wkd-checker 2.1.0 → 2.3.0

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export interface KeyCheckResult {
     policy_location: string;
     policyAvailable: boolean;
     policyCorsValid: boolean;
+    policy: PolicyFlags | null;
     key_location: string | null;
     key_available: boolean;
     keyCorsValid: boolean;
@@ -14,6 +15,7 @@ export interface KeyCheckResult {
     emailInKey: boolean;
     expired: boolean;
     revoked: boolean;
+    policyCompliant: boolean;
     valid: boolean;
 }
 /**
@@ -24,6 +26,20 @@ export declare enum KeyType {
     BinaryKey = "BinaryKey",
     ArmoredKey = "ArmoredKey"
 }
+/**
+ * Result of the policy file check.
+ */
+export interface PolicyFlags {
+    mailboxOnly: boolean;
+    daneOnly: boolean;
+    authSubmit: boolean;
+    protocolVersion: number | null;
+    submissionAddress: string | null;
+    others: Array<{
+        key: string;
+        value: string | null;
+    }>;
+}
 export declare class WKDError extends Error {
     constructor(message: string);
 }

package/dist/index.js

@@ -80,6 +80,64 @@ const detectKeyType = (keyData) => __awaiter(void 0, void 0, void 0, function* (
         return { keyType: KeyType.Invalid, key: null };
     }
 });
+/**
+ * Parses the Policy Flags file.
+ * Section 4.5. Policy Flags
+ * @param {string} text - Content of the policy file.
+ * @returns {PolicyFlags} Parsed policy flags.
+ */
+const parsePolicy = (text) => {
+    const flags = {
+        mailboxOnly: false,
+        daneOnly: false,
+        authSubmit: false,
+        protocolVersion: null,
+        submissionAddress: null,
+        others: []
+    };
+    if (!text)
+        return flags;
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+        const trimmed = line.trim();
+        // "Empty lines and lines starting with a '#' character are considered comment lines."
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const colonIndex = trimmed.indexOf(':');
+        let key = '';
+        let value = null;
+        if (colonIndex !== -1) {
+            key = trimmed.substring(0, colonIndex).trim().toLowerCase();
+            value = trimmed.substring(colonIndex + 1).trim();
+        }
+        else {
+            key = trimmed.trim().toLowerCase();
+        }
+        switch (key) {
+            case 'mailbox-only':
+                flags.mailboxOnly = true;
+                break;
+            case 'dane-only':
+                flags.daneOnly = true;
+                break;
+            case 'auth-submit':
+                flags.authSubmit = true;
+                break;
+            case 'protocol-version':
+                if (value)
+                    flags.protocolVersion = parseInt(value, 10);
+                break;
+            case 'submission-address':
+                if (value)
+                    flags.submissionAddress = value;
+                break;
+            default:
+                // "For experimental use of new features or for provider specific settings, keywords MUST be prefixed with a domain name and an underscore."
+                flags.others.push({ key, value });
+        }
+    }
+    return flags;
+};
 /**
  * Checks for a key at a specific WKD URL.
  * @param {string} url - The WKD URL for the key.
@@ -89,15 +147,26 @@ const detectKeyType = (keyData) => __awaiter(void 0, void 0, void 0, function* (
  * @returns {Promise<KeyCheckResult>} The result of the key check.
  */
 const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
+    var _a, _b, _c;
     const [policyData, keyData] = yield Promise.all([
         fetchWithCorsCheck(policy, options),
         fetchWithCorsCheck(url, options)
     ]);
+    let policyFlags = null;
+    if (policyData.response) {
+        try {
+            const policyText = yield policyData.response.text();
+            policyFlags = parsePolicy(policyText);
+        }
+        catch (_d) {
+            policyFlags = parsePolicy("");
+        }
+    }
     const result = {
         policy_location: ((_a = policyData.response) === null || _a === void 0 ? void 0 : _a.url) || policy,
         policyAvailable: !!policyData.response,
         policyCorsValid: policyData.corsValid,
+        policy: policyFlags,
         key_location: ((_b = keyData.response) === null || _b === void 0 ? void 0 : _b.url) || url,
         key_available: !!keyData.response,
         keyCorsValid: keyData.corsValid,
@@ -107,6 +176,7 @@ const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, v
         emailInKey: false,
         expired: false,
         revoked: false,
+        policyCompliant: true,
         valid: false,
     };
     if (keyData.response) {
@@ -118,15 +188,26 @@ const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, v
             const identities = yield key.getUserIDs();
             // Spec Section 5: "The mail provider MUST make sure to publish a key in a way that only the mail address belonging to the requested user is part of the User ID packets included in the returned key."
             // "Other User ID packets and their associated binding signatures MUST be removed before publication."
-            if (identities.length === 1) {
-                const id = identities[0];
-                // robustly extract email from "Name <email>" format
+            result.emailInKey = identities.length > 0;
+            for (const id of identities) {
                 const match = id.match(/<(.+)>/);
                 const emailInId = match ? match[1] : id;
-                result.emailInKey = emailInId.trim() === email;
+                if (emailInId.trim() !== email) {
+                    result.emailInKey = false;
+                    break;
+                }
             }
-            else {
-                result.emailInKey = false;
+            // Check policy compliance
+            if (((_c = result.policy) === null || _c === void 0 ? void 0 : _c.mailboxOnly) && identities.length > 0) {
+                for (const id of identities) {
+                    // If mailbox-only, the ID MUST 
+                    const match = id.match(/<(.+)>/);
+                    const emailInId = match ? match[1] : id;
+                    const expected = [`<${emailInId.trim()}>`, emailInId.trim()];
+                    if (!expected.includes(id.trim())) {
+                        result.policyCompliant = false;
+                    }
+                }
             }
             result.fingerprint = key.getFingerprint().toUpperCase();
             const expirationTime = yield key.getExpirationTime();
@@ -139,7 +220,8 @@ const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, v
     result.valid = result.policyAvailable &&
         result.key_available &&
         result.keyTypeValid &&
-        result.emailInKey;
+        result.emailInKey &&
+        result.policyCompliant;
     return result;
 });
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkd-checker",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "Web Key Directory library for Node.js. Retreive OpenPGP keys from WKD servers and validate them.",
   "repository": {
     "type": "git",