@sebastienrousseau/crypto-server 0.0.9 → 0.0.24

package/dist/routes/v2/stream.js

@@ -1,135 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const streaming_1 = require("@sebastienrousseau/crypto-lib/streaming");
 const protocols_1 = require("@sebastienrousseau/crypto-lib/protocols");
 const route_helpers_1 = require("../../utils/route-helpers");
 const keys_1 = require("../../utils/keys");
-const SIGN_SCHEMA = {
-    tags: ["Streaming"],
-    summary: "Batch sign messages with sub-millisecond throughput",
-    description: "Process high-throughput batch digital signing operations over multiple payloads.",
-    body: {
-        type: "object",
-        required: ["items"],
-        additionalProperties: false,
-        properties: {
-            items: {
-                type: "array",
-                minItems: 1,
-                maxItems: 1000,
-                items: {
-                    type: "object",
-                    required: ["id", "message", "keyId"],
-                    additionalProperties: false,
-                    properties: {
-                        id: { type: "string" },
-                        message: { type: "string", minLength: 1 },
-                        keyId: keys_1.KEY_ID_SCHEMA,
-                    },
-                },
-            },
-        },
-    },
-};
-const VERIFY_SCHEMA = {
-    tags: ["Streaming"],
-    summary: "Batch verify digital signatures",
-    description: "Batch verification pipeline for high-concurrency payment and transaction verification.",
-    body: {
-        type: "object",
-        required: ["items"],
-        additionalProperties: false,
-        properties: {
-            items: {
-                type: "array",
-                minItems: 1,
-                maxItems: 1000,
-                items: {
-                    type: "object",
-                    required: ["id", "message", "signature", "publicKey"],
-                    additionalProperties: false,
-                    properties: {
-                        id: { type: "string" },
-                        message: { type: "string", minLength: 1 },
-                        signature: { type: "string", minLength: 1 },
-                        publicKey: { type: "string", minLength: 64, maxLength: 64 },
-                    },
-                },
-            },
-        },
-    },
-};
-const ISO20022_SCHEMA = {
-    tags: ["Wholesale Payments"],
-    summary: "Verify ISO 20022 post-quantum dual-signature envelope",
-    description: "Validates the payload digest and both the Ed25519 and ML-DSA signatures of a pacs.008, pain.001 or camt.053 envelope. Signatures are checked against trustedKeys, the signer's public keys from the caller's own registry; the public keys inside the envelope are ignored.",
-    body: {
-        type: "object",
-        required: ["envelope", "payload", "trustedKeys"],
-        additionalProperties: false,
-        properties: {
-            trustedKeys: {
-                type: "object",
-                required: ["classicalPublicKey", "postQuantumPublicKey"],
-                additionalProperties: false,
-                properties: {
-                    classicalPublicKey: { type: "string", minLength: 1 },
-                    postQuantumPublicKey: { type: "string", minLength: 1 },
-                },
-            },
-            envelope: {
-                type: "object",
-                required: [
-                    "messageId",
-                    "messageType",
-                    "payloadDigest",
-                    "digestAlgorithm",
-                    "timestamp",
-                    "classical",
-                    "postQuantum",
-                ],
-                additionalProperties: false,
-                properties: {
-                    messageId: { type: "string" },
-                    messageType: {
-                        type: "string",
-                        enum: ["pacs.008", "pain.001", "camt.053", "generic"],
-                    },
-                    payloadDigest: { type: "string" },
-                    digestAlgorithm: {
-                        type: "string",
-                        enum: ["sha256", "sha384", "sha512"],
-                    },
-                    timestamp: { type: "string" },
-                    classical: {
-                        type: "object",
-                        required: ["algorithm", "signature", "publicKey"],
-                        additionalProperties: false,
-                        properties: {
-                            algorithm: { type: "string" },
-                            signature: { type: "string" },
-                            publicKey: { type: "string" },
-                        },
-                    },
-                    postQuantum: {
-                        type: "object",
-                        required: ["algorithm", "signature", "publicKey"],
-                        additionalProperties: false,
-                        properties: {
-                            algorithm: {
-                                type: "string",
-                                enum: ["ml-dsa-44", "ml-dsa-65", "ml-dsa-87"],
-                            },
-                            signature: { type: "string" },
-                            publicKey: { type: "string" },
-                        },
-                    },
-                },
-            },
-            payload: {},
-        },
-    },
-};
+const stream_schemas_1 = require("./stream-schemas");
 async function resolveBatchKeys(request, items) {
     const keys = new Map();
     for (const keyId of new Set(items.map((i) => i.keyId))) {
@@ -138,7 +14,7 @@ async function resolveBatchKeys(request, items) {
     return keys;
 }
 function registerBatchSign(app) {
-    app.post("/v2/stream/sign", { schema: SIGN_SCHEMA }, async (request, reply) => {
+    app.post("/v2/stream/sign", { schema: stream_schemas_1.SIGN_SCHEMA }, async (request, reply) => {
         const { items } = request.body;
         const keys = await resolveBatchKeys(request, items);
         const signatures = items.map((item) => {
@@ -159,7 +35,10 @@ function registerBatchSign(app) {
     });
 }
 function registerBatchVerify(app) {
-    app.post("/v2/stream/verify", { schema: VERIFY_SCHEMA }, async (request, reply) => {
+    app.post("/v2/stream/verify", {
+        schema: stream_schemas_1.VERIFY_SCHEMA,
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+    }, async (request, reply) => {
         try {
             const { items } = request.body;
             let validCount = 0;
@@ -189,7 +68,10 @@ function registerBatchVerify(app) {
     });
 }
 function registerIso20022Verify(app) {
-    app.post("/v2/stream/iso20022", { schema: ISO20022_SCHEMA }, async (request, reply) => {
+    app.post("/v2/stream/iso20022", {
+        schema: stream_schemas_1.ISO20022_SCHEMA,
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+    }, async (request, reply) => {
         try {
             const { envelope, payload, trustedKeys } = request.body;
             const result = (0, protocols_1.verifyIso20022Payment)(envelope, payload, {
@@ -203,9 +85,115 @@ function registerIso20022Verify(app) {
         }
     });
 }
+function registerStreamPqEncrypt(app) {
+    app.post("/v2/stream/pq-encrypt", { schema: stream_schemas_1.STREAM_PQ_ENCRYPT_SCHEMA }, async (request, reply) => {
+        try {
+            const { x25519PublicKey, mlKemPublicKey, plaintext, chunkSize } = request.body;
+            const ptBytes = Buffer.from(plaintext, "utf8");
+            const res = (0, streaming_1.streamPqEncrypt)({
+                recipientX25519Public: x25519PublicKey,
+                recipientMlKemPublic: mlKemPublicKey,
+                plaintext: ptBytes,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+            return reply.send({
+                data: {
+                    ciphertext: Buffer.from(res.ciphertext).toString("base64"),
+                    algorithm: res.algorithm,
+                },
+            });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "PQ stream encryption");
+        }
+    });
+}
+function registerStreamPqDecrypt(app) {
+    app.post("/v2/stream/pq-decrypt", { schema: stream_schemas_1.STREAM_PQ_DECRYPT_SCHEMA }, async (request, reply) => {
+        const { keyId, ciphertext, chunkSize } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["x25519-ml-kem-768"]);
+        try {
+            const ctBytes = Buffer.from(ciphertext, "base64");
+            const decrypted = (0, streaming_1.streamPqDecrypt)({
+                recipientX25519Secret: key.privateParts["x25519PrivateKey"],
+                recipientMlKemSecret: key.privateParts["mlKemSecretKey"],
+                ciphertext: ctBytes,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+            const plaintext = Buffer.from(decrypted).toString("utf8");
+            (0, crypto_lib_1.wipeMemory)(decrypted);
+            return reply.send({ data: { plaintext } });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "PQ stream decryption");
+        }
+    });
+}
+function registerStreamMultiPqEncrypt(app) {
+    app.post("/v2/stream/multi-pq-encrypt", { schema: stream_schemas_1.STREAM_MULTI_PQ_ENCRYPT_SCHEMA }, async (request, reply) => {
+        try {
+            const { recipients, plaintext, chunkSize } = request.body;
+            const ptBytes = Buffer.from(plaintext, "utf8");
+            const res = (0, streaming_1.streamMultiPqEncrypt)({
+                recipients: recipients.map((r) => ({
+                    recipientId: r.recipientId,
+                    recipientX25519Public: r.x25519PublicKey,
+                    recipientMlKemPublic: r.mlKemPublicKey,
+                })),
+                plaintext: ptBytes,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+            (0, crypto_lib_1.wipeMemory)(ptBytes);
+            return reply.send({
+                data: {
+                    ciphertext: Buffer.from(res.ciphertext).toString("base64"),
+                    algorithm: res.algorithm,
+                    recipientCount: res.recipientCount,
+                },
+            });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Multi-PQ stream encryption");
+        }
+    });
+}
+function registerStreamMultiPqDecrypt(app) {
+    app.post("/v2/stream/multi-pq-decrypt", {
+        schema: stream_schemas_1.STREAM_MULTI_PQ_DECRYPT_SCHEMA,
+        config: { rateLimit: { max: 100, timeWindow: "1 minute" } },
+    }, async (request, reply) => {
+        const { keyId, recipientId, ciphertext, chunkSize } = request.body;
+        const key = await (0, keys_1.resolveKey)(request, keyId, ["x25519-ml-kem-768"]);
+        try {
+            const ctBytes = Buffer.from(ciphertext, "base64");
+            const decrypted = (0, streaming_1.streamMultiPqDecrypt)({
+                ...(recipientId !== undefined ? { recipientId } : {}),
+                recipientX25519Secret: key.privateParts["x25519PrivateKey"],
+                recipientMlKemSecret: key.privateParts["mlKemSecretKey"],
+                ciphertext: ctBytes,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+            const plaintext = Buffer.from(decrypted.plaintext).toString("utf8");
+            (0, crypto_lib_1.wipeMemory)(decrypted.plaintext);
+            return reply.send({
+                data: {
+                    plaintext,
+                    recipientId: decrypted.recipientId,
+                },
+            });
+        }
+        catch (error) {
+            return (0, route_helpers_1.classifyCryptoError)(error, request, reply, "Multi-PQ stream decryption");
+        }
+    });
+}
 exports.default = (app) => {
     registerBatchSign(app);
     registerBatchVerify(app);
     registerIso20022Verify(app);
+    registerStreamPqEncrypt(app);
+    registerStreamPqDecrypt(app);
+    registerStreamMultiPqEncrypt(app);
+    registerStreamMultiPqDecrypt(app);
 };
 //# sourceMappingURL=stream.js.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAuCnC,iBAAe,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CA6EtD;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAuCnC,iBAAe,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAgFtD;AAED,OAAO,EAAE,IAAI,EAAE,CAAC"}

package/dist/server.js

@@ -55,6 +55,8 @@ const metering_1 = require("./enterprise/metering");
 const key_store_1 = require("./lib/key-store");
 const kdf_runner_1 = require("./lib/kdf-runner");
 const problem_1 = require("./lib/problem");
+const trace_1 = require("./utils/trace");
+const opaque_store_1 = require("./lib/opaque-store");
 const routes_1 = __importDefault(require("./routes"));
 const fastify = __importStar(require("fastify"));
 async function registerDocs(app) {
@@ -92,6 +94,7 @@ async function init() {
     app.addHook("onRequest", async (request, reply) => {
         const reqId = request.headers["x-request-id"] ?? (0, crypto_1.randomUUID)();
         reply.header("x-request-id", reqId);
+        (0, trace_1.propagateTraceContext)(request, reply);
     });
     app.addHook("onSend", async (request, reply) => {
         if (request.url.startsWith("/v2/")) {
@@ -122,6 +125,7 @@ async function init() {
     });
     app.decorate("keyStore", (0, key_store_1.keyStoreFromEnv)());
     app.decorate("kdf", new kdf_runner_1.KdfRunner());
+    app.decorate("opaqueStore", new opaque_store_1.OpaqueStore());
     app.addHook("onClose", () => app.kdf.close());
     (0, metering_1.registerMetering)(app);
     await app.register(async (scope) => {

package/dist/utils/trace.d.ts

@@ -0,0 +1,12 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+export interface TraceparentComponents {
+    version: string;
+    traceId: string;
+    parentId: string;
+    flags: string;
+}
+export declare function isValidTraceparent(header: unknown): header is string;
+export declare function parseTraceparent(header: string): TraceparentComponents | null;
+export declare function generateTraceparent(sampled?: boolean): string;
+export declare function propagateTraceContext(request: FastifyRequest, reply: FastifyReply): void;
+//# sourceMappingURL=trace.d.ts.map

package/dist/utils/trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/utils/trace.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAa5D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAQD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,MAAM,CAUpE;AAQD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAS7E;AAQD,wBAAgB,mBAAmB,CAAC,OAAO,UAAO,GAAG,MAAM,CAK1D;AASD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,IAAI,CAqBN"}

package/dist/utils/trace.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidTraceparent = isValidTraceparent;
+exports.parseTraceparent = parseTraceparent;
+exports.generateTraceparent = generateTraceparent;
+exports.propagateTraceContext = propagateTraceContext;
+const crypto_1 = require("crypto");
+const TRACEPARENT_REGEX = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
+const ALL_ZERO_TRACE_ID = "0".repeat(32);
+const ALL_ZERO_PARENT_ID = "0".repeat(16);
+function isValidTraceparent(header) {
+    if (typeof header !== "string")
+        return false;
+    const match = TRACEPARENT_REGEX.exec(header.trim());
+    if (!match)
+        return false;
+    const traceId = match[1];
+    const parentId = match[2];
+    if (traceId === ALL_ZERO_TRACE_ID || parentId === ALL_ZERO_PARENT_ID) {
+        return false;
+    }
+    return true;
+}
+function parseTraceparent(header) {
+    if (!isValidTraceparent(header))
+        return null;
+    const match = TRACEPARENT_REGEX.exec(header.trim());
+    return {
+        version: "00",
+        traceId: match[1],
+        parentId: match[2],
+        flags: match[3],
+    };
+}
+function generateTraceparent(sampled = true) {
+    const traceId = (0, crypto_1.randomBytes)(16).toString("hex");
+    const parentId = (0, crypto_1.randomBytes)(8).toString("hex");
+    const flags = sampled ? "01" : "00";
+    return `00-${traceId}-${parentId}-${flags}`;
+}
+function propagateTraceContext(request, reply) {
+    const incoming = request.headers["traceparent"];
+    let traceparentValue;
+    if (isValidTraceparent(incoming)) {
+        traceparentValue = incoming.trim();
+        const tracestate = request.headers["tracestate"];
+        if (typeof tracestate === "string" && tracestate.trim().length > 0) {
+            reply.header("tracestate", tracestate.trim());
+        }
+    }
+    else {
+        traceparentValue = generateTraceparent();
+    }
+    reply.header("traceparent", traceparentValue);
+    const parsed = parseTraceparent(traceparentValue);
+    if (parsed) {
+        request.traceId = parsed.traceId;
+    }
+    request.traceparent =
+        traceparentValue;
+}
+//# sourceMappingURL=trace.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/crypto-server",
-  "version": "0.0.9",
+  "version": "0.0.24",
   "description": "Crypto Server is a Fastify web server that exposes easy consumable REST APIs to perform low-level cryptographic operations.",
   "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
   "license": "MIT OR Apache-2.0",
@@ -60,7 +60,8 @@
     "fastify-healthcheck": "^5.1.0",
     "uuid": "^14.0.2",
     "winston": "^3.17.0",
-    "@sebastienrousseau/crypto-lib": "0.0.9"
+    "@sebastienrousseau/crypto-kms": "0.0.24",
+    "@sebastienrousseau/crypto-lib": "0.0.24"
   },
   "devDependencies": {
     "@types/chai": "^5.2.3",
@@ -73,7 +74,7 @@
     "chai-as-promised": "^8.0.2",
     "fast-check": "^4.10.2",
     "mocha": "^12.0.3",
-    "openpgp": "^6.3.1",
+    "openpgp": "^6.3.2",
     "prettier": "^3.9.9",
     "rimraf": "^6.1.3",
     "ts-node": "^10.9.2",