@sebastienrousseau/crypto-server 0.0.7 → 0.0.9

package/dist/routes/v1/decrypt.js

@@ -1,32 +1,38 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const decrypt_1 = __importDefault(require("@sebastienrousseau/crypto-lib/dist/lib/decrypt"));
+const pgp_1 = require("@sebastienrousseau/crypto-lib/pgp");
 const validation_1 = require("../../utils/validation");
 const route_helpers_1 = require("../../utils/route-helpers");
+const problem_1 = require("../../lib/problem");
+const keys_1 = require("../../utils/keys");
 const decryptSchema = {
     tags: ["Encryption"],
     summary: "Decrypt a message",
-    description: "Decrypts a PGP-encrypted message using private/public key pair and passphrase.",
+    description: "Decrypts a PGP message encrypted to the server's key pair (CRYPTO_KEY_DIR), unlocked with the passphrase. The API never takes a private key.",
     response: {
-        200: { type: "object", properties: { data: { type: "string" } } },
-        400: {
+        200: {
             type: "object",
-            properties: { error: { type: "string" }, details: { type: "array" } },
+            properties: {
+                data: {
+                    type: "object",
+                    properties: {
+                        data: { type: "string" },
+                        signatureValid: { type: "boolean" },
+                    },
+                },
+            },
         },
-        401: { type: "object", properties: { error: { type: "string" } } },
+        400: problem_1.PROBLEM_SCHEMA,
+        401: problem_1.PROBLEM_SCHEMA,
     },
     body: {
         type: "object",
-        required: ["passphrase", "message", "publicKey", "privateKey"],
+        required: ["passphrase", "message", "publicKey"],
         additionalProperties: false,
         properties: {
             passphrase: { type: "string", minLength: 1, maxLength: 1024 },
             message: { type: "string", minLength: 1, maxLength: 1024 * 1024 },
             publicKey: { type: "string", minLength: 1, maxLength: 64 * 1024 },
-            privateKey: { type: "string", minLength: 1, maxLength: 64 * 1024 },
         },
     },
 };
@@ -38,21 +44,20 @@ exports.default = (app) => {
                 passphrase: (0, validation_1.validateRequiredString)(body.passphrase, "passphrase"),
                 message: (0, validation_1.validateBase64)(body.message, "message"),
                 publicKey: (0, validation_1.validateBase64)(body.publicKey, "publicKey"),
-                privateKey: (0, validation_1.validateBase64)(body.privateKey, "privateKey"),
             }, reply);
             if (!v)
                 return;
-            const decryptedData = await (0, decrypt_1.default)({
+            const decryptedData = await (0, pgp_1.decrypt)({
                 passphrase: v.passphrase,
                 message: v.message,
                 publicKey: v.publicKey,
-                privateKey: v.privateKey,
+                privateKey: await (0, keys_1.serverPgpPrivateKey)(),
             });
             return reply.send({ data: decryptedData });
         }
         catch (error) {
             request.log.error(error, "Decryption operation failed");
-            return reply.status(500).send({ error: "Decryption failed" });
+            return (0, problem_1.sendProblem)(reply, 500, "internal-error", "Decryption failed");
         }
     });
 };

package/dist/routes/v1/encrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/encrypt.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAkC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA+BE"}
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/encrypt.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAqC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA+BE"}

package/dist/routes/v1/encrypt.js

@@ -1,22 +1,18 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const encrypt_1 = __importDefault(require("@sebastienrousseau/crypto-lib/dist/lib/encrypt"));
+const pgp_1 = require("@sebastienrousseau/crypto-lib/pgp");
 const validation_1 = require("../../utils/validation");
 const route_helpers_1 = require("../../utils/route-helpers");
+const problem_1 = require("../../lib/problem");
+const keys_1 = require("../../utils/keys");
 const encryptSchema = {
     tags: ["Encryption"],
     summary: "Encrypt a message",
     description: "Encrypts a plaintext message using the supplied PGP public key and passphrase.",
     response: {
         200: { type: "object", properties: { data: { type: "string" } } },
-        400: {
-            type: "object",
-            properties: { error: { type: "string" }, details: { type: "array" } },
-        },
-        401: { type: "object", properties: { error: { type: "string" } } },
+        400: problem_1.PROBLEM_SCHEMA,
+        401: problem_1.PROBLEM_SCHEMA,
     },
     body: {
         type: "object",
@@ -26,7 +22,10 @@ const encryptSchema = {
             passphrase: { type: "string", minLength: 1, maxLength: 1024 },
             message: { type: "string", minLength: 1, maxLength: 1024 * 1024 },
             publicKey: { type: "string", minLength: 1, maxLength: 64 * 1024 },
-            privateKey: { type: "string", minLength: 1, maxLength: 64 * 1024 },
+            sign: {
+                type: "boolean",
+                description: "Also sign with the server's key pair (CRYPTO_KEY_DIR), unlocked with the passphrase.",
+            },
         },
     },
 };
@@ -41,17 +40,17 @@ exports.default = (app) => {
             }, reply);
             if (!v)
                 return;
-            const encryptedData = await (0, encrypt_1.default)({
+            const encryptedData = await (0, pgp_1.encrypt)({
                 passphrase: v.passphrase,
                 message: v.message,
                 publicKey: v.publicKey,
-                ...(body.privateKey ? { privateKey: body.privateKey } : {}),
+                ...(body.sign ? { privateKey: await (0, keys_1.serverPgpPrivateKey)() } : {}),
             });
             return reply.send({ data: encryptedData });
         }
         catch (error) {
             request.log.error(error, "Encryption operation failed");
-            return reply.status(500).send({ error: "Encryption failed" });
+            return (0, problem_1.sendProblem)(reply, 500, "internal-error", "Encryption failed");
         }
     });
 };

package/dist/routes/v1/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/generate.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA+D/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAkEE"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/generate.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;yBAsF7C,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA8CE"}

package/dist/routes/v1/generate.js

@@ -1,12 +1,10 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const generate_1 = __importDefault(require("@sebastienrousseau/crypto-lib/dist/lib/generate"));
+const pgp_1 = require("@sebastienrousseau/crypto-lib/pgp");
 const types_1 = require("../../@types/types");
 const validation_1 = require("../../utils/validation");
 const route_helpers_1 = require("../../utils/route-helpers");
+const problem_1 = require("../../lib/problem");
 const generateSchema = {
     tags: ["Key Management"],
     summary: "Generate a key pair",
@@ -25,11 +23,8 @@ const generateSchema = {
                 warning: { type: "string" },
             },
         },
-        400: {
-            type: "object",
-            properties: { error: { type: "string" }, details: { type: "array" } },
-        },
-        401: { type: "object", properties: { error: { type: "string" } } },
+        400: problem_1.PROBLEM_SCHEMA,
+        401: problem_1.PROBLEM_SCHEMA,
     },
     body: {
         type: "object",
@@ -47,26 +42,28 @@ const generateSchema = {
         },
     },
 };
+function validateGenerateBody(body, reply) {
+    return (0, route_helpers_1.collectValidation)({
+        name: (0, validation_1.validateRequiredString)(body.name, "name"),
+        email: (0, validation_1.validateEmail)(body.email, "email"),
+        type: (0, validation_1.validateEnum)(body.type, "type", types_1.KEY_TYPES),
+        passphrase: (0, validation_1.validateRequiredString)(body.passphrase, "passphrase"),
+        curve: (0, validation_1.validateEnum)(body.curve, "curve", types_1.CURVE_TYPES),
+        format: (0, validation_1.validateEnum)(body.format, "format", types_1.FORMAT_TYPES),
+        rsaBits: (0, validation_1.validateOptionalNumber)(body.rsaBits, 2048, "rsaBits", {
+            min: 2048,
+            max: 4096,
+        }),
+        keyExpirationTime: (0, validation_1.validateOptionalNumber)(body.keyExpirationTime, 0, "keyExpirationTime", { min: 0 }),
+    }, reply);
+}
 exports.default = (app) => {
     app.post("/v1/generate", { schema: generateSchema }, async (request, reply) => {
         try {
-            const body = request.body;
-            const v = (0, route_helpers_1.collectValidation)({
-                name: (0, validation_1.validateRequiredString)(body.name, "name"),
-                email: (0, validation_1.validateEmail)(body.email, "email"),
-                type: (0, validation_1.validateEnum)(body.type, "type", types_1.KEY_TYPES),
-                passphrase: (0, validation_1.validateRequiredString)(body.passphrase, "passphrase"),
-                curve: (0, validation_1.validateEnum)(body.curve, "curve", types_1.CURVE_TYPES),
-                format: (0, validation_1.validateEnum)(body.format, "format", types_1.FORMAT_TYPES),
-                rsaBits: (0, validation_1.validateOptionalNumber)(body.rsaBits, 2048, "rsaBits", {
-                    min: 2048,
-                    max: 4096,
-                }),
-                keyExpirationTime: (0, validation_1.validateOptionalNumber)(body.keyExpirationTime, 0, "keyExpirationTime", { min: 0 }),
-            }, reply);
+            const v = validateGenerateBody(request.body, reply);
             if (!v)
                 return;
-            const generated = (await (0, generate_1.default)({
+            const generated = (await (0, pgp_1.generate)({
                 date: new Date(),
                 name: v.name,
                 email: v.email,
@@ -88,7 +85,7 @@ exports.default = (app) => {
         }
         catch (error) {
             request.log.error(error, "Key pair generation failed");
-            return reply.status(500).send({ error: "Key pair generation failed" });
+            return (0, problem_1.sendProblem)(reply, 500, "internal-error", "Key pair generation failed");
         }
     });
 };

package/dist/routes/v1/revoke.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/revoke.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA8C/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgCE"}
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/revoke.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA4C/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgCE"}

package/dist/routes/v1/revoke.js

@@ -1,12 +1,10 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const revoke_1 = __importDefault(require("@sebastienrousseau/crypto-lib/dist/lib/revoke"));
+const pgp_1 = require("@sebastienrousseau/crypto-lib/pgp");
 const types_1 = require("../../@types/types");
 const validation_1 = require("../../utils/validation");
 const route_helpers_1 = require("../../utils/route-helpers");
+const problem_1 = require("../../lib/problem");
 const revokeSchema = {
     tags: ["Key Management"],
     summary: "Revoke a key pair",
@@ -23,11 +21,8 @@ const revokeSchema = {
                 },
             },
         },
-        400: {
-            type: "object",
-            properties: { error: { type: "string" }, details: { type: "array" } },
-        },
-        401: { type: "object", properties: { error: { type: "string" } } },
+        400: problem_1.PROBLEM_SCHEMA,
+        401: problem_1.PROBLEM_SCHEMA,
     },
     body: {
         type: "object",
@@ -51,7 +46,7 @@ exports.default = (app) => {
             }, reply);
             if (!v)
                 return;
-            const revocationData = await (0, revoke_1.default)({
+            const revocationData = await (0, pgp_1.revoke)({
                 passphrase: v.passphrase,
                 flag: v.flag,
                 reason: v.reason,
@@ -60,7 +55,7 @@ exports.default = (app) => {
         }
         catch (error) {
             request.log.error(error, "Revocation operation failed");
-            return reply.status(500).send({ error: "Revocation failed" });
+            return (0, problem_1.sendProblem)(reply, 500, "internal-error", "Revocation failed");
         }
     });
 };

package/dist/routes/v1/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/verify.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAyC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiCE"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/verify.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAuC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiCE"}

package/dist/routes/v1/verify.js

@@ -1,11 +1,9 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-const verify_1 = __importDefault(require("@sebastienrousseau/crypto-lib/dist/lib/verify"));
+const pgp_1 = require("@sebastienrousseau/crypto-lib/pgp");
 const validation_1 = require("../../utils/validation");
 const route_helpers_1 = require("../../utils/route-helpers");
+const problem_1 = require("../../lib/problem");
 const verifySchema = {
     tags: ["Signing"],
     summary: "Verify a signed message",
@@ -16,11 +14,8 @@ const verifySchema = {
             additionalProperties: true,
             properties: { data: {} },
         },
-        400: {
-            type: "object",
-            properties: { error: { type: "string" }, details: { type: "array" } },
-        },
-        401: { type: "object", properties: { error: { type: "string" } } },
+        400: problem_1.PROBLEM_SCHEMA,
+        401: problem_1.PROBLEM_SCHEMA,
     },
     body: {
         type: "object",
@@ -44,7 +39,7 @@ exports.default = (app) => {
             }, reply);
             if (!v)
                 return;
-            const verifyData = await (0, verify_1.default)({
+            const verifyData = await (0, pgp_1.verify)({
                 date: v.date,
                 message: v.message,
                 verificationKeys: v.verificationKeys,
@@ -53,7 +48,7 @@ exports.default = (app) => {
         }
         catch (error) {
             request.log.error(error, "Verification operation failed");
-            return reply.status(500).send({ error: "Verification failed" });
+            return (0, problem_1.sendProblem)(reply, 500, "internal-error", "Verification failed");
         }
     });
 };

package/dist/routes/v2/algorithms.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 exports.default = (app) => {
     app.get("/v2/algorithms", {
         schema: {

package/dist/routes/v2/compliance.js

@@ -9,7 +9,7 @@ exports.buildCbom = buildCbom;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 const PACKAGES_ROOT = node_path_1.default.resolve(__dirname, "..", "..", "..", "..");
 function readPackageVersion(dir) {
     try {

package/dist/routes/v2/encrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/encrypt.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA+C/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA4BE"}
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/encrypt.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA4C/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA4BE"}

package/dist/routes/v2/encrypt.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 const route_helpers_1 = require("../../utils/route-helpers");
 const encryptSchema = {
     tags: ["Modern Encryption"],

package/dist/routes/v2/hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/hash.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAwB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiBE"}
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/hash.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAqB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiBE"}

package/dist/routes/v2/hash.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 const route_helpers_1 = require("../../utils/route-helpers");
 const hashSchema = {
     tags: ["Hashing"],

package/dist/routes/v2/kdf.d.ts

@@ -1,4 +1,9 @@
 import type { FastifyInstance } from "fastify";
+export declare const KDF_FLOORS: Readonly<{
+    scryptN: 131072;
+    scryptR: 8;
+    pbkdf2Iterations: 600000;
+}>;
 declare const _default: (app: FastifyInstance) => void;
 export default _default;
 //# sourceMappingURL=kdf.d.ts.map

package/dist/routes/v2/kdf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/kdf.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAuC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgCE"}
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/kdf.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAc/C,eAAO,MAAM,UAAU;;;;EAIrB,CAAC;yBA+Ca,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAqBE"}

package/dist/routes/v2/kdf.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+exports.KDF_FLOORS = void 0;
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 const route_helpers_1 = require("../../utils/route-helpers");
+exports.KDF_FLOORS = Object.freeze({
+    scryptN: 131072,
+    scryptR: 8,
+    pbkdf2Iterations: 600_000,
+});
 const kdfSchema = {
     tags: ["Key Derivation"],
     summary: "Derive a key from a password",
-    description: "Key derivation using scrypt, HKDF-SHA256, or PBKDF2-SHA256.",
+    description: "Key derivation using scrypt (N = 2^17, r = 8), HKDF-SHA256, or PBKDF2-SHA256 (>= 600,000 iterations). Runs on a worker thread.",
     body: {
         type: "object",
         required: ["algorithm", "password"],
@@ -19,10 +25,22 @@ const kdfSchema = {
                 type: "object",
                 additionalProperties: false,
                 properties: {
-                    N: { type: "integer", minimum: 2, maximum: 131072 },
-                    r: { type: "integer", minimum: 1, maximum: 8 },
+                    N: {
+                        type: "integer",
+                        minimum: exports.KDF_FLOORS.scryptN,
+                        maximum: exports.KDF_FLOORS.scryptN,
+                    },
+                    r: {
+                        type: "integer",
+                        minimum: exports.KDF_FLOORS.scryptR,
+                        maximum: exports.KDF_FLOORS.scryptR,
+                    },
                     p: { type: "integer", minimum: 1, maximum: 4 },
-                    iterations: { type: "integer", minimum: 1, maximum: 1000000 },
+                    iterations: {
+                        type: "integer",
+                        minimum: exports.KDF_FLOORS.pbkdf2Iterations,
+                        maximum: 1000000,
+                    },
                     info: { type: "string", maxLength: 1024 },
                 },
             },
@@ -33,17 +51,14 @@ exports.default = (app) => {
     app.post("/v2/kdf", { schema: kdfSchema }, async (request, reply) => {
         try {
             const body = request.body;
-            const result = (0, modern_1.kdfDerive)({
+            const options = {
                 algorithm: body.algorithm,
                 password: body.password,
                 ...(body.salt ? { salt: body.salt } : {}),
                 ...(body.keyLength ? { keyLength: body.keyLength } : {}),
-                ...(body.params
-                    ? {
-                        params: body.params,
-                    }
-                    : {}),
-            });
+                ...(body.params ? { params: body.params } : {}),
+            };
+            const result = await request.server.kdf.run("modern", "kdfDerive", options);
             return reply.send({ data: result });
         }
         catch (error) {

package/dist/routes/v2/key-wrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key-wrap.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/key-wrap.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA8EE"}
+{"version":3,"file":"key-wrap.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/key-wrap.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAwF/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/key-wrap.js

@@ -34,7 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+function registerKeysWrap(app) {
     app.post("/v2/keys/wrap", {
         schema: {
             tags: ["Key Wrapping"],
@@ -52,7 +52,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { aesKwWrap, aesKwpWrap } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/key-wrap")));
+            const { aesKwWrap, aesKwpWrap } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")));
             const { kek, keyToWrap, algorithm } = request.body;
             const result = algorithm === "aes-kwp"
                 ? aesKwpWrap(kek, keyToWrap)
@@ -63,6 +63,8 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key wrapping");
         }
     });
+}
+function registerKeysUnwrap(app) {
     app.post("/v2/keys/unwrap", {
         schema: {
             tags: ["Key Wrapping"],
@@ -80,7 +82,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { aesKwUnwrap, aesKwpUnwrap } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/key-wrap")));
+            const { aesKwUnwrap, aesKwpUnwrap } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")));
             const { kek, wrappedKey, algorithm } = request.body;
             const result = algorithm === "aes-kwp"
                 ? aesKwpUnwrap(kek, wrappedKey)
@@ -93,5 +95,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key unwrapping");
         }
     });
+}
+exports.default = (app) => {
+    registerKeysWrap(app);
+    registerKeysUnwrap(app);
 };
 //# sourceMappingURL=key-wrap.js.map

package/dist/routes/v2/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/keys.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA0DE"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/keys.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAiG/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/keys.js

@@ -33,12 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const keys_1 = require("@sebastienrousseau/crypto-lib/keys");
+const keys_2 = require("../../utils/keys");
+function registerGenerate(app) {
     app.post("/v2/keys/generate", {
         schema: {
             tags: ["Key Management"],
-            summary: "Generate a key pair for any supported algorithm",
+            summary: "Generate a server-held key pair for any supported algorithm",
+            description: "Generates a key pair, keeps the private key on the server and returns its keyId with the public key. Use the keyId with the signing, decryption and decapsulation routes.",
             body: {
                 type: "object",
                 additionalProperties: false,
@@ -46,20 +48,7 @@ exports.default = (app) => {
                     algorithm: {
                         default: "ed25519",
                         type: "string",
-                        enum: [
-                            "ed25519",
-                            "x25519",
-                            "ed448",
-                            "x448",
-                            "p256",
-                            "p384",
-                            "ml-kem-512",
-                            "ml-kem-768",
-                            "ml-kem-1024",
-                            "ml-dsa-44",
-                            "ml-dsa-65",
-                            "ml-dsa-87",
-                        ],
+                        enum: [...keys_1.KEY_ALGORITHMS],
                     },
                     metadata: {
                         type: "object",
@@ -74,15 +63,39 @@ exports.default = (app) => {
             },
         },
     }, async (request, reply) => {
-        try {
-            const { generateKeyPair } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/keys/keygen")));
-            const { algorithm, metadata } = request.body;
-            const result = generateKeyPair(algorithm, metadata);
-            return reply.send({ data: result });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key generation");
-        }
+        const { generateKeyPair } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/keys")));
+        const { algorithm, metadata } = request.body;
+        const pair = generateKeyPair(algorithm, metadata);
+        const stored = await (0, keys_2.storeKey)(request, pair.algorithm, { publicKey: pair.publicKey }, { privateKey: pair.privateKey });
+        return reply.send({
+            data: { ...(0, keys_2.publicView)(stored), kid: pair.kid, metadata: pair.metadata },
+        });
     });
+}
+function registerExport(app) {
+    app.post("/v2/keys/export", {
+        schema: {
+            tags: ["Key Management"],
+            summary: "Export a server-held private key",
+            description: "Returns the private key of a key pair this principal generated. Requires the crypto:keys:export scope, granted explicitly (crypto:admin does not include it).",
+            body: {
+                type: "object",
+                required: ["keyId"],
+                additionalProperties: false,
+                properties: { keyId: keys_2.KEY_ID_SCHEMA },
+            },
+        },
+    }, async (request, reply) => {
+        const { keyId } = request.body;
+        const key = await (0, keys_2.resolveKey)(request, keyId);
+        request.log.warn({ keyId }, "Private key exported");
+        return reply.send({
+            data: { ...(0, keys_2.publicView)(key), ...key.privateParts },
+        });
+    });
+}
+exports.default = (app) => {
+    registerGenerate(app);
+    registerExport(app);
 };
 //# sourceMappingURL=keys.js.map

package/dist/routes/v2/mac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mac.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/mac.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAQ/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiFE"}
+{"version":3,"file":"mac.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/mac.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA+F/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}