@tinycloud/sdk-services 3.8.0-beta.1 → 3.8.0-beta.16

package/dist/encryption/index.cjs

@@ -56,6 +56,7 @@ __export(encryption_exports, {
   isNetworkId: () => isNetworkId,
   networkDiscoveryKey: () => networkDiscoveryKey,
   openWrappedKey: () => openWrappedKey,
+  parseEncryptionResource: () => parseEncryptionResource,
   parseNetworkId: () => parseNetworkId,
   utf8Decode: () => utf8Decode,
   utf8Encode: () => utf8Encode,
@@ -201,6 +202,26 @@ function parseNetworkId(networkId) {
   }
   return { networkId, ownerDid, name };
 }
+function parseEncryptionResource(resource) {
+  const networkSeparator = resource.lastIndexOf(":");
+  const nameAndPath = resource.slice(networkSeparator + 1);
+  const pathSeparator = nameAndPath.indexOf("/");
+  const name = pathSeparator === -1 ? nameAndPath : nameAndPath.slice(0, pathSeparator);
+  const networkId = pathSeparator === -1 ? resource : `${resource.slice(0, networkSeparator + 1)}${name}`;
+  const parsed = parseNetworkId(networkId);
+  if (pathSeparator === -1) return parsed;
+  const keyPath = nameAndPath.slice(pathSeparator + 1);
+  const segments = keyPath.split("/");
+  const prefix = keyPath.endsWith("/");
+  if (keyPath.length === 0 || /[\u0000-\u001f\u007f\\]/.test(keyPath) || segments.some(
+    (segment, index) => segment === "." || segment === ".." || segment.length === 0 && !(prefix && index === segments.length - 1)
+  )) {
+    throw new NetworkIdError(
+      `encryption resource has an invalid keyPath (got ${JSON.stringify(resource)})`
+    );
+  }
+  return { ...parsed, keyPath };
+}
 function buildNetworkId(ownerDid, name) {
   if (typeof ownerDid !== "string" || !ownerDid.startsWith("did:")) {
     throw new NetworkIdError("ownerDid must be a DID");
@@ -913,7 +934,12 @@ function ensureNetworkUsableForDecrypt(descriptor) {
 
 // src/encryption/envelope.ts
 function encryptToNetwork(crypto, input) {
-  parseNetworkId(input.networkId);
+  const parsedResource = parseEncryptionResource(
+    input.keyPath === void 0 ? input.networkId : `${input.networkId}/${input.keyPath}`
+  );
+  if (parsedResource.keyPath !== input.keyPath || input.keyPath?.endsWith("/")) {
+    throw new NetworkIdError("keyPath must name an exact encryption key");
+  }
   const alg = input.alg ?? DEFAULT_ENCRYPTION_ALG;
   const keyVersion = input.keyVersion ?? DEFAULT_KEY_VERSION;
   const symmetricKey = crypto.randomBytes(32);
@@ -927,6 +953,7 @@ function encryptToNetwork(crypto, input) {
   const envelope = {
     v: ENVELOPE_VERSION,
     networkId: input.networkId,
+    ...input.keyPath !== void 0 ? { keyPath: input.keyPath } : {},
     alg,
     keyVersion,
     encryptedSymmetricKey,
@@ -958,13 +985,24 @@ function validateEnvelope(crypto, envelope) {
     };
   }
   try {
-    parseNetworkId(e.networkId);
+    if (parseEncryptionResource(e.networkId).keyPath !== void 0) {
+      throw new Error("networkId must identify the network root");
+    }
+    if (e.keyPath !== void 0) {
+      if (typeof e.keyPath !== "string") {
+        throw new Error("keyPath must be a string");
+      }
+      const parsed = parseEncryptionResource(`${e.networkId}/${e.keyPath}`);
+      if (parsed.keyPath !== e.keyPath || e.keyPath.endsWith("/")) {
+        throw new Error("keyPath must name an exact encryption key");
+      }
+    }
   } catch (err2) {
     return {
       ok: false,
       error: encryptionError({
         code: "INVALID_ENVELOPE",
-        message: `envelope.networkId is malformed: ${err2 instanceof Error ? err2.message : String(err2)}`
+        message: `envelope encryption resource is malformed: ${err2 instanceof Error ? err2.message : String(err2)}`
       })
     };
   }
@@ -1037,6 +1075,7 @@ function buildDecryptFacts(input) {
     type: DECRYPT_FACT_TYPE,
     targetNode: input.body.targetNode,
     networkId: input.body.networkId,
+    ...input.body.keyPath !== void 0 ? { keyPath: input.body.keyPath } : {},
     bodyHash,
     encryptedSymmetricKeyHash: input.encryptedSymmetricKeyHash,
     receiverPublicKeyHash,
@@ -1044,10 +1083,14 @@ function buildDecryptFacts(input) {
     keyVersion: input.body.keyVersion
   };
 }
-function buildDecryptAttenuation(networkId) {
-  parseNetworkId(networkId);
+function buildDecryptAttenuation(networkId, keyPath) {
+  const resource = keyPath === void 0 ? networkId : `${networkId}/${keyPath}`;
+  const parsed = parseEncryptionResource(resource);
+  if (parsed.networkId !== networkId || parsed.keyPath !== keyPath || keyPath?.endsWith("/")) {
+    throw new NetworkIdError("keyPath must name an exact encryption key");
+  }
   return {
-    [networkId]: {
+    [resource]: {
       [DECRYPT_ACTION]: {}
     }
   };
@@ -1107,6 +1150,15 @@ function checkDecryptInvocationInput(crypto, input) {
       })
     };
   }
+  if (input.facts.keyPath !== input.body.keyPath) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_INPUT",
+        message: "facts.keyPath must equal body.keyPath"
+      })
+    };
+  }
   if (input.facts.alg !== input.body.alg) {
     return {
       ok: false,
@@ -1144,7 +1196,9 @@ function checkDecryptInvocationInput(crypto, input) {
     };
   }
   try {
-    parseNetworkId(input.networkId);
+    if (parseEncryptionResource(input.networkId).keyPath !== void 0) {
+      throw new NetworkIdError("networkId must identify the network root");
+    }
   } catch (err2) {
     return {
       ok: false,
@@ -1154,6 +1208,22 @@ function checkDecryptInvocationInput(crypto, input) {
       })
     };
   }
+  try {
+    const resource = parseEncryptionResource(
+      input.body.keyPath === void 0 ? input.body.networkId : `${input.body.networkId}/${input.body.keyPath}`
+    );
+    if (resource.keyPath !== input.body.keyPath || input.body.keyPath?.endsWith("/")) {
+      throw new NetworkIdError("keyPath must name an exact encryption key");
+    }
+  } catch (err2) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_INPUT",
+        message: err2 instanceof Error ? err2.message : String(err2)
+      })
+    };
+  }
   const canonicalBody = canonicalize(
     input.body
   );
@@ -1394,6 +1464,7 @@ var EncryptionService = class extends BaseService {
         // that spelling in the envelope so a later response can be compared
         // byte-for-byte (notably for checksummed did:pkh principals).
         networkId: descriptor.networkId,
+        ...options?.keyPath !== void 0 ? { keyPath: options.keyPath } : {},
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},
@@ -1453,6 +1524,7 @@ var EncryptionService = class extends BaseService {
         type: DECRYPT_FACT_TYPE,
         targetNode,
         networkId: envelope.networkId,
+        ...envelope.keyPath !== void 0 ? { keyPath: envelope.keyPath } : {},
         alg: envelope.alg,
         keyVersion: envelope.keyVersion,
         encryptedSymmetricKey: envelope.encryptedSymmetricKey,
@@ -1597,6 +1669,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   isNetworkId,
   networkDiscoveryKey,
   openWrappedKey,
+  parseEncryptionResource,
   parseNetworkId,
   utf8Decode,
   utf8Encode,