harperdb 4.7.0-beta.3 → 4.7.0-beta.4

package/security/certificateVerification.d.ts

@@ -1,87 +0,0 @@
-/**
- * Certificate verification for mTLS authentication
- *
- * This module provides certificate revocation checking for client certificates
- * in mutual TLS (mTLS) connections. Currently supports OCSP (Online Certificate
- * Status Protocol) with the ability to add CRL (Certificate Revocation List) support.
- * Uses a system table, hdb_certificate_cache, for a certificate verification
- * status cache.
- *
- * Default configuration:
- * - Enabled by default when mTLS is configured
- * - Timeout: 5 seconds
- * - Cache TTL: 1 hour (success results)
- * - Error Cache TTL: 5 minutes (error results, for faster recovery)
- * - Failure mode: fail-open (allows connections if verification fails)
- */
-import './pkijs-ed25519-patch.ts';
-interface CertificateVerificationResult {
-    valid: boolean;
-    status: string;
-    cached?: boolean;
-    error?: string;
-    method?: 'ocsp' | 'crl' | 'disabled';
-}
-interface PeerCertificate {
-    subject?: {
-        CN?: string;
-        [key: string]: any;
-    };
-    raw?: Buffer;
-    issuerCertificate?: PeerCertificate;
-}
-interface CertificateVerificationConfig {
-    timeout?: number;
-    cacheTtl?: number;
-    errorCacheTtl?: number;
-    failureMode?: 'fail-open' | 'fail-closed';
-}
-interface CertificateChainEntry {
-    cert: Buffer;
-    issuer?: Buffer;
-}
-/**
- * Determine if certificate verification should be performed based on configuration
- * @param mtlsConfig - The mTLS configuration (can be boolean or object)
- * @returns Configuration object or false if verification is disabled
- */
-export declare function getCertificateVerificationConfig(mtlsConfig: boolean | Record<string, any> | null | undefined): false | CertificateVerificationConfig;
-/**
- * Verify certificate revocation status
- * @param peerCertificate - Peer certificate object from TLS connection
- * @param mtlsConfig - The mTLS configuration from the request
- * @returns Promise resolving to verification result
- */
-export declare function verifyCertificate(peerCertificate: PeerCertificate, mtlsConfig?: boolean | Record<string, any> | null): Promise<CertificateVerificationResult>;
-/**
- * Verify OCSP status of a client certificate
- * @param certPem - Client certificate in PEM format or Buffer
- * @param issuerPem - Issuer (CA) certificate in PEM format or Buffer
- * @param config - Optional configuration object
- * @param config.timeout - OCSP request timeout in milliseconds (default: 5000)
- * @param config.cacheTtl - Cache TTL for successful results in milliseconds (default: 3600000)
- * @param config.errorCacheTtl - Cache TTL for error results in milliseconds (default: 300000)
- * @param config.failureMode - How to handle OCSP failures: 'fail-open' | 'fail-closed' (default: 'fail-open')
- * @returns Promise resolving to verification result
- */
-export declare function verifyOCSP(certPem: Buffer | string, issuerPem: Buffer | string, config?: CertificateVerificationConfig): Promise<CertificateVerificationResult>;
-/**
- * Set TTL configuration for the certificate cache
- * @param ttlConfig - Configuration for cache expiration and eviction
- */
-export declare function setCertificateCacheTTL(ttlConfig: {
-    expiration: number;
-    eviction?: number;
-    scanInterval?: number;
-}): void;
-/**
- * Convert a buffer to PEM format
- */
-export declare function bufferToPem(buffer: Buffer, type: string): string;
-/**
- * Extract certificate chain from peer certificate object
- * @param peerCertificate - Peer certificate object from TLS connection
- * @returns Certificate chain
- */
-export declare function extractCertificateChain(peerCertificate: PeerCertificate): CertificateChainEntry[];
-export {};