@treeseed/sdk 0.13.0-rc.85 → 0.13.0-rc.87

package/dist/secrets-capability/service-vault-crypto.js

@@ -1,210 +0,0 @@
-import sodium from "libsodium-wrappers-sumo";
-import {
-  SERVICE_VAULT_AEAD_ALGORITHM,
-  SERVICE_VAULT_ENCRYPTION_VERSION,
-  SERVICE_VAULT_KDF,
-  SERVICE_VAULT_KEY_AGREEMENT
-} from "@treeseed/sdk/secrets-capability";
-const b64 = () => sodium.base64_variants.ORIGINAL;
-const encode = (value) => sodium.to_base64(value, b64());
-const decode = (value) => sodium.from_base64(value, b64());
-const hash = (value, key = null) => encode(sodium.crypto_generichash(32, value, key));
-async function ready() {
-  await sodium.ready;
-  return sodium;
-}
-function validKey(value, length, label) {
-  if (!(value instanceof Uint8Array) || value.length !== length) throw new Error(`${label} is invalid.`);
-  return value;
-}
-async function createServiceVaultKey() {
-  const crypto = await ready();
-  return crypto.randombytes_buf(crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES);
-}
-async function createServiceVaultUserKeyPair() {
-  const crypto = await ready(), pair = crypto.crypto_box_keypair();
-  return { publicKey: encode(pair.publicKey), privateKey: pair.privateKey };
-}
-async function encryptServiceVaultPrivateKey(privateKey, publicKey, passphrase, options = {}) {
-  const crypto = await ready();
-  validKey(privateKey, crypto.crypto_box_SECRETKEYBYTES, "Service-vault private key");
-  validKey(decode(publicKey), crypto.crypto_box_PUBLICKEYBYTES, "Service-vault public key");
-  if (passphrase.length < 12) throw new Error("Service-vault passphrase must contain at least 12 characters.");
-  const salt = crypto.randombytes_buf(crypto.crypto_pwhash_SALTBYTES);
-  const opsLimit = options.opsLimit ?? crypto.crypto_pwhash_OPSLIMIT_MODERATE;
-  const memLimit = options.memLimit ?? crypto.crypto_pwhash_MEMLIMIT_MODERATE;
-  const key = crypto.crypto_pwhash(
-    crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
-    passphrase,
-    salt,
-    opsLimit,
-    memLimit,
-    crypto.crypto_pwhash_ALG_ARGON2ID13
-  );
-  const nonce = crypto.randombytes_buf(crypto.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-  try {
-    return {
-      version: SERVICE_VAULT_ENCRYPTION_VERSION,
-      algorithm: SERVICE_VAULT_AEAD_ALGORITHM,
-      kdf: { algorithm: SERVICE_VAULT_KDF, opsLimit, memLimit, salt: encode(salt) },
-      nonce: encode(nonce),
-      ciphertext: encode(crypto.crypto_aead_xchacha20poly1305_ietf_encrypt(privateKey, publicKey, null, nonce, key)),
-      publicKey
-    };
-  } finally {
-    crypto.memzero(key);
-  }
-}
-async function decryptServiceVaultPrivateKey(envelope, passphrase) {
-  const crypto = await ready();
-  if (envelope.version !== SERVICE_VAULT_ENCRYPTION_VERSION || envelope.algorithm !== SERVICE_VAULT_AEAD_ALGORITHM || envelope.kdf.algorithm !== SERVICE_VAULT_KDF) throw new Error("Service-vault private-key envelope is unsupported.");
-  if (!Number.isSafeInteger(envelope.kdf.opsLimit) || !Number.isSafeInteger(envelope.kdf.memLimit) || envelope.kdf.opsLimit < crypto.crypto_pwhash_OPSLIMIT_INTERACTIVE || envelope.kdf.opsLimit > crypto.crypto_pwhash_OPSLIMIT_SENSITIVE || envelope.kdf.memLimit < crypto.crypto_pwhash_MEMLIMIT_INTERACTIVE || envelope.kdf.memLimit > crypto.crypto_pwhash_MEMLIMIT_SENSITIVE)
-    throw new Error("Service-vault private-key KDF parameters are invalid.");
-  const key = crypto.crypto_pwhash(
-    crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
-    passphrase,
-    decode(envelope.kdf.salt),
-    envelope.kdf.opsLimit,
-    envelope.kdf.memLimit,
-    crypto.crypto_pwhash_ALG_ARGON2ID13
-  );
-  try {
-    return validKey(crypto.crypto_aead_xchacha20poly1305_ietf_decrypt(
-      null,
-      decode(envelope.ciphertext),
-      envelope.publicKey,
-      decode(envelope.nonce),
-      key
-    ), crypto.crypto_box_SECRETKEYBYTES, "Decrypted service-vault private key");
-  } catch {
-    throw new Error("Service-vault passphrase or private-key envelope is invalid.");
-  } finally {
-    crypto.memzero(key);
-  }
-}
-async function createTeamVaultGrant(teamVaultKey, recipientPublicKey) {
-  const crypto = await ready();
-  validKey(teamVaultKey, crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES, "Team vault key");
-  const publicKey = validKey(decode(recipientPublicKey), crypto.crypto_box_PUBLICKEYBYTES, "Recipient public key");
-  return {
-    version: SERVICE_VAULT_ENCRYPTION_VERSION,
-    algorithm: SERVICE_VAULT_KEY_AGREEMENT,
-    recipientPublicKey,
-    wrappedTeamVaultKey: encode(crypto.crypto_box_seal(teamVaultKey, publicKey))
-  };
-}
-async function openTeamVaultGrant(grant, recipientPrivateKey) {
-  const crypto = await ready();
-  if (grant.version !== SERVICE_VAULT_ENCRYPTION_VERSION || grant.algorithm !== SERVICE_VAULT_KEY_AGREEMENT)
-    throw new Error("Team vault grant is unsupported.");
-  const publicKey = validKey(decode(grant.recipientPublicKey), crypto.crypto_box_PUBLICKEYBYTES, "Recipient public key");
-  validKey(recipientPrivateKey, crypto.crypto_box_SECRETKEYBYTES, "Recipient private key");
-  try {
-    return validKey(
-      crypto.crypto_box_seal_open(decode(grant.wrappedTeamVaultKey), publicKey, recipientPrivateKey),
-      crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES,
-      "Unwrapped team vault key"
-    );
-  } catch {
-    throw new Error("Team vault grant cannot be opened by this user key.");
-  }
-}
-async function encryptServiceCredential(plaintext, teamVaultKey, associatedData) {
-  const crypto = await ready();
-  validKey(teamVaultKey, crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES, "Team vault key");
-  if (!plaintext || !associatedData) throw new Error("Credential value and associated data are required.");
-  const dataKey = crypto.crypto_aead_xchacha20poly1305_ietf_keygen();
-  const nonce = crypto.randombytes_buf(crypto.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-  const wrappedKeyNonce = crypto.randombytes_buf(crypto.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-  try {
-    return {
-      version: SERVICE_VAULT_ENCRYPTION_VERSION,
-      algorithm: SERVICE_VAULT_AEAD_ALGORITHM,
-      ciphertext: encode(crypto.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, associatedData, null, nonce, dataKey)),
-      nonce: encode(nonce),
-      wrappedKey: encode(crypto.crypto_aead_xchacha20poly1305_ietf_encrypt(dataKey, associatedData, null, wrappedKeyNonce, teamVaultKey)),
-      wrappedKeyNonce: encode(wrappedKeyNonce),
-      associatedData,
-      associatedDataDigest: hash(associatedData),
-      fingerprint: hash(plaintext, teamVaultKey)
-    };
-  } finally {
-    crypto.memzero(dataKey);
-  }
-}
-async function decryptServiceCredential(envelope, teamVaultKey, expectedAssociatedData) {
-  const crypto = await ready();
-  validKey(teamVaultKey, crypto.crypto_aead_xchacha20poly1305_ietf_KEYBYTES, "Team vault key");
-  if (envelope.version !== SERVICE_VAULT_ENCRYPTION_VERSION || envelope.algorithm !== SERVICE_VAULT_AEAD_ALGORITHM || envelope.associatedData !== expectedAssociatedData || envelope.associatedDataDigest !== hash(expectedAssociatedData))
-    throw new Error("Credential envelope binding is invalid.");
-  let dataKey;
-  try {
-    dataKey = crypto.crypto_aead_xchacha20poly1305_ietf_decrypt(
-      null,
-      decode(envelope.wrappedKey),
-      expectedAssociatedData,
-      decode(envelope.wrappedKeyNonce),
-      teamVaultKey
-    );
-    return crypto.crypto_aead_xchacha20poly1305_ietf_decrypt(
-      null,
-      decode(envelope.ciphertext),
-      expectedAssociatedData,
-      decode(envelope.nonce),
-      dataKey,
-      "text"
-    );
-  } catch {
-    throw new Error("Credential envelope cannot be decrypted.");
-  } finally {
-    if (dataKey) crypto.memzero(dataKey);
-  }
-}
-async function rewrapServiceCredential(envelope, currentTeamVaultKey, replacementTeamVaultKey) {
-  const plaintext = await decryptServiceCredential(envelope, currentTeamVaultKey, envelope.associatedData);
-  return encryptServiceCredential(plaintext, replacementTeamVaultKey, envelope.associatedData);
-}
-async function sealSecretOperationPayload(values, operationPublicKey) {
-  const crypto = await ready();
-  if (!Object.keys(values).length || Object.values(values).some((value) => typeof value !== "string" || !value))
-    throw new Error("Secret operation payload must contain only non-empty string values.");
-  const payload = JSON.stringify(Object.fromEntries(Object.entries(values).sort(([left], [right]) => left.localeCompare(right))));
-  return encode(crypto.crypto_box_seal(payload, validKey(decode(operationPublicKey), crypto.crypto_box_PUBLICKEYBYTES, "Operation public key")));
-}
-async function encryptGitHubActionsSecret(value, providerPublicKey) {
-  const crypto = await ready();
-  if (!value) throw new Error("GitHub Actions secret value is required.");
-  return encode(crypto.crypto_box_seal(
-    value,
-    validKey(decode(providerPublicKey), crypto.crypto_box_PUBLICKEYBYTES, "GitHub public key")
-  ));
-}
-async function openSecretOperationPayload(sealedPayload, operationPublicKey, operationPrivateKey) {
-  const crypto = await ready();
-  try {
-    const plaintext = crypto.crypto_box_seal_open(decode(sealedPayload), decode(operationPublicKey), operationPrivateKey, "text");
-    const parsed = JSON.parse(plaintext);
-    if (!parsed || Array.isArray(parsed) || Object.values(parsed).some((value) => typeof value !== "string" || !value)) throw new Error();
-    return parsed;
-  } catch {
-    throw new Error("Secret operation payload cannot be opened.");
-  }
-}
-function clearServiceVaultKey(value) {
-  value?.fill(0);
-}
-export {
-  clearServiceVaultKey,
-  createServiceVaultKey,
-  createServiceVaultUserKeyPair,
-  createTeamVaultGrant,
-  decryptServiceCredential,
-  decryptServiceVaultPrivateKey,
-  encryptGitHubActionsSecret,
-  encryptServiceCredential,
-  encryptServiceVaultPrivateKey,
-  openSecretOperationPayload,
-  openTeamVaultGrant,
-  rewrapServiceCredential,
-  sealSecretOperationPayload
-};