@tinycloud/share-sdk 0.2.0-beta.1 → 0.2.0-beta.2

package/dist/index.cjs

@@ -8742,6 +8742,42 @@ function bytes2(value, label) {
   if (decoded.length !== 64 || toBase64Url(decoded) !== value) throw new Error(`${label} is invalid`);
   return decoded;
 }
+var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function toBase64(bytes3) {
+  let out = "";
+  for (let i = 0; i < bytes3.length; i += 3) {
+    const b0 = bytes3[i];
+    const b1 = i + 1 < bytes3.length ? bytes3[i + 1] : 0;
+    const b2 = i + 2 < bytes3.length ? bytes3[i + 2] : 0;
+    out += BASE64_ALPHABET[b0 >> 2 & 63];
+    out += BASE64_ALPHABET[(b0 << 4 | b1 >> 4) & 63];
+    out += i + 1 < bytes3.length ? BASE64_ALPHABET[(b1 << 2 | b2 >> 6) & 63] : "=";
+    out += i + 2 < bytes3.length ? BASE64_ALPHABET[b2 & 63] : "=";
+  }
+  return out;
+}
+function fromBase64(value, label) {
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+    throw new Error(`${label} is invalid`);
+  }
+  const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+  const out = new Uint8Array(value.length / 4 * 3 - padding);
+  let outIdx = 0;
+  for (let i = 0; i < value.length; i += 4) {
+    const v0 = BASE64_ALPHABET.indexOf(value[i]);
+    const v1 = BASE64_ALPHABET.indexOf(value[i + 1]);
+    const v2 = value[i + 2] === "=" ? 0 : BASE64_ALPHABET.indexOf(value[i + 2]);
+    const v3 = value[i + 3] === "=" ? 0 : BASE64_ALPHABET.indexOf(value[i + 3]);
+    const b0 = v0 << 2 | v1 >> 4;
+    const b1 = (v1 & 15) << 4 | v2 >> 2;
+    const b2 = (v2 & 3) << 6 | v3;
+    if (outIdx < out.length) out[outIdx++] = b0;
+    if (outIdx < out.length) out[outIdx++] = b1;
+    if (outIdx < out.length) out[outIdx++] = b2;
+  }
+  if (toBase64(out) !== value) throw new Error(`${label} is invalid`);
+  return out;
+}
 async function digest3(value) {
   return toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalize(value)))));
 }
@@ -8997,9 +9033,9 @@ var ShareRecipientClient = class {
       if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.type !== "tinycloud.encryption.decrypt-result/v1" || value.targetNode !== body.targetNode || value.nodeId !== body.targetNode || value.networkId !== body.networkId || value.invocationCid !== invocation.cid || value.encryptedSymmetricKeyHash !== body.encryptedSymmetricKeyHash || value.receiverPublicKeyHash !== receiverPublicKeyHash || value.alg !== body.alg || value.keyVersion !== body.keyVersion || value.requestHash !== hex((0, import_sha2564.sha256)(new TextEncoder().encode(`${invocation.cid}${bodyHash}`))) || typeof value.wrappedKey !== "string" || typeof value.nodeSignature !== "string") throw new Error("v3 decrypt response binding is invalid");
       const unsigned = { ...value };
       delete unsigned.nodeSignature;
-      const signature = fromBase64Url(value.nodeSignature);
+      const signature = fromBase64(value.nodeSignature, "v3 decrypt response signature");
       if (signature.length !== 64 || !import_ed255198.ed25519.verify(signature, new TextEncoder().encode(canonicalize(unsigned)), ed25519PublicKeyFromDidKey(body.targetNode), { zip215: false })) throw new Error("v3 decrypt response signature is invalid");
-      const wrapped = fromBase64Url(value.wrappedKey);
+      const wrapped = fromBase64(value.wrappedKey, "v3 wrapped content key");
       if (wrapped.length < 60) throw new Error("v3 wrapped content key is malformed");
       const shared = import_ed255198.x25519.getSharedSecret(receiverPrivateKey, wrapped.slice(0, 32));
       const symmetricKey = await aesGcmDecrypt(shared, wrapped.slice(32));