vaultkeeper 0.4.0 → 1.0.0

package/dist/index.cjs

@@ -5,6 +5,7 @@ var fs5 = require('fs/promises');
 var path5 = require('path');
 var os4 = require('os');
 var crypto4 = require('crypto');
+require('url');
 var fs4 = require('fs');
 var jose = require('jose');
 
@@ -162,6 +163,22 @@ var IdentityMismatchError = class extends VaultError {
     this.currentHash = currentHash;
   }
 };
+var InvalidAlgorithmError = class extends VaultError {
+  /**
+   * The algorithm that was requested.
+   */
+  algorithm;
+  /**
+   * The set of algorithms that are allowed.
+   */
+  allowed;
+  constructor(message, algorithm, allowed) {
+    super(message);
+    this.name = "InvalidAlgorithmError";
+    this.algorithm = algorithm;
+    this.allowed = allowed;
+  }
+};
 var SetupError = class extends VaultError {
   /**
    * The name of the dependency that caused the setup failure.
@@ -205,6 +222,7 @@ function isListableBackend(backend) {
 // src/backend/registry.ts
 var BackendRegistry = class {
   static backends = /* @__PURE__ */ new Map();
+  static setups = /* @__PURE__ */ new Map();
   /**
    * Register a backend factory.
    * @param type - Backend type identifier
@@ -217,7 +235,7 @@ var BackendRegistry = class {
    * Create a backend instance by type.
    * @param type - Backend type identifier
    * @returns A SecretBackend instance
-   * @throws Error if the backend type is not registered
+   * @throws {@link BackendUnavailableError} if the backend type is not registered
    */
   static create(type) {
     const factory = this.backends.get(type);
@@ -264,6 +282,46 @@ var BackendRegistry = class {
     );
     return results.filter((type) => type !== null);
   }
+  /**
+   * Register a setup factory for a backend type.
+   * @param type - Backend type identifier
+   * @param factory - Factory function that creates a setup generator
+   */
+  static registerSetup(type, factory) {
+    this.setups.set(type, factory);
+  }
+  /**
+   * Get the setup factory for a backend type, if one is registered.
+   * @param type - Backend type identifier
+   * @returns The setup factory, or `undefined` if none is registered
+   */
+  static getSetup(type) {
+    return this.setups.get(type);
+  }
+  /**
+   * Check whether a setup factory is registered for the given backend type.
+   * @param type - Backend type identifier
+   * @returns `true` if a setup factory is registered
+   */
+  static hasSetup(type) {
+    return this.setups.has(type);
+  }
+  /**
+   * Clear all registered backend factories.
+   * Intended for use in tests only.
+   * @internal
+   */
+  static clearBackends() {
+    this.backends.clear();
+  }
+  /**
+   * Clear all registered setup factories.
+   * Intended for use in tests only.
+   * @internal
+   */
+  static clearSetups() {
+    this.setups.clear();
+  }
 };
 async function execCommand(command, args, options) {
   const result = await execCommandFull(command, args);
@@ -513,6 +571,21 @@ function validateBackendEntry(entry, index) {
     }
     result.path = entry.path;
   }
+  if (entry.options !== void 0) {
+    if (!isObject(entry.options)) {
+      throw new Error(`backends[${String(index)}].options must be an object`);
+    }
+    const opts = {};
+    for (const [k, v] of Object.entries(entry.options)) {
+      if (typeof v !== "string") {
+        throw new Error(
+          `backends[${String(index)}].options["${k}"] must be a string`
+        );
+      }
+      opts[k] = v;
+    }
+    result.options = opts;
+  }
   return result;
 }
 function validateConfig(config) {
@@ -1023,10 +1096,12 @@ function resolveAlgorithmForKey(key, override) {
   if (keyType === "ed25519" || keyType === "ed448") {
     return { signAlg: null, label: keyType };
   }
-  const alg = override ?? "sha256";
+  const alg = (override ?? "sha256").toLowerCase();
   if (!ALLOWED_ALGORITHMS.has(alg)) {
-    throw new VaultError(
-      `Unsupported signing algorithm '${alg}'. Allowed: ${[...ALLOWED_ALGORITHMS].join(", ")}`
+    throw new InvalidAlgorithmError(
+      `Unsupported algorithm '${alg}'. Allowed: ${[...ALLOWED_ALGORITHMS].join(", ")}`,
+      alg,
+      [...ALLOWED_ALGORITHMS]
     );
   }
   return { signAlg: alg, label: alg };
@@ -1050,6 +1125,9 @@ function delegatedVerify(request) {
   } catch {
     return false;
   }
+  if (typeof request.publicKey === "string" && request.publicKey.includes("PRIVATE KEY")) {
+    return false;
+  }
   const { signAlg } = resolveAlgorithmForKey(key, request.algorithm);
   const sig = Buffer.from(request.signature, "base64");
   try {
@@ -1431,6 +1509,8 @@ var VaultKeeper = class _VaultKeeper {
    *   with the vault metadata (`vaultResponse`).
    * @throws {VaultError} If `token` is invalid or was not created by this
    *   vault instance.
+   * @throws {InvalidAlgorithmError} If `request.algorithm` is not in the
+   *   allowed set (e.g. `'md5'`).
    */
   async sign(token, request) {
     const claims = validateCapabilityToken(token);
@@ -1448,8 +1528,11 @@ var VaultKeeper = class _VaultKeeper {
    * capability tokens are required. It is safe to call from CI or any
    * context that has access to public key material.
    *
-   * Never throws. Returns `false` for invalid key material, malformed
-   * signatures, or any verification failure.
+   * Returns `false` for invalid key material, malformed signatures, or
+   * any verification failure (except disallowed algorithms, which throw).
+   *
+   * @throws {InvalidAlgorithmError} If `request.algorithm` is not in the
+   *   allowed set (e.g. `'md5'`).
    *
    * @param request - The data, signature, public key, and optional
    *   algorithm override.
@@ -1582,6 +1665,7 @@ exports.CapabilityToken = CapabilityToken;
 exports.DeviceNotPresentError = DeviceNotPresentError;
 exports.FilesystemError = FilesystemError;
 exports.IdentityMismatchError = IdentityMismatchError;
+exports.InvalidAlgorithmError = InvalidAlgorithmError;
 exports.KeyRevokedError = KeyRevokedError;
 exports.KeyRotatedError = KeyRotatedError;
 exports.PluginNotFoundError = PluginNotFoundError;