sliftutils 1.5.0 → 1.5.2

package/index.d.ts

@@ -72,17 +72,26 @@ declare module "sliftutils/misc/https/certs" {
     import * as forge from "node-forge";
     import { MaybePromise } from "socket-function/src/types";
     export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
-    export declare const identityStorageKey = "machineCA_11";
+    export declare const identityStorageKey = "machineCA_12";
     export type IdentityStorageType = {
         domain: string;
         certB64: string;
         keyB64: string;
     };
+    export type BrowserIdentityStorageType = {
+        domain: string;
+        certB64: string;
+        privateKey: CryptoKey;
+    };
     export interface X509KeyPair {
         domain: string;
         cert: Buffer;
-        key: Buffer;
+        key: Buffer | CryptoKey;
     }
+    export type NonExtractableKeyPair = {
+        publicKeyBytes: Buffer;
+        privateKey: CryptoKey;
+    };
     export declare function getCommonName(cert: Buffer | string): string;
     export declare function createX509(config: {
         domain: string;
@@ -91,23 +100,24 @@ declare module "sliftutils/misc/https/certs" {
         keyPair: {
             publicKey: forge.Ed25519PublicKey;
             privateKey: forge.Ed25519PrivateKey;
-        } | forge.pki.KeyPair;
-    }): X509KeyPair;
+        } | forge.pki.KeyPair | NonExtractableKeyPair;
+    }): MaybePromise<X509KeyPair>;
+    export declare function generateNonExtractableKeyPair(): Promise<NonExtractableKeyPair>;
     export declare function privateKeyToPem(buffer: forge.pki.PrivateKey | forge.Ed25519PrivateKey): string;
     export declare function parseCert(PEMorDER: string | Buffer): forge.pki.Certificate;
     export declare function getPublicIdentifier(PEMorDER: string | Buffer): Buffer;
     export declare const sign: (keyPair: {
-        key: string | Buffer;
-    }, data: unknown) => string;
+        key: string | Buffer | CryptoKey;
+    }, data: unknown) => MaybePromise<string>;
     export declare function verify(cert: string, signature: string, data: unknown): void;
     export declare function validateCACert(domain: string, cert: string | Buffer): void;
     export declare function validateCertificate(domain: string, cert: Buffer | string, issuerCert: Buffer | string): void;
     export declare function generateKeyPair(): forge.pki.rsa.KeyPair;
     export declare function generateRSAKeyPair(): forge.pki.rsa.KeyPair;
-    export declare function generateTestCA(domain: string): X509KeyPair;
+    export declare function generateTestCA(domain: string): MaybePromise<X509KeyPair>;
     export declare function createCertFromCA(config: {
         CAKeyPair: X509KeyPair;
-    }): X509KeyPair;
+    }): MaybePromise<X509KeyPair>;
     export declare function getMachineId(domainNameOrNodeId: string, domain: string): string;
     export type NodeIdParts = {
         threadId: string;
@@ -129,7 +139,7 @@ declare module "sliftutils/misc/https/certs" {
         machineId: string;
         publicKey: Buffer;
     }): boolean;
-    export declare function getThreadKeyCert(domain: string): X509KeyPair;
+    export declare function getThreadKeyCert(domain: string): MaybePromise<X509KeyPair>;
     export declare const createTestBrowserKeyCert: {
         (): Promise<X509KeyPair>;
         reset(): void;
@@ -213,11 +223,18 @@ declare module "sliftutils/misc/https/node-forge-ed25519" {
             static publicKeyToPem(key: Ed25519PublicKey): string;
             static publicKeyFromPem(pem: string): Ed25519PublicKey;
         }
+        namespace pki {
+            function getTBSCertificate(cert: pki.Certificate): asn1.Asn1;
+        }
     }
 }
 
 declare module "sliftutils/misc/https/persistentLocalStorage" {
     import { MaybePromise } from "socket-function/src/types";
+    export declare function getIDBKeyStore<T>(appName: string, key: string): {
+        get(): Promise<T | undefined>;
+        set(value: T | undefined): Promise<void>;
+    };
     export declare function getKeyStore<T>(appName: string, key: string): {
         get(): MaybePromise<T | undefined>;
         set(value: T | null): MaybePromise<void>;

package/misc/https/certs.d.ts

@@ -5,17 +5,26 @@
 import * as forge from "node-forge";
 import { MaybePromise } from "socket-function/src/types";
 export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
-export declare const identityStorageKey = "machineCA_11";
+export declare const identityStorageKey = "machineCA_12";
 export type IdentityStorageType = {
     domain: string;
     certB64: string;
     keyB64: string;
 };
+export type BrowserIdentityStorageType = {
+    domain: string;
+    certB64: string;
+    privateKey: CryptoKey;
+};
 export interface X509KeyPair {
     domain: string;
     cert: Buffer;
-    key: Buffer;
+    key: Buffer | CryptoKey;
 }
+export type NonExtractableKeyPair = {
+    publicKeyBytes: Buffer;
+    privateKey: CryptoKey;
+};
 export declare function getCommonName(cert: Buffer | string): string;
 export declare function createX509(config: {
     domain: string;
@@ -24,23 +33,24 @@ export declare function createX509(config: {
     keyPair: {
         publicKey: forge.Ed25519PublicKey;
         privateKey: forge.Ed25519PrivateKey;
-    } | forge.pki.KeyPair;
-}): X509KeyPair;
+    } | forge.pki.KeyPair | NonExtractableKeyPair;
+}): MaybePromise<X509KeyPair>;
+export declare function generateNonExtractableKeyPair(): Promise<NonExtractableKeyPair>;
 export declare function privateKeyToPem(buffer: forge.pki.PrivateKey | forge.Ed25519PrivateKey): string;
 export declare function parseCert(PEMorDER: string | Buffer): forge.pki.Certificate;
 export declare function getPublicIdentifier(PEMorDER: string | Buffer): Buffer;
 export declare const sign: (keyPair: {
-    key: string | Buffer;
-}, data: unknown) => string;
+    key: string | Buffer | CryptoKey;
+}, data: unknown) => MaybePromise<string>;
 export declare function verify(cert: string, signature: string, data: unknown): void;
 export declare function validateCACert(domain: string, cert: string | Buffer): void;
 export declare function validateCertificate(domain: string, cert: Buffer | string, issuerCert: Buffer | string): void;
 export declare function generateKeyPair(): forge.pki.rsa.KeyPair;
 export declare function generateRSAKeyPair(): forge.pki.rsa.KeyPair;
-export declare function generateTestCA(domain: string): X509KeyPair;
+export declare function generateTestCA(domain: string): MaybePromise<X509KeyPair>;
 export declare function createCertFromCA(config: {
     CAKeyPair: X509KeyPair;
-}): X509KeyPair;
+}): MaybePromise<X509KeyPair>;
 export declare function getMachineId(domainNameOrNodeId: string, domain: string): string;
 export type NodeIdParts = {
     threadId: string;
@@ -62,7 +72,7 @@ export declare function verifyMachineIdForPublicKey(config: {
     machineId: string;
     publicKey: Buffer;
 }): boolean;
-export declare function getThreadKeyCert(domain: string): X509KeyPair;
+export declare function getThreadKeyCert(domain: string): MaybePromise<X509KeyPair>;
 export declare const createTestBrowserKeyCert: {
     (): Promise<X509KeyPair>;
     reset(): void;

package/misc/https/certs.ts

@@ -18,7 +18,7 @@ import { getNodeIdDomain, getNodeIdDomainMaybeUndefined, getNodeIdLocation } fro
 import { MaybePromise } from "socket-function/src/types";
 import { SocketFunction } from "socket-function/SocketFunction";
 import { resetAllNodeCallFactories } from "socket-function/src/nodeCache";
-import { getKeyStore } from "./persistentLocalStorage";
+import { getKeyStore, getIDBKeyStore } from "./persistentLocalStorage";
 import { ellipsize } from "../strings";
 
 setFlag(require, "node-forge", "allowclient", true);
@@ -28,14 +28,22 @@ const timeInDay = 1000 * 60 * 60 * 24;
 
 export const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
 
-export const identityStorageKey = "machineCA_11";
+export const identityStorageKey = "machineCA_12";
 export type IdentityStorageType = { domain: string; certB64: string; keyB64: string };
+// In the browser the private key is a non-extractable CryptoKey. IndexedDB structured-clones
+//  it, so it persists, but the raw key bytes can never be read by JavaScript (only used
+//  via crypto.subtle.sign). This protects against exfiltration of stored keys.
+export type BrowserIdentityStorageType = { domain: string; certB64: string; privateKey: CryptoKey };
 
 function getIdentityStore(domain: string) {
     return getKeyStore<IdentityStorageType>(domain, identityStorageKey);
 }
+function getBrowserIdentityStore(domain: string) {
+    return getIDBKeyStore<BrowserIdentityStorageType>(domain, identityStorageKey);
+}
 
-export interface X509KeyPair { domain: string; cert: Buffer; key: Buffer; }
+export interface X509KeyPair { domain: string; cert: Buffer; key: Buffer | CryptoKey; }
+export type NonExtractableKeyPair = { publicKeyBytes: Buffer; privateKey: CryptoKey };
 
 export function getCommonName(cert: Buffer | string) {
     let subject = new crypto.X509Certificate(cert).subject;
@@ -53,14 +61,18 @@ export function createX509(
         keyPair: {
             publicKey: forge.Ed25519PublicKey;
             privateKey: forge.Ed25519PrivateKey;
-        } | forge.pki.KeyPair;
+        } | forge.pki.KeyPair | NonExtractableKeyPair;
     }
-): X509KeyPair {
-    return measureBlock(function createX509() {
+): MaybePromise<X509KeyPair> {
+    return measureBlock(function createX509(): MaybePromise<X509KeyPair> {
         let { domain, issuer, lifeSpan, keyPair } = config;
 
         let certObj = forge.pki.createCertificate();
-        certObj.publicKey = keyPair.publicKey;
+        if ("publicKeyBytes" in keyPair) {
+            certObj.publicKey = { publicKeyBytes: keyPair.publicKeyBytes, keyType: forge.pki.oids["EdDSA25519"] } as unknown as forge.pki.PublicKey;
+        } else {
+            certObj.publicKey = keyPair.publicKey;
+        }
         certObj.serialNumber = "01";
         // Give it 5 minutes before now. If we give it too much time, it can look like the cert is really
         //  old, which will trigger various processes to try to get a fresher one (as if it lasts for
@@ -115,7 +127,18 @@ export function createX509(
         certObj.setExtensions(extensions);
 
 
-        measureBlock(function sign() {
+        let signResult = measureBlock(function sign(): MaybePromise<void> {
+            let signingCryptoKey: CryptoKey | undefined;
+            if (issuer === "self") {
+                if ("publicKeyBytes" in keyPair) {
+                    signingCryptoKey = keyPair.privateKey;
+                }
+            } else if (issuer.key instanceof CryptoKey) {
+                signingCryptoKey = issuer.key;
+            }
+            if (signingCryptoKey) {
+                return signCertWithCryptoKey(certObj, signingCryptoKey);
+            }
             if (issuer === "self") {
                 certObj.sign(keyPair.privateKey as any, forge.md.sha256.create());
             } else {
@@ -123,15 +146,44 @@ export function createX509(
             }
         });
 
-        return measureBlock(function toPems() {
-            return {
-                domain,
-                cert: Buffer.from(forge.pki.certificateToPem(certObj)),
-                key: Buffer.from(privateKeyToPem(keyPair.privateKey)),
-            };
-        });
+        function toPems() {
+            return measureBlock(function toPems() {
+                let key: Buffer | CryptoKey;
+                if ("publicKeyBytes" in keyPair) {
+                    key = keyPair.privateKey;
+                } else {
+                    key = Buffer.from(privateKeyToPem(keyPair.privateKey));
+                }
+                return {
+                    domain,
+                    cert: Buffer.from(forge.pki.certificateToPem(certObj)),
+                    key,
+                };
+            });
+        }
+        if (signResult instanceof Promise) {
+            return signResult.then(toPems);
+        }
+        return toPems();
     });
 }
+
+// Replicates the forked forge's ed25519 cert.sign, except the signature is produced by
+//  crypto.subtle, so the private key can be a non-extractable CryptoKey.
+async function signCertWithCryptoKey(certObj: forge.pki.Certificate, privateKey: CryptoKey): Promise<void> {
+    certObj.signatureOid = certObj.siginfo.algorithmOid = forge.pki.oids["EdDSA25519"];
+    let tbs = forge.pki.getTBSCertificate(certObj);
+    let tbsDer = forge.asn1.toDer(tbs).getBytes();
+    let signature = await globalThis.crypto.subtle.sign("Ed25519", privateKey, Buffer.from(tbsDer, "binary"));
+    certObj.tbsCertificate = tbs;
+    certObj.signature = Buffer.from(signature).toString("binary");
+}
+
+export async function generateNonExtractableKeyPair(): Promise<NonExtractableKeyPair> {
+    let keyPair = await globalThis.crypto.subtle.generateKey("Ed25519", false, ["sign", "verify"]) as CryptoKeyPair;
+    let publicKeyBytes = Buffer.from(await globalThis.crypto.subtle.exportKey("raw", keyPair.publicKey));
+    return { publicKeyBytes, privateKey: keyPair.privateKey };
+}
 export function privateKeyToPem(buffer: forge.pki.PrivateKey | forge.Ed25519PrivateKey) {
     if ("privateKeyBytes" in buffer) {
         return forge.ed25519.privateKeyToPem(buffer);
@@ -173,8 +225,13 @@ function isED25519(key: string | Buffer) {
 }
 
 // EQUIVALENT TO: `crypto.createSign("SHA256").update(JSON.stringify(payload)).sign(keyCert.key, "binary")`
-export const sign = measureWrap(function sign(keyPair: { key: string | Buffer }, data: unknown): string {
+export const sign = measureWrap(function sign(keyPair: { key: string | Buffer | CryptoKey }, data: unknown): MaybePromise<string> {
     let dataStr = JSON.stringify(data);
+    if (keyPair.key instanceof CryptoKey) {
+        // "binary" encoding matches how forge interprets the string on the verify side
+        return globalThis.crypto.subtle.sign("Ed25519", keyPair.key, Buffer.from(dataStr, "binary"))
+            .then(signature => Buffer.from(signature).toString("binary"));
+    }
     if (isED25519(keyPair.key)) {
         let privateKey = (forge.pki.ed25519 as any).privateKeyFromPem(keyPair.key.toString());
         return privateKey.sign(dataStr);
@@ -201,6 +258,27 @@ function normalizeCertToPEM(PEMorDER: string | Buffer): string {
     return "-----BEGIN CERTIFICATE-----\n" + PEMorDER + "\n-----END CERTIFICATE-----";
 }
 
+// Base32 (RFC 4648, lowercase, unpadded), as domain names are case-insensitive,
+//  which rules out base64/hex-with-case
+const base32Alphabet = "abcdefghijklmnopqrstuvwxyz234567";
+function encodeBase32(bytes: Buffer): string {
+    let result = "";
+    let bitCount = 0;
+    let value = 0;
+    for (let byte of bytes) {
+        value = (value << 8) | byte;
+        bitCount += 8;
+        while (bitCount >= 5) {
+            result += base32Alphabet[(value >>> (bitCount - 5)) & 31];
+            bitCount -= 5;
+        }
+    }
+    if (bitCount > 0) {
+        result += base32Alphabet[(value << (5 - bitCount)) & 31];
+    }
+    return result;
+}
+
 function getDomainPartFromPublicKey(publicKey: { publicKeyBytes: Buffer } | forge.pki.KeyPair["publicKey"] | Buffer) {
     let bytes: Buffer;
     if ("publicKeyBytes" in publicKey) {
@@ -210,7 +288,7 @@ function getDomainPartFromPublicKey(publicKey: { publicKeyBytes: Buffer } | forg
     } else {
         bytes = Buffer.from(new Uint32Array((publicKey as any).n.data).buffer);
     }
-    return "b" + Buffer.from(sha265.sha256.array(Buffer.from(bytes))).toString("base64").slice(0, 16).replaceAll("+", "-").replaceAll("/", "_");
+    return "b" + encodeBase32(Buffer.from(sha265.sha256.array(Buffer.from(bytes)))).slice(0, 20);
 }
 
 export function validateCACert(domain: string, cert: string | Buffer) {
@@ -384,6 +462,31 @@ export function generateTestCA(domain: string) {
 
 let identityCA = cache((domain: string) => {
     let identityCA = lazy((async (): Promise<X509KeyPair> => {
+        if (!isNode()) {
+            let store = getBrowserIdentityStore(domain);
+            let caCached = await store.get();
+            if (!caCached) {
+                console.log(`Generating new identity CA (non-extractable browser key)`);
+                const keyPair = await generateNonExtractableKeyPair();
+                let caPublicKeyPart = getDomainPartFromPublicKey(keyPair.publicKeyBytes);
+                let fullDomain = `${caPublicKeyPart}.${domain}`;
+                let value = await createX509({ domain: fullDomain, issuer: "self", keyPair, lifeSpan: timeInDay * 365 * 20 });
+                caCached = {
+                    domain: value.domain,
+                    certB64: value.cert.toString("base64"),
+                    privateKey: keyPair.privateKey,
+                };
+                await store.set(caCached);
+            }
+            let result = {
+                domain: caCached.domain,
+                cert: Buffer.from(caCached.certB64, "base64"),
+                key: caCached.privateKey,
+            };
+            trustCertificate(result.cert.toString());
+            identityCA.set(result);
+            return result;
+        }
         let identityCACached = getIdentityStore(domain);
         let caCached = await identityCACached.get();
         if (!caCached) {
@@ -391,16 +494,13 @@ let identityCA = cache((domain: string) => {
             const keyPair = generateKeyPair();
             let caPublicKeyPart = getDomainPartFromPublicKey(keyPair.publicKey);
             let fullDomain = `${caPublicKeyPart}.${domain}`;
-            if (!isNode()) {
-                fullDomain = `${caPublicKeyPart}.${domain}`;
-            }
 
-            let value = createX509({ domain: fullDomain, issuer: "self", keyPair, lifeSpan: timeInDay * 365 * 20 });
+            let value = await createX509({ domain: fullDomain, issuer: "self", keyPair, lifeSpan: timeInDay * 365 * 20 });
 
             caCached = {
                 domain: value.domain,
                 certB64: value.cert.toString("base64"),
-                keyB64: value.key.toString("base64"),
+                keyB64: keyPairKeyToBuffer(value.key).toString("base64"),
             };
             await identityCACached.set(caCached);
         }
@@ -416,6 +516,13 @@ let identityCA = cache((domain: string) => {
     return identityCA;
 });
 
+function keyPairKeyToBuffer(key: Buffer | CryptoKey): Buffer {
+    if (key instanceof CryptoKey) {
+        throw new Error(`Cannot serialize a non-extractable CryptoKey`);
+    }
+    return key;
+}
+
 // IMPORTANT! We do not embed any debug info in this domain. If we did, it would be useful,
 //  but... potentally a security vulnerability, as if the debug info (such as a prefix)
 //  is used to identify what a certificate is for, it would be easy for an attack to
@@ -424,9 +531,22 @@ let identityCA = cache((domain: string) => {
 //  (and hopefully stored in a UI, showing IP, time, etc).
 export function createCertFromCA(config: {
     CAKeyPair: X509KeyPair;
-}): X509KeyPair {
-    return measureBlock(function createCertFromCA() {
+}): MaybePromise<X509KeyPair> {
+    return measureBlock(function createCertFromCA(): MaybePromise<X509KeyPair> {
         let { CAKeyPair } = config;
+        if (!isNode()) {
+            return (async () => {
+                const keyPair = await generateNonExtractableKeyPair();
+                let domainKeyPart = getDomainPartFromPublicKey(keyPair.publicKeyBytes);
+                let fullDomain = `${domainKeyPart}.${CAKeyPair.domain}`;
+                return await createX509({
+                    domain: fullDomain,
+                    issuer: CAKeyPair,
+                    keyPair,
+                    lifeSpan: timeInDay * 365 * 10,
+                });
+            })();
+        }
         const keyPair = generateKeyPair();
         let domainKeyPart = getDomainPartFromPublicKey(keyPair.publicKey);
         let fullDomain = `${domainKeyPart}.${config.CAKeyPair.domain}`;
@@ -491,12 +611,27 @@ export function encodeNodeId(parts: NodeIdParts) {
 }
 
 export async function setIdentityCARaw(domain: string, json: string) {
-    let identityCACached = getIdentityStore(domain);
     let obj = JSON.parse(json) as {
         domain: string;
         certB64: string;
         keyB64: string;
     };
+    if (!isNode()) {
+        // Import into a non-extractable CryptoKey, so once stored the key can't be exfiltrated
+        let privateKey = await importEd25519PrivateKey(Buffer.from(obj.keyB64, "base64").toString());
+        let ca = {
+            domain: obj.domain,
+            cert: Buffer.from(obj.certB64, "base64"),
+            key: privateKey,
+        };
+        trustCertificate(ca.cert.toString());
+        identityCA(domain).set(ca);
+        getThreadKeyCertBase(domain).reset();
+        await getBrowserIdentityStore(domain).set({ domain: obj.domain, certB64: obj.certB64, privateKey });
+        resetAllNodeCallFactories();
+        return;
+    }
+    let identityCACached = getIdentityStore(domain);
     let ca = {
         domain: obj.domain,
         cert: Buffer.from(obj.certB64, "base64"),
@@ -509,13 +644,28 @@ export async function setIdentityCARaw(domain: string, json: string) {
     resetAllNodeCallFactories();
 }
 
+async function importEd25519PrivateKey(pem: string): Promise<CryptoKey> {
+    let parsed = forge.ed25519.privateKeyFromPem(pem);
+    let bytes = Buffer.from(parsed.privateKeyBytes || parsed);
+    let seed = bytes;
+    if (seed.length === 64) {
+        // NaCl layout is seed || publicKey
+        seed = seed.subarray(0, 32);
+    }
+    if (seed.length !== 32) {
+        throw new Error(`Expected a 32 or 64 byte ed25519 private key, was ${bytes.length} bytes`);
+    }
+    let pkcs8 = Buffer.concat([Buffer.from("302e020100300506032b657004220420", "hex"), seed]);
+    return await globalThis.crypto.subtle.importKey("pkcs8", pkcs8, "Ed25519", false, ["sign"]);
+}
+
 export async function loadIdentityCA(domain: string) {
     await identityCA(domain)();
 }
 export function getIdentityCA(domain: string): X509KeyPair {
     let value = identityCA(domain)();
     if (value instanceof Promise) {
-        throw new Error("Identity CA is not yet loaded. Call and wait for loadIdentityCA() in your startup before accessing the identity (or call getIdentityCAPromise())");
+        throw new Error(`Identity CA is not yet loaded. Call and wait for loadIdentityCA(${JSON.stringify(domain)}) in your startup before accessing the identity (or call getIdentityCAPromise(${JSON.stringify(domain)}))`);
     }
     return value;
 }
@@ -531,7 +681,11 @@ export function getOwnMachineId(domain: string) {
     return getMachineId(getIdentityCA(domain).domain, domain);
 }
 export function getOwnThreadId(domain: string) {
-    return decodeNodeIdAssert(getThreadKeyCert(domain).domain, domain).threadId;
+    let threadKeyCert = getThreadKeyCert(domain);
+    if (threadKeyCert instanceof Promise) {
+        throw new Error(`Thread key cert is not yet loaded. Await getThreadKeyCert(${JSON.stringify(domain)}) in your startup before accessing the threadId`);
+    }
+    return decodeNodeIdAssert(threadKeyCert.domain, domain).threadId;
 }
 
 /** Part of the machineId comes from the publicKey, so we can use it to verify */

package/misc/https/node-forge-ed25519.d.ts

@@ -14,4 +14,7 @@ declare module "node-forge" {
         static publicKeyToPem(key: Ed25519PublicKey): string;
         static publicKeyFromPem(pem: string): Ed25519PublicKey;
     }
+    namespace pki {
+        function getTBSCertificate(cert: pki.Certificate): asn1.Asn1;
+    }
 }

package/misc/https/persistentLocalStorage.d.ts

@@ -1,4 +1,8 @@
 import { MaybePromise } from "socket-function/src/types";
+export declare function getIDBKeyStore<T>(appName: string, key: string): {
+    get(): Promise<T | undefined>;
+    set(value: T | undefined): Promise<void>;
+};
 export declare function getKeyStore<T>(appName: string, key: string): {
     get(): MaybePromise<T | undefined>;
     set(value: T | null): MaybePromise<void>;

package/misc/https/persistentLocalStorage.ts

@@ -4,6 +4,42 @@ import os from "os";
 import { MaybePromise } from "socket-function/src/types";
 import { cache } from "socket-function/src/caching";
 
+// Stores structured-cloneable values (including non-extractable CryptoKeys) in IndexedDB.
+export function getIDBKeyStore<T>(appName: string, key: string): {
+    get(): Promise<T | undefined>;
+    set(value: T | undefined): Promise<void>;
+} {
+    async function withStore<R>(mode: IDBTransactionMode, fnc: (store: IDBObjectStore) => IDBRequest<R>): Promise<R> {
+        let openReq = indexedDB.open(`keystore_${appName}`, 1);
+        openReq.onupgradeneeded = () => openReq.result.createObjectStore("kv");
+        let db = await new Promise<IDBDatabase>((resolve, reject) => {
+            openReq.onsuccess = () => resolve(openReq.result);
+            openReq.onerror = () => reject(openReq.error);
+        });
+        try {
+            let req = fnc(db.transaction("kv", mode).objectStore("kv"));
+            return await new Promise<R>((resolve, reject) => {
+                req.onsuccess = () => resolve(req.result);
+                req.onerror = () => reject(req.error);
+            });
+        } finally {
+            db.close();
+        }
+    }
+    return {
+        async get() {
+            return await withStore("readonly", store => store.get(key)) as T | undefined;
+        },
+        async set(value: T | undefined) {
+            if (!value) {
+                await withStore("readwrite", store => store.delete(key));
+                return;
+            }
+            await withStore("readwrite", store => store.put(value, key));
+        },
+    };
+}
+
 export function getKeyStore<T>(appName: string, key: string): {
     get(): MaybePromise<T | undefined>;
     set(value: T | null): MaybePromise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.5.0",
+    "version": "1.5.2",
     "main": "index.js",
     "license": "MIT",
     "files": [
@@ -53,6 +53,7 @@
         "acme-client": "^5.0.0",
         "js-sha256": "^0.11.1",
         "mobx": "^6.13.3",
+        "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
         "preact-old-types": "^10.28.1",
         "shell-quote": "^1.8.3",
         "socket-function": "^1.1.42",

package/yarn.lock

@@ -1631,6 +1631,10 @@ node-forge@^1.3.1:
   resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-1.3.3.tgz#0ad80f6333b3a0045e827ac20b7f735f93716751"
   integrity sha512-rLvcdSyRCyouf6jcOIPe/BgwG/d7hKjzMKOas33/pHEr6gbq18IK9zV7DiPvzsz0oBJPme6qr6H6kGZuI9/DZg==
 
+"node-forge@https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6":
+  version "1.3.2-0"
+  resolved "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6"
+
 node-gyp-build-optional-packages@5.1.1:
   version "5.1.1"
   resolved "https://registry.yarnpkg.com/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.1.1.tgz#52b143b9dd77b7669073cbfe39e3f4118bfc603c"
@@ -1940,10 +1944,10 @@ slash@^3.0.0:
   resolved "https://registry.yarnpkg.com/slash/-/slash-3.0.0.tgz#6539be870c165adbd5240220dbe361f1bc4d4634"
   integrity sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==
 
-socket-function@^1.1.40:
-  version "1.1.40"
-  resolved "https://registry.yarnpkg.com/socket-function/-/socket-function-1.1.40.tgz#0994aa018b3fcc64a131d29e5926377b7baff280"
-  integrity sha512-PtU8csq90nbjM/Jr/irRHzj2PojUgcMXTctfBMDEHJrLKmeOM4flf87svn0M8ad5iwNiSyav8SdxCzCl9IwZJw==
+socket-function@^1.1.42:
+  version "1.1.47"
+  resolved "https://registry.yarnpkg.com/socket-function/-/socket-function-1.1.47.tgz#45cb508b4f402ae37c3053eb8b7cabe1cefaa011"
+  integrity sha512-DT+TWWcr6GPQ6E/f8o3p+3UZlHfgnLPCJ6baSY+7jOOm5EdoPXcaCF5L4j4cna4OV4Tpw3ny85b4BqvixXP4sQ==
   dependencies:
     "@types/pako" "^2.0.3"
     "@types/ws" "^8.5.3"