@qlever-llc/trellis 0.5.1 → 0.6.0

package/esm/auth/workload_activation.js

@@ -0,0 +1,290 @@
+import { Type } from "typebox";
+import { Value } from "typebox/value";
+import { importEd25519PrivateKeyFromSeedBase64url, importEd25519PublicKeyFromBase64url, publicKeyBase64urlFromPrivateKey, } from "./keys.js";
+import { AuthGetWorkloadConnectInfoResponseSchema, WaitForWorkloadActivationResponseSchema, } from "./protocol.js";
+import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8 } from "./utils.js";
+const WORKLOAD_IDENTITY_HKDF_INFO = "trellis/workload-identity/v1";
+const WORKLOAD_ACTIVATION_HKDF_INFO = "trellis/workload-activate/v1";
+const WORKLOAD_QR_MAC_DOMAIN = "trellis-workload-qr/v1";
+const WORKLOAD_CONFIRMATION_DOMAIN = "trellis-workload-confirm/v1";
+const CROCKFORD_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+const DEFAULT_WAIT_POLL_INTERVAL_MS = 1_000;
+export const WorkloadActivationPayloadSchema = Type.Object({
+    v: Type.Literal(1),
+    publicIdentityKey: Type.String({ minLength: 1 }),
+    nonce: Type.String({ minLength: 1 }),
+    qrMac: Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+export const WorkloadActivationWaitRequestSchema = Type.Object({
+    publicIdentityKey: Type.String({ minLength: 1 }),
+    nonce: Type.String({ minLength: 1 }),
+    contractDigest: Type.Optional(Type.String({ minLength: 1 })),
+    iat: Type.Number(),
+    sig: Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+function concatBytes(parts) {
+    const size = parts.reduce((total, part) => total + part.length, 0);
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const part of parts) {
+        bytes.set(part, offset);
+        offset += part.length;
+    }
+    return bytes;
+}
+function normalizeSecretBytes(value, name) {
+    if (typeof value === "string") {
+        const decoded = base64urlDecode(value);
+        if (decoded.length === 0)
+            throw new Error(`${name} must not be empty`);
+        return decoded;
+    }
+    if (value.length === 0)
+        throw new Error(`${name} must not be empty`);
+    return value;
+}
+async function hkdfSha256(inputKeyingMaterial, info, length) {
+    const key = await crypto.subtle.importKey("raw", toArrayBuffer(inputKeyingMaterial), "HKDF", false, ["deriveBits"]);
+    const derivedBits = await crypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: toArrayBuffer(new Uint8Array(0)),
+        info: toArrayBuffer(utf8(info)),
+    }, key, length * 8);
+    return new Uint8Array(derivedBits);
+}
+async function hmacSha256(keyBytes, data) {
+    const key = await crypto.subtle.importKey("raw", toArrayBuffer(keyBytes), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return new Uint8Array(await crypto.subtle.sign("HMAC", key, toArrayBuffer(data)));
+}
+function crockfordEncode(bytes) {
+    let value = 0;
+    let bits = 0;
+    let output = "";
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            output += CROCKFORD_ALPHABET[(value >>> bits) & 31] ?? "0";
+        }
+    }
+    if (bits > 0) {
+        output += CROCKFORD_ALPHABET[(value << (5 - bits)) & 31] ?? "0";
+    }
+    return output;
+}
+function normalizeCrockford(value) {
+    return value.trim().toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1");
+}
+async function sleep(ms, signal) {
+    if (signal?.aborted)
+        throw signal.reason ?? new DOMException("Aborted", "AbortError");
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        function onAbort() {
+            clearTimeout(timer);
+            reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+export async function deriveWorkloadIdentity(workloadRootSecret) {
+    if (workloadRootSecret.length !== 32) {
+        throw new Error(`Invalid workload root secret length: ${workloadRootSecret.length} (expected 32)`);
+    }
+    const identitySeed = await hkdfSha256(workloadRootSecret, WORKLOAD_IDENTITY_HKDF_INFO, 32);
+    const activationKey = await hkdfSha256(workloadRootSecret, WORKLOAD_ACTIVATION_HKDF_INFO, 32);
+    const identitySeedBase64url = base64urlEncode(identitySeed);
+    const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(identitySeedBase64url);
+    const publicIdentityKey = await publicKeyBase64urlFromPrivateKey(identityPrivateKey);
+    return {
+        identitySeed,
+        identitySeedBase64url,
+        publicIdentityKey,
+        activationKey,
+        activationKeyBase64url: base64urlEncode(activationKey),
+    };
+}
+export async function deriveWorkloadQrMac(input) {
+    const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
+    const mac = await hmacSha256(activationKey, concatBytes([
+        utf8(WORKLOAD_QR_MAC_DOMAIN),
+        utf8(input.publicIdentityKey),
+        utf8(input.nonce),
+    ]));
+    return base64urlEncode(mac.slice(0, 8));
+}
+export async function buildWorkloadActivationPayload(input) {
+    const qrMac = await deriveWorkloadQrMac(input);
+    return {
+        v: 1,
+        publicIdentityKey: input.publicIdentityKey,
+        nonce: input.nonce,
+        qrMac,
+    };
+}
+export function encodeWorkloadActivationPayload(payload) {
+    return base64urlEncode(utf8(JSON.stringify(payload)));
+}
+export function parseWorkloadActivationPayload(value) {
+    const decoded = new TextDecoder().decode(base64urlDecode(value));
+    const parsed = JSON.parse(decoded);
+    if (!Value.Check(WorkloadActivationPayloadSchema, parsed)) {
+        throw new Error("Invalid workload activation payload");
+    }
+    return parsed;
+}
+export function buildWorkloadActivationUrl(args) {
+    const baseUrl = new URL(args.trellisUrl);
+    baseUrl.pathname = "/auth/workloads/activate";
+    baseUrl.searchParams.set("payload", typeof args.payload === "string" ? args.payload : encodeWorkloadActivationPayload(args.payload));
+    return baseUrl.toString();
+}
+export async function deriveWorkloadConfirmationCode(input) {
+    const activationKey = normalizeSecretBytes(input.activationKey, "activationKey");
+    const mac = await hmacSha256(activationKey, concatBytes([
+        utf8(WORKLOAD_CONFIRMATION_DOMAIN),
+        utf8(input.publicIdentityKey),
+        utf8(input.nonce),
+    ]));
+    return crockfordEncode(mac.slice(0, 5)).slice(0, 8);
+}
+export async function verifyWorkloadConfirmationCode(input) {
+    const expected = await deriveWorkloadConfirmationCode(input);
+    return normalizeCrockford(expected) === normalizeCrockford(input.confirmationCode);
+}
+export function buildWorkloadWaitProofInput(publicIdentityKey, nonce, iat) {
+    const enc = new TextEncoder();
+    const publicIdentityKeyBytes = enc.encode(publicIdentityKey);
+    const nonceBytes = enc.encode(nonce);
+    const iatBytes = enc.encode(String(iat));
+    const buf = new Uint8Array(4 + publicIdentityKeyBytes.length +
+        4 + nonceBytes.length +
+        4 + iatBytes.length);
+    const view = new DataView(buf.buffer);
+    let offset = 0;
+    view.setUint32(offset, publicIdentityKeyBytes.length);
+    offset += 4;
+    buf.set(publicIdentityKeyBytes, offset);
+    offset += publicIdentityKeyBytes.length;
+    view.setUint32(offset, nonceBytes.length);
+    offset += 4;
+    buf.set(nonceBytes, offset);
+    offset += nonceBytes.length;
+    view.setUint32(offset, iatBytes.length);
+    offset += 4;
+    buf.set(iatBytes, offset);
+    return buf;
+}
+export async function signWorkloadWaitRequest(args) {
+    const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
+    const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
+    const iat = args.iat ?? Math.floor(Date.now() / 1_000);
+    const proofInput = buildWorkloadWaitProofInput(args.publicIdentityKey, args.nonce, iat);
+    const proofHash = await sha256(proofInput);
+    const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, toArrayBuffer(proofHash)));
+    return {
+        publicIdentityKey: args.publicIdentityKey,
+        nonce: args.nonce,
+        ...(args.contractDigest ? { contractDigest: args.contractDigest } : {}),
+        iat,
+        sig: base64urlEncode(signature),
+    };
+}
+export async function createWorkloadNatsAuthToken(args) {
+    const identitySeed = normalizeSecretBytes(args.identitySeed, "identitySeed");
+    const identityPrivateKey = await importEd25519PrivateKeyFromSeedBase64url(base64urlEncode(identitySeed));
+    const iat = args.iat ?? Math.floor(Date.now() / 1_000);
+    const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(utf8(`nats-connect:${iat}`)));
+    const signature = new Uint8Array(await crypto.subtle.sign("Ed25519", identityPrivateKey, digest));
+    return {
+        v: 1,
+        sessionKey: args.publicIdentityKey,
+        iat,
+        sig: base64urlEncode(signature),
+        contractDigest: args.contractDigest,
+    };
+}
+export async function waitForWorkloadActivation(args) {
+    const pollIntervalMs = args.pollIntervalMs ?? DEFAULT_WAIT_POLL_INTERVAL_MS;
+    while (true) {
+        const request = await signWorkloadWaitRequest(args);
+        const response = await fetch(new URL("/auth/workloads/activate/wait", args.trellisUrl), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(request),
+            signal: args.signal,
+        });
+        if (!response.ok) {
+            throw new Error(`workload activation wait failed: ${response.status}`);
+        }
+        const body = await response.json();
+        if (!Value.Check(WaitForWorkloadActivationResponseSchema, body)) {
+            throw new Error("Invalid workload activation wait response");
+        }
+        if (body.status === "pending") {
+            await sleep(pollIntervalMs, args.signal);
+            continue;
+        }
+        if (body.status === "rejected") {
+            throw new Error(`workload activation rejected: ${body.reason ?? "unknown_reason"}`);
+        }
+        return body;
+    }
+}
+export async function getWorkloadConnectInfo(args) {
+    const request = await signWorkloadWaitRequest({
+        publicIdentityKey: args.publicIdentityKey,
+        identitySeed: args.identitySeed,
+        contractDigest: args.contractDigest,
+        nonce: "connect-info",
+        iat: args.iat,
+    });
+    const payload = {
+        publicIdentityKey: request.publicIdentityKey,
+        contractDigest: args.contractDigest,
+        iat: request.iat,
+        sig: request.sig,
+    };
+    const response = await fetch(new URL("/auth/workloads/connect-info", args.trellisUrl), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(payload),
+    });
+    if (!response.ok) {
+        throw new Error(`workload connect info failed: ${response.status}`);
+    }
+    const body = await response.json();
+    if (!Value.Check(AuthGetWorkloadConnectInfoResponseSchema, body)) {
+        throw new Error("Invalid workload connect info response");
+    }
+    return body;
+}
+export function createWorkloadActivationClient(client) {
+    return {
+        activateWorkload(input) {
+            return client.requestOrThrow("Auth.ActivateWorkload", input);
+        },
+        getWorkloadActivationStatus(input) {
+            return client.requestOrThrow("Auth.GetWorkloadActivationStatus", input);
+        },
+        listWorkloadActivations(input = {}) {
+            return client.requestOrThrow("Auth.ListWorkloadActivations", input);
+        },
+        revokeWorkloadActivation(input) {
+            return client.requestOrThrow("Auth.RevokeWorkloadActivation", input);
+        },
+        getWorkloadConnectInfo(input) {
+            return client.requestOrThrow("Auth.GetWorkloadConnectInfo", input);
+        },
+    };
+}
+export async function verifyWorkloadWaitSignature(input) {
+    const publicKey = await importEd25519PublicKeyFromBase64url(input.publicIdentityKey);
+    const proofHash = await sha256(buildWorkloadWaitProofInput(input.publicIdentityKey, input.nonce, input.iat));
+    return await crypto.subtle.verify("Ed25519", publicKey, toArrayBuffer(base64urlDecode(input.sig)), toArrayBuffer(proofHash));
+}

package/esm/contracts/canonical.d.ts

@@ -0,0 +1,14 @@
+export type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [k: string]: JsonValue;
+};
+export declare function isJsonValue(value: unknown): value is JsonValue;
+export declare function canonicalizeJson(value: JsonValue): string;
+export declare function base64url(bytes: Uint8Array): string;
+export declare function sha256Bytes(data: Uint8Array): Uint8Array;
+export declare function sha256Base64urlSync(text: string): string;
+export declare function sha256Base64url(text: string): Promise<string>;
+export declare function digestJson(value: JsonValue): Promise<{
+    canonical: string;
+    digest: string;
+}>;
+//# sourceMappingURL=canonical.d.ts.map

package/esm/contracts/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/contracts/canonical.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,EAAE,GACX;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE/B,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAiB9D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAoBzD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKnD;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CA+ExD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOnE;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAID"}

package/esm/contracts/canonical.js

@@ -0,0 +1,135 @@
+export function isJsonValue(value) {
+    if (value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean")
+        return true;
+    if (typeof value === "number") {
+        return Number.isFinite(value) && !Object.is(value, -0);
+    }
+    if (Array.isArray(value))
+        return value.every(isJsonValue);
+    if (typeof value === "object") {
+        return Object.values(value).every(isJsonValue);
+    }
+    return false;
+}
+export function canonicalizeJson(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value) || Object.is(value, -0)) {
+            throw new Error(`Non-canonical number in manifest: ${value}`);
+        }
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalizeJson).join(",")}]`;
+    }
+    const keys = Object.keys(value).sort();
+    const entries = keys.map((k) => `${JSON.stringify(k)}:${canonicalizeJson(value[k])}`);
+    return `{${entries.join(",")}}`;
+}
+export function base64url(bytes) {
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    const b64 = btoa(bin);
+    return b64.replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function rotr(value, bits) {
+    return (value >>> bits) | (value << (32 - bits));
+}
+export function sha256Bytes(data) {
+    const K = new Uint32Array([
+        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4,
+        0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe,
+        0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f,
+        0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+        0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc,
+        0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+        0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116,
+        0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7,
+        0xc67178f2,
+    ]);
+    const H = new Uint32Array([
+        0x6a09e667,
+        0xbb67ae85,
+        0x3c6ef372,
+        0xa54ff53a,
+        0x510e527f,
+        0x9b05688c,
+        0x1f83d9ab,
+        0x5be0cd19,
+    ]);
+    const bitLength = data.length * 8;
+    const paddedLength = Math.ceil((data.length + 9) / 64) * 64;
+    const padded = new Uint8Array(paddedLength);
+    padded.set(data);
+    padded[data.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(paddedLength - 4, bitLength >>> 0, false);
+    view.setUint32(paddedLength - 8, Math.floor(bitLength / 2 ** 32), false);
+    const w = new Uint32Array(64);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let i = 0; i < 16; i++) {
+            w[i] = view.getUint32(offset + i * 4, false);
+        }
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (((w[i - 16] + s0) | 0) + w[i - 7] + s1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, h] = H;
+        for (let i = 0; i < 64; i++) {
+            const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const temp1 = (((((h + s1) | 0) + ch) | 0) + K[i] + w[i]) >>> 0;
+            const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (s0 + maj) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        H[0] = (H[0] + a) >>> 0;
+        H[1] = (H[1] + b) >>> 0;
+        H[2] = (H[2] + c) >>> 0;
+        H[3] = (H[3] + d) >>> 0;
+        H[4] = (H[4] + e) >>> 0;
+        H[5] = (H[5] + f) >>> 0;
+        H[6] = (H[6] + g) >>> 0;
+        H[7] = (H[7] + h) >>> 0;
+    }
+    const out = new Uint8Array(32);
+    const outView = new DataView(out.buffer);
+    for (let i = 0; i < H.length; i++) {
+        outView.setUint32(i * 4, H[i], false);
+    }
+    return out;
+}
+export function sha256Base64urlSync(text) {
+    return base64url(sha256Bytes(new TextEncoder().encode(text)));
+}
+export async function sha256Base64url(text) {
+    if (typeof crypto !== "undefined" && crypto.subtle) {
+        const data = new TextEncoder().encode(text);
+        const digest = await crypto.subtle.digest("SHA-256", data);
+        return base64url(new Uint8Array(digest));
+    }
+    return sha256Base64urlSync(text);
+}
+export async function digestJson(value) {
+    const canonical = canonicalizeJson(value);
+    const digest = await sha256Base64url(canonical);
+    return { canonical, digest };
+}