vaultkeeper 0.7.0 → 0.7.1

package/dist/index.cjs

@@ -1391,13 +1391,19 @@ var DpapiBackend = class {
     const entryPath = getEntryPath2(storageDir, id);
     const script = [
       "Add-Type -AssemblyName System.Security",
-      `$bytes = [System.Text.Encoding]::UTF8.GetBytes(${JSON.stringify(secret)})`,
+      "$b64 = [Console]::In.ReadToEnd()",
+      "$bytes = [System.Convert]::FromBase64String($b64.Trim())",
       "$entropy = $null",
       "$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser",
       "$encrypted = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $entropy, $scope)",
       `[System.IO.File]::WriteAllBytes(${JSON.stringify(entryPath)}, $encrypted)`
     ].join("; ");
-    await execCommand("powershell", ["-NoProfile", "-Command", script]);
+    const secretBuf = Buffer.from(secret, "utf8");
+    const stdinPayload = secretBuf.toString("base64");
+    secretBuf.fill(0);
+    await execCommand("powershell", ["-NoProfile", "-Command", script], {
+      stdin: stdinPayload
+    });
   }
   async retrieve(id) {
     const storageDir = this.#storageDir;
@@ -2950,11 +2956,16 @@ async function createToken(key, claims, options) {
 function isObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isLeasePresence(value) {
+  if (!isObject2(value)) return false;
+  const { op, at, method, backend } = value;
+  return typeof op === "string" && typeof at === "number" && typeof method === "string" && typeof backend === "string";
+}
 function parseVaultClaims(raw) {
   if (!isObject2(raw)) {
     return void 0;
   }
-  const { jti, exp, iat, sub, exe, use, tid, bkd, val, ref } = raw;
+  const { jti, exp, iat, sub, exe, use, tid, bkd, val, ref, kty, kid, kgen, pres } = raw;
   if (typeof jti !== "string") return void 0;
   if (typeof exp !== "number") return void 0;
   if (typeof iat !== "number") return void 0;
@@ -2962,10 +2973,29 @@ function parseVaultClaims(raw) {
   if (typeof exe !== "string") return void 0;
   if (use !== null && typeof use !== "number") return void 0;
   if (tid !== 1 && tid !== 2 && tid !== 3) return void 0;
-  if (typeof bkd !== "string") return void 0;
-  if (typeof val !== "string") return void 0;
+  if (bkd !== void 0 && typeof bkd !== "string") return void 0;
+  if (val !== void 0 && typeof val !== "string") return void 0;
   if (typeof ref !== "string") return void 0;
-  return { jti, exp, iat, sub, exe, use: use ?? null, tid, bkd, val, ref };
+  if (kty !== void 0 && kty !== "secret" && kty !== "signing-key") return void 0;
+  if (kid !== void 0 && typeof kid !== "string") return void 0;
+  if (kgen !== void 0 && typeof kgen !== "number") return void 0;
+  if (pres !== void 0 && !isLeasePresence(pres)) return void 0;
+  return {
+    jti,
+    exp,
+    iat,
+    sub,
+    exe,
+    use: use ?? null,
+    tid,
+    bkd,
+    val,
+    ref,
+    kty,
+    kid,
+    kgen,
+    pres
+  };
 }
 async function decryptToken(key, jwe) {
   let plaintext;
@@ -3046,15 +3076,44 @@ function validateClaims(claims, usedCount = 0) {
   if (claims.exe.trim() === "") {
     throw new VaultError("Invalid token: exe must not be empty");
   }
-  if (claims.bkd.trim() === "") {
-    throw new VaultError("Invalid token: bkd must not be empty");
-  }
-  if (claims.val.trim() === "") {
-    throw new VaultError("Invalid token: val must not be empty");
-  }
   if (claims.ref.trim() === "") {
     throw new VaultError("Invalid token: ref must not be empty");
   }
+  switch (claims.kty) {
+    case "signing-key": {
+      if (claims.val !== void 0) {
+        throw new VaultError("Invalid token: signing lease must not carry a val");
+      }
+      if (claims.kid === void 0 || claims.kid.trim() === "") {
+        throw new VaultError("Invalid token: kid must not be empty");
+      }
+      if (claims.kgen === void 0) {
+        throw new VaultError("Invalid token: kgen is required for a signing lease");
+      }
+      if (!Number.isSafeInteger(claims.kgen) || claims.kgen < 0) {
+        throw new VaultError("Invalid token: kgen must be a non-negative integer");
+      }
+      break;
+    }
+    case "secret":
+    case void 0: {
+      if (claims.bkd === void 0 || claims.bkd.trim() === "") {
+        throw new VaultError("Invalid token: bkd must not be empty");
+      }
+      if (claims.val === void 0 || claims.val.trim() === "") {
+        throw new VaultError("Invalid token: val must not be empty");
+      }
+      if (claims.kid !== void 0 || claims.kgen !== void 0 || claims.pres !== void 0) {
+        throw new VaultError(
+          "Invalid token: secret claim must not carry signing-lease fields (kid/kgen/pres)"
+        );
+      }
+      break;
+    }
+    default: {
+      throw new VaultError(`Invalid token: unrecognized claim kind kty=${String(claims.kty)}`);
+    }
+  }
   if (claims.iat > claims.exp) {
     throw new VaultError("Invalid token: iat must not be after exp");
   }
@@ -4069,6 +4128,16 @@ var VaultKeeper = class _VaultKeeper {
         "This capability token authorizes a signing key, not a secret \u2014 it cannot be read with getSecret(). Use sign() instead."
       );
     }
+    if (claims.kty === "signing-key") {
+      throw new AuthorizationDeniedError(
+        "This capability token authorizes a signing key, not a secret \u2014 it cannot be read with getSecret(). Use sign() instead."
+      );
+    }
+    if (claims.val === void 0) {
+      throw new AuthorizationDeniedError(
+        "This capability token does not carry a secret value \u2014 it is malformed or was not minted as a secret token."
+      );
+    }
     return createSecretAccessor(claims.val);
   }
   /**
@@ -4411,7 +4480,7 @@ var VaultKeeper = class _VaultKeeper {
   // ---------------------------------------------------------------------------
   static #resolveSecrets(token) {
     if (token instanceof CapabilityToken) {
-      return _VaultKeeper.#requireSecretClaims(token).val;
+      return _VaultKeeper.#requireSecretValue(token);
     }
     const result = {};
     for (const [name, t] of Object.entries(token)) {
@@ -4420,7 +4489,7 @@ var VaultKeeper = class _VaultKeeper {
           `Invalid capability token for secret "${name}" \u2014 expected a CapabilityToken from authorize()`
         );
       }
-      result[name] = _VaultKeeper.#requireSecretClaims(t).val;
+      result[name] = _VaultKeeper.#requireSecretValue(t);
     }
     return result;
   }
@@ -4428,7 +4497,10 @@ var VaultKeeper = class _VaultKeeper {
    * Resolve a token to its secret claims, rejecting a signing-key token.
    *
    * Defense in depth: a signing-key capability must never be injectable as a
-   * secret through `fetch()`/`exec()`.
+   * secret through `fetch()`/`exec()`. This rejects both the in-memory
+   * signing-key token (`isSigningClaims`) and a JWE-based signing-key lease
+   * (`kty: 'signing-key'`) — the two capability shapes are discriminated
+   * differently but neither ever carries a secret value.
    */
   static #requireSecretClaims(token) {
     const claims = validateCapabilityToken(token);
@@ -4437,8 +4509,21 @@ var VaultKeeper = class _VaultKeeper {
         "This capability token authorizes a signing key, not a secret \u2014 it cannot be injected into fetch() or exec()."
       );
     }
+    if (claims.kty === "signing-key") {
+      throw new AuthorizationDeniedError(
+        "This capability token authorizes a signing-key lease, not a secret \u2014 it cannot be injected into fetch() or exec()."
+      );
+    }
     return claims;
   }
+  /** Resolve a token to its secret value, rejecting a claims shape with no `val`. */
+  static #requireSecretValue(token) {
+    const claims = _VaultKeeper.#requireSecretClaims(token);
+    if (claims.val === void 0 || claims.val.trim() === "") {
+      throw new AuthorizationDeniedError("This capability token does not authorize a secret value.");
+    }
+    return claims.val;
+  }
   /**
    * Validate a caller-supplied resource name. `kind` names the resource in the
    * error so a signing-key caller is not told about a "secret".