@originator-profile/securing-mechanism 0.6.1 → 0.7.0-beta.2

package/README.md

@@ -1,3 +1,5 @@
 # Profile JWT Securing Mechanism
 
+[![npm version](https://img.shields.io/npm/v/@originator-profile/securing-mechanism)](https://www.npmjs.com/package/@originator-profile/securing-mechanism) [![jsDocs.io](https://img.shields.io/badge/jsDocs.io-reference-blue)](https://www.jsdocs.io/package/@originator-profile/securing-mechanism)
+
 VC の Securing 処理をするためのパッケージです。

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { OpVc, Jwk } from '@originator-profile/model';
 import { JWTInvalid, JOSEError } from 'jose/errors';
-import { JWTPayload, ProtectedHeaderParameters } from 'jose';
+import { JWTPayload, ProtectedHeaderParameters, CryptoKey, KeyObject } from 'jose';
 import { Keys } from '@originator-profile/cryptography';
 import { ZodType } from 'zod';
 
@@ -114,6 +114,28 @@ type JwtVcDecoder<T extends OpVc> = ReturnType<typeof JwtVcDecoder<T>>;
 declare function toUnverifiedJwtVc<T extends OpVc>(payload: JWTPayload, protectedHeader: ProtectedHeaderParameters, jwt: string): UnverifiedJwtVc<T>;
 declare function toVerifiedJwtVc<T extends OpVc>(payload: JWTPayload, protectedHeader: ProtectedHeaderParameters, jwt: string, key: Jwk): VerifiedJwtVc<T>;
 
+/**
+ * 鍵材料を外部に渡さない不透明な署名者
+ *
+ * HSM・セキュアエレメント・クラウドKMS(AWS KMS, Google Cloud KMS, Azure Key Vault等)・
+ * WebAuthn/FIDO2など、秘密鍵をハードウェア境界外に取り出せない署名環境向けの注入口。
+ */
+type JwtSigner = {
+    /** JWS alg */
+    alg: string;
+    /** JWS kid (鍵材料を持たないためサムプリントによるフォールバック計算ができない) */
+    kid: string;
+    /**
+     * signingInput (base64url(header) + "." + base64url(payload) の ASCII バイト列) に対する
+     * 生の署名バイト列 (JOSE 形式。例えば ES256 なら r||s の固定長結合) を返す。
+     */
+    sign: (signingInput: Uint8Array) => Promise<Uint8Array>;
+};
+/** ソフトウェア鍵として直接扱える鍵材料 */
+type KeyMaterial = Jwk | CryptoKey | KeyObject;
+/** signer が JwtSigner (不透明な署名者) かどうかを判定する */
+declare function isJwtSigner(signer: KeyMaterial | JwtSigner): signer is JwtSigner;
+
 type SignableVc = {
     issuer: string;
     credentialSubject: {
@@ -123,11 +145,12 @@ type SignableVc = {
 /**
  * VC への署名
  * @param vc VC オブジェクト
- * @param privateKey プライベートキー
+ * @param signer プライベートキー (Jwk/CryptoKey/KeyObject)、または HSM・KMS・WebAuthn等の外部署名者 (JwtSigner)
  * @return JWT でエンコードされた VC
  */
-declare function signJwtVc<T extends SignableVc>(vc: T, privateKey: Jwk, options: {
+declare function signJwtVc<T extends SignableVc>(vc: T, signer: KeyMaterial | JwtSigner, options: {
     alg?: string;
+    kid?: string;
     issuedAt: Date;
     expiredAt: Date;
 }): Promise<string>;
@@ -147,5 +170,5 @@ type VcValidator<V extends UnverifiedVc> = ReturnType<typeof VcValidator<V>>;
 declare function JwtVcVerifier<T extends OpVc>(keys: Keys, issuer: string | string[], validator?: VcValidator<VerifiedJwtVc<T>>): (jwt: string) => Promise<JwtVcVerificationResult<T>>;
 type JwtVcVerifier<T extends OpVc> = ReturnType<typeof JwtVcVerifier<T>>;
 
-export { JwtVcDecoder, JwtVcVerifier, SchemaValidationError, VcDecodeFailed, VcValidateFailed, VcValidator, VcVerifyFailed, signJwtVc, toUnverifiedJwtVc, toVerifiedJwtVc };
-export type { JwtVcDecodingFailure, JwtVcDecodingResult, JwtVcValidationResult, JwtVcVerificationFailure, JwtVcVerificationResult, SchemaIssue, UndecodedJwtVc, UndecodedVc, UnverifiedJwtVc, UnverifiedVc, VcDecodingFailure, VcDecodingResult, VcValidationFailure, VcValidationResult, VcVerificationFailure, VcVerificationResult, VerifiedJwtVc, VerifiedVc };
+export { JwtVcDecoder, JwtVcVerifier, SchemaValidationError, VcDecodeFailed, VcValidateFailed, VcValidator, VcVerifyFailed, isJwtSigner, signJwtVc, toUnverifiedJwtVc, toVerifiedJwtVc };
+export type { JwtSigner, JwtVcDecodingFailure, JwtVcDecodingResult, JwtVcValidationResult, JwtVcVerificationFailure, JwtVcVerificationResult, KeyMaterial, SchemaIssue, UndecodedJwtVc, UndecodedVc, UnverifiedJwtVc, UnverifiedVc, VcDecodingFailure, VcDecodingResult, VcValidationFailure, VcValidationResult, VcVerificationFailure, VcVerificationResult, VerifiedJwtVc, VerifiedVc };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { decodeJwt, decodeProtectedHeader, importJWK, SignJWT, jwtVerify, exportJWK } from 'jose';
+import { decodeJwt, decodeProtectedHeader, base64url, importJWK, SignJWT, exportJWK, jwtVerify } from 'jose';
 import { createThumbprint } from '@originator-profile/cryptography';
 import { JOSEError } from 'jose/errors';
 
@@ -108,18 +108,61 @@ function JwtVcDecoder() {
   return decode;
 }
 
-async function signJwtVc(vc, privateKey, options) {
-  const payload = vc;
-  const { alg = "ES256", issuedAt, expiredAt } = options;
-  const header = {
-    alg,
-    kid: privateKey.kid ?? await createThumbprint(privateKey, alg),
-    typ: "vc+jwt",
-    cty: "vc"
-  };
-  const privateKeyImported = await importJWK(privateKey, alg);
-  const jwt = await new SignJWT(payload).setProtectedHeader(header).setIssuer(vc.issuer).setSubject(vc.credentialSubject.id).setIssuedAt(getUnixTime(issuedAt)).setExpirationTime(getUnixTime(expiredAt)).sign(privateKeyImported);
-  return jwt;
+function isJwtSigner(signer) {
+  return !("kty" in signer) && "sign" in signer && typeof signer.sign === "function";
+}
+
+function isJwk(keyMaterial) {
+  return "kty" in keyMaterial;
+}
+async function resolveKid(keyMaterial) {
+  if (isJwk(keyMaterial)) {
+    return keyMaterial.kid ?? await createThumbprint(keyMaterial);
+  }
+  try {
+    const jwk = await exportJWK(keyMaterial);
+    return await createThumbprint(jwk);
+  } catch (e) {
+    throw new Error(
+      "Could not derive kid from the key (it may be non-extractable). Specify options.kid explicitly.",
+      { cause: e }
+    );
+  }
+}
+async function resolveAlgAndKid(signer, options) {
+  if (isJwtSigner(signer)) {
+    if (options.alg !== void 0 && options.alg !== signer.alg) {
+      throw new Error(
+        `options.alg ("${options.alg}") must match signer.alg ("${signer.alg}").`
+      );
+    }
+    return { alg: signer.alg, kid: options.kid ?? signer.kid };
+  }
+  const alg = options.alg ?? "ES256";
+  return { alg, kid: options.kid ?? await resolveKid(signer) };
+}
+async function signJwtVc(vc, signer, options) {
+  const { issuedAt, expiredAt } = options;
+  const { alg, kid } = await resolveAlgAndKid(signer, options);
+  const header = { alg, kid, typ: "vc+jwt", cty: "vc" };
+  if (isJwtSigner(signer)) {
+    const claims = {
+      ...vc,
+      iss: vc.issuer,
+      sub: vc.credentialSubject.id,
+      iat: getUnixTime(issuedAt),
+      exp: getUnixTime(expiredAt)
+    };
+    const encodedHeader = base64url.encode(JSON.stringify(header));
+    const encodedPayload = base64url.encode(JSON.stringify(claims));
+    const signingInput = new TextEncoder().encode(
+      `${encodedHeader}.${encodedPayload}`
+    );
+    const signature = await signer.sign(signingInput);
+    return `${encodedHeader}.${encodedPayload}.${base64url.encode(signature)}`;
+  }
+  const key = isJwk(signer) ? await importJWK(signer, alg) : signer;
+  return await new SignJWT(vc).setProtectedHeader(header).setIssuer(vc.issuer).setSubject(vc.credentialSubject.id).setIssuedAt(getUnixTime(issuedAt)).setExpirationTime(getUnixTime(expiredAt)).sign(key);
 }
 
 function JwtVcVerifier(keys, issuer, validator) {
@@ -174,4 +217,4 @@ function VcValidator(schema) {
   return validate;
 }
 
-export { JwtVcDecoder, JwtVcVerifier, SchemaValidationError, VcDecodeFailed, VcValidateFailed, VcValidator, VcVerifyFailed, signJwtVc, toUnverifiedJwtVc, toVerifiedJwtVc };
+export { JwtVcDecoder, JwtVcVerifier, SchemaValidationError, VcDecodeFailed, VcValidateFailed, VcValidator, VcVerifyFailed, isJwtSigner, signJwtVc, toUnverifiedJwtVc, toVerifiedJwtVc };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@originator-profile/securing-mechanism",
-  "version": "0.6.1",
+  "version": "0.7.0-beta.2",
   "license": "Apache-2.0",
   "homepage": "https://docs.originator-profile.org",
   "repository": {
@@ -25,22 +25,21 @@
   "dependencies": {
     "jose": "^6.2.2",
     "zod": "^4.3.6",
-    "@originator-profile/cryptography": "0.6.1",
-    "@originator-profile/model": "0.6.1"
+    "@originator-profile/cryptography": "0.7.0-beta.2",
+    "@originator-profile/model": "0.7.0-beta.2"
   },
   "devDependencies": {
     "date-fns": "4.1.0",
-    "eslint": "10.2.0",
+    "oxlint": "^1.73.0",
+    "oxlint-tsgolint": "^0.24.0",
     "pkgroll": "2.27.0",
     "typescript": "6.0.2",
     "vitest": "4.1.4",
-    "eslint-config-originator-profile": "0.6.1",
-    "@originator-profile/tsconfig": "0.6.1"
+    "@originator-profile/tsconfig": "0.7.0-beta.2"
   },
   "scripts": {
     "build": "pkgroll --clean-dist",
     "test": "vitest run",
-    "lint": "eslint --fix .",
-    "type-check": "tsc --noEmit"
+    "lint": "oxlint --fix ."
   }
 }