@sudoplatform/sudo-common 7.1.3 → 8.0.0

package/cjs/sudoKeyArchive/sudoKeyArchive.d.ts

@@ -0,0 +1,190 @@
+import { KeyData, KeyDataKeyType } from '../sudoKeyManager';
+import { SudoKeyManager } from '../sudoKeyManager/sudoKeyManager';
+import { KeyArchiveKeyInfo } from './keyInfo';
+import { KeyArchiveKeyType } from './keyType';
+export interface SudoKeyArchive {
+    /**
+     * Loads keys from the secure store into the archive.
+     */
+    loadKeys(): Promise<void>;
+    /**
+     * Saves the keys in this archive to the secure store.
+     */
+    saveKeys(): Promise<void>;
+    /**
+     * Archives and encrypts the keys loaded into this archive.
+     *
+     * @param password
+     *   The password to use to encrypt the archive. Or undefined if no password.
+     *   Choice to have no password must be explicit.
+     *
+     * @returns Binary archive data.
+     */
+    archive(password: ArrayBuffer | undefined): Promise<ArrayBuffer>;
+    /**
+     * Decrypts and unarchives the keys in this archive.
+     *
+     * @param password
+     *    The password to use to decrypt the archive if its a secure archive
+     *    otherwise must be undefined.
+     *
+     * @throws {@link KeyArchiveDecodingError}
+     *    If the archive is unable to be decoding according to the
+     *    required structure.
+     *
+     * @throws {@link KeyArchiveIncorrectPasswordError}
+     *    If the archive is a secure archive and the password is unable to be
+     *    used to decrypt the encrypted keys.
+     *
+     * @throws {@link KeyArchivePasswordRequiredError}
+     *    If the archive is a secure archive but no password is provided.
+     *
+     * @throws {@link KeyArchiveNoPasswordRequiredError}
+     *    If the archive is an insecure archive but a password is provided.
+     */
+    unarchive(password: ArrayBuffer | undefined): Promise<void>;
+    /**
+     * Resets the archive by clearing loaded keys and archive data.
+     */
+    reset(): void;
+    /**
+     * Determines whether or not the archive contains the key with the
+     * specified name and type. The archive must be unarchived before the
+     * key can be searched.
+     *
+     * @param namespace the namespace of the key
+     * @param name the key name.
+     * @param type the key type.
+     *
+     * @return true if the specified key exists in the archive.
+     */
+    containsKey(namespace: string, name: string, type: KeyArchiveKeyType): boolean;
+    /**
+     * Retrieves the specified key data from the archive. The archive must
+     * be unarchived before the key data can be retrieved.
+     *
+     * @param namespace the namespace of the key
+     * @param name the key name
+     * @param type the key type
+     *
+     * @return a byte array containing the specified key data or null if it was not found.
+     *
+     * @throws {@link KeyNotFoundError}
+     *     If key is not present in the archive.
+     */
+    getKeyData(namespace: string, name: string, type: KeyArchiveKeyType): ArrayBuffer;
+    /** @return the key types to exclude from the archive in an unmodifiable set. */
+    getExcludedKeyTypes(): ReadonlySet<KeyArchiveKeyType>;
+    /** @return the key names to exclude from the archive in an unmodifiable set. */
+    getExcludedKeys(): ReadonlySet<string>;
+    /** @return the meta-information associated with this archive in an unmodifiable map. */
+    getMetaInfo(): ReadonlyMap<string, string>;
+}
+export declare type KeyArchiveKeyInfoDecoded = KeyArchiveKeyInfo & {
+    Decoded: ArrayBuffer;
+};
+export declare class DefaultSudoKeyArchive implements SudoKeyArchive {
+    /**
+     * Version 2 format is not gzipped is what's currently generated
+     * by iOS and Android. We may want to add support for importing
+     * such archives.
+     */
+    static readonly PREGZIP_ARCHIVE_VERSION = 2;
+    /**
+     * Version 3 format permits both secure and insecure key archives.
+     *
+     * Insecure key archives are used where the archive will be stored
+     * in an otherwise known secure way e.g. via secure-vault-service
+     * where the encryption of the archive would then be handled by
+     * clients of that service.
+     *
+     * Secure key archives are password protected (via PBKDF2) a la version
+     * 2 format.
+     *
+     * Insecure format detail is:
+     *
+     *     gzip(JSON.stringify(InsecureKeyArchive))
+     *
+     * Secure format detail is:
+     *
+     *     gzip(JSON.stringify(SecureKeyArchive))
+     *
+     * where Keys property of SecureKeyArchive is:
+     *
+     *     base64(encrypt(gzip(JSON.stringify(array of keys))))
+     *
+     * Where encrypt operation is 256-bit AES CBC-mode with IV SecureKeyArchive.IV
+     * and key generated by SecureKeyArchive.Rounds of PBKDF2 on the password
+     * salted with SecureKeyArchive.Salt.
+     */
+    static readonly CURRENT_ARCHIVE_VERSION = 3;
+    private readonly defaultKeyManager;
+    private readonly keyManagers;
+    private keyArchive;
+    private readonly excludedKeys;
+    private readonly excludedKeyTypes;
+    private readonly metaInfo;
+    private readonly keys;
+    /**
+     * Construct SudoKeyArchive
+     *
+     *
+     * @param keyManagers
+     *     Key manager or array of key managers to either restore archive in to
+     *     or construct archive from
+     *
+     * @param archiveData
+     *     Array buffer of binary archive data to restore.
+     *
+     * @param excludedKeys
+     *     Set of key names to exclude from archive or restore operation.
+     *     Default: None
+     *
+     * @param excludedKeyTypes
+     *     Set of key types to exclude from archive or restore operation.
+     *     Default: {@link KeyArchiveKeyType.PublicKey}
+     *
+     * @param metaInfo
+     *     Meta information to include with the key archive
+     *
+     * @throws {@link IllegalArgumentError}
+     *     If no key managers are provided
+     *
+     * @throws {@link IllegalArgumentError}
+     *     If multiple key managers are provided with the same namespace
+     *
+     * @throws {@link KeyArchiveDecodingError}
+     *     If archiveData is provided and its binary data cannot be decoded
+     *
+     * @throws {@link KeyArchiveTypeError}
+     *     If archiveData is provided and decodes to an unsupported archive
+     *     type.
+     *
+     * @throws {@link KeyArchiveVersionError}
+     *     If archiveData is provided and decodes to an unsupported archive
+     *     version.
+     */
+    constructor(keyManagers: SudoKeyManager | SudoKeyManager[], options?: {
+        archiveData?: ArrayBuffer;
+        excludedKeys?: ReadonlySet<string>;
+        excludedKeyTypes?: ReadonlySet<KeyArchiveKeyType>;
+        metaInfo?: ReadonlyMap<string, string>;
+    });
+    /**
+     * Reads the binary data and converts it to JSON and then deserialises it
+     * into a KeyArchive
+     */
+    private loadArchive;
+    loadKeys(): Promise<void>;
+    saveKeys(): Promise<void>;
+    archive(password: ArrayBuffer | undefined): Promise<ArrayBuffer>;
+    unarchive(password: ArrayBuffer | undefined): Promise<void>;
+    reset(): void;
+    containsKey(namespace: string, name: string, type: KeyArchiveKeyType): boolean;
+    getKeyData(namespace: string, name: string, type: KeyArchiveKeyType): ArrayBuffer;
+    getExcludedKeys(): ReadonlySet<string>;
+    getExcludedKeyTypes(): ReadonlySet<KeyArchiveKeyType>;
+    getMetaInfo(): ReadonlyMap<string, string>;
+}
+export declare function keyArchiveInfoFromKeyData(keyData: KeyData): KeyArchiveKeyInfoDecoded;
+export declare function keyArchiveKeyTypeFromKeyDataKeyType(keyDataKeyType: KeyDataKeyType): KeyArchiveKeyType;

package/cjs/sudoKeyArchive/sudoKeyArchive.js

@@ -0,0 +1,373 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keyArchiveKeyTypeFromKeyDataKeyType = exports.keyArchiveInfoFromKeyData = exports.DefaultSudoKeyArchive = void 0;
+const fflate_1 = require("fflate");
+const Either_1 = require("fp-ts/lib/Either");
+const error_1 = require("../errors/error");
+const sudoKeyManager_1 = require("../sudoKeyManager");
+const sudoCryptoProvider_1 = require("../sudoKeyManager/sudoCryptoProvider");
+const base64_1 = require("../utils/base64");
+const buffer_1 = require("../utils/buffer");
+const keyArchive_1 = require("./keyArchive");
+const keyInfo_1 = require("./keyInfo");
+const keyType_1 = require("./keyType");
+class DefaultSudoKeyArchive {
+    /**
+     * Construct SudoKeyArchive
+     *
+     *
+     * @param keyManagers
+     *     Key manager or array of key managers to either restore archive in to
+     *     or construct archive from
+     *
+     * @param archiveData
+     *     Array buffer of binary archive data to restore.
+     *
+     * @param excludedKeys
+     *     Set of key names to exclude from archive or restore operation.
+     *     Default: None
+     *
+     * @param excludedKeyTypes
+     *     Set of key types to exclude from archive or restore operation.
+     *     Default: {@link KeyArchiveKeyType.PublicKey}
+     *
+     * @param metaInfo
+     *     Meta information to include with the key archive
+     *
+     * @throws {@link IllegalArgumentError}
+     *     If no key managers are provided
+     *
+     * @throws {@link IllegalArgumentError}
+     *     If multiple key managers are provided with the same namespace
+     *
+     * @throws {@link KeyArchiveDecodingError}
+     *     If archiveData is provided and its binary data cannot be decoded
+     *
+     * @throws {@link KeyArchiveTypeError}
+     *     If archiveData is provided and decodes to an unsupported archive
+     *     type.
+     *
+     * @throws {@link KeyArchiveVersionError}
+     *     If archiveData is provided and decodes to an unsupported archive
+     *     version.
+     */
+    constructor(keyManagers, options) {
+        this.keyManagers = {};
+        this.excludedKeys = new Set();
+        this.excludedKeyTypes = new Set();
+        this.metaInfo = new Map();
+        this.keys = new Map();
+        if (Array.isArray(keyManagers)) {
+            if (keyManagers.length === 0) {
+                throw new error_1.IllegalArgumentError('Must provide at least one key manager');
+            }
+            keyManagers.forEach((keyManager) => {
+                if (this.keyManagers[keyManager.namespace]) {
+                    throw new error_1.IllegalArgumentError(`Multiple key managers provided with namespace ${keyManager.namespace}`);
+                }
+                this.keyManagers[keyManager.namespace] = keyManager;
+            });
+            this.defaultKeyManager = keyManagers[0];
+        }
+        else {
+            this.keyManagers[keyManagers.namespace] = keyManagers;
+            this.defaultKeyManager = keyManagers;
+        }
+        if (options?.archiveData) {
+            this.keyArchive = this.loadArchive(options.archiveData);
+        }
+        // We take copies of the input parameters so we own the data
+        if (options?.excludedKeys) {
+            options?.excludedKeys.forEach((excludedKey) => this.excludedKeys.add(excludedKey));
+        }
+        if (options?.excludedKeyTypes) {
+            options?.excludedKeyTypes.forEach((excludedKeyType) => this.excludedKeyTypes.add(excludedKeyType));
+        }
+        if (options?.metaInfo?.size) {
+            for (const [key, value] of options?.metaInfo?.entries()) {
+                this.metaInfo.set(key, value);
+            }
+        }
+    }
+    /**
+     * Reads the binary data and converts it to JSON and then deserialises it
+     * into a KeyArchive
+     */
+    loadArchive(archiveData) {
+        let unzipped;
+        try {
+            unzipped = (0, fflate_1.gunzipSync)(new Uint8Array(archiveData));
+        }
+        catch (err) {
+            throw new error_1.KeyArchiveDecodingError();
+        }
+        let keyArchive;
+        try {
+            const decoded = keyArchive_1.KeyArchiveCodec.decode(JSON.parse(buffer_1.Buffer.toString(unzipped)));
+            if ((0, Either_1.isLeft)(decoded)) {
+                throw new error_1.KeyArchiveDecodingError();
+            }
+            keyArchive = decoded.right;
+        }
+        catch (err) {
+            throw new error_1.KeyArchiveDecodingError();
+        }
+        if ((0, keyArchive_1.isUnrecognizedKeyArchive)(keyArchive)) {
+            if (keyArchive.Type &&
+                keyArchive.Type !== keyArchive_1.SecureKeyArchiveType &&
+                keyArchive.Type !== keyArchive_1.InsecureKeyArchiveType) {
+                throw new error_1.KeyArchiveTypeError(keyArchive.Type);
+            }
+            // Only support DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION for now.
+            if (keyArchive.Version !== undefined &&
+                keyArchive.Version !== DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION) {
+                throw new error_1.KeyArchiveVersionError(keyArchive.Version);
+            }
+            throw new error_1.KeyArchiveDecodingError();
+        }
+        return keyArchive;
+    }
+    async loadKeys() {
+        for (const keyManager of Object.values(this.keyManagers)) {
+            await keyManager.exportKeys().then((exported) => {
+                exported.forEach((data) => {
+                    const keyArchiveInfoDecoded = keyArchiveInfoFromKeyData(data);
+                    if (!this.excludedKeyTypes.has(keyArchiveInfoDecoded.Type) &&
+                        !this.excludedKeys.has(data.name)) {
+                        this.keys.set(`${keyArchiveInfoDecoded.NameSpace}:${keyArchiveInfoDecoded.Type}:${keyArchiveInfoDecoded.Name}`, keyArchiveInfoDecoded);
+                    }
+                });
+            });
+        }
+    }
+    async saveKeys() {
+        for (const info of this.keys.values()) {
+            const keyManager = this.keyManagers[info.NameSpace];
+            if (!keyManager)
+                continue;
+            if (this.excludedKeyTypes.has(info.Type))
+                continue;
+            if (this.excludedKeys.has(info.Name))
+                continue;
+            const keyData = info.Decoded;
+            switch (info.Type) {
+                case keyType_1.KeyArchiveKeyType.Password:
+                    await keyManager.addPassword(keyData, info.Name);
+                    break;
+                case keyType_1.KeyArchiveKeyType.PrivateKey:
+                    await keyManager.addPrivateKey(keyData, info.Name);
+                    break;
+                case keyType_1.KeyArchiveKeyType.PublicKey:
+                    await keyManager.addPublicKey(keyData, info.Name);
+                    break;
+                case keyType_1.KeyArchiveKeyType.SymmetricKey:
+                    await keyManager.addSymmetricKey(keyData, info.Name);
+                    break;
+                default:
+                    throw new error_1.KeyArchiveUnknownKeyTypeError(`Key archive key type ${info.Type} is not recognized`);
+            }
+        }
+    }
+    async archive(password) {
+        const keys = [];
+        for (const key of this.keys.values()) {
+            keys.push({
+                NameSpace: key.NameSpace,
+                Name: key.Name,
+                Data: key.Data,
+                Type: key.Type,
+                Synchronizable: key.Synchronizable,
+                Exportable: key.Exportable,
+            });
+        }
+        let keyArchive;
+        if (!password) {
+            const insecureKeyArchive = {
+                Type: 'Insecure',
+                MetaInfo: {},
+                Version: DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION,
+                Keys: keys,
+            };
+            keyArchive = insecureKeyArchive;
+        }
+        else {
+            const salt = await this.defaultKeyManager.generateRandomData(sudoCryptoProvider_1.SudoCryptoProviderDefaults.pbkdfSaltSize);
+            const b64Salt = base64_1.Base64.encode(salt);
+            const key = await this.defaultKeyManager.generateSymmetricKeyFromPassword(password, salt, {
+                rounds: sudoCryptoProvider_1.SudoCryptoProviderDefaults.pbkdfRounds,
+            });
+            const serializedKeys = JSON.stringify(keys);
+            const compressedSerializedKeys = (0, fflate_1.gzipSync)(buffer_1.Buffer.fromString(serializedKeys), {
+                level: 9,
+            });
+            // Don't strictly need a randomly generated IV here but no harm either
+            const iv = await this.defaultKeyManager.generateRandomData(sudoCryptoProvider_1.SudoCryptoProviderDefaults.aesIVSize);
+            const encryptedKeys = await this.defaultKeyManager.encryptWithSymmetricKey(key, compressedSerializedKeys, { iv });
+            const secureKeyArchive = {
+                Type: 'Secure',
+                Version: DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION,
+                MetaInfo: {},
+                Salt: b64Salt,
+                Rounds: sudoCryptoProvider_1.SudoCryptoProviderDefaults.pbkdfRounds,
+                Keys: base64_1.Base64.encode(encryptedKeys),
+                IV: base64_1.Base64.encode(iv),
+            };
+            keyArchive = secureKeyArchive;
+        }
+        for (const [key, value] of this.metaInfo.entries()) {
+            keyArchive.MetaInfo[key] = value;
+        }
+        const archiveString = JSON.stringify(keyArchive);
+        // While this double Gzips the SecureKeyArchive, it allows us to roughly
+        // recover the space consumed by Base64 encoding the cipher text. Otherwise
+        // we would end up having a fully binary data structure for the archive.
+        // If the time to compute becomes prohibitive we can look at a binary, non-JSON
+        // base format for the archive.
+        const archiveGzipped = (0, fflate_1.gzipSync)(buffer_1.Buffer.fromString(archiveString), {
+            level: 9,
+        });
+        return Promise.resolve(archiveGzipped);
+    }
+    async unarchive(password) {
+        if (!this.keyArchive) {
+            throw new error_1.KeyArchiveMissingError();
+        }
+        let keys;
+        if ((0, keyArchive_1.isSecureKeyArchive)(this.keyArchive)) {
+            if (!password) {
+                throw new error_1.KeyArchivePasswordRequiredError();
+            }
+            let iv;
+            let encryptedKeys;
+            let key;
+            try {
+                const salt = base64_1.Base64.decode(this.keyArchive.Salt);
+                iv = base64_1.Base64.decode(this.keyArchive.IV);
+                encryptedKeys = base64_1.Base64.decode(this.keyArchive.Keys);
+                key = await this.defaultKeyManager.generateSymmetricKeyFromPassword(password, salt, { rounds: this.keyArchive.Rounds });
+            }
+            catch (err) {
+                throw new error_1.KeyArchiveDecodingError();
+            }
+            let compressedSerializedKeys;
+            try {
+                compressedSerializedKeys =
+                    await this.defaultKeyManager.decryptWithSymmetricKey(key, encryptedKeys, { iv });
+            }
+            catch (err) {
+                throw new error_1.KeyArchiveIncorrectPasswordError();
+            }
+            try {
+                const serializedKeys = (0, fflate_1.gunzipSync)(new Uint8Array(compressedSerializedKeys));
+                const decoded = keyInfo_1.KeyArchiveKeyInfoArrayCodec.decode(JSON.parse(buffer_1.Buffer.toString(serializedKeys)));
+                if ((0, Either_1.isLeft)(decoded)) {
+                    throw new error_1.KeyArchiveDecodingError();
+                }
+                keys = decoded.right;
+            }
+            catch (err) {
+                throw new error_1.KeyArchiveDecodingError();
+            }
+        }
+        else {
+            if (password) {
+                throw new error_1.KeyArchiveNoPasswordRequiredError();
+            }
+            keys = this.keyArchive.Keys;
+        }
+        keys.forEach((key) => {
+            const keyKey = `${key.NameSpace}:${key.Type}:${key.Name}`;
+            let decoded;
+            try {
+                decoded = base64_1.Base64.decode(key.Data);
+            }
+            catch (err) {
+                throw new error_1.KeyArchiveDecodingError(`Unable to decode key ${keyKey}`);
+            }
+            this.keys.set(keyKey, { ...key, Decoded: decoded });
+        });
+    }
+    reset() {
+        this.keys.clear();
+    }
+    containsKey(namespace, name, type) {
+        return this.keys.has(`${namespace}:${type}:${name}`);
+    }
+    getKeyData(namespace, name, type) {
+        const keyInfo = this.keys.get(`${namespace}:${type}:${name}`);
+        if (!keyInfo) {
+            throw new error_1.KeyNotFoundError();
+        }
+        return keyInfo.Decoded;
+    }
+    getExcludedKeys() {
+        return this.excludedKeys;
+    }
+    getExcludedKeyTypes() {
+        return this.excludedKeyTypes;
+    }
+    getMetaInfo() {
+        return this.metaInfo;
+    }
+}
+exports.DefaultSudoKeyArchive = DefaultSudoKeyArchive;
+/**
+ * Version 2 format is not gzipped is what's currently generated
+ * by iOS and Android. We may want to add support for importing
+ * such archives.
+ */
+DefaultSudoKeyArchive.PREGZIP_ARCHIVE_VERSION = 2;
+/**
+ * Version 3 format permits both secure and insecure key archives.
+ *
+ * Insecure key archives are used where the archive will be stored
+ * in an otherwise known secure way e.g. via secure-vault-service
+ * where the encryption of the archive would then be handled by
+ * clients of that service.
+ *
+ * Secure key archives are password protected (via PBKDF2) a la version
+ * 2 format.
+ *
+ * Insecure format detail is:
+ *
+ *     gzip(JSON.stringify(InsecureKeyArchive))
+ *
+ * Secure format detail is:
+ *
+ *     gzip(JSON.stringify(SecureKeyArchive))
+ *
+ * where Keys property of SecureKeyArchive is:
+ *
+ *     base64(encrypt(gzip(JSON.stringify(array of keys))))
+ *
+ * Where encrypt operation is 256-bit AES CBC-mode with IV SecureKeyArchive.IV
+ * and key generated by SecureKeyArchive.Rounds of PBKDF2 on the password
+ * salted with SecureKeyArchive.Salt.
+ */
+DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION = keyArchive_1.CURRENT_ARCHIVE_VERSION;
+function keyArchiveInfoFromKeyData(keyData) {
+    return {
+        NameSpace: keyData.namespace,
+        Name: keyData.name,
+        Type: keyArchiveKeyTypeFromKeyDataKeyType(keyData.type),
+        Data: base64_1.Base64.encode(keyData.data),
+        Decoded: keyData.data,
+        Synchronizable: false,
+        Exportable: true,
+    };
+}
+exports.keyArchiveInfoFromKeyData = keyArchiveInfoFromKeyData;
+function keyArchiveKeyTypeFromKeyDataKeyType(keyDataKeyType) {
+    switch (keyDataKeyType) {
+        case sudoKeyManager_1.KeyDataKeyType.Password:
+            return keyType_1.KeyArchiveKeyType.Password;
+        case sudoKeyManager_1.KeyDataKeyType.RSAPrivateKey:
+            return keyType_1.KeyArchiveKeyType.PrivateKey;
+        case sudoKeyManager_1.KeyDataKeyType.RSAPublicKey:
+            return keyType_1.KeyArchiveKeyType.PublicKey;
+        case sudoKeyManager_1.KeyDataKeyType.SymmetricKey:
+            return keyType_1.KeyArchiveKeyType.SymmetricKey;
+    }
+}
+exports.keyArchiveKeyTypeFromKeyDataKeyType = keyArchiveKeyTypeFromKeyDataKeyType;
+//# sourceMappingURL=sudoKeyArchive.js.map

package/cjs/sudoKeyArchive/sudoKeyArchive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudoKeyArchive.js","sourceRoot":"","sources":["../../src/sudoKeyArchive/sudoKeyArchive.ts"],"names":[],"mappings":";;;AAAA,mCAA6C;AAC7C,6CAAyC;AAEzC,2CAWwB;AACxB,sDAA2D;AAC3D,6EAAiF;AAEjF,4CAAwC;AACxC,4CAAsD;AACtD,6CAUqB;AACrB,uCAA0E;AAC1E,uCAA6C;AAkG7C,MAAa,qBAAqB;IAkDhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,YACE,WAA8C,EAC9C,OAKC;QA1Dc,gBAAW,GAAmC,EAAE,CAAA;QAEhD,iBAAY,GAAgB,IAAI,GAAG,EAAU,CAAA;QAC7C,qBAAgB,GAC/B,IAAI,GAAG,EAAqB,CAAA;QACb,aAAQ,GAAwB,IAAI,GAAG,EAAkB,CAAA;QAEzD,SAAI,GAA0C,IAAI,GAAG,EAGnE,CAAA;QAkDD,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE;YAC9B,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;gBAC5B,MAAM,IAAI,4BAAoB,CAAC,uCAAuC,CAAC,CAAA;aACxE;YAED,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;gBACjC,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;oBAC1C,MAAM,IAAI,4BAAoB,CAC5B,iDAAiD,UAAU,CAAC,SAAS,EAAE,CACxE,CAAA;iBACF;gBACD,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,UAAU,CAAA;YACrD,CAAC,CAAC,CAAA;YACF,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;SACxC;aAAM;YACL,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,WAAW,CAAA;YACrD,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAA;SACrC;QAED,IAAI,OAAO,EAAE,WAAW,EAAE;YACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;SACxD;QAED,4DAA4D;QAC5D,IAAI,OAAO,EAAE,YAAY,EAAE;YACzB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CACnC,CAAA;SACF;QAED,IAAI,OAAO,EAAE,gBAAgB,EAAE;YAC7B,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,EAAE,CACpD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,CAC3C,CAAA;SACF;QAED,IAAI,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gBACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;aAC9B;SACF;IACH,CAAC;IAED;;;OAGG;IACK,WAAW,CACjB,WAAwB;QAExB,IAAI,QAAoB,CAAA;QAExB,IAAI;YACF,QAAQ,GAAG,IAAA,mBAAU,EAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;SACnD;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,+BAAuB,EAAE,CAAA;SACpC;QAED,IAAI,UAAsB,CAAA;QAC1B,IAAI;YACF,MAAM,OAAO,GAAG,4BAAe,CAAC,MAAM,CACpC,IAAI,CAAC,KAAK,CAAC,eAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAC1C,CAAA;YACD,IAAI,IAAA,eAAM,EAAC,OAAO,CAAC,EAAE;gBACnB,MAAM,IAAI,+BAAuB,EAAE,CAAA;aACpC;YACD,UAAU,GAAG,OAAO,CAAC,KAAK,CAAA;SAC3B;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,IAAI,+BAAuB,EAAE,CAAA;SACpC;QACD,IAAI,IAAA,qCAAwB,EAAC,UAAU,CAAC,EAAE;YACxC,IACE,UAAU,CAAC,IAAI;gBACf,UAAU,CAAC,IAAI,KAAK,iCAAoB;gBACxC,UAAU,CAAC,IAAI,KAAK,mCAAsB,EAC1C;gBACA,MAAM,IAAI,2BAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;aAC/C;YAED,sEAAsE;YACtE,IACE,UAAU,CAAC,OAAO,KAAK,SAAS;gBAChC,UAAU,CAAC,OAAO,KAAK,qBAAqB,CAAC,uBAAuB,EACpE;gBACA,MAAM,IAAI,8BAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;aACrD;YAED,MAAM,IAAI,+BAAuB,EAAE,CAAA;SACpC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE;YACxD,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC9C,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;oBACxB,MAAM,qBAAqB,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;oBAC7D,IACE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC;wBACtD,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EACjC;wBACA,IAAI,CAAC,IAAI,CAAC,GAAG,CACX,GAAG,qBAAqB,CAAC,SAAS,IAAI,qBAAqB,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,EAAE,EAChG,qBAAqB,CACtB,CAAA;qBACF;gBACH,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;SACH;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACnD,IAAI,CAAC,UAAU;gBAAE,SAAQ;YACzB,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAClD,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAE9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;YAC5B,QAAQ,IAAI,CAAC,IAAI,EAAE;gBACjB,KAAK,2BAAiB,CAAC,QAAQ;oBAC7B,MAAM,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;oBAChD,MAAK;gBACP,KAAK,2BAAiB,CAAC,UAAU;oBAC/B,MAAM,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;oBAClD,MAAK;gBACP,KAAK,2BAAiB,CAAC,SAAS;oBAC9B,MAAM,UAAU,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;oBACjD,MAAK;gBACP,KAAK,2BAAiB,CAAC,YAAY;oBACjC,MAAM,UAAU,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;oBACpD,MAAK;gBACP;oBACE,MAAM,IAAI,qCAA6B,CACrC,wBAAwB,IAAI,CAAC,IAAc,oBAAoB,CAChE,CAAA;aACJ;SACF;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAiC;QAC7C,MAAM,IAAI,GAAwB,EAAE,CAAA;QACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;YACpC,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAA;SACH;QAED,IAAI,UAAiD,CAAA;QACrD,IAAI,CAAC,QAAQ,EAAE;YACb,MAAM,kBAAkB,GAAuB;gBAC7C,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,qBAAqB,CAAC,uBAAuB;gBACtD,IAAI,EAAE,IAAI;aACX,CAAA;YACD,UAAU,GAAG,kBAAkB,CAAA;SAChC;aAAM;YACL,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAC1D,+CAA0B,CAAC,aAAa,CACzC,CAAA;YACD,MAAM,OAAO,GAAG,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,gCAAgC,CACvE,QAAQ,EACR,IAAI,EACJ;gBACE,MAAM,EAAE,+CAA0B,CAAC,WAAW;aAC/C,CACF,CAAA;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC3C,MAAM,wBAAwB,GAAG,IAAA,iBAAQ,EACvC,eAAU,CAAC,UAAU,CAAC,cAAc,CAAC,EACrC;gBACE,KAAK,EAAE,CAAC;aACT,CACF,CAAA;YAED,sEAAsE;YACtE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CACxD,+CAA0B,CAAC,SAAS,CACrC,CAAA;YACD,MAAM,aAAa,GACjB,MAAM,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAClD,GAAG,EACH,wBAAwB,EACxB,EAAE,EAAE,EAAE,CACP,CAAA;YACH,MAAM,gBAAgB,GAAqB;gBACzC,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,qBAAqB,CAAC,uBAAuB;gBACtD,QAAQ,EAAE,EAAE;gBACZ,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,+CAA0B,CAAC,WAAW;gBAC9C,IAAI,EAAE,eAAM,CAAC,MAAM,CAAC,aAAa,CAAC;gBAClC,EAAE,EAAE,eAAM,CAAC,MAAM,CAAC,EAAE,CAAC;aACtB,CAAA;YAED,UAAU,GAAG,gBAAgB,CAAA;SAC9B;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE;YAClD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;SACjC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAEhD,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,+EAA+E;QAC/E,+BAA+B;QAC/B,MAAM,cAAc,GAAG,IAAA,iBAAQ,EAAC,eAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE;YACpE,KAAK,EAAE,CAAC;SACT,CAAC,CAAA;QAEF,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAiC;QAC/C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE;YACpB,MAAM,IAAI,8BAAsB,EAAE,CAAA;SACnC;QAED,IAAI,IAAyB,CAAA;QAE7B,IAAI,IAAA,+BAAkB,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE;YACvC,IAAI,CAAC,QAAQ,EAAE;gBACb,MAAM,IAAI,uCAA+B,EAAE,CAAA;aAC5C;YAED,IAAI,EAAe,CAAA;YACnB,IAAI,aAA0B,CAAA;YAC9B,IAAI,GAAgB,CAAA;YACpB,IAAI;gBACF,MAAM,IAAI,GAAG,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChD,EAAE,GAAG,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBACtC,aAAa,GAAG,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;gBACnD,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,gCAAgC,CACjE,QAAQ,EACR,IAAI,EACJ,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CACnC,CAAA;aACF;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,IAAI,+BAAuB,EAAE,CAAA;aACpC;YAED,IAAI,wBAAqC,CAAA;YACzC,IAAI;gBACF,wBAAwB;oBACtB,MAAM,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAClD,GAAG,EACH,aAAa,EACb,EAAE,EAAE,EAAE,CACP,CAAA;aACJ;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,IAAI,wCAAgC,EAAE,CAAA;aAC7C;YACD,IAAI;gBACF,MAAM,cAAc,GAAG,IAAA,mBAAU,EAC/B,IAAI,UAAU,CAAC,wBAAwB,CAAC,CACzC,CAAA;gBACD,MAAM,OAAO,GAAG,qCAA2B,CAAC,MAAM,CAChD,IAAI,CAAC,KAAK,CAAC,eAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAChD,CAAA;gBACD,IAAI,IAAA,eAAM,EAAC,OAAO,CAAC,EAAE;oBACnB,MAAM,IAAI,+BAAuB,EAAE,CAAA;iBACpC;gBACD,IAAI,GAAG,OAAO,CAAC,KAAK,CAAA;aACrB;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,IAAI,+BAAuB,EAAE,CAAA;aACpC;SACF;aAAM;YACL,IAAI,QAAQ,EAAE;gBACZ,MAAM,IAAI,yCAAiC,EAAE,CAAA;aAC9C;YACD,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;SAC5B;QAED,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAA;YACzD,IAAI,OAAoB,CAAA;YACxB,IAAI;gBACF,OAAO,GAAG,eAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;aAClC;YAAC,OAAO,GAAG,EAAE;gBACZ,MAAM,IAAI,+BAAuB,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAA;aACpE;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;IACnB,CAAC;IAED,WAAW,CACT,SAAiB,EACjB,IAAY,EACZ,IAAuB;QAEvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,UAAU,CACR,SAAiB,EACjB,IAAY,EACZ,IAAuB;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC,OAAO,EAAE;YACZ,MAAM,IAAI,wBAAgB,EAAE,CAAA;SAC7B;QAED,OAAO,OAAO,CAAC,OAAO,CAAA;IACxB,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;;AA9aH,sDA+aC;AA9aC;;;;GAIG;AACoB,6CAAuB,GAAG,CAAC,CAAA;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACoB,6CAAuB,GAAG,oCAAuB,CAAA;AA8Y1E,SAAgB,yBAAyB,CACvC,OAAgB;IAEhB,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,mCAAmC,CAAC,OAAO,CAAC,IAAI,CAAC;QACvD,IAAI,EAAE,eAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,IAAI;KACjB,CAAA;AACH,CAAC;AAZD,8DAYC;AAED,SAAgB,mCAAmC,CACjD,cAA8B;IAE9B,QAAQ,cAAc,EAAE;QACtB,KAAK,+BAAc,CAAC,QAAQ;YAC1B,OAAO,2BAAiB,CAAC,QAAQ,CAAA;QACnC,KAAK,+BAAc,CAAC,aAAa;YAC/B,OAAO,2BAAiB,CAAC,UAAU,CAAA;QACrC,KAAK,+BAAc,CAAC,YAAY;YAC9B,OAAO,2BAAiB,CAAC,SAAS,CAAA;QACpC,KAAK,+BAAc,CAAC,YAAY;YAC9B,OAAO,2BAAiB,CAAC,YAAY,CAAA;KACxC;AACH,CAAC;AAbD,kFAaC"}

package/cjs/sudoKeyManager/index.d.ts

@@ -0,0 +1,4 @@
+export * from './keyData';
+export * from './publicKey';
+export * from './sudoCryptoProvider';
+export * from './sudoKeyManager';

package/cjs/sudoKeyManager/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./keyData"), exports);
+tslib_1.__exportStar(require("./publicKey"), exports);
+tslib_1.__exportStar(require("./sudoCryptoProvider"), exports);
+tslib_1.__exportStar(require("./sudoKeyManager"), exports);
+//# sourceMappingURL=index.js.map

package/cjs/sudoKeyManager/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sudoKeyManager/index.ts"],"names":[],"mappings":";;;AAAA,oDAAyB;AACzB,sDAA2B;AAC3B,+DAAoC;AACpC,2DAAgC"}

package/cjs/sudoKeyManager/keyData.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Type of key
+ */
+export declare enum KeyDataKeyType {
+    SymmetricKey = "SymmetricKey",
+    RSAPublicKey = "RSAPublicKey",
+    RSAPrivateKey = "RSAPrivateKey",
+    Password = "Password"
+}
+export declare enum KeyDataKeyFormat {
+    /**
+     * Raw key format.
+     *
+     * For SymmetricKey and Password types this means the raw bytes
+     * of the key/password.
+     *
+     * For RSAPublicKey this means RSAPublicKey binary format.
+     * For RSAPrivateKey this means RSAPrivateKey binary format.
+     * "RSA PUBLIC KEY" or "RSA PRIVATE KEY" in PEM speak
+     */
+    Raw = "Raw",
+    /**
+     * SPKI public key format.
+     *
+     * Applies to public keys (currently only RSAPublicKey)
+     * and means they are formated using SPKI.
+     *
+     * "PUBLIC KEY" in PEM speak
+     */
+    SPKI = "SPKI",
+    /**
+     * PKCS8 private key format.
+     *
+     * Applies to private keys (currently only RSAPrivateKey)
+     * and means they are formated using unencrypted PKCS8.
+     *
+     * "PRIVATE KEY" in PEM speak
+     */
+    PKCS8 = "PKCS8"
+}
+/**
+ * Record of key in a key archive
+ *
+ * @property name name of the key within the namespace
+ * @property namespace namespace of the key manager for this key
+ * @property data raw binary data of the key
+ * @property type type of the key
+ * @property format format of the raw binary data
+ */
+export interface KeyData {
+    name: string;
+    namespace: string;
+    data: ArrayBuffer;
+    type: KeyDataKeyType;
+    format: KeyDataKeyFormat;
+}