@sebastienrousseau/crypto-server 0.0.8 → 0.0.24

package/dist/routes/v2/kms.js

@@ -0,0 +1,310 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerKmsProvider = registerKmsProvider;
+exports.resetKmsProviders = resetKmsProviders;
+exports.resolveKmsProvider = resolveKmsProvider;
+exports.default = kmsRoute;
+const crypto_kms_1 = require("@sebastienrousseau/crypto-kms");
+const route_helpers_1 = require("../../utils/route-helpers");
+const providerRegistry = new Map();
+providerRegistry.set("local", new crypto_kms_1.LocalKmsProvider());
+function registerKmsProvider(name, provider) {
+    providerRegistry.set(name.toLowerCase(), provider);
+}
+function resetKmsProviders() {
+    providerRegistry.clear();
+    providerRegistry.set("local", new crypto_kms_1.LocalKmsProvider());
+}
+function createAwsProvider() {
+    return new crypto_kms_1.AwsKmsProvider({
+        region: process.env["AWS_REGION"] ?? "us-east-1",
+    });
+}
+function createGcpProvider() {
+    return new crypto_kms_1.GcpKmsProvider({
+        projectId: process.env["GCP_PROJECT_ID"] ?? "test-project",
+        locationId: process.env["GCP_LOCATION_ID"] ?? "global",
+        keyRingId: process.env["GCP_KEY_RING_ID"] ?? "test-ring",
+        token: process.env["GCP_AUTH_TOKEN"] ?? "test-token",
+    });
+}
+function createVaultProvider() {
+    return new crypto_kms_1.VaultKmsProvider({
+        address: process.env["VAULT_ADDR"] ?? "http://localhost:8200",
+        token: process.env["VAULT_TOKEN"] ?? "test-token",
+    });
+}
+function createAzureProvider() {
+    return new crypto_kms_1.AzureKmsProvider({
+        vaultUrl: process.env["AZURE_VAULT_URL"] ?? "https://my-vault.vault.azure.net",
+    });
+}
+function createDefaultProvider(key, name) {
+    switch (key) {
+        case "aws":
+            return createAwsProvider();
+        case "gcp":
+            return createGcpProvider();
+        case "vault":
+            return createVaultProvider();
+        case "azure":
+            return createAzureProvider();
+        default:
+            throw new Error(`Unsupported KMS provider: ${name}`);
+    }
+}
+function resolveKmsProvider(name) {
+    const key = (name ?? "local").toLowerCase();
+    const existing = providerRegistry.get(key);
+    if (existing)
+        return existing;
+    const provider = createDefaultProvider(key, name);
+    providerRegistry.set(key, provider);
+    return provider;
+}
+function parseBytes(text) {
+    const isHex = /^[0-9a-fA-F]*$/.test(text) && text.length % 2 === 0;
+    return isHex
+        ? new Uint8Array(Buffer.from(text, "hex"))
+        : new Uint8Array(Buffer.from(text, "utf8"));
+}
+function sanitizeKeyId(id) {
+    if (typeof id !== "string" ||
+        !/^[a-zA-Z0-9_\-/:.]+$/.test(id) ||
+        id.includes("..")) {
+        throw new Error("Invalid keyId format");
+    }
+    return encodeURIComponent(id).replace(/%2F/g, "/").replace(/%3A/g, ":");
+}
+const CREATE_KEY_SCHEMA = {
+    tags: ["KMS"],
+    summary: "Create a managed key in the designated KMS provider",
+    body: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            provider: { type: "string" },
+            algorithm: { type: "string" },
+            usage: { type: "string", enum: ["encrypt", "sign", "wrap"] },
+            metadata: { type: "object", additionalProperties: { type: "string" } },
+        },
+    },
+};
+const WRAP_SCHEMA = {
+    tags: ["KMS"],
+    summary: "Wrap an existing key using a managed KMS key",
+    body: {
+        type: "object",
+        required: ["keyId", "unwrappedKey"],
+        additionalProperties: false,
+        properties: {
+            keyId: { type: "string" },
+            unwrappedKey: { type: "string" },
+            provider: { type: "string" },
+            context: { type: "object", additionalProperties: { type: "string" } },
+        },
+    },
+};
+const UNWRAP_SCHEMA = {
+    tags: ["KMS"],
+    summary: "Unwrap a wrapped key using a managed KMS key",
+    body: {
+        type: "object",
+        required: ["keyId", "wrappedKey"],
+        additionalProperties: false,
+        properties: {
+            keyId: { type: "string" },
+            wrappedKey: { type: "string" },
+            provider: { type: "string" },
+            context: { type: "object", additionalProperties: { type: "string" } },
+        },
+    },
+};
+const DATA_KEY_SCHEMA = {
+    tags: ["KMS"],
+    summary: "Generate a Data Encryption Key (DEK) via KMS provider",
+    body: {
+        type: "object",
+        required: ["keyId"],
+        additionalProperties: false,
+        properties: {
+            keyId: { type: "string" },
+            provider: { type: "string" },
+            keySpec: { type: "string" },
+        },
+    },
+};
+const ENCRYPT_SCHEMA = {
+    tags: ["KMS"],
+    summary: "Encrypt plaintext with a managed KMS key",
+    body: {
+        type: "object",
+        required: ["keyId", "plaintext"],
+        additionalProperties: false,
+        properties: {
+            keyId: { type: "string" },
+            plaintext: { type: "string" },
+            provider: { type: "string" },
+            context: { type: "object", additionalProperties: { type: "string" } },
+        },
+    },
+};
+const DECRYPT_SCHEMA = {
+    tags: ["KMS"],
+    summary: "Decrypt ciphertext with a managed KMS key",
+    body: {
+        type: "object",
+        required: ["keyId", "ciphertext"],
+        additionalProperties: false,
+        properties: {
+            keyId: { type: "string" },
+            ciphertext: { type: "string" },
+            provider: { type: "string" },
+            context: { type: "object", additionalProperties: { type: "string" } },
+        },
+    },
+};
+function registerCreateKey(app) {
+    app.post("/v2/kms/create-key", {
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+        schema: CREATE_KEY_SCHEMA,
+    }, async (request, reply) => {
+        const b = request.body;
+        try {
+            const provider = resolveKmsProvider(b["provider"]);
+            const meta = await provider.createKey(b["algorithm"] ?? "aes-256-gcm", b["usage"] ?? "encrypt", b["metadata"]);
+            return reply.send({ data: meta });
+        }
+        catch (err) {
+            return (0, route_helpers_1.classifyCryptoError)(err, request, reply, "KMS CreateKey");
+        }
+    });
+}
+function registerWrap(app) {
+    app.post("/v2/kms/wrap", {
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+        schema: WRAP_SCHEMA,
+    }, async (request, reply) => {
+        const b = request.body;
+        try {
+            const provider = resolveKmsProvider(b["provider"]);
+            if (!provider.wrapKey) {
+                throw new Error(`Provider ${provider.name} does not support wrapKey`);
+            }
+            const keyId = sanitizeKeyId(b["keyId"]);
+            const bytes = parseBytes(b["unwrappedKey"]);
+            const res = await provider.wrapKey(keyId, bytes, b["context"]);
+            return reply.send({
+                data: { ...res, provider: provider.name },
+            });
+        }
+        catch (err) {
+            return (0, route_helpers_1.classifyCryptoError)(err, request, reply, "KMS Wrap");
+        }
+    });
+}
+function registerUnwrap(app) {
+    app.post("/v2/kms/unwrap", {
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+        schema: UNWRAP_SCHEMA,
+    }, async (request, reply) => {
+        const b = request.body;
+        try {
+            const provider = resolveKmsProvider(b["provider"]);
+            if (!provider.unwrapKey) {
+                throw new Error(`Provider ${provider.name} does not support unwrapKey`);
+            }
+            const keyId = sanitizeKeyId(b["keyId"]);
+            const res = await provider.unwrapKey(keyId, b["wrappedKey"], b["context"]);
+            return reply.send({
+                data: {
+                    unwrappedKey: Buffer.from(res.unwrappedKey).toString("hex"),
+                    keyId: res.keyId,
+                    provider: provider.name,
+                },
+            });
+        }
+        catch (err) {
+            return (0, route_helpers_1.classifyCryptoError)(err, request, reply, "KMS Unwrap");
+        }
+    });
+}
+function registerDataKey(app) {
+    app.post("/v2/kms/generate-data-key", {
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+        schema: DATA_KEY_SCHEMA,
+    }, async (request, reply) => {
+        const b = request.body;
+        try {
+            const provider = resolveKmsProvider(b["provider"]);
+            const keyId = sanitizeKeyId(b["keyId"]);
+            const res = await provider.generateDataKey(keyId, b["keySpec"]);
+            return reply.send({
+                data: {
+                    plaintext: Buffer.from(res.plaintext).toString("hex"),
+                    ciphertext: res.ciphertext,
+                    keyId,
+                    provider: provider.name,
+                },
+            });
+        }
+        catch (err) {
+            return (0, route_helpers_1.classifyCryptoError)(err, request, reply, "KMS GenerateDataKey");
+        }
+    });
+}
+function registerEncrypt(app) {
+    app.post("/v2/kms/encrypt", {
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+        schema: ENCRYPT_SCHEMA,
+    }, async (request, reply) => {
+        const b = request.body;
+        try {
+            const provider = resolveKmsProvider(b["provider"]);
+            const keyId = sanitizeKeyId(b["keyId"]);
+            const bytes = parseBytes(b["plaintext"]);
+            const res = await provider.encrypt(keyId, bytes, b["context"]);
+            return reply.send({
+                data: { ...res, provider: provider.name },
+            });
+        }
+        catch (err) {
+            return (0, route_helpers_1.classifyCryptoError)(err, request, reply, "KMS Encrypt");
+        }
+    });
+}
+function registerDecrypt(app) {
+    app.post("/v2/kms/decrypt", {
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+        schema: DECRYPT_SCHEMA,
+    }, async (request, reply) => {
+        const b = request.body;
+        try {
+            const provider = resolveKmsProvider(b["provider"]);
+            const keyId = sanitizeKeyId(b["keyId"]);
+            const res = await provider.decrypt(keyId, b["ciphertext"], b["context"]);
+            const utf8 = Buffer.from(res.plaintext).toString("utf8");
+            const hex = Buffer.from(res.plaintext).toString("hex");
+            return reply.send({
+                data: {
+                    plaintext: utf8,
+                    hex,
+                    keyId: res.keyId,
+                    provider: provider.name,
+                },
+            });
+        }
+        catch (err) {
+            return (0, route_helpers_1.classifyCryptoError)(err, request, reply, "KMS Decrypt");
+        }
+    });
+}
+function kmsRoute(app) {
+    registerCreateKey(app);
+    registerWrap(app);
+    registerUnwrap(app);
+    registerDataKey(app);
+    registerEncrypt(app);
+    registerDecrypt(app);
+}
+//# sourceMappingURL=kms.js.map

package/dist/routes/v2/mac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mac.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/mac.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAQ/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiFE"}
+{"version":3,"file":"mac.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/mac.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAgG/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/mac.js

@@ -35,7 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
 const HMAC_ALGORITHMS = ["sha256", "sha384", "sha512", "sha3-256", "sha3-512"];
-exports.default = (app) => {
+function registerHmac(app) {
     app.post("/v2/hmac", {
         schema: {
             tags: ["MAC"],
@@ -53,7 +53,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { computeHmac } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/mac")));
+            const { computeHmac } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
             const body = request.body;
             const result = computeHmac({
                 algorithm: body.algorithm,
@@ -66,6 +66,8 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "HMAC computation");
         }
     });
+}
+function registerHmacVerify(app) {
     app.post("/v2/hmac/verify", {
         schema: {
             tags: ["MAC"],
@@ -82,9 +84,10 @@ exports.default = (app) => {
                 },
             },
         },
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
     }, async (request, reply) => {
         try {
-            const { verifyHmac } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/modern/mac")));
+            const { verifyHmac } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/modern")));
             const body = request.body;
             const result = verifyHmac({
                 algorithm: body.algorithm,
@@ -98,5 +101,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "HMAC verification");
         }
     });
+}
+exports.default = (app) => {
+    registerHmac(app);
+    registerHmacVerify(app);
 };
 //# sourceMappingURL=mac.js.map

package/dist/routes/v2/multi-recipient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multi-recipient.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/multi-recipient.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgEE"}
+{"version":3,"file":"multi-recipient.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/multi-recipient.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAuB/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAiDE"}

package/dist/routes/v2/multi-recipient.js

@@ -34,6 +34,16 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
+function toLibRecipient(r) {
+    if (r.type === "classical") {
+        return { type: "x25519", publicKey: r.publicKey };
+    }
+    return {
+        type: "x25519-ml-kem-768",
+        x25519PublicKey: r.publicKey,
+        mlKemPublicKey: r.mlKemPublicKey,
+    };
+}
 exports.default = (app) => {
     app.post("/v2/multi-recipient/encrypt", {
         schema: {
@@ -66,18 +76,9 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { multiEncrypt } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/multi-recipient")));
+            const { multiEncrypt } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")));
             const { plaintext, recipients } = request.body;
-            const libRecipients = recipients.map((r) => {
-                if (r.type === "classical") {
-                    return { type: "x25519", publicKey: r.publicKey };
-                }
-                return {
-                    type: "x25519-ml-kem-768",
-                    x25519PublicKey: r.publicKey,
-                    mlKemPublicKey: r.mlKemPublicKey,
-                };
-            });
+            const libRecipients = recipients.map(toLibRecipient);
             return reply.send({ data: multiEncrypt(libRecipients, plaintext) });
         }
         catch (error) {

package/dist/routes/v2/opaque.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+declare const _default: (app: FastifyInstance) => void;
+export default _default;
+//# sourceMappingURL=opaque.d.ts.map

package/dist/routes/v2/opaque.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/opaque.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAoQ/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAKE"}

package/dist/routes/v2/opaque.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const problem_1 = require("../../lib/problem");
+const route_helpers_1 = require("../../utils/route-helpers");
+const { pake } = crypto_lib_1.protocols;
+function parseHex(hex) {
+    if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex)) {
+        throw new crypto_lib_1.CryptoError("Invalid hex string", "INVALID_HEX");
+    }
+    return new Uint8Array(Buffer.from(hex, "hex"));
+}
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+const OPAQUE_RATE_LIMIT = Object.freeze({
+    config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+});
+const SUPPORTED_SUITES = ["P256-SHA256", "ristretto255-SHA512"];
+const REGISTER_INIT_SCHEMA = {
+    tags: ["OPAQUE"],
+    summary: "Initiate OPAQUE credential registration",
+    description: "Evaluates the client's blinded registration request using the server's OPRF seed.",
+    body: {
+        type: "object",
+        required: ["credentialIdentifier", "request"],
+        additionalProperties: false,
+        properties: {
+            credentialIdentifier: { type: "string", minLength: 1, maxLength: 256 },
+            request: { type: "string", minLength: 2, pattern: "^[0-9a-fA-F]+$" },
+            suite: { type: "string", enum: SUPPORTED_SUITES },
+        },
+    },
+};
+const REGISTER_FINISH_SCHEMA = {
+    tags: ["OPAQUE"],
+    summary: "Finish OPAQUE credential registration",
+    description: "Stores the client's registration record under their credential identifier.",
+    body: {
+        type: "object",
+        required: ["credentialIdentifier", "record"],
+        additionalProperties: false,
+        properties: {
+            credentialIdentifier: { type: "string", minLength: 1, maxLength: 256 },
+            record: { type: "string", minLength: 2, pattern: "^[0-9a-fA-F]+$" },
+            suite: { type: "string", enum: SUPPORTED_SUITES },
+        },
+    },
+};
+const LOGIN_INIT_SCHEMA = {
+    tags: ["OPAQUE"],
+    summary: "Initiate OPAQUE login handshake",
+    description: "Evaluates client's KE1 and returns KE2 along with a transient login session identifier.",
+    body: {
+        type: "object",
+        required: ["credentialIdentifier", "ke1"],
+        additionalProperties: false,
+        properties: {
+            credentialIdentifier: { type: "string", minLength: 1, maxLength: 256 },
+            ke1: { type: "string", minLength: 2, pattern: "^[0-9a-fA-F]+$" },
+            suite: { type: "string", enum: SUPPORTED_SUITES },
+        },
+    },
+};
+const LOGIN_FINISH_SCHEMA = {
+    tags: ["OPAQUE"],
+    summary: "Finish OPAQUE login handshake",
+    description: "Verifies client's KE3 auth response in constant time and returns the shared session key.",
+    body: {
+        type: "object",
+        required: ["sessionId", "ke3"],
+        additionalProperties: false,
+        properties: {
+            sessionId: { type: "string", minLength: 1, maxLength: 128 },
+            ke3: { type: "string", minLength: 2, pattern: "^[0-9a-fA-F]+$" },
+        },
+    },
+};
+function registerRegisterInit(app) {
+    app.post("/v2/opaque/register/init", { ...OPAQUE_RATE_LIMIT, schema: REGISTER_INIT_SCHEMA }, async (request, reply) => {
+        try {
+            const body = request.body;
+            const suite = body.suite ?? "P256-SHA256";
+            const store = request.server.opaqueStore;
+            const setup = store.getSetup(suite);
+            const reqBytes = parseHex(body.request);
+            const regReq = pake.deserializeRegistrationRequest(reqBytes, suite);
+            const regRes = pake.createRegistrationResponse(regReq, setup.serverPublicKey, body.credentialIdentifier, setup.oprfSeed, { suite });
+            const responseBytes = pake.serializeRegistrationResponse(regRes);
+            return reply.send({ data: { response: toHex(responseBytes) } });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "OPAQUE registration init");
+        }
+    });
+}
+function registerRegisterFinish(app) {
+    app.post("/v2/opaque/register/finish", { ...OPAQUE_RATE_LIMIT, schema: REGISTER_FINISH_SCHEMA }, async (request, reply) => {
+        try {
+            const body = request.body;
+            const suite = body.suite ?? "P256-SHA256";
+            const store = request.server.opaqueStore;
+            if (store.hasRecord(body.credentialIdentifier)) {
+                return (0, problem_1.sendProblem)(reply, 409, "conflict", "Credential identifier is already registered", { code: "CREDENTIAL_EXISTS" });
+            }
+            const recBytes = parseHex(body.record);
+            const record = pake.deserializeRegistrationRecord(recBytes, suite);
+            store.setRecord(body.credentialIdentifier, record);
+            return reply.send({
+                data: {
+                    status: "registered",
+                    credentialIdentifier: body.credentialIdentifier,
+                },
+            });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "OPAQUE registration finish");
+        }
+    });
+}
+function registerLoginInit(app) {
+    app.post("/v2/opaque/login/init", { ...OPAQUE_RATE_LIMIT, schema: LOGIN_INIT_SCHEMA }, async (request, reply) => {
+        try {
+            const body = request.body;
+            const suite = body.suite ?? "P256-SHA256";
+            const store = request.server.opaqueStore;
+            const setup = store.getSetup(suite);
+            const record = store.getRecord(body.credentialIdentifier) ??
+                store.getFakeRecord(suite);
+            const ke1Bytes = parseHex(body.ke1);
+            const ke1 = pake.deserializeKE1(ke1Bytes, suite);
+            const { ke2, state } = pake.generateKE2({
+                serverPrivateKey: setup.serverPrivateKey,
+                serverPublicKey: setup.serverPublicKey,
+                oprfSeed: setup.oprfSeed,
+                record,
+                credentialIdentifier: body.credentialIdentifier,
+                ke1,
+            }, { suite });
+            const sessionId = store.createSession(body.credentialIdentifier, state, suite);
+            const ke2Bytes = pake.serializeKE2(ke2);
+            return reply.send({ data: { sessionId, ke2: toHex(ke2Bytes) } });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "OPAQUE login init");
+        }
+    });
+}
+function registerLoginFinish(app) {
+    app.post("/v2/opaque/login/finish", { ...OPAQUE_RATE_LIMIT, schema: LOGIN_FINISH_SCHEMA }, async (request, reply) => {
+        try {
+            const body = request.body;
+            const store = request.server.opaqueStore;
+            const session = store.consumeSession(body.sessionId);
+            if (!session) {
+                return (0, problem_1.sendProblem)(reply, 400, "invalid-input", "Invalid or expired login session", { code: "INVALID_SESSION" });
+            }
+            const ke3Bytes = parseHex(body.ke3);
+            const ke3 = pake.deserializeKE3(ke3Bytes, session.suite);
+            const sessionKey = pake.serverFinish(session.serverState, ke3);
+            return reply.send({ data: { sessionKey: toHex(sessionKey) } });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "OPAQUE login finish");
+        }
+    });
+}
+exports.default = (app) => {
+    registerRegisterInit(app);
+    registerRegisterFinish(app);
+    registerLoginInit(app);
+    registerLoginFinish(app);
+};
+//# sourceMappingURL=opaque.js.map

package/dist/routes/v2/password-encrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/password-encrypt.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAsEE"}
+{"version":3,"file":"password-encrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/password-encrypt.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAoF/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}