@southwind-ai/license 0.1.0

package/src/verification.ts

@@ -0,0 +1,199 @@
+import type {
+  LegacyPrototypeLicenseClaims,
+  LegacyPrototypeLicenseVerificationResult,
+  LegacyPrototypeSignedLicense,
+  LicenseVerificationResult,
+  SignedLicense,
+} from "@southwind-ai/shared";
+import { createLicenseSigningPayload } from "./payload.js";
+
+export type LicensePublicKeyMap = Record<string, string>;
+
+export type LicensePublicKeyResolver = (
+  publicKeyId: string,
+) => Promise<string | undefined> | string | undefined;
+
+export type LicensePublicKeySource =
+  | LicensePublicKeyMap
+  | LicensePublicKeyResolver;
+
+export async function verifySignedLicense(
+  license: SignedLicense,
+  publicKeySource: LicensePublicKeySource,
+): Promise<LicenseVerificationResult> {
+  if (license.formatVersion !== 1) {
+    return { valid: false, failures: ["unsupported-format"] };
+  }
+  if (license.algorithm !== "ED25519") {
+    return { valid: false, failures: ["invalid-format"] };
+  }
+  const publicKeyPem = await resolvePublicKey(
+    publicKeySource,
+    license.publicKeyId,
+  );
+  if (!publicKeyPem) {
+    return { valid: false, failures: ["unknown-public-key"] };
+  }
+  const valid = await verifyLicenseSignature(license, publicKeyPem);
+  return valid
+    ? { valid: true, claims: license.claims, failures: [] }
+    : { valid: false, failures: ["invalid-signature"] };
+}
+
+export async function verifyLicenseSignature(
+  license: SignedLicense,
+  publicKeyPem: string,
+): Promise<boolean> {
+  try {
+    return verifyLicensePayloadSignature(
+      createLicenseSigningPayload({
+        formatVersion: 1,
+        algorithm: license.algorithm,
+        publicKeyId: license.publicKeyId,
+        claims: license.claims,
+      }),
+      license.signature,
+      publicKeyPem,
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Explicit read-only compatibility path. It must never be used to issue. */
+export const legacyPrototypeLicensePayloadReader = {
+  parse(payload: string): LegacyPrototypeLicenseClaims {
+    return JSON.parse(payload) as LegacyPrototypeLicenseClaims;
+  },
+  serializeForVerification(claims: LegacyPrototypeLicenseClaims): string {
+    return JSON.stringify(claims);
+  },
+} as const;
+
+export async function verifyLegacyPrototypeSignedLicense(
+  license: LegacyPrototypeSignedLicense,
+  publicKeySource: LicensePublicKeySource,
+): Promise<LegacyPrototypeLicenseVerificationResult> {
+  if ((license.algorithm as string) !== "ED25519") {
+    return { valid: false, failures: ["invalid-signature"] };
+  }
+  const publicKeyPem = await resolvePublicKey(
+    publicKeySource,
+    license.publicKeyId,
+  );
+  if (!publicKeyPem) {
+    return { valid: false, failures: ["invalid-signature"] };
+  }
+  const valid = await verifyLicensePayloadSignature(
+    legacyPrototypeLicensePayloadReader.serializeForVerification(
+      license.claims,
+    ),
+    license.signature,
+    publicKeyPem,
+  );
+  return valid
+    ? { valid: true, claims: license.claims, failures: [] }
+    : { valid: false, failures: ["invalid-signature"] };
+}
+
+export async function verifyLicensePayloadSignature(
+  payload: string,
+  signatureBase64: string,
+  publicKeyPem: string,
+): Promise<boolean> {
+  let payloadBytes: Uint8Array;
+  let signature: Uint8Array;
+  try {
+    payloadBytes = new TextEncoder().encode(payload);
+    signature = base64ToBytes(signatureBase64);
+  } catch {
+    return false;
+  }
+  const webCryptoResult = await verifyWithWebCrypto(
+    publicKeyPem,
+    signature,
+    payloadBytes,
+  );
+  if (webCryptoResult !== undefined) return webCryptoResult;
+  return verifyWithNodeCrypto(publicKeyPem, signature, payloadBytes);
+}
+
+async function resolvePublicKey(
+  source: LicensePublicKeySource,
+  publicKeyId: string,
+): Promise<string | undefined> {
+  return typeof source === "function"
+    ? source(publicKeyId)
+    : source[publicKeyId];
+}
+
+async function verifyWithWebCrypto(
+  publicKeyPem: string,
+  signature: Uint8Array,
+  payload: Uint8Array,
+): Promise<boolean | undefined> {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) return undefined;
+  try {
+    const algorithm: AlgorithmIdentifier = { name: "Ed25519" };
+    const publicKey = await subtle.importKey(
+      "spki",
+      toArrayBuffer(pemToDer(publicKeyPem)),
+      algorithm,
+      false,
+      ["verify"],
+    );
+    return subtle.verify(
+      algorithm,
+      publicKey,
+      toArrayBuffer(signature),
+      toArrayBuffer(payload),
+    );
+  } catch {
+    return undefined;
+  }
+}
+
+async function verifyWithNodeCrypto(
+  publicKeyPem: string,
+  signature: Uint8Array,
+  payload: Uint8Array,
+): Promise<boolean> {
+  try {
+    const { createPublicKey, verify } = await import("node:crypto");
+    return verify(null, payload, createPublicKey(publicKeyPem), signature);
+  } catch {
+    return false;
+  }
+}
+
+function pemToDer(pem: string): Uint8Array {
+  return base64ToBytes(
+    pem
+      .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+      .replace(/-----END PUBLIC KEY-----/g, "")
+      .replace(/\s+/g, ""),
+  );
+}
+
+function base64ToBytes(value: string): Uint8Array {
+  if (
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(
+      value,
+    )
+  ) {
+    throw new Error("无效 Base64");
+  }
+  if (typeof atob === "function") {
+    const binary = atob(value);
+    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  }
+  return new Uint8Array(Buffer.from(value, "base64"));
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength,
+  ) as ArrayBuffer;
+}