@pallasoft/ps-utilities 1.3.0 → 2.0.0

package/dist/client/http-service.d.ts

@@ -16,5 +16,8 @@ export declare class HttpService {
     static createApiClient(options?: CreateApiClientOptions): {
         get: <T>(url: string, config?: PsHttpRequestConfig) => Promise<PsHttpResponse<T>>;
         post: <T>(url: string, data?: unknown, config?: PsHttpRequestConfig) => Promise<PsHttpResponse<T>>;
+        put: <T>(url: string, data?: unknown, config?: PsHttpRequestConfig) => Promise<PsHttpResponse<T>>;
+        patch: <T>(url: string, data?: unknown, config?: PsHttpRequestConfig) => Promise<PsHttpResponse<T>>;
+        delete: <T>(url: string, config?: PsHttpRequestConfig) => Promise<PsHttpResponse<T>>;
     };
 }

package/dist/client/http-service.js

@@ -52,9 +52,8 @@ var HttpService = /** @class */ (function () {
         var apiKey = options.apiKey, _a = options.apiKeyHeader, apiKeyHeader = _a === void 0 ? 'X-API-Key' : _a, baseURL = options.baseURL;
         var request = function (method, url, data, config) { return __awaiter(_this, void 0, void 0, function () {
             var fullUrl, sendsBinaryBody, headers, body, response, responseData, error;
-            var _a;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         fullUrl = baseURL ? "".concat(baseURL).concat(url) : url;
                         sendsBinaryBody = isBinaryBody(data);
@@ -68,18 +67,18 @@ var HttpService = /** @class */ (function () {
                         body = data === undefined ? undefined : sendsBinaryBody ? data : JSON.stringify(data);
                         return [4 /*yield*/, fetch(fullUrl, { method: method, headers: headers, body: body })];
                     case 1:
-                        response = _b.sent();
+                        response = _a.sent();
                         return [4 /*yield*/, ((config === null || config === void 0 ? void 0 : config.responseType) === 'arraybuffer'
                                 ? response.arrayBuffer()
                                 : (config === null || config === void 0 ? void 0 : config.responseType) === 'text'
                                     ? response.text()
                                     : (config === null || config === void 0 ? void 0 : config.responseType) === 'json'
                                         ? response.json()
-                                        : ((_a = response.headers.get('content-type')) !== null && _a !== void 0 ? _a : '').includes('application/json')
+                                        : String(response.headers.get('content-type')).includes('application/json')
                                             ? response.json()
                                             : response.text())];
                     case 2:
-                        responseData = _b.sent();
+                        responseData = _a.sent();
                         if (!response.ok) {
                             error = new Error("Request failed with status ".concat(response.status));
                             error.response = { data: responseData, status: response.status };
@@ -96,6 +95,15 @@ var HttpService = /** @class */ (function () {
             post: function (url, data, config) {
                 return request('POST', url, data, config);
             },
+            put: function (url, data, config) {
+                return request('PUT', url, data, config);
+            },
+            patch: function (url, data, config) {
+                return request('PATCH', url, data, config);
+            },
+            delete: function (url, config) {
+                return request('DELETE', url, undefined, config);
+            },
         };
     };
     return HttpService;

package/dist/common/crypto-service.d.ts

@@ -7,6 +7,8 @@ export declare class CryptoService {
     private static _textEncoder;
     private static _textDecoder;
     private static _payloadVersion;
+    private static _dataKeyPayloadVersion;
+    private static _dataKeyLength;
     private static _payloadAlgorithm;
     private static _aad;
     private static _toBase64;
@@ -15,5 +17,14 @@ export declare class CryptoService {
     private static _parsePayload;
     private static _deriveKey;
     static encryptPayload(payload: Record<string, unknown>, cryptoKey: string): Promise<string>;
+    private static _importDataKey;
+    static generateDataKey(): string;
+    static encryptPayloadWithDataKey(payload: Record<string, unknown>, dataKey: string): Promise<string>;
+    static decryptPayloadWithDataKey<T>(encryptedPayload: string, dataKey: string): Promise<T>;
+    static encryptValueWithDataKey(value: string, dataKey: string): Promise<string>;
+    static decryptValueWithDataKey(encryptedPayload: string, dataKey: string): Promise<string>;
+    static encryptValue(value: string, cryptoKey: string): Promise<string>;
+    static decryptValue(encryptedPayload: string, cryptoKey: string): Promise<string>;
+    static isEncryptedPayload(candidate: string): boolean;
     static decryptPayload<T>(encryptedPayload: string, cryptoKey: string): Promise<T>;
 }

package/dist/common/crypto-service.js

@@ -60,11 +60,12 @@ var CryptoService = /** @class */ (function () {
     };
     CryptoService._parsePayload = function (encryptedPayload) {
         var payload = JSON.parse(encryptedPayload);
-        if (payload.v !== this._payloadVersion ||
-            payload.alg !== this._payloadAlgorithm ||
+        var isDerived = payload.v === this._payloadVersion && Boolean(payload.salt);
+        var isDataKey = payload.v === this._dataKeyPayloadVersion;
+        if (payload.alg !== this._payloadAlgorithm ||
             !payload.iv ||
-            !payload.salt ||
-            !payload.ciphertext) {
+            !payload.ciphertext ||
+            (!isDerived && !isDataKey)) {
             throw new Error('Encrypted payload is malformed');
         }
         return payload;
@@ -121,6 +122,119 @@ var CryptoService = /** @class */ (function () {
             });
         });
     };
+    CryptoService._importDataKey = function (dataKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, crypto.subtle.importKey('raw', this._fromBase64(dataKey), { name: this._algorithm, length: this._keyLength }, false, ['encrypt', 'decrypt'])];
+                    case 1: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    CryptoService.generateDataKey = function () {
+        return this._toBase64(crypto.getRandomValues(new Uint8Array(this._dataKeyLength)));
+    };
+    CryptoService.encryptPayloadWithDataKey = function (payload, dataKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var iv, encryptedBuffer, _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        iv = crypto.getRandomValues(new Uint8Array(this._ivLength));
+                        _b = (_a = crypto.subtle).encrypt;
+                        _c = [{ name: this._algorithm, iv: iv, additionalData: this._getAdditionalData() }];
+                        return [4 /*yield*/, this._importDataKey(dataKey)];
+                    case 1: return [4 /*yield*/, _b.apply(_a, _c.concat([_d.sent(), this._textEncoder.encode(JSON.stringify(payload))]))];
+                    case 2:
+                        encryptedBuffer = _d.sent();
+                        return [2 /*return*/, JSON.stringify({
+                                v: this._dataKeyPayloadVersion,
+                                alg: this._payloadAlgorithm,
+                                iv: this._toBase64(iv),
+                                ciphertext: this._toBase64(new Uint8Array(encryptedBuffer)),
+                            })];
+                }
+            });
+        });
+    };
+    CryptoService.decryptPayloadWithDataKey = function (encryptedPayload, dataKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var payload, decryptedBuffer, _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        payload = this._parsePayload(encryptedPayload);
+                        _b = (_a = crypto.subtle).decrypt;
+                        _c = [{
+                                name: this._algorithm,
+                                iv: this._fromBase64(payload.iv),
+                                additionalData: this._getAdditionalData(),
+                            }];
+                        return [4 /*yield*/, this._importDataKey(dataKey)];
+                    case 1: return [4 /*yield*/, _b.apply(_a, _c.concat([_d.sent(), this._fromBase64(payload.ciphertext)]))];
+                    case 2:
+                        decryptedBuffer = _d.sent();
+                        return [2 /*return*/, JSON.parse(this._textDecoder.decode(decryptedBuffer))];
+                }
+            });
+        });
+    };
+    CryptoService.encryptValueWithDataKey = function (value, dataKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.encryptPayloadWithDataKey({ value: value }, dataKey)];
+                    case 1: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    CryptoService.decryptValueWithDataKey = function (encryptedPayload, dataKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var value;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.decryptPayloadWithDataKey(encryptedPayload, dataKey)];
+                    case 1:
+                        value = (_a.sent()).value;
+                        return [2 /*return*/, value];
+                }
+            });
+        });
+    };
+    CryptoService.encryptValue = function (value, cryptoKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.encryptPayload({ value: value }, cryptoKey)];
+                    case 1: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    CryptoService.decryptValue = function (encryptedPayload, cryptoKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var value;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.decryptPayload(encryptedPayload, cryptoKey)];
+                    case 1:
+                        value = (_a.sent()).value;
+                        return [2 /*return*/, value];
+                }
+            });
+        });
+    };
+    CryptoService.isEncryptedPayload = function (candidate) {
+        try {
+            this._parsePayload(candidate);
+            return true;
+        }
+        catch (_a) {
+            return false;
+        }
+    };
     CryptoService.decryptPayload = function (encryptedPayload, cryptoKey) {
         return __awaiter(this, void 0, void 0, function () {
             var payload, key, decryptedBuffer;
@@ -151,6 +265,8 @@ var CryptoService = /** @class */ (function () {
     CryptoService._textEncoder = new TextEncoder();
     CryptoService._textDecoder = new TextDecoder();
     CryptoService._payloadVersion = 1;
+    CryptoService._dataKeyPayloadVersion = 2;
+    CryptoService._dataKeyLength = 32;
     CryptoService._payloadAlgorithm = 'A256GCM';
     CryptoService._aad = 'encrypted-form:v1:a256gcm';
     return CryptoService;

package/dist/common/encrypted-fields-service.d.ts

@@ -0,0 +1,10 @@
+export interface EncryptedFieldsSpec<T> {
+    json?: readonly (keyof T)[];
+    values?: readonly (keyof T)[];
+}
+export declare class EncryptedFieldsService {
+    private static _isBlank;
+    static encrypt<Row extends object, Entity extends object>(row: Row, spec: EncryptedFieldsSpec<Entity>, wrappedDataKey: string, masterKey: string): Promise<Row>;
+    static decrypt<Row extends object, Entity extends object>(row: Row, spec: EncryptedFieldsSpec<Entity>, wrappedDataKey: string, masterKey: string): Promise<Row>;
+    static decryptMany<Row extends object, Entity extends object>(rows: Row[], spec: EncryptedFieldsSpec<Entity>, wrappedDataKey: string, masterKey: string): Promise<Row[]>;
+}

package/dist/common/encrypted-fields-service.js

@@ -0,0 +1,178 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptedFieldsService = void 0;
+var envelope_crypto_service_1 = require("./envelope-crypto-service");
+var EncryptedFieldsService = /** @class */ (function () {
+    function EncryptedFieldsService() {
+    }
+    EncryptedFieldsService._isBlank = function (value) {
+        return value === null || value === undefined || value === '';
+    };
+    EncryptedFieldsService.encrypt = function (row, spec, wrappedDataKey, masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var encrypted, _i, _a, field, value, _b, _c, _d, _e, field, value, _f, _g;
+            return __generator(this, function (_h) {
+                switch (_h.label) {
+                    case 0:
+                        encrypted = __assign({}, row);
+                        _i = 0, _a = (spec.values !== null && spec.values !== undefined
+                            ? spec.values
+                            : []);
+                        _h.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        field = _a[_i];
+                        value = encrypted[field];
+                        if (this._isBlank(value))
+                            return [3 /*break*/, 3];
+                        _b = encrypted;
+                        _c = field;
+                        return [4 /*yield*/, envelope_crypto_service_1.EnvelopeCryptoService.encryptValue(value, wrappedDataKey, masterKey)];
+                    case 2:
+                        _b[_c] = _h.sent();
+                        _h.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4:
+                        _d = 0, _e = (spec.json !== null && spec.json !== undefined
+                            ? spec.json
+                            : []);
+                        _h.label = 5;
+                    case 5:
+                        if (!(_d < _e.length)) return [3 /*break*/, 8];
+                        field = _e[_d];
+                        value = encrypted[field];
+                        if (this._isBlank(value))
+                            return [3 /*break*/, 7];
+                        _f = encrypted;
+                        _g = field;
+                        return [4 /*yield*/, envelope_crypto_service_1.EnvelopeCryptoService.encryptPayload(value, wrappedDataKey, masterKey)];
+                    case 6:
+                        _f[_g] = _h.sent();
+                        _h.label = 7;
+                    case 7:
+                        _d++;
+                        return [3 /*break*/, 5];
+                    case 8: return [2 /*return*/, encrypted];
+                }
+            });
+        });
+    };
+    EncryptedFieldsService.decrypt = function (row, spec, wrappedDataKey, masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var decrypted, _i, _a, field, value, _b, _c, _d, _e, field, value, _f, _g;
+            return __generator(this, function (_h) {
+                switch (_h.label) {
+                    case 0:
+                        decrypted = __assign({}, row);
+                        _i = 0, _a = (spec.values !== null && spec.values !== undefined
+                            ? spec.values
+                            : []);
+                        _h.label = 1;
+                    case 1:
+                        if (!(_i < _a.length)) return [3 /*break*/, 4];
+                        field = _a[_i];
+                        value = decrypted[field];
+                        if (this._isBlank(value))
+                            return [3 /*break*/, 3];
+                        _b = decrypted;
+                        _c = field;
+                        return [4 /*yield*/, envelope_crypto_service_1.EnvelopeCryptoService.decryptValue(value, wrappedDataKey, masterKey)];
+                    case 2:
+                        _b[_c] = _h.sent();
+                        _h.label = 3;
+                    case 3:
+                        _i++;
+                        return [3 /*break*/, 1];
+                    case 4:
+                        _d = 0, _e = (spec.json !== null && spec.json !== undefined
+                            ? spec.json
+                            : []);
+                        _h.label = 5;
+                    case 5:
+                        if (!(_d < _e.length)) return [3 /*break*/, 8];
+                        field = _e[_d];
+                        value = decrypted[field];
+                        if (this._isBlank(value))
+                            return [3 /*break*/, 7];
+                        _f = decrypted;
+                        _g = field;
+                        return [4 /*yield*/, envelope_crypto_service_1.EnvelopeCryptoService.decryptPayload(value, wrappedDataKey, masterKey)];
+                    case 6:
+                        _f[_g] = _h.sent();
+                        _h.label = 7;
+                    case 7:
+                        _d++;
+                        return [3 /*break*/, 5];
+                    case 8: return [2 /*return*/, decrypted];
+                }
+            });
+        });
+    };
+    EncryptedFieldsService.decryptMany = function (rows, spec, wrappedDataKey, masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _this = this;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, Promise.all(rows.map(function (row) { return __awaiter(_this, void 0, void 0, function () { return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, this.decrypt(row, spec, wrappedDataKey, masterKey)];
+                                case 1: return [2 /*return*/, _a.sent()];
+                            }
+                        }); }); }))];
+                    case 1: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    return EncryptedFieldsService;
+}());
+exports.EncryptedFieldsService = EncryptedFieldsService;

package/dist/common/envelope-crypto-service.d.ts

@@ -0,0 +1,17 @@
+export interface DataKeyPair {
+    dataKey: string;
+    wrappedDataKey: string;
+}
+export declare class EnvelopeCryptoService {
+    private static _cache;
+    private static _cacheLimit;
+    private static _remember;
+    static createDataKey(masterKey: string): Promise<DataKeyPair>;
+    static unwrapDataKey(wrappedDataKey: string, masterKey: string): Promise<string>;
+    static rewrapDataKey(wrappedDataKey: string, currentMasterKey: string, nextMasterKey: string): Promise<string>;
+    static encryptValue(value: string, wrappedDataKey: string, masterKey: string): Promise<string>;
+    static decryptValue(encryptedPayload: string, wrappedDataKey: string, masterKey: string): Promise<string>;
+    static encryptPayload(payload: Record<string, unknown>, wrappedDataKey: string, masterKey: string): Promise<string>;
+    static decryptPayload<T>(encryptedPayload: string, wrappedDataKey: string, masterKey: string): Promise<T>;
+    static forget(wrappedDataKey: string): void;
+}

package/dist/common/envelope-crypto-service.js

@@ -0,0 +1,167 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvelopeCryptoService = void 0;
+var crypto_service_1 = require("./crypto-service");
+var EnvelopeCryptoService = /** @class */ (function () {
+    function EnvelopeCryptoService() {
+    }
+    EnvelopeCryptoService._remember = function (wrappedDataKey, dataKey) {
+        if (this._cache.size >= this._cacheLimit) {
+            var oldest = this._cache.keys().next().value;
+            if (oldest)
+                this._cache.delete(oldest);
+        }
+        this._cache.set(wrappedDataKey, dataKey);
+    };
+    EnvelopeCryptoService.createDataKey = function (masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var dataKey, wrappedDataKey;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        dataKey = crypto_service_1.CryptoService.generateDataKey();
+                        return [4 /*yield*/, crypto_service_1.CryptoService.encryptValue(dataKey, masterKey)];
+                    case 1:
+                        wrappedDataKey = _a.sent();
+                        this._remember(wrappedDataKey, dataKey);
+                        return [2 /*return*/, { dataKey: dataKey, wrappedDataKey: wrappedDataKey }];
+                }
+            });
+        });
+    };
+    EnvelopeCryptoService.unwrapDataKey = function (wrappedDataKey, masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var cached, dataKey;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        cached = this._cache.get(wrappedDataKey);
+                        if (cached)
+                            return [2 /*return*/, cached];
+                        return [4 /*yield*/, crypto_service_1.CryptoService.decryptValue(wrappedDataKey, masterKey)];
+                    case 1:
+                        dataKey = _a.sent();
+                        this._remember(wrappedDataKey, dataKey);
+                        return [2 /*return*/, dataKey];
+                }
+            });
+        });
+    };
+    EnvelopeCryptoService.rewrapDataKey = function (wrappedDataKey, currentMasterKey, nextMasterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var dataKey;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, this.unwrapDataKey(wrappedDataKey, currentMasterKey)];
+                    case 1:
+                        dataKey = _a.sent();
+                        return [4 /*yield*/, crypto_service_1.CryptoService.encryptValue(dataKey, nextMasterKey)];
+                    case 2: return [2 /*return*/, _a.sent()];
+                }
+            });
+        });
+    };
+    EnvelopeCryptoService.encryptValue = function (value, wrappedDataKey, masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        _b = (_a = crypto_service_1.CryptoService).encryptValueWithDataKey;
+                        _c = [value];
+                        return [4 /*yield*/, this.unwrapDataKey(wrappedDataKey, masterKey)];
+                    case 1: return [4 /*yield*/, _b.apply(_a, _c.concat([_d.sent()]))];
+                    case 2: return [2 /*return*/, _d.sent()];
+                }
+            });
+        });
+    };
+    EnvelopeCryptoService.decryptValue = function (encryptedPayload, wrappedDataKey, masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        _b = (_a = crypto_service_1.CryptoService).decryptValueWithDataKey;
+                        _c = [encryptedPayload];
+                        return [4 /*yield*/, this.unwrapDataKey(wrappedDataKey, masterKey)];
+                    case 1: return [4 /*yield*/, _b.apply(_a, _c.concat([_d.sent()]))];
+                    case 2: return [2 /*return*/, _d.sent()];
+                }
+            });
+        });
+    };
+    EnvelopeCryptoService.encryptPayload = function (payload, wrappedDataKey, masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        _b = (_a = crypto_service_1.CryptoService).encryptPayloadWithDataKey;
+                        _c = [payload];
+                        return [4 /*yield*/, this.unwrapDataKey(wrappedDataKey, masterKey)];
+                    case 1: return [4 /*yield*/, _b.apply(_a, _c.concat([_d.sent()]))];
+                    case 2: return [2 /*return*/, _d.sent()];
+                }
+            });
+        });
+    };
+    EnvelopeCryptoService.decryptPayload = function (encryptedPayload, wrappedDataKey, masterKey) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a, _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        _b = (_a = crypto_service_1.CryptoService).decryptPayloadWithDataKey;
+                        _c = [encryptedPayload];
+                        return [4 /*yield*/, this.unwrapDataKey(wrappedDataKey, masterKey)];
+                    case 1: return [4 /*yield*/, _b.apply(_a, _c.concat([_d.sent()]))];
+                    case 2: return [2 /*return*/, _d.sent()];
+                }
+            });
+        });
+    };
+    EnvelopeCryptoService.forget = function (wrappedDataKey) {
+        this._cache.delete(wrappedDataKey);
+    };
+    EnvelopeCryptoService._cache = new Map();
+    EnvelopeCryptoService._cacheLimit = 500;
+    return EnvelopeCryptoService;
+}());
+exports.EnvelopeCryptoService = EnvelopeCryptoService;

package/dist/common/index.d.ts

@@ -1,7 +1,10 @@
 export * from './color-service';
 export * from './crypto-service';
+export * from './encrypted-fields-service';
+export * from './envelope-crypto-service';
 export * from './date-service';
 export * from './number-format-service';
 export * from './recaptcha-service';
 export * from './url-service';
 export * from './string-service';
+export * from './transform-service';

package/dist/common/index.js

@@ -16,8 +16,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./color-service"), exports);
 __exportStar(require("./crypto-service"), exports);
+__exportStar(require("./encrypted-fields-service"), exports);
+__exportStar(require("./envelope-crypto-service"), exports);
 __exportStar(require("./date-service"), exports);
 __exportStar(require("./number-format-service"), exports);
 __exportStar(require("./recaptcha-service"), exports);
 __exportStar(require("./url-service"), exports);
 __exportStar(require("./string-service"), exports);
+__exportStar(require("./transform-service"), exports);

package/dist/common/recaptcha-service.d.ts

@@ -3,6 +3,5 @@ export interface RecaptchaVerifyResult {
     errorCodes: string[];
 }
 export declare class RecaptchaService {
-    private static _verifyUrl;
     static verify(token: string, secretKey: string, remoteIp?: string): Promise<RecaptchaVerifyResult>;
 }

package/dist/common/recaptcha-service.js

@@ -46,10 +46,13 @@ var RecaptchaService = /** @class */ (function () {
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
+                        if (!process.env.RECAPTCHA_VERIFY_URL) {
+                            throw new Error('No reCAPTCHA verify URL found');
+                        }
                         params = new URLSearchParams({ secret: secretKey, response: token });
                         if (remoteIp)
                             params.set('remoteip', remoteIp);
-                        return [4 /*yield*/, fetch(this._verifyUrl, {
+                        return [4 /*yield*/, fetch(process.env.RECAPTCHA_VERIFY_URL, {
                                 method: 'POST',
                                 headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
                                 body: params.toString(),
@@ -64,13 +67,12 @@ var RecaptchaService = /** @class */ (function () {
                         data = (_a.sent());
                         return [2 /*return*/, {
                                 success: !!data.success,
-                                errorCodes: data['error-codes'] || [],
+                                errorCodes: data['error-codes'] ? data['error-codes'] : [],
                             }];
                 }
             });
         });
     };
-    RecaptchaService._verifyUrl = 'https://www.google.com/recaptcha/api/siteverify';
     return RecaptchaService;
 }());
 exports.RecaptchaService = RecaptchaService;

package/dist/index.d.ts

@@ -2,3 +2,5 @@ import * as ClientNamespace from './client';
 import * as CommonNamespace from './common';
 export declare const Common: typeof CommonNamespace;
 export declare const Client: typeof ClientNamespace;
+export type { EncryptedFieldsSpec } from './common/encrypted-fields-service';
+export type { DataKeyPair } from './common/envelope-crypto-service';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@pallasoft/ps-utilities",
-	"version": "1.3.0",
+	"version": "2.0.0",
 	"private": false,
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",