create-windy 0.2.6 → 0.2.8

package/template/packages/license-sdk/src/verification.ts

@@ -1,199 +0,0 @@
-import type {
-  LegacyPrototypeLicenseClaims,
-  LegacyPrototypeLicenseVerificationResult,
-  LegacyPrototypeSignedLicense,
-  LicenseVerificationResult,
-  SignedLicense,
-} from "@windy/shared";
-import { createLicenseSigningPayload } from "./payload.js";
-
-export type LicensePublicKeyMap = Record<string, string>;
-
-export type LicensePublicKeyResolver = (
-  publicKeyId: string,
-) => Promise<string | undefined> | string | undefined;
-
-export type LicensePublicKeySource =
-  | LicensePublicKeyMap
-  | LicensePublicKeyResolver;
-
-export async function verifySignedLicense(
-  license: SignedLicense,
-  publicKeySource: LicensePublicKeySource,
-): Promise<LicenseVerificationResult> {
-  if (license.formatVersion !== 1) {
-    return { valid: false, failures: ["unsupported-format"] };
-  }
-  if (license.algorithm !== "ED25519") {
-    return { valid: false, failures: ["invalid-format"] };
-  }
-  const publicKeyPem = await resolvePublicKey(
-    publicKeySource,
-    license.publicKeyId,
-  );
-  if (!publicKeyPem) {
-    return { valid: false, failures: ["unknown-public-key"] };
-  }
-  const valid = await verifyLicenseSignature(license, publicKeyPem);
-  return valid
-    ? { valid: true, claims: license.claims, failures: [] }
-    : { valid: false, failures: ["invalid-signature"] };
-}
-
-export async function verifyLicenseSignature(
-  license: SignedLicense,
-  publicKeyPem: string,
-): Promise<boolean> {
-  try {
-    return verifyLicensePayloadSignature(
-      createLicenseSigningPayload({
-        formatVersion: 1,
-        algorithm: license.algorithm,
-        publicKeyId: license.publicKeyId,
-        claims: license.claims,
-      }),
-      license.signature,
-      publicKeyPem,
-    );
-  } catch {
-    return false;
-  }
-}
-
-/** Explicit read-only compatibility path. It must never be used to issue. */
-export const legacyPrototypeLicensePayloadReader = {
-  parse(payload: string): LegacyPrototypeLicenseClaims {
-    return JSON.parse(payload) as LegacyPrototypeLicenseClaims;
-  },
-  serializeForVerification(claims: LegacyPrototypeLicenseClaims): string {
-    return JSON.stringify(claims);
-  },
-} as const;
-
-export async function verifyLegacyPrototypeSignedLicense(
-  license: LegacyPrototypeSignedLicense,
-  publicKeySource: LicensePublicKeySource,
-): Promise<LegacyPrototypeLicenseVerificationResult> {
-  if ((license.algorithm as string) !== "ED25519") {
-    return { valid: false, failures: ["invalid-signature"] };
-  }
-  const publicKeyPem = await resolvePublicKey(
-    publicKeySource,
-    license.publicKeyId,
-  );
-  if (!publicKeyPem) {
-    return { valid: false, failures: ["invalid-signature"] };
-  }
-  const valid = await verifyLicensePayloadSignature(
-    legacyPrototypeLicensePayloadReader.serializeForVerification(
-      license.claims,
-    ),
-    license.signature,
-    publicKeyPem,
-  );
-  return valid
-    ? { valid: true, claims: license.claims, failures: [] }
-    : { valid: false, failures: ["invalid-signature"] };
-}
-
-export async function verifyLicensePayloadSignature(
-  payload: string,
-  signatureBase64: string,
-  publicKeyPem: string,
-): Promise<boolean> {
-  let payloadBytes: Uint8Array;
-  let signature: Uint8Array;
-  try {
-    payloadBytes = new TextEncoder().encode(payload);
-    signature = base64ToBytes(signatureBase64);
-  } catch {
-    return false;
-  }
-  const webCryptoResult = await verifyWithWebCrypto(
-    publicKeyPem,
-    signature,
-    payloadBytes,
-  );
-  if (webCryptoResult !== undefined) return webCryptoResult;
-  return verifyWithNodeCrypto(publicKeyPem, signature, payloadBytes);
-}
-
-async function resolvePublicKey(
-  source: LicensePublicKeySource,
-  publicKeyId: string,
-): Promise<string | undefined> {
-  return typeof source === "function"
-    ? source(publicKeyId)
-    : source[publicKeyId];
-}
-
-async function verifyWithWebCrypto(
-  publicKeyPem: string,
-  signature: Uint8Array,
-  payload: Uint8Array,
-): Promise<boolean | undefined> {
-  const subtle = globalThis.crypto?.subtle;
-  if (!subtle) return undefined;
-  try {
-    const algorithm: AlgorithmIdentifier = { name: "Ed25519" };
-    const publicKey = await subtle.importKey(
-      "spki",
-      toArrayBuffer(pemToDer(publicKeyPem)),
-      algorithm,
-      false,
-      ["verify"],
-    );
-    return subtle.verify(
-      algorithm,
-      publicKey,
-      toArrayBuffer(signature),
-      toArrayBuffer(payload),
-    );
-  } catch {
-    return undefined;
-  }
-}
-
-async function verifyWithNodeCrypto(
-  publicKeyPem: string,
-  signature: Uint8Array,
-  payload: Uint8Array,
-): Promise<boolean> {
-  try {
-    const { createPublicKey, verify } = await import("node:crypto");
-    return verify(null, payload, createPublicKey(publicKeyPem), signature);
-  } catch {
-    return false;
-  }
-}
-
-function pemToDer(pem: string): Uint8Array {
-  return base64ToBytes(
-    pem
-      .replace(/-----BEGIN PUBLIC KEY-----/g, "")
-      .replace(/-----END PUBLIC KEY-----/g, "")
-      .replace(/\s+/g, ""),
-  );
-}
-
-function base64ToBytes(value: string): Uint8Array {
-  if (
-    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(
-      value,
-    )
-  ) {
-    throw new Error("无效 Base64");
-  }
-  if (typeof atob === "function") {
-    const binary = atob(value);
-    return Uint8Array.from(binary, (char) => char.charCodeAt(0));
-  }
-  return new Uint8Array(Buffer.from(value, "base64"));
-}
-
-function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
-  return bytes.buffer.slice(
-    bytes.byteOffset,
-    bytes.byteOffset + bytes.byteLength,
-  ) as ArrayBuffer;
-}