@pryv/encryption 3.11.0 → 3.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pryv/encryption",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "description": "Client-side encryption and decryption of Pryv.io events",
   "keywords": [
     "Pryv",

package/src/EventsCipher.js

@@ -46,7 +46,7 @@ class EventsCipher {
    * `encrypt` is optional (a decrypt-only method supports reading existing
    * encrypted events but cannot produce new ones).
    * @param {string} name
-   * @param {{ decrypt: Function, encrypt?: Function }} method
+   * @param {{ decrypt: Function, encrypt?: Function, encryptBytes?: Function, decryptBytes?: Function }} method
    * @returns {EventsCipher} this, for chaining.
    */
   registerMethod (name, method) {
@@ -72,7 +72,7 @@ class EventsCipher {
    * @param {*} [params.hint]
    * @returns {Promise<{ type: string, content: { payload: string, keyRef?: string, hint?: * } }>}
    */
-  async encryptEventContent (material, params = {}) {
+  async encryptEventContent (material, params = /** @type {any} */ ({})) {
     const { method: methodName, keyRef, hint } = params;
     const method = this._methods[methodName];
     if (!method) {
@@ -103,7 +103,7 @@ class EventsCipher {
    * @param {*} [params.hint]
    * @returns {Promise<Object>} a new encrypted event (input is not mutated).
    */
-  async encryptEvent (plainEvent, params = {}) {
+  async encryptEvent (plainEvent, params = /** @type {any} */ ({})) {
     const { type, content } = await this.encryptEventContent(plainEvent, params);
     const encrypted = Object.assign({}, plainEvent);
     encrypted.type = type;
@@ -180,7 +180,7 @@ class EventsCipher {
    * @param {*} [params.hint]
    * @returns {Promise<Uint8Array>} raw payload-layout bytes.
    */
-  async encryptAttachmentData (bytes, params = {}) {
+  async encryptAttachmentData (bytes, params = /** @type {any} */ ({})) {
     const { method: methodName, keyRef, hint } = params;
     const method = this._methods[methodName];
     if (!method) {

package/src/methods/aes-256-gcm.js

@@ -43,7 +43,11 @@ async function importKey (key) {
   if (raw.length !== KEY_LENGTH) {
     throw new Error(`aes-256-gcm: key must be ${KEY_LENGTH} bytes, got ${raw.length}`);
   }
-  return globalThis.crypto.subtle.importKey('raw', raw, ALGORITHM, false, ['encrypt', 'decrypt']);
+  // Cast at the Web Crypto boundary: since TypeScript 5.7 a bare
+  // `Uint8Array` is `Uint8Array<ArrayBufferLike>`, which admits
+  // SharedArrayBuffer and so is not a `BufferSource`. These bytes never
+  // come from shared memory, and Web Crypto rejects it regardless.
+  return globalThis.crypto.subtle.importKey('raw', /** @type {BufferSource} */ (raw), ALGORITHM, false, ['encrypt', 'decrypt']);
 }
 
 /**
@@ -58,7 +62,7 @@ async function importKey (key) {
 async function encryptBytes (bytes, key) {
   const cryptoKey = await importKey(key);
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(IV_LENGTH));
-  const cipherBuffer = await globalThis.crypto.subtle.encrypt({ name: ALGORITHM, iv }, cryptoKey, bytes);
+  const cipherBuffer = await globalThis.crypto.subtle.encrypt({ name: ALGORITHM, iv }, cryptoKey, /** @type {BufferSource} */ (bytes));
   const cipherBytes = new Uint8Array(cipherBuffer);
 
   const out = new Uint8Array(iv.length + cipherBytes.length);

package/src/methods/aes-text-base64.js

@@ -45,7 +45,7 @@ function evpBytesToKey (passphrase, salt) {
     input.set(block, 0);
     input.set(passphrase, block.length);
     input.set(salt, block.length + passphrase.length);
-    block = md5(input);
+    block = /** @type {Uint8Array<ArrayBuffer>} */ (md5(input));
     const take = Math.min(block.length, needed - filled);
     derived.set(block.subarray(0, take), filled);
     filled += take;
@@ -85,8 +85,13 @@ async function decrypt (content, key) {
   const passphrase = new TextEncoder().encode(key);
   const { key: keyBytes, iv } = evpBytesToKey(passphrase, salt);
 
-  const cryptoKey = await globalThis.crypto.subtle.importKey('raw', keyBytes, 'AES-CBC', false, ['decrypt']);
-  const plainBuffer = await globalThis.crypto.subtle.decrypt({ name: 'AES-CBC', iv }, cryptoKey, ciphertext);
+  // See the boundary note in aes-256-gcm.js.
+  const cryptoKey = await globalThis.crypto.subtle.importKey('raw', /** @type {BufferSource} */ (keyBytes), 'AES-CBC', false, ['decrypt']);
+  const plainBuffer = await globalThis.crypto.subtle.decrypt(
+    { name: 'AES-CBC', iv: /** @type {BufferSource} */ (iv) },
+    cryptoKey,
+    /** @type {BufferSource} */ (ciphertext)
+  );
   return JSON.parse(new TextDecoder().decode(plainBuffer));
 }
 

package/src/methods/ecies-aes-256-gcm.js

@@ -106,29 +106,30 @@ async function normalizeKey (material, usage) {
   }
 
   if (wantPrivate) {
-    return subtle.importKey('pkcs8', bytes, ALGORITHM, false, ['deriveBits']);
+  // See the boundary note in aes-256-gcm.js.
+    return subtle.importKey('pkcs8', /** @type {BufferSource} */ (bytes), ALGORITHM, false, ['deriveBits']);
   }
   if (bytes.length !== EPH_PUB_LENGTH || bytes[0] !== 0x04) {
     throw new Error('ecies-aes-256-gcm: public key must be a 65-byte SEC1 uncompressed point (0x04 || X || Y)');
   }
-  return subtle.importKey('raw', bytes, ALGORITHM, false, []);
+  return subtle.importKey('raw', /** @type {BufferSource} */ (bytes), ALGORITHM, false, []);
 }
 
 /**
  * Derive the AES-256-GCM key from an ECDH shared secret via HKDF-SHA-256.
  * @param {Uint8Array} secret - the 32-byte ECDH shared secret.
- * @param {string[]} usages
+ * @param {KeyUsage[]} usages
  * @returns {Promise<CryptoKey>}
  */
 async function deriveAesKey (secret, usages) {
   const subtle = globalThis.crypto.subtle;
-  const hkdfKey = await subtle.importKey('raw', secret, 'HKDF', false, ['deriveBits']);
+  const hkdfKey = await subtle.importKey('raw', /** @type {BufferSource} */ (secret), 'HKDF', false, ['deriveBits']);
   const aesBits = await subtle.deriveBits(
     { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: new TextEncoder().encode(INFO) },
     hkdfKey,
     256
   );
-  return subtle.importKey('raw', new Uint8Array(aesBits), 'AES-GCM', false, usages);
+  return subtle.importKey('raw', /** @type {BufferSource} */ (new Uint8Array(aesBits)), 'AES-GCM', false, usages);
 }
 
 /**
@@ -150,7 +151,7 @@ async function encryptBytes (bytes, key) {
   const aesKey = await deriveAesKey(new Uint8Array(secretBits), ['encrypt']);
 
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(IV_LENGTH));
-  const cipherBuffer = await subtle.encrypt({ name: 'AES-GCM', iv }, aesKey, bytes);
+  const cipherBuffer = await subtle.encrypt({ name: 'AES-GCM', iv }, aesKey, /** @type {BufferSource} */ (bytes));
   const cipherBytes = new Uint8Array(cipherBuffer);
 
   const ephRaw = new Uint8Array(await subtle.exportKey('raw', ephemeral.publicKey));