harperdb 4.6.5 → 4.7.0-alpha.1

package/security/certificateVerification.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Certificate verification for mTLS authentication
+ *
+ * This module provides certificate revocation checking for client certificates
+ * in mutual TLS (mTLS) connections. Currently supports OCSP (Online Certificate
+ * Status Protocol) with the ability to add CRL (Certificate Revocation List) support.
+ * Uses a system table, hdb_certificate_cache, for a certificate verification
+ * status cache.
+ *
+ * Default configuration:
+ * - Enabled by default when mTLS is configured
+ * - Timeout: 5 seconds
+ * - Cache TTL: 1 hour
+ * - Failure mode: fail-open (allows connections if verification fails)
+ */
+import './pkijs-ed25519-patch.ts';
+interface CertificateVerificationResult {
+    valid: boolean;
+    status: string;
+    cached?: boolean;
+    error?: string;
+    method?: 'ocsp' | 'crl' | 'disabled';
+}
+interface PeerCertificate {
+    subject?: {
+        CN?: string;
+        [key: string]: any;
+    };
+    raw?: Buffer;
+    issuerCertificate?: PeerCertificate;
+}
+interface CertificateVerificationConfig {
+    timeout?: number;
+    cacheTtl?: number;
+    failureMode?: 'fail-open' | 'fail-closed';
+}
+interface CertificateChainEntry {
+    cert: Buffer;
+    issuer?: Buffer;
+}
+/**
+ * Determine if certificate verification should be performed based on configuration
+ * @param mtlsConfig - The mTLS configuration (can be boolean or object)
+ * @returns Configuration object or false if verification is disabled
+ */
+export declare function getCertificateVerificationConfig(mtlsConfig: boolean | Record<string, any> | null | undefined): false | CertificateVerificationConfig;
+/**
+ * Verify certificate revocation status
+ * @param peerCertificate - Peer certificate object from TLS connection
+ * @param mtlsConfig - The mTLS configuration from the request
+ * @returns Promise resolving to verification result
+ */
+export declare function verifyCertificate(peerCertificate: PeerCertificate, mtlsConfig?: boolean | Record<string, any> | null): Promise<CertificateVerificationResult>;
+/**
+ * Verify OCSP status of a client certificate
+ * @param certPem - Client certificate in PEM format or Buffer
+ * @param issuerPem - Issuer (CA) certificate in PEM format or Buffer
+ * @returns Promise resolving to verification result
+ */
+export declare function verifyOCSP(certPem: Buffer | string, issuerPem: Buffer | string, config?: CertificateVerificationConfig): Promise<CertificateVerificationResult>;
+/**
+ * Set TTL configuration for the certificate cache
+ * @param ttlConfig - Configuration for cache expiration and eviction
+ */
+export declare function setCertificateCacheTTL(ttlConfig: {
+    expiration: number;
+    eviction?: number;
+    scanInterval?: number;
+}): void;
+/**
+ * Convert a buffer to PEM format
+ */
+export declare function bufferToPem(buffer: Buffer, type: string): string;
+/**
+ * Extract certificate chain from peer certificate object
+ * @param peerCertificate - Peer certificate object from TLS connection
+ * @returns Certificate chain
+ */
+export declare function extractCertificateChain(peerCertificate: PeerCertificate): CertificateChainEntry[];
+export {};

package/security/pkijs-ed25519-patch.d.ts

@@ -0,0 +1,14 @@
+/**
+ * PKI.js Ed25519/Ed448 Support Patch
+ *
+ * This module patches PKI.js to add complete Ed25519/Ed448 support for certificate
+ * and OCSP response verification. While PKI.js has some Ed25519/Ed448 support,
+ * it currently lacks:
+ * - getHashAlgorithm() support for Ed25519/Ed448 OIDs
+ * - getAlgorithmByOID() recognition of Ed25519/Ed448
+ * - Certificate verification using Ed25519/Ed448 signatures
+ * - OCSP response signature verification with Ed25519/Ed448
+ *
+ * This patch must be loaded before any module that uses PKI.js (including easy-ocsp).
+ */
+export declare function applyEd25519Patch(): void;