cuonztech-privacy-chaos-gate 0.1.0 → 0.2.0

package/dist/chunk-FN3QUFUZ.js

@@ -0,0 +1,36 @@
+// src/core/license/ed25519.ts
+import crypto from "crypto";
+
+// src/core/license/publicKey.ts
+var LICENSE_PUBLIC_KEY = "q20XyLRZGURVvMLR6q0SCIc6poLhW73KE5Ds94Yq1FQ=";
+
+// src/core/license/ed25519.ts
+var PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+var SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function rawKey(b64, what) {
+  const raw = Buffer.from(b64, "base64");
+  if (raw.length !== 32) throw new Error(`${what}: erwartet 32 Byte (base64), erhalten ${raw.length}`);
+  return raw;
+}
+function defaultPublicKey() {
+  return process.env.CPCG_LICENSE_PUBLIC_KEY || LICENSE_PUBLIC_KEY;
+}
+function verifyEd25519(domain, payload, sigB64url, publicKeyB64 = defaultPublicKey()) {
+  try {
+    const key = crypto.createPublicKey({
+      key: Buffer.concat([SPKI_PREFIX, rawKey(publicKeyB64, "Public Key")]),
+      format: "der",
+      type: "spki"
+    });
+    const sig = Buffer.from(sigB64url, "base64url");
+    return sig.length === 64 && crypto.verify(null, Buffer.from(`${domain}.${payload}`), key, sig);
+  } catch {
+    return false;
+  }
+}
+
+export {
+  defaultPublicKey,
+  verifyEd25519
+};
+//# sourceMappingURL=chunk-FN3QUFUZ.js.map

package/dist/chunk-FN3QUFUZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/license/ed25519.ts","../src/core/license/publicKey.ts"],"sourcesContent":["import crypto from \"node:crypto\";\nimport { LICENSE_PUBLIC_KEY } from \"./publicKey.js\";\n\n/**\n * Ed25519-Signaturen für Lizenzen und Grants.\n *\n * Der Server signiert mit dem privaten Seed (nur in config.php / KeePass),\n * der Client prüft ausschliesslich mit dem öffentlichen Schlüssel. Wer das CLI\n * besitzt, kann damit nichts ausstellen. Schlüssel sind rohe 32 Byte, base64.\n *\n * Jeder Token-Typ signiert mit eigenem Domain-Präfix, damit eine Lizenz-\n * Signatur nie als Grant (oder umgekehrt) durchgeht.\n */\nexport type SignDomain = \"cpcg-license-v1\" | \"cpcg-grant-v1\";\n\nconst PKCS8_PREFIX = Buffer.from(\"302e020100300506032b657004220420\", \"hex\");\nconst SPKI_PREFIX = Buffer.from(\"302a300506032b6570032100\", \"hex\");\n\nfunction rawKey(b64: string, what: string): Buffer {\n  const raw = Buffer.from(b64, \"base64\");\n  if (raw.length !== 32) throw new Error(`${what}: erwartet 32 Byte (base64), erhalten ${raw.length}`);\n  return raw;\n}\n\nexport function generateLicenseKeyPair(): { seed: string; publicKey: string } {\n  const { privateKey, publicKey } = crypto.generateKeyPairSync(\"ed25519\");\n  return {\n    seed: privateKey.export({ format: \"der\", type: \"pkcs8\" }).subarray(-32).toString(\"base64\"),\n    publicKey: publicKey.export({ format: \"der\", type: \"spki\" }).subarray(-32).toString(\"base64\"),\n  };\n}\n\nexport function signEd25519(domain: SignDomain, payload: string, seedB64: string): string {\n  const key = crypto.createPrivateKey({\n    key: Buffer.concat([PKCS8_PREFIX, rawKey(seedB64, \"CPCG_LICENSE_SIGNING_SEED\")]),\n    format: \"der\",\n    type: \"pkcs8\",\n  });\n  return crypto.sign(null, Buffer.from(`${domain}.${payload}`), key).toString(\"base64url\");\n}\n\n/** Öffentlicher Schlüssel: CPCG_LICENSE_PUBLIC_KEY (Tests, Self-Hosting) vor dem eingebetteten. */\nexport function defaultPublicKey(): string {\n  return process.env.CPCG_LICENSE_PUBLIC_KEY || LICENSE_PUBLIC_KEY;\n}\n\nexport function verifyEd25519(\n  domain: SignDomain,\n  payload: string,\n  sigB64url: string,\n  publicKeyB64: string = defaultPublicKey()\n): boolean {\n  try {\n    const key = crypto.createPublicKey({\n      key: Buffer.concat([SPKI_PREFIX, rawKey(publicKeyB64, \"Public Key\")]),\n      format: \"der\",\n      type: \"spki\",\n    });\n    const sig = Buffer.from(sigB64url, \"base64url\");\n    return sig.length === 64 && crypto.verify(null, Buffer.from(`${domain}.${payload}`), key, sig);\n  } catch {\n    return false;\n  }\n}\n","/**\n * Öffentlicher Ed25519-Schlüssel des Cuonztech-Lizenzdienstes (32 Byte, base64).\n * Der zugehörige private Seed liegt nur serverseitig (config.php) und im KeePass.\n */\nexport const LICENSE_PUBLIC_KEY = \"q20XyLRZGURVvMLR6q0SCIc6poLhW73KE5Ds94Yq1FQ=\";\n"],"mappings":";AAAA,OAAO,YAAY;;;ACIZ,IAAM,qBAAqB;;;ADWlC,IAAM,eAAe,OAAO,KAAK,oCAAoC,KAAK;AAC1E,IAAM,cAAc,OAAO,KAAK,4BAA4B,KAAK;AAEjE,SAAS,OAAO,KAAa,MAAsB;AACjD,QAAM,MAAM,OAAO,KAAK,KAAK,QAAQ;AACrC,MAAI,IAAI,WAAW,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,yCAAyC,IAAI,MAAM,EAAE;AACnG,SAAO;AACT;AAoBO,SAAS,mBAA2B;AACzC,SAAO,QAAQ,IAAI,2BAA2B;AAChD;AAEO,SAAS,cACd,QACA,SACA,WACA,eAAuB,iBAAiB,GAC/B;AACT,MAAI;AACF,UAAM,MAAM,OAAO,gBAAgB;AAAA,MACjC,KAAK,OAAO,OAAO,CAAC,aAAa,OAAO,cAAc,YAAY,CAAC,CAAC;AAAA,MACpE,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,UAAM,MAAM,OAAO,KAAK,WAAW,WAAW;AAC9C,WAAO,IAAI,WAAW,MAAM,OAAO,OAAO,MAAM,OAAO,KAAK,GAAG,MAAM,IAAI,OAAO,EAAE,GAAG,KAAK,GAAG;AAAA,EAC/F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}