effect 4.0.7 → 4.1.1

package/dist/jose/Jwe.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Compact JSON Web Encryption with a shared key: `dir` key management and
+ * A256GCM content encryption.
+ *
+ * The protected header is authenticated as additional data, so changing it
+ * fails decryption. Headers with `crit` or `zip` are rejected.
+ *
+ * Bound untrusted token length before decryption; this module does not impose
+ * a token-size limit.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Aead from "../crypto/Aead.ts";
+import * as SecureRandom from "../crypto/SecureRandom.ts";
+import * as Effect from "../Effect.ts";
+import * as Redacted from "../Redacted.ts";
+import * as Schema from "../Schema.ts";
+import * as JoseError from "./JoseError.ts";
+import type { SecretKey } from "./Jwk.ts";
+/**
+ * Schema for a JWE protected header, including additional JSON-valued
+ * parameters.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export declare const ProtectedHeader: Schema.StructWithRest<Schema.Struct<{
+    readonly alg: Schema.Literal<"dir">;
+    readonly enc: Schema.Literal<"A256GCM">;
+    readonly kid: Schema.optionalKey<Schema.String>;
+    readonly typ: Schema.optionalKey<Schema.String>;
+    readonly cty: Schema.optionalKey<Schema.String>;
+}>, readonly [Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>]>;
+/**
+ * A JWE protected header. It is authenticated only after decryption succeeds.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export type ProtectedHeader = typeof ProtectedHeader.Type;
+/**
+ * Standard header parameters to protect. Encryption also accepts additional
+ * JSON-valued parameters. `alg` and `enc` are fixed and `kid` defaults to the
+ * key's.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Header {
+    readonly alg?: never;
+    readonly enc?: never;
+    readonly crit?: never;
+    readonly zip?: never;
+    readonly kid?: string | undefined;
+    readonly typ?: string | undefined;
+    readonly cty?: string | undefined;
+}
+/**
+ * The protected header, plaintext, and key used to decrypt a JWE.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Decrypted {
+    readonly protectedHeader: ProtectedHeader;
+    readonly plaintext: Uint8Array;
+    readonly key: SecretKey<"dir">;
+}
+/**
+ * Encrypts plaintext as a compact JWE with a random 96-bit IV.
+ *
+ * **Example** (Encrypting and decrypting a message)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted } from "effect"
+ * import { Aead, SecureRandom } from "effect/crypto"
+ * import { Jwe, Jwk } from "effect/jose"
+ *
+ * const layer = Aead.layerWebCrypto.pipe(Layer.provideMerge(SecureRandom.layerWebCrypto))
+ *
+ * const plaintext = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "dir"
+ *   )
+ *   const token = yield* Jwe.encrypt(new TextEncoder().encode("private message"), key)
+ *   const decrypted = yield* Jwe.decrypt(token, key)
+ *   return new TextDecoder().decode(decrypted.plaintext)
+ * }).pipe(Effect.provide(layer)))
+ * plaintext // => "private message"
+ * ```
+ *
+ * @see {@link decrypt}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const encrypt: <H extends object & { readonly [P in keyof H]: Schema.Json | undefined; } = Header>(plaintext: Uint8Array<ArrayBufferLike>, key: SecretKey<"dir">, header?: (Header & H) | undefined) => Effect.Effect<Redacted.Redacted<string>, JoseError.JoseError, Aead.Aead | SecureRandom.SecureRandom>;
+/**
+ * Decrypts a compact `dir`/A256GCM JWE and authenticates its protected
+ * header.
+ *
+ * **Details**
+ *
+ * Accepts a key or an effectful resolver for key rotation. The token's
+ * structure and supported header parameters are checked before the resolver
+ * runs. Resolver failures and service requirements are preserved.
+ *
+ * **Gotchas**
+ *
+ * The resolver receives an unauthenticated header and must use it only for
+ * key selection.
+ *
+ * @see {@link encrypt}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const decrypt: <E = never, R = never>(token: string | Redacted.Redacted<string>, key: SecretKey<"dir"> | ((header: ProtectedHeader) => Effect.Effect<SecretKey<"dir">, E, R>)) => Effect.Effect<Decrypted, E | JoseError.JoseError, R | Aead.Aead>;
+//# sourceMappingURL=Jwe.d.ts.map

package/dist/jose/Jwe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwe.d.ts","sourceRoot":"","sources":["../../src/jose/Jwe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,YAAY,MAAM,2BAA2B,CAAA;AACzD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAEtC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAUtC,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;mGAS3B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;CAC/B;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,OAAO,GAClB,CAAC,SAAS,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,SAAS,GAAE,oNAgBvE,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,OAAO,GAA+B,CAAC,UAAU,CAAC,uFAE3B,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,sEA2B3F,CAAA"}

package/dist/jose/Jwe.js

@@ -0,0 +1,134 @@
+/**
+ * Compact JSON Web Encryption with a shared key: `dir` key management and
+ * A256GCM content encryption.
+ *
+ * The protected header is authenticated as additional data, so changing it
+ * fails decryption. Headers with `crit` or `zip` are rejected.
+ *
+ * Bound untrusted token length before decryption; this module does not impose
+ * a token-size limit.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Aead from "../crypto/Aead.js";
+import * as SecureRandom from "../crypto/SecureRandom.js";
+import * as Effect from "../Effect.js";
+import * as Base64Url from "../encoding/Base64Url.js";
+import * as Redacted from "../Redacted.js";
+import * as Schema from "../Schema.js";
+import { cryptoFailure, decodeHeader, decodeSegment, encodeHeader, invalidToken, split, utf8 } from "./internal/compact.js";
+import * as JoseError from "./JoseError.js";
+/**
+ * Schema for a JWE protected header, including additional JSON-valued
+ * parameters.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export const ProtectedHeader = /*#__PURE__*/Schema.StructWithRest(/*#__PURE__*/Schema.Struct({
+  alg: /*#__PURE__*/Schema.Literal("dir"),
+  enc: /*#__PURE__*/Schema.Literal("A256GCM"),
+  kid: /*#__PURE__*/Schema.optionalKey(Schema.String),
+  typ: /*#__PURE__*/Schema.optionalKey(Schema.String),
+  cty: /*#__PURE__*/Schema.optionalKey(Schema.String)
+}), [/*#__PURE__*/Schema.Record(Schema.String, Schema.Json)]);
+const tagLength = 16;
+const decodeProtectedHeader = /*#__PURE__*/Schema.decodeUnknownOption(ProtectedHeader);
+/**
+ * Encrypts plaintext as a compact JWE with a random 96-bit IV.
+ *
+ * **Example** (Encrypting and decrypting a message)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted } from "effect"
+ * import { Aead, SecureRandom } from "effect/crypto"
+ * import { Jwe, Jwk } from "effect/jose"
+ *
+ * const layer = Aead.layerWebCrypto.pipe(Layer.provideMerge(SecureRandom.layerWebCrypto))
+ *
+ * const plaintext = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "dir"
+ *   )
+ *   const token = yield* Jwe.encrypt(new TextEncoder().encode("private message"), key)
+ *   const decrypted = yield* Jwe.decrypt(token, key)
+ *   return new TextDecoder().decode(decrypted.plaintext)
+ * }).pipe(Effect.provide(layer)))
+ * plaintext // => "private message"
+ * ```
+ *
+ * @see {@link decrypt}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const encrypt = /*#__PURE__*/Effect.fnUntraced(function* (plaintext, key, header) {
+  const protectedHeader = yield* encodeHeader({
+    alg: "dir",
+    enc: "A256GCM"
+  }, key.kid, header, ["crit", "zip"]);
+  const random = yield* SecureRandom.SecureRandom;
+  const aead = yield* Aead.Aead;
+  const nonce = yield* random.randomBytes(Aead.aes256Gcm.nonceLength);
+  const sealed = yield* aead.encrypt(key.key, plaintext, {
+    nonce,
+    aad: utf8(protectedHeader)
+  }).pipe(Effect.mapError(cryptoFailure("Could not encrypt with the key")));
+  const ciphertext = Base64Url.encode(sealed.subarray(0, -tagLength));
+  const tag = Base64Url.encode(sealed.subarray(-tagLength));
+  return Redacted.make(`${protectedHeader}..${Base64Url.encode(nonce)}.${ciphertext}.${tag}`);
+});
+/**
+ * Decrypts a compact `dir`/A256GCM JWE and authenticates its protected
+ * header.
+ *
+ * **Details**
+ *
+ * Accepts a key or an effectful resolver for key rotation. The token's
+ * structure and supported header parameters are checked before the resolver
+ * runs. Resolver failures and service requirements are preserved.
+ *
+ * **Gotchas**
+ *
+ * The resolver receives an unauthenticated header and must use it only for
+ * key selection.
+ *
+ * @see {@link encrypt}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const decrypt = /*#__PURE__*/Effect.fnUntraced(function* (token, key) {
+  const [header, encryptedKey, iv, ciphertext, tag] = yield* split(token, 5);
+  if (encryptedKey !== "") return yield* invalidToken("A dir token must have an empty encrypted key");
+  const protectedHeader = yield* decodeHeader(header, decodeProtectedHeader, ["crit", "zip"]);
+  const nonce = decodeSegment(iv);
+  const data = decodeSegment(ciphertext);
+  const authTag = decodeSegment(tag);
+  if (nonce === undefined || data === undefined || authTag === undefined || nonce.length !== Aead.aes256Gcm.nonceLength || authTag.length !== tagLength) {
+    return yield* invalidToken("The IV, ciphertext, or tag is malformed");
+  }
+  const resolvedKey = typeof key === "function" ? yield* key(protectedHeader) : key;
+  const sealed = new Uint8Array(data.length + tagLength);
+  sealed.set(data);
+  sealed.set(authTag, data.length);
+  const aead = yield* Aead.Aead;
+  const plaintext = yield* aead.decrypt(resolvedKey.key, sealed, {
+    nonce,
+    aad: utf8(header)
+  }).pipe(Effect.mapError(error => error.reason._tag === "DecryptionFailed" ? new JoseError.JoseError({
+    reason: new JoseError.DecryptionFailed()
+  }) : cryptoFailure("Could not decrypt with the key")(error)));
+  return {
+    protectedHeader,
+    plaintext,
+    key: resolvedKey
+  };
+});
+//# sourceMappingURL=Jwe.js.map

package/dist/jose/Jwe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwe.js","names":[],"sources":["../../src/jose/Jwe.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;AAaA,OAAO,KAAK,IAAI,MAAM,mBAAmB;AACzC,OAAO,KAAK,YAAY,MAAM,2BAA2B;AACzD,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,OAAO,KAAK,SAAS,MAAM,0BAA0B;AACrD,OAAO,KAAK,QAAQ,MAAM,gBAAgB;AAC1C,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,SACE,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,IAAI,QACC,uBAAuB;AAC9B,OAAO,KAAK,SAAS,MAAM,gBAAgB;AAG3C;;;;;;;;AAQA,OAAO,MAAM,eAAe,gBAAG,MAAM,CAAC,cAAc,cAClD,MAAM,CAAC,MAAM,CAAC;EACZ,GAAG,eAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;EAC1B,GAAG,eAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;EAC9B,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;CACtC,CAAC,EACF,cAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAC5C;AA2CD,MAAM,SAAS,GAAG,EAAE;AAEpB,MAAM,qBAAqB,gBAAG,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,OAAO,MAAM,OAAO,gBAAG,MAAM,CAAC,UAAU,CAAC,WAGvC,SAAqB,EACrB,GAAqB,EACrB,MAAmB;EAEnB,MAAM,eAAe,GAAG,OAAO,YAAY,CAAC;IAAE,GAAG,EAAE,KAAK;IAAE,GAAG,EAAE;EAAS,CAAE,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;EAC7G,MAAM,MAAM,GAAG,OAAO,YAAY,CAAC,YAAY;EAC/C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI;EAC7B,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;EACnE,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE;IAAE,KAAK;IAAE,GAAG,EAAE,IAAI,CAAC,eAAe;EAAC,CAAE,CAAC,CAAC,IAAI,CAChG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CACjE;EACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;EACnE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC;EACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;AAC7F,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;AAqBA,OAAO,MAAM,OAAO,gBAAG,MAAM,CAAC,UAAU,CAAC,WACvC,KAAyC,EACzC,GAA4F;EAE5F,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;EAC1E,IAAI,YAAY,KAAK,EAAE,EAAE,OAAO,OAAO,YAAY,CAAC,8CAA8C,CAAC;EACnG,MAAM,eAAe,GAAG,OAAO,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;EAC3F,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC;EAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC;EACtC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC;EAClC,IACE,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAClE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAC3E;IACA,OAAO,OAAO,YAAY,CAAC,yCAAyC,CAAC;EACvE;EACA,MAAM,WAAW,GAAG,OAAO,GAAG,KAAK,UAAU,GAAG,OAAO,GAAG,CAAC,eAAe,CAAC,GAAG,GAAG;EACjF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;EACtD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;EAChB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;EAChC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI;EAC7B,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE;IAAE,KAAK;IAAE,GAAG,EAAE,IAAI,CAAC,MAAM;EAAC,CAAE,CAAC,CAAC,IAAI,CAC/F,MAAM,CAAC,QAAQ,CAAE,KAAK,IACpB,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,GACpC,IAAI,SAAS,CAAC,SAAS,CAAC;IAAE,MAAM,EAAE,IAAI,SAAS,CAAC,gBAAgB;EAAE,CAAE,CAAC,GACrE,aAAa,CAAC,gCAAgC,CAAC,CAAC,KAAK,CAAC,CAC3D,CACF;EACD,OAAO;IAAE,eAAe;IAAE,SAAS;IAAE,GAAG,EAAE;EAAW,CAAE;AACzD,CAAC,CAAC","ignoreList":[]}