@sphereon/ssi-sdk-ext.key-manager 0.28.1-feature.oyd.cmsm.improv.21 → 0.28.1-next.54

package/dist/index.cjs

@@ -0,0 +1,615 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// plugin.schema.json
+var require_plugin_schema = __commonJS({
+  "plugin.schema.json"(exports, module2) {
+    module2.exports = {
+      ISphereonKeyManager: {
+        components: {
+          schemas: {
+            ISphereonKeyManagerCreateArgs: {
+              type: "object",
+              properties: {
+                type: {
+                  $ref: "#/components/schemas/TKeyType",
+                  description: "Key type"
+                },
+                kms: {
+                  type: "string",
+                  description: "Key Management System"
+                },
+                opts: {
+                  $ref: "#/components/schemas/IkeyOptions",
+                  description: "Key options"
+                },
+                meta: {
+                  $ref: "#/components/schemas/KeyMetadata",
+                  description: "Optional. Key meta data"
+                }
+              },
+              required: ["type"],
+              description: "Input arguments for  {@link ISphereonKeyManager.keyManagerCreate | keyManagerCreate }"
+            },
+            TKeyType: {
+              type: "string",
+              enum: ["Ed25519", "Secp256k1", "Secp256r1", "X25519", "Bls12381G1", "Bls12381G2", "RSA"],
+              description: "Cryptographic key type."
+            },
+            IkeyOptions: {
+              type: "object",
+              properties: {
+                ephemeral: {
+                  type: "boolean",
+                  description: "Is this a temporary key?"
+                },
+                expiration: {
+                  type: "object",
+                  properties: {
+                    expiryDate: {
+                      type: "string",
+                      format: "date-time"
+                    },
+                    removalDate: {
+                      type: "string",
+                      format: "date-time"
+                    }
+                  },
+                  description: "Expiration and remove the key"
+                }
+              }
+            },
+            KeyMetadata: {
+              type: "object",
+              properties: {
+                algorithms: {
+                  type: "array",
+                  items: {
+                    type: "string"
+                  }
+                }
+              },
+              description: "This encapsulates data about a key.\n\nImplementations of  {@link  @veramo/key-manager#AbstractKeyManagementSystem | AbstractKeyManagementSystem }  should populate this object, for each key, with the algorithms that can be performed using it.\n\nThis can also be used to add various tags to the keys under management."
+            },
+            PartialKey: {
+              type: "object",
+              properties: {
+                privateKeyHex: {
+                  type: "string"
+                },
+                kid: {
+                  type: "string",
+                  description: "Key ID"
+                },
+                kms: {
+                  type: "string",
+                  description: "Key Management System"
+                },
+                type: {
+                  $ref: "#/components/schemas/TKeyType",
+                  description: "Key type"
+                },
+                publicKeyHex: {
+                  type: "string",
+                  description: "Public key"
+                },
+                meta: {
+                  anyOf: [
+                    {
+                      $ref: "#/components/schemas/KeyMetadata"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ],
+                  description: "Optional. Key metadata. This should be used to determine which algorithms are supported."
+                }
+              },
+              required: ["kid", "kms", "privateKeyHex", "publicKeyHex", "type"]
+            },
+            ISphereonKeyManagerHandleExpirationsArgs: {
+              type: "object",
+              properties: {
+                skipRemovals: {
+                  type: "boolean"
+                }
+              }
+            },
+            ManagedKeyInfo: {
+              type: "object",
+              properties: {
+                kid: {
+                  type: "string",
+                  description: "Key ID"
+                },
+                kms: {
+                  type: "string",
+                  description: "Key Management System"
+                },
+                type: {
+                  $ref: "#/components/schemas/TKeyType",
+                  description: "Key type"
+                },
+                publicKeyHex: {
+                  type: "string",
+                  description: "Public key"
+                },
+                meta: {
+                  anyOf: [
+                    {
+                      $ref: "#/components/schemas/KeyMetadata"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ],
+                  description: "Optional. Key metadata. This should be used to determine which algorithms are supported."
+                }
+              },
+              required: ["kid", "kms", "type", "publicKeyHex"],
+              description: "Represents information about a managed key. Private or secret key material is NOT present."
+            },
+            MinimalImportableKey: {
+              $ref: '#/components/schemas/RequireOnly<IKey,("privateKeyHex"|"type"|"kms")>',
+              description: "Represents the properties required to import a key."
+            },
+            'RequireOnly<IKey,("privateKeyHex"|"type"|"kms")>': {
+              type: "object",
+              properties: {
+                kid: {
+                  type: "string",
+                  description: "Key ID"
+                },
+                kms: {
+                  type: "string",
+                  description: "Key Management System"
+                },
+                type: {
+                  $ref: "#/components/schemas/TKeyType",
+                  description: "Key type"
+                },
+                publicKeyHex: {
+                  type: "string",
+                  description: "Public key"
+                },
+                privateKeyHex: {
+                  type: "string",
+                  description: "Optional. Private key"
+                },
+                meta: {
+                  anyOf: [
+                    {
+                      $ref: "#/components/schemas/KeyMetadata"
+                    },
+                    {
+                      type: "null"
+                    }
+                  ],
+                  description: "Optional. Key metadata. This should be used to determine which algorithms are supported."
+                }
+              },
+              description: "Represents an object type where a subset of keys are required and everything else is optional."
+            },
+            ISphereonKeyManagerSignArgs: {
+              type: "object",
+              properties: {
+                keyRef: {
+                  type: "string",
+                  description: "The key handle, as returned during `keyManagerCreateKey`"
+                },
+                algorithm: {
+                  type: "string",
+                  description: "The algorithm to use for signing. This must be one of the algorithms supported by the KMS for this key type.\n\nThe algorithm used here should match one of the names listed in `IKey.meta.algorithms`"
+                },
+                data: {
+                  anyOf: [
+                    {
+                      type: "string"
+                    },
+                    {
+                      type: "object",
+                      properties: {
+                        BYTES_PER_ELEMENT: {
+                          type: "number"
+                        },
+                        buffer: {
+                          anyOf: [
+                            {
+                              type: "object",
+                              properties: {
+                                byteLength: {
+                                  type: "number"
+                                }
+                              },
+                              required: ["byteLength"]
+                            },
+                            {}
+                          ]
+                        },
+                        byteLength: {
+                          type: "number"
+                        },
+                        byteOffset: {
+                          type: "number"
+                        },
+                        length: {
+                          type: "number"
+                        }
+                      },
+                      required: ["BYTES_PER_ELEMENT", "buffer", "byteLength", "byteOffset", "length"],
+                      additionalProperties: {
+                        type: "number"
+                      }
+                    }
+                  ],
+                  description: "Data to sign"
+                },
+                encoding: {
+                  type: "string",
+                  enum: ["utf-8", "base16", "base64", "hex"],
+                  description: 'If the data is a "string" then you can specify which encoding is used. Default is "utf-8"'
+                }
+              },
+              required: ["data", "keyRef"],
+              description: "Input arguments for  {@link ISphereonKeyManagerSignArgs.keyManagerSign | keyManagerSign }"
+            },
+            ISphereonKeyManagerVerifyArgs: {
+              type: "object",
+              properties: {
+                kms: {
+                  type: "string"
+                },
+                publicKeyHex: {
+                  type: "string"
+                },
+                type: {
+                  $ref: "#/components/schemas/TKeyType"
+                },
+                algorithm: {
+                  type: "string"
+                },
+                data: {
+                  type: "object",
+                  properties: {
+                    BYTES_PER_ELEMENT: {
+                      type: "number"
+                    },
+                    buffer: {
+                      anyOf: [
+                        {
+                          type: "object",
+                          properties: {
+                            byteLength: {
+                              type: "number"
+                            }
+                          },
+                          required: ["byteLength"]
+                        },
+                        {}
+                      ]
+                    },
+                    byteLength: {
+                      type: "number"
+                    },
+                    byteOffset: {
+                      type: "number"
+                    },
+                    length: {
+                      type: "number"
+                    }
+                  },
+                  required: ["BYTES_PER_ELEMENT", "buffer", "byteLength", "byteOffset", "length"],
+                  additionalProperties: {
+                    type: "number"
+                  }
+                },
+                signature: {
+                  type: "string"
+                }
+              },
+              required: ["publicKeyHex", "type", "data", "signature"]
+            }
+          },
+          methods: {
+            keyManagerCreate: {
+              description: "",
+              arguments: {
+                $ref: "#/components/schemas/ISphereonKeyManagerCreateArgs"
+              },
+              returnType: {
+                $ref: "#/components/schemas/PartialKey"
+              }
+            },
+            keyManagerGetDefaultKeyManagementSystem: {
+              description: "Get the KMS registered as default. Handy when no explicit KMS is provided for a function",
+              arguments: {
+                type: "object"
+              },
+              returnType: {
+                type: "string"
+              }
+            },
+            keyManagerHandleExpirations: {
+              description: "Set keys to expired and remove keys eligible for deletion.",
+              arguments: {
+                $ref: "#/components/schemas/ISphereonKeyManagerHandleExpirationsArgs"
+              },
+              returnType: {
+                type: "array",
+                items: {
+                  $ref: "#/components/schemas/ManagedKeyInfo"
+                }
+              }
+            },
+            keyManagerImport: {
+              description: "",
+              arguments: {
+                $ref: "#/components/schemas/MinimalImportableKey"
+              },
+              returnType: {
+                $ref: "#/components/schemas/PartialKey"
+              }
+            },
+            keyManagerListKeys: {
+              description: "",
+              arguments: {
+                type: "object"
+              },
+              returnType: {
+                type: "array",
+                items: {
+                  $ref: "#/components/schemas/ManagedKeyInfo"
+                }
+              }
+            },
+            keyManagerSign: {
+              description: "",
+              arguments: {
+                $ref: "#/components/schemas/ISphereonKeyManagerSignArgs"
+              },
+              returnType: {
+                type: "string"
+              }
+            },
+            keyManagerVerify: {
+              description: "Verifies a signature using the key",
+              arguments: {
+                $ref: "#/components/schemas/ISphereonKeyManagerVerifyArgs"
+              },
+              returnType: {
+                type: "boolean"
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  SphereonKeyManager: () => SphereonKeyManager,
+  hasKeyOptions: () => hasKeyOptions,
+  isDefined: () => isDefined,
+  schema: () => schema,
+  sphereonKeyManagerMethods: () => sphereonKeyManagerMethods
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/agent/SphereonKeyManager.ts
+var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.key-utils");
+var import_key_manager = require("@veramo/key-manager");
+var u8a = __toESM(require("uint8arrays"), 1);
+
+// src/types/ISphereonKeyManager.ts
+function hasKeyOptions(object) {
+  return object && "opts" in object && ("ephemeral" in object.opts || "expiration" in object.opts);
+}
+__name(hasKeyOptions, "hasKeyOptions");
+var isDefined = /* @__PURE__ */ __name((object) => object !== void 0, "isDefined");
+
+// src/agent/SphereonKeyManager.ts
+var { fromString } = u8a;
+var sphereonKeyManagerMethods = [
+  "keyManagerCreate",
+  "keyManagerGet",
+  "keyManagerImport",
+  "keyManagerSign",
+  "keyManagerVerify",
+  "keyManagerListKeys",
+  "keyManagerGetDefaultKeyManagementSystem",
+  "keyManagerHandleExpirations"
+];
+var SphereonKeyManager = class extends import_key_manager.KeyManager {
+  static {
+    __name(this, "SphereonKeyManager");
+  }
+  // local store reference, given the superclass store is private, and we need additional functions/calls
+  kmsStore;
+  availableKmses;
+  _defaultKms;
+  kmsMethods;
+  constructor(options) {
+    super({
+      store: options.store,
+      kms: options.kms
+    });
+    this.kmsStore = options.store;
+    this.availableKmses = options.kms;
+    this._defaultKms = options.defaultKms ?? Object.keys(this.availableKmses)[0];
+    if (!Object.keys(this.availableKmses).includes(this._defaultKms)) {
+      throw Error(`Default KMS needs to be listed in the kms object as well. Found kms-es: ${Object.keys(this.availableKmses).join(",")}`);
+    }
+    const methods = this.methods;
+    methods.keyManagerVerify = this.keyManagerVerify.bind(this);
+    methods.keyManagerListKeys = this.keyManagerListKeys.bind(this);
+    methods.keyManagerGetDefaultKeyManagementSystem = this.keyManagerGetDefaultKeyManagementSystem.bind(this);
+    this.kmsMethods = methods;
+  }
+  keyManagerGetDefaultKeyManagementSystem() {
+    return Promise.resolve(this._defaultKms);
+  }
+  async keyManagerCreate(args) {
+    const kms = this.getKmsByName(args.kms ?? this._defaultKms);
+    const meta = {
+      ...args.meta,
+      ...args.opts && {
+        opts: args.opts
+      }
+    };
+    if (hasKeyOptions(meta) && meta.opts?.ephemeral && !meta.opts.expiration?.removalDate) {
+      meta.opts = {
+        ...meta.opts,
+        expiration: {
+          ...meta.opts?.expiration,
+          removalDate: new Date(Date.now() + 5 * 60 * 1e3)
+        }
+      };
+    }
+    const partialKey = await kms.createKey({
+      type: args.type,
+      meta
+    });
+    const key = {
+      ...partialKey,
+      kms: args.kms ?? this._defaultKms
+    };
+    key.meta = {
+      ...meta,
+      ...key.meta
+    };
+    key.meta.jwkThumbprint = key.meta.jwkThumbprint ?? (0, import_ssi_sdk_ext.calculateJwkThumbprintForKey)({
+      key
+    });
+    await this.kmsStore.import(key);
+    if (key.privateKeyHex) {
+      delete key.privateKeyHex;
+    }
+    return key;
+  }
+  //FIXME extend the IKeyManagerSignArgs.data to be a string or array of strings
+  async keyManagerSign(args) {
+    const keyInfo = await this.keyManagerGet({
+      kid: args.keyRef
+    });
+    const kms = this.getKmsByName(keyInfo.kms);
+    if (keyInfo.type === "Bls12381G2") {
+      return await kms.sign({
+        keyRef: keyInfo,
+        data: typeof args.data === "string" ? fromString(args.data) : args.data
+      });
+    }
+    return await super.keyManagerSign({
+      ...args,
+      keyRef: keyInfo.kid
+    });
+  }
+  async keyManagerVerify(args) {
+    if (args.kms) {
+      const kms = this.getKmsByName(args.kms);
+      if (kms && "verify" in kms && typeof kms.verify === "function") {
+        return await kms.verify(args);
+      }
+    }
+    return await (0, import_ssi_sdk_ext.verifyRawSignature)({
+      key: (0, import_ssi_sdk_ext.toJwk)(args.publicKeyHex, args.type),
+      data: args.data,
+      signature: fromString(args.signature, "utf-8")
+    });
+  }
+  async keyManagerListKeys() {
+    return this.kmsStore.list({});
+  }
+  async keyManagerHandleExpirations(args) {
+    const keys = await this.keyManagerListKeys();
+    const expiredKeys = keys.filter((key) => hasKeyOptions(key.meta)).filter((key) => {
+      if (hasKeyOptions(key.meta) && key.meta?.opts?.expiration) {
+        const expiration = key.meta.opts.expiration;
+        return !(expiration.expiryDate && expiration.expiryDate.getMilliseconds() > Date.now());
+      }
+      return false;
+    });
+    if (args.skipRemovals !== true) {
+      await Promise.all(expiredKeys.map((key) => this.keyManagerDelete({
+        kid: key.kid
+      })));
+    }
+    return keys;
+  }
+  getKmsByName(name) {
+    const kms = this.availableKmses[name];
+    if (!kms) {
+      throw Error(`invalid_argument: This agent has no registered KeyManagementSystem with name='${name}'`);
+    }
+    return kms;
+  }
+  //todo https://sphereon.atlassian.net/browse/SDK-28 improve the logic for keyManagerGet in sphereon-key-manager
+  async keyManagerGet({ kid }) {
+    try {
+      const key = await this.kmsStore.get({
+        kid
+      });
+      return key;
+    } catch (e) {
+      const keys = await this.keyManagerListKeys();
+      const foundKey = keys.find((key) => key.publicKeyHex === kid || key.meta?.jwkThumbprint === kid || key.meta?.jwkThumbprint == null && (0, import_ssi_sdk_ext.calculateJwkThumbprintForKey)({
+        key
+      }) === kid);
+      if (foundKey) {
+        return foundKey;
+      } else {
+        throw new Error(`Key with kid ${kid} not found`);
+      }
+    }
+  }
+  get defaultKms() {
+    return this._defaultKms;
+  }
+  set defaultKms(kms) {
+    if (!Object.keys(this.availableKmses).includes(kms)) {
+      throw Error(`Default KMS needs to be listed in the kms object as well. Found kms-es: ${Object.keys(this.availableKmses).join(",")}`);
+    }
+    this._defaultKms = kms;
+  }
+  setKms(name, kms) {
+    this.availableKmses[name] = kms;
+  }
+};
+
+// src/index.ts
+__reExport(index_exports, require("@veramo/key-manager"), module.exports);
+var schema = require_plugin_schema();
+//# sourceMappingURL=index.cjs.map