knodin 0.7.6 → 0.8.2

package/dist/src/update-ceremony.js

@@ -0,0 +1,162 @@
+import { createHash, createPublicKey } from "node:crypto";
+import { compareBytes } from "./compare.js";
+import { canonicalizeUpdateMetadata, verifyUpdateRootChain, } from "./update-trust.js";
+const SHA256 = /^[0-9a-f]{64}$/;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{2,63}$/;
+function exactKeys(value, expected, label) {
+    const actual = Object.keys(value).sort(compareBytes);
+    const wanted = [...expected].sort(compareBytes);
+    if (actual.join("\0") !== wanted.join("\0"))
+        throw new Error(`${label} contains missing or unknown fields`);
+}
+function rejectPrivateMaterial(value, path = "input") {
+    if (typeof value === "string" && /PRIVATE KEY|recovery secret|seed phrase/i.test(value))
+        throw new Error(`${path} contains private material`);
+    if (!value || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (/private|secret|seed|mnemonic|password|token/i.test(key))
+            throw new Error(`${path}.${key} is forbidden`);
+        rejectPrivateMaterial(child, `${path}.${key}`);
+    }
+}
+export function validateRootCeremonyManifest(value) {
+    rejectPrivateMaterial(value);
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("manifest must be an object");
+    const manifest = value;
+    exactKeys(manifest, [
+        "schemaVersion",
+        "ceremonyId",
+        "purpose",
+        "productionActivation",
+        "custodians",
+        "roleKeyIds",
+        "thresholds",
+    ], "manifest");
+    if (manifest.schemaVersion !== 1 ||
+        !ID.test(manifest.ceremonyId) ||
+        !["rehearsal", "production"].includes(manifest.purpose) ||
+        manifest.productionActivation !== false)
+        throw new Error("invalid fail-closed ceremony header");
+    if (!Array.isArray(manifest.custodians) ||
+        manifest.custodians.length < 3 ||
+        new Set(manifest.custodians.map((c) => c.id)).size !== manifest.custodians.length ||
+        manifest.custodians.some((c) => {
+            exactKeys(c, c.role === "root-signer"
+                ? ["id", "role", "publicKeyId"]
+                : ["id", "role", "recoveryKeyIds", "evidenceId"], "custodian");
+            return (!ID.test(c.id) ||
+                !["root-signer", "recovery"].includes(c.role) ||
+                (c.role === "root-signer" && !SHA256.test(c.publicKeyId ?? "")) ||
+                (c.role === "recovery" &&
+                    (!ID.test(c.evidenceId ?? "") ||
+                        !Array.isArray(c.recoveryKeyIds) ||
+                        c.recoveryKeyIds.some((id) => !SHA256.test(id)))));
+        }))
+        throw new Error("at least three distinct named custodians are required");
+    const roles = ["root", "targets", "snapshot", "timestamp"];
+    exactKeys(manifest.roleKeyIds, roles, "roleKeyIds");
+    exactKeys(manifest.thresholds, roles, "thresholds");
+    const all = new Set();
+    for (const role of roles) {
+        const ids = manifest.roleKeyIds?.[role];
+        const threshold = manifest.thresholds?.[role];
+        if (!Array.isArray(ids) ||
+            ids.length === 0 ||
+            ids.some((id) => !SHA256.test(id) || all.has(id)))
+            throw new Error("role keys must be valid and disjoint");
+        for (const id of ids)
+            all.add(id);
+        if (!Number.isInteger(threshold) ||
+            threshold < (role === "root" || role === "targets" ? 2 : 1) ||
+            threshold > ids.length)
+            throw new Error(`invalid ${role} threshold`);
+    }
+    if (manifest.custodians.filter((c) => c.role === "root-signer").length < manifest.thresholds.root ||
+        !manifest.custodians.some((c) => c.role === "recovery"))
+        throw new Error("custodian roles do not satisfy threshold and recovery separation");
+    const assigned = manifest.custodians
+        .filter((c) => c.role === "root-signer")
+        .map((c) => c.publicKeyId)
+        // `publicKeyId` is optional on the type but validated present for every
+        // root-signer above; `sort` also never passes undefined to a comparator.
+        .sort((left, right) => compareBytes(left ?? "", right ?? ""));
+    if (assigned.join("\0") !== [...manifest.roleKeyIds.root].sort(compareBytes).join("\0"))
+        throw new Error("root signer assignments must exactly match root role keys");
+    const recovery = manifest.custodians.filter((c) => c.role === "recovery");
+    if (recovery.length < manifest.thresholds.root ||
+        new Set(recovery.map((c) => c.evidenceId)).size !== recovery.length ||
+        recovery.some((c) => !c.recoveryKeyIds?.length ||
+            new Set(c.recoveryKeyIds).size !== c.recoveryKeyIds.length ||
+            c.recoveryKeyIds.length >= manifest.thresholds.root))
+        throw new Error("recovery sets must preserve root threshold independence");
+    const recovered = new Set(recovery.flatMap((c) => c.recoveryKeyIds ?? []));
+    if (manifest.roleKeyIds.root.some((id) => !recovered.has(id)))
+        throw new Error("recovery assignments must cover every root role key");
+    return manifest;
+}
+export function validateRootPinReviewReceipt(value, manifest) {
+    rejectPrivateMaterial(value);
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("receipt must be an object");
+    const receipt = value;
+    exactKeys(receipt, [
+        "schemaVersion",
+        "ceremonyId",
+        "rootEnvelopeSha256",
+        "reviewerId",
+        "reviewedAt",
+        "decision",
+        "authentication",
+        "productionActivation",
+    ], "receipt");
+    if (receipt.schemaVersion !== 1 ||
+        receipt.ceremonyId !== manifest.ceremonyId ||
+        !SHA256.test(receipt.rootEnvelopeSha256) ||
+        !ID.test(receipt.reviewerId) ||
+        manifest.custodians.some((c) => c.id === receipt.reviewerId) ||
+        receipt.decision !== "approved" ||
+        receipt.authentication !== "rehearsal-unsigned" ||
+        receipt.productionActivation !== false ||
+        !Number.isFinite(Date.parse(receipt.reviewedAt)) ||
+        new Date(receipt.reviewedAt).toISOString() !== receipt.reviewedAt)
+        throw new Error("invalid or non-independent pin-review receipt");
+    return receipt;
+}
+export function preparePublicRootImport(envelope, pin, manifestValue, receiptValue, now = new Date()) {
+    rejectPrivateMaterial(envelope, "rootEnvelope");
+    const manifest = validateRootCeremonyManifest(manifestValue);
+    if (manifest.purpose === "production")
+        throw new Error("production import requires externally authenticated review and remains blocked");
+    const receipt = validateRootPinReviewReceipt(receiptValue, manifest);
+    if (Date.parse(receipt.reviewedAt) > now.getTime())
+        throw new Error("pin-review receipt cannot be future-dated");
+    const roles = ["root", "targets", "snapshot", "timestamp"];
+    for (const role of roles) {
+        const expected = manifest.roleKeyIds[role];
+        const actual = envelope.signed.roles[role];
+        if (actual.threshold !== manifest.thresholds[role] ||
+            [...actual.keyids].sort(compareBytes).join("\0") !==
+                [...expected].sort(compareBytes).join("\0"))
+            throw new Error(`manifest ${role} role does not match root envelope`);
+    }
+    for (const key of Object.values(envelope.signed.keys)) {
+        let canonical = "";
+        try {
+            canonical = createPublicKey(key.keyval.public)
+                .export({ type: "spki", format: "pem" })
+                .toString();
+        }
+        catch {
+            /* fail below */
+        }
+        if (canonical !== key.keyval.public)
+            throw new Error("root envelope keys must use canonical public SPKI PEM only");
+    }
+    const digest = createHash("sha256").update(canonicalizeUpdateMetadata(envelope)).digest("hex");
+    if (pin !== digest || receipt.rootEnvelopeSha256 !== digest)
+        throw new Error("root envelope, pin, and independent review receipt disagree");
+    verifyUpdateRootChain(envelope, pin, [], now);
+    return { rootEnvelope: envelope, rootEnvelopeSha256: digest, productionActivation: false };
+}