@sebastienrousseau/crypto-server 0.0.8 → 0.0.24

package/dist/routes/v2/sealedbox.js

@@ -34,7 +34,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const keys_1 = require("../../utils/keys");
+const loadSealedbox = async () => (await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")))).sealedbox;
+function registerSeal(app) {
     app.post("/v2/sealedbox/seal", {
         schema: {
             tags: ["Sealed Box"],
@@ -51,7 +53,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { seal } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/sealedbox")));
+            const { seal } = await loadSealedbox();
             const { recipientPublicKey, plaintext } = request.body;
             return reply.send({ data: seal(recipientPublicKey, plaintext) });
         }
@@ -59,25 +61,29 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
         }
     });
+}
+function registerOpen(app) {
     app.post("/v2/sealedbox/open", {
         schema: {
             tags: ["Sealed Box"],
             summary: "Decrypt an anonymous sealed box (X25519)",
+            description: "Opens a sealed box with a server-held x25519 key (keyId from POST /v2/keys/generate).",
             body: {
                 type: "object",
-                required: ["recipientSecretKey", "sealed"],
+                required: ["keyId", "sealed"],
                 additionalProperties: false,
                 properties: {
-                    recipientSecretKey: { type: "string", minLength: 1 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     sealed: { type: "string", minLength: 1 },
                 },
             },
         },
     }, async (request, reply) => {
+        const { keyId, sealed } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["x25519"]);
         try {
-            const { open } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/sealedbox")));
-            const { recipientSecretKey, sealed } = request.body;
-            const plaintext = open(recipientSecretKey, sealed);
+            const { open } = await loadSealedbox();
+            const plaintext = open(key.privateParts["privateKey"], sealed);
             return reply.send({
                 data: Buffer.from(plaintext).toString("utf8"),
             });
@@ -86,6 +92,8 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
         }
     });
+}
+function registerSealPq(app) {
     app.post("/v2/sealedbox/seal-pq", {
         schema: {
             tags: ["Sealed Box"],
@@ -103,7 +111,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { sealPQ } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/sealedbox")));
+            const { sealPQ } = await loadSealedbox();
             const { x25519PublicKey, mlKemPublicKey, plaintext } = request.body;
             return reply.send({
                 data: sealPQ(x25519PublicKey, mlKemPublicKey, plaintext),
@@ -113,26 +121,30 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
         }
     });
+}
+function registerOpenPq(app) {
     app.post("/v2/sealedbox/open-pq", {
         schema: {
             tags: ["Sealed Box"],
             summary: "Decrypt a post-quantum sealed box (X25519 + ML-KEM-768)",
+            description: "Opens a hybrid sealed box with a server-held x25519-ml-kem-768 key (keyId from POST /v2/pq/hybrid/keygen).",
             body: {
                 type: "object",
-                required: ["x25519SecretKey", "mlKemSecretKey", "sealed"],
+                required: ["keyId", "sealed"],
                 additionalProperties: false,
                 properties: {
-                    x25519SecretKey: { type: "string", minLength: 1 },
-                    mlKemSecretKey: { type: "string", minLength: 1 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     sealed: { type: "string", minLength: 1 },
                 },
             },
         },
     }, async (request, reply) => {
+        const { keyId, sealed } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["x25519-ml-kem-768"]);
         try {
-            const { openPQ } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/sealedbox")));
-            const { x25519SecretKey, mlKemSecretKey, sealed } = request.body;
-            const plaintext = openPQ(x25519SecretKey, mlKemSecretKey, sealed);
+            const { openPQ } = await loadSealedbox();
+            const { x25519PrivateKey, mlKemSecretKey } = key.privateParts;
+            const plaintext = openPQ(x25519PrivateKey, mlKemSecretKey, sealed);
             return reply.send({
                 data: Buffer.from(plaintext).toString("utf8"),
             });
@@ -141,5 +153,11 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
         }
     });
+}
+exports.default = (app) => {
+    registerSeal(app);
+    registerOpen(app);
+    registerSealPq(app);
+    registerOpenPq(app);
 };
 //# sourceMappingURL=sealedbox.js.map

package/dist/routes/v2/secretbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretbox.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/secretbox.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAyEE"}
+{"version":3,"file":"secretbox.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/secretbox.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAqF/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/secretbox.js

@@ -34,7 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const loadSecretbox = async () => (await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")))).secretbox;
+function registerSeal(app) {
     app.post("/v2/secretbox/seal", {
         schema: {
             tags: ["Secretbox"],
@@ -52,7 +53,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { seal } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/secretbox")));
+            const { seal } = await loadSecretbox();
             const { key, plaintext, aad } = request.body;
             const aadBytes = aad ? Buffer.from(aad, "utf8") : undefined;
             return reply.send({ data: seal(key, plaintext, aadBytes) });
@@ -61,6 +62,8 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
         }
     });
+}
+function registerOpen(app) {
     app.post("/v2/secretbox/open", {
         schema: {
             tags: ["Secretbox"],
@@ -78,7 +81,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { open } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/secretbox")));
+            const { open } = await loadSecretbox();
             const { key, ciphertext, aad } = request.body;
             const aadBytes = aad ? Buffer.from(aad, "utf8") : undefined;
             const plaintext = open(key, ciphertext, aadBytes);
@@ -90,5 +93,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
         }
     });
+}
+exports.default = (app) => {
+    registerSeal(app);
+    registerOpen(app);
 };
 //# sourceMappingURL=secretbox.js.map

package/dist/routes/v2/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/signing.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAQ/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA6EE"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/signing.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA0F/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAIE"}

package/dist/routes/v2/signing.js

@@ -1,19 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const keys_1 = require("../../utils/keys");
+function registerSign(app) {
     app.post("/v2/sign", {
         schema: {
             tags: ["Signing"],
             summary: "Sign with Ed25519",
-            description: "Create an Ed25519 digital signature over a message.",
+            description: "Create an Ed25519 digital signature over a message with a server-held ed25519 key (keyId from POST /v2/keys/generate).",
             body: {
                 type: "object",
-                required: ["privateKey", "message"],
+                required: ["keyId", "message"],
                 additionalProperties: false,
                 properties: {
-                    privateKey: { type: "string", minLength: 64, maxLength: 64 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     message: {
                         type: "string",
                         minLength: 1,
@@ -23,15 +24,13 @@ exports.default = (app) => {
             },
         },
     }, async (request, reply) => {
-        try {
-            const { privateKey, message } = request.body;
-            const result = (0, modern_1.ed25519Sign)(privateKey, message);
-            return reply.send({ data: result });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Signing");
-        }
+        const { keyId, message } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["ed25519"]);
+        const result = (0, modern_1.ed25519Sign)(key.privateParts["privateKey"], message);
+        return reply.send({ data: result });
     });
+}
+function registerVerify(app) {
     app.post("/v2/verify", {
         schema: {
             tags: ["Signing"],
@@ -52,6 +51,7 @@ exports.default = (app) => {
                 },
             },
         },
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
     }, async (request, reply) => {
         try {
             const { publicKey, message, signature } = request.body;
@@ -62,5 +62,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Verification");
         }
     });
+}
+exports.default = (app) => {
+    registerSign(app);
+    registerVerify(app);
 };
 //# sourceMappingURL=signing.js.map

package/dist/routes/v2/stream-schemas.d.ts

@@ -0,0 +1,296 @@
+export declare const SIGN_SCHEMA: {
+    tags: string[];
+    summary: string;
+    description: string;
+    body: {
+        type: string;
+        required: string[];
+        additionalProperties: boolean;
+        properties: {
+            items: {
+                type: string;
+                minItems: number;
+                maxItems: number;
+                items: {
+                    type: string;
+                    required: string[];
+                    additionalProperties: boolean;
+                    properties: {
+                        id: {
+                            type: string;
+                        };
+                        message: {
+                            type: string;
+                            minLength: number;
+                        };
+                        keyId: {
+                            readonly type: "string";
+                            readonly pattern: "^k_[A-Za-z0-9_-]{22}$";
+                            readonly description: "Identifier of a server-held key, returned by a key-generation route.";
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+export declare const VERIFY_SCHEMA: {
+    tags: string[];
+    summary: string;
+    description: string;
+    body: {
+        type: string;
+        required: string[];
+        additionalProperties: boolean;
+        properties: {
+            items: {
+                type: string;
+                minItems: number;
+                maxItems: number;
+                items: {
+                    type: string;
+                    required: string[];
+                    additionalProperties: boolean;
+                    properties: {
+                        id: {
+                            type: string;
+                        };
+                        message: {
+                            type: string;
+                            minLength: number;
+                        };
+                        signature: {
+                            type: string;
+                            minLength: number;
+                        };
+                        publicKey: {
+                            type: string;
+                            minLength: number;
+                            maxLength: number;
+                        };
+                    };
+                };
+            };
+        };
+    };
+};
+export declare const ISO20022_SCHEMA: {
+    tags: string[];
+    summary: string;
+    description: string;
+    body: {
+        type: string;
+        required: string[];
+        additionalProperties: boolean;
+        properties: {
+            trustedKeys: {
+                type: string;
+                required: string[];
+                additionalProperties: boolean;
+                properties: {
+                    classicalPublicKey: {
+                        type: string;
+                        minLength: number;
+                    };
+                    postQuantumPublicKey: {
+                        type: string;
+                        minLength: number;
+                    };
+                };
+            };
+            envelope: {
+                type: string;
+                required: string[];
+                additionalProperties: boolean;
+                properties: {
+                    messageId: {
+                        type: string;
+                    };
+                    messageType: {
+                        type: string;
+                        enum: string[];
+                    };
+                    payloadDigest: {
+                        type: string;
+                    };
+                    digestAlgorithm: {
+                        type: string;
+                        enum: string[];
+                    };
+                    timestamp: {
+                        type: string;
+                    };
+                    classical: {
+                        type: string;
+                        required: string[];
+                        additionalProperties: boolean;
+                        properties: {
+                            algorithm: {
+                                type: string;
+                            };
+                            signature: {
+                                type: string;
+                            };
+                            publicKey: {
+                                type: string;
+                            };
+                        };
+                    };
+                    postQuantum: {
+                        type: string;
+                        required: string[];
+                        additionalProperties: boolean;
+                        properties: {
+                            algorithm: {
+                                type: string;
+                                enum: string[];
+                            };
+                            signature: {
+                                type: string;
+                            };
+                            publicKey: {
+                                type: string;
+                            };
+                        };
+                    };
+                };
+            };
+            payload: {};
+        };
+    };
+};
+export declare const STREAM_PQ_ENCRYPT_SCHEMA: {
+    tags: string[];
+    summary: string;
+    description: string;
+    body: {
+        type: string;
+        required: string[];
+        additionalProperties: boolean;
+        properties: {
+            x25519PublicKey: {
+                type: string;
+                minLength: number;
+                maxLength: number;
+            };
+            mlKemPublicKey: {
+                type: string;
+                minLength: number;
+            };
+            plaintext: {
+                type: string;
+                minLength: number;
+            };
+            chunkSize: {
+                type: string;
+                minimum: number;
+                maximum: number;
+            };
+        };
+    };
+};
+export declare const STREAM_PQ_DECRYPT_SCHEMA: {
+    tags: string[];
+    summary: string;
+    description: string;
+    body: {
+        type: string;
+        required: string[];
+        additionalProperties: boolean;
+        properties: {
+            keyId: {
+                readonly type: "string";
+                readonly pattern: "^k_[A-Za-z0-9_-]{22}$";
+                readonly description: "Identifier of a server-held key, returned by a key-generation route.";
+            };
+            ciphertext: {
+                type: string;
+                minLength: number;
+            };
+            chunkSize: {
+                type: string;
+                minimum: number;
+                maximum: number;
+            };
+        };
+    };
+};
+export declare const STREAM_MULTI_PQ_ENCRYPT_SCHEMA: {
+    tags: string[];
+    summary: string;
+    description: string;
+    body: {
+        type: string;
+        required: string[];
+        additionalProperties: boolean;
+        properties: {
+            recipients: {
+                type: string;
+                minItems: number;
+                maxItems: number;
+                items: {
+                    type: string;
+                    required: string[];
+                    additionalProperties: boolean;
+                    properties: {
+                        recipientId: {
+                            type: string;
+                            minLength: number;
+                            maxLength: number;
+                        };
+                        x25519PublicKey: {
+                            type: string;
+                            minLength: number;
+                            maxLength: number;
+                        };
+                        mlKemPublicKey: {
+                            type: string;
+                            minLength: number;
+                        };
+                    };
+                };
+            };
+            plaintext: {
+                type: string;
+                minLength: number;
+            };
+            chunkSize: {
+                type: string;
+                minimum: number;
+                maximum: number;
+            };
+        };
+    };
+};
+export declare const STREAM_MULTI_PQ_DECRYPT_SCHEMA: {
+    tags: string[];
+    summary: string;
+    description: string;
+    body: {
+        type: string;
+        required: string[];
+        additionalProperties: boolean;
+        properties: {
+            keyId: {
+                readonly type: "string";
+                readonly pattern: "^k_[A-Za-z0-9_-]{22}$";
+                readonly description: "Identifier of a server-held key, returned by a key-generation route.";
+            };
+            recipientId: {
+                type: string;
+                minLength: number;
+                maxLength: number;
+            };
+            ciphertext: {
+                type: string;
+                minLength: number;
+            };
+            chunkSize: {
+                type: string;
+                minimum: number;
+                maximum: number;
+            };
+        };
+    };
+};
+//# sourceMappingURL=stream-schemas.d.ts.map

package/dist/routes/v2/stream-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-schemas.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/stream-schemas.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BvB,CAAC;AAGF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BzB,CAAC;AAGF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuE3B,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgBpC,CAAC;AAGF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;CAepC,CAAC;AAGF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8B1C,CAAC;AAGF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB1C,CAAC"}