@yielded/crypto 0.1.0-beta.27 → 0.1.0-beta.29

package/src/internal/hmac.ts

@@ -1,8 +1,8 @@
-import { Effect, Exit, Fiber, Redacted, Schema, Scope } from "effect";
+import { Effect, Redacted, Schema } from "effect";
 
-import { CryptoUnavailable } from "../Errors";
 import { Hmac, Input, type Key, KeyInput, VerifyInput } from "../Hmac";
 import { copy, decode, importError, nativeError, withSecret } from "./common";
+import { makeScopedKey } from "./scoped-key";
 
 const keyBytes = Schema.Uint8Array.check(Schema.isMinLength(1));
 
@@ -12,37 +12,7 @@ export const makeHmac = (subtle: SubtleCrypto): Hmac["Service"] => {
 
     yield* decode(keyBytes, Redacted.value(value.key), "key");
 
-    // A sequential child joins every native call before dropping the key, even
-    // when the caller's Scope runs its other finalizers in parallel.
-    const scope = yield* Scope.fork(yield* Effect.scope, "sequential");
-    let imported: CryptoKey | undefined;
-
-    yield* Scope.addFinalizer(
-      scope,
-      Effect.sync(() => {
-        imported = undefined;
-      }),
-    );
-
-    const available = Effect.suspend(() =>
-      scope.state._tag === "Closed" ? Effect.fail(CryptoUnavailable.make({})) : Effect.void,
-    );
-
-    const run = <A, E>(operation: Effect.Effect<A, E>) =>
-      Effect.acquireUseRelease(
-        available.pipe(Effect.andThen(Effect.forkIn(operation, scope, { uninterruptible: false }))),
-        (fiber) =>
-          Effect.gen(function* () {
-            const exit = yield* Fiber.await(fiber);
-
-            yield* available;
-
-            return yield* exit;
-          }),
-        Fiber.interrupt,
-      );
-
-    yield* run(
+    const use = yield* makeScopedKey(
       withSecret(value.key, (material) =>
         Effect.tryPromise({
           try: () =>
@@ -51,41 +21,30 @@ export const makeHmac = (subtle: SubtleCrypto): Hmac["Service"] => {
               "verify",
             ]),
           catch: importError,
-        }).pipe(
-          Effect.tap((key) =>
-            Effect.sync(() => {
-              imported = key;
-            }),
-          ),
-          Effect.uninterruptible,
-        ),
+        }),
       ),
-    ).pipe(
-      Effect.onExit((exit) => (Exit.isFailure(exit) ? Scope.close(scope, exit) : Effect.void)),
     );
 
-    const use = <A>(operation: (key: CryptoKey) => Promise<A>) =>
-      run(
-        Effect.suspend(() => {
-          const key = imported;
-
-          return key === undefined
-            ? Effect.fail(CryptoUnavailable.make({}))
-            : Effect.tryPromise({ try: () => operation(key), catch: nativeError });
-        }).pipe(Effect.uninterruptible),
-      );
-
     return {
       sign: Effect.fnUntraced(function* (input) {
         const data = yield* decode(Schema.Uint8Array, input, "data").pipe(Effect.flatMap(copy));
 
-        return new Uint8Array(yield* use((key) => subtle.sign("HMAC", key, data)));
+        return new Uint8Array(
+          yield* use((key) =>
+            Effect.tryPromise({ try: () => subtle.sign("HMAC", key, data), catch: nativeError }),
+          ),
+        );
       }),
       verify: Effect.fnUntraced(function* (input, signature) {
         const data = yield* decode(Schema.Uint8Array, input, "data").pipe(Effect.flatMap(copy));
         const tag = yield* decode(Schema.Uint8Array, signature, "data").pipe(Effect.flatMap(copy));
 
-        return yield* use((key) => subtle.verify("HMAC", key, tag, data));
+        return yield* use((key) =>
+          Effect.tryPromise({
+            try: () => subtle.verify("HMAC", key, tag, data),
+            catch: nativeError,
+          }),
+        );
       }),
     } satisfies Key;
   });

package/src/internal/scoped-key.ts

@@ -0,0 +1,60 @@
+import { Effect, Exit, Fiber, Scope } from "effect";
+
+import { CryptoUnavailable, type OperationError } from "../Errors";
+
+/** Join native calls before releasing a key, including parallel parent closure. */
+export const makeScopedKey = Effect.fnUntraced(function* (
+  acquire: Effect.Effect<CryptoKey, OperationError>,
+) {
+  const scope = yield* Scope.fork(yield* Effect.scope, "sequential");
+  let imported: CryptoKey | undefined;
+
+  yield* Scope.addFinalizer(
+    scope,
+    Effect.sync(() => {
+      imported = undefined;
+    }),
+  );
+
+  const available = Effect.suspend(() =>
+    scope.state._tag === "Closed" ? Effect.fail(CryptoUnavailable.make({})) : Effect.void,
+  );
+
+  const run = <A, E>(operation: Effect.Effect<A, E>) =>
+    Effect.acquireUseRelease(
+      available.pipe(
+        Effect.andThen(
+          Effect.forkIn(operation, scope, { uninterruptible: false, startImmediately: true }),
+        ),
+      ),
+      (fiber) =>
+        Effect.gen(function* () {
+          const exit = yield* Fiber.await(fiber);
+
+          yield* available;
+
+          return yield* exit;
+        }),
+      Fiber.interrupt,
+    );
+
+  yield* run(
+    acquire.pipe(
+      Effect.tap((key) =>
+        Effect.sync(() => {
+          imported = key;
+        }),
+      ),
+      Effect.uninterruptible,
+    ),
+  ).pipe(Effect.onExit((exit) => (Exit.isFailure(exit) ? Scope.close(scope, exit) : Effect.void)));
+
+  return <A, E>(operation: (key: CryptoKey) => Effect.Effect<A, E>) =>
+    run(
+      Effect.suspend((): Effect.Effect<A, E | CryptoUnavailable> => {
+        const key = imported;
+
+        return key === undefined ? Effect.fail(CryptoUnavailable.make({})) : operation(key);
+      }).pipe(Effect.uninterruptible),
+    );
+});

package/src/internal/signature.ts

@@ -4,13 +4,18 @@ import { Base64Url } from "effect/encoding";
 import { InvalidInput } from "../Errors";
 import {
   type Algorithm,
+  type PrivateKey,
+  PrivateKeyInput,
   PrivateKeyParameters,
+  type PublicKey,
+  PublicKeyInput,
   PublicKeyParameters,
   SignInput,
   Signature,
   VerifyInput,
 } from "../Signature";
 import { copy, decode, importError, nativeError, withSecret } from "./common";
+import { makeScopedKey } from "./scoped-key";
 
 const derBytes = Schema.Uint8Array.check(Schema.isMinLength(1), Schema.isMaxLength(16384));
 
@@ -121,6 +126,55 @@ export const makeSignature = (subtle: SubtleCrypto): Signature["Service"] => {
   });
 
   return Signature.of({
+    importPrivateKey: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(PrivateKeyInput, input, "key");
+      const algorithm = value.algorithm;
+
+      const use = yield* makeScopedKey(
+        withSecret(value.privateKey, (material) => importKey(algorithm, "pkcs8", material)),
+      );
+
+      return {
+        sign: Effect.fnUntraced(function* (input) {
+          const data = yield* decode(Schema.Uint8Array, input, "data").pipe(Effect.flatMap(copy));
+
+          const result = yield* use((key) =>
+            Effect.tryPromise({
+              try: () => subtle.sign(operationAlgorithm(algorithm), key, data),
+              catch: nativeError,
+            }),
+          );
+
+          return new Uint8Array(result);
+        }),
+      } satisfies PrivateKey;
+    }),
+    importPublicKey: Effect.fnUntraced(function* (input) {
+      const value = yield* decode(PublicKeyInput, input, "key");
+      const algorithm = value.algorithm;
+      const material = yield* copy(value.publicKey);
+      const use = yield* makeScopedKey(importKey(algorithm, "spki", material));
+
+      return {
+        verify: Effect.fnUntraced(function* (input, signature) {
+          const data = yield* decode(Schema.Uint8Array, input, "data").pipe(Effect.flatMap(copy));
+
+          const tag = yield* decode(Schema.Uint8Array, signature, "data").pipe(
+            Effect.flatMap(copy),
+          );
+
+          return yield* use((key) => {
+            if ((algorithm === "ECDSA-P256-SHA256" || algorithm === "Ed25519") && tag.length !== 64)
+              return Effect.succeed(false);
+
+            return Effect.tryPromise({
+              try: () => subtle.verify(operationAlgorithm(algorithm), key, tag, data),
+              catch: nativeError,
+            });
+          });
+        }),
+      } satisfies PublicKey;
+    }),
     encodePublicKey: Effect.fnUntraced(function* (input) {
       const parameters = yield* decode(PublicKeyParameters, input, "key");
       const key = yield* importComponents(parameters, "verify");

package/src/internal/xchacha-core.ts

@@ -258,6 +258,7 @@ interface State {
   readonly nonce: Uint32Array;
   readonly words: Uint32Array;
   readonly stream: Uint8Array;
+  readonly streamView: DataView;
 }
 
 const readWords = (data: Uint8Array, words: Uint32Array): void => {
@@ -270,11 +271,14 @@ function withState<A>(key: Uint8Array, nonce: Uint8Array, operation: (state: Sta
   const original = new Uint32Array(8);
   const extendedNonce = new Uint32Array(4);
 
+  const stream = new Uint8Array(64);
+
   const state: State = {
     key: new Uint32Array(8),
     nonce: new Uint32Array(3),
     words: new Uint32Array(16),
-    stream: new Uint8Array(64),
+    stream,
+    streamView: new DataView(stream.buffer),
   };
 
   try {
@@ -300,7 +304,7 @@ function withState<A>(key: Uint8Array, nonce: Uint8Array, operation: (state: Sta
 
 const blockAt = (state: State, counter: number): void => {
   chachaCore(sigma, state.key, state.nonce, state.words, counter);
-  const view = new DataView(state.stream.buffer, state.stream.byteOffset, state.stream.byteLength);
+  const view = state.streamView;
 
   for (let i = 0; i < 16; i++) view.setUint32(i * 4, state.words[i], true);
 };