@sudoplatform/sudo-common 7.1.3 → 8.0.2

package/lib/sudoKeyArchive/sudoKeyArchive.js

@@ -1,460 +1,367 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.DefaultSudoKeyArchive = void 0;
-exports.keyArchiveInfoFromKeyData = keyArchiveInfoFromKeyData;
-exports.keyArchiveKeyTypeFromKeyDataKeyType = keyArchiveKeyTypeFromKeyDataKeyType;
-
-var _fflate = require("fflate");
-
-var _Either = require("fp-ts/lib/Either");
-
-var _error = require("../errors/error");
-
-var _sudoKeyManager = require("../sudoKeyManager");
-
-var _sudoCryptoProvider = require("../sudoKeyManager/sudoCryptoProvider");
-
-var _base = require("../utils/base64");
-
-var _buffer = require("../utils/buffer");
-
-var _keyArchive = require("./keyArchive");
-
-var _keyInfo = require("./keyInfo");
-
-var _keyType = require("./keyType");
-
-function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
-
-class DefaultSudoKeyArchive {
-  /**
-   * Version 2 format is not gzipped is what's currently generated
-   * by iOS and Android. We may want to add support for importing
-   * such archives.
-   */
-
-  /**
-   * Version 3 format permits both secure and insecure key archives.
-   *
-   * Insecure key archives are used where the archive will be stored
-   * in an otherwise known secure way e.g. via secure-vault-service
-   * where the encryption of the archive would then be handled by
-   * clients of that service.
-   *
-   * Secure key archives are password protected (via PBKDF2) a la version
-   * 2 format.
-   *
-   * Insecure format detail is:
-   *
-   *     gzip(JSON.stringify(InsecureKeyArchive))
-   *
-   * Secure format detail is:
-   *
-   *     gzip(JSON.stringify(SecureKeyArchive))
-   *
-   * where Keys property of SecureKeyArchive is:
-   *
-   *     base64(encrypt(gzip(JSON.stringify(array of keys))))
-   *
-   * Where encrypt operation is 256-bit AES CBC-mode with IV SecureKeyArchive.IV
-   * and key generated by SecureKeyArchive.Rounds of PBKDF2 on the password
-   * salted with SecureKeyArchive.Salt.
-   */
-
-  /**
-   * Construct SudoKeyArchive
-   *
-   *
-   * @param keyManagers
-   *     Key manager or array of key managers to either restore archive in to
-   *     or construct archive from
-   *
-   * @param archiveData
-   *     Array buffer of binary archive data to restore.
-   *
-   * @param excludedKeys
-   *     Set of key names to exclude from archive or restore operation.
-   *     Default: None
-   *
-   * @param excludedKeyTypes
-   *     Set of key types to exclude from archive or restore operation.
-   *     Default: {@link KeyArchiveKeyType.PublicKey}
-   *
-   * @param metaInfo
-   *     Meta information to include with the key archive
-   *
-   * @throws {@link IllegalArgumentError}
-   *     If no key managers are provided
-   *
-   * @throws {@link IllegalArgumentError}
-   *     If multiple key managers are provided with the same namespace
-   *
-   * @throws {@link KeyArchiveDecodingError}
-   *     If archiveData is provided and its binary data cannot be decoded
-   *
-   * @throws {@link KeyArchiveTypeError}
-   *     If archiveData is provided and decodes to an unsupported archive
-   *     type.
-   *
-   * @throws {@link KeyArchiveVersionError}
-   *     If archiveData is provided and decodes to an unsupported archive
-   *     version.
-   */
-  constructor(keyManagers, options) {
-    var _options$metaInfo;
-
-    _defineProperty(this, "defaultKeyManager", void 0);
-
-    _defineProperty(this, "keyManagers", {});
-
-    _defineProperty(this, "keyArchive", void 0);
-
-    _defineProperty(this, "excludedKeys", new Set());
-
-    _defineProperty(this, "excludedKeyTypes", new Set());
-
-    _defineProperty(this, "metaInfo", new Map());
-
-    _defineProperty(this, "keys", new Map());
-
-    if (Array.isArray(keyManagers)) {
-      if (keyManagers.length === 0) {
-        throw new _error.IllegalArgumentError('Must provide at least one key manager');
-      }
-
-      keyManagers.forEach(keyManager => {
-        if (this.keyManagers[keyManager.namespace]) {
-          throw new _error.IllegalArgumentError(`Multiple key managers provided with namespace ${keyManager.namespace}`);
+import { gunzipSync, gzipSync } from 'fflate';
+import { isLeft } from 'fp-ts/lib/Either';
+import { IllegalArgumentError, KeyArchiveDecodingError, KeyArchiveIncorrectPasswordError, KeyArchiveMissingError, KeyArchiveNoPasswordRequiredError, KeyArchivePasswordRequiredError, KeyArchiveTypeError, KeyArchiveUnknownKeyTypeError, KeyArchiveVersionError, KeyNotFoundError, } from '../errors/error';
+import { KeyDataKeyType } from '../sudoKeyManager';
+import { SudoCryptoProviderDefaults } from '../sudoKeyManager/sudoCryptoProvider';
+import { Base64 } from '../utils/base64';
+import { Buffer as BufferUtil } from '../utils/buffer';
+import { CURRENT_ARCHIVE_VERSION, InsecureKeyArchiveType, isSecureKeyArchive, isUnrecognizedKeyArchive, KeyArchiveCodec, SecureKeyArchiveType, } from './keyArchive';
+import { KeyArchiveKeyInfoArrayCodec } from './keyInfo';
+import { KeyArchiveKeyType } from './keyType';
+export class DefaultSudoKeyArchive {
+    /**
+     * Construct SudoKeyArchive
+     *
+     *
+     * @param keyManagers
+     *     Key manager or array of key managers to either restore archive in to
+     *     or construct archive from
+     *
+     * @param archiveData
+     *     Array buffer of binary archive data to restore.
+     *
+     * @param excludedKeys
+     *     Set of key names to exclude from archive or restore operation.
+     *     Default: None
+     *
+     * @param excludedKeyTypes
+     *     Set of key types to exclude from archive or restore operation.
+     *     Default: {@link KeyArchiveKeyType.PublicKey}
+     *
+     * @param metaInfo
+     *     Meta information to include with the key archive
+     *
+     * @throws {@link IllegalArgumentError}
+     *     If no key managers are provided
+     *
+     * @throws {@link IllegalArgumentError}
+     *     If multiple key managers are provided with the same namespace
+     *
+     * @throws {@link KeyArchiveDecodingError}
+     *     If archiveData is provided and its binary data cannot be decoded
+     *
+     * @throws {@link KeyArchiveTypeError}
+     *     If archiveData is provided and decodes to an unsupported archive
+     *     type.
+     *
+     * @throws {@link KeyArchiveVersionError}
+     *     If archiveData is provided and decodes to an unsupported archive
+     *     version.
+     */
+    constructor(keyManagers, options) {
+        this.keyManagers = {};
+        this.excludedKeys = new Set();
+        this.excludedKeyTypes = new Set();
+        this.metaInfo = new Map();
+        this.keys = new Map();
+        if (Array.isArray(keyManagers)) {
+            if (keyManagers.length === 0) {
+                throw new IllegalArgumentError('Must provide at least one key manager');
+            }
+            keyManagers.forEach((keyManager) => {
+                if (this.keyManagers[keyManager.namespace]) {
+                    throw new IllegalArgumentError(`Multiple key managers provided with namespace ${keyManager.namespace}`);
+                }
+                this.keyManagers[keyManager.namespace] = keyManager;
+            });
+            this.defaultKeyManager = keyManagers[0];
+        }
+        else {
+            this.keyManagers[keyManagers.namespace] = keyManagers;
+            this.defaultKeyManager = keyManagers;
+        }
+        if (options?.archiveData) {
+            this.keyArchive = this.loadArchive(options.archiveData);
+        }
+        // We take copies of the input parameters so we own the data
+        if (options?.excludedKeys) {
+            options?.excludedKeys.forEach((excludedKey) => this.excludedKeys.add(excludedKey));
+        }
+        if (options?.excludedKeyTypes) {
+            options?.excludedKeyTypes.forEach((excludedKeyType) => this.excludedKeyTypes.add(excludedKeyType));
+        }
+        if (options?.metaInfo?.size) {
+            for (const [key, value] of options?.metaInfo?.entries()) {
+                this.metaInfo.set(key, value);
+            }
         }
-
-        this.keyManagers[keyManager.namespace] = keyManager;
-      });
-      this.defaultKeyManager = keyManagers[0];
-    } else {
-      this.keyManagers[keyManagers.namespace] = keyManagers;
-      this.defaultKeyManager = keyManagers;
-    }
-
-    if (options !== null && options !== void 0 && options.archiveData) {
-      this.keyArchive = this.loadArchive(options.archiveData);
-    } // We take copies of the input parameters so we own the data
-
-
-    if (options !== null && options !== void 0 && options.excludedKeys) {
-      options === null || options === void 0 ? void 0 : options.excludedKeys.forEach(excludedKey => this.excludedKeys.add(excludedKey));
-    }
-
-    if (options !== null && options !== void 0 && options.excludedKeyTypes) {
-      options === null || options === void 0 ? void 0 : options.excludedKeyTypes.forEach(excludedKeyType => this.excludedKeyTypes.add(excludedKeyType));
-    }
-
-    if (options !== null && options !== void 0 && (_options$metaInfo = options.metaInfo) !== null && _options$metaInfo !== void 0 && _options$metaInfo.size) {
-      for (const [key, value] of options === null || options === void 0 ? void 0 : (_options$metaInfo2 = options.metaInfo) === null || _options$metaInfo2 === void 0 ? void 0 : _options$metaInfo2.entries()) {
-        var _options$metaInfo2;
-
-        this.metaInfo.set(key, value);
-      }
     }
-  }
-  /**
-   * Reads the binary data and converts it to JSON and then deserialises it
-   * into a KeyArchive
-   */
-
-
-  loadArchive(archiveData) {
-    let unzipped;
-
-    try {
-      unzipped = (0, _fflate.gunzipSync)(new Uint8Array(archiveData));
-    } catch (err) {
-      throw new _error.KeyArchiveDecodingError();
+    /**
+     * Reads the binary data and converts it to JSON and then deserialises it
+     * into a KeyArchive
+     */
+    loadArchive(archiveData) {
+        let unzipped;
+        try {
+            unzipped = gunzipSync(new Uint8Array(archiveData));
+        }
+        catch (err) {
+            throw new KeyArchiveDecodingError();
+        }
+        let keyArchive;
+        try {
+            const decoded = KeyArchiveCodec.decode(JSON.parse(BufferUtil.toString(unzipped)));
+            if (isLeft(decoded)) {
+                throw new KeyArchiveDecodingError();
+            }
+            keyArchive = decoded.right;
+        }
+        catch (err) {
+            throw new KeyArchiveDecodingError();
+        }
+        if (isUnrecognizedKeyArchive(keyArchive)) {
+            if (keyArchive.Type &&
+                keyArchive.Type !== SecureKeyArchiveType &&
+                keyArchive.Type !== InsecureKeyArchiveType) {
+                throw new KeyArchiveTypeError(keyArchive.Type);
+            }
+            // Only support DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION for now.
+            if (keyArchive.Version !== undefined &&
+                keyArchive.Version !== DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION) {
+                throw new KeyArchiveVersionError(keyArchive.Version);
+            }
+            throw new KeyArchiveDecodingError();
+        }
+        return keyArchive;
     }
-
-    let keyArchive;
-
-    try {
-      const decoded = _keyArchive.KeyArchiveCodec.decode(JSON.parse(_buffer.Buffer.toString(unzipped)));
-
-      if ((0, _Either.isLeft)(decoded)) {
-        throw new _error.KeyArchiveDecodingError();
-      }
-
-      keyArchive = decoded.right;
-    } catch (err) {
-      throw new _error.KeyArchiveDecodingError();
+    async loadKeys() {
+        for (const keyManager of Object.values(this.keyManagers)) {
+            await keyManager.exportKeys().then((exported) => {
+                exported.forEach((data) => {
+                    const keyArchiveInfoDecoded = keyArchiveInfoFromKeyData(data);
+                    if (!this.excludedKeyTypes.has(keyArchiveInfoDecoded.Type) &&
+                        !this.excludedKeys.has(data.name)) {
+                        this.keys.set(`${keyArchiveInfoDecoded.NameSpace}:${keyArchiveInfoDecoded.Type}:${keyArchiveInfoDecoded.Name}`, keyArchiveInfoDecoded);
+                    }
+                });
+            });
+        }
     }
-
-    if ((0, _keyArchive.isUnrecognizedKeyArchive)(keyArchive)) {
-      if (keyArchive.Type && keyArchive.Type !== _keyArchive.SecureKeyArchiveType && keyArchive.Type !== _keyArchive.InsecureKeyArchiveType) {
-        throw new _error.KeyArchiveTypeError(keyArchive.Type);
-      } // Only support DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION for now.
-
-
-      if (keyArchive.Version !== undefined && keyArchive.Version !== DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION) {
-        throw new _error.KeyArchiveVersionError(keyArchive.Version);
-      }
-
-      throw new _error.KeyArchiveDecodingError();
+    async saveKeys() {
+        for (const info of this.keys.values()) {
+            const keyManager = this.keyManagers[info.NameSpace];
+            if (!keyManager)
+                continue;
+            if (this.excludedKeyTypes.has(info.Type))
+                continue;
+            if (this.excludedKeys.has(info.Name))
+                continue;
+            const keyData = info.Decoded;
+            switch (info.Type) {
+                case KeyArchiveKeyType.Password:
+                    await keyManager.addPassword(keyData, info.Name);
+                    break;
+                case KeyArchiveKeyType.PrivateKey:
+                    await keyManager.addPrivateKey(keyData, info.Name);
+                    break;
+                case KeyArchiveKeyType.PublicKey:
+                    await keyManager.addPublicKey(keyData, info.Name);
+                    break;
+                case KeyArchiveKeyType.SymmetricKey:
+                    await keyManager.addSymmetricKey(keyData, info.Name);
+                    break;
+                default:
+                    throw new KeyArchiveUnknownKeyTypeError(`Key archive key type ${info.Type} is not recognized`);
+            }
+        }
     }
-
-    return keyArchive;
-  }
-
-  async loadKeys() {
-    for (const keyManager of Object.values(this.keyManagers)) {
-      await keyManager.exportKeys().then(exported => {
-        exported.forEach(data => {
-          const keyArchiveInfoDecoded = keyArchiveInfoFromKeyData(data);
-
-          if (!this.excludedKeyTypes.has(keyArchiveInfoDecoded.Type) && !this.excludedKeys.has(data.name)) {
-            this.keys.set(`${keyArchiveInfoDecoded.NameSpace}:${keyArchiveInfoDecoded.Type}:${keyArchiveInfoDecoded.Name}`, keyArchiveInfoDecoded);
-          }
+    async archive(password) {
+        const keys = [];
+        for (const key of this.keys.values()) {
+            keys.push({
+                NameSpace: key.NameSpace,
+                Name: key.Name,
+                Data: key.Data,
+                Type: key.Type,
+                Synchronizable: key.Synchronizable,
+                Exportable: key.Exportable,
+            });
+        }
+        let keyArchive;
+        if (!password) {
+            const insecureKeyArchive = {
+                Type: 'Insecure',
+                MetaInfo: {},
+                Version: DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION,
+                Keys: keys,
+            };
+            keyArchive = insecureKeyArchive;
+        }
+        else {
+            const salt = await this.defaultKeyManager.generateRandomData(SudoCryptoProviderDefaults.pbkdfSaltSize);
+            const b64Salt = Base64.encode(salt);
+            const key = await this.defaultKeyManager.generateSymmetricKeyFromPassword(password, salt, {
+                rounds: SudoCryptoProviderDefaults.pbkdfRounds,
+            });
+            const serializedKeys = JSON.stringify(keys);
+            const compressedSerializedKeys = gzipSync(BufferUtil.fromString(serializedKeys), {
+                level: 9,
+            });
+            // Don't strictly need a randomly generated IV here but no harm either
+            const iv = await this.defaultKeyManager.generateRandomData(SudoCryptoProviderDefaults.aesIVSize);
+            const encryptedKeys = await this.defaultKeyManager.encryptWithSymmetricKey(key, compressedSerializedKeys, { iv });
+            const secureKeyArchive = {
+                Type: 'Secure',
+                Version: DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION,
+                MetaInfo: {},
+                Salt: b64Salt,
+                Rounds: SudoCryptoProviderDefaults.pbkdfRounds,
+                Keys: Base64.encode(encryptedKeys),
+                IV: Base64.encode(iv),
+            };
+            keyArchive = secureKeyArchive;
+        }
+        for (const [key, value] of this.metaInfo.entries()) {
+            keyArchive.MetaInfo[key] = value;
+        }
+        const archiveString = JSON.stringify(keyArchive);
+        // While this double Gzips the SecureKeyArchive, it allows us to roughly
+        // recover the space consumed by Base64 encoding the cipher text. Otherwise
+        // we would end up having a fully binary data structure for the archive.
+        // If the time to compute becomes prohibitive we can look at a binary, non-JSON
+        // base format for the archive.
+        const archiveGzipped = gzipSync(BufferUtil.fromString(archiveString), {
+            level: 9,
         });
-      });
+        return Promise.resolve(archiveGzipped);
     }
-  }
-
-  async saveKeys() {
-    for (const info of this.keys.values()) {
-      const keyManager = this.keyManagers[info.NameSpace];
-      if (!keyManager) continue;
-      if (this.excludedKeyTypes.has(info.Type)) continue;
-      if (this.excludedKeys.has(info.Name)) continue;
-      const keyData = info.Decoded;
-
-      switch (info.Type) {
-        case _keyType.KeyArchiveKeyType.Password:
-          await keyManager.addPassword(keyData, info.Name);
-          break;
-
-        case _keyType.KeyArchiveKeyType.PrivateKey:
-          await keyManager.addPrivateKey(keyData, info.Name);
-          break;
-
-        case _keyType.KeyArchiveKeyType.PublicKey:
-          await keyManager.addPublicKey(keyData, info.Name);
-          break;
-
-        case _keyType.KeyArchiveKeyType.SymmetricKey:
-          await keyManager.addSymmetricKey(keyData, info.Name);
-          break;
-
-        default:
-          throw new _error.KeyArchiveUnknownKeyTypeError(`Key archive key type ${info.Type} is not recognized`);
-      }
+    async unarchive(password) {
+        if (!this.keyArchive) {
+            throw new KeyArchiveMissingError();
+        }
+        let keys;
+        if (isSecureKeyArchive(this.keyArchive)) {
+            if (!password) {
+                throw new KeyArchivePasswordRequiredError();
+            }
+            let iv;
+            let encryptedKeys;
+            let key;
+            try {
+                const salt = Base64.decode(this.keyArchive.Salt);
+                iv = Base64.decode(this.keyArchive.IV);
+                encryptedKeys = Base64.decode(this.keyArchive.Keys);
+                key = await this.defaultKeyManager.generateSymmetricKeyFromPassword(password, salt, { rounds: this.keyArchive.Rounds });
+            }
+            catch (err) {
+                throw new KeyArchiveDecodingError();
+            }
+            let compressedSerializedKeys;
+            try {
+                compressedSerializedKeys =
+                    await this.defaultKeyManager.decryptWithSymmetricKey(key, encryptedKeys, { iv });
+            }
+            catch (err) {
+                throw new KeyArchiveIncorrectPasswordError();
+            }
+            try {
+                const serializedKeys = gunzipSync(new Uint8Array(compressedSerializedKeys));
+                const decoded = KeyArchiveKeyInfoArrayCodec.decode(JSON.parse(BufferUtil.toString(serializedKeys)));
+                if (isLeft(decoded)) {
+                    throw new KeyArchiveDecodingError();
+                }
+                keys = decoded.right;
+            }
+            catch (err) {
+                throw new KeyArchiveDecodingError();
+            }
+        }
+        else {
+            if (password) {
+                throw new KeyArchiveNoPasswordRequiredError();
+            }
+            keys = this.keyArchive.Keys;
+        }
+        keys.forEach((key) => {
+            const keyKey = `${key.NameSpace}:${key.Type}:${key.Name}`;
+            let decoded;
+            try {
+                decoded = Base64.decode(key.Data);
+            }
+            catch (err) {
+                throw new KeyArchiveDecodingError(`Unable to decode key ${keyKey}`);
+            }
+            this.keys.set(keyKey, { ...key, Decoded: decoded });
+        });
     }
-  }
-
-  async archive(password) {
-    const keys = [];
-
-    for (const key of this.keys.values()) {
-      keys.push({
-        NameSpace: key.NameSpace,
-        Name: key.Name,
-        Data: key.Data,
-        Type: key.Type,
-        Synchronizable: key.Synchronizable,
-        Exportable: key.Exportable
-      });
+    reset() {
+        this.keys.clear();
     }
-
-    let keyArchive;
-
-    if (!password) {
-      const insecureKeyArchive = {
-        Type: 'Insecure',
-        MetaInfo: {},
-        Version: DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION,
-        Keys: keys
-      };
-      keyArchive = insecureKeyArchive;
-    } else {
-      const salt = await this.defaultKeyManager.generateRandomData(_sudoCryptoProvider.SudoCryptoProviderDefaults.pbkdfSaltSize);
-
-      const b64Salt = _base.Base64.encode(salt);
-
-      const key = await this.defaultKeyManager.generateSymmetricKeyFromPassword(password, salt, {
-        rounds: _sudoCryptoProvider.SudoCryptoProviderDefaults.pbkdfRounds
-      });
-      const serializedKeys = JSON.stringify(keys);
-      const compressedSerializedKeys = (0, _fflate.gzipSync)(_buffer.Buffer.fromString(serializedKeys), {
-        level: 9
-      }); // Don't strictly need a randomly generated IV here but no harm either
-
-      const iv = await this.defaultKeyManager.generateRandomData(_sudoCryptoProvider.SudoCryptoProviderDefaults.aesIVSize);
-      const encryptedKeys = await this.defaultKeyManager.encryptWithSymmetricKey(key, compressedSerializedKeys, {
-        iv
-      });
-      const secureKeyArchive = {
-        Type: 'Secure',
-        Version: DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION,
-        MetaInfo: {},
-        Salt: b64Salt,
-        Rounds: _sudoCryptoProvider.SudoCryptoProviderDefaults.pbkdfRounds,
-        Keys: _base.Base64.encode(encryptedKeys),
-        IV: _base.Base64.encode(iv)
-      };
-      keyArchive = secureKeyArchive;
+    containsKey(namespace, name, type) {
+        return this.keys.has(`${namespace}:${type}:${name}`);
     }
-
-    for (const [key, value] of this.metaInfo.entries()) {
-      keyArchive.MetaInfo[key] = value;
+    getKeyData(namespace, name, type) {
+        const keyInfo = this.keys.get(`${namespace}:${type}:${name}`);
+        if (!keyInfo) {
+            throw new KeyNotFoundError();
+        }
+        return keyInfo.Decoded;
     }
-
-    const archiveString = JSON.stringify(keyArchive); // While this double Gzips the SecureKeyArchive, it allows us to roughly
-    // recover the space consumed by Base64 encoding the cipher text. Otherwise
-    // we would end up having a fully binary data structure for the archive.
-    // If the time to compute becomes prohibitive we can look at a binary, non-JSON
-    // base format for the archive.
-
-    const archiveGzipped = (0, _fflate.gzipSync)(_buffer.Buffer.fromString(archiveString), {
-      level: 9
-    });
-    return Promise.resolve(archiveGzipped);
-  }
-
-  async unarchive(password) {
-    if (!this.keyArchive) {
-      throw new _error.KeyArchiveMissingError();
+    getExcludedKeys() {
+        return this.excludedKeys;
     }
-
-    let keys;
-
-    if ((0, _keyArchive.isSecureKeyArchive)(this.keyArchive)) {
-      if (!password) {
-        throw new _error.KeyArchivePasswordRequiredError();
-      }
-
-      let iv;
-      let encryptedKeys;
-      let key;
-
-      try {
-        const salt = _base.Base64.decode(this.keyArchive.Salt);
-
-        iv = _base.Base64.decode(this.keyArchive.IV);
-        encryptedKeys = _base.Base64.decode(this.keyArchive.Keys);
-        key = await this.defaultKeyManager.generateSymmetricKeyFromPassword(password, salt, {
-          rounds: this.keyArchive.Rounds
-        });
-      } catch (err) {
-        throw new _error.KeyArchiveDecodingError();
-      }
-
-      let compressedSerializedKeys;
-
-      try {
-        compressedSerializedKeys = await this.defaultKeyManager.decryptWithSymmetricKey(key, encryptedKeys, {
-          iv
-        });
-      } catch (err) {
-        throw new _error.KeyArchiveIncorrectPasswordError();
-      }
-
-      try {
-        const serializedKeys = (0, _fflate.gunzipSync)(new Uint8Array(compressedSerializedKeys));
-
-        const decoded = _keyInfo.KeyArchiveKeyInfoArrayCodec.decode(JSON.parse(_buffer.Buffer.toString(serializedKeys)));
-
-        if ((0, _Either.isLeft)(decoded)) {
-          throw new _error.KeyArchiveDecodingError();
-        }
-
-        keys = decoded.right;
-      } catch (err) {
-        throw new _error.KeyArchiveDecodingError();
-      }
-    } else {
-      if (password) {
-        throw new _error.KeyArchiveNoPasswordRequiredError();
-      }
-
-      keys = this.keyArchive.Keys;
+    getExcludedKeyTypes() {
+        return this.excludedKeyTypes;
     }
-
-    keys.forEach(key => {
-      const keyKey = `${key.NameSpace}:${key.Type}:${key.Name}`;
-      let decoded;
-
-      try {
-        decoded = _base.Base64.decode(key.Data);
-      } catch (err) {
-        throw new _error.KeyArchiveDecodingError(`Unable to decode key ${keyKey}`);
-      }
-
-      this.keys.set(keyKey, { ...key,
-        Decoded: decoded
-      });
-    });
-  }
-
-  reset() {
-    this.keys.clear();
-  }
-
-  containsKey(namespace, name, type) {
-    return this.keys.has(`${namespace}:${type}:${name}`);
-  }
-
-  getKeyData(namespace, name, type) {
-    const keyInfo = this.keys.get(`${namespace}:${type}:${name}`);
-
-    if (!keyInfo) {
-      throw new _error.KeyNotFoundError();
+    getMetaInfo() {
+        return this.metaInfo;
     }
-
-    return keyInfo.Decoded;
-  }
-
-  getExcludedKeys() {
-    return this.excludedKeys;
-  }
-
-  getExcludedKeyTypes() {
-    return this.excludedKeyTypes;
-  }
-
-  getMetaInfo() {
-    return this.metaInfo;
-  }
-
 }
-
-exports.DefaultSudoKeyArchive = DefaultSudoKeyArchive;
-
-_defineProperty(DefaultSudoKeyArchive, "PREGZIP_ARCHIVE_VERSION", 2);
-
-_defineProperty(DefaultSudoKeyArchive, "CURRENT_ARCHIVE_VERSION", _keyArchive.CURRENT_ARCHIVE_VERSION);
-
-function keyArchiveInfoFromKeyData(keyData) {
-  return {
-    NameSpace: keyData.namespace,
-    Name: keyData.name,
-    Type: keyArchiveKeyTypeFromKeyDataKeyType(keyData.type),
-    Data: _base.Base64.encode(keyData.data),
-    Decoded: keyData.data,
-    Synchronizable: false,
-    Exportable: true
-  };
+/**
+ * Version 2 format is not gzipped is what's currently generated
+ * by iOS and Android. We may want to add support for importing
+ * such archives.
+ */
+DefaultSudoKeyArchive.PREGZIP_ARCHIVE_VERSION = 2;
+/**
+ * Version 3 format permits both secure and insecure key archives.
+ *
+ * Insecure key archives are used where the archive will be stored
+ * in an otherwise known secure way e.g. via secure-vault-service
+ * where the encryption of the archive would then be handled by
+ * clients of that service.
+ *
+ * Secure key archives are password protected (via PBKDF2) a la version
+ * 2 format.
+ *
+ * Insecure format detail is:
+ *
+ *     gzip(JSON.stringify(InsecureKeyArchive))
+ *
+ * Secure format detail is:
+ *
+ *     gzip(JSON.stringify(SecureKeyArchive))
+ *
+ * where Keys property of SecureKeyArchive is:
+ *
+ *     base64(encrypt(gzip(JSON.stringify(array of keys))))
+ *
+ * Where encrypt operation is 256-bit AES CBC-mode with IV SecureKeyArchive.IV
+ * and key generated by SecureKeyArchive.Rounds of PBKDF2 on the password
+ * salted with SecureKeyArchive.Salt.
+ */
+DefaultSudoKeyArchive.CURRENT_ARCHIVE_VERSION = CURRENT_ARCHIVE_VERSION;
+export function keyArchiveInfoFromKeyData(keyData) {
+    return {
+        NameSpace: keyData.namespace,
+        Name: keyData.name,
+        Type: keyArchiveKeyTypeFromKeyDataKeyType(keyData.type),
+        Data: Base64.encode(keyData.data),
+        Decoded: keyData.data,
+        Synchronizable: false,
+        Exportable: true,
+    };
+}
+export function keyArchiveKeyTypeFromKeyDataKeyType(keyDataKeyType) {
+    switch (keyDataKeyType) {
+        case KeyDataKeyType.Password:
+            return KeyArchiveKeyType.Password;
+        case KeyDataKeyType.RSAPrivateKey:
+            return KeyArchiveKeyType.PrivateKey;
+        case KeyDataKeyType.RSAPublicKey:
+            return KeyArchiveKeyType.PublicKey;
+        case KeyDataKeyType.SymmetricKey:
+            return KeyArchiveKeyType.SymmetricKey;
+    }
 }
-
-function keyArchiveKeyTypeFromKeyDataKeyType(keyDataKeyType) {
-  switch (keyDataKeyType) {
-    case _sudoKeyManager.KeyDataKeyType.Password:
-      return _keyType.KeyArchiveKeyType.Password;
-
-    case _sudoKeyManager.KeyDataKeyType.RSAPrivateKey:
-      return _keyType.KeyArchiveKeyType.PrivateKey;
-
-    case _sudoKeyManager.KeyDataKeyType.RSAPublicKey:
-      return _keyType.KeyArchiveKeyType.PublicKey;
-
-    case _sudoKeyManager.KeyDataKeyType.SymmetricKey:
-      return _keyType.KeyArchiveKeyType.SymmetricKey;
-  }
-}
+//# sourceMappingURL=sudoKeyArchive.js.map