@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
1 lines • 8.63 kB
Source Map (JSON)
{"version":3,"file":"KmsDecryptOptions.mjs","names":["z"],"sources":["../../../../src/modules/kms/options/KmsDecryptOptions.ts"],"sourcesContent":["import { z } from 'zod'\nimport { zAnyUint8Array } from '../../../utils/zod'\nimport { isJwaHpkeAlgorithm, KnownJwaContentEncryptionAlgorithms } from '../jwk/jwa'\nimport { zKmsJwkPrivateOct } from '../jwk/kty/oct/octJwk'\nimport { zKmsKeyId } from './common'\nimport { zKmsKeyAgreementDecryptOptions } from './KmsKeyAgreementDecryptOptions'\n\nconst zKmsDecryptDataDecryptionAesGcm = z.object({\n // AES-GCM Content Decryption\n algorithm: z.enum([\n KnownJwaContentEncryptionAlgorithms.A128GCM,\n KnownJwaContentEncryptionAlgorithms.A192GCM,\n KnownJwaContentEncryptionAlgorithms.A256GCM,\n ]),\n\n iv: zAnyUint8Array.refine((iv) => iv.length === 12, 'iv must be 12 bytes for AES GCM'),\n aad: z.optional(zAnyUint8Array),\n tag: zAnyUint8Array,\n})\nexport type KmsDecryptDataDecryptionAesGcm = z.output<typeof zKmsDecryptDataDecryptionAesGcm>\n\n// AES-CBC Content Decryption\nconst zKmsDecryptDataDecryptionAesCbc = z.object({\n algorithm: z.enum([KnownJwaContentEncryptionAlgorithms.A128CBC, KnownJwaContentEncryptionAlgorithms.A256CBC]),\n iv: zAnyUint8Array.refine((iv) => iv.length === 16, 'iv must be 16 bytes for AES CBC'),\n})\nexport type KmsDecryptDataDecryptionAesCbc = z.output<typeof zKmsDecryptDataDecryptionAesCbc>\n\n// AES-CBC Content Decryption\nconst zKmsDecryptDataDecryptionAesCbcHmac = z.object({\n algorithm: z.enum([\n KnownJwaContentEncryptionAlgorithms.A128CBC_HS256,\n KnownJwaContentEncryptionAlgorithms.A192CBC_HS384,\n KnownJwaContentEncryptionAlgorithms.A256CBC_HS512,\n ]),\n iv: zAnyUint8Array.refine((iv) => iv.length === 16, 'iv must be 16 bytes for AES CBC with HMAC'),\n aad: z.optional(zAnyUint8Array),\n tag: zAnyUint8Array,\n})\nexport type KmsDecryptDataDecryptionAesCbcHmac = z.output<typeof zKmsDecryptDataDecryptionAesCbcHmac>\n\n// XSalsa20-Poly1305 Content Decryption\nconst zKmsDecryptDataDecryptionSalsa = z.object({\n algorithm: z.enum([KnownJwaContentEncryptionAlgorithms['XSALSA20-POLY1305']]),\n iv: zAnyUint8Array.optional(),\n})\n\n// ChaCha20-Poly1305 Content Decryption\nconst zKmsDecryptDataDecryptionC20p = z.object({\n algorithm: z.enum([KnownJwaContentEncryptionAlgorithms.C20P, KnownJwaContentEncryptionAlgorithms.XC20P]),\n iv: zAnyUint8Array,\n aad: z.optional(zAnyUint8Array),\n tag: zAnyUint8Array,\n})\n// FIXME: see how we can do refine with the discriminated union\n// .refine(\n// ({ iv, algorithm }) => iv.length === (algorithm === 'C20P' ? 12 : 24),\n// `iv must be 12 bytes for C20P (ChaCha20-Poly1305) or 24 bytes for XC20P (XChaCha20-Poly1305)`\n// )\nexport type KmsDecryptDataDecryptionC20p = z.output<typeof zKmsDecryptDataDecryptionC20p>\n\n/**\n * Integrated-encryption HPKE. The HPKE suite (see the `HPKE-*` key agreement algorithms) fixes the\n * AEAD, and both the content encryption key and the nonce are derived from the HPKE key schedule.\n * The tag is part of the HPKE ciphertext, so the only parameter left to the caller is the aad.\n */\nconst zKmsDecryptDataDecryptionHpke = z.object({\n algorithm: z.literal('HPKE'),\n aad: z.optional(zAnyUint8Array),\n})\nexport type KmsDecryptDataDecryptionHpke = z.output<typeof zKmsDecryptDataDecryptionHpke>\n\nconst zKmsDecryptDataDecryption = z.discriminatedUnion('algorithm', [\n zKmsDecryptDataDecryptionAesCbc,\n zKmsDecryptDataDecryptionAesCbcHmac,\n zKmsDecryptDataDecryptionAesGcm,\n zKmsDecryptDataDecryptionC20p,\n zKmsDecryptDataDecryptionSalsa,\n zKmsDecryptDataDecryptionHpke,\n])\nexport type KmsDecryptDataDecryption = z.output<typeof zKmsDecryptDataDecryption>\n\n/**\n * Content decryption excluding the integrated-encryption HPKE marker, so the AEAD parameters a\n * backend performs the actual content decryption with.\n */\nexport type KmsDecryptDataContentDecryption = Exclude<KmsDecryptDataDecryption, { algorithm: 'HPKE' }>\n\nexport const zKmsDecryptOptions = z\n .object({\n /**\n * The key to use for decrypting. There are three possible formats:\n * - a key id, pointing to a symmetric (oct) jwk that can be used directly for decryption\n * - a private symmetric (oct) jwk object that can be used directly for decryption\n * - an object configuring key agreement, based on an existing asymmetric key\n */\n key: z.union([\n z.object({\n keyId: zKmsKeyId,\n\n // never helps with type narrowing\n privateJwk: z.never().optional(),\n keyAgreement: z.never().optional(),\n }),\n z.object({\n privateJwk: zKmsJwkPrivateOct.describe('A private oct (symmetric) jwk'),\n\n // never helps with type narrowing\n keyId: z.never().optional(),\n keyAgreement: z.never().optional(),\n }),\n z.object({\n keyAgreement: zKmsKeyAgreementDecryptOptions,\n\n // never helps with type narrowing\n keyId: z.never().optional(),\n privateJwk: z.never().optional(),\n }),\n ]),\n\n /**\n * The decryption algorithm used to decrypt the data/content.\n * In JWE this parameter is referred to as \"enc\".\n *\n * Must be 'HPKE' for the integrated-encryption HPKE algorithms, where the suite fixes the AEAD\n * and only the aad is left to the caller.\n */\n decryption: zKmsDecryptDataDecryption.describe(\n 'Options related to the decryption algorithm to use for decrypting the data'\n ),\n\n /**\n * The encrypted data to decrypt\n */\n encrypted: zAnyUint8Array.describe('The encrypted data to decrypt'),\n })\n .check(({ value, issues }) => {\n const usesIntegratedEncryption = value.key.keyAgreement && isJwaHpkeAlgorithm(value.key.keyAgreement.algorithm)\n const usesHpkeContentDecryption = value.decryption.algorithm === 'HPKE'\n\n if (usesIntegratedEncryption && !usesHpkeContentDecryption) {\n issues.push({\n code: 'custom',\n input: value.decryption,\n path: ['decryption', 'algorithm'],\n message: `'decryption.algorithm' must be 'HPKE' for key agreement algorithm '${value.key.keyAgreement?.algorithm}', as the HPKE suite defines the content encryption algorithm`,\n })\n } else if (!usesIntegratedEncryption && usesHpkeContentDecryption) {\n issues.push({\n code: 'custom',\n input: value.decryption,\n path: ['decryption', 'algorithm'],\n message: `'decryption.algorithm' 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`,\n })\n }\n })\n\nexport type KmsDecryptOptions = z.output<typeof zKmsDecryptOptions>\n\nexport interface KmsDecryptReturn {\n /**\n * The decrypted data\n */\n data: Uint8Array\n}\n"],"mappings":";;;;;;;AAOA,MAAM,kCAAkCA,IAAE,OAAO;CAE/C,WAAWA,IAAE,KAAK;EAChB,oCAAoC;EACpC,oCAAoC;EACpC,oCAAoC;CACtC,CAAC;CAED,IAAI,eAAe,QAAQ,OAAO,GAAG,WAAW,IAAI,iCAAiC;CACrF,KAAKA,IAAE,SAAS,cAAc;CAC9B,KAAK;AACP,CAAC;AAID,MAAM,kCAAkCA,IAAE,OAAO;CAC/C,WAAWA,IAAE,KAAK,CAAC,oCAAoC,SAAS,oCAAoC,OAAO,CAAC;CAC5G,IAAI,eAAe,QAAQ,OAAO,GAAG,WAAW,IAAI,iCAAiC;AACvF,CAAC;AAID,MAAM,sCAAsCA,IAAE,OAAO;CACnD,WAAWA,IAAE,KAAK;EAChB,oCAAoC;EACpC,oCAAoC;EACpC,oCAAoC;CACtC,CAAC;CACD,IAAI,eAAe,QAAQ,OAAO,GAAG,WAAW,IAAI,2CAA2C;CAC/F,KAAKA,IAAE,SAAS,cAAc;CAC9B,KAAK;AACP,CAAC;AAID,MAAM,iCAAiCA,IAAE,OAAO;CAC9C,WAAWA,IAAE,KAAK,CAAC,oCAAoC,oBAAoB,CAAC;CAC5E,IAAI,eAAe,SAAS;AAC9B,CAAC;AAGD,MAAM,gCAAgCA,IAAE,OAAO;CAC7C,WAAWA,IAAE,KAAK,CAAC,oCAAoC,MAAM,oCAAoC,KAAK,CAAC;CACvG,IAAI;CACJ,KAAKA,IAAE,SAAS,cAAc;CAC9B,KAAK;AACP,CAAC;;;;;;AAaD,MAAM,gCAAgCA,IAAE,OAAO;CAC7C,WAAWA,IAAE,QAAQ,MAAM;CAC3B,KAAKA,IAAE,SAAS,cAAc;AAChC,CAAC;AAGD,MAAM,4BAA4BA,IAAE,mBAAmB,aAAa;CAClE;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AASD,MAAa,qBAAqBA,IAC/B,OAAO;;;;;;;CAON,KAAKA,IAAE,MAAM;EACXA,IAAE,OAAO;GACP,OAAO;GAGP,YAAYA,IAAE,MAAM,CAAC,CAAC,SAAS;GAC/B,cAAcA,IAAE,MAAM,CAAC,CAAC,SAAS;EACnC,CAAC;EACDA,IAAE,OAAO;GACP,YAAY,kBAAkB,SAAS,+BAA+B;GAGtE,OAAOA,IAAE,MAAM,CAAC,CAAC,SAAS;GAC1B,cAAcA,IAAE,MAAM,CAAC,CAAC,SAAS;EACnC,CAAC;EACDA,IAAE,OAAO;GACP,cAAc;GAGd,OAAOA,IAAE,MAAM,CAAC,CAAC,SAAS;GAC1B,YAAYA,IAAE,MAAM,CAAC,CAAC,SAAS;EACjC,CAAC;CACH,CAAC;;;;;;;;CASD,YAAY,0BAA0B,SACpC,4EACF;;;;CAKA,WAAW,eAAe,SAAS,+BAA+B;AACpE,CAAC,CAAC,CACD,OAAO,EAAE,OAAO,aAAa;CAC5B,MAAM,2BAA2B,MAAM,IAAI,gBAAgB,mBAAmB,MAAM,IAAI,aAAa,SAAS;CAC9G,MAAM,4BAA4B,MAAM,WAAW,cAAc;CAEjE,IAAI,4BAA4B,CAAC,2BAC/B,OAAO,KAAK;EACV,MAAM;EACN,OAAO,MAAM;EACb,MAAM,CAAC,cAAc,WAAW;EAChC,SAAS,sEAAsE,MAAM,IAAI,cAAc,UAAU;CACnH,CAAC;MACI,IAAI,CAAC,4BAA4B,2BACtC,OAAO,KAAK;EACV,MAAM;EACN,OAAO,MAAM;EACb,MAAM,CAAC,cAAc,WAAW;EAChC,SAAS;CACX,CAAC;AAEL,CAAC"}