@praecise/tere
Version:
Trusted Execution Runtime Environment SDK
436 lines (435 loc) • 17 kB
JavaScript
;
// packages/sdk/src/runtime.ts
Object.defineProperty(exports, "__esModule", { value: true });
exports.SecureLog = exports.Attestation = exports.CloudKms = exports.Crypto = exports.CryptoProvider = exports.AccessControl = exports.State = void 0;
/**
* Runtime API for TERE scripts
* These functions are available to scripts running inside the TEE
*/
/**
* State management API for storing and retrieving data
*/
class State {
/**
* Get a value from the state store
* @param key The key to retrieve
* @returns The value, or null if not found
*/
static get(key) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_state_get) === null || _a === void 0 ? void 0 : _a.call(global, key)) !== null && _b !== void 0 ? _b : null;
}
/**
* Set a value in the state store
* @param key The key to set
* @param value The value to store
* @param callerId Optional caller ID for access control
* @returns True if successful
*/
static set(key, value, callerId) {
var _a, _b;
const serializedValue = typeof value === 'string' ? value : JSON.stringify(value);
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_state_set) === null || _a === void 0 ? void 0 : _a.call(global, key, serializedValue, callerId)) !== null && _b !== void 0 ? _b : false;
}
/**
* Check if a key exists in the state store
* @param key The key to check
* @returns True if the key exists
*/
static exists(key) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_state_exists) === null || _a === void 0 ? void 0 : _a.call(global, key)) !== null && _b !== void 0 ? _b : false;
}
/**
* Remove a value from the state store
* @param key The key to remove
* @param callerId Optional caller ID for access control
* @returns The removed value, or null if not found
*/
static remove(key, callerId) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_state_remove) === null || _a === void 0 ? void 0 : _a.call(global, key, callerId)) !== null && _b !== void 0 ? _b : null;
}
}
exports.State = State;
/**
* Access control API for managing permissions
*/
class AccessControl {
/**
* Set an access rule for a key
* @param key The key to set the rule for
* @param rule The access rule
* @param callerId Optional caller ID for access control
* @returns True if successful
*/
static setAccessRule(key, rule, callerId) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_access_control_set_rule) === null || _a === void 0 ? void 0 : _a.call(global, key, JSON.stringify(rule), callerId)) !== null && _b !== void 0 ? _b : false;
}
/**
* Get the access rule for a key
* @param key The key to get the rule for
* @returns The access rule, or null if not found
*/
static getAccessRule(key) {
var _a;
// @ts-ignore - This is replaced at runtime
const rule = (_a = global.__tere_access_control_get_rule) === null || _a === void 0 ? void 0 : _a.call(global, key);
if (!rule)
return null;
return JSON.parse(rule);
}
}
exports.AccessControl = AccessControl;
/**
* HSM crypto provider class
*/
class CryptoProvider {
/**
* Create a new crypto provider
* @param options Provider options
*/
constructor(options) {
this.options = options || {};
}
/**
* Create a new key in the HSM
* @param keyId ID for the key
* @param purpose Key purpose: 'encrypt', 'sign', or 'decrypt'
* @param algorithm Optional algorithm specification
* @returns Information about the created key
*/
async createKey(keyId, purpose, algorithm) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_hsm_create_key) === null || _a === void 0 ? void 0 : _a.call(global, keyId, purpose, algorithm, this.options)) !== null && _b !== void 0 ? _b : {};
}
/**
* Get an existing key or create it if it doesn't exist
* @param keyId ID for the key
* @param purpose Key purpose: 'encrypt', 'sign', or 'decrypt'
* @param algorithm Optional algorithm specification
* @returns Information about the key
*/
async getOrCreateKey(keyId, purpose, algorithm) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_hsm_get_or_create_key) === null || _a === void 0 ? void 0 : _a.call(global, keyId, purpose, algorithm, this.options)) !== null && _b !== void 0 ? _b : {};
}
/**
* Encrypt data using an HSM-backed key
* @param data Data to encrypt
* @param keyId ID of the HSM key to use
* @returns The encrypted data
*/
async encrypt(data, keyId) {
var _a, _b;
const dataArray = typeof data === 'string'
? new TextEncoder().encode(data)
: data;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_hsm_encrypt) === null || _a === void 0 ? void 0 : _a.call(global, dataArray, keyId, this.options)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Decrypt data using an HSM-backed key
* @param encryptedData Data to decrypt
* @param keyId ID of the HSM key to use
* @returns The decrypted data
*/
async decrypt(encryptedData, keyId) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_hsm_decrypt) === null || _a === void 0 ? void 0 : _a.call(global, encryptedData, keyId, this.options)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Sign data using an HSM-backed key
* @param data Data to sign
* @param keyId ID of the HSM signing key to use
* @returns The signature
*/
async sign(data, keyId) {
var _a, _b;
const dataArray = typeof data === 'string'
? new TextEncoder().encode(data)
: data;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_hsm_sign) === null || _a === void 0 ? void 0 : _a.call(global, dataArray, keyId, this.options)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Verify a signature using an HSM-backed key
* @param data Original data that was signed
* @param signature Signature to verify
* @param keyId ID of the HSM signing key to use
* @returns True if the signature is valid
*/
async verify(data, signature, keyId) {
var _a, _b;
const dataArray = typeof data === 'string'
? new TextEncoder().encode(data)
: data;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_hsm_verify) === null || _a === void 0 ? void 0 : _a.call(global, dataArray, signature, keyId, this.options)) !== null && _b !== void 0 ? _b : false;
}
/**
* List all keys in the HSM key ring
* @returns Array of key information objects
*/
async listKeys() {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_hsm_list_keys) === null || _a === void 0 ? void 0 : _a.call(global, this.options)) !== null && _b !== void 0 ? _b : [];
}
}
exports.CryptoProvider = CryptoProvider;
/**
* Cryptography API for secure operations
*/
class Crypto {
/**
* Encrypt data using AES-GCM
* @param data The data to encrypt
* @param key The encryption key (32 bytes)
* @param options Optional configuration for encryption
* @returns The encrypted data with the nonce prepended
*/
static encrypt(data, key, options) {
var _a, _b;
const dataArray = typeof data === 'string'
? new TextEncoder().encode(data)
: data;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_crypto_encrypt) === null || _a === void 0 ? void 0 : _a.call(global, dataArray, key, options)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Decrypt data using AES-GCM
* @param encryptedData The encrypted data with nonce prepended
* @param key The encryption key (32 bytes)
* @param options Optional configuration for decryption
* @returns The decrypted data
*/
static decrypt(encryptedData, key, options) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_crypto_decrypt) === null || _a === void 0 ? void 0 : _a.call(global, encryptedData, key, options)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Compute a SHA-256 hash
* @param data The data to hash
* @returns The hash value
*/
static hash(data) {
var _a, _b;
const dataArray = typeof data === 'string'
? new TextEncoder().encode(data)
: data;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_crypto_hash) === null || _a === void 0 ? void 0 : _a.call(global, dataArray)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Generate a cryptographically secure random key
* @param options Optional configuration for key generation
* @returns A 32-byte random key
*/
static generateKey(options) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_crypto_generate_key) === null || _a === void 0 ? void 0 : _a.call(global, options)) !== null && _b !== void 0 ? _b : new Uint8Array(32);
}
/**
* Generate random bytes
* @param length The number of bytes to generate
* @returns Random bytes
*/
static randomBytes(length) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_crypto_random_bytes) === null || _a === void 0 ? void 0 : _a.call(global, length)) !== null && _b !== void 0 ? _b : new Uint8Array(length);
}
/**
* Derive a key from a password
* @param password The password
* @param salt The salt (16 bytes recommended)
* @param iterations The number of iterations (recommend at least 100,000)
* @param options Optional configuration for key derivation
* @returns The derived key
*/
static deriveKeyFromPassword(password, salt, iterations, options) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_crypto_derive_key) === null || _a === void 0 ? void 0 : _a.call(global, password, salt, iterations, options)) !== null && _b !== void 0 ? _b : new Uint8Array(32);
}
/**
* Create a cryptography provider that uses HSM for operations
* @param options Configuration for the HSM provider
* @returns A provider object for HSM-backed operations
*/
static withHsmProvider(options) {
return new CryptoProvider({
provider: 'hsm',
protection: 'hsm',
...options
});
}
/**
* Create a cryptography provider that uses software for operations
* @param options Configuration for the software provider
* @returns A provider object for software operations
*/
static withSoftwareProvider(options) {
return new CryptoProvider({
provider: 'software',
protection: 'software',
...options
});
}
}
exports.Crypto = Crypto;
/**
* Cloud KMS integration for key management
*/
class CloudKms {
/**
* Encrypt data using a cloud-managed key
* @param data The data to encrypt
* @param keyName The name of the key
* @returns The encrypted data
*/
static async encrypt(data, keyName) {
var _a, _b;
const dataArray = typeof data === 'string'
? new TextEncoder().encode(data)
: data;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_cloud_kms_encrypt) === null || _a === void 0 ? void 0 : _a.call(global, dataArray, keyName)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Decrypt data using a cloud-managed key
* @param encryptedData The encrypted data
* @param keyName The name of the key
* @returns The decrypted data
*/
static async decrypt(encryptedData, keyName) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_cloud_kms_decrypt) === null || _a === void 0 ? void 0 : _a.call(global, encryptedData, keyName)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Create a new key in Cloud KMS
* @param keyName The name of the key to create
* @param purpose The purpose of the key ('encrypt', 'sign', etc.)
* @param options Optional configuration
* @returns Information about the created key
*/
static async createKey(keyName, purpose, options) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_cloud_kms_create_key) === null || _a === void 0 ? void 0 : _a.call(global, keyName, purpose, options)) !== null && _b !== void 0 ? _b : {};
}
/**
* Sign data using a cloud-managed key
* @param data The data to sign
* @param keyName The name of the key
* @returns The signature
*/
static async sign(data, keyName) {
var _a, _b;
const dataArray = typeof data === 'string'
? new TextEncoder().encode(data)
: data;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_cloud_kms_sign) === null || _a === void 0 ? void 0 : _a.call(global, dataArray, keyName)) !== null && _b !== void 0 ? _b : new Uint8Array(0);
}
/**
* Verify a signature using a cloud-managed key
* @param data The data that was signed
* @param signature The signature to verify
* @param keyName The name of the key
* @returns True if the signature is valid
*/
static async verify(data, signature, keyName) {
var _a, _b;
const dataArray = typeof data === 'string'
? new TextEncoder().encode(data)
: data;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_cloud_kms_verify) === null || _a === void 0 ? void 0 : _a.call(global, dataArray, signature, keyName)) !== null && _b !== void 0 ? _b : false;
}
}
exports.CloudKms = CloudKms;
/**
* Attestation API for TEE verification
*/
class Attestation {
/**
* Get attestation report for the current TEE
* @param nonce Optional nonce for freshness
* @returns The attestation report
*/
static getReport(nonce) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_attestation_get_report) === null || _a === void 0 ? void 0 : _a.call(global, nonce)) !== null && _b !== void 0 ? _b : '';
}
/**
* Verify an attestation report
* @param attestation The attestation report to verify
* @param expectedNonce Optional nonce to verify
* @returns True if the attestation is valid
*/
static verify(attestation, expectedNonce) {
var _a, _b;
// @ts-ignore - This is replaced at runtime
return (_b = (_a = global.__tere_attestation_verify) === null || _a === void 0 ? void 0 : _a.call(global, attestation, expectedNonce)) !== null && _b !== void 0 ? _b : false;
}
}
exports.Attestation = Attestation;
/**
* Secure logging utilities
*/
class SecureLog {
/**
* Log a message securely (does not expose sensitive data)
* @param message The message to log
* @param level The log level
*/
static log(message, level = 'info') {
var _a;
// @ts-ignore - This is replaced at runtime
(_a = global.__tere_secure_log) === null || _a === void 0 ? void 0 : _a.call(global, message, level);
}
/**
* Log information
* @param message The message to log
*/
static info(message) {
SecureLog.log(message, 'info');
}
/**
* Log a warning
* @param message The message to log
*/
static warn(message) {
SecureLog.log(message, 'warn');
}
/**
* Log an error
* @param message The message to log
*/
static error(message) {
SecureLog.log(message, 'error');
}
/**
* Log debug information
* @param message The message to log
*/
static debug(message) {
SecureLog.log(message, 'debug');
}
}
exports.SecureLog = SecureLog;