@opengovsg/formsg-sdk 0.16.1 → 7.1.4

package/dist/esm/crypto.d.ts

@@ -0,0 +1,41 @@
+import CryptoBase from './crypto-base';
+import { DecryptedContent, DecryptedContentAndAttachments, DecryptParams, EncryptedContent } from './types';
+export default class Crypto extends CryptoBase {
+    signingPublicKey?: string;
+    constructor({ signingPublicKey }?: {
+        signingPublicKey?: string;
+    });
+    /**
+     * Encrypt input with a unique keypair for each submission
+     * @param encryptionPublicKey The base-64 encoded public key for encrypting.
+     * @param msg The message to encrypt, will be stringified.
+     * @param signingPrivateKey Optional. Must be a base-64 encoded private key. If given, will be used to signing the given msg param prior to encrypting.
+     * @returns The encrypted basestring.
+     */
+    encrypt: (msg: any, encryptionPublicKey: string, signingPrivateKey?: string) => EncryptedContent;
+    /**
+     * Decrypts an encrypted submission and returns it.
+     * @param formSecretKey The base-64 secret key of the form to decrypt with.
+     * @param decryptParams The params containing encrypted content and information.
+     * @param decryptParams.encryptedContent The encrypted content encoded with base-64.
+     * @param decryptParams.version The version of the payload. Used to determine the decryption process to decrypt the content with.
+     * @param decryptParams.verifiedContent Optional. The encrypted and signed verified content. If given, the signingPublicKey will be used to attempt to open the signed message.
+     * @returns The decrypted content if successful. Else, null will be returned.
+     * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
+     */
+    decrypt: (formSecretKey: string, decryptParams: DecryptParams) => DecryptedContent | null;
+    /**
+     * Returns true if a pair of public & secret keys are associated with each other
+     * @param publicKey The public key to verify against.
+     * @param secretKey The private key to verify against.
+     */
+    valid: (publicKey: string, secretKey: string) => boolean;
+    /**
+     * Decrypts an encrypted submission, and also download and decrypt any attachments alongside it.
+     * @param formSecretKey Secret key as a base-64 string
+     * @param decryptParams The params containing encrypted content and information.
+     * @returns A promise of the decrypted submission, including attachments (if any). Or else returns null if a decryption error decrypting any part of the submission.
+     * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
+     */
+    decryptWithAttachments: (formSecretKey: string, decryptParams: DecryptParams) => Promise<DecryptedContentAndAttachments | null>;
+}

package/dist/esm/crypto.js

@@ -0,0 +1,228 @@
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+import axios from 'axios';
+import nacl from 'tweetnacl';
+import { decodeBase64, decodeUTF8, encodeUTF8 } from 'tweetnacl-util';
+import { areAttachmentFieldIdsValid, convertEncryptedAttachmentToFileContent, decryptContent, encryptMessage, verifySignedMessage, } from './util/crypto';
+import { determineIsFormFields } from './util/validate';
+import CryptoBase from './crypto-base';
+import { AttachmentDecryptionError, MissingPublicKeyError } from './errors';
+var Crypto = /** @class */ (function (_super) {
+    __extends(Crypto, _super);
+    function Crypto(_a) {
+        var _b = _a === void 0 ? {} : _a, signingPublicKey = _b.signingPublicKey;
+        var _this = _super.call(this) || this;
+        /**
+         * Encrypt input with a unique keypair for each submission
+         * @param encryptionPublicKey The base-64 encoded public key for encrypting.
+         * @param msg The message to encrypt, will be stringified.
+         * @param signingPrivateKey Optional. Must be a base-64 encoded private key. If given, will be used to signing the given msg param prior to encrypting.
+         * @returns The encrypted basestring.
+         */
+        _this.encrypt = function (msg, encryptionPublicKey, signingPrivateKey) {
+            var processedMsg = decodeUTF8(JSON.stringify(msg));
+            if (signingPrivateKey) {
+                processedMsg = nacl.sign(processedMsg, decodeBase64(signingPrivateKey));
+            }
+            return encryptMessage(processedMsg, encryptionPublicKey);
+        };
+        /**
+         * Decrypts an encrypted submission and returns it.
+         * @param formSecretKey The base-64 secret key of the form to decrypt with.
+         * @param decryptParams The params containing encrypted content and information.
+         * @param decryptParams.encryptedContent The encrypted content encoded with base-64.
+         * @param decryptParams.version The version of the payload. Used to determine the decryption process to decrypt the content with.
+         * @param decryptParams.verifiedContent Optional. The encrypted and signed verified content. If given, the signingPublicKey will be used to attempt to open the signed message.
+         * @returns The decrypted content if successful. Else, null will be returned.
+         * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
+         */
+        _this.decrypt = function (formSecretKey, decryptParams) {
+            try {
+                var encryptedContent = decryptParams.encryptedContent, verifiedContent = decryptParams.verifiedContent;
+                // Do not return the transformed object in `_decrypt` function as a signed
+                // object is not encoded in UTF8 and is encoded in Base-64 instead.
+                var decryptedContent = decryptContent(formSecretKey, encryptedContent);
+                if (!decryptedContent) {
+                    throw new Error('Failed to decrypt content');
+                }
+                var decryptedObject = JSON.parse(encodeUTF8(decryptedContent));
+                if (!determineIsFormFields(decryptedObject)) {
+                    throw new Error('Decrypted object does not fit expected shape');
+                }
+                var returnedObject = {
+                    responses: decryptedObject,
+                };
+                if (verifiedContent) {
+                    if (!_this.signingPublicKey) {
+                        throw new MissingPublicKeyError('Public signing key must be provided when instantiating the Crypto class in order to verify verified content');
+                    }
+                    // Only care if it is the correct shape if verifiedContent exists, since
+                    // we need to append it to the end.
+                    // Decrypted message must be able to be authenticated by the public key.
+                    var decryptedVerifiedContent = decryptContent(formSecretKey, verifiedContent);
+                    if (!decryptedVerifiedContent) {
+                        // Returns null if decrypting verified content failed.
+                        throw new Error('Failed to decrypt verified content');
+                    }
+                    var decryptedVerifiedObject = verifySignedMessage(decryptedVerifiedContent, _this.signingPublicKey);
+                    returnedObject.verified = decryptedVerifiedObject;
+                }
+                return returnedObject;
+            }
+            catch (err) {
+                // Should only throw if MissingPublicKeyError.
+                // This library should be able to be used to encrypt and decrypt content
+                // if the content does not contain verified fields.
+                if (err instanceof MissingPublicKeyError) {
+                    throw err;
+                }
+                return null;
+            }
+        };
+        /**
+         * Returns true if a pair of public & secret keys are associated with each other
+         * @param publicKey The public key to verify against.
+         * @param secretKey The private key to verify against.
+         */
+        _this.valid = function (publicKey, secretKey) {
+            var _a;
+            var testResponse = [];
+            var internalValidationVersion = 1;
+            var cipherResponse = _this.encrypt(testResponse, publicKey);
+            // Use toString here since the return should be an empty array.
+            return (testResponse.toString() ===
+                ((_a = _this.decrypt(secretKey, {
+                    encryptedContent: cipherResponse,
+                    version: internalValidationVersion,
+                })) === null || _a === void 0 ? void 0 : _a.responses.toString()));
+        };
+        /**
+         * Decrypts an encrypted submission, and also download and decrypt any attachments alongside it.
+         * @param formSecretKey Secret key as a base-64 string
+         * @param decryptParams The params containing encrypted content and information.
+         * @returns A promise of the decrypted submission, including attachments (if any). Or else returns null if a decryption error decrypting any part of the submission.
+         * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
+         */
+        _this.decryptWithAttachments = function (formSecretKey, decryptParams) { return __awaiter(_this, void 0, void 0, function () {
+            var decryptedRecords, filenames, attachmentRecords, decryptedContent, fieldIds, downloadPromises, _a;
+            var _this = this;
+            var _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0:
+                        decryptedRecords = {};
+                        filenames = {};
+                        attachmentRecords = (_b = decryptParams.attachmentDownloadUrls) !== null && _b !== void 0 ? _b : {};
+                        decryptedContent = this.decrypt(formSecretKey, decryptParams);
+                        if (decryptedContent === null)
+                            return [2 /*return*/, null
+                                // Retrieve all original filenames for attachments for easy lookup
+                            ];
+                        // Retrieve all original filenames for attachments for easy lookup
+                        decryptedContent.responses.forEach(function (response) {
+                            if (response.fieldType === 'attachment' && response.answer) {
+                                filenames[response._id] = response.answer;
+                            }
+                        });
+                        fieldIds = Object.keys(attachmentRecords);
+                        // Check if all fieldIds are within filenames
+                        if (!areAttachmentFieldIdsValid(fieldIds, filenames)) {
+                            return [2 /*return*/, null];
+                        }
+                        downloadPromises = fieldIds.map(function (fieldId) {
+                            return (axios
+                                // Retrieve all the attachments as JSON
+                                .get(attachmentRecords[fieldId], {
+                                responseType: 'json',
+                            })
+                                // Decrypt all the attachments
+                                .then(function (_a) {
+                                var downloadResponse = _a.data;
+                                var encryptedFile = convertEncryptedAttachmentToFileContent(downloadResponse);
+                                return _this.decryptFile(formSecretKey, encryptedFile);
+                            })
+                                .then(function (decryptedFile) {
+                                // Check if the file exists and set the filename accordingly; otherwise, throw an error
+                                if (decryptedFile) {
+                                    decryptedRecords[fieldId] = {
+                                        filename: filenames[fieldId],
+                                        content: decryptedFile,
+                                    };
+                                }
+                                else {
+                                    throw new AttachmentDecryptionError();
+                                }
+                            }));
+                        });
+                        _c.label = 1;
+                    case 1:
+                        _c.trys.push([1, 3, , 4]);
+                        return [4 /*yield*/, Promise.all(downloadPromises)];
+                    case 2:
+                        _c.sent();
+                        return [3 /*break*/, 4];
+                    case 3:
+                        _a = _c.sent();
+                        return [2 /*return*/, null];
+                    case 4: return [2 /*return*/, {
+                            content: decryptedContent,
+                            attachments: decryptedRecords,
+                        }];
+                }
+            });
+        }); };
+        _this.signingPublicKey = signingPublicKey;
+        return _this;
+    }
+    return Crypto;
+}(CryptoBase));
+export default Crypto;

package/dist/esm/errors.d.ts

@@ -0,0 +1,13 @@
+declare class MissingSecretKeyError extends Error {
+    constructor(message?: string);
+}
+declare class MissingPublicKeyError extends Error {
+    constructor(message?: string);
+}
+declare class WebhookAuthenticateError extends Error {
+    constructor(message: string);
+}
+declare class AttachmentDecryptionError extends Error {
+    constructor(message?: string);
+}
+export { MissingSecretKeyError, MissingPublicKeyError, WebhookAuthenticateError, AttachmentDecryptionError, };

package/dist/esm/errors.js

@@ -0,0 +1,64 @@
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var MissingSecretKeyError = /** @class */ (function (_super) {
+    __extends(MissingSecretKeyError, _super);
+    function MissingSecretKeyError(message) {
+        if (message === void 0) { message = 'Provide a secret key when initializing the FormSG SDK to use this function.'; }
+        var _this = _super.call(this, message) || this;
+        _this.name = _this.constructor.name;
+        // Set the prototype explicitly.
+        // See https://github.com/facebook/jest/issues/8279
+        Object.setPrototypeOf(_this, MissingSecretKeyError.prototype);
+        return _this;
+    }
+    return MissingSecretKeyError;
+}(Error));
+var MissingPublicKeyError = /** @class */ (function (_super) {
+    __extends(MissingPublicKeyError, _super);
+    function MissingPublicKeyError(message) {
+        if (message === void 0) { message = 'Provide a public key when initializing the FormSG SDK to use this function.'; }
+        var _this = _super.call(this, message) || this;
+        _this.name = _this.constructor.name;
+        // Set the prototype explicitly.
+        // See https://github.com/facebook/jest/issues/8279
+        Object.setPrototypeOf(_this, MissingPublicKeyError.prototype);
+        return _this;
+    }
+    return MissingPublicKeyError;
+}(Error));
+var WebhookAuthenticateError = /** @class */ (function (_super) {
+    __extends(WebhookAuthenticateError, _super);
+    function WebhookAuthenticateError(message) {
+        var _this = _super.call(this, message) || this;
+        _this.name = _this.constructor.name;
+        // Set the prototype explicitly.
+        // See https://github.com/facebook/jest/issues/8279
+        Object.setPrototypeOf(_this, WebhookAuthenticateError.prototype);
+        return _this;
+    }
+    return WebhookAuthenticateError;
+}(Error));
+var AttachmentDecryptionError = /** @class */ (function (_super) {
+    __extends(AttachmentDecryptionError, _super);
+    function AttachmentDecryptionError(message) {
+        if (message === void 0) { message = 'Attachment decryption with the given nonce failed.'; }
+        var _this = _super.call(this, message) || this;
+        _this.name = _this.constructor.name;
+        return _this;
+    }
+    return AttachmentDecryptionError;
+}(Error));
+export { MissingSecretKeyError, MissingPublicKeyError, WebhookAuthenticateError, AttachmentDecryptionError, };

package/dist/esm/index.d.ts

@@ -0,0 +1,20 @@
+export type { DecryptedContent, DecryptedContentV3, DecryptParams, DecryptParamsV3, EncryptedAttachmentContent, EncryptedAttachmentRecords, EncryptedContent, EncryptedContentV3, EncryptedFileContent, FieldType, FormField, FormFieldsV3, Keypair, PackageMode, VerificationOptions, } from './types';
+import Crypto from './crypto';
+import CryptoV3 from './crypto-v3';
+import { PackageInitParams } from './types';
+import Verification from './verification';
+import Webhooks from './webhooks';
+/**
+ * Entrypoint into the FormSG SDK
+ *
+ * @param {PackageInitParams} config Package initialization config parameters
+ * @param {string?} [config.mode] Optional. Initializes public key used for verifying and decrypting in this package. If `config.signingPublicKey` is given, this param will be ignored.
+ * @param {string?} [config.webhookSecretKey] Optional. base64 secret key for signing webhooks. If provided, enables generating signature and headers to authenticate webhook data.
+ * @param {VerificationOptions?} [config.verificationOptions] Optional. If provided, enables the usage of the verification module.
+ */
+export default function (config?: PackageInitParams): {
+    webhooks: Webhooks;
+    crypto: Crypto;
+    cryptoV3: CryptoV3;
+    verification: Verification;
+};

package/dist/esm/index.js

@@ -0,0 +1,39 @@
+import { getSigningPublicKey, getVerificationPublicKey } from './util/publicKey';
+import Crypto from './crypto';
+import CryptoV3 from './crypto-v3';
+import Verification from './verification';
+import Webhooks from './webhooks';
+/**
+ * Entrypoint into the FormSG SDK
+ *
+ * @param {PackageInitParams} config Package initialization config parameters
+ * @param {string?} [config.mode] Optional. Initializes public key used for verifying and decrypting in this package. If `config.signingPublicKey` is given, this param will be ignored.
+ * @param {string?} [config.webhookSecretKey] Optional. base64 secret key for signing webhooks. If provided, enables generating signature and headers to authenticate webhook data.
+ * @param {VerificationOptions?} [config.verificationOptions] Optional. If provided, enables the usage of the verification module.
+ */
+export default function (config) {
+    if (config === void 0) { config = {}; }
+    var webhookSecretKey = config.webhookSecretKey, mode = config.mode, verificationOptions = config.verificationOptions;
+    /**
+     * Public key is used for decrypting signed verified content in the `crypto` module, and
+     * also for verifying webhook signatures' authenticity in the `wehbooks` module.
+     */
+    var signingPublicKey = getSigningPublicKey(mode || 'production');
+    /**
+     * Public key is used for verifying verified field signatures' authenticity in the `verification` module.
+     */
+    var verificationPublicKey = getVerificationPublicKey(mode || 'production');
+    return {
+        webhooks: new Webhooks({
+            publicKey: signingPublicKey,
+            secretKey: webhookSecretKey,
+        }),
+        crypto: new Crypto({ signingPublicKey: signingPublicKey }),
+        cryptoV3: new CryptoV3({ signingPublicKey: signingPublicKey }),
+        verification: new Verification({
+            publicKey: verificationPublicKey,
+            secretKey: verificationOptions === null || verificationOptions === void 0 ? void 0 : verificationOptions.secretKey,
+            transactionExpiry: verificationOptions === null || verificationOptions === void 0 ? void 0 : verificationOptions.transactionExpiry,
+        }),
+    };
+}

package/dist/esm/resource/signing-keys.d.ts

@@ -0,0 +1,16 @@
+export declare const SIGNING_KEYS: {
+    staging: {
+        publicKey: string;
+    };
+    development: {
+        publicKey: string;
+        secretKey: string;
+    };
+    production: {
+        publicKey: string;
+    };
+    test: {
+        publicKey: string;
+        secretKey: string;
+    };
+};

package/dist/esm/resource/signing-keys.js

@@ -0,0 +1,19 @@
+// keys generated using nacl.sign.keyPair() from tweetnacl
+export var SIGNING_KEYS = {
+    staging: {
+        // staging must never contain secret keys
+        publicKey: 'rjv41kYqZwcbe3r6ymMEEKQ+Vd+DPuogN+Gzq3lP2Og=',
+    },
+    development: {
+        publicKey: 'Tl5gfszlKcQj99/0uafLwVpT6JAu4C0dHGvLq1cHzFE=',
+        secretKey: 'HDBXpu+2/gu10bLHpy8HjpN89xbA6boH9GwibPGJA8BOXmB+zOUpxCP33/S5p8vBWlPokC7gLR0ca8urVwfMUQ==',
+    },
+    production: {
+        // production must never contain secret keys
+        publicKey: '3Tt8VduXsjjd4IrpdCd7BAkdZl/vUCstu9UvTX84FWw=',
+    },
+    test: {
+        publicKey: 'KUY1XT30ar+XreVjsS1w/c3EpDs2oASbF6G3evvaUJM=',
+        secretKey: '/u+LP57Ib9y5Ytpud56FzuitSC9O6lJ4EOLOFHpsHlYpRjVdPfRqv5et5WOxLXD9zcSkOzagBJsXobd6+9pQkw==',
+    },
+};

package/dist/esm/resource/verification-keys.d.ts

@@ -0,0 +1,16 @@
+export declare const VERIFICATION_KEYS: {
+    staging: {
+        publicKey: string;
+    };
+    development: {
+        publicKey: string;
+        secretKey: string;
+    };
+    production: {
+        publicKey: string;
+    };
+    test: {
+        publicKey: string;
+        secretKey: string;
+    };
+};

package/dist/esm/resource/verification-keys.js

@@ -0,0 +1,19 @@
+// keys generated using nacl.sign.keyPair() from tweetnacl
+export var VERIFICATION_KEYS = {
+    staging: {
+        // staging must never contain secret keys
+        publicKey: 'bDgK1223JbrDNePFIrj7b0z02Z5nSiBzkRYRqDdVPfA=',
+    },
+    development: {
+        publicKey: 'SZ4pV0JXgj8dhFU69uHllqYcxTtliYmi+d6Ml56lnQU=',
+        secretKey: 'iGkfOuI6uxrlfw+7CZFFUZBwk86I+pu6v+g7EWA6qJpJnilXQleCPx2EVTr24eWWphzFO2WJiaL53oyXnqWdBQ==',
+    },
+    production: {
+        // production must never contain secret keys
+        publicKey: 'W/lf24kRJ9PVvSK1Ubjjhc9zHjp1amKr+3Q+Nmsy4w4=',
+    },
+    test: {
+        publicKey: 'ileDo328P/UApBPANuS/xO6P4BuHSgPnjRRBifgQYvs=',
+        secretKey: 'zLnXIV0cGjODell5w1usEHcGOJ/xsQDuDOw2BPcPEQOKV4Ojfbw/9QCkE8A25L/E7o/gG4dKA+eNFEGJ+BBi+w==',
+    },
+};

package/dist/esm/types.d.ts

@@ -0,0 +1,101 @@
+export type PackageInitParams = {
+    /** base64 secret key for signing webhooks. If provided, enables generating signature and headers to authenticate webhook data. */
+    webhookSecretKey?: string;
+    /** If provided, enables the usage of the verification module. */
+    verificationOptions?: VerificationOptions;
+    /** Initializes public key used for verifying and decrypting in this package. If not given, will default to "production". */
+    mode?: PackageMode;
+};
+export type FieldType = 'section' | 'radiobutton' | 'dropdown' | 'checkbox' | 'nric' | 'email' | 'table' | 'number' | 'rating' | 'yes_no' | 'decimal' | 'textfield' | 'textarea' | 'attachment' | 'date' | 'mobile' | 'homeno' | 'statement' | 'image' | 'country_region' | 'uen' | 'children' | 'address' | 'signature';
+export type FormField = {
+    _id: string;
+    question: string;
+    fieldType: FieldType;
+    isHeader?: boolean;
+    signature?: string;
+} & ({
+    answer: string;
+    answerArray?: never;
+} | {
+    answer?: never;
+    answerArray: string[] | string[][];
+});
+export type FormFieldsV3 = Record<string, {
+    fieldType: FieldType;
+    answer: any;
+}>;
+export type EncryptedContent = string;
+export type EncryptedContentV3 = {
+    submissionPublicKey: string;
+    submissionSecretKey: string;
+    encryptedContent: EncryptedContent;
+    encryptedSubmissionSecretKey: EncryptedContent;
+};
+export type EncryptedAttachmentRecords = Record<string, string>;
+export interface DecryptParams {
+    encryptedContent: EncryptedContent;
+    version: number;
+    verifiedContent?: EncryptedContent;
+    attachmentDownloadUrls?: EncryptedAttachmentRecords;
+}
+export interface DecryptParamsV3 {
+    encryptedContent: EncryptedContent;
+    encryptedSubmissionSecretKey: EncryptedContent;
+    verifiedContent?: EncryptedContent;
+    version: number;
+}
+export type DecryptedContent = {
+    responses: FormField[];
+    verified?: Record<string, any>;
+};
+export type DecryptedContentV3 = {
+    submissionSecretKey: string;
+    responses: FormFieldsV3;
+    verified?: Record<string, any>;
+};
+export type DecryptedFile = {
+    filename: string;
+    content: Uint8Array;
+};
+export type DecryptedAttachments = Record<string, DecryptedFile>;
+export type DecryptedContentAndAttachments = {
+    content: DecryptedContent;
+    attachments: DecryptedAttachments;
+};
+export type EncryptedFileContent = {
+    submissionPublicKey: string;
+    nonce: string;
+    binary: Uint8Array;
+};
+export type EncryptedAttachmentContent = {
+    encryptedFile: {
+        submissionPublicKey: string;
+        nonce: string;
+        binary: string;
+    };
+};
+export type Keypair = {
+    publicKey: string;
+    secretKey: string;
+};
+export type PackageMode = 'staging' | 'production' | 'development' | 'test';
+export type VerificationOptions = {
+    publicKey?: string;
+    secretKey?: string;
+    transactionExpiry?: number;
+};
+export type VerifiedAnswer = {
+    fieldId: string;
+    answer: string;
+};
+export type VerificationSignatureOptions = VerifiedAnswer & {
+    transactionId: string;
+    formId: string;
+};
+export type VerificationBasestringOptions = VerificationSignatureOptions & {
+    time: number;
+};
+export type VerificationAuthenticateOptions = VerifiedAnswer & {
+    signatureString: string;
+    submissionCreatedAt: number;
+};

package/dist/esm/types.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/util/crypto.d.ts

@@ -0,0 +1,42 @@
+import { EncryptedAttachmentContent, EncryptedContent, EncryptedFileContent, Keypair } from '../types';
+/**
+ * Helper method to generate a new keypair for encryption.
+ * @returns The generated keypair.
+ */
+export declare const generateKeypair: () => Keypair;
+/**
+ * Helper function to encrypt input with a unique keypair for each submission.
+ * @param msg The message to encrypt
+ * @param theirPublicKey The base-64 encoded public key
+ * @returns The encrypted basestring
+ * @throws error if any of the encrypt methods fail
+ */
+export declare const encryptMessage: (msg: Uint8Array, theirPublicKey: string) => EncryptedContent;
+/**
+ * Helper method to decrypt an encrypted submission.
+ * @param formPrivateKey base64
+ * @param encryptedContent encrypted string encoded in base64
+ * @return The decrypted content, or null if decryption failed.
+ */
+export declare const decryptContent: (formPrivateKey: string, encryptedContent: EncryptedContent) => Uint8Array | null;
+/**
+ * Helper method to verify a signed message.
+ * @param msg the message to verify
+ * @param publicKey the public key to authenticate the signed message with
+ * @returns the signed message if successful, else an error will be thrown
+ * @throws {Error} if the message cannot be verified
+ */
+export declare const verifySignedMessage: (msg: Uint8Array, publicKey: string) => Record<string, any>;
+/**
+ * Helper method to check if all the field IDs given are within the filenames
+ * @param fieldIds the list of fieldIds to check
+ * @param filenames the filenames that should contain the fields
+ * @returns boolean indicating whether the fields are valid
+ */
+export declare const areAttachmentFieldIdsValid: (fieldIds: string[], filenames: Record<string, string>) => boolean;
+/**
+ * Converts an encrypted attachment to encrypted file content
+ * @param encryptedAttachment The encrypted attachment
+ * @returns EncryptedFileContent The encrypted file content
+ */
+export declare const convertEncryptedAttachmentToFileContent: (encryptedAttachment: EncryptedAttachmentContent) => EncryptedFileContent;