sliftutils 1.5.3 → 1.5.4

package/index.d.ts

@@ -70,7 +70,6 @@ declare module "sliftutils/misc/https/certs" {
     /// <reference types="node" />
     /// <reference types="node" />
     import * as forge from "node-forge";
-    import { MaybePromise } from "socket-function/src/types";
     export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
     export declare const identityStorageKey = "machineCA_12";
     export type IdentityStorageType = {
@@ -121,7 +120,7 @@ declare module "sliftutils/misc/https/certs" {
     export declare function setIdentityCARaw(domain: string, json: string): Promise<void>;
     export declare function loadIdentityCA(domain: string): Promise<void>;
     export declare function getIdentityCA(domain: string): X509KeyPair;
-    export declare function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair>;
+    export declare function getIdentityCAPromise(domain: string): X509KeyPair;
     export declare function getOwnMachineId(domain: string): string;
     export declare function getOwnThreadId(domain: string): string;
     /** Part of the machineId comes from the publicKey, so we can use it to verify */
@@ -217,10 +216,9 @@ declare module "sliftutils/misc/https/node-forge-ed25519" {
 }
 
 declare module "sliftutils/misc/https/persistentLocalStorage" {
-    import { MaybePromise } from "socket-function/src/types";
     export declare function getKeyStore<T>(appName: string, key: string): {
-        get(): MaybePromise<T | undefined>;
-        set(value: T | null): MaybePromise<void>;
+        get(): T | undefined;
+        set(value: T | null): void;
     };
 
 }

package/misc/https/certs.d.ts

@@ -3,7 +3,6 @@
 /// <reference types="node" />
 /// <reference types="node" />
 import * as forge from "node-forge";
-import { MaybePromise } from "socket-function/src/types";
 export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
 export declare const identityStorageKey = "machineCA_12";
 export type IdentityStorageType = {
@@ -54,7 +53,7 @@ export declare function encodeNodeId(parts: NodeIdParts): string;
 export declare function setIdentityCARaw(domain: string, json: string): Promise<void>;
 export declare function loadIdentityCA(domain: string): Promise<void>;
 export declare function getIdentityCA(domain: string): X509KeyPair;
-export declare function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair>;
+export declare function getIdentityCAPromise(domain: string): X509KeyPair;
 export declare function getOwnMachineId(domain: string): string;
 export declare function getOwnThreadId(domain: string): string;
 /** Part of the machineId comes from the publicKey, so we can use it to verify */

package/misc/https/certs.ts

@@ -15,7 +15,6 @@ import crypto from "crypto";
 import { trustCertificate } from "socket-function/src/certStore";
 import { measureBlock, measureFnc, measureWrap } from "socket-function/src/profiling/measure";
 import { getNodeIdDomain, getNodeIdDomainMaybeUndefined, getNodeIdLocation } from "socket-function/src/nodeCache";
-import { MaybePromise } from "socket-function/src/types";
 import { SocketFunction } from "socket-function/SocketFunction";
 import { resetAllNodeCallFactories } from "socket-function/src/nodeCache";
 import { getKeyStore } from "./persistentLocalStorage";
@@ -386,6 +385,14 @@ function validateAltNames(certParsed: forge.pki.Certificate, subject: string) {
 }
 
 
+// NOTE: We can't use crypto.subtle (non-extractable CryptoKeys) for our keys, because subtle
+//  is asynchronous, and everything here (key generation, cert creation, signing) must be
+//  available synchronously. The only real benefit of subtle is that a cross-site scripting
+//  attack can't exfiltrate the key. Which, while nice, is of minor benefit, as the cross-site
+//  script can already do quite a bit of damage anyway with access. And if that happens, the
+//  first thing the user is probably going to do is reset all their credentials, which solves
+//  the case of the key being exfiltrated anyway (by telling the server to stop trusting
+//  all identities).
 export function generateKeyPair() {
     return measureBlock(function generateKeyPair() {
         // NOTE: We use ED25519 because it can generated keys about 10X faster, WHICH, is still slow
@@ -415,36 +422,32 @@ export function generateTestCA(domain: string) {
     return createX509({ domain: fullDomain, issuer: "self", keyPair, lifeSpan: timeInDay * 365 * 20 });
 }
 
-let identityCA = cache((domain: string) => {
-    let identityCA = lazy((async (): Promise<X509KeyPair> => {
-        let identityCACached = getIdentityStore(domain);
-        let caCached = await identityCACached.get();
-        if (!caCached) {
-            console.log(`Generating new identity CA`);
-            const keyPair = generateKeyPair();
-            let caPublicKeyPart = getDomainPartFromPublicKey(keyPair.publicKey);
-            let fullDomain = `${caPublicKeyPart}.${domain}`;
+let identityCA = cache((domain: string) => lazy((): X509KeyPair => {
+    let identityCACached = getIdentityStore(domain);
+    let caCached = identityCACached.get();
+    if (!caCached) {
+        console.log(`Generating new identity CA`);
+        const keyPair = generateKeyPair();
+        let caPublicKeyPart = getDomainPartFromPublicKey(keyPair.publicKey);
+        let fullDomain = `${caPublicKeyPart}.${domain}`;
 
-            let value = createX509({ domain: fullDomain, issuer: "self", keyPair, lifeSpan: timeInDay * 365 * 20 });
+        let value = createX509({ domain: fullDomain, issuer: "self", keyPair, lifeSpan: timeInDay * 365 * 20 });
 
-            caCached = {
-                domain: value.domain,
-                certB64: value.cert.toString("base64"),
-                keyB64: value.key.toString("base64"),
-            };
-            await identityCACached.set(caCached);
-        }
-        let result = {
-            domain: caCached.domain,
-            cert: Buffer.from(caCached.certB64, "base64"),
-            key: Buffer.from(caCached.keyB64, "base64"),
+        caCached = {
+            domain: value.domain,
+            certB64: value.cert.toString("base64"),
+            keyB64: value.key.toString("base64"),
         };
-        trustCertificate(result.cert.toString());
-        identityCA.set(result);
-        return result;
-    }) as (() => MaybePromise<X509KeyPair>));
-    return identityCA;
-});
+        identityCACached.set(caCached);
+    }
+    let result = {
+        domain: caCached.domain,
+        cert: Buffer.from(caCached.certB64, "base64"),
+        key: Buffer.from(caCached.keyB64, "base64"),
+    };
+    trustCertificate(result.cert.toString());
+    return result;
+}));
 
 // IMPORTANT! We do not embed any debug info in this domain. If we did, it would be useful,
 //  but... potentally a security vulnerability, as if the debug info (such as a prefix)
@@ -535,24 +538,23 @@ export async function setIdentityCARaw(domain: string, json: string) {
     trustCertificate(ca.cert.toString());
     identityCA(domain).set(ca);
     getThreadKeyCertBase(domain).reset();
-    await identityCACached.set(obj);
+    identityCACached.set(obj);
     resetAllNodeCallFactories();
 }
 
+// NOTE: The identity CA is available synchronously (storage is fs/localStorage, both
+//  synchronous), so this only exists for backwards compatibility with startup code
+//  that awaits it.
 export async function loadIdentityCA(domain: string) {
-    await identityCA(domain)();
+    identityCA(domain)();
 }
 export function getIdentityCA(domain: string): X509KeyPair {
-    let value = identityCA(domain)();
-    if (value instanceof Promise) {
-        throw new Error(`Identity CA is not yet loaded. Call and wait for loadIdentityCA(${JSON.stringify(domain)}) in your startup before accessing the identity (or call getIdentityCAPromise(${JSON.stringify(domain)}))`);
-    }
-    return value;
+    return identityCA(domain)();
 }
 
 // TODO: Replace this with a database, so it is easy for us to trust CAs
 //  cross machine, and even have multiple users, etc, etc.
-export function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair> {
+export function getIdentityCAPromise(domain: string): X509KeyPair {
     return identityCA(domain)();
 }
 

package/misc/https/persistentLocalStorage.d.ts

@@ -1,5 +1,4 @@
-import { MaybePromise } from "socket-function/src/types";
 export declare function getKeyStore<T>(appName: string, key: string): {
-    get(): MaybePromise<T | undefined>;
-    set(value: T | null): MaybePromise<void>;
+    get(): T | undefined;
+    set(value: T | null): void;
 };

package/misc/https/persistentLocalStorage.ts

@@ -1,12 +1,11 @@
 import { isNode } from "socket-function/src/misc";
 import fs from "fs";
 import os from "os";
-import { MaybePromise } from "socket-function/src/types";
 import { cache } from "socket-function/src/caching";
 
 export function getKeyStore<T>(appName: string, key: string): {
-    get(): MaybePromise<T | undefined>;
-    set(value: T | null): MaybePromise<void>;
+    get(): T | undefined;
+    set(value: T | null): void;
 } {
     if (isNode()) {
         let path = os.homedir() + `/keystore_${appName}_` + key + ".json";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.5.3",
+    "version": "1.5.4",
     "main": "index.js",
     "license": "MIT",
     "files": [