stringify(msg));
+        _this.encrypt = function (msg, encryptionPublicKey, signingPrivateKey) {
+            var processedMsg = (0, tweetnacl_util_1.decodeUTF8)(JSON.stringify(msg));
             if (signingPrivateKey) {
-                processedMsg = tweetnacl_1.default.sign(processedMsg, tweetnacl_util_1.decodeBase64(signingPrivateKey));
+                processedMsg = tweetnacl_1.default.sign(processedMsg, (0, tweetnacl_util_1.decodeBase64)(signingPrivateKey));
             }
-            return crypto_1.encryptMessage(processedMsg, encryptionPublicKey);
+            return (0, crypto_1.encryptMessage)(processedMsg, encryptionPublicKey);
         };
         /**
          * Decrypts an encrypted submission and returns it.
@@ -73,17 +90,17 @@ var Crypto = /** @class */ (function () {
          * @returns The decrypted content if successful. Else, null will be returned.
          * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
          */
-        this.decrypt = function (formSecretKey, decryptParams) {
+        _this.decrypt = function (formSecretKey, decryptParams) {
             try {
                 var encryptedContent = decryptParams.encryptedContent, verifiedContent = decryptParams.verifiedContent;
                 // Do not return the transformed object in `_decrypt` function as a signed
                 // object is not encoded in UTF8 and is encoded in Base-64 instead.
-                var decryptedContent = crypto_1.decryptContent(formSecretKey, encryptedContent);
+                var decryptedContent = (0, crypto_1.decryptContent)(formSecretKey, encryptedContent);
                 if (!decryptedContent) {
                     throw new Error('Failed to decrypt content');
                 }
-                var decryptedObject = JSON.parse(tweetnacl_util_1.encodeUTF8(decryptedContent));
-                if (!validate_1.determineIsFormFields(decryptedObject)) {
+                var decryptedObject = JSON.parse((0, tweetnacl_util_1.encodeUTF8)(decryptedContent));
+                if (!(0, validate_1.determineIsFormFields)(decryptedObject)) {
                     throw new Error('Decrypted object does not fit expected shape');
                 }
                 var returnedObject = {
@@ -96,12 +113,12 @@ var Crypto = /** @class */ (function () {
                     // Only care if it is the correct shape if verifiedContent exists, since
                     // we need to append it to the end.
                     // Decrypted message must be able to be authenticated by the public key.
-                    var decryptedVerifiedContent = crypto_1.decryptContent(formSecretKey, verifiedContent);
+                    var decryptedVerifiedContent = (0, crypto_1.decryptContent)(formSecretKey, verifiedContent);
                     if (!decryptedVerifiedContent) {
                         // Returns null if decrypting verified content failed.
                         throw new Error('Failed to decrypt verified content');
                     }
-                    var decryptedVerifiedObject = crypto_1.verifySignedMessage(decryptedVerifiedContent, _this.signingPublicKey);
+                    var decryptedVerifiedObject = (0, crypto_1.verifySignedMessage)(decryptedVerifiedContent, _this.signingPublicKey);
                     returnedObject.verified = decryptedVerifiedObject;
                 }
                 return returnedObject;
@@ -116,61 +133,22 @@ var Crypto = /** @class */ (function () {
                 return null;
             }
         };
-        /**
-         * Generates a new keypair for encryption.
-         * @returns The generated keypair.
-         */
-        this.generate = crypto_1.generateKeypair;
         /**
          * Returns true if a pair of public & secret keys are associated with each other
          * @param publicKey The public key to verify against.
          * @param secretKey The private key to verify against.
          */
-        this.valid = function (publicKey, secretKey) {
+        _this.valid = function (publicKey, secretKey) {
             var _a;
             var testResponse = [];
             var internalValidationVersion = 1;
             var cipherResponse = _this.encrypt(testResponse, publicKey);
             // Use toString here since the return should be an empty array.
-            return (testResponse.toString() === ((_a = _this.decrypt(secretKey, {
-                encryptedContent: cipherResponse,
-                version: internalValidationVersion,
-            })) === null || _a === void 0 ? void 0 : _a.responses.toString()));
-        };
-        /**
-         * Encrypt given binary file with a unique keypair for each submission.
-         * @param binary The file to encrypt, should be a blob that is converted to Uint8Array binary
-         * @param formPublicKey The base-64 encoded public key
-         * @returns Promise holding the encrypted file
-         * @throws error if any of the encrypt methods fail
-         */
-        this.encryptFile = function (binary, formPublicKey) { return __awaiter(_this, void 0, void 0, function () {
-            var submissionKeypair, nonce;
-            return __generator(this, function (_a) {
-                submissionKeypair = this.generate();
-                nonce = tweetnacl_1.default.randomBytes(24);
-                return [2 /*return*/, {
-                        submissionPublicKey: submissionKeypair.publicKey,
-                        nonce: tweetnacl_util_1.encodeBase64(nonce),
-                        binary: tweetnacl_1.default.box(binary, nonce, tweetnacl_util_1.decodeBase64(formPublicKey), tweetnacl_util_1.decodeBase64(submissionKeypair.secretKey)),
-                    }];
-            });
-        }); };
-        /**
-         * Decrypt the given encrypted file content.
-         * @param formSecretKey Secret key as a base-64 string
-         * @param encrypted Object returned from encryptFile function
-         * @param encrypted.submissionPublicKey The submission public key as a base-64 string
-         * @param encrypted.nonce The nonce as a base-64 string
-         * @param encrypted.blob The encrypted file as a Blob object
-         */
-        this.decryptFile = function (formSecretKey, _a) {
-            var submissionPublicKey = _a.submissionPublicKey, nonce = _a.nonce, encryptedBinary = _a.binary;
-            return __awaiter(_this, void 0, void 0, function () {
-                return __generator(this, function (_b) {
-                    return [2 /*return*/, tweetnacl_1.default.box.open(encryptedBinary, tweetnacl_util_1.decodeBase64(nonce), tweetnacl_util_1.decodeBase64(submissionPublicKey), tweetnacl_util_1.decodeBase64(formSecretKey))];
-                });
-            });
+            return (testResponse.toString() ===
+                ((_a = _this.decrypt(secretKey, {
+                    encryptedContent: cipherResponse,
+                    version: internalValidationVersion,
+                })) === null || _a === void 0 ? void 0 : _a.responses.toString()));
         };
         /**
          * Decrypts an encrypted submission, and also download and decrypt any attachments alongside it.
@@ -179,7 +157,7 @@ var Crypto = /** @class */ (function () {
          * @returns A promise of the decrypted submission, including attachments (if any). Or else returns null if a decryption error decrypting any part of the submission.
          * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
          */
-        this.decryptWithAttachments = function (formSecretKey, decryptParams) { return __awaiter(_this, void 0, void 0, function () {
+        _this.decryptWithAttachments = function (formSecretKey, decryptParams) { return __awaiter(_this, void 0, void 0, function () {
             var decryptedRecords, filenames, attachmentRecords, decryptedContent, fieldIds, downloadPromises, _a;
             var _this = this;
             var _b;
@@ -202,7 +180,7 @@ var Crypto = /** @class */ (function () {
                         });
                         fieldIds = Object.keys(attachmentRecords);
                         // Check if all fieldIds are within filenames
-                        if (!crypto_1.areAttachmentFieldIdsValid(fieldIds, filenames)) {
+                        if (!(0, crypto_1.areAttachmentFieldIdsValid)(fieldIds, filenames)) {
                             return [2 /*return*/, null];
                         }
                         downloadPromises = fieldIds.map(function (fieldId) {
@@ -214,7 +192,7 @@ var Crypto = /** @class */ (function () {
                                 // Decrypt all the attachments
                                 .then(function (_a) {
                                 var downloadResponse = _a.data;
-                                var encryptedFile = crypto_1.convertEncryptedAttachmentToFileContent(downloadResponse);
+                                var encryptedFile = (0, crypto_1.convertEncryptedAttachmentToFileContent)(downloadResponse);
                                 return _this.decryptFile(formSecretKey, encryptedFile);
                             })
                                 .then(function (decryptedFile) {
@@ -247,8 +225,9 @@ var Crypto = /** @class */ (function () {
                 }
             });
         }); };
-        this.signingPublicKey = signingPublicKey;
+        _this.signingPublicKey = signingPublicKey;
+        return _this;
     }
     return Crypto;
-}());
+}(crypto_base_1.default));
 exports.default = Crypto;