asherah 3.0.13 → 4.0.0-beta.1

package/README.md

@@ -1,176 +1,20 @@
 # asherah-node
 
-Asherah envelope encryption and key rotation library
+`asherah-node` packages the Asherah AppEncryption runtime as a Node.js native
+addon using `napi-rs`. The crate builds a `cdylib` that is published to npm via
+the accompanying workflow.
 
-This is a wrapper of the Asherah Go implementation using the Cobhan FFI library
+## Features
 
-*NOTE:* Due to limitations around the type of libraries Go creates and the type of libraries musl libc supports, you MUST use a glibc based Linux distribution with asherah-node, such as Debian, Ubuntu, AlmaLinux, etc.  Alpine Linux with musl libc will not work.  For technical details, see below.
+- Provides synchronous and asynchronous session helpers mirroring the Go SDK.
+- Shares configuration parsing through the `asherah-config` crate.
+- Leverages the same Rust core (`asherah`) used by other language bindings.
 
-Example code: 
+## Building
 
-### TypeScript
+Use `npm install` in `asherah-node/` to compile the addon locally. CI builds
+and publishes prebuilt binaries for supported targets.
 
-```typescript
-import { AsherahConfig, decrypt, encrypt, setup, shutdown } from 'asherah'
+## License
 
-const config: AsherahConfig = {
-    KMS: 'aws',
-    Metastore: 'memory',
-    ServiceName: 'TestService',
-    ProductID: 'TestProduct',
-    Verbose: true,
-    EnableSessionCaching: true,
-    ExpireAfter: null,
-    CheckInterval: null,
-    ConnectionString: null,
-    ReplicaReadConsistency: null,
-    DynamoDBEndpoint: null,
-    DynamoDBRegion: null,
-    DynamoDBTableName: null,
-    SessionCacheMaxSize: null,
-    SessionCacheDuration: null,
-    RegionMap: {"us-west-2": "arn:aws:kms:us-west-2:XXXXXXXXX:key/XXXXXXXXXX"},
-    PreferredRegion: null,
-    EnableRegionSuffix: null
-  };
-
-setup(config)
-
-const input = 'mysecretdata'
-
-console.log("Input: " + input)
-
-const data = Buffer.from(input, 'utf8');
-
-const encrypted = encrypt('partition', data);
-
-const decrypted = decrypt('partition', encrypted);
-
-const output = decrypted.toString('utf8');
-
-console.log("Output: " + output)
-
-shutdown()
-```
-
-### JavaScript
-
-```javascript
-
-const asherah = require('asherah')
-
-const config = {
-    KMS: 'aws',
-    Metastore: 'memory',
-    ServiceName: 'TestService',
-    ProductID: 'TestProduct',
-    Verbose: true,
-    EnableSessionCaching: true,
-    ExpireAfter: null,
-    CheckInterval: null,
-    ConnectionString: null,
-    ReplicaReadConsistency: null,
-    DynamoDBEndpoint: null,
-    DynamoDBRegion: null,
-    DynamoDBTableName: null,
-    SessionCacheMaxSize: null,
-    SessionCacheDuration: null,
-    RegionMap: {"us-west-2": "arn:aws:kms:us-west-2:XXXXXXXXX:key/XXXXXXXXXX"},
-    PreferredRegion: null,
-    EnableRegionSuffix: null
-  };
-
-asherah.setup(config)
-
-const input = 'mysecretdata'
-
-console.log("Input: " + input)
-
-const data = Buffer.from(input, 'utf8');
-
-const encrypted = asherah.encrypt('partition', data);
-
-const decrypted = asherah.decrypt('partition', encrypted);
-
-const output = decrypted.toString('utf8');
-
-console.log("Output: " + output)
-
-asherah.shutdown()
-```
-
-### Environment Variables and AWS
-
-If you're experiencing issues with AWS credentials, you can forcibly set the environment variables prior to calling setup in such a way as to ensure they're set for the Go runtime:
-
-```javascript
-
-const asherah = require('asherah');
-const fs = require('fs');
-
-const config = {
-    KMS: 'aws',
-    Metastore: 'memory',
-    ServiceName: 'TestService',
-    ProductID: 'TestProduct',
-    Verbose: true,
-    EnableSessionCaching: true,
-    ExpireAfter: null,
-    CheckInterval: null,
-    ConnectionString: null,
-    ReplicaReadConsistency: null,
-    DynamoDBEndpoint: null,
-    DynamoDBRegion: null,
-    DynamoDBTableName: null,
-    SessionCacheMaxSize: null,
-    SessionCacheDuration: null,
-    RegionMap: {"us-west-2": "arn:aws:kms:us-west-2:XXXXXXXXX:key/XXXXXXXXXX"},
-    PreferredRegion: null,
-    EnableRegionSuffix: null
-  };
-
-// Read the AWS environment variables from the JSON file
-// DO NOT HARDCODE YOUR AWS CREDENTIALS
-const awsEnvPath = './awsEnv.json';
-const awsEnvData = fs.readFileSync(awsEnvPath, 'utf8');
-const awsEnv = JSON.stringify(awsEnvData);
-
-// Set the environment variables using the setenv function
-asherah.setenv(awsEnv);
-
-asherah.setup(config)
-
-const input = 'mysecretdata'
-
-console.log("Input: " + input)
-
-const data = Buffer.from(input, 'utf8');
-
-const encrypted = asherah.encrypt('partition', data);
-
-const decrypted = asherah.decrypt('partition', encrypted);
-
-const output = decrypted.toString('utf8');
-
-console.log("Output: " + output)
-
-asherah.shutdown()
-```
-
-The `awsEnv.json` file would look like this (spelling errors intentional):
-
-```json
-{
-  "AXS_ACCESS_KEY_XD": "sample_access_key_xd",
-  "AXS_SXCRET_ACCXSS_KEY": "sample_sxcret_accxss_kxy",
-  "AXS_SXSSION_TXKEN": "sample_sxssion_txken"
-}
-```
-
-### Go and Alpine / musl libc
-
-The Golang compiler when creating shared libraries (.so) uses a Thread Local Storage model of init-exec.  This model is inheriently incompatible with loading libraries at runtime with dlopen(), unless your libc reserves some space for dlopen()'ed libraries which is something of a hack.  The most common libc, glibc does in fact reserve space for dlopen()'ed libraries that use init-exec model.  The libc provided with Alpine is musl libc, and it does not participate in this hack / workaround of reserving space.  Most compilers generate libraries with a Thread Local Storage model of global-dynamic which does not require this workaround, and the authors of musl libc do not feel that workaround should exist.
-
-## Updating npm packages
-
-To update packages, run `npm run update`. This command uses [npm-check-updates](https://github.com/raineorshine/npm-check-updates) to bring all npm packages to their latest version. This command also runs `npm install` and `npm audit fix` for you.
+Licensed under the Apache License, Version 2.0.

package/index.d.ts

@@ -0,0 +1,53 @@
+/// <reference types="node" />
+
+export type AsherahConfig = {
+  serviceName: string;
+  productId: string;
+  expireAfter?: number | null;
+  checkInterval?: number | null;
+  metastore: 'memory' | 'rdbms' | 'dynamodb';
+  connectionString?: string | null;
+  dynamoDBEndpoint?: string | null;
+  dynamoDBRegion?: string | null;
+  dynamoDBTableName?: string | null;
+  sessionCacheMaxSize?: number | null;
+  sessionCacheDuration?: number | null;
+  kms?: 'aws' | 'static' | null;
+  regionMap?: Record<string, string> | null;
+  preferredRegion?: string | null;
+  enableRegionSuffix?: boolean | null;
+  enableSessionCaching?: boolean | null;
+  verbose?: boolean | null;
+};
+
+export declare function setup(config: AsherahConfig): void;
+export declare function setupAsync(config: AsherahConfig): Promise<void>;
+export declare function shutdown(): void;
+export declare function shutdownAsync(): Promise<void>;
+export declare function getSetupStatus(): boolean;
+export declare function setenv(env: string): void;
+
+export declare function encrypt(partitionId: string, data: Buffer): string;
+export declare function encryptAsync(partitionId: string, data: Buffer): Promise<string>;
+export declare function decrypt(partitionId: string, dataRowRecordJson: string): Buffer;
+export declare function decryptAsync(partitionId: string, dataRowRecordJson: string): Promise<Buffer>;
+
+export declare function encryptString(partitionId: string, data: string): string;
+export declare function encryptStringAsync(partitionId: string, data: string): Promise<string>;
+export declare function decryptString(partitionId: string, dataRowRecordJson: string): string;
+export declare function decryptStringAsync(partitionId: string, dataRowRecordJson: string): Promise<string>;
+
+export declare function setMaxStackAllocItemSize(n: number): void;
+export declare function setSafetyPaddingOverhead(n: number): void;
+export type LogEvent = {
+  level: 'trace' | 'debug' | 'info' | 'warn' | 'error';
+  message: string;
+  target: string;
+};
+
+export type MetricsEvent =
+  | { type: 'encrypt' | 'decrypt' | 'store' | 'load'; durationNs: number }
+  | { type: 'cache_hit' | 'cache_miss'; name: string };
+
+export declare function setLogHook(hook: ((event: LogEvent) => void) | null): void;
+export declare function setMetricsHook(hook: ((event: MetricsEvent) => void) | null): void;

package/npm/index.js

@@ -0,0 +1,54 @@
+const path = require('path');
+const os = require('os');
+
+// Determine current platform
+function getPlatform() {
+  const type = os.platform();
+  const arch = os.arch();
+
+  if (type === 'darwin') {
+    if (arch === 'x64') return 'darwin-x64';
+    if (arch === 'arm64') return 'darwin-arm64';
+  }
+  if (type === 'linux') {
+    if (arch === 'x64') return 'linux-x64-gnu';
+    if (arch === 'arm64') return 'linux-arm64-gnu';
+  }
+  if (type === 'win32') {
+    if (arch === 'x64') return 'win32-x64-msvc';
+  }
+
+  throw new Error(`Unsupported platform: ${type}-${arch}`);
+}
+
+const platform = getPlatform();
+
+// Try to load the native module
+const attempts = [
+  // Platform-specific directory (for universal package)
+  path.join(__dirname, platform, `index.${platform}.node`),
+  // Fallback to old single-binary location
+  path.join(__dirname, 'asherah.node'),
+  path.join(__dirname, '..', 'index.node'),
+];
+
+let lastErr = null;
+for (const candidate of attempts) {
+  try {
+    module.exports = require(candidate);
+    module.exports.__binary = candidate;
+    return;
+  } catch (err) {
+    lastErr = err;
+    if (
+      err.code !== 'MODULE_NOT_FOUND' &&
+      err.code !== 'ERR_MODULE_NOT_FOUND' &&
+      err.code !== 'ERR_DLOPEN_FAILED'
+    ) {
+      throw err;
+    }
+  }
+}
+
+const detail = lastErr ? `: ${lastErr.message || String(lastErr)}` : '';
+throw new Error(`Failed to load Asherah native addon for ${platform}${detail}`);

package/package.json

@@ -1,81 +1,32 @@
 {
   "name": "asherah",
-  "version": "3.0.13",
+  "version": "4.0.0-beta.1",
+  "private": false,
   "description": "Asherah envelope encryption and key rotation library",
-  "exports": {
-    "node-addons": "./dist/asherah.node"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/godaddy/asherah-node.git"
-  },
-  "scripts": {
-    "preinstall": "scripts/download-libraries.sh",
-    "load": "node --max-old-space-size=500 scripts/dumpster-fire-memory.js",
-    "install": "scripts/build.sh",
-    "test:mocha-debug": "lldb -o run -- node node_modules/mocha/bin/mocha --inspect-brk",
-    "test:mocha": "mocha",
-    "test": "nyc npm run test:mocha",
-    "test:bun": "bun test/bun-test.js",
-    "debug": "nyc npm run test:mocha-debug",
-    "posttest": "npm run lint && npm run test:bun",
-    "lint": "eslint src/**.ts --fix",
-    "update": "npx npm-check-updates --target latest -u -x mocha && npm i && npm audit fix"
-  },
-  "keywords": [],
-  "author": "Jeremiah Gowdy <jeremiah@gowdy.me>",
-  "license": "MIT",
+  "main": "npm/index.js",
+  "types": "index.d.ts",
   "files": [
-    "binding.gyp",
-    "src/asherah_async_worker.h",
-    "src/asherah.cc",
-    "src/cobhan_buffer_napi.h",
-    "src/cobhan_buffer.h",
-    "src/hints.h",
-    "src/logging.h",
-    "src/logging_napi.cc",
-    "src/logging_napi.h",
-    "src/logging_stderr.cc",
-    "src/logging_stderr.h",
-    "src/napi_utils.h",
-    "src/scoped_allocate.h",
-    "src/asherah.d.ts",
-    "scripts/download-libraries.sh",
-    "scripts/build.sh",
-    "SHA256SUMS",
-    "SHA256SUMS-darwin",
-    ".asherah-version"
+    "npm/**/*",
+    "index.d.ts",
+    "README.md",
+    "LICENSE"
   ],
+  "scripts": {
+    "build": "napi build",
+    "build:release": "napi build --release",
+    "prepublishOnly": "napi prepublish -t npm",
+    "test": "node test/roundtrip.js"
+  },
   "devDependencies": {
-    "@cucumber/cucumber": "^11.2.0",
-    "@eslint/eslintrc": "^3.2.0",
-    "@eslint/js": "^9.20.0",
-    "@types/chai": "^5.0.1",
-    "@types/mocha": "^10.0.10",
-    "@types/node": "^22.13.1",
-    "@typescript-eslint/eslint-plugin": "^8.24.0",
-    "@typescript-eslint/parser": "^8.24.0",
-    "chai": "^5.1.2",
-    "eslint": "^9.20.1",
-    "globals": "^15.15.0",
-    "microtime": "^3.1.1",
-    "mocha": "^10.0.0",
-    "node-api-headers": "^1.5.0",
-    "nyc": "^17.1.0",
-    "ts-mocha": "^10.0.0",
-    "typescript": "^5.7.3",
-    "winston": "^3.17.0"
+    "@napi-rs/cli": "^2.18.0"
   },
-  "mocha": {
-    "extension": [
-      "ts"
-    ],
-    "recursive": true,
-    "spec": "test/**/*.spec.ts",
-    "require": "ts-node/register"
+  "engines": {
+    "node": ">= 18"
   },
-  "types": "dist/asherah.d.ts",
-  "dependencies": {
-    "node-addon-api": "^8.3.0"
+  "optionalDependencies": {
+    "asherah-win32-x64-msvc": "4.0.0",
+    "asherah-darwin-x64": "4.0.0",
+    "asherah-linux-x64-gnu": "4.0.0",
+    "asherah-linux-arm64-gnu": "4.0.0"
   }
 }

package/.asherah-version

@@ -1 +0,0 @@
-ASHERAH_VERSION=v0.4.36

package/LICENSE

@@ -1,21 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2022 GoDaddy Operating Company, LLC.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/binding.gyp

@@ -1,36 +0,0 @@
-{
-  'targets': [
-      {
-      'target_name': 'asherah',
-      'include_dirs': ["<!(node -p \"require('node-addon-api').include_dir\")", "lib/", "src/"],
-      "cflags": ["-fexceptions", "-g", "-O3", "-std=c++17", "-fPIC", "-Wno-unknown-pragmas"],
-      "cflags_cc": ["-fexceptions", "-g", "-O3", "-std=c++17", "-fPIC", "-Wno-unknown-pragmas"],
-      "cflags!": [ "-fno-exceptions"],
-      "cflags_cc!": [ "-fno-exceptions" ],
-      'xcode_settings': {
-        'GCC_ENABLE_CPP_EXCEPTIONS': 'YES',
-        'OTHER_CFLAGS': [
-          '-fexceptions',
-          '-g',
-          '-O3',
-          '-std=c++17',
-          '-fPIC',
-          '-Wno-unknown-pragmas'
-        ],
-      },
-      'defines': [ 
-        'NAPI_CPP_EXCEPTIONS',
-        'NODE_API_SWALLOW_UNTHROWABLE_EXCEPTIONS',
-        'NODE_ADDON_API_DISABLE_DEPRECATED',
-        'NODE_API_NO_EXTERNAL_BUFFERS_ALLOWED',
-        'USE_SCOPED_ALLOCATE_BUFFER',
-        ],
-      'sources': [
-        'src/asherah.cc',
-        'src/logging_napi.cc',
-        'src/logging_stderr.cc'
-      ],
-      'libraries': [ '../lib/libasherah.a' ]
-    }
-  ]
-}

package/scripts/build.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-
-set -e
-
-mkdir -p dist/
-
-# Check if USE_CMAKE is set to 1
-if [ "$USE_CMAKE" = "1" ]; then
-    # Run CMake commands
-    (cmake . && make) || exit 1
-else
-    # Run node-gyp commands
-    node-gyp configure && node-gyp build && cp build/Release/asherah.node dist/asherah.node
-fi
-
-cp src/asherah.d.ts dist/asherah.d.ts