@credo-ts/core
Version:
<p align="center"> <br /> <img alt="Credo Logo" src="https://github.com/openwallet-foundation/credo-ts/blob/c7886cb8377ceb8ee4efe8d264211e561a75072d/images/credo-logo.png" height="250px" /> </p> <h1 align="center"><b>Credo - Core</b></h1
145 lines (144 loc) • 8.59 kB
JavaScript
import { TypedArrayEncoder } from "../../../utils/TypedArrayEncoder.mjs";
import { Hasher } from "../../../crypto/hashes/Hasher.mjs";
import "../../../utils/index.mjs";
import "../../kms/index.mjs";
import { publicJwkToSpki } from "../../../crypto/webcrypto/utils/keyAlgorithmConversion.mjs";
import "../../../crypto/webcrypto/utils/index.mjs";
import { convertName } from "./nameConversion.mjs";
import { AsnConvert } from "@peculiar/asn1-schema";
import { BaseCRLNumber, CRLNumber, CertificateIssuer, DistributionPoint, DistributionPointName, GeneralName, IssuingDistributionPoint, Name, Reason, id_ce_cRLNumber, id_ce_certificateIssuer, id_ce_deltaCRLIndicator, id_ce_issuingDistributionPoint } from "@peculiar/asn1-x509";
import { AuthorityKeyIdentifierExtension, BasicConstraintsExtension, CRLDistributionPointsExtension, ExtendedKeyUsageExtension, Extension, IssuerAlternativeNameExtension, KeyUsagesExtension, Name as Name$1, SubjectAlternativeNameExtension, SubjectKeyIdentifierExtension } from "@peculiar/x509";
//#region src/modules/x509/utils/extensions.ts
/**
* X.509 extension OIDs defined in RFC 5280
*/
let X509ExtensionIdentifier = /* @__PURE__ */ function(X509ExtensionIdentifier) {
/** Basic Constraints (RFC 5280 Section 4.2.1.9) */
X509ExtensionIdentifier["BasicConstraints"] = "2.5.29.19";
/** Key Usage (RFC 5280 Section 4.2.1.3) */
X509ExtensionIdentifier["KeyUsage"] = "2.5.29.15";
/** Extended Key Usage (RFC 5280 Section 4.2.1.12) */
X509ExtensionIdentifier["ExtendedKeyUsage"] = "2.5.29.37";
/** Subject Alternative Name (RFC 5280 Section 4.2.1.6) */
X509ExtensionIdentifier["SubjectAltName"] = "2.5.29.17";
/** Issuer Alternative Name (RFC 5280 Section 4.2.1.7) */
X509ExtensionIdentifier["IssuerAltName"] = "2.5.29.18";
/** Subject Key Identifier (RFC 5280 Section 4.2.1.2) */
X509ExtensionIdentifier["SubjectKeyIdentifier"] = "2.5.29.14";
/** Authority Key Identifier (RFC 5280 Section 4.2.1.1) */
X509ExtensionIdentifier["AuthorityKeyIdentifier"] = "2.5.29.35";
/** CRL Distribution Points (RFC 5280 Section 4.2.1.13) */
X509ExtensionIdentifier["CrlDistributionPoints"] = "2.5.29.31";
/** Name Constraints (RFC 5280 Section 4.2.1.10) */
X509ExtensionIdentifier["NameConstraints"] = "2.5.29.30";
/** Policy Constraints (RFC 5280 Section 4.2.1.11) */
X509ExtensionIdentifier["PolicyConstraints"] = "2.5.29.36";
return X509ExtensionIdentifier;
}({});
/**
* X.509 CRL extension OIDs defined in RFC 5280 Section 5.2.
*
* These are the extensions that may appear on a CRL itself. They are distinct from the per-entry
* CRL extensions of RFC 5280 Section 5.3 (such as `reasonCode`, `invalidityDate` and
* `certificateIssuer`), which are carried on individual revoked entries rather than the CRL.
*/
let X509CrlExtensionIdentifier = /* @__PURE__ */ function(X509CrlExtensionIdentifier) {
/** Authority Key Identifier (RFC 5280 Section 5.2.1) */
X509CrlExtensionIdentifier["AuthorityKeyIdentifier"] = "2.5.29.35";
/** Issuer Alternative Name (RFC 5280 Section 5.2.2) */
X509CrlExtensionIdentifier["IssuerAltName"] = "2.5.29.18";
/** CRL Number (RFC 5280 Section 5.2.3) */
X509CrlExtensionIdentifier["CrlNumber"] = "2.5.29.20";
/** Delta CRL Indicator (RFC 5280 Section 5.2.4) */
X509CrlExtensionIdentifier["DeltaCrlIndicator"] = "2.5.29.27";
/** Issuing Distribution Point (RFC 5280 Section 5.2.5) */
X509CrlExtensionIdentifier["IssuingDistributionPoint"] = "2.5.29.28";
/** Freshest CRL, a.k.a. Delta CRL Distribution Point (RFC 5280 Section 5.2.6) */
X509CrlExtensionIdentifier["FreshestCrl"] = "2.5.29.46";
/** Authority Information Access (RFC 5280 Section 5.2.7) */
X509CrlExtensionIdentifier["AuthorityInformationAccess"] = "1.3.6.1.5.5.7.1.1";
return X509CrlExtensionIdentifier;
}({});
const createSubjectKeyIdentifierExtension = (options, additionalOptions) => {
if (!options?.include) return;
const spki = publicJwkToSpki(additionalOptions.publicJwk);
const hash = Hasher.hash(new Uint8Array(spki.subjectPublicKey), "SHA-1");
return new SubjectKeyIdentifierExtension(TypedArrayEncoder.toHex(hash));
};
const createKeyUsagesExtension = (options) => {
if (!options) return;
const flags = options.usages.reduce((prev, curr) => prev | curr, 0);
return new KeyUsagesExtension(flags, options.markAsCritical);
};
const createExtendedKeyUsagesExtension = (options) => {
if (!options) return;
return new ExtendedKeyUsageExtension(options.usages, options.markAsCritical);
};
const createAuthorityKeyIdentifierExtension = (options, additionalOptions) => {
if (!options) return;
const spki = publicJwkToSpki(additionalOptions.publicJwk);
const hash = Hasher.hash(new Uint8Array(spki.subjectPublicKey), "SHA-1");
return new AuthorityKeyIdentifierExtension(TypedArrayEncoder.toHex(hash), options.markAsCritical);
};
const createIssuerAlternativeNameExtension = (options) => {
if (!options) return;
return new IssuerAlternativeNameExtension(options.name, options.markAsCritical);
};
const createSubjectAlternativeNameExtension = (options) => {
if (!options) return;
return new SubjectAlternativeNameExtension(options.name, options.markAsCritical);
};
const createBasicConstraintsExtension = (options) => {
if (!options) return;
return new BasicConstraintsExtension(options.ca, options.pathLenConstraint, options.markAsCritical);
};
const createCrlDistributionPointsExtension = (options) => {
if (!options) return;
const distributionPoint = new DistributionPoint({ distributionPoint: new DistributionPointName({ fullName: options.urls.map((url) => new GeneralName({ uniformResourceIdentifier: url })) }) });
if (options.reasons && options.reasons.length > 0) {
const reasonBits = options.reasons.reduce((mask, reason) => mask | 1 << reason, 0);
const reason = new Reason();
reason.fromNumber(reasonBits);
distributionPoint.reasons = reason;
}
if (options.crlIssuer) distributionPoint.cRLIssuer = [new GeneralName({ uniformResourceIdentifier: options.crlIssuer })];
return new CRLDistributionPointsExtension([distributionPoint], options.markAsCritical);
};
const createCrlNumberExtension = (options) => {
if (!options) return;
const value = AsnConvert.serialize(new CRLNumber(options.value));
return new Extension(id_ce_cRLNumber, options.markAsCritical ?? false, value);
};
const createDeltaCrlIndicatorExtension = (options) => {
if (!options) return;
const value = AsnConvert.serialize(new BaseCRLNumber(options.value));
return new Extension(id_ce_deltaCRLIndicator, options.markAsCritical ?? true, value);
};
const createIssuingDistributionPointExtension = (options) => {
if (!options) return;
const issuingDistributionPoint = new IssuingDistributionPoint({
onlyContainsUserCerts: options.onlyContainsUserCerts ?? false,
onlyContainsCACerts: options.onlyContainsCACerts ?? false,
indirectCRL: options.indirectCRL ?? false,
onlyContainsAttributeCerts: options.onlyContainsAttributeCerts ?? false
});
if (options.fullName && options.fullName.length > 0) issuingDistributionPoint.distributionPoint = new DistributionPointName({ fullName: options.fullName.map((url) => new GeneralName({ uniformResourceIdentifier: url })) });
if (options.onlySomeReasons && options.onlySomeReasons.length > 0) {
const reason = new Reason();
reason.fromNumber(options.onlySomeReasons.reduce((mask, value) => mask | 1 << value, 0));
issuingDistributionPoint.onlySomeReasons = reason;
}
return new Extension(id_ce_issuingDistributionPoint, options.markAsCritical ?? true, AsnConvert.serialize(issuingDistributionPoint));
};
/**
* Build the `certificateIssuer` CRL entry extension (RFC 5280 §5.3.3) used by indirect CRLs to
* indicate the issuer of the revoked certificate. This extension is always critical.
*/
const createCrlEntryCertificateIssuerExtension = (issuer) => {
const name = AsnConvert.parse(new Name$1(convertName(issuer)).toArrayBuffer(), Name);
const certificateIssuer = new CertificateIssuer([new GeneralName({ directoryName: name })]);
return new Extension(id_ce_certificateIssuer, true, AsnConvert.serialize(certificateIssuer));
};
//#endregion
export { X509CrlExtensionIdentifier, X509ExtensionIdentifier, createAuthorityKeyIdentifierExtension, createBasicConstraintsExtension, createCrlDistributionPointsExtension, createCrlEntryCertificateIssuerExtension, createCrlNumberExtension, createDeltaCrlIndicatorExtension, createExtendedKeyUsagesExtension, createIssuerAlternativeNameExtension, createIssuingDistributionPointExtension, createKeyUsagesExtension, createSubjectAlternativeNameExtension, createSubjectKeyIdentifierExtension };
//# sourceMappingURL=extensions.mjs.map