@virtru/dsp-sdk 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -1
- package/README.md +81 -3
- package/dist/src/fips.d.ts +7 -0
- package/dist/src/fips.js +12 -0
- package/dist/src/lib/dsp.d.ts +17 -1
- package/dist/src/lib/dsp.js +28 -5
- package/package.json +23 -2
- package/.prettierrc +0 -3
- package/.rush/temp/chunked-rush-logs/dsp-sdk._phase_build.chunks.jsonl +0 -12
- package/.rush/temp/chunked-rush-logs/dsp-sdk._phase_test.chunks.jsonl +0 -383
- package/.rush/temp/package-deps__phase_build.json +0 -76
- package/.rush/temp/shrinkwrap-deps.json +0 -1262
- package/CHANGELOG.json +0 -299
- package/buf.gen.yaml +0 -17
- package/buf.yaml +0 -4
- package/config/jest.config.json +0 -6
- package/config/rig.json +0 -8
- package/dist/tests/dsp-client.test.d.ts +0 -1
- package/dist/tests/dsp-client.test.js +0 -73
- package/dist/tests/dsp.test.d.ts +0 -1
- package/dist/tests/dsp.test.js +0 -92
- package/dist/tests/fips-crypto.unit.test.d.ts +0 -1
- package/dist/tests/fips-crypto.unit.test.js +0 -258
- package/dist/tests/mocks/create-export-artifacts.d.ts +0 -2
- package/dist/tests/mocks/create-export-artifacts.js +0 -13
- package/dist/tests/mocks/tagging-pdp-tag.d.ts +0 -2
- package/dist/tests/mocks/tagging-pdp-tag.js +0 -11
- package/dist/tests/mocks/well-known-configuration.d.ts +0 -2
- package/dist/tests/mocks/well-known-configuration.js +0 -12
- package/dist/tests/setup-msw.d.ts +0 -9
- package/dist/tests/setup-msw.js +0 -30
- package/dist/tests/setup-unit.d.ts +0 -7
- package/dist/tests/setup-unit.js +0 -70
- package/eslint.config.mjs +0 -28
- package/lib-commonjs/src/gen/buf/validate/validate_pb.js +0 -487
- package/lib-commonjs/src/gen/config/v1/config_pb.js +0 -142
- package/lib-commonjs/src/gen/config/v1/kas_config_pb.js +0 -72
- package/lib-commonjs/src/gen/config/v1/meta_pb.js +0 -36
- package/lib-commonjs/src/gen/config/v1/outlook_config_pb.js +0 -67
- package/lib-commonjs/src/gen/config/v1/secureviewer_config_pb.js +0 -67
- package/lib-commonjs/src/gen/config/v1/tagging_pb.js +0 -246
- package/lib-commonjs/src/gen/google/api/annotations_pb.js +0 -33
- package/lib-commonjs/src/gen/google/api/http_pb.js +0 -44
- package/lib-commonjs/src/gen/policyimportexport/v1/policy_import_export_pb.js +0 -93
- package/lib-commonjs/src/gen/shared/v1/shared_pb.js +0 -95
- package/lib-commonjs/src/gen/tagging/pdp/v2/tagging_pb.js +0 -277
- package/lib-commonjs/src/gen/version/v1/version_pb.js +0 -40
- package/lib-commonjs/src/gen/virtru/common/common_pb.js +0 -76
- package/lib-commonjs/src/gen/virtru/policy/certificates/v1/certificates_pb.js +0 -77
- package/lib-commonjs/src/gen/virtru/policy/objects_pb.js +0 -143
- package/lib-commonjs/src/index.js +0 -48
- package/lib-commonjs/src/lib/client.js +0 -66
- package/lib-commonjs/src/lib/consts.js +0 -10
- package/lib-commonjs/src/lib/dsp.js +0 -49
- package/lib-commonjs/src/lib/fips-crypto/asymmetric.js +0 -126
- package/lib-commonjs/src/lib/fips-crypto/key-format.js +0 -243
- package/lib-commonjs/src/lib/fips-crypto/keys.js +0 -134
- package/lib-commonjs/src/lib/fips-crypto/primitives.js +0 -112
- package/lib-commonjs/src/lib/fips-crypto/symmetric.js +0 -162
- package/lib-commonjs/src/lib/fips-crypto-service.js +0 -57
- package/lib-commonjs/src/lib/utils.js +0 -401
- package/lib-commonjs/tests/dsp-client.test.js +0 -75
- package/lib-commonjs/tests/dsp.test.js +0 -94
- package/lib-commonjs/tests/fips-crypto.unit.test.js +0 -260
- package/lib-commonjs/tests/mocks/create-export-artifacts.js +0 -17
- package/lib-commonjs/tests/mocks/tagging-pdp-tag.js +0 -15
- package/lib-commonjs/tests/mocks/well-known-configuration.js +0 -16
- package/lib-commonjs/tests/setup-msw.js +0 -33
- package/lib-commonjs/tests/setup-unit.js +0 -72
- package/public/virtru.wasm +0 -0
- package/src/gen/buf/validate/validate_pb.ts +0 -4879
- package/src/gen/config/formatters/testdata/v1/test_pb.ts +0 -287
- package/src/gen/config/v1/config_connect.ts +0 -111
- package/src/gen/config/v1/config_pb.ts +0 -439
- package/src/gen/config/v1/kas_config_pb.ts +0 -183
- package/src/gen/config/v1/meta_pb.ts +0 -72
- package/src/gen/config/v1/outlook_config_pb.ts +0 -242
- package/src/gen/config/v1/secureviewer_config_pb.ts +0 -161
- package/src/gen/config/v1/tagging_pb.ts +0 -456
- package/src/gen/google/api/annotations_pb.ts +0 -43
- package/src/gen/google/api/http_pb.ts +0 -486
- package/src/gen/helloworld/v1/helloworld_connect.ts +0 -49
- package/src/gen/helloworld/v1/helloworld_pb.ts +0 -104
- package/src/gen/kas/nanotdf/v1/nanotdf_rewrap_connect.ts +0 -39
- package/src/gen/kas/nanotdf/v1/nanotdf_rewrap_pb.ts +0 -207
- package/src/gen/policyimportexport/v1/policy_import_export_connect.ts +0 -56
- package/src/gen/policyimportexport/v1/policy_import_export_pb.ts +0 -332
- package/src/gen/shared/v1/shared_connect.ts +0 -61
- package/src/gen/shared/v1/shared_pb.ts +0 -240
- package/src/gen/shared/v2/shared_connect.ts +0 -39
- package/src/gen/shared/v2/shared_pb.ts +0 -122
- package/src/gen/tagging/pdp/v2/externalprocessors/processor_connect.ts +0 -156
- package/src/gen/tagging/pdp/v2/externalprocessors/processor_pb.ts +0 -709
- package/src/gen/tagging/pdp/v2/stanag/stanag_pb.ts +0 -953
- package/src/gen/tagging/pdp/v2/tagging_connect.ts +0 -73
- package/src/gen/tagging/pdp/v2/tagging_pb.ts +0 -1064
- package/src/gen/version/v1/version_connect.ts +0 -31
- package/src/gen/version/v1/version_pb.ts +0 -143
- package/src/gen/virtru/common/common_pb.ts +0 -201
- package/src/gen/virtru/policy/certificates/v1/certificates_connect.ts +0 -44
- package/src/gen/virtru/policy/certificates/v1/certificates_pb.ts +0 -305
- package/src/gen/virtru/policy/objects_pb.ts +0 -253
- package/src/gen/web-admin/v1/config_connect.ts +0 -52
- package/src/gen/web-admin/v1/config_pb.ts +0 -173
- package/src/index.ts +0 -62
- package/src/lib/client.ts +0 -90
- package/src/lib/consts.ts +0 -8
- package/src/lib/dsp.ts +0 -65
- package/src/lib/fips-crypto/asymmetric.ts +0 -162
- package/src/lib/fips-crypto/key-format.ts +0 -287
- package/src/lib/fips-crypto/keys.ts +0 -190
- package/src/lib/fips-crypto/primitives.ts +0 -197
- package/src/lib/fips-crypto/symmetric.ts +0 -213
- package/src/lib/fips-crypto-service.ts +0 -58
- package/src/lib/utils.test.ts +0 -415
- package/src/lib/utils.ts +0 -525
- package/src/vite-env.d.ts +0 -7
- package/temp/build/lint/_eslint-5eVG3S6w.json +0 -38
- package/temp/test/jest/haste-map-b055a9550e6d9f9b43d8ad29b1607278-49d19aee56a0732eca9c014a51272338-8710993d07b75a801b0956e67ffc46fa +0 -0
- package/tests/dsp-client.test.ts +0 -95
- package/tests/dsp.test.ts +0 -119
- package/tests/fips-crypto.unit.test.ts +0 -412
- package/tests/mocks/create-export-artifacts.ts +0 -16
- package/tests/mocks/tagging-pdp-tag.ts +0 -13
- package/tests/mocks/well-known-configuration.ts +0 -15
- package/tests/setup-msw.ts +0 -35
- package/tests/setup-unit.ts +0 -108
- package/tsconfig.json +0 -32
- package/update-protos.sh +0 -63
- package/vitest.config.ts +0 -48
|
@@ -1,260 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
/*
|
|
3
|
-
* Copyright (c) Virtru Corporation. All rights reserved.
|
|
4
|
-
*
|
|
5
|
-
* Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
|
|
6
|
-
*/
|
|
7
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
8
|
-
const vitest_1 = require("vitest");
|
|
9
|
-
const singlecontainer_1 = require("@opentdf/sdk/singlecontainer");
|
|
10
|
-
const fips_crypto_service_1 = require("../src/lib/fips-crypto-service");
|
|
11
|
-
(0, vitest_1.describe)('FIPS CryptoService - Methods', () => {
|
|
12
|
-
// RSA key slots are finite in the WASM keystore. Each describe group that
|
|
13
|
-
// uses RSA keys creates ONE shared key pair in beforeAll and releases it in
|
|
14
|
-
// afterAll so slots are reclaimed before the next group starts.
|
|
15
|
-
(0, vitest_1.describe)('sign and verify (asymmetric)', () => {
|
|
16
|
-
let keyPair;
|
|
17
|
-
(0, vitest_1.beforeAll)(async () => {
|
|
18
|
-
keyPair = await fips_crypto_service_1.FipsCryptoService.generateSigningKeyPair();
|
|
19
|
-
}, 60000);
|
|
20
|
-
(0, vitest_1.afterAll)(() => {
|
|
21
|
-
(0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
|
|
22
|
-
});
|
|
23
|
-
(0, vitest_1.test)('should sign and verify with RS256', async () => {
|
|
24
|
-
const data = new Uint8Array([1, 2, 3, 4, 5]);
|
|
25
|
-
const signature = await fips_crypto_service_1.FipsCryptoService.sign(data, keyPair.privateKey, 'RS256');
|
|
26
|
-
const isValid = await fips_crypto_service_1.FipsCryptoService.verify(data, signature, keyPair.publicKey, 'RS256');
|
|
27
|
-
(0, vitest_1.expect)(isValid).toBe(true);
|
|
28
|
-
});
|
|
29
|
-
(0, vitest_1.test)('should reject tampered data', async () => {
|
|
30
|
-
const data = new Uint8Array([1, 2, 3, 4, 5]);
|
|
31
|
-
const signature = await fips_crypto_service_1.FipsCryptoService.sign(data, keyPair.privateKey, 'RS256');
|
|
32
|
-
const tamperedData = new Uint8Array([1, 2, 3, 4, 6]);
|
|
33
|
-
const isValid = await fips_crypto_service_1.FipsCryptoService.verify(tamperedData, signature, keyPair.publicKey, 'RS256');
|
|
34
|
-
(0, vitest_1.expect)(isValid).toBe(false);
|
|
35
|
-
});
|
|
36
|
-
(0, vitest_1.test)('should throw error for ES256 (EC not supported)', async () => {
|
|
37
|
-
await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.sign(new Uint8Array([1, 2, 3, 4]), keyPair.privateKey, 'ES256')).rejects.toThrow('not supported in FIPS mode');
|
|
38
|
-
});
|
|
39
|
-
(0, vitest_1.test)('encryption key pair (RSA-OAEP) should not be usable for signing', async () => {
|
|
40
|
-
// Catches algorithm mismatch: if generateKeyPair() incorrectly used
|
|
41
|
-
// RSASSA-PKCS1-v1_5 params, signing would succeed here instead of throwing.
|
|
42
|
-
const encKeyPair = await fips_crypto_service_1.FipsCryptoService.generateKeyPair();
|
|
43
|
-
await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.sign(new Uint8Array([1, 2, 3]), encKeyPair.privateKey, 'RS256')).rejects.toThrow();
|
|
44
|
-
(0, fips_crypto_service_1.unwrapPublicKey)(encKeyPair.publicKey).release();
|
|
45
|
-
(0, fips_crypto_service_1.unwrapPrivateKey)(encKeyPair.privateKey).release();
|
|
46
|
-
});
|
|
47
|
-
});
|
|
48
|
-
(0, vitest_1.describe)('hmac and verifyHmac', () => {
|
|
49
|
-
(0, vitest_1.test)('should compute and verify HMAC-SHA256', async () => {
|
|
50
|
-
const crypto = fips_crypto_service_1.FipsCryptoService;
|
|
51
|
-
const keyBytes = await crypto.randomBytes(32);
|
|
52
|
-
const symKey = await crypto.importSymmetricKey(keyBytes);
|
|
53
|
-
const data = new Uint8Array([1, 2, 3, 4, 5]);
|
|
54
|
-
const signature = await crypto.hmac(data, symKey);
|
|
55
|
-
const isValid = await crypto.verifyHmac(data, signature, symKey);
|
|
56
|
-
(0, vitest_1.expect)(isValid).toBe(true);
|
|
57
|
-
});
|
|
58
|
-
(0, vitest_1.test)('should reject invalid signature', async () => {
|
|
59
|
-
const crypto = fips_crypto_service_1.FipsCryptoService;
|
|
60
|
-
const symKey = await crypto.generateKey(32);
|
|
61
|
-
const data = new Uint8Array([1, 2, 3, 4]);
|
|
62
|
-
const signature = await crypto.hmac(data, symKey);
|
|
63
|
-
signature[0] ^= 1; // Flip a bit
|
|
64
|
-
const isValid = await crypto.verifyHmac(data, signature, symKey);
|
|
65
|
-
(0, vitest_1.expect)(isValid).toBe(false);
|
|
66
|
-
});
|
|
67
|
-
(0, vitest_1.test)('should reject signature with wrong key', async () => {
|
|
68
|
-
const crypto = fips_crypto_service_1.FipsCryptoService;
|
|
69
|
-
const symKey1 = await crypto.importSymmetricKey(await crypto.randomBytes(32));
|
|
70
|
-
const symKey2 = await crypto.importSymmetricKey(await crypto.randomBytes(32));
|
|
71
|
-
const data = new Uint8Array([1, 2, 3, 4]);
|
|
72
|
-
const signature = await crypto.hmac(data, symKey1);
|
|
73
|
-
const isValid = await crypto.verifyHmac(data, signature, symKey2);
|
|
74
|
-
(0, vitest_1.expect)(isValid).toBe(false);
|
|
75
|
-
});
|
|
76
|
-
});
|
|
77
|
-
(0, vitest_1.describe)('digest', () => {
|
|
78
|
-
(0, vitest_1.test)('should compute SHA-256 hash', async () => {
|
|
79
|
-
const data = new Uint8Array([1, 2, 3, 4]);
|
|
80
|
-
const hash = await fips_crypto_service_1.FipsCryptoService.digest('SHA-256', data);
|
|
81
|
-
(0, vitest_1.expect)(hash).toBeInstanceOf(Uint8Array);
|
|
82
|
-
(0, vitest_1.expect)(hash.byteLength).toBe(32);
|
|
83
|
-
});
|
|
84
|
-
(0, vitest_1.test)('should produce consistent hashes', async () => {
|
|
85
|
-
const data = new Uint8Array([1, 2, 3, 4]);
|
|
86
|
-
const hash1 = await fips_crypto_service_1.FipsCryptoService.digest('SHA-256', data);
|
|
87
|
-
const hash2 = await fips_crypto_service_1.FipsCryptoService.digest('SHA-256', data);
|
|
88
|
-
(0, vitest_1.expect)(hash1).toEqual(hash2);
|
|
89
|
-
});
|
|
90
|
-
(0, vitest_1.test)('should throw error for SHA-384 (not supported)', async () => {
|
|
91
|
-
await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.digest('SHA-384', new Uint8Array([1, 2, 3, 4]))).rejects.toThrow('not supported in FIPS mode');
|
|
92
|
-
});
|
|
93
|
-
});
|
|
94
|
-
(0, vitest_1.describe)('EC placeholder methods', () => {
|
|
95
|
-
(0, vitest_1.test)('should throw error for generateECKeyPair', async () => {
|
|
96
|
-
await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.generateECKeyPair()).rejects.toThrow('not supported in FIPS mode');
|
|
97
|
-
});
|
|
98
|
-
(0, vitest_1.test)('should throw error for deriveKeyFromECDH', async () => {
|
|
99
|
-
await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.deriveKeyFromECDH({}, {}, {
|
|
100
|
-
hash: 'SHA-256',
|
|
101
|
-
salt: new Uint8Array(),
|
|
102
|
-
})).rejects.toThrow('not supported in FIPS mode');
|
|
103
|
-
});
|
|
104
|
-
});
|
|
105
|
-
(0, vitest_1.describe)('exportPublicKeyPem', () => {
|
|
106
|
-
let keyPair;
|
|
107
|
-
(0, vitest_1.beforeAll)(async () => {
|
|
108
|
-
keyPair = await fips_crypto_service_1.FipsCryptoService.generateKeyPair();
|
|
109
|
-
}, 60000);
|
|
110
|
-
(0, vitest_1.afterAll)(() => {
|
|
111
|
-
(0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
|
|
112
|
-
});
|
|
113
|
-
(0, vitest_1.test)('should export generated public key to PEM', async () => {
|
|
114
|
-
const pem = await fips_crypto_service_1.FipsCryptoService.exportPublicKeyPem(keyPair.publicKey);
|
|
115
|
-
(0, vitest_1.expect)(pem).toContain('-----BEGIN PUBLIC KEY-----');
|
|
116
|
-
(0, vitest_1.expect)(pem).toContain('-----END PUBLIC KEY-----');
|
|
117
|
-
});
|
|
118
|
-
});
|
|
119
|
-
(0, vitest_1.describe)('importPublicKey', () => {
|
|
120
|
-
let keyPair;
|
|
121
|
-
let importedKey;
|
|
122
|
-
(0, vitest_1.beforeAll)(async () => {
|
|
123
|
-
const crypto = fips_crypto_service_1.FipsCryptoService;
|
|
124
|
-
keyPair = await crypto.generateKeyPair(2048);
|
|
125
|
-
const pem = await crypto.exportPublicKeyPem(keyPair.publicKey);
|
|
126
|
-
importedKey = await crypto.importPublicKey(pem, { usage: 'encrypt' });
|
|
127
|
-
}, 60000);
|
|
128
|
-
(0, vitest_1.afterAll)(() => {
|
|
129
|
-
(0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
|
|
130
|
-
(0, fips_crypto_service_1.unwrapPublicKey)(importedKey).release();
|
|
131
|
-
});
|
|
132
|
-
(0, vitest_1.test)('should import PEM and detect RSA-2048', () => {
|
|
133
|
-
(0, vitest_1.expect)(importedKey.algorithm).toBe('rsa:2048');
|
|
134
|
-
});
|
|
135
|
-
});
|
|
136
|
-
(0, vitest_1.describe)('exportPublicKeyJwk', () => {
|
|
137
|
-
let keyPair;
|
|
138
|
-
(0, vitest_1.beforeAll)(async () => {
|
|
139
|
-
keyPair = await fips_crypto_service_1.FipsCryptoService.generateKeyPair(2048);
|
|
140
|
-
}, 60000);
|
|
141
|
-
(0, vitest_1.afterAll)(() => {
|
|
142
|
-
(0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
|
|
143
|
-
});
|
|
144
|
-
(0, vitest_1.test)('should export public key to JWK', async () => {
|
|
145
|
-
const jwk = await fips_crypto_service_1.FipsCryptoService.exportPublicKeyJwk(keyPair.publicKey);
|
|
146
|
-
(0, vitest_1.expect)(jwk.kty).toBe('RSA');
|
|
147
|
-
(0, vitest_1.expect)(jwk.n).toBeDefined();
|
|
148
|
-
(0, vitest_1.expect)(jwk.e).toBeDefined();
|
|
149
|
-
(0, vitest_1.expect)(typeof jwk.n).toBe('string');
|
|
150
|
-
(0, vitest_1.expect)(typeof jwk.e).toBe('string');
|
|
151
|
-
});
|
|
152
|
-
(0, vitest_1.test)('should produce a JWK that round-trips back to SPKI', async () => {
|
|
153
|
-
const jwk = await fips_crypto_service_1.FipsCryptoService.exportPublicKeyJwk(keyPair.publicKey);
|
|
154
|
-
const webKey = await globalThis.crypto.subtle.importKey('jwk', jwk, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, true, ['verify']);
|
|
155
|
-
const spki = await globalThis.crypto.subtle.exportKey('spki', webKey);
|
|
156
|
-
(0, vitest_1.expect)(spki.byteLength).toBeGreaterThan(0);
|
|
157
|
-
});
|
|
158
|
-
});
|
|
159
|
-
(0, vitest_1.describe)('encrypt and decrypt (symmetric AES-GCM)', () => {
|
|
160
|
-
(0, vitest_1.test)('should round-trip encrypt/decrypt', async () => {
|
|
161
|
-
const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
|
|
162
|
-
const iv = singlecontainer_1.Binary.fromArrayBuffer((await fips_crypto_service_1.FipsCryptoService.randomBytes(12)).buffer);
|
|
163
|
-
const plaintext = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
|
|
164
|
-
const { payload: cipher, authTag } = await fips_crypto_service_1.FipsCryptoService.encrypt(singlecontainer_1.Binary.fromArrayBuffer(plaintext.buffer), key, iv);
|
|
165
|
-
const { payload: recovered } = await fips_crypto_service_1.FipsCryptoService.decrypt(cipher, key, iv, undefined, authTag);
|
|
166
|
-
(0, vitest_1.expect)(new Uint8Array(recovered.asArrayBuffer())).toEqual(plaintext);
|
|
167
|
-
});
|
|
168
|
-
(0, vitest_1.test)('should produce different ciphertext for different IVs', async () => {
|
|
169
|
-
const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
|
|
170
|
-
const plaintext = singlecontainer_1.Binary.fromArrayBuffer(new Uint8Array([1, 2, 3, 4]).buffer);
|
|
171
|
-
const iv1 = singlecontainer_1.Binary.fromArrayBuffer((await fips_crypto_service_1.FipsCryptoService.randomBytes(12)).buffer);
|
|
172
|
-
const iv2 = singlecontainer_1.Binary.fromArrayBuffer((await fips_crypto_service_1.FipsCryptoService.randomBytes(12)).buffer);
|
|
173
|
-
const { payload: cipher1 } = await fips_crypto_service_1.FipsCryptoService.encrypt(plaintext, key, iv1);
|
|
174
|
-
const { payload: cipher2 } = await fips_crypto_service_1.FipsCryptoService.encrypt(plaintext, key, iv2);
|
|
175
|
-
(0, vitest_1.expect)(new Uint8Array(cipher1.asArrayBuffer())).not.toEqual(new Uint8Array(cipher2.asArrayBuffer()));
|
|
176
|
-
});
|
|
177
|
-
});
|
|
178
|
-
(0, vitest_1.describe)('encryptWithPublicKey and decryptWithPrivateKey (RSA-OAEP)', () => {
|
|
179
|
-
let keyPair;
|
|
180
|
-
(0, vitest_1.beforeAll)(async () => {
|
|
181
|
-
keyPair = await fips_crypto_service_1.FipsCryptoService.generateKeyPair();
|
|
182
|
-
}, 60000);
|
|
183
|
-
(0, vitest_1.afterAll)(() => {
|
|
184
|
-
(0, fips_crypto_service_1.unwrapPublicKey)(keyPair.publicKey).release();
|
|
185
|
-
});
|
|
186
|
-
(0, vitest_1.test)('should round-trip RSA encrypt/decrypt', async () => {
|
|
187
|
-
const plaintext = new Uint8Array([10, 20, 30, 40, 50]);
|
|
188
|
-
const encrypted = await fips_crypto_service_1.FipsCryptoService.encryptWithPublicKey(singlecontainer_1.Binary.fromArrayBuffer(plaintext.buffer), keyPair.publicKey);
|
|
189
|
-
const decrypted = await fips_crypto_service_1.FipsCryptoService.decryptWithPrivateKey(encrypted, keyPair.privateKey);
|
|
190
|
-
(0, vitest_1.expect)(new Uint8Array(decrypted.asArrayBuffer())).toEqual(plaintext);
|
|
191
|
-
});
|
|
192
|
-
(0, vitest_1.test)('should produce different ciphertext each call (RSA-OAEP is randomized)', async () => {
|
|
193
|
-
const payload = singlecontainer_1.Binary.fromArrayBuffer(new Uint8Array([1, 2, 3]).buffer);
|
|
194
|
-
const enc1 = await fips_crypto_service_1.FipsCryptoService.encryptWithPublicKey(payload, keyPair.publicKey);
|
|
195
|
-
const enc2 = await fips_crypto_service_1.FipsCryptoService.encryptWithPublicKey(payload, keyPair.publicKey);
|
|
196
|
-
(0, vitest_1.expect)(new Uint8Array(enc1.asArrayBuffer())).not.toEqual(new Uint8Array(enc2.asArrayBuffer()));
|
|
197
|
-
});
|
|
198
|
-
(0, vitest_1.test)('signing key pair (RSASSA-PKCS1-v1_5) should not be usable for encryption', async () => {
|
|
199
|
-
// Catches algorithm mismatch: if generateSigningKeyPair() incorrectly used
|
|
200
|
-
// RSA-OAEP params, encryption would succeed here instead of throwing.
|
|
201
|
-
const signingKp = await fips_crypto_service_1.FipsCryptoService.generateSigningKeyPair();
|
|
202
|
-
await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.encryptWithPublicKey(singlecontainer_1.Binary.fromArrayBuffer(new Uint8Array([1, 2, 3]).buffer), signingKp.publicKey)).rejects.toThrow();
|
|
203
|
-
(0, fips_crypto_service_1.unwrapPublicKey)(signingKp.publicKey).release();
|
|
204
|
-
(0, fips_crypto_service_1.unwrapPrivateKey)(signingKp.privateKey).release();
|
|
205
|
-
});
|
|
206
|
-
});
|
|
207
|
-
(0, vitest_1.describe)('importPrivateKey and exportPrivateKeyPem', () => {
|
|
208
|
-
let privKey;
|
|
209
|
-
(0, vitest_1.beforeAll)(async () => {
|
|
210
|
-
const kp = await globalThis.crypto.subtle.generateKey({
|
|
211
|
-
name: 'RSASSA-PKCS1-v1_5',
|
|
212
|
-
modulusLength: 2048,
|
|
213
|
-
publicExponent: new Uint8Array([1, 0, 1]),
|
|
214
|
-
hash: 'SHA-256',
|
|
215
|
-
}, true, ['sign', 'verify']);
|
|
216
|
-
const pkcs8 = await globalThis.crypto.subtle.exportKey('pkcs8', kp.privateKey);
|
|
217
|
-
const b64 = btoa(String.fromCharCode(...new Uint8Array(pkcs8)));
|
|
218
|
-
const pem = `-----BEGIN PRIVATE KEY-----\n${b64
|
|
219
|
-
.match(/.{1,64}/g)
|
|
220
|
-
.join('\n')}\n-----END PRIVATE KEY-----`;
|
|
221
|
-
privKey = await (0, fips_crypto_service_1.importPrivateKey)(pem, {
|
|
222
|
-
usage: 'sign',
|
|
223
|
-
extractable: true,
|
|
224
|
-
});
|
|
225
|
-
}, 60000);
|
|
226
|
-
(0, vitest_1.afterAll)(() => {
|
|
227
|
-
(0, fips_crypto_service_1.unwrapPrivateKey)(privKey).release();
|
|
228
|
-
});
|
|
229
|
-
(0, vitest_1.test)('should import PKCS#8 PEM private key', () => {
|
|
230
|
-
(0, vitest_1.expect)(privKey.algorithm).toBe('rsa:2048');
|
|
231
|
-
});
|
|
232
|
-
(0, vitest_1.test)('should export imported private key back to PEM', async () => {
|
|
233
|
-
const exported = await (0, fips_crypto_service_1.exportPrivateKeyPem)(privKey);
|
|
234
|
-
(0, vitest_1.expect)(exported).toContain('-----BEGIN PRIVATE KEY-----');
|
|
235
|
-
(0, vitest_1.expect)(exported).toContain('-----END PRIVATE KEY-----');
|
|
236
|
-
});
|
|
237
|
-
});
|
|
238
|
-
(0, vitest_1.describe)('splitSymmetricKey and mergeSymmetricKeys', () => {
|
|
239
|
-
(0, vitest_1.test)('splitSymmetricKey with 1 share returns the same key (single-KAS identity)', async () => {
|
|
240
|
-
const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
|
|
241
|
-
const shares = await fips_crypto_service_1.FipsCryptoService.splitSymmetricKey(key, 1);
|
|
242
|
-
(0, vitest_1.expect)(shares).toHaveLength(1);
|
|
243
|
-
(0, vitest_1.expect)(shares[0]).toBe(key);
|
|
244
|
-
});
|
|
245
|
-
(0, vitest_1.test)('mergeSymmetricKeys with 1 share returns the same key (single-KAS identity)', async () => {
|
|
246
|
-
const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
|
|
247
|
-
const merged = await fips_crypto_service_1.FipsCryptoService.mergeSymmetricKeys([key]);
|
|
248
|
-
(0, vitest_1.expect)(merged).toBe(key);
|
|
249
|
-
});
|
|
250
|
-
(0, vitest_1.test)('splitSymmetricKey with 2 shares throws (multi-KAS not yet supported)', async () => {
|
|
251
|
-
const key = await fips_crypto_service_1.FipsCryptoService.generateKey();
|
|
252
|
-
await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.splitSymmetricKey(key, 2)).rejects.toThrow('not yet supported in FIPS mode');
|
|
253
|
-
});
|
|
254
|
-
(0, vitest_1.test)('mergeSymmetricKeys with 2 shares throws (multi-KAS not yet supported)', async () => {
|
|
255
|
-
const key1 = await fips_crypto_service_1.FipsCryptoService.generateKey();
|
|
256
|
-
const key2 = await fips_crypto_service_1.FipsCryptoService.generateKey();
|
|
257
|
-
await (0, vitest_1.expect)(fips_crypto_service_1.FipsCryptoService.mergeSymmetricKeys([key1, key2])).rejects.toThrow('not yet supported in FIPS mode');
|
|
258
|
-
});
|
|
259
|
-
});
|
|
260
|
-
});
|
|
@@ -1,17 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
/*
|
|
3
|
-
* Copyright (c) Virtru Corporation. All rights reserved.
|
|
4
|
-
*
|
|
5
|
-
* Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
|
|
6
|
-
*/
|
|
7
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
8
|
-
exports.mockCreateExportArtifactsResponse = void 0;
|
|
9
|
-
const policy_import_export_pb_1 = require("@src/gen/policyimportexport/v1/policy_import_export_pb");
|
|
10
|
-
const mockCreateExportArtifactsResponse = () => ({
|
|
11
|
-
$typeName: 'policyimportexport.v1.CreateExportArtifactsResponse',
|
|
12
|
-
artifact: {
|
|
13
|
-
case: undefined,
|
|
14
|
-
value: undefined,
|
|
15
|
-
},
|
|
16
|
-
});
|
|
17
|
-
exports.mockCreateExportArtifactsResponse = mockCreateExportArtifactsResponse;
|
|
@@ -1,15 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
/*
|
|
3
|
-
* Copyright (c) Virtru Corporation. All rights reserved.
|
|
4
|
-
*
|
|
5
|
-
* Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
|
|
6
|
-
*/
|
|
7
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
8
|
-
exports.mockTaggingPDPResponse = void 0;
|
|
9
|
-
const tagging_pb_1 = require("@src/gen/tagging/pdp/v2/tagging_pb");
|
|
10
|
-
const mockTaggingPDPResponse = () => ({
|
|
11
|
-
$typeName: 'tagging.pdp.v2.TaggingPDPResponse',
|
|
12
|
-
events: [],
|
|
13
|
-
tags: [],
|
|
14
|
-
});
|
|
15
|
-
exports.mockTaggingPDPResponse = mockTaggingPDPResponse;
|
|
@@ -1,16 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
/*
|
|
3
|
-
* Copyright (c) Virtru Corporation. All rights reserved.
|
|
4
|
-
*
|
|
5
|
-
* Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
|
|
6
|
-
*/
|
|
7
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
8
|
-
exports.mockWellKnownConfiguration = void 0;
|
|
9
|
-
const wellknown_configuration_pb_js_1 = require("@opentdf/sdk/platform/wellknownconfiguration/wellknown_configuration_pb.js");
|
|
10
|
-
const mockWellKnownConfiguration = () => ({
|
|
11
|
-
$typeName: 'wellknownconfiguration.GetWellKnownConfigurationResponse',
|
|
12
|
-
configuration: {
|
|
13
|
-
wellKnown: {},
|
|
14
|
-
},
|
|
15
|
-
});
|
|
16
|
-
exports.mockWellKnownConfiguration = mockWellKnownConfiguration;
|
|
@@ -1,33 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
/*
|
|
3
|
-
* Copyright (c) Virtru Corporation. All rights reserved.
|
|
4
|
-
*
|
|
5
|
-
* Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
|
|
6
|
-
*/
|
|
7
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
8
|
-
exports.setupMSW = setupMSW;
|
|
9
|
-
const browser_1 = require("msw/browser");
|
|
10
|
-
const vitest_1 = require("vitest");
|
|
11
|
-
const msw_1 = require("msw");
|
|
12
|
-
let worker;
|
|
13
|
-
/**
|
|
14
|
-
* Sets up the MSW (Mock Service Worker) for testing.
|
|
15
|
-
*
|
|
16
|
-
* @param handlers - An array of HTTP handlers to be used with MSW.
|
|
17
|
-
* @returns The MSW worker instance.
|
|
18
|
-
*/
|
|
19
|
-
function setupMSW(handlers) {
|
|
20
|
-
if (!worker) {
|
|
21
|
-
worker = (0, browser_1.setupWorker)(...handlers);
|
|
22
|
-
(0, vitest_1.beforeAll)(async () => {
|
|
23
|
-
await worker.start();
|
|
24
|
-
});
|
|
25
|
-
(0, vitest_1.afterEach)(() => worker.resetHandlers());
|
|
26
|
-
(0, vitest_1.afterAll)(() => worker.stop());
|
|
27
|
-
}
|
|
28
|
-
else {
|
|
29
|
-
// If worker already exists, just update handlers
|
|
30
|
-
worker.resetHandlers(...handlers);
|
|
31
|
-
}
|
|
32
|
-
return worker;
|
|
33
|
-
}
|
|
@@ -1,72 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
/*
|
|
3
|
-
* Copyright (c) Virtru Corporation. All rights reserved.
|
|
4
|
-
*
|
|
5
|
-
* Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
|
|
6
|
-
*/
|
|
7
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
8
|
-
const buffer_1 = require("buffer");
|
|
9
|
-
const promises_1 = require("node:fs/promises");
|
|
10
|
-
const node_path_1 = require("node:path");
|
|
11
|
-
const node_util_1 = require("node:util");
|
|
12
|
-
globalThis.Buffer = buffer_1.Buffer;
|
|
13
|
-
if (!globalThis.TextEncoder) {
|
|
14
|
-
globalThis.TextEncoder = node_util_1.TextEncoder;
|
|
15
|
-
}
|
|
16
|
-
if (!globalThis.TextDecoder) {
|
|
17
|
-
globalThis.TextDecoder = node_util_1.TextDecoder;
|
|
18
|
-
}
|
|
19
|
-
if (typeof window !== 'undefined' && !window.Module) {
|
|
20
|
-
window.Module = {};
|
|
21
|
-
}
|
|
22
|
-
// Prefer the copied local WASM artifact used by package scripts.
|
|
23
|
-
const copiedWasmFilePath = node_path_1.default.resolve(process.cwd(), 'public/virtru.wasm');
|
|
24
|
-
// Fallback for direct local runs when copy-wasm has not been executed.
|
|
25
|
-
const sourceWasmFilePath = node_path_1.default.resolve(process.cwd(), '../fips-crypto-js/src/utils/virtru.wasm');
|
|
26
|
-
let resolvedWasmFilePath = copiedWasmFilePath;
|
|
27
|
-
try {
|
|
28
|
-
await (0, promises_1.access)(copiedWasmFilePath);
|
|
29
|
-
}
|
|
30
|
-
catch {
|
|
31
|
-
resolvedWasmFilePath = sourceWasmFilePath;
|
|
32
|
-
}
|
|
33
|
-
const originalFetch = globalThis.fetch;
|
|
34
|
-
globalThis.fetch = async function (input, init) {
|
|
35
|
-
const url = typeof input === 'string'
|
|
36
|
-
? input
|
|
37
|
-
: input instanceof URL
|
|
38
|
-
? input.href
|
|
39
|
-
: input.url;
|
|
40
|
-
if (url && url.includes('virtru.wasm')) {
|
|
41
|
-
const wasmBytes = await (0, promises_1.readFile)(resolvedWasmFilePath);
|
|
42
|
-
return new Response(wasmBytes, {
|
|
43
|
-
status: 200,
|
|
44
|
-
headers: {
|
|
45
|
-
'content-type': 'application/wasm',
|
|
46
|
-
},
|
|
47
|
-
});
|
|
48
|
-
}
|
|
49
|
-
return originalFetch(input, init);
|
|
50
|
-
};
|
|
51
|
-
await Promise.resolve().then(() => require('@virtru-private/fips-crypto-js'));
|
|
52
|
-
const isFipsReady = (candidate) => {
|
|
53
|
-
return (!!candidate &&
|
|
54
|
-
typeof candidate === 'object' &&
|
|
55
|
-
'isInitialized' in candidate &&
|
|
56
|
-
candidate.isInitialized === true &&
|
|
57
|
-
'generateKey' in candidate &&
|
|
58
|
-
typeof candidate.generateKey === 'function');
|
|
59
|
-
};
|
|
60
|
-
if (!isFipsReady(window.VirtruFipsWasmLib)) {
|
|
61
|
-
await new Promise((resolve, reject) => {
|
|
62
|
-
const timeout = setTimeout(() => reject(new Error('Timeout waiting for VirtruCrypto WASM initialization in unit setup.')), 10000);
|
|
63
|
-
const onReady = () => {
|
|
64
|
-
clearTimeout(timeout);
|
|
65
|
-
resolve();
|
|
66
|
-
};
|
|
67
|
-
window.addEventListener('wasmReady', onReady, { once: true });
|
|
68
|
-
});
|
|
69
|
-
}
|
|
70
|
-
if (!isFipsReady(window.VirtruFipsWasmLib)) {
|
|
71
|
-
throw new Error('VirtruCrypto was loaded but not initialized in unit setup.');
|
|
72
|
-
}
|
package/public/virtru.wasm
DELETED
|
Binary file
|