effect 4.1.0 → 4.1.1

package/dist/jose/Jwe.js

@@ -0,0 +1,134 @@
+/**
+ * Compact JSON Web Encryption with a shared key: `dir` key management and
+ * A256GCM content encryption.
+ *
+ * The protected header is authenticated as additional data, so changing it
+ * fails decryption. Headers with `crit` or `zip` are rejected.
+ *
+ * Bound untrusted token length before decryption; this module does not impose
+ * a token-size limit.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Aead from "../crypto/Aead.js";
+import * as SecureRandom from "../crypto/SecureRandom.js";
+import * as Effect from "../Effect.js";
+import * as Base64Url from "../encoding/Base64Url.js";
+import * as Redacted from "../Redacted.js";
+import * as Schema from "../Schema.js";
+import { cryptoFailure, decodeHeader, decodeSegment, encodeHeader, invalidToken, split, utf8 } from "./internal/compact.js";
+import * as JoseError from "./JoseError.js";
+/**
+ * Schema for a JWE protected header, including additional JSON-valued
+ * parameters.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export const ProtectedHeader = /*#__PURE__*/Schema.StructWithRest(/*#__PURE__*/Schema.Struct({
+  alg: /*#__PURE__*/Schema.Literal("dir"),
+  enc: /*#__PURE__*/Schema.Literal("A256GCM"),
+  kid: /*#__PURE__*/Schema.optionalKey(Schema.String),
+  typ: /*#__PURE__*/Schema.optionalKey(Schema.String),
+  cty: /*#__PURE__*/Schema.optionalKey(Schema.String)
+}), [/*#__PURE__*/Schema.Record(Schema.String, Schema.Json)]);
+const tagLength = 16;
+const decodeProtectedHeader = /*#__PURE__*/Schema.decodeUnknownOption(ProtectedHeader);
+/**
+ * Encrypts plaintext as a compact JWE with a random 96-bit IV.
+ *
+ * **Example** (Encrypting and decrypting a message)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted } from "effect"
+ * import { Aead, SecureRandom } from "effect/crypto"
+ * import { Jwe, Jwk } from "effect/jose"
+ *
+ * const layer = Aead.layerWebCrypto.pipe(Layer.provideMerge(SecureRandom.layerWebCrypto))
+ *
+ * const plaintext = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "dir"
+ *   )
+ *   const token = yield* Jwe.encrypt(new TextEncoder().encode("private message"), key)
+ *   const decrypted = yield* Jwe.decrypt(token, key)
+ *   return new TextDecoder().decode(decrypted.plaintext)
+ * }).pipe(Effect.provide(layer)))
+ * plaintext // => "private message"
+ * ```
+ *
+ * @see {@link decrypt}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const encrypt = /*#__PURE__*/Effect.fnUntraced(function* (plaintext, key, header) {
+  const protectedHeader = yield* encodeHeader({
+    alg: "dir",
+    enc: "A256GCM"
+  }, key.kid, header, ["crit", "zip"]);
+  const random = yield* SecureRandom.SecureRandom;
+  const aead = yield* Aead.Aead;
+  const nonce = yield* random.randomBytes(Aead.aes256Gcm.nonceLength);
+  const sealed = yield* aead.encrypt(key.key, plaintext, {
+    nonce,
+    aad: utf8(protectedHeader)
+  }).pipe(Effect.mapError(cryptoFailure("Could not encrypt with the key")));
+  const ciphertext = Base64Url.encode(sealed.subarray(0, -tagLength));
+  const tag = Base64Url.encode(sealed.subarray(-tagLength));
+  return Redacted.make(`${protectedHeader}..${Base64Url.encode(nonce)}.${ciphertext}.${tag}`);
+});
+/**
+ * Decrypts a compact `dir`/A256GCM JWE and authenticates its protected
+ * header.
+ *
+ * **Details**
+ *
+ * Accepts a key or an effectful resolver for key rotation. The token's
+ * structure and supported header parameters are checked before the resolver
+ * runs. Resolver failures and service requirements are preserved.
+ *
+ * **Gotchas**
+ *
+ * The resolver receives an unauthenticated header and must use it only for
+ * key selection.
+ *
+ * @see {@link encrypt}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const decrypt = /*#__PURE__*/Effect.fnUntraced(function* (token, key) {
+  const [header, encryptedKey, iv, ciphertext, tag] = yield* split(token, 5);
+  if (encryptedKey !== "") return yield* invalidToken("A dir token must have an empty encrypted key");
+  const protectedHeader = yield* decodeHeader(header, decodeProtectedHeader, ["crit", "zip"]);
+  const nonce = decodeSegment(iv);
+  const data = decodeSegment(ciphertext);
+  const authTag = decodeSegment(tag);
+  if (nonce === undefined || data === undefined || authTag === undefined || nonce.length !== Aead.aes256Gcm.nonceLength || authTag.length !== tagLength) {
+    return yield* invalidToken("The IV, ciphertext, or tag is malformed");
+  }
+  const resolvedKey = typeof key === "function" ? yield* key(protectedHeader) : key;
+  const sealed = new Uint8Array(data.length + tagLength);
+  sealed.set(data);
+  sealed.set(authTag, data.length);
+  const aead = yield* Aead.Aead;
+  const plaintext = yield* aead.decrypt(resolvedKey.key, sealed, {
+    nonce,
+    aad: utf8(header)
+  }).pipe(Effect.mapError(error => error.reason._tag === "DecryptionFailed" ? new JoseError.JoseError({
+    reason: new JoseError.DecryptionFailed()
+  }) : cryptoFailure("Could not decrypt with the key")(error)));
+  return {
+    protectedHeader,
+    plaintext,
+    key: resolvedKey
+  };
+});
+//# sourceMappingURL=Jwe.js.map

package/dist/jose/Jwe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwe.js","names":[],"sources":["../../src/jose/Jwe.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;AAaA,OAAO,KAAK,IAAI,MAAM,mBAAmB;AACzC,OAAO,KAAK,YAAY,MAAM,2BAA2B;AACzD,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,OAAO,KAAK,SAAS,MAAM,0BAA0B;AACrD,OAAO,KAAK,QAAQ,MAAM,gBAAgB;AAC1C,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,SACE,aAAa,EACb,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,IAAI,QACC,uBAAuB;AAC9B,OAAO,KAAK,SAAS,MAAM,gBAAgB;AAG3C;;;;;;;;AAQA,OAAO,MAAM,eAAe,gBAAG,MAAM,CAAC,cAAc,cAClD,MAAM,CAAC,MAAM,CAAC;EACZ,GAAG,eAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;EAC1B,GAAG,eAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;EAC9B,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;CACtC,CAAC,EACF,cAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAC5C;AA2CD,MAAM,SAAS,GAAG,EAAE;AAEpB,MAAM,qBAAqB,gBAAG,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BA,OAAO,MAAM,OAAO,gBAAG,MAAM,CAAC,UAAU,CAAC,WAGvC,SAAqB,EACrB,GAAqB,EACrB,MAAmB;EAEnB,MAAM,eAAe,GAAG,OAAO,YAAY,CAAC;IAAE,GAAG,EAAE,KAAK;IAAE,GAAG,EAAE;EAAS,CAAE,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;EAC7G,MAAM,MAAM,GAAG,OAAO,YAAY,CAAC,YAAY;EAC/C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI;EAC7B,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;EACnE,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE;IAAE,KAAK;IAAE,GAAG,EAAE,IAAI,CAAC,eAAe;EAAC,CAAE,CAAC,CAAC,IAAI,CAChG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAgC,CAAC,CAAC,CACjE;EACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;EACnE,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC;EACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;AAC7F,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;AAqBA,OAAO,MAAM,OAAO,gBAAG,MAAM,CAAC,UAAU,CAAC,WACvC,KAAyC,EACzC,GAA4F;EAE5F,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;EAC1E,IAAI,YAAY,KAAK,EAAE,EAAE,OAAO,OAAO,YAAY,CAAC,8CAA8C,CAAC;EACnG,MAAM,eAAe,GAAG,OAAO,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;EAC3F,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,CAAC;EAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC;EACtC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC;EAClC,IACE,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAClE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAC3E;IACA,OAAO,OAAO,YAAY,CAAC,yCAAyC,CAAC;EACvE;EACA,MAAM,WAAW,GAAG,OAAO,GAAG,KAAK,UAAU,GAAG,OAAO,GAAG,CAAC,eAAe,CAAC,GAAG,GAAG;EACjF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;EACtD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;EAChB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;EAChC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI;EAC7B,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE;IAAE,KAAK;IAAE,GAAG,EAAE,IAAI,CAAC,MAAM;EAAC,CAAE,CAAC,CAAC,IAAI,CAC/F,MAAM,CAAC,QAAQ,CAAE,KAAK,IACpB,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,GACpC,IAAI,SAAS,CAAC,SAAS,CAAC;IAAE,MAAM,EAAE,IAAI,SAAS,CAAC,gBAAgB;EAAE,CAAE,CAAC,GACrE,aAAa,CAAC,gCAAgC,CAAC,CAAC,KAAK,CAAC,CAC3D,CACF;EACD,OAAO;IAAE,eAAe;IAAE,SAAS;IAAE,GAAG,EAAE;EAAW,CAAE;AACzD,CAAC,CAAC","ignoreList":[]}