@sphereon/ssi-sdk-ext.x509-utils/dist/index.d.ts

Sphereon SSI-SDK plugin functions for X.509 Certificate handling.

import { CryptoKey } from 'node';
import { JsonWebKey, JWK } from '@sphereon/ssi-types';
import { X509Certificate, AlgorithmProvider } from '@peculiar/x509';
import { Certificate } from 'pkijs';
import { SubjectPublicKeyInfo } from '@peculiar/asn1-x509';

declare enum JwkKeyUse {
    Encryption = "enc",
    Signature = "sig"
}
type HashAlgorithm = 'SHA-256' | 'SHA-512';
type KeyVisibility = 'public' | 'private';
interface X509Opts {
    cn?: string;
    privateKeyPEM?: string;
    certificatePEM?: string;
    certificateChainURL?: string;
    certificateChainPEM?: string;
}

type RSASignatureSchemes = 'RSASSA-PKCS1-V1_5' | 'RSA-PSS';
type RSAEncryptionSchemes = 'RSAES-PKCS-v1_5 ' | 'RSAES-OAEP';
declare const signAlgorithmToSchemeAndHashAlg: (signingAlg: string) => {
    scheme: "RSASSA-PKCS1-V1_5" | "RSA-PSS";
    hashAlgorithm: HashAlgorithm;
};
declare const cryptoSubtleImportRSAKey: (jwk: JsonWebKey, scheme: RSAEncryptionSchemes | RSASignatureSchemes, hashAlgorithm?: HashAlgorithm) => Promise<CryptoKey>;
declare const generateRSAKeyAsPEM: (scheme: RSAEncryptionSchemes | RSASignatureSchemes, hashAlgorithm?: HashAlgorithm, modulusLength?: number) => Promise<string>;

declare class RSASigner {
    private readonly hashAlgorithm;
    private readonly jwk;
    private key;
    private readonly scheme;
    /**
     *
     * @param key Either in PEM or JWK format (no raw hex keys here!)
     * @param opts The algorithm and signature/encryption schemes
     */
    constructor(key: string | JsonWebKey, opts?: {
        hashAlgorithm?: HashAlgorithm;
        scheme?: RSAEncryptionSchemes | RSASignatureSchemes;
        visibility?: KeyVisibility;
    });
    private getImportParams;
    private getKey;
    private bufferToString;
    sign(data: Uint8Array): Promise<string>;
    verify(data: string | Uint8Array, signature: string): Promise<boolean>;
}

declare function pemCertChainTox5c(cert: string, maxDepth?: number): string[];
declare function x5cToPemCertChain(x5c: string[], maxDepth?: number): string;
declare const pemOrDerToX509Certificate: (cert: string | Uint8Array | X509Certificate) => Certificate;
declare const areCertificatesEqual: (cert1: Certificate, cert2: Certificate) => boolean;
declare const toKeyObject: (PEM: string, visibility?: KeyVisibility) => {
    pem: string;
    jwk: JsonWebKey;
    keyHex: string;
    keyType: KeyVisibility;
};
declare const jwkToPEM: (jwk: JsonWebKey, visibility?: KeyVisibility) => string;
declare const PEMToJwk: (pem: string, visibility?: KeyVisibility) => JsonWebKey;
declare const privateKeyHexFromPEM: (PEM: string) => string;
declare const hexKeyFromPEMBasedJwk: (jwk: JsonWebKey, visibility?: KeyVisibility) => string;
declare const publicKeyHexFromPEM: (PEM: string) => string;
declare const PEMToHex: (PEM: string, headerKey?: string) => string;
declare function PEMToBinary(pem: string): Uint8Array;
/**
 * Converts a base64 encoded string to hex string, removing any non-base64 characters, including newlines
 * @param input The input in base64, with optional newlines
 * @param inputEncoding
 */
declare const base64ToHex: (input: string, inputEncoding?: "base64" | "base64pad" | "base64url" | "base64urlpad") => any;
declare const hexToBase64: (input: number | object | string, targetEncoding?: "base64" | "base64pad" | "base64url" | "base64urlpad") => string;
declare const hexToPEM: (hex: string, type: KeyVisibility) => string;
declare function PEMToDer(pem: string): string;
declare function derToPEM(cert: string, headerKey?: 'PUBLIC KEY' | 'RSA PRIVATE KEY' | 'PRIVATE KEY' | 'CERTIFICATE'): string;

type DNInfo = {
    DN: string;
    attributes: Record<string, string>;
};
type CertificateInfo = {
    certificate?: any;
    notBefore: Date;
    notAfter: Date;
    publicKeyJWK?: any;
    issuer: {
        dn: DNInfo;
    };
    subject: {
        dn: DNInfo;
        subjectAlternativeNames: SubjectAlternativeName[];
    };
};
type X509ValidationResult = {
    error: boolean;
    critical: boolean;
    message: string;
    detailMessage?: string;
    verificationTime: Date;
    certificateChain?: Array<CertificateInfo>;
    trustAnchor?: CertificateInfo;
    client?: {
        clientId: string;
        clientIdScheme: ClientIdScheme;
    };
};
declare const getCertificateInfo: (certificate: Certificate, opts?: {
    sanTypeFilter: SubjectAlternativeGeneralName | SubjectAlternativeGeneralName[];
}) => Promise<CertificateInfo>;
type X509CertificateChainValidationOpts = {
    allowNoTrustAnchorsFound?: boolean;
    trustRootWhenNoAnchors?: boolean;
    allowSingleNoCAChainElement?: boolean;
    blindlyTrustedAnchors?: string[];
    disallowReversedChain?: boolean;
    client?: {
        clientId: string;
        clientIdScheme: ClientIdScheme;
    };
};
declare const validateX509CertificateChain: ({ chain: pemOrDerChain, trustAnchors, verificationTime, opts, }: {
    chain: (Uint8Array | string)[];
    trustAnchors?: string[];
    verificationTime?: Date;
    opts?: X509CertificateChainValidationOpts;
}) => Promise<X509ValidationResult>;
declare const getX509AlgorithmProvider: () => AlgorithmProvider;
type ParsedCertificate = {
    publicKeyInfo: SubjectPublicKeyInfo;
    publicKeyJwk?: JWK;
    publicKeyRaw: Uint8Array;
    publicKeyAlgorithm: Algorithm;
    certificateInfo: CertificateInfo;
    certificate: Certificate;
    x509Certificate: X509Certificate;
};
declare const parseCertificate: (rawCert: string | Uint8Array) => Promise<ParsedCertificate>;
declare const getIssuerDN: (cert: Certificate) => DNInfo;
declare const getSubjectDN: (cert: Certificate) => DNInfo;
declare const getCertificateSubjectPublicKeyJWK: (pemOrDerCert: string | Uint8Array | Certificate) => Promise<JWK>;
/**
 *  otherName                       [0]     OtherName,
 *         rfc822Name                      [1]     IA5String,
 *         dNSName                         [2]     IA5String,
 *         x400Address                     [3]     ORAddress,
 *         directoryName                   [4]     Name,
 *         ediPartyName                    [5]     EDIPartyName,
 *         uniformResourceIdentifier       [6]     IA5String,
 *         iPAddress                       [7]     OCTET STRING,
 *         registeredID                    [8]     OBJECT IDENTIFIER }
 */
declare enum SubjectAlternativeGeneralName {
    rfc822Name = 1,// email
    dnsName = 2,
    uniformResourceIdentifier = 6,
    ipAddress = 7
}
interface SubjectAlternativeName {
    value: string;
    type: SubjectAlternativeGeneralName;
}
type ClientIdScheme = 'x509_san_dns' | 'x509_san_uri';
declare const assertCertificateMatchesClientIdScheme: (certificate: Certificate, clientId: string, clientIdScheme: ClientIdScheme) => void;
declare const validateCertificateChainMatchesClientIdScheme: (certificate: Certificate, clientId: string, clientIdScheme: ClientIdScheme) => Promise<X509ValidationResult>;
declare const getSubjectAlternativeNames: (certificate: Certificate, opts?: {
    typeFilter?: SubjectAlternativeGeneralName | SubjectAlternativeGeneralName[];
    clientIdSchemeFilter?: ClientIdScheme;
}) => SubjectAlternativeName[];

export { type CertificateInfo, type ClientIdScheme, type DNInfo, type HashAlgorithm, JwkKeyUse, type KeyVisibility, PEMToBinary, PEMToDer, PEMToHex, PEMToJwk, type ParsedCertificate, type RSAEncryptionSchemes, type RSASignatureSchemes, RSASigner, SubjectAlternativeGeneralName, type SubjectAlternativeName, type X509CertificateChainValidationOpts, type X509Opts, type X509ValidationResult, areCertificatesEqual, assertCertificateMatchesClientIdScheme, base64ToHex, cryptoSubtleImportRSAKey, derToPEM, generateRSAKeyAsPEM, getCertificateInfo, getCertificateSubjectPublicKeyJWK, getIssuerDN, getSubjectAlternativeNames, getSubjectDN, getX509AlgorithmProvider, hexKeyFromPEMBasedJwk, hexToBase64, hexToPEM, jwkToPEM, parseCertificate, pemCertChainTox5c, pemOrDerToX509Certificate, privateKeyHexFromPEM, publicKeyHexFromPEM, signAlgorithmToSchemeAndHashAlg, toKeyObject, validateCertificateChainMatchesClientIdScheme, validateX509CertificateChain, x5cToPemCertChain };