@sebastienrousseau/crypto-server 0.0.8 → 0.0.9

package/dist/routes/v2/pq.js

@@ -1,24 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const keys_1 = require("../../utils/keys");
+const EMPTY_BODY = {
+    type: "object",
+    additionalProperties: false,
+    properties: {},
+};
+function registerMlKemKeygen(app) {
     app.post("/v2/pq/keygen", {
         schema: {
             tags: ["Post-Quantum"],
-            summary: "Generate ML-KEM-768 key pair",
-            description: "Generate a NIST FIPS 203 ML-KEM-768 key pair for quantum-resistant key encapsulation.",
-            body: { type: "object", additionalProperties: false, properties: {} },
+            summary: "Generate a server-held ML-KEM-768 key pair",
+            description: "Generates a NIST FIPS 203 ML-KEM-768 key pair, keeps the secret key on the server and returns its keyId with the public key.",
+            body: EMPTY_BODY,
         },
     }, async (request, reply) => {
-        try {
-            const keyPair = (0, modern_1.mlKemGenerateKeyPair)();
-            return reply.send({ data: keyPair });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key generation");
-        }
+        const { publicKey, secretKey, algorithm } = (0, modern_1.mlKemGenerateKeyPair)();
+        const stored = await (0, keys_1.storeKey)(request, algorithm, { publicKey }, { secretKey });
+        return reply.send({ data: (0, keys_1.publicView)(stored) });
     });
+}
+function registerMlKemEncapsulate(app) {
     app.post("/v2/pq/encapsulate", {
         schema: {
             tags: ["Post-Quantum"],
@@ -43,47 +47,56 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encapsulation");
         }
     });
+}
+function registerMlKemDecapsulate(app) {
     app.post("/v2/pq/decapsulate", {
         schema: {
             tags: ["Post-Quantum"],
             summary: "ML-KEM decapsulate",
-            description: "Decapsulate and recover the shared secret using the ML-KEM secret key.",
+            description: "Recover the shared secret with a server-held ML-KEM-768 key (keyId from POST /v2/pq/keygen or POST /v2/keys/generate).",
             body: {
                 type: "object",
-                required: ["secretKey", "ciphertext"],
+                required: ["keyId", "ciphertext"],
                 additionalProperties: false,
                 properties: {
-                    secretKey: { type: "string", minLength: 1 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     ciphertext: { type: "string", minLength: 1 },
                 },
             },
         },
     }, async (request, reply) => {
+        const { keyId, ciphertext } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["ml-kem-768"]);
         try {
-            const { secretKey, ciphertext } = request.body;
-            const result = (0, modern_1.mlKemDecapsulate)(secretKey, ciphertext);
+            const result = (0, modern_1.mlKemDecapsulate)(key.privateParts["secretKey"], ciphertext);
             return reply.send({ data: result });
         }
         catch (error) {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decapsulation");
         }
     });
+}
+function registerHybridKeygen(app) {
     app.post("/v2/pq/hybrid/keygen", {
         schema: {
             tags: ["Post-Quantum"],
-            summary: "Generate hybrid X25519 + ML-KEM-768 key pair",
-            description: "Generates both classical (X25519) and post-quantum (ML-KEM-768) key pairs for hybrid key exchange.",
-            body: { type: "object", additionalProperties: false, properties: {} },
+            summary: "Generate a server-held hybrid X25519 + ML-KEM-768 key pair",
+            description: "Generates classical (X25519) and post-quantum (ML-KEM-768) key pairs for hybrid key exchange, keeps the private keys on the server and returns a keyId with the public keys.",
+            body: EMPTY_BODY,
         },
     }, async (request, reply) => {
-        try {
-            const keyPair = (0, modern_1.hybridGenerateKeyPair)();
-            return reply.send({ data: keyPair });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Key generation");
-        }
+        const kp = (0, modern_1.hybridGenerateKeyPair)();
+        const stored = await (0, keys_1.storeKey)(request, kp.algorithm, {
+            x25519PublicKey: kp.x25519PublicKey,
+            mlKemPublicKey: kp.mlKemPublicKey,
+        }, {
+            x25519PrivateKey: kp.x25519PrivateKey,
+            mlKemSecretKey: kp.mlKemSecretKey,
+        });
+        return reply.send({ data: (0, keys_1.publicView)(stored) });
     });
+}
+function registerHybridEncapsulate(app) {
     app.post("/v2/pq/hybrid/encapsulate", {
         schema: {
             tags: ["Post-Quantum"],
@@ -109,23 +122,19 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Hybrid encapsulation");
         }
     });
+}
+function registerHybridDecapsulate(app) {
     app.post("/v2/pq/hybrid/decapsulate", {
         schema: {
             tags: ["Post-Quantum"],
             summary: "Hybrid decapsulate (X25519 + ML-KEM-768)",
-            description: "Recovers the combined shared secret using private keys and sender's ephemeral data.",
+            description: "Recovers the combined shared secret with a server-held x25519-ml-kem-768 key (keyId from POST /v2/pq/hybrid/keygen) and the sender's ephemeral data.",
             body: {
                 type: "object",
-                required: [
-                    "x25519PrivateKey",
-                    "mlKemSecretKey",
-                    "x25519EphemeralPublic",
-                    "mlKemCiphertext",
-                ],
+                required: ["keyId", "x25519EphemeralPublic", "mlKemCiphertext"],
                 additionalProperties: false,
                 properties: {
-                    x25519PrivateKey: { type: "string", minLength: 64, maxLength: 64 },
-                    mlKemSecretKey: { type: "string", minLength: 1 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     x25519EphemeralPublic: {
                         type: "string",
                         minLength: 64,
@@ -136,14 +145,24 @@ exports.default = (app) => {
             },
         },
     }, async (request, reply) => {
+        const body = request.body;
+        const key = await (0, keys_1.resolveKey)(request, body.keyId, ["x25519-ml-kem-768"]);
         try {
-            const body = request.body;
-            const result = (0, modern_1.hybridDecapsulate)(body.x25519PrivateKey, body.mlKemSecretKey, body.x25519EphemeralPublic, body.mlKemCiphertext);
+            const { x25519PrivateKey, mlKemSecretKey } = key.privateParts;
+            const result = (0, modern_1.hybridDecapsulate)(x25519PrivateKey, mlKemSecretKey, body.x25519EphemeralPublic, body.mlKemCiphertext);
             return reply.send({ data: result });
         }
         catch (error) {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Hybrid decapsulation");
         }
     });
+}
+exports.default = (app) => {
+    registerMlKemKeygen(app);
+    registerMlKemEncapsulate(app);
+    registerMlKemDecapsulate(app);
+    registerHybridKeygen(app);
+    registerHybridEncapsulate(app);
+    registerHybridDecapsulate(app);
 };
 //# sourceMappingURL=pq.js.map

package/dist/routes/v2/sealedbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sealedbox.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/sealedbox.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA6IE"}
+{"version":3,"file":"sealedbox.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/sealedbox.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAmK/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAKE"}

package/dist/routes/v2/sealedbox.js

@@ -34,7 +34,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const keys_1 = require("../../utils/keys");
+const loadSealedbox = async () => (await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")))).sealedbox;
+function registerSeal(app) {
     app.post("/v2/sealedbox/seal", {
         schema: {
             tags: ["Sealed Box"],
@@ -51,7 +53,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { seal } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/sealedbox")));
+            const { seal } = await loadSealedbox();
             const { recipientPublicKey, plaintext } = request.body;
             return reply.send({ data: seal(recipientPublicKey, plaintext) });
         }
@@ -59,25 +61,29 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
         }
     });
+}
+function registerOpen(app) {
     app.post("/v2/sealedbox/open", {
         schema: {
             tags: ["Sealed Box"],
             summary: "Decrypt an anonymous sealed box (X25519)",
+            description: "Opens a sealed box with a server-held x25519 key (keyId from POST /v2/keys/generate).",
             body: {
                 type: "object",
-                required: ["recipientSecretKey", "sealed"],
+                required: ["keyId", "sealed"],
                 additionalProperties: false,
                 properties: {
-                    recipientSecretKey: { type: "string", minLength: 1 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     sealed: { type: "string", minLength: 1 },
                 },
             },
         },
     }, async (request, reply) => {
+        const { keyId, sealed } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["x25519"]);
         try {
-            const { open } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/sealedbox")));
-            const { recipientSecretKey, sealed } = request.body;
-            const plaintext = open(recipientSecretKey, sealed);
+            const { open } = await loadSealedbox();
+            const plaintext = open(key.privateParts["privateKey"], sealed);
             return reply.send({
                 data: Buffer.from(plaintext).toString("utf8"),
             });
@@ -86,6 +92,8 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
         }
     });
+}
+function registerSealPq(app) {
     app.post("/v2/sealedbox/seal-pq", {
         schema: {
             tags: ["Sealed Box"],
@@ -103,7 +111,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { sealPQ } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/sealedbox")));
+            const { sealPQ } = await loadSealedbox();
             const { x25519PublicKey, mlKemPublicKey, plaintext } = request.body;
             return reply.send({
                 data: sealPQ(x25519PublicKey, mlKemPublicKey, plaintext),
@@ -113,26 +121,30 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
         }
     });
+}
+function registerOpenPq(app) {
     app.post("/v2/sealedbox/open-pq", {
         schema: {
             tags: ["Sealed Box"],
             summary: "Decrypt a post-quantum sealed box (X25519 + ML-KEM-768)",
+            description: "Opens a hybrid sealed box with a server-held x25519-ml-kem-768 key (keyId from POST /v2/pq/hybrid/keygen).",
             body: {
                 type: "object",
-                required: ["x25519SecretKey", "mlKemSecretKey", "sealed"],
+                required: ["keyId", "sealed"],
                 additionalProperties: false,
                 properties: {
-                    x25519SecretKey: { type: "string", minLength: 1 },
-                    mlKemSecretKey: { type: "string", minLength: 1 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     sealed: { type: "string", minLength: 1 },
                 },
             },
         },
     }, async (request, reply) => {
+        const { keyId, sealed } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["x25519-ml-kem-768"]);
         try {
-            const { openPQ } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/sealedbox")));
-            const { x25519SecretKey, mlKemSecretKey, sealed } = request.body;
-            const plaintext = openPQ(x25519SecretKey, mlKemSecretKey, sealed);
+            const { openPQ } = await loadSealedbox();
+            const { x25519PrivateKey, mlKemSecretKey } = key.privateParts;
+            const plaintext = openPQ(x25519PrivateKey, mlKemSecretKey, sealed);
             return reply.send({
                 data: Buffer.from(plaintext).toString("utf8"),
             });
@@ -141,5 +153,11 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
         }
     });
+}
+exports.default = (app) => {
+    registerSeal(app);
+    registerOpen(app);
+    registerSealPq(app);
+    registerOpenPq(app);
 };
 //# sourceMappingURL=sealedbox.js.map

package/dist/routes/v2/secretbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretbox.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/secretbox.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAI/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAyEE"}
+{"version":3,"file":"secretbox.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/secretbox.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAqF/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAGE"}

package/dist/routes/v2/secretbox.js

@@ -34,7 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const loadSecretbox = async () => (await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/high-level")))).secretbox;
+function registerSeal(app) {
     app.post("/v2/secretbox/seal", {
         schema: {
             tags: ["Secretbox"],
@@ -52,7 +53,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { seal } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/secretbox")));
+            const { seal } = await loadSecretbox();
             const { key, plaintext, aad } = request.body;
             const aadBytes = aad ? Buffer.from(aad, "utf8") : undefined;
             return reply.send({ data: seal(key, plaintext, aadBytes) });
@@ -61,6 +62,8 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Encryption");
         }
     });
+}
+function registerOpen(app) {
     app.post("/v2/secretbox/open", {
         schema: {
             tags: ["Secretbox"],
@@ -78,7 +81,7 @@ exports.default = (app) => {
         },
     }, async (request, reply) => {
         try {
-            const { open } = await Promise.resolve().then(() => __importStar(require("@sebastienrousseau/crypto-lib/dist/high-level/secretbox")));
+            const { open } = await loadSecretbox();
             const { key, ciphertext, aad } = request.body;
             const aadBytes = aad ? Buffer.from(aad, "utf8") : undefined;
             const plaintext = open(key, ciphertext, aadBytes);
@@ -90,5 +93,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Decryption");
         }
     });
+}
+exports.default = (app) => {
+    registerSeal(app);
+    registerOpen(app);
 };
 //# sourceMappingURL=secretbox.js.map

package/dist/routes/v2/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/signing.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAQ/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBA6EE"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/signing.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAyF/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAIE"}

package/dist/routes/v2/signing.js

@@ -1,19 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const modern_1 = require("@sebastienrousseau/crypto-lib/dist/modern");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
 const route_helpers_1 = require("../../utils/route-helpers");
-exports.default = (app) => {
+const keys_1 = require("../../utils/keys");
+function registerSign(app) {
     app.post("/v2/sign", {
         schema: {
             tags: ["Signing"],
             summary: "Sign with Ed25519",
-            description: "Create an Ed25519 digital signature over a message.",
+            description: "Create an Ed25519 digital signature over a message with a server-held ed25519 key (keyId from POST /v2/keys/generate).",
             body: {
                 type: "object",
-                required: ["privateKey", "message"],
+                required: ["keyId", "message"],
                 additionalProperties: false,
                 properties: {
-                    privateKey: { type: "string", minLength: 64, maxLength: 64 },
+                    keyId: keys_1.KEY_ID_SCHEMA,
                     message: {
                         type: "string",
                         minLength: 1,
@@ -23,15 +24,13 @@ exports.default = (app) => {
             },
         },
     }, async (request, reply) => {
-        try {
-            const { privateKey, message } = request.body;
-            const result = (0, modern_1.ed25519Sign)(privateKey, message);
-            return reply.send({ data: result });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Signing");
-        }
+        const { keyId, message } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["ed25519"]);
+        const result = (0, modern_1.ed25519Sign)(key.privateParts["privateKey"], message);
+        return reply.send({ data: result });
     });
+}
+function registerVerify(app) {
     app.post("/v2/verify", {
         schema: {
             tags: ["Signing"],
@@ -62,5 +61,9 @@ exports.default = (app) => {
             return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Verification");
         }
     });
+}
+exports.default = (app) => {
+    registerSign(app);
+    registerVerify(app);
 };
 //# sourceMappingURL=signing.js.map

package/dist/routes/v2/stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/stream.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;yBAuQ/B,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAIE"}
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../../src/routes/v2/stream.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;yBAsR/C,KAAK,eAAe,KAAG,IAAI;AAA3C,wBAIE"}

package/dist/routes/v2/stream.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
-const iso20022_1 = require("@sebastienrousseau/crypto-lib/dist/protocols/iso20022");
+const protocols_1 = require("@sebastienrousseau/crypto-lib/protocols");
 const route_helpers_1 = require("../../utils/route-helpers");
+const keys_1 = require("../../utils/keys");
 const SIGN_SCHEMA = {
     tags: ["Streaming"],
     summary: "Batch sign messages with sub-millisecond throughput",
@@ -18,12 +19,12 @@ const SIGN_SCHEMA = {
                 maxItems: 1000,
                 items: {
                     type: "object",
-                    required: ["id", "message", "privateKey"],
+                    required: ["id", "message", "keyId"],
                     additionalProperties: false,
                     properties: {
                         id: { type: "string" },
                         message: { type: "string", minLength: 1 },
-                        privateKey: { type: "string", minLength: 64, maxLength: 64 },
+                        keyId: keys_1.KEY_ID_SCHEMA,
                     },
                 },
             },
@@ -129,28 +130,32 @@ const ISO20022_SCHEMA = {
         },
     },
 };
+async function resolveBatchKeys(request, items) {
+    const keys = new Map();
+    for (const keyId of new Set(items.map((i) => i.keyId))) {
+        keys.set(keyId, await (0, keys_1.resolveKey)(request, keyId, ["ed25519"]));
+    }
+    return keys;
+}
 function registerBatchSign(app) {
     app.post("/v2/stream/sign", { schema: SIGN_SCHEMA }, async (request, reply) => {
-        try {
-            const { items } = request.body;
-            const signatures = items.map((item) => {
-                const res = (0, crypto_lib_1.ed25519Sign)(item.privateKey, item.message);
-                return {
-                    id: item.id,
-                    signature: res.signature,
-                    algorithm: "ed25519",
-                };
-            });
-            return reply.send({
-                data: {
-                    count: signatures.length,
-                    signatures,
-                },
-            });
-        }
-        catch (error) {
-            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Batch signing");
-        }
+        const { items } = request.body;
+        const keys = await resolveBatchKeys(request, items);
+        const signatures = items.map((item) => {
+            const key = keys.get(item.keyId);
+            const res = (0, crypto_lib_1.ed25519Sign)(key.privateParts["privateKey"], item.message);
+            return {
+                id: item.id,
+                signature: res.signature,
+                algorithm: "ed25519",
+            };
+        });
+        return reply.send({
+            data: {
+                count: signatures.length,
+                signatures,
+            },
+        });
     });
 }
 function registerBatchVerify(app) {
@@ -187,7 +192,7 @@ function registerIso20022Verify(app) {
     app.post("/v2/stream/iso20022", { schema: ISO20022_SCHEMA }, async (request, reply) => {
         try {
             const { envelope, payload, trustedKeys } = request.body;
-            const result = (0, iso20022_1.verifyIso20022Payment)(envelope, payload, {
+            const result = (0, protocols_1.verifyIso20022Payment)(envelope, payload, {
                 classicalPublicKeyHex: trustedKeys.classicalPublicKey,
                 postQuantumPublicKeyHex: trustedKeys.postQuantumPublicKey,
             });

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AA4CnC,iBAAe,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CA0DtD;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAuCnC,iBAAe,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CA6EtD;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/server.js

@@ -50,12 +50,13 @@ const swagger_ui_1 = __importDefault(require("@fastify/swagger-ui"));
 const crypto_1 = require("crypto");
 const logger_1 = __importDefault(require("./lib/logger"));
 const auth_1 = require("./lib/auth");
+const auth_policy_1 = require("./config/auth-policy");
 const metering_1 = require("./enterprise/metering");
+const key_store_1 = require("./lib/key-store");
+const kdf_runner_1 = require("./lib/kdf-runner");
+const problem_1 = require("./lib/problem");
 const routes_1 = __importDefault(require("./routes"));
 const fastify = __importStar(require("fastify"));
-function isPublicPath(url) {
-    return (0, constants_1.isProbePath)(url) || url.startsWith("/docs");
-}
 async function registerDocs(app) {
     await app.register(swagger_1.default, {
         openapi: {
@@ -82,7 +83,12 @@ async function registerDocs(app) {
 }
 async function init() {
     const app = fastify.fastify(constants_1.fastifyOptions);
+    const registered = [];
+    app.addHook("onRoute", (route) => {
+        registered.push({ method: route.method, url: route.url });
+    });
     logger_1.default.info("\n\nEnvironment details: " + constants_1.consoleOutput);
+    (0, problem_1.registerProblemHandlers)(app);
     app.addHook("onRequest", async (request, reply) => {
         const reqId = request.headers["x-request-id"] ?? (0, crypto_1.randomUUID)();
         reply.header("x-request-id", reqId);
@@ -107,18 +113,22 @@ async function init() {
     });
     await (0, auth_1.registerAuth)(app);
     app.addHook("onRequest", async (request, reply) => {
-        if (isPublicPath(request.url))
+        if ((0, auth_policy_1.isPublicRoute)(request.url))
             return;
         const auth = await (0, auth_1.authenticate)(request, reply);
-        if (!auth)
+        if (!auth || !(0, auth_1.authorizeRoute)(request, reply, auth))
             return reply;
         request.auth = auth;
     });
+    app.decorate("keyStore", (0, key_store_1.keyStoreFromEnv)());
+    app.decorate("kdf", new kdf_runner_1.KdfRunner());
+    app.addHook("onClose", () => app.kdf.close());
     (0, metering_1.registerMetering)(app);
     await app.register(async (scope) => {
         (0, routes_1.default)(scope);
     });
     await app.ready();
+    (0, auth_policy_1.assertRoutesCovered)(registered);
     return app;
 }
 //# sourceMappingURL=server.js.map

package/dist/utils/keys.d.ts

@@ -0,0 +1,17 @@
+import type { FastifyRequest } from "fastify";
+import { type KeyParts, type KeyStore, type StoredKey } from "../lib/key-store";
+declare module "fastify" {
+    interface FastifyInstance {
+        keyStore: KeyStore;
+    }
+}
+export declare const KEY_ID_SCHEMA: {
+    readonly type: "string";
+    readonly pattern: "^k_[A-Za-z0-9_-]{22}$";
+    readonly description: "Identifier of a server-held key, returned by a key-generation route.";
+};
+export declare function resolveKey(request: FastifyRequest, keyId: string, algorithms?: readonly string[]): Promise<StoredKey>;
+export declare function storeKey(request: FastifyRequest, algorithm: string, publicParts: KeyParts, privateParts: KeyParts): Promise<StoredKey>;
+export declare function serverPgpPrivateKey(): Promise<string>;
+export declare function publicView(key: StoredKey): Record<string, string>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/utils/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/utils/keys.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACb,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,eAAe;QAEvB,QAAQ,EAAE,QAAQ,CAAC;KACpB;CACF;AAGD,eAAO,MAAM,aAAa;;;;CAKhB,CAAC;AAeX,wBAAgB,UAAU,CACxB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,SAAS,CAAC,CAEpB;AAGD,wBAAgB,QAAQ,CACtB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,QAAQ,EACrB,YAAY,EAAE,QAAQ,GACrB,OAAO,CAAC,SAAS,CAAC,CAOpB;AAOD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAG3D;AAGD,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEjE"}

package/dist/utils/keys.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_ID_SCHEMA = void 0;
+exports.resolveKey = resolveKey;
+exports.storeKey = storeKey;
+exports.serverPgpPrivateKey = serverPgpPrivateKey;
+exports.publicView = publicView;
+const pgp_1 = require("@sebastienrousseau/crypto-lib/pgp");
+const key_store_1 = require("../lib/key-store");
+exports.KEY_ID_SCHEMA = {
+    type: "string",
+    pattern: key_store_1.KEY_ID_PATTERN,
+    description: "Identifier of a server-held key, returned by a key-generation route.",
+};
+function principalOf(request) {
+    return request.auth.sub;
+}
+function resolveKey(request, keyId, algorithms) {
+    return request.server.keyStore.get(keyId, principalOf(request), algorithms);
+}
+function storeKey(request, algorithm, publicParts, privateParts) {
+    return request.server.keyStore.put({
+        algorithm,
+        owner: principalOf(request),
+        publicParts,
+        privateParts,
+    });
+}
+async function serverPgpPrivateKey() {
+    const { privateKeyArmored } = await (0, pgp_1.loadKeystore)();
+    return Buffer.from(privateKeyArmored, "latin1").toString("base64");
+}
+function publicView(key) {
+    return { keyId: key.keyId, algorithm: key.algorithm, ...key.publicParts };
+}
+//# sourceMappingURL=keys.js.map

package/dist/utils/route-helpers.d.ts

@@ -7,9 +7,5 @@ export declare function classifyCryptoError(error: unknown, request: {
     log: {
         error: (err: unknown, msg: string) => void;
     };
-}, reply: {
-    status: (code: number) => {
-        send: (body: unknown) => unknown;
-    };
-}, operation: string): unknown;
+}, reply: FastifyReply, operation: string): FastifyReply;
 //# sourceMappingURL=route-helpers.d.ts.map

package/dist/utils/route-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/route-helpers.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAGL,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAOtB,wBAAgB,iBAAiB,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAEnD,OAAO,EAAE,CAAC,EACV,KAAK,EAAE,YAAY,GAEjB;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK;CAAE,GACtE,IAAI,CAmBP;AAUD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;IAAE,GAAG,EAAE;QAAE,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,EAChE,KAAK,EAAE;IAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAA;KAAE,CAAA;CAAE,EACzE,SAAS,EAAE,MAAM,GAChB,OAAO,CAkBT"}
+{"version":3,"file":"route-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/route-helpers.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAGL,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAOtB,wBAAgB,iBAAiB,CAC/B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAEnD,OAAO,EAAE,CAAC,EACV,KAAK,EAAE,YAAY,GAEjB;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK;CAAE,GACtE,IAAI,CAmBP;AAsBD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;IAAE,GAAG,EAAE;QAAE,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,EAChE,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,MAAM,GAChB,YAAY,CA6Bd"}