@qlever-llc/trellis 0.5.1 → 0.6.0

package/esm/auth/mod.js

@@ -0,0 +1,17 @@
+/**
+ * @module
+ *
+ * Trellis server-side authentication library for session-key based authentication.
+ *
+ * - Session keys are Ed25519 keys represented as base64url (32-byte raw public key).
+ * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
+ * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
+ */
+export { buildWorkloadActivationPayload, buildWorkloadActivationUrl, buildWorkloadWaitProofInput, createWorkloadNatsAuthToken, createWorkloadActivationClient, deriveWorkloadConfirmationCode, deriveWorkloadIdentity, deriveWorkloadQrMac, encodeWorkloadActivationPayload, getWorkloadConnectInfo, parseWorkloadActivationPayload, signWorkloadWaitRequest, verifyWorkloadConfirmationCode, verifyWorkloadWaitSignature, waitForWorkloadActivation, } from "./workload_activation.js";
+export { bindFlow, bindSession, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForBindingToken, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, signBytes, submitPortalApproval, } from "./browser.js";
+export { buildProofInput, createProof, verifyProof, } from "./proof.js";
+export { ApprovalRecordViewSchema, AuthActivateWorkloadResponseSchema, AuthActivateWorkloadSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthClearWorkloadPortalSelectionResponseSchema, AuthClearWorkloadPortalSelectionSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateWorkloadProfileResponseSchema, AuthCreateWorkloadProfileSchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthDisableWorkloadInstanceResponseSchema, AuthDisableWorkloadInstanceSchema, AuthDisableWorkloadProfileResponseSchema, AuthDisableWorkloadProfileSchema, AuthGetWorkloadConnectInfoResponseSchema, AuthGetWorkloadConnectInfoSchema, AuthGetWorkloadPortalDefaultResponseSchema, AuthGetWorkloadPortalDefaultSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListWorkloadPortalSelectionsResponseSchema, AuthListWorkloadPortalSelectionsSchema, AuthListWorkloadActivationReviewsResponseSchema, AuthListWorkloadActivationReviewsSchema, AuthListWorkloadActivationsResponseSchema, AuthListWorkloadActivationsSchema, AuthGetWorkloadActivationStatusResponseSchema, AuthGetWorkloadActivationStatusSchema, AuthListWorkloadInstancesResponseSchema, AuthListWorkloadInstancesSchema, AuthListWorkloadProfilesResponseSchema, AuthListWorkloadProfilesSchema, AuthProvisionWorkloadInstanceResponseSchema, AuthProvisionWorkloadInstanceSchema, AuthDecideWorkloadActivationReviewResponseSchema, AuthDecideWorkloadActivationReviewSchema, AuthWorkloadActivationReviewRequestedEventSchema, AuthRevokeWorkloadActivationResponseSchema, AuthRevokeWorkloadActivationSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthSetWorkloadPortalDefaultResponseSchema, AuthSetWorkloadPortalDefaultSchema, AuthSetWorkloadPortalSelectionResponseSchema, AuthSetWorkloadPortalSelectionSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthInstallServiceResponseSchema, AuthInstallServiceSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListServicesResponseSchema, AuthListServicesSchema, AuthListUsersResponseSchema, AuthListUsersSchema, AuthMeResponseSchema, AuthMeSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpgradeServiceContractResponseSchema, AuthUpgradeServiceContractSchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, AuthenticatedWorkloadSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, PortalSchema, PortalFlowStateSchema, ServiceViewSchema, UserViewSchema, WaitForWorkloadActivationResponseSchema, WorkloadActivationReviewSchema, WorkloadPortalDefaultSchema, WorkloadPortalSelectionSchema, WorkloadActivationRecordSchema, WorkloadConnectInfoSchema, WorkloadProfileSchema, WorkloadSchema, } from "./protocol.js";
+export { ApprovalDecisionSchema, BindRequestSchema, BindResponseSchema, BindSuccessResponseSchema, ContractApprovalSchema, LoginQuerySchema, NatsAuthTokenV1Schema, SentinelCredsSchema, } from "./schemas.js";
+export { createAuth, } from "./session_auth.js";
+export { trellisIdFromOriginId } from "./trellis_id.js";
+export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";

package/esm/auth/proof.d.ts

@@ -0,0 +1,9 @@
+export type ProofParams = {
+    sessionKey: string;
+    subject: string;
+    payloadHash: Uint8Array;
+};
+export declare function buildProofInput(sessionKey: string, subject: string, payloadHash: Uint8Array): Uint8Array;
+export declare function createProof(privateKey: CryptoKey, params: ProofParams): Promise<string>;
+export declare function verifyProof(publicSessionKey: string, params: ProofParams, proofBase64url: string): Promise<boolean>;
+//# sourceMappingURL=proof.d.ts.map

package/esm/auth/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../src/auth/proof.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,UAAU,GACtB,UAAU,CA8BZ;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,SAAS,EACrB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/esm/auth/proof.js

@@ -0,0 +1,43 @@
+import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
+import { importEd25519PublicKeyFromBase64url } from "./keys.js";
+import { AsyncResult } from "@qlever-llc/result";
+export function buildProofInput(sessionKey, subject, payloadHash) {
+    const sessionKeyBytes = utf8(sessionKey);
+    const subjectBytes = utf8(subject);
+    const buf = new Uint8Array(4 +
+        sessionKeyBytes.length +
+        4 +
+        subjectBytes.length +
+        4 +
+        payloadHash.length);
+    const view = new DataView(buf.buffer);
+    let offset = 0;
+    view.setUint32(offset, sessionKeyBytes.length);
+    offset += 4;
+    buf.set(sessionKeyBytes, offset);
+    offset += sessionKeyBytes.length;
+    view.setUint32(offset, subjectBytes.length);
+    offset += 4;
+    buf.set(subjectBytes, offset);
+    offset += subjectBytes.length;
+    view.setUint32(offset, payloadHash.length);
+    offset += 4;
+    buf.set(payloadHash, offset);
+    return buf;
+}
+export async function createProof(privateKey, params) {
+    const input = buildProofInput(params.sessionKey, params.subject, params.payloadHash);
+    const digest = await sha256(input);
+    const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, toArrayBuffer(digest));
+    return base64urlEncode(new Uint8Array(sig));
+}
+export async function verifyProof(publicSessionKey, params, proofBase64url) {
+    const result = await AsyncResult.try(async () => {
+        const input = buildProofInput(params.sessionKey, params.subject, params.payloadHash);
+        const digest = await sha256(input);
+        const signature = base64urlDecode(proofBase64url);
+        const pub = await importEd25519PublicKeyFromBase64url(publicSessionKey);
+        return crypto.subtle.verify({ name: "Ed25519" }, pub, toArrayBuffer(signature), toArrayBuffer(digest));
+    });
+    return result.unwrapOr(false);
+}