wkd-checker 2.2.0 → 2.4.0

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export interface KeyCheckResult {
     policy_location: string;
     policyAvailable: boolean;
     policyCorsValid: boolean;
+    policy: PolicyFlags | null;
     key_location: string | null;
     key_available: boolean;
     keyCorsValid: boolean;
@@ -14,6 +15,7 @@ export interface KeyCheckResult {
     emailInKey: boolean;
     expired: boolean;
     revoked: boolean;
+    policyCompliant: boolean;
     valid: boolean;
 }
 /**
@@ -24,6 +26,20 @@ export declare enum KeyType {
     BinaryKey = "BinaryKey",
     ArmoredKey = "ArmoredKey"
 }
+/**
+ * Result of the policy file check.
+ */
+export interface PolicyFlags {
+    mailboxOnly: boolean;
+    daneOnly: boolean;
+    authSubmit: boolean;
+    protocolVersion: number | null;
+    submissionAddress: string | null;
+    others: Array<{
+        key: string;
+        value: string | null;
+    }>;
+}
 export declare class WKDError extends Error {
     constructor(message: string);
 }

package/dist/index.js

@@ -80,6 +80,64 @@ const detectKeyType = (keyData) => __awaiter(void 0, void 0, void 0, function* (
         return { keyType: KeyType.Invalid, key: null };
     }
 });
+/**
+ * Parses the Policy Flags file.
+ * Section 4.5. Policy Flags
+ * @param {string} text - Content of the policy file.
+ * @returns {PolicyFlags} Parsed policy flags.
+ */
+const parsePolicy = (text) => {
+    const flags = {
+        mailboxOnly: false,
+        daneOnly: false,
+        authSubmit: false,
+        protocolVersion: null,
+        submissionAddress: null,
+        others: []
+    };
+    if (!text)
+        return flags;
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+        const trimmed = line.trim();
+        // "Empty lines and lines starting with a '#' character are considered comment lines."
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const colonIndex = trimmed.indexOf(':');
+        let key = '';
+        let value = null;
+        if (colonIndex !== -1) {
+            key = trimmed.substring(0, colonIndex).trim().toLowerCase();
+            value = trimmed.substring(colonIndex + 1).trim();
+        }
+        else {
+            key = trimmed.trim().toLowerCase();
+        }
+        switch (key) {
+            case 'mailbox-only':
+                flags.mailboxOnly = true;
+                break;
+            case 'dane-only':
+                flags.daneOnly = true;
+                break;
+            case 'auth-submit':
+                flags.authSubmit = true;
+                break;
+            case 'protocol-version':
+                if (value)
+                    flags.protocolVersion = parseInt(value, 10);
+                break;
+            case 'submission-address':
+                if (value)
+                    flags.submissionAddress = value;
+                break;
+            default:
+                // "For experimental use of new features or for provider specific settings, keywords MUST be prefixed with a domain name and an underscore."
+                flags.others.push({ key, value });
+        }
+    }
+    return flags;
+};
 /**
  * Checks for a key at a specific WKD URL.
  * @param {string} url - The WKD URL for the key.
@@ -89,15 +147,26 @@ const detectKeyType = (keyData) => __awaiter(void 0, void 0, void 0, function* (
  * @returns {Promise<KeyCheckResult>} The result of the key check.
  */
 const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
+    var _a, _b, _c;
     const [policyData, keyData] = yield Promise.all([
         fetchWithCorsCheck(policy, options),
         fetchWithCorsCheck(url, options)
     ]);
+    let policyFlags = null;
+    if (policyData.response) {
+        try {
+            const policyText = yield policyData.response.text();
+            policyFlags = parsePolicy(policyText);
+        }
+        catch (_d) {
+            policyFlags = parsePolicy("");
+        }
+    }
     const result = {
         policy_location: ((_a = policyData.response) === null || _a === void 0 ? void 0 : _a.url) || policy,
         policyAvailable: !!policyData.response,
         policyCorsValid: policyData.corsValid,
+        policy: policyFlags,
         key_location: ((_b = keyData.response) === null || _b === void 0 ? void 0 : _b.url) || url,
         key_available: !!keyData.response,
         keyCorsValid: keyData.corsValid,
@@ -107,6 +176,7 @@ const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, v
         emailInKey: false,
         expired: false,
         revoked: false,
+        policyCompliant: true,
         valid: false,
     };
     if (keyData.response) {
@@ -116,15 +186,25 @@ const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, v
         result.keyTypeValid = keyType === KeyType.BinaryKey;
         if (key) {
             const identities = yield key.getUserIDs();
-            // Spec Section 5: "The mail provider MUST make sure to publish a key in a way that only the mail address belonging to the requested user is part of the User ID packets included in the returned key."
-            // "Other User ID packets and their associated binding signatures MUST be removed before publication."
-            result.emailInKey = identities.length > 0;
-            for (const id of identities) {
-                const match = id.match(/<(.+)>/);
-                const emailInId = match ? match[1] : id;
-                if (emailInId.trim() !== email) {
-                    result.emailInKey = false;
-                    break;
+            // Helper to extract email address from User ID string ("Name <email@domain>" or "email@domain")
+            const extractEmail = (id) => {
+                const match = id.match(/<([^>]+)>/);
+                return (match ? match[1] : id).trim().toLowerCase();
+            };
+            const targetEmail = email.trim().toLowerCase();
+            const emailsInKey = identities.map(extractEmail);
+            // Spec Section 3.1 & Section 5: The key needs to carry a User ID packet with that mail address.
+            // Client MUST check that the received key has the requested User-Id and MUST drop all other User-Ids.
+            result.emailInKey = emailsInKey.includes(targetEmail);
+            // Check policy compliance
+            if (((_c = result.policy) === null || _c === void 0 ? void 0 : _c.mailboxOnly) && identities.length > 0) {
+                for (const id of identities) {
+                    const emailInId = extractEmail(id);
+                    const expected = [`<${emailInId}>`, emailInId];
+                    if (!expected.includes(id.trim().toLowerCase())) {
+                        result.policyCompliant = false;
+                        break;
+                    }
                 }
             }
             result.fingerprint = key.getFingerprint().toUpperCase();
@@ -138,7 +218,8 @@ const checkKeyUrl = (url, policy, options, email) => __awaiter(void 0, void 0, v
     result.valid = result.policyAvailable &&
         result.key_available &&
         result.keyTypeValid &&
-        result.emailInKey;
+        result.emailInKey &&
+        result.policyCompliant;
     return result;
 });
 /**
@@ -237,6 +318,9 @@ exports.getKey = getKey;
  * @returns {Promise<{ advanced: KeyCheckResult, direct: KeyCheckResult }>} Results for both lookup methods.
  */
 const checkKey = (email) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!(0, exports.validateEmail)(email)) {
+        throw new WKDError('Invalid e-mail address.');
+    }
     const { advancedUrl, directUrl, advancedPolicyUrl, directPolicyUrl } = yield generateWkdUrls(email);
     const options = {
         headers: { "User-Agent": USER_AGENT }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wkd-checker",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Web Key Directory library for Node.js. Retreive OpenPGP keys from WKD servers and validate them.",
   "repository": {
     "type": "git",