sliftutils 1.5.1 → 1.5.2

package/index.d.ts

@@ -72,7 +72,7 @@ declare module "sliftutils/misc/https/certs" {
     import * as forge from "node-forge";
     import { MaybePromise } from "socket-function/src/types";
     export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
-    export declare const identityStorageKey = "machineCA_11";
+    export declare const identityStorageKey = "machineCA_12";
     export type IdentityStorageType = {
         domain: string;
         certB64: string;

package/misc/https/certs.d.ts

@@ -5,7 +5,7 @@
 import * as forge from "node-forge";
 import { MaybePromise } from "socket-function/src/types";
 export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
-export declare const identityStorageKey = "machineCA_11";
+export declare const identityStorageKey = "machineCA_12";
 export type IdentityStorageType = {
     domain: string;
     certB64: string;

package/misc/https/certs.ts

@@ -28,7 +28,7 @@ const timeInDay = 1000 * 60 * 60 * 24;
 
 export const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
 
-export const identityStorageKey = "machineCA_11";
+export const identityStorageKey = "machineCA_12";
 export type IdentityStorageType = { domain: string; certB64: string; keyB64: string };
 // In the browser the private key is a non-extractable CryptoKey. IndexedDB structured-clones
 //  it, so it persists, but the raw key bytes can never be read by JavaScript (only used
@@ -258,6 +258,27 @@ function normalizeCertToPEM(PEMorDER: string | Buffer): string {
     return "-----BEGIN CERTIFICATE-----\n" + PEMorDER + "\n-----END CERTIFICATE-----";
 }
 
+// Base32 (RFC 4648, lowercase, unpadded), as domain names are case-insensitive,
+//  which rules out base64/hex-with-case
+const base32Alphabet = "abcdefghijklmnopqrstuvwxyz234567";
+function encodeBase32(bytes: Buffer): string {
+    let result = "";
+    let bitCount = 0;
+    let value = 0;
+    for (let byte of bytes) {
+        value = (value << 8) | byte;
+        bitCount += 8;
+        while (bitCount >= 5) {
+            result += base32Alphabet[(value >>> (bitCount - 5)) & 31];
+            bitCount -= 5;
+        }
+    }
+    if (bitCount > 0) {
+        result += base32Alphabet[(value << (5 - bitCount)) & 31];
+    }
+    return result;
+}
+
 function getDomainPartFromPublicKey(publicKey: { publicKeyBytes: Buffer } | forge.pki.KeyPair["publicKey"] | Buffer) {
     let bytes: Buffer;
     if ("publicKeyBytes" in publicKey) {
@@ -267,7 +288,7 @@ function getDomainPartFromPublicKey(publicKey: { publicKeyBytes: Buffer } | forg
     } else {
         bytes = Buffer.from(new Uint32Array((publicKey as any).n.data).buffer);
     }
-    return "b" + Buffer.from(sha265.sha256.array(Buffer.from(bytes))).toString("base64").slice(0, 16).replaceAll("+", "-").replaceAll("/", "_");
+    return "b" + encodeBase32(Buffer.from(sha265.sha256.array(Buffer.from(bytes)))).slice(0, 20);
 }
 
 export function validateCACert(domain: string, cert: string | Buffer) {
@@ -644,7 +665,7 @@ export async function loadIdentityCA(domain: string) {
 export function getIdentityCA(domain: string): X509KeyPair {
     let value = identityCA(domain)();
     if (value instanceof Promise) {
-        throw new Error("Identity CA is not yet loaded. Call and wait for loadIdentityCA() in your startup before accessing the identity (or call getIdentityCAPromise())");
+        throw new Error(`Identity CA is not yet loaded. Call and wait for loadIdentityCA(${JSON.stringify(domain)}) in your startup before accessing the identity (or call getIdentityCAPromise(${JSON.stringify(domain)}))`);
     }
     return value;
 }
@@ -662,7 +683,7 @@ export function getOwnMachineId(domain: string) {
 export function getOwnThreadId(domain: string) {
     let threadKeyCert = getThreadKeyCert(domain);
     if (threadKeyCert instanceof Promise) {
-        throw new Error("Thread key cert is not yet loaded. Await getThreadKeyCert() in your startup before accessing the threadId");
+        throw new Error(`Thread key cert is not yet loaded. Await getThreadKeyCert(${JSON.stringify(domain)}) in your startup before accessing the threadId`);
     }
     return decodeNodeIdAssert(threadKeyCert.domain, domain).threadId;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.5.1",
+    "version": "1.5.2",
     "main": "index.js",
     "license": "MIT",
     "files": [