@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
122 lines • 6.72 kB
text/typescript
import { X509Certificate } from "./X509Certificate.mjs";
import { X509CertificateRevocationList } from "./X509CertificateRevocationList.mjs";
import { X509CheckCertificateRevocationOptions, X509FetchCertificateRevocationListOptions } from "./X509ServiceOptions.mjs";
import { X509CertificateSingleValidationResult } from "./X509ValidationResult.mjs";
import { X509ModuleConfig } from "./X509ModuleConfig.mjs";
import { AgentContext } from "../../agent/context/AgentContext.mjs";
import "../../agent/index.mjs";
//#region src/modules/x509/X509RevocationService.d.ts
export interface X509RevocationCheckResult {
isValid: boolean;
isRevoked?: boolean;
error?: Error;
details?: string;
method?: 'crl';
}
export declare class X509RevocationService {
/**
* Check the revocation status of a single certificate using CRL.
*/
static checkCertificateRevocation(agentContext: AgentContext, { certificate, issuerCertificate, revocationCheckOptions }: X509CheckCertificateRevocationOptions): Promise<X509RevocationCheckResult>;
/**
* Check the revocation status of every certificate in a chain (the leaf and, unless
* `checkFullChain` is disabled, the intermediate CAs). The root is skipped as it is self-issued and
* not covered by a CRL we can fetch and verify.
*
* The chain must be ordered from root (index 0) to leaf (last index); each certificate's issuer is
* the certificate that precedes it in the chain.
*
* The same CRL handling limitations as {@link checkCertificateRevocation} apply (CRL only; delta
* and indirect CRLs rejected; no IDP distribution-point-name matching; no `onlySomeReasons`
* cross-check; Freshest CRL / AIA and `invalidityDate` not processed).
*/
static checkCertificateChainRevocation(agentContext: AgentContext, certificateChain: X509Certificate[], config: X509ModuleConfig, verificationDate: Date): Promise<X509CertificateSingleValidationResult>;
/**
* Checks the revocation status of a certificate using CRL with proper reason partitioning
* Based on RFC 5280 Section 5.2.5
*/
private static checkCrl;
/**
* Calculate bitmask of revocation reasons covered by a distribution point
*/
private static calculateReasonMask;
/**
* Calculate the union of all reasons present in distribution points
* Used to determine the default required reasons (no point requiring reasons the issuer never published)
*/
private static calculateAllReasonsInDPs;
/**
* Convert a bitmask of revocation reasons to human-readable names
*/
private static reasonMaskToNames;
/**
* Check revocation status using a single distribution point (typically a "full" DP)
*/
private static checkDistributionPoint;
/**
* Determine whether a verified CRL can be used to authoritatively determine the revocation status
* of `certificate`. Uses the CRL's own extensions (RFC 5280 §5.2.4 Delta CRL Indicator and §5.2.5
* Issuing Distribution Point) to reject CRLs we cannot correctly interpret as a complete, direct
* CRL covering this certificate. Returns a human-readable reason when the CRL must be rejected.
*/
private static checkCrlApplicability;
/**
* Fetch and verify a CRL from a list of mirror URLs
* Tries each URL in order until one succeeds
*/
private static fetchAndVerifyCrl;
/**
* Obtain a verified CRL for a URL, preferring the cached verified summary.
*
* A summary is only reused when the provided issuer certificate carries the same subject name and
* public key the summary was verified against, its key usage (when present) permits cRLSign, and
* the summary's validity window covers `verificationDate` — together these reproduce exactly the
* issuer-dependent checks of {@link X509CertificateRevocationList.verify}, so a renewed or
* cross-certified issuer certificate (same name and key) reuses the summary directly. A reusable
* summary that is still fresh (`staleAt` in the future) is then trusted from the
* (application-controlled) cache without any network I/O; a stale one is revalidated on the full
* path, which reuses it without re-parsing when the freshly fetched bytes are unchanged.
*
* Anything else — a different key or subject name, a key usage without cRLSign, an out-of-window,
* missing or malformed summary — falls through to the full fetch-parse-verify path, which
* produces all failure results (an unreachable host is then an availability failure like any
* other fetch, also when revalidating a stale summary). On success the full path overwrites the
* summary with the new issuer binding.
*/
private static fetchVerifyAndCacheCrl;
/**
* Download a single CRL, parse it, and verify it against the issuer. When `useCache` is enabled,
* a successful verification also caches a derived summary so subsequent checks can skip the
* download and the (potentially very expensive) parse via {@link fetchVerifyAndCacheCrl}.
*
* `staleSummary` is a cached summary that passed all reuse gates but whose `staleAt` has passed:
* when the fetched bytes hash to its `crlSha256`, the parse and verification are skipped and the
* summary is re-cached with a refreshed `staleAt`.
*/
private static fetchParseVerifyAndCacheCrl;
/**
* Compute the cache TTL (in seconds) for a verified CRL summary: the full time until its
* `nextUpdate` (freshness within that window is governed by the summary's `staleAt`). Returns 0
* when the CRL is already at/after `nextUpdate` so it is not cached. A CRL without `nextUpdate`
* gets the freshness period itself as TTL, so its entry expires instead of being revalidated.
*/
private static computeCacheTtlSeconds;
/**
* Handles errors during revocation checking based on the configured mode
*/
private static handleRevocationError;
/**
* Fetch a CRL from a URL and parse it into an {@link X509CertificateRevocationList}.
*
* When `issuerCertificate` is provided, the CRL's signature, issuer name, issuer `cRLSign` key
* usage, and validity window are verified, and an error is thrown on failure. When omitted, the CRL
* is returned unverified.
*
* Note: this is a raw fetch+parse helper. Unlike {@link checkCertificateRevocation}, it does not
* apply revocation-scope/applicability checks (delta/indirect/IDP scope), so it will return a delta
* or scoped CRL as-is for inspection.
*/
static fetchCertificateRevocationList(agentContext: AgentContext, { url, issuerCertificate, timeoutMs, maxCrlSizeBytes, verificationDate }: X509FetchCertificateRevocationListOptions): Promise<X509CertificateRevocationList>;
}
//#endregion
//# sourceMappingURL=X509RevocationService.d.mts.map