@virtru/dsp-sdk 0.5.0 → 0.7.0

package/dist/tests/fips-crypto.unit.test.js

@@ -1,258 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-import { expect, test, beforeAll, afterAll, describe } from 'vitest';
-import { Binary, } from '@opentdf/sdk/singlecontainer';
-import { FipsCryptoService, unwrapPublicKey, unwrapPrivateKey, importPrivateKey, exportPrivateKeyPem, } from '../src/lib/fips-crypto-service';
-describe('FIPS CryptoService - Methods', () => {
-    // RSA key slots are finite in the WASM keystore. Each describe group that
-    // uses RSA keys creates ONE shared key pair in beforeAll and releases it in
-    // afterAll so slots are reclaimed before the next group starts.
-    describe('sign and verify (asymmetric)', () => {
-        let keyPair;
-        beforeAll(async () => {
-            keyPair = await FipsCryptoService.generateSigningKeyPair();
-        }, 60000);
-        afterAll(() => {
-            unwrapPublicKey(keyPair.publicKey).release();
-        });
-        test('should sign and verify with RS256', async () => {
-            const data = new Uint8Array([1, 2, 3, 4, 5]);
-            const signature = await FipsCryptoService.sign(data, keyPair.privateKey, 'RS256');
-            const isValid = await FipsCryptoService.verify(data, signature, keyPair.publicKey, 'RS256');
-            expect(isValid).toBe(true);
-        });
-        test('should reject tampered data', async () => {
-            const data = new Uint8Array([1, 2, 3, 4, 5]);
-            const signature = await FipsCryptoService.sign(data, keyPair.privateKey, 'RS256');
-            const tamperedData = new Uint8Array([1, 2, 3, 4, 6]);
-            const isValid = await FipsCryptoService.verify(tamperedData, signature, keyPair.publicKey, 'RS256');
-            expect(isValid).toBe(false);
-        });
-        test('should throw error for ES256 (EC not supported)', async () => {
-            await expect(FipsCryptoService.sign(new Uint8Array([1, 2, 3, 4]), keyPair.privateKey, 'ES256')).rejects.toThrow('not supported in FIPS mode');
-        });
-        test('encryption key pair (RSA-OAEP) should not be usable for signing', async () => {
-            // Catches algorithm mismatch: if generateKeyPair() incorrectly used
-            // RSASSA-PKCS1-v1_5 params, signing would succeed here instead of throwing.
-            const encKeyPair = await FipsCryptoService.generateKeyPair();
-            await expect(FipsCryptoService.sign(new Uint8Array([1, 2, 3]), encKeyPair.privateKey, 'RS256')).rejects.toThrow();
-            unwrapPublicKey(encKeyPair.publicKey).release();
-            unwrapPrivateKey(encKeyPair.privateKey).release();
-        });
-    });
-    describe('hmac and verifyHmac', () => {
-        test('should compute and verify HMAC-SHA256', async () => {
-            const crypto = FipsCryptoService;
-            const keyBytes = await crypto.randomBytes(32);
-            const symKey = await crypto.importSymmetricKey(keyBytes);
-            const data = new Uint8Array([1, 2, 3, 4, 5]);
-            const signature = await crypto.hmac(data, symKey);
-            const isValid = await crypto.verifyHmac(data, signature, symKey);
-            expect(isValid).toBe(true);
-        });
-        test('should reject invalid signature', async () => {
-            const crypto = FipsCryptoService;
-            const symKey = await crypto.generateKey(32);
-            const data = new Uint8Array([1, 2, 3, 4]);
-            const signature = await crypto.hmac(data, symKey);
-            signature[0] ^= 1; // Flip a bit
-            const isValid = await crypto.verifyHmac(data, signature, symKey);
-            expect(isValid).toBe(false);
-        });
-        test('should reject signature with wrong key', async () => {
-            const crypto = FipsCryptoService;
-            const symKey1 = await crypto.importSymmetricKey(await crypto.randomBytes(32));
-            const symKey2 = await crypto.importSymmetricKey(await crypto.randomBytes(32));
-            const data = new Uint8Array([1, 2, 3, 4]);
-            const signature = await crypto.hmac(data, symKey1);
-            const isValid = await crypto.verifyHmac(data, signature, symKey2);
-            expect(isValid).toBe(false);
-        });
-    });
-    describe('digest', () => {
-        test('should compute SHA-256 hash', async () => {
-            const data = new Uint8Array([1, 2, 3, 4]);
-            const hash = await FipsCryptoService.digest('SHA-256', data);
-            expect(hash).toBeInstanceOf(Uint8Array);
-            expect(hash.byteLength).toBe(32);
-        });
-        test('should produce consistent hashes', async () => {
-            const data = new Uint8Array([1, 2, 3, 4]);
-            const hash1 = await FipsCryptoService.digest('SHA-256', data);
-            const hash2 = await FipsCryptoService.digest('SHA-256', data);
-            expect(hash1).toEqual(hash2);
-        });
-        test('should throw error for SHA-384 (not supported)', async () => {
-            await expect(FipsCryptoService.digest('SHA-384', new Uint8Array([1, 2, 3, 4]))).rejects.toThrow('not supported in FIPS mode');
-        });
-    });
-    describe('EC placeholder methods', () => {
-        test('should throw error for generateECKeyPair', async () => {
-            await expect(FipsCryptoService.generateECKeyPair()).rejects.toThrow('not supported in FIPS mode');
-        });
-        test('should throw error for deriveKeyFromECDH', async () => {
-            await expect(FipsCryptoService.deriveKeyFromECDH({}, {}, {
-                hash: 'SHA-256',
-                salt: new Uint8Array(),
-            })).rejects.toThrow('not supported in FIPS mode');
-        });
-    });
-    describe('exportPublicKeyPem', () => {
-        let keyPair;
-        beforeAll(async () => {
-            keyPair = await FipsCryptoService.generateKeyPair();
-        }, 60000);
-        afterAll(() => {
-            unwrapPublicKey(keyPair.publicKey).release();
-        });
-        test('should export generated public key to PEM', async () => {
-            const pem = await FipsCryptoService.exportPublicKeyPem(keyPair.publicKey);
-            expect(pem).toContain('-----BEGIN PUBLIC KEY-----');
-            expect(pem).toContain('-----END PUBLIC KEY-----');
-        });
-    });
-    describe('importPublicKey', () => {
-        let keyPair;
-        let importedKey;
-        beforeAll(async () => {
-            const crypto = FipsCryptoService;
-            keyPair = await crypto.generateKeyPair(2048);
-            const pem = await crypto.exportPublicKeyPem(keyPair.publicKey);
-            importedKey = await crypto.importPublicKey(pem, { usage: 'encrypt' });
-        }, 60000);
-        afterAll(() => {
-            unwrapPublicKey(keyPair.publicKey).release();
-            unwrapPublicKey(importedKey).release();
-        });
-        test('should import PEM and detect RSA-2048', () => {
-            expect(importedKey.algorithm).toBe('rsa:2048');
-        });
-    });
-    describe('exportPublicKeyJwk', () => {
-        let keyPair;
-        beforeAll(async () => {
-            keyPair = await FipsCryptoService.generateKeyPair(2048);
-        }, 60000);
-        afterAll(() => {
-            unwrapPublicKey(keyPair.publicKey).release();
-        });
-        test('should export public key to JWK', async () => {
-            const jwk = await FipsCryptoService.exportPublicKeyJwk(keyPair.publicKey);
-            expect(jwk.kty).toBe('RSA');
-            expect(jwk.n).toBeDefined();
-            expect(jwk.e).toBeDefined();
-            expect(typeof jwk.n).toBe('string');
-            expect(typeof jwk.e).toBe('string');
-        });
-        test('should produce a JWK that round-trips back to SPKI', async () => {
-            const jwk = await FipsCryptoService.exportPublicKeyJwk(keyPair.publicKey);
-            const webKey = await globalThis.crypto.subtle.importKey('jwk', jwk, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, true, ['verify']);
-            const spki = await globalThis.crypto.subtle.exportKey('spki', webKey);
-            expect(spki.byteLength).toBeGreaterThan(0);
-        });
-    });
-    describe('encrypt and decrypt (symmetric AES-GCM)', () => {
-        test('should round-trip encrypt/decrypt', async () => {
-            const key = await FipsCryptoService.generateKey();
-            const iv = Binary.fromArrayBuffer((await FipsCryptoService.randomBytes(12)).buffer);
-            const plaintext = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
-            const { payload: cipher, authTag } = await FipsCryptoService.encrypt(Binary.fromArrayBuffer(plaintext.buffer), key, iv);
-            const { payload: recovered } = await FipsCryptoService.decrypt(cipher, key, iv, undefined, authTag);
-            expect(new Uint8Array(recovered.asArrayBuffer())).toEqual(plaintext);
-        });
-        test('should produce different ciphertext for different IVs', async () => {
-            const key = await FipsCryptoService.generateKey();
-            const plaintext = Binary.fromArrayBuffer(new Uint8Array([1, 2, 3, 4]).buffer);
-            const iv1 = Binary.fromArrayBuffer((await FipsCryptoService.randomBytes(12)).buffer);
-            const iv2 = Binary.fromArrayBuffer((await FipsCryptoService.randomBytes(12)).buffer);
-            const { payload: cipher1 } = await FipsCryptoService.encrypt(plaintext, key, iv1);
-            const { payload: cipher2 } = await FipsCryptoService.encrypt(plaintext, key, iv2);
-            expect(new Uint8Array(cipher1.asArrayBuffer())).not.toEqual(new Uint8Array(cipher2.asArrayBuffer()));
-        });
-    });
-    describe('encryptWithPublicKey and decryptWithPrivateKey (RSA-OAEP)', () => {
-        let keyPair;
-        beforeAll(async () => {
-            keyPair = await FipsCryptoService.generateKeyPair();
-        }, 60000);
-        afterAll(() => {
-            unwrapPublicKey(keyPair.publicKey).release();
-        });
-        test('should round-trip RSA encrypt/decrypt', async () => {
-            const plaintext = new Uint8Array([10, 20, 30, 40, 50]);
-            const encrypted = await FipsCryptoService.encryptWithPublicKey(Binary.fromArrayBuffer(plaintext.buffer), keyPair.publicKey);
-            const decrypted = await FipsCryptoService.decryptWithPrivateKey(encrypted, keyPair.privateKey);
-            expect(new Uint8Array(decrypted.asArrayBuffer())).toEqual(plaintext);
-        });
-        test('should produce different ciphertext each call (RSA-OAEP is randomized)', async () => {
-            const payload = Binary.fromArrayBuffer(new Uint8Array([1, 2, 3]).buffer);
-            const enc1 = await FipsCryptoService.encryptWithPublicKey(payload, keyPair.publicKey);
-            const enc2 = await FipsCryptoService.encryptWithPublicKey(payload, keyPair.publicKey);
-            expect(new Uint8Array(enc1.asArrayBuffer())).not.toEqual(new Uint8Array(enc2.asArrayBuffer()));
-        });
-        test('signing key pair (RSASSA-PKCS1-v1_5) should not be usable for encryption', async () => {
-            // Catches algorithm mismatch: if generateSigningKeyPair() incorrectly used
-            // RSA-OAEP params, encryption would succeed here instead of throwing.
-            const signingKp = await FipsCryptoService.generateSigningKeyPair();
-            await expect(FipsCryptoService.encryptWithPublicKey(Binary.fromArrayBuffer(new Uint8Array([1, 2, 3]).buffer), signingKp.publicKey)).rejects.toThrow();
-            unwrapPublicKey(signingKp.publicKey).release();
-            unwrapPrivateKey(signingKp.privateKey).release();
-        });
-    });
-    describe('importPrivateKey and exportPrivateKeyPem', () => {
-        let privKey;
-        beforeAll(async () => {
-            const kp = await globalThis.crypto.subtle.generateKey({
-                name: 'RSASSA-PKCS1-v1_5',
-                modulusLength: 2048,
-                publicExponent: new Uint8Array([1, 0, 1]),
-                hash: 'SHA-256',
-            }, true, ['sign', 'verify']);
-            const pkcs8 = await globalThis.crypto.subtle.exportKey('pkcs8', kp.privateKey);
-            const b64 = btoa(String.fromCharCode(...new Uint8Array(pkcs8)));
-            const pem = `-----BEGIN PRIVATE KEY-----\n${b64
-                .match(/.{1,64}/g)
-                .join('\n')}\n-----END PRIVATE KEY-----`;
-            privKey = await importPrivateKey(pem, {
-                usage: 'sign',
-                extractable: true,
-            });
-        }, 60000);
-        afterAll(() => {
-            unwrapPrivateKey(privKey).release();
-        });
-        test('should import PKCS#8 PEM private key', () => {
-            expect(privKey.algorithm).toBe('rsa:2048');
-        });
-        test('should export imported private key back to PEM', async () => {
-            const exported = await exportPrivateKeyPem(privKey);
-            expect(exported).toContain('-----BEGIN PRIVATE KEY-----');
-            expect(exported).toContain('-----END PRIVATE KEY-----');
-        });
-    });
-    describe('splitSymmetricKey and mergeSymmetricKeys', () => {
-        test('splitSymmetricKey with 1 share returns the same key (single-KAS identity)', async () => {
-            const key = await FipsCryptoService.generateKey();
-            const shares = await FipsCryptoService.splitSymmetricKey(key, 1);
-            expect(shares).toHaveLength(1);
-            expect(shares[0]).toBe(key);
-        });
-        test('mergeSymmetricKeys with 1 share returns the same key (single-KAS identity)', async () => {
-            const key = await FipsCryptoService.generateKey();
-            const merged = await FipsCryptoService.mergeSymmetricKeys([key]);
-            expect(merged).toBe(key);
-        });
-        test('splitSymmetricKey with 2 shares throws (multi-KAS not yet supported)', async () => {
-            const key = await FipsCryptoService.generateKey();
-            await expect(FipsCryptoService.splitSymmetricKey(key, 2)).rejects.toThrow('not yet supported in FIPS mode');
-        });
-        test('mergeSymmetricKeys with 2 shares throws (multi-KAS not yet supported)', async () => {
-            const key1 = await FipsCryptoService.generateKey();
-            const key2 = await FipsCryptoService.generateKey();
-            await expect(FipsCryptoService.mergeSymmetricKeys([key1, key2])).rejects.toThrow('not yet supported in FIPS mode');
-        });
-    });
-});

package/dist/tests/mocks/create-export-artifacts.d.ts

@@ -1,2 +0,0 @@
-import { type CreateExportArtifactsResponse } from '@src/gen/policyimportexport/v1/policy_import_export_pb';
-export declare const mockCreateExportArtifactsResponse: () => CreateExportArtifactsResponse;

package/dist/tests/mocks/create-export-artifacts.js

@@ -1,13 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-import {} from '@src/gen/policyimportexport/v1/policy_import_export_pb';
-export const mockCreateExportArtifactsResponse = () => ({
-    $typeName: 'policyimportexport.v1.CreateExportArtifactsResponse',
-    artifact: {
-        case: undefined,
-        value: undefined,
-    },
-});

package/dist/tests/mocks/tagging-pdp-tag.d.ts

@@ -1,2 +0,0 @@
-import { type TaggingPDPResponse } from '@src/gen/tagging/pdp/v2/tagging_pb';
-export declare const mockTaggingPDPResponse: () => TaggingPDPResponse;

package/dist/tests/mocks/tagging-pdp-tag.js

@@ -1,11 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-import {} from '@src/gen/tagging/pdp/v2/tagging_pb';
-export const mockTaggingPDPResponse = () => ({
-    $typeName: 'tagging.pdp.v2.TaggingPDPResponse',
-    events: [],
-    tags: [],
-});

package/dist/tests/mocks/well-known-configuration.d.ts

@@ -1,2 +0,0 @@
-import { type GetWellKnownConfigurationResponse } from '@opentdf/sdk/platform/wellknownconfiguration/wellknown_configuration_pb.js';
-export declare const mockWellKnownConfiguration: () => GetWellKnownConfigurationResponse;

package/dist/tests/mocks/well-known-configuration.js

@@ -1,12 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-import {} from '@opentdf/sdk/platform/wellknownconfiguration/wellknown_configuration_pb.js';
-export const mockWellKnownConfiguration = () => ({
-    $typeName: 'wellknownconfiguration.GetWellKnownConfigurationResponse',
-    configuration: {
-        wellKnown: {},
-    },
-});

package/dist/tests/setup-msw.d.ts

@@ -1,9 +0,0 @@
-import { type SetupWorker } from 'msw/browser';
-import { HttpHandler } from 'msw';
-/**
- * Sets up the MSW (Mock Service Worker) for testing.
- *
- * @param handlers - An array of HTTP handlers to be used with MSW.
- * @returns The MSW worker instance.
- */
-export declare function setupMSW(handlers: HttpHandler[]): SetupWorker | undefined;

package/dist/tests/setup-msw.js

@@ -1,30 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-import { setupWorker } from 'msw/browser';
-import { beforeAll, afterEach, afterAll } from 'vitest';
-import { HttpHandler } from 'msw';
-let worker;
-/**
- * Sets up the MSW (Mock Service Worker) for testing.
- *
- * @param handlers - An array of HTTP handlers to be used with MSW.
- * @returns The MSW worker instance.
- */
-export function setupMSW(handlers) {
-    if (!worker) {
-        worker = setupWorker(...handlers);
-        beforeAll(async () => {
-            await worker.start();
-        });
-        afterEach(() => worker.resetHandlers());
-        afterAll(() => worker.stop());
-    }
-    else {
-        // If worker already exists, just update handlers
-        worker.resetHandlers(...handlers);
-    }
-    return worker;
-}

package/dist/tests/setup-unit.d.ts

@@ -1,7 +0,0 @@
-declare global {
-    interface Window {
-        Module: unknown;
-        VirtruFipsWasmLib?: unknown;
-    }
-}
-export {};

package/dist/tests/setup-unit.js

@@ -1,70 +0,0 @@
-/*
- * Copyright (c) Virtru Corporation.  All rights reserved.
- *
- * Your use of this file is governed by the Virtu Terms of Service <https://www.virtru.com/terms-of-service/>.
- */
-import { Buffer } from 'buffer';
-import { access, readFile } from 'node:fs/promises';
-import path from 'node:path';
-import { TextEncoder, TextDecoder } from 'node:util';
-globalThis.Buffer = Buffer;
-if (!globalThis.TextEncoder) {
-    globalThis.TextEncoder = TextEncoder;
-}
-if (!globalThis.TextDecoder) {
-    globalThis.TextDecoder = TextDecoder;
-}
-if (typeof window !== 'undefined' && !window.Module) {
-    window.Module = {};
-}
-// Prefer the copied local WASM artifact used by package scripts.
-const copiedWasmFilePath = path.resolve(process.cwd(), 'public/virtru.wasm');
-// Fallback for direct local runs when copy-wasm has not been executed.
-const sourceWasmFilePath = path.resolve(process.cwd(), '../fips-crypto-js/src/utils/virtru.wasm');
-let resolvedWasmFilePath = copiedWasmFilePath;
-try {
-    await access(copiedWasmFilePath);
-}
-catch {
-    resolvedWasmFilePath = sourceWasmFilePath;
-}
-const originalFetch = globalThis.fetch;
-globalThis.fetch = async function (input, init) {
-    const url = typeof input === 'string'
-        ? input
-        : input instanceof URL
-            ? input.href
-            : input.url;
-    if (url && url.includes('virtru.wasm')) {
-        const wasmBytes = await readFile(resolvedWasmFilePath);
-        return new Response(wasmBytes, {
-            status: 200,
-            headers: {
-                'content-type': 'application/wasm',
-            },
-        });
-    }
-    return originalFetch(input, init);
-};
-await import('@virtru-private/fips-crypto-js');
-const isFipsReady = (candidate) => {
-    return (!!candidate &&
-        typeof candidate === 'object' &&
-        'isInitialized' in candidate &&
-        candidate.isInitialized === true &&
-        'generateKey' in candidate &&
-        typeof candidate.generateKey === 'function');
-};
-if (!isFipsReady(window.VirtruFipsWasmLib)) {
-    await new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => reject(new Error('Timeout waiting for VirtruCrypto WASM initialization in unit setup.')), 10000);
-        const onReady = () => {
-            clearTimeout(timeout);
-            resolve();
-        };
-        window.addEventListener('wasmReady', onReady, { once: true });
-    });
-}
-if (!isFipsReady(window.VirtruFipsWasmLib)) {
-    throw new Error('VirtruCrypto was loaded but not initialized in unit setup.');
-}

package/eslint.config.mjs

@@ -1,28 +0,0 @@
-import js from '@eslint/js';
-import globals from 'globals';
-import tseslint from 'typescript-eslint';
-import { defineConfig } from 'eslint/config';
-import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
-
-export default defineConfig(
-  [
-    tseslint.configs.recommended,
-    eslintPluginPrettierRecommended,
-    {
-      files: ['**/*.{js,mjs,cjs,ts,mts,cts}'],
-      plugins: { js, tseslint },
-    },
-    {
-      files: ['**/*.{js,mjs,cjs,ts,mts,cts}'],
-      languageOptions: { globals: globals.browser },
-    },
-  ],
-  {
-    ignores: ['dist/**'],
-  },
-  {
-    linterOptions: {
-      reportUnusedDisableDirectives: 'off',
-    },
-  }
-);