@wireapp/core-crypto 0.6.0-rc.3 → 0.6.0-rc.5
Sign up to get free protection for your applications and to get access to all the features.
package/README.md
CHANGED
|
@@ -114,7 +114,7 @@ cargo make wasm
|
|
|
114
114
|
|
|
115
115
|
### Android / JVM
|
|
116
116
|
|
|
117
|
-
You can publish the JVM and Android bindings to maven using gradle after you'
|
|
117
|
+
You can publish the JVM and Android bindings to maven using gradle after you've built the corresponding target.
|
|
118
118
|
|
|
119
119
|
```ignore
|
|
120
120
|
cd kotlin
|
package/package.json
CHANGED
|
@@ -1,63 +1,63 @@
|
|
|
1
1
|
{
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
}
|
|
2
|
+
"name": "@wireapp/core-crypto",
|
|
3
|
+
"version": "0.6.0-rc.5",
|
|
4
|
+
"description": "CoreCrypto bindings for the Web",
|
|
5
|
+
"type": "module",
|
|
6
|
+
"module": "platforms/web/corecrypto.js",
|
|
7
|
+
"types": "platforms/web/corecrypto.d.js",
|
|
8
|
+
"scripts": {
|
|
9
|
+
"prepare": "npm run build",
|
|
10
|
+
"build": "npm run clean && rollup -c crypto-ffi/bindings/js/rollup.config.js",
|
|
11
|
+
"build:test": "npm run clean && rollup -c crypto-ffi/bindings/js/rollup.config.test.js",
|
|
12
|
+
"clean": "rm -f ./platforms/web/*.{js,ts,wasm,html} && rm -rf ./platforms/web/assets",
|
|
13
|
+
"package": "npm run build && npm pack",
|
|
14
|
+
"test:raw": "jest -c crypto-ffi/bindings/js/jest.config.js --no-cache --runInBand --verbose",
|
|
15
|
+
"test": "npm run build:test && npm run test:raw",
|
|
16
|
+
"test:cov": "npm run build:test && jest -c crypto-ffi/bindings/js/jest.config.js --coverage --no-cache --runInBand --verbose"
|
|
17
|
+
},
|
|
18
|
+
"publishConfig": {
|
|
19
|
+
"access": "public"
|
|
20
|
+
},
|
|
21
|
+
"files": [
|
|
22
|
+
"platforms/web"
|
|
23
|
+
],
|
|
24
|
+
"keywords": [
|
|
25
|
+
"wire",
|
|
26
|
+
"e2ee",
|
|
27
|
+
"corecrypto",
|
|
28
|
+
"mls",
|
|
29
|
+
"proteus"
|
|
30
|
+
],
|
|
31
|
+
"author": "Mathieu Amiot <amiot.mathieu@gmail.com>",
|
|
32
|
+
"license": "GPL-3.0",
|
|
33
|
+
"homepage": "https://github.com/wireapp/core-crypto",
|
|
34
|
+
"repository": {
|
|
35
|
+
"type": "git",
|
|
36
|
+
"url": "git@github.com:wireapp/core-crypto.git"
|
|
37
|
+
},
|
|
38
|
+
"bugs": {
|
|
39
|
+
"url": "https://github.com/wireapp/core-crypto/issues"
|
|
40
|
+
},
|
|
41
|
+
"devDependencies": {
|
|
42
|
+
"@rollup/plugin-html": "^0.2.4",
|
|
43
|
+
"@types/jest": "^29.0.1",
|
|
44
|
+
"@types/jest-dev-server": "^5.0.0",
|
|
45
|
+
"@typescript-eslint/eslint-plugin": "^5.36.2",
|
|
46
|
+
"@typescript-eslint/parser": "^5.36.2",
|
|
47
|
+
"@wasm-tool/rollup-plugin-rust": "^2.3.1",
|
|
48
|
+
"dts-bundle-generator": "^6.13.0",
|
|
49
|
+
"eslint": "^8.23.1",
|
|
50
|
+
"eslint-config-prettier": "^8.5.0",
|
|
51
|
+
"eslint-plugin-prettier": "^4.2.1",
|
|
52
|
+
"jest": "^29.0.3",
|
|
53
|
+
"jest-dev-server": "^6.1.1",
|
|
54
|
+
"prettier": "^2.7.1",
|
|
55
|
+
"puppeteer": "^17.1.3",
|
|
56
|
+
"rollup": "^2.79.0",
|
|
57
|
+
"rollup-jest": "^3.0.0",
|
|
58
|
+
"rollup-plugin-ts": "^3.0.2",
|
|
59
|
+
"ts-jest": "^29.0.0",
|
|
60
|
+
"ts-loader": "^9.3.1",
|
|
61
|
+
"typescript": "^4.8.3"
|
|
62
|
+
}
|
|
63
|
+
}
|
|
Binary file
|
|
@@ -1,34 +1,155 @@
|
|
|
1
|
+
declare class WireE2eIdentity {
|
|
2
|
+
free(): void;
|
|
3
|
+
/**
|
|
4
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::directory_response]
|
|
5
|
+
* @param {Uint8Array} directory
|
|
6
|
+
* @returns {any}
|
|
7
|
+
*/
|
|
8
|
+
directory_response(directory: Uint8Array): any;
|
|
9
|
+
/**
|
|
10
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::new_account_request]
|
|
11
|
+
* @param {any} directory
|
|
12
|
+
* @param {string} previous_nonce
|
|
13
|
+
* @returns {Uint8Array}
|
|
14
|
+
*/
|
|
15
|
+
new_account_request(directory: any, previous_nonce: string): Uint8Array;
|
|
16
|
+
/**
|
|
17
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::new_account_response]
|
|
18
|
+
* @param {Uint8Array} account
|
|
19
|
+
* @returns {Uint8Array}
|
|
20
|
+
*/
|
|
21
|
+
new_account_response(account: Uint8Array): Uint8Array;
|
|
22
|
+
/**
|
|
23
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::new_order_request]
|
|
24
|
+
* @param {string} handle
|
|
25
|
+
* @param {string} client_id
|
|
26
|
+
* @param {number} expiry_days
|
|
27
|
+
* @param {any} directory
|
|
28
|
+
* @param {Uint8Array} account
|
|
29
|
+
* @param {string} previous_nonce
|
|
30
|
+
* @returns {Uint8Array}
|
|
31
|
+
*/
|
|
32
|
+
new_order_request(handle: string, client_id: string, expiry_days: number, directory: any, account: Uint8Array, previous_nonce: string): Uint8Array;
|
|
33
|
+
/**
|
|
34
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::new_order_response]
|
|
35
|
+
* @param {Uint8Array} order
|
|
36
|
+
* @returns {any}
|
|
37
|
+
*/
|
|
38
|
+
new_order_response(order: Uint8Array): any;
|
|
39
|
+
/**
|
|
40
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::new_authz_request]
|
|
41
|
+
* @param {string} url
|
|
42
|
+
* @param {Uint8Array} account
|
|
43
|
+
* @param {string} previous_nonce
|
|
44
|
+
* @returns {Uint8Array}
|
|
45
|
+
*/
|
|
46
|
+
new_authz_request(url: string, account: Uint8Array, previous_nonce: string): Uint8Array;
|
|
47
|
+
/**
|
|
48
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::new_authz_response]
|
|
49
|
+
* @param {Uint8Array} authz
|
|
50
|
+
* @returns {any}
|
|
51
|
+
*/
|
|
52
|
+
new_authz_response(authz: Uint8Array): any;
|
|
53
|
+
/**
|
|
54
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::create_dpop_token]
|
|
55
|
+
* @param {string} access_token_url
|
|
56
|
+
* @param {string} user_id
|
|
57
|
+
* @param {bigint} client_id
|
|
58
|
+
* @param {string} domain
|
|
59
|
+
* @param {any} client_id_challenge
|
|
60
|
+
* @param {string} backend_nonce
|
|
61
|
+
* @param {number} expiry_days
|
|
62
|
+
* @returns {string}
|
|
63
|
+
*/
|
|
64
|
+
create_dpop_token(access_token_url: string, user_id: string, client_id: bigint, domain: string, client_id_challenge: any, backend_nonce: string, expiry_days: number): string;
|
|
65
|
+
/**
|
|
66
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::new_challenge_request]
|
|
67
|
+
* @param {any} handle_challenge
|
|
68
|
+
* @param {Uint8Array} account
|
|
69
|
+
* @param {string} previous_nonce
|
|
70
|
+
* @returns {Uint8Array}
|
|
71
|
+
*/
|
|
72
|
+
new_challenge_request(handle_challenge: any, account: Uint8Array, previous_nonce: string): Uint8Array;
|
|
73
|
+
/**
|
|
74
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::new_challenge_response]
|
|
75
|
+
* @param {Uint8Array} challenge
|
|
76
|
+
*/
|
|
77
|
+
new_challenge_response(challenge: Uint8Array): void;
|
|
78
|
+
/**
|
|
79
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::check_order_request]
|
|
80
|
+
* @param {string} order_url
|
|
81
|
+
* @param {Uint8Array} account
|
|
82
|
+
* @param {string} previous_nonce
|
|
83
|
+
* @returns {Uint8Array}
|
|
84
|
+
*/
|
|
85
|
+
check_order_request(order_url: string, account: Uint8Array, previous_nonce: string): Uint8Array;
|
|
86
|
+
/**
|
|
87
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::check_order_response]
|
|
88
|
+
* @param {Uint8Array} order
|
|
89
|
+
* @returns {Uint8Array}
|
|
90
|
+
*/
|
|
91
|
+
check_order_response(order: Uint8Array): Uint8Array;
|
|
92
|
+
/**
|
|
93
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::finalize_request]
|
|
94
|
+
* @param {(Uint8Array)[]} domains
|
|
95
|
+
* @param {Uint8Array} order
|
|
96
|
+
* @param {Uint8Array} account
|
|
97
|
+
* @param {string} previous_nonce
|
|
98
|
+
* @returns {Uint8Array}
|
|
99
|
+
*/
|
|
100
|
+
finalize_request(domains: (Uint8Array)[], order: Uint8Array, account: Uint8Array, previous_nonce: string): Uint8Array;
|
|
101
|
+
/**
|
|
102
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::finalize_response]
|
|
103
|
+
* @param {Uint8Array} finalize
|
|
104
|
+
* @returns {any}
|
|
105
|
+
*/
|
|
106
|
+
finalize_response(finalize: Uint8Array): any;
|
|
107
|
+
/**
|
|
108
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::certificate_request]
|
|
109
|
+
* @param {any} finalize
|
|
110
|
+
* @param {Uint8Array} account
|
|
111
|
+
* @param {string} previous_nonce
|
|
112
|
+
* @returns {Uint8Array}
|
|
113
|
+
*/
|
|
114
|
+
certificate_request(finalize: any, account: Uint8Array, previous_nonce: string): Uint8Array;
|
|
115
|
+
/**
|
|
116
|
+
* See [core_crypto::e2e_identity::WireE2eIdentity::certificate_response]
|
|
117
|
+
* @param {string} certificate_chain
|
|
118
|
+
* @returns {(Uint8Array)[]}
|
|
119
|
+
*/
|
|
120
|
+
certificate_response(certificate_chain: string): (Uint8Array)[];
|
|
121
|
+
}
|
|
1
122
|
/**
|
|
2
|
-
* see [core_crypto::prelude::CiphersuiteName]
|
|
3
|
-
*/
|
|
123
|
+
* see [core_crypto::prelude::CiphersuiteName]
|
|
124
|
+
*/
|
|
4
125
|
export declare enum Ciphersuite {
|
|
5
126
|
/**
|
|
6
|
-
|
|
7
|
-
|
|
127
|
+
* DH KEM x25519 | AES-GCM 128 | SHA2-256 | Ed25519
|
|
128
|
+
*/
|
|
8
129
|
MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519 = 1,
|
|
9
130
|
/**
|
|
10
|
-
|
|
11
|
-
|
|
131
|
+
* DH KEM P256 | AES-GCM 128 | SHA2-256 | EcDSA P256
|
|
132
|
+
*/
|
|
12
133
|
MLS_128_DHKEMP256_AES128GCM_SHA256_P256 = 2,
|
|
13
134
|
/**
|
|
14
|
-
|
|
15
|
-
|
|
135
|
+
* DH KEM x25519 | Chacha20Poly1305 | SHA2-256 | Ed25519
|
|
136
|
+
*/
|
|
16
137
|
MLS_128_DHKEMX25519_CHACHA20POLY1305_SHA256_Ed25519 = 3,
|
|
17
138
|
/**
|
|
18
|
-
|
|
19
|
-
|
|
139
|
+
* DH KEM x448 | AES-GCM 256 | SHA2-512 | Ed448
|
|
140
|
+
*/
|
|
20
141
|
MLS_256_DHKEMX448_AES256GCM_SHA512_Ed448 = 4,
|
|
21
142
|
/**
|
|
22
|
-
|
|
23
|
-
|
|
143
|
+
* DH KEM P521 | AES-GCM 256 | SHA2-512 | EcDSA P521
|
|
144
|
+
*/
|
|
24
145
|
MLS_256_DHKEMP521_AES256GCM_SHA512_P521 = 5,
|
|
25
146
|
/**
|
|
26
|
-
|
|
27
|
-
|
|
147
|
+
* DH KEM x448 | Chacha20Poly1305 | SHA2-512 | Ed448
|
|
148
|
+
*/
|
|
28
149
|
MLS_256_DHKEMX448_CHACHA20POLY1305_SHA512_Ed448 = 6,
|
|
29
150
|
/**
|
|
30
|
-
|
|
31
|
-
|
|
151
|
+
* DH KEM P384 | AES-GCM 256 | SHA2-384 | EcDSA P384
|
|
152
|
+
*/
|
|
32
153
|
MLS_256_DHKEMP384_AES256GCM_SHA384_P384 = 7
|
|
33
154
|
}
|
|
34
155
|
/**
|
|
@@ -401,10 +522,11 @@ export interface CoreCryptoCallbacks {
|
|
|
401
522
|
* Callback to ensure that the given `clientId` belongs to one of the provided `existingClients`
|
|
402
523
|
* This basically allows to defer the client ID parsing logic to the caller - because CoreCrypto is oblivious to such things
|
|
403
524
|
*
|
|
525
|
+
* @param conversationId - id of the group/conversation
|
|
404
526
|
* @param clientId - id of a client
|
|
405
527
|
* @param existingClients - all the clients currently within the MLS group
|
|
406
528
|
*/
|
|
407
|
-
clientIsExistingGroupUser: (clientId: Uint8Array, existingClients: Uint8Array[]) => boolean;
|
|
529
|
+
clientIsExistingGroupUser: (conversationId: Uint8Array, clientId: Uint8Array, existingClients: Uint8Array[]) => boolean;
|
|
408
530
|
}
|
|
409
531
|
/**
|
|
410
532
|
* Wrapper for the WASM-compiled version of CoreCrypto
|
|
@@ -689,7 +811,7 @@ export declare class CoreCrypto {
|
|
|
689
811
|
* **CAUTION**: only use this when you had an explicit response from the Delivery Service
|
|
690
812
|
* e.g. 403. Do not use otherwise e.g. 5xx responses, timeout etc..
|
|
691
813
|
* **DO NOT** use when Delivery Service responds 409, pending state will be renewed
|
|
692
|
-
* in {@link CoreCrypto.
|
|
814
|
+
* in {@link CoreCrypto.decryptMessage}
|
|
693
815
|
*
|
|
694
816
|
* @param conversationId - The group's ID
|
|
695
817
|
*/
|
|
@@ -834,7 +956,7 @@ export declare class CoreCrypto {
|
|
|
834
956
|
*
|
|
835
957
|
* @param prekey - the prekey bundle to get the fingerprint from
|
|
836
958
|
* @returns Hex-encoded public key string
|
|
837
|
-
|
|
959
|
+
**/
|
|
838
960
|
static proteusFingerprintPrekeybundle(prekey: Uint8Array): string;
|
|
839
961
|
/**
|
|
840
962
|
* Imports all the data stored by Cryptobox into the CoreCrypto keystore
|
|
@@ -842,6 +964,15 @@ export declare class CoreCrypto {
|
|
|
842
964
|
* @param storeName - The name of the IndexedDB store where the data is stored
|
|
843
965
|
*/
|
|
844
966
|
proteusCryptoboxMigrate(storeName: string): Promise<void>;
|
|
967
|
+
/**
|
|
968
|
+
* Creates an enrollment instance with private key material you can use in order to fetch
|
|
969
|
+
* a new x509 certificate from the acme server.
|
|
970
|
+
* Make sure to call [WireE2eIdentity::free] (not yet available) to dispose this instance and its associated
|
|
971
|
+
* keying material.
|
|
972
|
+
*
|
|
973
|
+
* @param ciphersuite - For generating signing key material. Only {@link Ciphersuite.MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519} is supported currently
|
|
974
|
+
*/
|
|
975
|
+
newAcmeEnrollment(): Promise<WireE2eIdentity>;
|
|
845
976
|
/**
|
|
846
977
|
* Returns the current version of {@link CoreCrypto}
|
|
847
978
|
*
|
|
@@ -849,5 +980,261 @@ export declare class CoreCrypto {
|
|
|
849
980
|
*/
|
|
850
981
|
static version(): string;
|
|
851
982
|
}
|
|
983
|
+
type JsonRawData = Uint8Array;
|
|
984
|
+
type AcmeAccount = Uint8Array;
|
|
985
|
+
type AcmeOrder = Uint8Array;
|
|
986
|
+
export declare class WireE2eIdentity {
|
|
987
|
+
#private;
|
|
988
|
+
/** @hidden */
|
|
989
|
+
constructor(e2ei: CoreCryptoFfiTypes.WireE2eIdentity, module: typeof CoreCryptoFfiTypes);
|
|
990
|
+
/**
|
|
991
|
+
* Parses the response from `GET /acme/{provisioner-name}/directory`.
|
|
992
|
+
* Use this {@link AcmeDirectory} in the next step to fetch the first nonce from the acme server. Use
|
|
993
|
+
* {@link AcmeDirectory.newNonce}.
|
|
994
|
+
*
|
|
995
|
+
* @param directory HTTP response body
|
|
996
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.1.1
|
|
997
|
+
*/
|
|
998
|
+
directoryResponse(directory: JsonRawData): AcmeDirectory;
|
|
999
|
+
/**
|
|
1000
|
+
* For creating a new acme account. This returns a signed JWS-alike request body to send to
|
|
1001
|
+
* `POST /acme/{provisioner-name}/new-account`.
|
|
1002
|
+
*
|
|
1003
|
+
* @param directory you got from {@link directoryResponse}
|
|
1004
|
+
* @param previousNonce you got from calling `HEAD {@link AcmeDirectory.newNonce}`
|
|
1005
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.3
|
|
1006
|
+
*/
|
|
1007
|
+
newAccountRequest(directory: AcmeDirectory, previousNonce: string): JsonRawData;
|
|
1008
|
+
/**
|
|
1009
|
+
* Parses the response from `POST /acme/{provisioner-name}/new-account`.
|
|
1010
|
+
* @param account HTTP response body
|
|
1011
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.3
|
|
1012
|
+
*/
|
|
1013
|
+
newAccountResponse(account: JsonRawData): AcmeAccount;
|
|
1014
|
+
/**
|
|
1015
|
+
* Creates a new acme order for the handle (userId + display name) and the clientId.
|
|
1016
|
+
*
|
|
1017
|
+
* @param handle domain of the authorization server e.g. `idp.example.org`
|
|
1018
|
+
* @param clientId domain of the wire-server e.g. `wire.example.org`
|
|
1019
|
+
* @param expiryDays generated x509 certificate expiry
|
|
1020
|
+
* @param directory you got from {@link directoryResponse}
|
|
1021
|
+
* @param account you got from {@link newAccountResponse}
|
|
1022
|
+
* @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/new-account`
|
|
1023
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
|
|
1024
|
+
*/
|
|
1025
|
+
newOrderRequest(handle: string, clientId: string, expiryDays: number, directory: AcmeDirectory, account: AcmeAccount, previousNonce: string): JsonRawData;
|
|
1026
|
+
/**
|
|
1027
|
+
* Parses the response from `POST /acme/{provisioner-name}/new-order`.
|
|
1028
|
+
*
|
|
1029
|
+
* @param order HTTP response body
|
|
1030
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
|
|
1031
|
+
*/
|
|
1032
|
+
newOrderResponse(order: JsonRawData): NewAcmeOrder;
|
|
1033
|
+
/**
|
|
1034
|
+
* Creates a new authorization request.
|
|
1035
|
+
*
|
|
1036
|
+
* @param url one of the URL in new order's authorizations (use {@link NewAcmeOrder.authorizations} from {@link newOrderResponse})
|
|
1037
|
+
* @param account you got from {@link newAccountResponse}
|
|
1038
|
+
* @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/new-order` (or from the
|
|
1039
|
+
* previous to this method if you are creating the second authorization)
|
|
1040
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5
|
|
1041
|
+
*/
|
|
1042
|
+
newAuthzRequest(url: string, account: AcmeAccount, previousNonce: string): JsonRawData;
|
|
1043
|
+
/**
|
|
1044
|
+
* Parses the response from `POST /acme/{provisioner-name}/authz/{authz-id}`
|
|
1045
|
+
*
|
|
1046
|
+
* You then have to map the challenge from this authorization object. The `client_id_challenge`
|
|
1047
|
+
* will be the one with the `client_id_host` (you supplied to {@link newOrderRequest}) identifier,
|
|
1048
|
+
* the other will be your `handle_challenge`.
|
|
1049
|
+
*
|
|
1050
|
+
* @param authz HTTP response body
|
|
1051
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5
|
|
1052
|
+
*/
|
|
1053
|
+
newAuthzResponse(authz: JsonRawData): NewAcmeAuthz;
|
|
1054
|
+
/**
|
|
1055
|
+
* Generates a new client Dpop JWT token. It demonstrates proof of possession of the nonces
|
|
1056
|
+
* (from wire-server & acme server) and will be verified by the acme server when verifying the
|
|
1057
|
+
* challenge (in order to deliver a certificate).
|
|
1058
|
+
*
|
|
1059
|
+
* Then send it to `POST /clients/{id}/access-token`
|
|
1060
|
+
* {@link https://staging-nginz-https.zinfra.io/api/swagger-ui/#/default/post_clients__cid__access_token} on wire-server.
|
|
1061
|
+
*
|
|
1062
|
+
* @param accessTokenUrl backend endpoint where this token will be sent. Should be this one {@link https://staging-nginz-https.zinfra.io/api/swagger-ui/#/default/post_clients__cid__access_token}
|
|
1063
|
+
* @param userId an UUIDv4 uniquely identifying the user
|
|
1064
|
+
* @param clientId client identifier
|
|
1065
|
+
* @param domain owning backend domain e.g. `wire.com`
|
|
1066
|
+
* @param clientIdChallenge you found after {@link newAuthzResponse}
|
|
1067
|
+
* @param backendNonce you get by calling `GET /clients/token/nonce` on wire-server as defined here {@link https://staging-nginz-https.zinfra.io/api/swagger-ui/#/default/get_clients__client__nonce}
|
|
1068
|
+
* @param expiryDays token expiry in days
|
|
1069
|
+
*/
|
|
1070
|
+
createDpopToken(accessTokenUrl: string, userId: string, clientId: bigint, domain: string, clientIdChallenge: AcmeChallenge, backendNonce: string, expiryDays: number): string;
|
|
1071
|
+
/**
|
|
1072
|
+
* Creates a new challenge request.
|
|
1073
|
+
*
|
|
1074
|
+
* @param handleChallenge you found after {@link newAuthzResponse}
|
|
1075
|
+
* @param account you found after {@link newAccountResponse}
|
|
1076
|
+
* @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/authz/{authz-id}`
|
|
1077
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1
|
|
1078
|
+
*/
|
|
1079
|
+
newChallengeRequest(handleChallenge: AcmeChallenge, account: AcmeAccount, previousNonce: string): JsonRawData;
|
|
1080
|
+
/**
|
|
1081
|
+
* Parses the response from `POST /acme/{provisioner-name}/challenge/{challenge-id}`.
|
|
1082
|
+
*
|
|
1083
|
+
* @param challenge HTTP response body
|
|
1084
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1
|
|
1085
|
+
*/
|
|
1086
|
+
newChallengeResponse(challenge: JsonRawData): void;
|
|
1087
|
+
/**
|
|
1088
|
+
* Verifies that the previous challenge has been completed.
|
|
1089
|
+
*
|
|
1090
|
+
* @param orderUrl `location` header from http response you got from {@link newOrderResponse}
|
|
1091
|
+
* @param account you found after {@link newAccountResponse}
|
|
1092
|
+
* @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/challenge/{challenge-id}`
|
|
1093
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
|
|
1094
|
+
*/
|
|
1095
|
+
checkOrderRequest(orderUrl: string, account: AcmeAccount, previousNonce: string): JsonRawData;
|
|
1096
|
+
/**
|
|
1097
|
+
* Parses the response from `POST /acme/{provisioner-name}/order/{order-id}`.
|
|
1098
|
+
*
|
|
1099
|
+
* @param order HTTP response body
|
|
1100
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
|
|
1101
|
+
*/
|
|
1102
|
+
checkOrderResponse(order: JsonRawData): AcmeOrder;
|
|
1103
|
+
/**
|
|
1104
|
+
* Final step before fetching the certificate.
|
|
1105
|
+
*
|
|
1106
|
+
* @param domains you want to generate a certificate for e.g. `["wire.com"]`
|
|
1107
|
+
* @param order you got from {@link checkOrderResponse}
|
|
1108
|
+
* @param account you found after {@link newAccountResponse}
|
|
1109
|
+
* @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/order/{order-id}`
|
|
1110
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
|
|
1111
|
+
*/
|
|
1112
|
+
finalizeRequest(domains: Uint8Array[], order: AcmeOrder, account: AcmeAccount, previousNonce: string): JsonRawData;
|
|
1113
|
+
/**
|
|
1114
|
+
* Parses the response from `POST /acme/{provisioner-name}/order/{order-id}/finalize`.
|
|
1115
|
+
*
|
|
1116
|
+
* @param finalize HTTP response body
|
|
1117
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
|
|
1118
|
+
*/
|
|
1119
|
+
finalizeResponse(finalize: JsonRawData): AcmeFinalize;
|
|
1120
|
+
/**
|
|
1121
|
+
* Creates a request for finally fetching the x509 certificate.
|
|
1122
|
+
*
|
|
1123
|
+
* @param finalize you got from {@link finalizeResponse}
|
|
1124
|
+
* @param account you got from {@link newAccountResponse}
|
|
1125
|
+
* @param previousNonce `replay-nonce` response header from `POST /acme/{provisioner-name}/order/{order-id}/finalize`
|
|
1126
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4.2
|
|
1127
|
+
*/
|
|
1128
|
+
certificateRequest(finalize: AcmeFinalize, account: AcmeAccount, previousNonce: string): JsonRawData;
|
|
1129
|
+
/**
|
|
1130
|
+
* Parses the response from `POST /acme/{provisioner-name}/certificate/{certificate-id}`.
|
|
1131
|
+
*
|
|
1132
|
+
* @param certificateChain HTTP string response body
|
|
1133
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4.2
|
|
1134
|
+
*/
|
|
1135
|
+
certificateResponse(certificateChain: string): Uint8Array[];
|
|
1136
|
+
}
|
|
1137
|
+
/**
|
|
1138
|
+
* Holds URLs of all the standard ACME endpoint supported on an ACME server.
|
|
1139
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.1.1
|
|
1140
|
+
*/
|
|
1141
|
+
export interface AcmeDirectory {
|
|
1142
|
+
/**
|
|
1143
|
+
* URL for fetching a new nonce. Use this only for creating a new account.
|
|
1144
|
+
*
|
|
1145
|
+
* @readonly
|
|
1146
|
+
*/
|
|
1147
|
+
newNonce: string;
|
|
1148
|
+
/**
|
|
1149
|
+
* URL for creating a new account.
|
|
1150
|
+
*
|
|
1151
|
+
* @readonly
|
|
1152
|
+
*/
|
|
1153
|
+
newAccount: string;
|
|
1154
|
+
/**
|
|
1155
|
+
* URL for creating a new order.
|
|
1156
|
+
*
|
|
1157
|
+
* @readonly
|
|
1158
|
+
*/
|
|
1159
|
+
newOrder: string;
|
|
1160
|
+
}
|
|
1161
|
+
/**
|
|
1162
|
+
* Result of an order creation
|
|
1163
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
|
|
1164
|
+
*/
|
|
1165
|
+
export interface NewAcmeOrder {
|
|
1166
|
+
/**
|
|
1167
|
+
* Contains raw JSON data of this order. This is parsed by the underlying Rust library hence should not be accessed
|
|
1168
|
+
*
|
|
1169
|
+
* @readonly
|
|
1170
|
+
*/
|
|
1171
|
+
delegate: Uint8Array;
|
|
1172
|
+
/**
|
|
1173
|
+
* An authorization for each domain to create
|
|
1174
|
+
*
|
|
1175
|
+
* @readonly
|
|
1176
|
+
*/
|
|
1177
|
+
authorizations: Uint8Array[];
|
|
1178
|
+
}
|
|
1179
|
+
/**
|
|
1180
|
+
* Result of an authorization creation.
|
|
1181
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5
|
|
1182
|
+
*/
|
|
1183
|
+
export interface NewAcmeAuthz {
|
|
1184
|
+
/**
|
|
1185
|
+
* DNS entry associated with those challenge
|
|
1186
|
+
*
|
|
1187
|
+
* @readonly
|
|
1188
|
+
*/
|
|
1189
|
+
identifier: string;
|
|
1190
|
+
/**
|
|
1191
|
+
* Challenge for the clientId
|
|
1192
|
+
*
|
|
1193
|
+
* @readonly
|
|
1194
|
+
*/
|
|
1195
|
+
wireHttpChallenge: AcmeChallenge | null;
|
|
1196
|
+
/**
|
|
1197
|
+
* Challenge for the userId and displayName
|
|
1198
|
+
*
|
|
1199
|
+
* @readonly
|
|
1200
|
+
*/
|
|
1201
|
+
wireOidcChallenge: AcmeChallenge | null;
|
|
1202
|
+
}
|
|
1203
|
+
/**
|
|
1204
|
+
* For creating a challenge
|
|
1205
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.5.1
|
|
1206
|
+
*/
|
|
1207
|
+
export interface AcmeChallenge {
|
|
1208
|
+
/**
|
|
1209
|
+
* Contains raw JSON data of this challenge. This is parsed by the underlying Rust library hence should not be accessed
|
|
1210
|
+
*
|
|
1211
|
+
* @readonly
|
|
1212
|
+
*/
|
|
1213
|
+
delegate: Uint8Array;
|
|
1214
|
+
/**
|
|
1215
|
+
* URL of this challenge
|
|
1216
|
+
*
|
|
1217
|
+
* @readonly
|
|
1218
|
+
*/
|
|
1219
|
+
url: string;
|
|
1220
|
+
}
|
|
1221
|
+
/**
|
|
1222
|
+
* Result from finalize.
|
|
1223
|
+
* @see https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4
|
|
1224
|
+
*/
|
|
1225
|
+
export interface AcmeFinalize {
|
|
1226
|
+
/**
|
|
1227
|
+
* Contains raw JSON data of this finalize. This is parsed by the underlying Rust library hence should not be accessed
|
|
1228
|
+
*
|
|
1229
|
+
* @readonly
|
|
1230
|
+
*/
|
|
1231
|
+
delegate: Uint8Array;
|
|
1232
|
+
/**
|
|
1233
|
+
* URL of to use for the last request to fetch the x509 certificate
|
|
1234
|
+
*
|
|
1235
|
+
* @readonly
|
|
1236
|
+
*/
|
|
1237
|
+
certificateUrl: string;
|
|
1238
|
+
}
|
|
852
1239
|
|
|
853
1240
|
export {};
|