@webda/core
Version:
Expose API with Lambda
304 lines (303 loc) • 7.33 kB
TypeScript
import * as util from "util";
import { OperationContext, RegistryEntry, Store } from "../index.js";
import { DeepPartial, Service, ServiceParameters } from "./service.js";
export declare class SecretString {
protected str: string;
protected encrypter: string;
constructor(str: string, encrypter: string);
static from(value: string | SecretString, path?: string): string;
getValue(): string;
toString(): string;
[util.inspect.custom](depth: any, options: any, inspect: any): string;
}
export interface KeysRegistry {
/**
* Contains the instanceId of the last
* service who rotated
*/
rotationInstance: string;
/**
* Key storage
*/
[keys: `key_${string}`]: {
publicKey: string;
privateKey: string;
symetric: string;
};
/**
* Current key
*/
current: string;
}
/**
* Encrypt/Decrypt string
*/
export interface StringEncrypter {
/**
* Encrypt a string
* @param data
* @returns
*/
encrypt(data: string, options?: any): Promise<string>;
/**
* Decrypt a string
* @param data
* @returns
*/
decrypt(data: string, options?: any): Promise<string>;
}
/**
* JWT Options
*/
export interface JWTOptions {
/**
* Secret to use with JWT
*/
secretOrPublicKey?: string | Buffer | {
key: string;
passphrase: string;
};
/**
* Algorithm for JWT token
*
* @see https://www.npmjs.com/package/jsonwebtoken
* @default "HS256"
*/
algorithm?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "ES256" | "ES384" | "ES512";
/**
* expressed in seconds or a string describing a time span zeit/ms.
*
* Eg: 60, "2 days", "10h", "7d". A numeric value is interpreted as a seconds count. If you use a string be sure you provide the time units (days, hours, etc), otherwise milliseconds unit is used by default ("120" is equal to "120ms").
*/
expiresIn?: number | string;
/**
* Audience for the jwt
*/
audience?: string;
/**
* Issuer of the token
*/
issuer?: string;
/**
* Subject for JWT
*/
subject?: string;
keyid?: any;
}
export declare class CryptoServiceParameters extends ServiceParameters {
/**
* Number of hours a key should be used for encryption
*
* if auto-rotate is not set this
*/
keyActiveLifespan: number;
/**
* Number of hours allowed to decrypt data encrypted with this key
*/
keyLifespan: number;
/**
* Try to rotate keys when they expire in days
*/
autoRotate?: number;
/**
* Create first set of key if does not exist
*/
autoCreate?: boolean;
/**
* To expose JWKS
*
* @see https://datatracker.ietf.org/doc/html/rfc7517
*/
url?: string;
/**
* Type of asymetric key
*
* https://nodejs.org/api/crypto.html#cryptogeneratekeypairsynctype-options
* https://nodejs.org/docs/latest-v14.x/api/crypto.html#crypto_crypto_generatekeypairsync_type_options
*/
asymetricType: "rsa" | "dsa" | "ec" | "ed25519" | "ed448" | "x25519" | "x448" | "dh";
/**
* Options for asymetric generation
*/
asymetricOptions?: {
/**
* @default 2048
*/
modulusLength?: number;
/**
* Only if asymetricType "ec"
*/
namedCurve?: string;
publicKeyEncoding?: {
/**
* @default spki
*/
type?: "spki" | "pkcs1";
format?: "pem";
};
privateKeyEncoding?: {
/**
* https://nodejs.org/docs/latest-v14.x/api/crypto.html#crypto_keyobject_export_options
* @default pkcs8
*/
type?: "pkcs1" | "pkcs8" | "sec1";
format?: "pem";
cipher?: string;
passphrase?: string;
};
};
/**
* @default 256
*/
symetricKeyLength?: number;
/**
* @default "aes-256-ctr"
*/
symetricCipher?: string;
/**
* Default JWT options
*/
jwt?: JWTOptions;
constructor(params: any);
}
interface KeysDefinition {
publicKey: string;
privateKey: string;
symetric: string;
}
/**
* @WebdaModda
*/
export default class CryptoService<T extends CryptoServiceParameters = CryptoServiceParameters> extends Service<T> implements StringEncrypter {
private static encrypters;
/**
* Register an encrypter for configuration
* @param name
* @param encrypter
*/
static registerEncrypter(name: string, encrypter: {
encrypt: (data: string) => Promise<string>;
decrypt: (data: string) => Promise<string>;
}): void;
currentSymetricKey: string;
currentAsymetricKey: {
publicKey: string;
privateKey: string;
};
current: string;
age: number;
keys: {
[key: string]: KeysDefinition;
};
/**
* JWKS cache
*/
jwks: {
[key: string]: {
n: string;
e: string;
};
};
registry: Store<RegistryEntry>;
/**
* @override
*/
loadParameters(params: DeepPartial<T>): ServiceParameters;
/**
* @override
*/
init(): Promise<this>;
/**
*
*/
serveJWKS(context: OperationContext): Promise<void>;
/**
* Load keys from registry
*/
load(): Promise<boolean>;
/**
* Generate asymetric key
* @returns
*/
generateAsymetricKeys(): {
publicKey: string;
privateKey: string;
};
/**
* Generate symetric key
* @returns
*/
generateSymetricKey(): string;
/**
* Return current key set
*/
getCurrentKeys(): Promise<{
id: string;
keys: KeysDefinition;
}>;
/**
* Retrieve a HMAC for a string
* @param data
* @param keyId to use
* @returns
*/
hmac(data: string | any, keyId?: string): Promise<string>;
/**
* Verify a HMAC for a string
* @param data
* @returns
*/
hmacVerify(data: string | any, hmac: string): Promise<boolean>;
/**
* JWT token generation
*/
jwtSign(data: any, options?: JWTOptions): Promise<string>;
/**
*
* @param keyId
* @returns
*/
checkKey(keyId: string): Promise<boolean>;
/**
* Get JWT key based on kid
*/
getJWTKey(header: any, callback: any): Promise<void>;
/**
* JWT token verification
*/
jwtVerify(token: string, options?: JWTOptions): Promise<string | any>;
/**
* Encrypt data
*/
encrypt(data: any): Promise<string>;
/**
* Parse the JWT header section
*/
getJWTHeader(token: string): any;
/**
* Encrypt configuration
* @param data
*/
static encryptConfiguration(data: any): Promise<any>;
/**
*
* @param data
*/
static decryptConfiguration(data: any): Promise<any>;
/**
* Decrypt data
*/
decrypt(token: string): Promise<any>;
/**
* Get next id
*/
getNextId(): {
id: string;
age: number;
};
/**
* Rotate keys
*/
rotate(): Promise<void>;
}
export { CryptoService };