@sphereon/ssi-sdk-ext.kms-azure
Version:
Sphereon SSI-SDK plugin for Azure KeyVault Key Management System.
182 lines (180 loc) • 7.6 kB
JavaScript
;
var __create = Object.create;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __getProtoOf = Object.getPrototypeOf;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
var __export = (target, all) => {
for (var name in all)
__defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
if (from && typeof from === "object" || typeof from === "function") {
for (let key of __getOwnPropNames(from))
if (!__hasOwnProp.call(to, key) && key !== except)
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
}
return to;
};
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
// If the importer is in node compatibility mode or this is not an ESM
// file that has been converted to a CommonJS file using a Babel-
// compatible transform (i.e. "__esModule" has not been set), then set
// "default" to the CommonJS "module.exports" for node compatibility.
isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
mod
));
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
// src/index.ts
var index_exports = {};
__export(index_exports, {
AzureKeyVaultKeyManagementSystem: () => AzureKeyVaultKeyManagementSystem
});
module.exports = __toCommonJS(index_exports);
// src/AzureKeyVaultKeyManagementSystem.ts
var import_kmp_crypto_kms_azure = require("@sphereon/kmp-crypto-kms-azure");
var kmsAzure = __toESM(require("@sphereon/kmp-crypto-kms-azure"), 1);
var import_key_manager = require("@veramo/key-manager");
var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.key-utils");
var import_ssi_types = require("@sphereon/ssi-types");
var SignatureAlgorithm = kmsAzure.com.sphereon.crypto.generic.SignatureAlgorithm;
var KeyOperations = kmsAzure.com.sphereon.crypto.generic.KeyOperations;
var JwkUse = kmsAzure.com.sphereon.crypto.jose.JwkUse;
var AzureKeyVaultKeyManagementSystem = class extends import_key_manager.AbstractKeyManagementSystem {
static {
__name(this, "AzureKeyVaultKeyManagementSystem");
}
client;
id;
constructor(options) {
super();
const credentialOptions = new kmsAzure.com.sphereon.crypto.kms.azure.CredentialOpts(kmsAzure.com.sphereon.crypto.kms.azure.CredentialMode.SERVICE_CLIENT_SECRET, new kmsAzure.com.sphereon.crypto.kms.azure.SecretCredentialOpts(options.keyVaultClientId, options.keyVaultClientSecret));
const azureKeyVaultClientConfig = new kmsAzure.com.sphereon.crypto.kms.azure.AzureKeyVaultClientConfig(options.applicationId, options.keyVaultUrl, options.keyVaultClientIdTenantId, credentialOptions);
this.id = options.applicationId;
this.client = new import_kmp_crypto_kms_azure.AzureKeyVaultCryptoProvider(azureKeyVaultClientConfig);
}
async createKey(args) {
const { type, meta } = args;
const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type);
const options = new import_kmp_crypto_kms_azure.AzureKeyVaultCryptoProvider.GenerateKeyRequest(meta?.keyAlias || `key-${crypto.randomUUID()}`, meta && "keyUsage" in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.sig, meta && "keyOperations" in meta ? this.mapKeyOperations(meta.keyOperations) : [
KeyOperations.SIGN
], signatureAlgorithm);
const key = await this.client.generateKeyAsync(options);
const jwk = {
...key.jose.publicJwk.toPublicKey(),
kty: key.jose.publicJwk.toPublicKey().kty.name,
crv: this.signatureAlgorithmToCurve(signatureAlgorithm),
x: key.jose.publicJwk.toPublicKey().x,
y: key.jose.publicJwk.toPublicKey().y,
kid: key.jose.publicJwk.toPublicKey().kid
};
return {
kid: key.kmsKeyRef,
kms: this.id,
type,
meta: {
alias: key.kid,
algorithms: [
key.jose.publicJwk.alg?.name ?? "PS256"
],
jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
jwk,
digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm)
})
},
publicKeyHex: Buffer.from(key.jose.toString(), "utf8").toString("base64")
};
}
async sign(args) {
if (!args.keyRef) {
throw new Error("key_not_found: No key ref provided");
}
const key = await this.client.fetchKeyAsync(args.keyRef.kid);
const signature = await this.client.createRawSignatureAsync({
keyInfo: key,
// @ts-ignore
input: args.data
});
return Buffer.from(signature).toString("hex");
}
async verify(args) {
if (!args.keyRef) {
throw new Error("key_not_found: No key ref provided");
}
try {
const key = await this.client.fetchKeyAsync(args.keyRef.kid);
return await this.client.isValidRawSignatureAsync({
keyInfo: key,
// @ts-ignore
signature: Buffer.from(args.signature, "hex"),
// @ts-ignore
input: args.data
});
} catch (e) {
console.error(e);
return false;
}
}
sharedSecret(args) {
throw new Error("sharedSecret is not implemented for AzureKeyVaultKMS.");
}
async importKey(args) {
throw new Error("importKey is not implemented for AzureKeyVaultKMS.");
}
async deleteKey({ kid }) {
throw new Error("deleteKey is not implemented for AzureKeyVaultKMS.");
}
async listKeys() {
throw new Error("listKeys is not implemented for AzureKeyVaultKMS.");
}
signatureAlgorithmToDigestAlgorithm = /* @__PURE__ */ __name((signatureAlgorithm) => {
switch (signatureAlgorithm) {
case SignatureAlgorithm.ECDSA_SHA256:
return "sha256";
default:
throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by AzureKeyVaultKMS`);
}
}, "signatureAlgorithmToDigestAlgorithm");
signatureAlgorithmToCurve = /* @__PURE__ */ __name((signatureAlgorithm) => {
switch (signatureAlgorithm) {
case SignatureAlgorithm.ECDSA_SHA256:
return import_ssi_types.JoseCurve.P_256;
default:
throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by AzureKeyVaultKMS`);
}
}, "signatureAlgorithmToCurve");
mapKeyUsage = /* @__PURE__ */ __name((usage) => {
switch (usage) {
case "sig":
return JwkUse.sig;
case "enc":
return JwkUse.enc;
default:
throw new Error(`Key usage ${usage} is not supported by AzureKeyVaultKMS`);
}
}, "mapKeyUsage");
mapKeyTypeToSignatureAlgorithm = /* @__PURE__ */ __name((type) => {
switch (type) {
case "Secp256r1":
return SignatureAlgorithm.ECDSA_SHA256;
default:
throw new Error(`Key type ${type} is not supported by AzureKeyVaultKMS`);
}
}, "mapKeyTypeToSignatureAlgorithm");
mapKeyOperation = /* @__PURE__ */ __name((operation) => {
switch (operation) {
case "sign":
return KeyOperations.SIGN;
case "verify":
return KeyOperations.VERIFY;
default:
throw new Error(`Key operation ${operation} is not supported by AzureKeyVaultKMS`);
}
}, "mapKeyOperation");
mapKeyOperations = /* @__PURE__ */ __name((operations) => {
return operations.map((operation) => this.mapKeyOperation(operation));
}, "mapKeyOperations");
};
//# sourceMappingURL=index.cjs.map