@sebastienrousseau/crypto-server 0.0.8 → 0.0.9

package/dist/lib/auth.js

@@ -33,13 +33,17 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SCOPES = void 0;
+exports.EXPLICIT_SCOPES = exports.SCOPES = void 0;
 exports.registerAuth = registerAuth;
+exports.exceedsLifetime = exceedsLifetime;
 exports.authenticate = authenticate;
 exports.hasScope = hasScope;
 exports.requireScope = requireScope;
+exports.authorizeRoute = authorizeRoute;
 const crypto_1 = require("crypto");
 const validation_1 = require("../utils/validation");
+const problem_1 = require("./problem");
+const auth_policy_1 = require("../config/auth-policy");
 exports.SCOPES = [
     "crypto:encrypt",
     "crypto:decrypt",
@@ -48,18 +52,70 @@ exports.SCOPES = [
     "crypto:hash",
     "crypto:kdf",
     "crypto:keys",
+    "crypto:keys:export",
     "crypto:admin",
 ];
+exports.EXPLICIT_SCOPES = ["crypto:keys:export"];
+const IAT_CLOCK_SKEW_SECONDS = 60;
 async function registerAuth(app) {
     const jwtSecret = process.env["JWT_SECRET"];
-    if (jwtSecret) {
-        const fastifyJwt = await Promise.resolve().then(() => __importStar(require("@fastify/jwt")));
-        await app.register(fastifyJwt.default, {
-            secret: jwtSecret,
-            verify: { algorithms: ["HS256"] },
-        });
+    if (!jwtSecret)
+        return;
+    const configError = (0, auth_policy_1.jwtConfigError)(process.env);
+    if (configError)
+        throw new Error(configError);
+    const policy = (0, auth_policy_1.jwtPolicy)(process.env);
+    const fastifyJwt = await Promise.resolve().then(() => __importStar(require("@fastify/jwt")));
+    await app.register(fastifyJwt.default, {
+        secret: jwtSecret,
+        verify: {
+            algorithms: ["HS256"],
+            requiredClaims: [
+                "exp",
+                "iat",
+                ...(policy.issuer ? ["iss"] : []),
+                ...(policy.audience ? ["aud"] : []),
+            ],
+            maxAge: policy.maxAgeSeconds * 1000,
+            ...(policy.issuer ? { allowedIss: policy.issuer } : {}),
+            ...(policy.audience ? { allowedAud: policy.audience } : {}),
+        },
+    });
+}
+function exceedsLifetime(payload, maxAgeSeconds, nowSeconds = Math.floor(Date.now() / 1000)) {
+    const { exp, iat } = payload;
+    if (typeof exp !== "number" || typeof iat !== "number")
+        return true;
+    return exp - iat > maxAgeSeconds || iat > nowSeconds + IAT_CLOCK_SKEW_SECONDS;
+}
+async function verifyBearer(request, reply) {
+    try {
+        const decoded = await request.jwtVerify();
+        const { maxAgeSeconds } = (0, auth_policy_1.jwtPolicy)(process.env);
+        if (exceedsLifetime(decoded, maxAgeSeconds)) {
+            throw new Error("token lifetime exceeds JWT_MAX_AGE");
+        }
+        return decoded;
+    }
+    catch {
+        (0, problem_1.sendProblem)(reply, 401, "unauthorized", "Invalid or expired JWT token");
+        return null;
     }
 }
+function checkApiKey(request, reply, apiKey) {
+    const providedKey = request.headers["x-api-key"];
+    if (!providedKey || typeof providedKey !== "string") {
+        (0, problem_1.sendProblem)(reply, 401, "unauthorized", "Missing API key or Bearer token");
+        return null;
+    }
+    const a = Buffer.from(providedKey);
+    const b = Buffer.from(apiKey);
+    if (a.length !== b.length || !(0, crypto_1.timingSafeEqual)(a, b)) {
+        (0, problem_1.sendProblem)(reply, 401, "unauthorized", "Invalid API key");
+        return null;
+    }
+    return { sub: "api-key", scopes: ["crypto:admin"] };
+}
 async function authenticate(request, reply) {
     const jwtSecret = process.env["JWT_SECRET"];
     const apiKey = process.env["CRYPTO_API_KEY"];
@@ -67,54 +123,45 @@ async function authenticate(request, reply) {
         if ((0, validation_1.anonymousAllowed)()) {
             return { sub: "anonymous", scopes: ["crypto:admin"] };
         }
-        reply
-            .status(401)
-            .send({ error: "Unauthorized: authentication is not configured" });
+        (0, problem_1.sendProblem)(reply, 401, "unauthorized", "Authentication is not configured");
         return null;
     }
     const authHeader = request.headers["authorization"];
     if (authHeader?.startsWith("Bearer ") && jwtSecret) {
-        try {
-            const decoded = await request.jwtVerify();
-            return decoded;
-        }
-        catch {
-            reply.status(401).send({ error: "Invalid or expired JWT token" });
-            return null;
-        }
+        return verifyBearer(request, reply);
     }
     if (apiKey) {
-        const providedKey = request.headers["x-api-key"];
-        if (!providedKey || typeof providedKey !== "string") {
-            reply
-                .status(401)
-                .send({ error: "Unauthorized: Missing API key or Bearer token" });
-            return null;
-        }
-        const a = Buffer.from(providedKey);
-        const b = Buffer.from(apiKey);
-        if (a.length !== b.length || !(0, crypto_1.timingSafeEqual)(a, b)) {
-            reply.status(401).send({ error: "Unauthorized: Invalid API key" });
-            return null;
-        }
-        return { sub: "api-key", scopes: ["crypto:admin"] };
+        return checkApiKey(request, reply, apiKey);
     }
-    reply
-        .status(401)
-        .send({ error: "Unauthorized: No valid credentials provided" });
+    (0, problem_1.sendProblem)(reply, 401, "unauthorized", "No valid credentials provided");
     return null;
 }
 function hasScope(payload, required) {
-    return (payload.scopes.includes("crypto:admin") || payload.scopes.includes(required));
+    const scopes = Array.isArray(payload.scopes)
+        ? payload.scopes
+        : [];
+    if (scopes.includes(required))
+        return true;
+    return !exports.EXPLICIT_SCOPES.includes(required) && scopes.includes("crypto:admin");
 }
 function requireScope(payload, scope, reply) {
     if (!hasScope(payload, scope)) {
-        reply.status(403).send({
-            error: "Forbidden",
-            message: `Missing required scope: ${scope}`,
-        });
+        (0, problem_1.sendProblem)(reply, 403, "forbidden", `Missing required scope: ${scope}`);
         return false;
     }
     return true;
 }
+function authorizeRoute(request, reply, payload) {
+    const url = request.routeOptions.url;
+    if (url === undefined)
+        return true;
+    const required = (0, auth_policy_1.routeRequirement)(request.method, url);
+    if (required === undefined) {
+        (0, problem_1.sendProblem)(reply, 403, "forbidden", "No access policy is defined for this route");
+        return false;
+    }
+    if (required === auth_policy_1.AUTHENTICATED)
+        return true;
+    return requireScope(payload, required, reply);
+}
 //# sourceMappingURL=auth.js.map

package/dist/lib/kdf-runner.d.ts

@@ -0,0 +1,18 @@
+export declare const KDF_WORKER_THREADS = 2;
+declare const MODULES: {
+    readonly modern: string;
+    readonly highLevel: string;
+};
+export type KdfModule = keyof typeof MODULES;
+export declare class KdfRunner {
+    private pool;
+    run<T>(module: KdfModule, functionName: string, ...args: unknown[]): Promise<T>;
+    close(): Promise<void>;
+}
+declare module "fastify" {
+    interface FastifyInstance {
+        kdf: KdfRunner;
+    }
+}
+export {};
+//# sourceMappingURL=kdf-runner.d.ts.map

package/dist/lib/kdf-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf-runner.d.ts","sourceRoot":"","sources":["../../src/lib/kdf-runner.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAQpC,QAAA,MAAM,OAAO;;;CAGH,CAAC;AAGX,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,OAAO,CAAC;AAM7C,qBAAa,SAAS;IACpB,OAAO,CAAC,IAAI,CAAyB;IAOrC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE;IAU5D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QAEvB,GAAG,EAAE,SAAS,CAAC;KAChB;CACF"}

package/dist/lib/kdf-runner.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KdfRunner = exports.KDF_WORKER_THREADS = void 0;
+const accel_1 = require("@sebastienrousseau/crypto-lib/accel");
+exports.KDF_WORKER_THREADS = 2;
+const MODULES = {
+    modern: require.resolve("@sebastienrousseau/crypto-lib/modern"),
+    highLevel: require.resolve("@sebastienrousseau/crypto-lib/high-level"),
+};
+class KdfRunner {
+    pool;
+    run(module, functionName, ...args) {
+        this.pool ??= new accel_1.WorkerPool({ size: exports.KDF_WORKER_THREADS });
+        return this.pool.execute({
+            modulePath: MODULES[module],
+            functionName,
+            args,
+        });
+    }
+    async close() {
+        const pool = this.pool;
+        this.pool = undefined;
+        await pool?.shutdown();
+    }
+}
+exports.KdfRunner = KdfRunner;
+//# sourceMappingURL=kdf-runner.js.map

package/dist/lib/key-store.d.ts

@@ -0,0 +1,30 @@
+export type KeyParts = Readonly<Record<string, string>>;
+export interface StoredKey {
+    readonly keyId: string;
+    readonly algorithm: string;
+    readonly owner: string;
+    readonly createdAt: string;
+    readonly publicParts: KeyParts;
+    readonly privateParts: KeyParts;
+}
+export type NewKey = Pick<StoredKey, "algorithm" | "owner" | "publicParts" | "privateParts">;
+export declare const KEY_ID_PATTERN = "^k_[A-Za-z0-9_-]{22}$";
+export declare const DEFAULT_KEY_CAPACITY = 10000;
+export declare class KeyStoreError extends Error {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(message: string, statusCode: number, code: string);
+}
+export declare class KeyStore {
+    private readonly dir;
+    private readonly capacity;
+    private readonly keys;
+    constructor(dir: string | undefined, capacity?: number);
+    put(key: NewKey): Promise<StoredKey>;
+    get(keyId: string, owner: string, algorithms?: readonly string[]): Promise<StoredKey>;
+    private lookup;
+    private remember;
+    private file;
+}
+export declare function keyStoreFromEnv(): KeyStore;
+//# sourceMappingURL=key-store.d.ts.map

package/dist/lib/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../src/lib/key-store.ts"],"names":[],"mappings":"AA6BA,MAAM,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAGxD,MAAM,WAAW,SAAS;IAExB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;IAE/B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC;AAGD,MAAM,MAAM,MAAM,GAAG,IAAI,CACvB,SAAS,EACT,WAAW,GAAG,OAAO,GAAG,aAAa,GAAG,cAAc,CACvD,CAAC;AAGF,eAAO,MAAM,cAAc,0BAA0B,CAAC;AAKtD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAG3C,qBAAa,aAAc,SAAQ,KAAK;IAEtC,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAM9D;AAOD,qBAAa,QAAQ;IAUjB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAV3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;gBASlC,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,GAAE,MAA6B;IAIpD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA6BpC,GAAG,CACP,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,SAAS,CAAC;YAcP,MAAM;IAiBpB,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,IAAI;CAGb;AAGD,wBAAgB,eAAe,IAAI,QAAQ,CAE1C"}

package/dist/lib/key-store.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyStore = exports.KeyStoreError = exports.DEFAULT_KEY_CAPACITY = exports.KEY_ID_PATTERN = void 0;
+exports.keyStoreFromEnv = keyStoreFromEnv;
+const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
+const path = __importStar(require("path"));
+exports.KEY_ID_PATTERN = "^k_[A-Za-z0-9_-]{22}$";
+const KEY_ID_RE = new RegExp(exports.KEY_ID_PATTERN);
+exports.DEFAULT_KEY_CAPACITY = 10_000;
+class KeyStoreError extends Error {
+    statusCode;
+    code;
+    constructor(message, statusCode, code) {
+        super(message);
+        this.name = "KeyStoreError";
+        this.statusCode = statusCode;
+        this.code = code;
+    }
+}
+exports.KeyStoreError = KeyStoreError;
+const notFound = () => new KeyStoreError("Key not found", 404, "KEY_NOT_FOUND");
+class KeyStore {
+    dir;
+    capacity;
+    keys = new Map();
+    constructor(dir, capacity = exports.DEFAULT_KEY_CAPACITY) {
+        this.dir = dir;
+        this.capacity = capacity;
+    }
+    async put(key) {
+        if (!this.dir && this.keys.size >= this.capacity) {
+            throw new KeyStoreError("Key store is full; set CRYPTO_KEY_OUT_DIR to persist keys", 503, "KEY_STORE_FULL");
+        }
+        const stored = Object.freeze({
+            ...key,
+            keyId: `k_${(0, crypto_1.randomBytes)(16).toString("base64url")}`,
+            createdAt: new Date().toISOString(),
+        });
+        if (this.dir) {
+            await (0, promises_1.writeFile)(this.file(stored.keyId), JSON.stringify(stored), {
+                encoding: "utf8",
+                mode: 0o600,
+                flag: "wx",
+            });
+        }
+        this.remember(stored);
+        return stored;
+    }
+    async get(keyId, owner, algorithms) {
+        const key = await this.lookup(keyId);
+        if (!key || key.owner !== owner)
+            throw notFound();
+        if (algorithms && !algorithms.includes(key.algorithm)) {
+            throw new KeyStoreError(`Key ${keyId} is a ${key.algorithm} key; this operation needs ${algorithms.join(" or ")}`, 400, "KEY_ALGORITHM_MISMATCH");
+        }
+        return key;
+    }
+    async lookup(keyId) {
+        if (!KEY_ID_RE.test(keyId))
+            return undefined;
+        const cached = this.keys.get(keyId);
+        if (cached || !this.dir)
+            return cached;
+        let raw;
+        try {
+            raw = await (0, promises_1.readFile)(this.file(keyId), "utf8");
+        }
+        catch {
+            return undefined;
+        }
+        const stored = Object.freeze(JSON.parse(raw));
+        if (stored.keyId !== keyId)
+            return undefined;
+        this.remember(stored);
+        return stored;
+    }
+    remember(key) {
+        this.keys.set(key.keyId, key);
+        if (this.keys.size > this.capacity) {
+            const oldest = this.keys.keys().next().value;
+            this.keys.delete(oldest);
+        }
+    }
+    file(keyId) {
+        return path.join(this.dir, `${keyId}.json`);
+    }
+}
+exports.KeyStore = KeyStore;
+function keyStoreFromEnv() {
+    return new KeyStore(process.env["CRYPTO_KEY_OUT_DIR"] || undefined);
+}
+//# sourceMappingURL=key-store.js.map

package/dist/lib/problem.d.ts

@@ -0,0 +1,66 @@
+import type { FastifyInstance, FastifyReply } from "fastify";
+import { CryptoError } from "@sebastienrousseau/crypto-lib";
+export declare const PROBLEM_CONTENT_TYPE = "application/problem+json";
+export declare const PROBLEM_TYPE_PREFIX = "urn:crypto-service:problem:";
+export declare const PROBLEM_TITLES: Readonly<{
+    "validation-failed": "Validation failed";
+    "invalid-input": "Invalid input";
+    unauthorized: "Unauthorized";
+    forbidden: "Forbidden";
+    "not-found": "Not Found";
+    "key-not-found": "Key not found";
+    "key-algorithm-mismatch": "Key algorithm mismatch";
+    "key-store-full": "Key store full";
+    "payload-too-large": "Payload Too Large";
+    "rate-limited": "Too Many Requests";
+    "request-error": "Bad Request";
+    "internal-error": "Internal Server Error";
+}>;
+export type ProblemSlug = keyof typeof PROBLEM_TITLES;
+export interface Problem {
+    type: string;
+    title: string;
+    status: number;
+    detail: string;
+    instance?: string;
+    [extension: string]: unknown;
+}
+export declare const PROBLEM_SCHEMA: {
+    readonly type: "object";
+    readonly properties: {
+        readonly type: {
+            readonly type: "string";
+        };
+        readonly title: {
+            readonly type: "string";
+        };
+        readonly status: {
+            readonly type: "integer";
+        };
+        readonly detail: {
+            readonly type: "string";
+        };
+        readonly instance: {
+            readonly type: "string";
+        };
+        readonly code: {
+            readonly type: "string";
+        };
+        readonly errors: {
+            readonly type: "array";
+        };
+    };
+};
+export declare function problem(status: number, slug: ProblemSlug, detail: string, extensions?: Record<string, unknown>, instance?: string): Problem;
+export declare function sendProblem(reply: FastifyReply, status: number, slug: ProblemSlug, detail: string, extensions?: Record<string, unknown>): FastifyReply;
+export declare function cryptoErrorStatus(code: string): number;
+export declare function isCryptoError(error: unknown): error is CryptoError;
+export interface ProblemSpec {
+    status: number;
+    slug: ProblemSlug;
+    detail: string;
+    extensions: Record<string, unknown>;
+}
+export declare function classifyThrown(error: unknown): ProblemSpec;
+export declare function registerProblemHandlers(app: FastifyInstance): void;
+//# sourceMappingURL=problem.d.ts.map

package/dist/lib/problem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"problem.d.ts","sourceRoot":"","sources":["../../src/lib/problem.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAkB,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI5D,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAG/D,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAGjE,eAAO,MAAM,cAAc;;;;;;;;;;;;;EAazB,CAAC;AAGH,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,cAAc,CAAC;AAGtD,MAAM,WAAW,OAAO;IAEtB,IAAI,EAAE,MAAM,CAAC;IAEb,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,EAAE,MAAM,CAAC;IAEf,MAAM,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9B;AAGD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;CAWjB,CAAC;AAGX,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACxC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAST;AAOD,wBAAgB,WAAW,CACzB,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,YAAY,CAGd;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAGD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAUD,MAAM,WAAW,WAAW;IAE1B,MAAM,EAAE,MAAM,CAAC;IAEf,IAAI,EAAE,WAAW,CAAC;IAElB,MAAM,EAAE,MAAM,CAAC;IAEf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAwFD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAU1D;AAOD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAoBlE"}

package/dist/lib/problem.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROBLEM_SCHEMA = exports.PROBLEM_TITLES = exports.PROBLEM_TYPE_PREFIX = exports.PROBLEM_CONTENT_TYPE = void 0;
+exports.problem = problem;
+exports.sendProblem = sendProblem;
+exports.cryptoErrorStatus = cryptoErrorStatus;
+exports.isCryptoError = isCryptoError;
+exports.classifyThrown = classifyThrown;
+exports.registerProblemHandlers = registerProblemHandlers;
+const http_1 = require("http");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const key_store_1 = require("./key-store");
+exports.PROBLEM_CONTENT_TYPE = "application/problem+json";
+exports.PROBLEM_TYPE_PREFIX = "urn:crypto-service:problem:";
+exports.PROBLEM_TITLES = Object.freeze({
+    "validation-failed": "Validation failed",
+    "invalid-input": "Invalid input",
+    unauthorized: "Unauthorized",
+    forbidden: "Forbidden",
+    "not-found": "Not Found",
+    "key-not-found": "Key not found",
+    "key-algorithm-mismatch": "Key algorithm mismatch",
+    "key-store-full": "Key store full",
+    "payload-too-large": "Payload Too Large",
+    "rate-limited": "Too Many Requests",
+    "request-error": "Bad Request",
+    "internal-error": "Internal Server Error",
+});
+exports.PROBLEM_SCHEMA = {
+    type: "object",
+    properties: {
+        type: { type: "string" },
+        title: { type: "string" },
+        status: { type: "integer" },
+        detail: { type: "string" },
+        instance: { type: "string" },
+        code: { type: "string" },
+        errors: { type: "array" },
+    },
+};
+function problem(status, slug, detail, extensions = {}, instance) {
+    return {
+        type: `${exports.PROBLEM_TYPE_PREFIX}${slug}`,
+        title: exports.PROBLEM_TITLES[slug],
+        status,
+        detail,
+        ...(instance === undefined ? {} : { instance }),
+        ...extensions,
+    };
+}
+const pathOf = (request) => request?.url.split("?")[0];
+function sendProblem(reply, status, slug, detail, extensions) {
+    const body = problem(status, slug, detail, extensions, pathOf(reply.request));
+    return reply.status(status).type(exports.PROBLEM_CONTENT_TYPE).send(body);
+}
+const CRYPTO_INPUT_CODES = new Set([
+    "INVALID_KEY",
+    "UNSUPPORTED_ALGORITHM",
+    "INVALID_HEX",
+    "INVALID_CIPHERTEXT",
+    "AUTH_FAILED",
+    "INVALID_INPUT",
+]);
+function cryptoErrorStatus(code) {
+    return CRYPTO_INPUT_CODES.has(code) ? 400 : 500;
+}
+function isCryptoError(error) {
+    return error instanceof crypto_lib_1.CryptoError;
+}
+const KEY_STORE_SLUGS = {
+    KEY_NOT_FOUND: "key-not-found",
+    KEY_ALGORITHM_MISMATCH: "key-algorithm-mismatch",
+    KEY_STORE_FULL: "key-store-full",
+};
+function fieldOf(issue) {
+    const missing = issue.params.missingProperty;
+    return missing ? `${issue.instancePath}/${missing}` : issue.instancePath;
+}
+const internal = (extensions = {}) => ({
+    status: 500,
+    slug: "internal-error",
+    detail: "An unexpected error occurred",
+    extensions,
+});
+function validationProblem(error) {
+    const errors = error.validation.map((issue) => ({
+        field: fieldOf(issue),
+        message: issue.message ?? "is invalid",
+    }));
+    return {
+        status: 400,
+        slug: "validation-failed",
+        detail: error.message,
+        extensions: { errors },
+    };
+}
+function cryptoProblem(error) {
+    if (cryptoErrorStatus(error.code) === 500) {
+        return internal({ code: error.code });
+    }
+    return {
+        status: 400,
+        slug: "invalid-input",
+        detail: "Invalid input",
+        extensions: { code: error.code },
+    };
+}
+function keyStoreProblem(error) {
+    return {
+        status: error.statusCode,
+        slug: KEY_STORE_SLUGS[error.code] ?? "request-error",
+        detail: error.message,
+        extensions: { code: error.code },
+    };
+}
+function clientProblem(status, error) {
+    const slug = status === 429
+        ? "rate-limited"
+        : status === 413
+            ? "payload-too-large"
+            : "request-error";
+    return {
+        status,
+        slug,
+        detail: error.message ?? String(http_1.STATUS_CODES[status]),
+        extensions: {},
+    };
+}
+function classifyThrown(error) {
+    if (isCryptoError(error))
+        return cryptoProblem(error);
+    if (error instanceof key_store_1.KeyStoreError)
+        return keyStoreProblem(error);
+    const thrown = (error ?? {});
+    if (thrown.validation) {
+        return validationProblem(thrown);
+    }
+    const status = thrown.statusCode ?? 500;
+    if (status >= 400 && status < 500)
+        return clientProblem(status, thrown);
+    return internal();
+}
+function registerProblemHandlers(app) {
+    app.setErrorHandler((error, request, reply) => {
+        const spec = classifyThrown(error);
+        if (spec.status >= 500)
+            request.log.error(error, "Request failed");
+        return sendProblem(reply, spec.status, spec.slug, spec.detail, spec.extensions);
+    });
+    app.setNotFoundHandler((request, reply) => sendProblem(reply, 404, "not-found", `Route ${request.method} ${pathOf(request)} not found`));
+}
+//# sourceMappingURL=problem.js.map

package/dist/routes/v1/decrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/decrypt.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAkC/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAgCE"}
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../src/routes/v1/decrypt.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBA2C/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA+BE"}