@qnsp/tenant-sdk 0.0.2 → 0.2.0

package/src/index.ts

@@ -34,6 +34,110 @@ type InternalTenantClientConfig = {
 
 export type TenantStatus = "active" | "suspended" | "pending" | "deleted";
 
+/**
+ * Crypto policy tier determines which PQC algorithms are allowed.
+ * Maps to tenant_crypto_policies.policy_tier in tenant-service.
+ */
+export type CryptoPolicyTier = "default" | "strict" | "maximum" | "government";
+
+/**
+ * Tenant crypto policy configuration.
+ */
+export interface TenantCryptoPolicy {
+	readonly tenantId: string;
+	readonly policyTier: CryptoPolicyTier;
+	readonly customAllowedKemAlgorithms: readonly string[] | null;
+	readonly customAllowedSignatureAlgorithms: readonly string[] | null;
+	readonly customAllowedSymmetricAlgorithms?: readonly string[] | null;
+	readonly customForbiddenAlgorithms?: readonly string[] | null;
+	readonly requireHsmForRootKeys: boolean;
+	readonly maxKeyAgeDays: number;
+	readonly enforcementMode?: "audit" | "enforce";
+	readonly createdAt: string;
+	readonly updatedAt: string;
+}
+
+/**
+ * Input for creating or updating a tenant crypto policy.
+ */
+export interface TenantCryptoPolicyInput {
+	readonly policyTier: CryptoPolicyTier;
+	readonly customAllowedKemAlgorithms?: readonly string[] | null;
+	readonly customAllowedSignatureAlgorithms?: readonly string[] | null;
+	readonly requireHsmForRootKeys?: boolean;
+	readonly maxKeyAgeDays?: number;
+}
+
+/**
+ * Algorithm configuration per crypto policy tier.
+ */
+export interface TierAlgorithmConfig {
+	readonly kemAlgorithms: readonly string[];
+	readonly signatureAlgorithms: readonly string[];
+	readonly defaultKemAlgorithm: string;
+	readonly defaultSignatureAlgorithm: string;
+}
+
+/**
+ * Default algorithms per crypto policy tier.
+ */
+export const CRYPTO_POLICY_ALGORITHMS: Record<CryptoPolicyTier, TierAlgorithmConfig> = {
+	default: {
+		kemAlgorithms: ["kyber-512", "kyber-768", "kyber-1024"],
+		signatureAlgorithms: ["dilithium-2", "dilithium-3", "dilithium-5"],
+		defaultKemAlgorithm: "kyber-768",
+		defaultSignatureAlgorithm: "dilithium-3",
+	},
+	strict: {
+		kemAlgorithms: ["kyber-768", "kyber-1024"],
+		signatureAlgorithms: ["dilithium-3", "dilithium-5", "falcon-1024"],
+		defaultKemAlgorithm: "kyber-768",
+		defaultSignatureAlgorithm: "dilithium-3",
+	},
+	maximum: {
+		kemAlgorithms: ["kyber-1024"],
+		signatureAlgorithms: ["dilithium-5", "falcon-1024", "sphincs-shake-256f-simple"],
+		defaultKemAlgorithm: "kyber-1024",
+		defaultSignatureAlgorithm: "dilithium-5",
+	},
+	government: {
+		kemAlgorithms: ["kyber-1024"],
+		signatureAlgorithms: ["dilithium-5", "sphincs-shake-256f-simple"],
+		defaultKemAlgorithm: "kyber-1024",
+		defaultSignatureAlgorithm: "dilithium-5",
+	},
+};
+
+/**
+ * Mapping from internal algorithm names to NIST standardized names.
+ */
+export const ALGORITHM_TO_NIST: Record<string, string> = {
+	"kyber-512": "ML-KEM-512",
+	"kyber-768": "ML-KEM-768",
+	"kyber-1024": "ML-KEM-1024",
+	"dilithium-2": "ML-DSA-44",
+	"dilithium-3": "ML-DSA-65",
+	"dilithium-5": "ML-DSA-87",
+	"falcon-512": "FN-DSA-512",
+	"falcon-1024": "FN-DSA-1024",
+	"sphincs-shake-128f-simple": "SLH-DSA-SHAKE-128f",
+	"sphincs-shake-256f-simple": "SLH-DSA-SHAKE-256f",
+};
+
+/**
+ * Convert internal algorithm name to NIST standardized name.
+ */
+export function toNistAlgorithmName(internal: string): string {
+	return ALGORITHM_TO_NIST[internal] ?? internal;
+}
+
+/**
+ * Get algorithm config for a crypto policy tier.
+ */
+export function getAlgorithmConfigForTier(tier: CryptoPolicyTier): TierAlgorithmConfig {
+	return CRYPTO_POLICY_ALGORITHMS[tier];
+}
+
 export interface TenantSecurityEnvelope {
 	readonly controlPlaneTokenSha256: string | null;
 	readonly pqcSignatures: readonly {
@@ -353,6 +457,90 @@ export class TenantClient {
 			operation: "listTenants",
 		});
 	}
+
+	/**
+	 * Get the crypto policy for a tenant.
+	 * Returns the tenant's crypto policy configuration including allowed algorithms.
+	 * If no policy exists, a default policy is created and returned.
+	 */
+	async getTenantCryptoPolicy(tenantId: string): Promise<TenantCryptoPolicy> {
+		validateUUID(tenantId, "tenantId");
+
+		return this.request<TenantCryptoPolicy>("GET", `/tenant/v1/tenants/${tenantId}/crypto-policy`, {
+			operation: "getTenantCryptoPolicy",
+		});
+	}
+
+	/**
+	 * Create or update the crypto policy for a tenant.
+	 * Sets the policy tier and optional custom algorithm restrictions.
+	 */
+	async upsertTenantCryptoPolicy(
+		tenantId: string,
+		policy: TenantCryptoPolicyInput,
+	): Promise<TenantCryptoPolicy> {
+		validateUUID(tenantId, "tenantId");
+
+		return this.request<TenantCryptoPolicy>("PUT", `/tenant/v1/tenants/${tenantId}/crypto-policy`, {
+			body: {
+				policyTier: policy.policyTier,
+				...(policy.customAllowedKemAlgorithms !== undefined
+					? { customAllowedKemAlgorithms: policy.customAllowedKemAlgorithms }
+					: {}),
+				...(policy.customAllowedSignatureAlgorithms !== undefined
+					? { customAllowedSignatureAlgorithms: policy.customAllowedSignatureAlgorithms }
+					: {}),
+				...(policy.requireHsmForRootKeys !== undefined
+					? { requireHsmForRootKeys: policy.requireHsmForRootKeys }
+					: {}),
+				...(policy.maxKeyAgeDays !== undefined ? { maxKeyAgeDays: policy.maxKeyAgeDays } : {}),
+			},
+			operation: "upsertTenantCryptoPolicy",
+		});
+	}
+
+	/**
+	 * Get the allowed KEM algorithms for a tenant based on their crypto policy.
+	 * Convenience method that fetches the policy and returns the allowed algorithms.
+	 */
+	async getAllowedKemAlgorithms(tenantId: string): Promise<readonly string[]> {
+		const policy = await this.getTenantCryptoPolicy(tenantId);
+		if (policy.customAllowedKemAlgorithms && policy.customAllowedKemAlgorithms.length > 0) {
+			return policy.customAllowedKemAlgorithms;
+		}
+		return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].kemAlgorithms;
+	}
+
+	/**
+	 * Get the allowed signature algorithms for a tenant based on their crypto policy.
+	 * Convenience method that fetches the policy and returns the allowed algorithms.
+	 */
+	async getAllowedSignatureAlgorithms(tenantId: string): Promise<readonly string[]> {
+		const policy = await this.getTenantCryptoPolicy(tenantId);
+		if (
+			policy.customAllowedSignatureAlgorithms &&
+			policy.customAllowedSignatureAlgorithms.length > 0
+		) {
+			return policy.customAllowedSignatureAlgorithms;
+		}
+		return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].signatureAlgorithms;
+	}
+
+	/**
+	 * Get the default KEM algorithm for a tenant based on their crypto policy tier.
+	 */
+	async getDefaultKemAlgorithm(tenantId: string): Promise<string> {
+		const policy = await this.getTenantCryptoPolicy(tenantId);
+		return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].defaultKemAlgorithm;
+	}
+
+	/**
+	 * Get the default signature algorithm for a tenant based on their crypto policy tier.
+	 */
+	async getDefaultSignatureAlgorithm(tenantId: string): Promise<string> {
+		const policy = await this.getTenantCryptoPolicy(tenantId);
+		return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].defaultSignatureAlgorithm;
+	}
 }
 
 export * from "./observability.js";