@qlever-llc/trellis 0.7.0 → 0.8.0-rc.2

package/esm/npm/src/auth/mod.js

@@ -0,0 +1,18 @@
+/**
+ * @module
+ *
+ * Trellis server-side authentication library for session-key based authentication.
+ *
+ * - Session keys are Ed25519 keys represented as base64url (32-byte raw public key).
+ * - Proofs are Ed25519 signatures over SHA-256(buildProofInput(...)).
+ * - Services load their session key seed from `TRELLIS_SESSION_KEY_SEED`.
+ */
+export { buildDeviceActivationPayload, buildDeviceWaitProofInput, createDeviceActivationClient, createDeviceNatsAuthToken, deriveDeviceConfirmationCode, deriveDeviceIdentity, deriveDeviceQrMac, encodeDeviceActivationPayload, getDeviceConnectInfo, parseDeviceActivationPayload, signDeviceWaitRequest, startDeviceActivationRequest, verifyDeviceConfirmationCode, verifyDeviceWaitSignature, waitForDeviceActivation, } from "./device_activation.js";
+export { bindFlow, buildLoginUrl, clearSessionKey, createRpcProof, fetchPortalFlowState, generateSessionKey, getOrCreateSessionKey, getPublicSessionKey, hasSessionKey, isBindSuccessResponse, loadSessionKey, natsConnectSigForIat, portalFlowIdFromUrl, portalProviderLoginUrl, portalRedirectLocation, signBytes, startAuthRequest, submitPortalApproval, } from "./browser.js";
+export { buildProofInput, createProof, verifyProof, } from "./proof.js";
+export { ApprovalRecordViewSchema, AuthActivateDeviceProgressSchema, AuthActivateDeviceResponseSchema, AuthActivateDeviceSchema, AuthApplyDeviceDeploymentContractResponseSchema, AuthApplyDeviceDeploymentContractSchema, AuthApplyServiceDeploymentContractResponseSchema, AuthApplyServiceDeploymentContractSchema, AuthClearDevicePortalSelectionResponseSchema, AuthClearDevicePortalSelectionSchema, AuthClearLoginPortalSelectionResponseSchema, AuthClearLoginPortalSelectionSchema, AuthCreateDeviceDeploymentResponseSchema, AuthCreateDeviceDeploymentSchema, AuthCreatePortalResponseSchema, AuthCreatePortalSchema, AuthCreateServiceDeploymentResponseSchema, AuthCreateServiceDeploymentSchema, AuthDecideDeviceActivationReviewResponseSchema, AuthDecideDeviceActivationReviewSchema, AuthDeviceActivatedEventSchema, AuthDeviceActivationApprovedEventSchema, AuthDeviceActivationRequestedEventSchema, AuthDeviceActivationReviewRequestedEventSchema, AuthDisableDeviceDeploymentResponseSchema, AuthDisableDeviceDeploymentSchema, AuthDisableDeviceInstanceResponseSchema, AuthDisableDeviceInstanceSchema, AuthDisableInstanceGrantPolicyResponseSchema, AuthDisableInstanceGrantPolicySchema, AuthDisablePortalProfileResponseSchema, AuthDisablePortalProfileSchema, AuthDisablePortalResponseSchema, AuthDisablePortalSchema, AuthDisableServiceDeploymentResponseSchema, AuthDisableServiceDeploymentSchema, AuthDisableServiceInstanceResponseSchema, AuthDisableServiceInstanceSchema, AuthEnableDeviceDeploymentResponseSchema, AuthEnableDeviceDeploymentSchema, AuthEnableDeviceInstanceResponseSchema, AuthEnableDeviceInstanceSchema, AuthEnableServiceDeploymentResponseSchema, AuthEnableServiceDeploymentSchema, AuthEnableServiceInstanceResponseSchema, AuthEnableServiceInstanceSchema, AuthenticatedDeviceSchema, AuthGetDeviceConnectInfoResponseSchema, AuthGetDeviceConnectInfoSchema, AuthGetDevicePortalDefaultResponseSchema, AuthGetDevicePortalDefaultSchema, AuthGetInstalledContractResponseSchema, AuthGetInstalledContractSchema, AuthGetLoginPortalDefaultResponseSchema, AuthGetLoginPortalDefaultSchema, AuthListApprovalsResponseSchema, AuthListApprovalsSchema, AuthListDeviceActivationReviewsResponseSchema, AuthListDeviceActivationReviewsSchema, AuthListDeviceActivationsResponseSchema, AuthListDeviceActivationsSchema, AuthListDeviceDeploymentsResponseSchema, AuthListDeviceDeploymentsSchema, AuthListDeviceInstancesResponseSchema, AuthListDeviceInstancesSchema, AuthListDevicePortalSelectionsResponseSchema, AuthListDevicePortalSelectionsSchema, AuthListInstalledContractsResponseSchema, AuthListInstalledContractsSchema, AuthListInstanceGrantPoliciesResponseSchema, AuthListInstanceGrantPoliciesSchema, AuthListLoginPortalSelectionsResponseSchema, AuthListLoginPortalSelectionsSchema, AuthListPortalProfilesResponseSchema, AuthListPortalProfilesSchema, AuthListPortalsResponseSchema, AuthListPortalsSchema, AuthListServiceDeploymentsResponseSchema, AuthListServiceDeploymentsSchema, AuthListServiceInstancesResponseSchema, AuthListServiceInstancesSchema, AuthListUserGrantsResponseSchema, AuthListUserGrantsSchema, AuthListUsersResponseSchema, AuthListUsersSchema, AuthMeResponseSchema, AuthMeSchema, AuthProvisionDeviceInstanceResponseSchema, AuthProvisionDeviceInstanceSchema, AuthProvisionServiceInstanceResponseSchema, AuthProvisionServiceInstanceSchema, AuthRemoveDeviceDeploymentResponseSchema, AuthRemoveDeviceDeploymentSchema, AuthRemoveDeviceInstanceResponseSchema, AuthRemoveDeviceInstanceSchema, AuthRemoveServiceDeploymentResponseSchema, AuthRemoveServiceDeploymentSchema, AuthRemoveServiceInstanceResponseSchema, AuthRemoveServiceInstanceSchema, AuthRevokeApprovalResponseSchema, AuthRevokeApprovalSchema, AuthRevokeDeviceActivationResponseSchema, AuthRevokeDeviceActivationSchema, AuthRevokeUserGrantResponseSchema, AuthRevokeUserGrantSchema, AuthSetDevicePortalDefaultResponseSchema, AuthSetDevicePortalDefaultSchema, AuthSetDevicePortalSelectionResponseSchema, AuthSetDevicePortalSelectionSchema, AuthSetLoginPortalDefaultResponseSchema, AuthSetLoginPortalDefaultSchema, AuthSetLoginPortalSelectionResponseSchema, AuthSetLoginPortalSelectionSchema, AuthSetPortalProfileResponseSchema, AuthSetPortalProfileSchema, AuthUnapplyDeviceDeploymentContractResponseSchema, AuthUnapplyDeviceDeploymentContractSchema, AuthUnapplyServiceDeploymentContractResponseSchema, AuthUnapplyServiceDeploymentContractSchema, AuthUpdateUserResponseSchema, AuthUpdateUserSchema, AuthUpsertInstanceGrantPolicyResponseSchema, AuthUpsertInstanceGrantPolicySchema, AuthValidateRequestResponseSchema, AuthValidateRequestSchema, CallerViewSchema, ContractAnalysisSchema, ContractAnalysisSummarySchema, DeviceActivationRecordSchema, DeviceActivationReviewSchema, DeviceConnectInfoSchema, DeviceDeploymentSchema, DevicePortalDefaultSchema, DevicePortalSelectionSchema, DeviceSchema, DigestSchema, InstalledContractDetailSchema, InstalledContractSchema, InstanceGrantPolicySchema, LoginPortalDefaultSchema, LoginPortalSelectionSchema, OpenObjectSchema, ParticipantKindSchema, PortalFlowStateSchema, PortalProfileSchema, PortalSchema, ServiceDeploymentSchema, ServiceInstanceSchema, UserGrantViewSchema, UserViewSchema, WaitForDeviceActivationResponseSchema, } from "./protocol.js";
+export { ApprovalDecisionSchema, AuthStartFlowResponseSchema, AuthStartRequestSchema, AuthStartResponseSchema, BindResponseSchema, BindSuccessResponseSchema, ClientTransportEndpointsSchema, ClientTransportsSchema, ContractApprovalSchema, NatsAuthTokenV1Schema, SentinelCredsSchema, UserParticipantKindSchema, } from "./schemas.js";
+export { buildNatsConnectSignaturePayload, createAuth, } from "./session_auth.js";
+export { correctedIatSeconds, estimateMidpointClockOffsetMs } from "./time.js";
+export { trellisIdFromOriginId } from "./trellis_id.js";
+export { base64urlDecode, base64urlEncode, canonicalizeJsonValue, sha256, toArrayBuffer, utf8, } from "./utils.js";

package/esm/npm/src/auth/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../../src/auth/proof.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,UAAU,GACtB,UAAU,CA8BZ;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,SAAS,EACrB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,WAAW,CAC/B,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/esm/npm/src/auth/proof.js

@@ -0,0 +1,43 @@
+import { base64urlDecode, base64urlEncode, sha256, toArrayBuffer, utf8, } from "./utils.js";
+import { importEd25519PublicKeyFromBase64url } from "./keys.js";
+import { AsyncResult } from "@qlever-llc/result";
+export function buildProofInput(sessionKey, subject, payloadHash) {
+    const sessionKeyBytes = utf8(sessionKey);
+    const subjectBytes = utf8(subject);
+    const buf = new Uint8Array(4 +
+        sessionKeyBytes.length +
+        4 +
+        subjectBytes.length +
+        4 +
+        payloadHash.length);
+    const view = new DataView(buf.buffer);
+    let offset = 0;
+    view.setUint32(offset, sessionKeyBytes.length);
+    offset += 4;
+    buf.set(sessionKeyBytes, offset);
+    offset += sessionKeyBytes.length;
+    view.setUint32(offset, subjectBytes.length);
+    offset += 4;
+    buf.set(subjectBytes, offset);
+    offset += subjectBytes.length;
+    view.setUint32(offset, payloadHash.length);
+    offset += 4;
+    buf.set(payloadHash, offset);
+    return buf;
+}
+export async function createProof(privateKey, params) {
+    const input = buildProofInput(params.sessionKey, params.subject, params.payloadHash);
+    const digest = await sha256(input);
+    const sig = await crypto.subtle.sign({ name: "Ed25519" }, privateKey, toArrayBuffer(digest));
+    return base64urlEncode(new Uint8Array(sig));
+}
+export async function verifyProof(publicSessionKey, params, proofBase64url) {
+    const result = await AsyncResult.try(async () => {
+        const input = buildProofInput(params.sessionKey, params.subject, params.payloadHash);
+        const digest = await sha256(input);
+        const signature = base64urlDecode(proofBase64url);
+        const pub = await importEd25519PublicKeyFromBase64url(publicSessionKey);
+        return crypto.subtle.verify({ name: "Ed25519" }, pub, toArrayBuffer(signature), toArrayBuffer(digest));
+    });
+    return result.unwrapOr(false);
+}