@webda/core 4.0.0-beta.6 → 4.0.0-beta.7

package/lib/services/pki.encrypter.d.ts

@@ -0,0 +1,214 @@
+import { KeyObject } from "crypto";
+import type { EncrypterContext, StringEncrypter } from "./cryptoservice.service.js";
+/**
+ * Options of the `pki` encrypter, in `parameters.configurationEncryption.encrypters.pki`
+ */
+export interface PkiEncrypterOptions {
+    /**
+     * Key id used to encrypt new values
+     *
+     * Its public key must be available: `<publicKeys>/<activeKey>.pub.pem`
+     */
+    activeKey?: string;
+    /**
+     * Directory of the public keys, relative to the application: `<kid>.pub.pem`
+     *
+     * Commit it with the application, any developer or CI job can then encrypt a value.
+     *
+     * @default ".webda/keys"
+     */
+    publicKeys?: string;
+    /**
+     * Directory of the private keys at runtime, a Kubernetes Secret mount for example: `<kid>.pem` or `<kid>`
+     *
+     * @default env WEBDA_PKI_PRIVATE_KEYS_DIR, then "/etc/webda/pki"
+     */
+    privateKeys?: string;
+}
+/**
+ * Version of the `pki` encrypted format
+ */
+export declare const PKI_FORMAT_V1 = "v1";
+/**
+ * Default directory of the public keys, relative to the application
+ */
+export declare const PKI_DEFAULT_PUBLIC_KEYS = ".webda/keys";
+/**
+ * Default directory of the private keys
+ */
+export declare const PKI_DEFAULT_PRIVATE_KEYS = "/etc/webda/pki";
+/**
+ * Environment variable overriding the private keys directory
+ */
+export declare const PKI_PRIVATE_KEYS_DIR_ENV = "WEBDA_PKI_PRIVATE_KEYS_DIR";
+/**
+ * Environment variable prefix holding one private key PEM: `WEBDA_PKI_PRIVATE_KEY_<KID>`
+ */
+export declare const PKI_PRIVATE_KEY_ENV_PREFIX = "WEBDA_PKI_PRIVATE_KEY_";
+/**
+ * Environment variable holding the passphrase of the private keys
+ */
+export declare const PKI_PASSPHRASE_ENV = "WEBDA_PKI_PASSPHRASE";
+/**
+ * Minimum RSA modulus length
+ */
+export declare const PKI_MIN_BITS = 3072;
+/**
+ * Check a key id
+ * @param kid - the key id
+ * @returns the key id
+ */
+export declare function checkKid(kid: string): string;
+/**
+ * Name of the environment variable holding the private key of a kid
+ * @param kid - the key id
+ * @returns the variable name
+ */
+export declare function getPrivateKeyEnv(kid: string): string;
+/**
+ * Parsed `pki` encrypted value
+ */
+export interface PkiValue {
+    kid: string;
+    wrappedKey: string;
+    ciphertext: string;
+}
+/**
+ * Parse a `v1:<kid>:<wrappedKey>:<ciphertext>` value
+ * @param data - the encrypted value, without `crypt:pki:`
+ * @returns the parts
+ */
+export declare function parsePkiValue(data: string): PkiValue;
+/**
+ * Public and private keys of the `pki` encrypter
+ *
+ * The keys are loaded lazily and cached by kid.
+ */
+export declare class PkiKeyring {
+    /**
+     * Key id used to encrypt
+     */
+    readonly activeKey?: string;
+    /**
+     * Absolute directory of the public keys
+     */
+    readonly publicKeysDir: string;
+    /**
+     * Absolute directory of the private keys
+     */
+    readonly privateKeysDir: string;
+    protected publicKeys: Map<string, KeyObject>;
+    protected privateKeys: Map<string, KeyObject>;
+    /**
+     * @param options - the encrypter options
+     * @param appPath - the application path, relative directories resolve against it
+     */
+    constructor(options?: PkiEncrypterOptions, appPath?: string);
+    /**
+     * List the kids of a directory
+     * @param dir - the directory
+     * @param suffix - the file suffix
+     * @param optionalSuffix - also accept files without the suffix
+     * @returns the sorted kids
+     */
+    protected static listDir(dir: string, suffix: string, optionalSuffix: boolean): string[];
+    /**
+     * List the kids having a public key
+     * @returns the kids
+     */
+    listKids(): string[];
+    /**
+     * List the kids having a private key file
+     * @returns the kids
+     */
+    listPrivateKids(): string[];
+    /**
+     * Get the public key of a kid
+     *
+     * From `<publicKeys>/<kid>.pub.pem`, or derived from its private key when it is available
+     *
+     * @param kid - the key id
+     * @returns the public key
+     */
+    getPublicKey(kid: string): KeyObject;
+    /**
+     * Find the source of a private key
+     * @param kid - the key id
+     * @returns the environment variable or file name, undefined if not found
+     */
+    protected findPrivateKey(kid: string): {
+        env?: string;
+        file?: string;
+    } | undefined;
+    /**
+     * Check if the private key of a kid is available
+     * @param kid - the key id
+     * @returns true if available
+     */
+    hasPrivateKey(kid: string): boolean;
+    /**
+     * Get the private key of a kid
+     *
+     * From `WEBDA_PKI_PRIVATE_KEY_<KID>`, then `<privateKeys>/<kid>.pem` or `<privateKeys>/<kid>`.
+     * The passphrase, if any, is read from `WEBDA_PKI_PASSPHRASE`.
+     *
+     * @param kid - the key id
+     * @returns the private key
+     */
+    getPrivateKey(kid: string): KeyObject;
+}
+/**
+ * Asymmetric encrypter: hybrid RSA-OAEP-256 + AES-256-GCM
+ *
+ * The public keys are committed with the application, so anyone can encrypt a value. The private keys only live
+ * in the runtime (a Kubernetes Secret mount or environment variables), so only the application can decrypt.
+ *
+ * Format: `v1:<kid>:<base64(wrappedKey)>:<base64(iv | tag | ciphertext)>`, the kid is authenticated.
+ */
+export declare class PkiEncrypter implements StringEncrypter {
+    protected keyring: PkiKeyring;
+    /**
+     * Serialized configuration of the keyring, to keep its cache when unchanged
+     */
+    protected configuration: string;
+    /**
+     * Configure the keyring
+     * @param options - the encrypter options
+     * @param context - the encryption context
+     */
+    configure(options?: PkiEncrypterOptions, context?: EncrypterContext): void;
+    /**
+     * Get the keyring, with the default options when not configured
+     * @returns the keyring
+     */
+    getKeyring(): PkiKeyring;
+    /**
+     * Additional authenticated data binding the format and the kid
+     * @param kid - the key id
+     * @returns the AAD
+     */
+    protected static aad(kid: string): Uint8Array;
+    /**
+     * Encrypt with the public key of the active key
+     * @param data - the plain value
+     * @returns the encrypted value
+     */
+    encrypt(data: string): Promise<string>;
+    /**
+     * Decrypt with the private key of the value kid
+     * @param data - the encrypted value
+     * @returns the plain value
+     */
+    decrypt(data: string): Promise<string>;
+    /**
+     * A value needs an upgrade when it was not encrypted with the active key
+     * @param data - the encrypted value
+     * @returns true to re-encrypt it
+     */
+    needsUpgrade(data: string): boolean;
+}
+/**
+ * The `pki` encrypter instance, registered by CryptoService
+ */
+export declare const pkiEncrypter: PkiEncrypter;
+//# sourceMappingURL=pki.encrypter.d.ts.map

package/lib/services/pki.encrypter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki.encrypter.d.ts","sourceRoot":"","sources":["../../src/services/pki.encrypter.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,SAAS,EAIV,MAAM,QAAQ,CAAC;AAKhB,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAEpF;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC;;GAEG;AACH,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AACrD;;GAEG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AACzD;;GAEG;AACH,eAAO,MAAM,wBAAwB,+BAA+B,CAAC;AACrE;;GAEG;AACH,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE;;GAEG;AACH,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AACzD;;GAEG;AACH,eAAO,MAAM,YAAY,OAAO,CAAC;AAMjC;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAkBD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAMpD;AAED;;;;GAIG;AACH,qBAAa,UAAU;IACrB;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,UAAU,yBAAgC;IACpD,SAAS,CAAC,WAAW,yBAAgC;IAErD;;;OAGG;IACH,YAAY,OAAO,GAAE,mBAAwB,EAAE,OAAO,GAAE,MAAsB,EAS7E;IAED;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,GAAG,MAAM,EAAE,CAqBvF;IAED;;;OAGG;IACH,QAAQ,IAAI,MAAM,EAAE,CAEnB;IAED;;;OAGG;IACH,eAAe,IAAI,MAAM,EAAE,CAE1B;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAmBnC;IAED;;;;OAIG;IACH,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAWjF;IAED;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAElC;IAED;;;;;;;;OAQG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAwBpC;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC;IAC9B;;OAEG;IACH,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;IAEhC;;;;OAIG;IACH,SAAS,CAAC,OAAO,GAAE,mBAAwB,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAQ7E;IAED;;;OAGG;IACH,UAAU,IAAI,UAAU,CAKvB;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAE5C;IAED;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc3C;IAED;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkB3C;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOlC;CACF;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/lib/services/pki.encrypter.js

@@ -0,0 +1,350 @@
+import { constants, createPrivateKey, createPublicKey, privateDecrypt, publicEncrypt, randomBytes } from "crypto";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { AuthenticatedEncryption } from "./authenticatedencryption.js";
+/**
+ * Version of the `pki` encrypted format
+ */
+export const PKI_FORMAT_V1 = "v1";
+/**
+ * Default directory of the public keys, relative to the application
+ */
+export const PKI_DEFAULT_PUBLIC_KEYS = ".webda/keys";
+/**
+ * Default directory of the private keys
+ */
+export const PKI_DEFAULT_PRIVATE_KEYS = "/etc/webda/pki";
+/**
+ * Environment variable overriding the private keys directory
+ */
+export const PKI_PRIVATE_KEYS_DIR_ENV = "WEBDA_PKI_PRIVATE_KEYS_DIR";
+/**
+ * Environment variable prefix holding one private key PEM: `WEBDA_PKI_PRIVATE_KEY_<KID>`
+ */
+export const PKI_PRIVATE_KEY_ENV_PREFIX = "WEBDA_PKI_PRIVATE_KEY_";
+/**
+ * Environment variable holding the passphrase of the private keys
+ */
+export const PKI_PASSPHRASE_ENV = "WEBDA_PKI_PASSPHRASE";
+/**
+ * Minimum RSA modulus length
+ */
+export const PKI_MIN_BITS = 3072;
+/**
+ * Valid key id
+ */
+const KID = /^[A-Za-z0-9_.-]+$/;
+/**
+ * Check a key id
+ * @param kid - the key id
+ * @returns the key id
+ */
+export function checkKid(kid) {
+    if (typeof kid !== "string" || !KID.test(kid)) {
+        throw new Error(`Invalid key id '${kid}', use letters, digits, '_', '-' and '.' only`);
+    }
+    return kid;
+}
+/**
+ * Name of the environment variable holding the private key of a kid
+ * @param kid - the key id
+ * @returns the variable name
+ */
+export function getPrivateKeyEnv(kid) {
+    return PKI_PRIVATE_KEY_ENV_PREFIX + kid.toUpperCase().replace(/[-.]/g, "_");
+}
+/**
+ * Check that a key can be used by the `pki` encrypter
+ * @param key - the key
+ * @param kid - the key id, for the message
+ * @returns the key
+ */
+function checkKey(key, kid) {
+    if (key.asymmetricKeyType !== "rsa") {
+        throw new Error(`Key '${kid}' is not an RSA key (${key.asymmetricKeyType})`);
+    }
+    if ((key.asymmetricKeyDetails?.modulusLength ?? 0) < PKI_MIN_BITS) {
+        throw new Error(`Key '${kid}' is too small, RSA ${PKI_MIN_BITS} bits at least is required`);
+    }
+    return key;
+}
+/**
+ * Parse a `v1:<kid>:<wrappedKey>:<ciphertext>` value
+ * @param data - the encrypted value, without `crypt:pki:`
+ * @returns the parts
+ */
+export function parsePkiValue(data) {
+    const parts = typeof data === "string" ? data.split(":") : [];
+    if (parts.length !== 4 || parts[0] !== PKI_FORMAT_V1 || !KID.test(parts[1])) {
+        throw new Error("Invalid pki encrypted data");
+    }
+    return { kid: parts[1], wrappedKey: parts[2], ciphertext: parts[3] };
+}
+/**
+ * Public and private keys of the `pki` encrypter
+ *
+ * The keys are loaded lazily and cached by kid.
+ */
+export class PkiKeyring {
+    /**
+     * Key id used to encrypt
+     */
+    activeKey;
+    /**
+     * Absolute directory of the public keys
+     */
+    publicKeysDir;
+    /**
+     * Absolute directory of the private keys
+     */
+    privateKeysDir;
+    publicKeys = new Map();
+    privateKeys = new Map();
+    /**
+     * @param options - the encrypter options
+     * @param appPath - the application path, relative directories resolve against it
+     */
+    constructor(options = {}, appPath = process.cwd()) {
+        if (options.activeKey !== undefined) {
+            this.activeKey = checkKid(options.activeKey);
+        }
+        this.publicKeysDir = resolve(appPath, options.publicKeys ?? PKI_DEFAULT_PUBLIC_KEYS);
+        this.privateKeysDir = resolve(appPath, options.privateKeys ?? process.env[PKI_PRIVATE_KEYS_DIR_ENV] ?? PKI_DEFAULT_PRIVATE_KEYS);
+    }
+    /**
+     * List the kids of a directory
+     * @param dir - the directory
+     * @param suffix - the file suffix
+     * @param optionalSuffix - also accept files without the suffix
+     * @returns the sorted kids
+     */
+    static listDir(dir, suffix, optionalSuffix) {
+        if (!existsSync(dir)) {
+            return [];
+        }
+        const kids = new Set();
+        for (const file of readdirSync(dir)) {
+            // Kubernetes Secret mounts hold `..data` and `..<timestamp>` entries
+            if (file.startsWith(".") || !statSync(join(dir, file)).isFile()) {
+                continue;
+            }
+            let kid;
+            if (file.endsWith(suffix)) {
+                kid = file.substring(0, file.length - suffix.length);
+            }
+            else if (optionalSuffix && !file.includes(".pem")) {
+                kid = file;
+            }
+            if (kid && KID.test(kid)) {
+                kids.add(kid);
+            }
+        }
+        return [...kids].sort();
+    }
+    /**
+     * List the kids having a public key
+     * @returns the kids
+     */
+    listKids() {
+        return PkiKeyring.listDir(this.publicKeysDir, ".pub.pem", false);
+    }
+    /**
+     * List the kids having a private key file
+     * @returns the kids
+     */
+    listPrivateKids() {
+        return PkiKeyring.listDir(this.privateKeysDir, ".pem", true);
+    }
+    /**
+     * Get the public key of a kid
+     *
+     * From `<publicKeys>/<kid>.pub.pem`, or derived from its private key when it is available
+     *
+     * @param kid - the key id
+     * @returns the public key
+     */
+    getPublicKey(kid) {
+        checkKid(kid);
+        if (!this.publicKeys.has(kid)) {
+            const file = join(this.publicKeysDir, `${kid}.pub.pem`);
+            let key;
+            if (existsSync(file)) {
+                try {
+                    key = createPublicKey(readFileSync(file));
+                }
+                catch (err) {
+                    throw new Error(`Cannot load public key '${kid}' from ${file}: ${err.message}`);
+                }
+            }
+            else if (this.hasPrivateKey(kid)) {
+                key = createPublicKey(this.getPrivateKey(kid));
+            }
+            else {
+                throw new Error(`No public key for active key '${kid}' in ${this.publicKeysDir}`);
+            }
+            this.publicKeys.set(kid, checkKey(key, kid));
+        }
+        return this.publicKeys.get(kid);
+    }
+    /**
+     * Find the source of a private key
+     * @param kid - the key id
+     * @returns the environment variable or file name, undefined if not found
+     */
+    findPrivateKey(kid) {
+        const env = getPrivateKeyEnv(kid);
+        if (process.env[env]) {
+            return { env };
+        }
+        for (const file of [join(this.privateKeysDir, `${kid}.pem`), join(this.privateKeysDir, kid)]) {
+            if (existsSync(file) && statSync(file).isFile()) {
+                return { file };
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Check if the private key of a kid is available
+     * @param kid - the key id
+     * @returns true if available
+     */
+    hasPrivateKey(kid) {
+        return this.privateKeys.has(kid) || this.findPrivateKey(kid) !== undefined;
+    }
+    /**
+     * Get the private key of a kid
+     *
+     * From `WEBDA_PKI_PRIVATE_KEY_<KID>`, then `<privateKeys>/<kid>.pem` or `<privateKeys>/<kid>`.
+     * The passphrase, if any, is read from `WEBDA_PKI_PASSPHRASE`.
+     *
+     * @param kid - the key id
+     * @returns the private key
+     */
+    getPrivateKey(kid) {
+        checkKid(kid);
+        if (!this.privateKeys.has(kid)) {
+            const source = this.findPrivateKey(kid);
+            if (!source) {
+                const available = this.listPrivateKids();
+                throw new Error(`No private key for kid '${kid}' (available: ${available.length ? available.join(", ") : "none"} in ${this.privateKeysDir})`);
+            }
+            const origin = source.env ?? source.file;
+            let key;
+            try {
+                key = createPrivateKey({
+                    key: source.env ? process.env[source.env] : readFileSync(source.file),
+                    passphrase: process.env[PKI_PASSPHRASE_ENV]
+                });
+            }
+            catch (err) {
+                // The error never contains the key material
+                throw new Error(`Cannot load private key '${kid}' from ${origin}: ${err.message}`);
+            }
+            this.privateKeys.set(kid, checkKey(key, kid));
+        }
+        return this.privateKeys.get(kid);
+    }
+}
+/**
+ * Asymmetric encrypter: hybrid RSA-OAEP-256 + AES-256-GCM
+ *
+ * The public keys are committed with the application, so anyone can encrypt a value. The private keys only live
+ * in the runtime (a Kubernetes Secret mount or environment variables), so only the application can decrypt.
+ *
+ * Format: `v1:<kid>:<base64(wrappedKey)>:<base64(iv | tag | ciphertext)>`, the kid is authenticated.
+ */
+export class PkiEncrypter {
+    keyring;
+    /**
+     * Serialized configuration of the keyring, to keep its cache when unchanged
+     */
+    configuration;
+    /**
+     * Configure the keyring
+     * @param options - the encrypter options
+     * @param context - the encryption context
+     */
+    configure(options = {}, context) {
+        const appPath = context?.appPath ?? process.cwd();
+        const configuration = JSON.stringify([options, appPath, process.env[PKI_PRIVATE_KEYS_DIR_ENV]]);
+        if (this.keyring && configuration === this.configuration) {
+            return;
+        }
+        this.keyring = new PkiKeyring(options, appPath);
+        this.configuration = configuration;
+    }
+    /**
+     * Get the keyring, with the default options when not configured
+     * @returns the keyring
+     */
+    getKeyring() {
+        if (!this.keyring) {
+            this.configure();
+        }
+        return this.keyring;
+    }
+    /**
+     * Additional authenticated data binding the format and the kid
+     * @param kid - the key id
+     * @returns the AAD
+     */
+    static aad(kid) {
+        return new Uint8Array(Buffer.from(`${PKI_FORMAT_V1}:${kid}`));
+    }
+    /**
+     * Encrypt with the public key of the active key
+     * @param data - the plain value
+     * @returns the encrypted value
+     */
+    async encrypt(data) {
+        const keyring = this.getKeyring();
+        const kid = keyring.activeKey;
+        if (!kid) {
+            throw new Error("No active key, set parameters.configurationEncryption.encrypters.pki.activeKey");
+        }
+        const publicKey = keyring.getPublicKey(kid);
+        const dataKey = new Uint8Array(randomBytes(32));
+        const ciphertext = AuthenticatedEncryption.encrypt(dataKey, data, PkiEncrypter.aad(kid));
+        const wrappedKey = publicEncrypt({ key: publicKey, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" }, dataKey).toString("base64");
+        return `${PKI_FORMAT_V1}:${kid}:${wrappedKey}:${ciphertext}`;
+    }
+    /**
+     * Decrypt with the private key of the value kid
+     * @param data - the encrypted value
+     * @returns the plain value
+     */
+    async decrypt(data) {
+        const { kid, wrappedKey, ciphertext } = parsePkiValue(data);
+        const privateKey = this.getKeyring().getPrivateKey(kid);
+        let dataKey;
+        try {
+            dataKey = new Uint8Array(privateDecrypt({ key: privateKey, padding: constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" }, new Uint8Array(Buffer.from(wrappedKey, "base64"))));
+        }
+        catch {
+            throw new Error("Wrong key or altered data");
+        }
+        if (dataKey.length !== 32) {
+            throw new Error("Wrong key or altered data");
+        }
+        return AuthenticatedEncryption.decrypt(dataKey, ciphertext, PkiEncrypter.aad(kid));
+    }
+    /**
+     * A value needs an upgrade when it was not encrypted with the active key
+     * @param data - the encrypted value
+     * @returns true to re-encrypt it
+     */
+    needsUpgrade(data) {
+        const activeKey = this.getKeyring().activeKey;
+        try {
+            return activeKey !== undefined && parsePkiValue(data).kid !== activeKey;
+        }
+        catch {
+            return true;
+        }
+    }
+}
+/**
+ * The `pki` encrypter instance, registered by CryptoService
+ */
+export const pkiEncrypter = new PkiEncrypter();
+//# sourceMappingURL=pki.encrypter.js.map

package/lib/services/pki.encrypter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pki.encrypter.js","sourceRoot":"","sources":["../../src/services/pki.encrypter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,eAAe,EAEf,cAAc,EACd,aAAa,EACb,WAAW,EACZ,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AA6BvE;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAClC;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AACrD;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;AACzD;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AACrE;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AACnE;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AACzD;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC;;GAEG;AACH,MAAM,GAAG,GAAG,mBAAmB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,+CAA+C,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,0BAA0B,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAc,EAAE,GAAW;IAC3C,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,wBAAwB,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,aAAa,IAAI,CAAC,CAAC,GAAG,YAAY,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,uBAAuB,YAAY,4BAA4B,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAU;IACrB;;OAEG;IACM,SAAS,CAAU;IAC5B;;OAEG;IACM,aAAa,CAAS;IAC/B;;OAEG;IACM,cAAc,CAAS;IACtB,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,WAAW,GAAG,IAAI,GAAG,EAAqB,CAAC;IAErD;;;OAGG;IACH,YAAY,OAAO,GAAwB,EAAE,EAAE,OAAO,GAAW,OAAO,CAAC,GAAG,EAAE;QAC5E,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,uBAAuB,CAAC,CAAC;QACrF,IAAI,CAAC,cAAc,GAAG,OAAO,CAC3B,OAAO,EACP,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,wBAAwB,CACzF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACO,MAAM,CAAC,OAAO,CAAC,GAAW,EAAE,MAAc,EAAE,cAAuB;QAC3E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,qEAAqE;YACrE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,IAAI,GAAW,CAAC;YAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,GAAG,GAAG,IAAI,CAAC;YACb,CAAC;YACD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CAAC,GAAW;QACtB,QAAQ,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;YACxD,IAAI,GAAc,CAAC;YACnB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,UAAU,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACO,cAAc,CAAC,GAAW;QAClC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC7F,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAChD,OAAO,EAAE,IAAI,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IAC7E,CAAC;IAED;;;;;;;;OAQG;IACH,aAAa,CAAC,GAAW;QACvB,QAAQ,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,iBAAiB,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,IAAI,CAAC,cAAc,GAAG,CAC7H,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC;YACzC,IAAI,GAAc,CAAC;YACnB,IAAI,CAAC;gBACH,GAAG,GAAG,gBAAgB,CAAC;oBACrB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;oBACrE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;iBAC5C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4CAA4C;gBAC5C,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,UAAU,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,YAAY;IACb,OAAO,CAAa;IAC9B;;OAEG;IACO,aAAa,CAAS;IAEhC;;;;OAIG;IACH,SAAS,CAAC,OAAO,GAAwB,EAAE,EAAE,OAA0B;QACrE,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,OAAO,IAAI,aAAa,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YACzD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACO,MAAM,CAAC,GAAG,CAAC,GAAW;QAC9B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,aAAa,CAC9B,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACjF,OAAO,CACR,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,GAAG,aAAa,IAAI,GAAG,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,UAAU,CACtB,cAAc,CACZ,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAClF,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAClD,CACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,uBAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,IAAY;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,SAAS,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC"}