diff --git a/.github/workflows/jsr-publish.yml b/.github/workflows/jsr-publish.yml new file mode 100644 index 0000000..eab2313 --- /dev/null +++ b/.github/workflows/jsr-publish.yml @@ -0,0 +1,23 @@ +# Publish @polymorph/webcrypto (js/deltic) to JSR. +# +# Auth is GitHub Actions OIDC: the package's GitHub-repository link on +# jsr.io authorizes runs from this repository — no tokens. Dispatch +# after a release whose manifest version is not yet on JSR; JSR rejects +# duplicate versions, so a re-run is a no-op-by-failure. +name: jsr-publish +on: + workflow_dispatch: +permissions: + contents: read + id-token: write +jobs: + publish: + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - uses: actions/checkout@v5 + - uses: denoland/setup-deno@v2 + with: + deno-version: "2.9.5" + - run: deno publish + working-directory: js/deltic diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/conformance/driver-ct/justfile b/conformance/driver-ct/justfile index a167df3..4abb6dc 100644 --- a/conformance/driver-ct/justfile +++ b/conformance/driver-ct/justfile @@ -28,15 +28,20 @@ conformance-browser-enabled := if env('GITHUB_ACTIONS', '') == 'true' { '1' } el conformance-firefox-enabled := if env('CONFORMANCE_FIREFOX', '') == '1' { '1' } else { '' } # The one-VERSION-everywhere pin gate, replacing the old -# assertPinConsistency script: every `jsr:@deltic/*` import across BOTH -# deno.json files (this directory's and js/deltic's) must resolve to the -# exact same version. Wired into the conformance CI job -# (.github/justfile's conformance-checks) as the fail-loud point. +# assertPinConsistency script: every resolved `@deltic/*` package (except +# @deltic/protocol, which is versioned independently) across BOTH +# deno.lock files (this directory's and js/deltic's) must resolve to the +# exact same version — js/deltic's published manifest carries a caret +# range, so the specifier string no longer pins identity; the resolved +# lockfile version is what module identity actually needs. Wired into the +# conformance CI job (.github/justfile's conformance-checks) as the +# fail-loud point. deltic-pin-check: #!/usr/bin/env bash set -euo pipefail - v=$(grep -ho 'jsr:@deltic/[a-z-]*@[^/"]*' \ - {{root}}/js/deltic/deno.json deltic/deno.json \ + v=$(jq -r '.jsr | keys[]' \ + {{root}}/js/deltic/deno.lock deltic/deno.lock \ + | grep -v '^@deltic/protocol@' \ | sed 's/.*@//' | sort -u) if [ "$(printf '%s\n' "$v" | wc -l)" != 1 ]; then echo "deltic pin drift: $v" >&2 diff --git a/js/deltic/deno.json b/js/deltic/deno.json index 508aac8..915387d 100644 --- a/js/deltic/deno.json +++ b/js/deltic/deno.json @@ -1,12 +1,16 @@ { - "name": "@polymorph/webcrypto-deltic", + "name": "@polymorph/webcrypto", "version": "0.1.0", + "license": "Apache-2.0", "exports": "./src/mod.ts", - "//": "MODULE-IDENTITY CONSTRAINT: deltic's wasi module imports @deltic/runtime/embedder by bare specifier internally. Every config in this repo (this file AND conformance/driver-ct/deltic/deno.json) must map that specifier to the IDENTICAL exact-pinned JSR version, or the embedder module loads twice and `instanceof ComponentException` stops holding across the module boundary. deltic ships as exact-pinned JSR releases (caret-honest upstream: within a minor line releases stay compatible, breaking bumps the minor; between releases, per-commit `-pre.g` prereleases exist — pin exactly); deno.lock carries integrity, --frozen enforced; the pin gate (just conformance-ct::deltic-pin-check) asserts one @deltic version repo-wide.", + "//": "MODULE-IDENTITY CONSTRAINT: deltic's wasi module imports @deltic/runtime/embedder by bare specifier internally. This file's @deltic/runtime/embedder entry is a caret range (published-package convention: consumers resolve one shared @deltic/runtime across their dependency graph); conformance/driver-ct/deltic/deno.json (repo-internal, not published) exact-pins the same package for its own module-identity needs. The pin gate (just conformance-ct::deltic-pin-check) asserts the two deno.locks resolve to one @deltic/runtime version repo-wide.", "imports": { - "@deltic/runtime/embedder": "jsr:@deltic/runtime@0.1.0/embedder" + "@deltic/runtime/embedder": "jsr:@deltic/runtime@^0.1.0/embedder" }, "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*"] }, + "publish": { + "exclude": ["tests"] + }, "tasks": { "check": "deno check --frozen src tests", "test": "deno test --frozen --allow-read=../../conformance/vectors tests" diff --git a/js/deltic/deno.lock b/js/deltic/deno.lock index 2367079..a3fc8d7 100644 --- a/js/deltic/deno.lock +++ b/js/deltic/deno.lock @@ -2,7 +2,7 @@ "version": "5", "specifiers": { "jsr:@deltic/protocol@0.2": "0.2.0", - "jsr:@deltic/runtime@0.1.0": "0.1.0" + "jsr:@deltic/runtime@0.1": "0.1.0" }, "jsr": { "@deltic/protocol@0.2.0": { @@ -17,7 +17,7 @@ }, "workspace": { "dependencies": [ - "jsr:@deltic/runtime@0.1.0" + "jsr:@deltic/runtime@0.1" ] } } diff --git a/js/deltic/src/aead.ts b/js/deltic/src/aead.ts index 9c1211f..1defb60 100644 --- a/js/deltic/src/aead.ts +++ b/js/deltic/src/aead.ts @@ -237,7 +237,7 @@ async function importAesGcmKey(bits: number, raw: Uint8Array, options: AeadKeyOp /** The `polymorph:webcrypto/aes-gcm@0.1.0` interface. */ export const aesGcm = { - importKeyRaw: (variant: string, raw: Uint8Array, options: AeadKeyOptions) => + importKeyRaw: (variant: string, raw: Uint8Array, options: AeadKeyOptions): Promise => importAesGcmKey(aesBits(variant), raw, options), importKeyJwk: async (variant: string, jwk: string, options: AeadKeyOptions): Promise => { const bits = aesBits(variant); @@ -275,11 +275,11 @@ export const aesGcm = { const key = await deriveKeyFrom(input, { name: "AES-GCM", length: bits }, policy.extractable, usages); return new AeadKey(key, bits, policy); }, - unwrapKeyRaw: (variant: string, input: UnwrapInput, options: AeadKeyOptions) => { + unwrapKeyRaw: (variant: string, input: UnwrapInput, options: AeadKeyOptions): Promise => { const { bytes } = consumeUnwrapInput(input); return importAesGcmKey(aesBits(variant), bytes, options); }, - unwrapKeyJwk: (variant: string, input: UnwrapInput, options: AeadKeyOptions) => { + unwrapKeyJwk: (variant: string, input: UnwrapInput, options: AeadKeyOptions): Promise => { const { bytes } = consumeUnwrapInput(input); const policy = optionsOf(options); const jwk = unwrappedJwk(bytes, "enc", platformUsages(policy)); diff --git a/js/deltic/src/cipher.ts b/js/deltic/src/cipher.ts index b5133ca..5f93e76 100644 --- a/js/deltic/src/cipher.ts +++ b/js/deltic/src/cipher.ts @@ -239,8 +239,18 @@ export class CipherKey { } } +/** The minting-object shape returned by `cipherMinting` for one AES mode. */ +interface CipherMinting { + importKeyRaw(variant: string, raw: Uint8Array, options: CipherKeyOptions): Promise; + importKeyJwk(variant: string, jwk: string, options: CipherKeyOptions): Promise; + generateKey(variant: string, options: CipherKeyOptions): Promise; + deriveKey(variant: string, input: DeriveInput, options: CipherKeyOptions): Promise; + unwrapKeyRaw(variant: string, input: UnwrapInput, options: CipherKeyOptions): Promise; + unwrapKeyJwk(variant: string, input: UnwrapInput, options: CipherKeyOptions): Promise; +} + /** The `aes-cbc` / `aes-ctr` minting pair over one mode name (reference: webcrypto.js:2963). */ -function cipherMinting(name: CipherName) { +function cipherMinting(name: CipherName): CipherMinting { const minting = { async importKeyRaw(variant: string, raw: Uint8Array, options: CipherKeyOptions): Promise { const policy = cipherPolicyOf(options); @@ -310,7 +320,7 @@ function cipherMinting(name: CipherName) { export const cipher = { CipherKey, CipherKeyOptions }; /** The `polymorph:webcrypto/aes-cbc@0.1.0` interface. */ -export const aesCbc = cipherMinting("AES-CBC"); +export const aesCbc: CipherMinting = cipherMinting("AES-CBC"); /** The `polymorph:webcrypto/aes-ctr@0.1.0` interface. */ -export const aesCtr = cipherMinting("AES-CTR"); +export const aesCtr: CipherMinting = cipherMinting("AES-CTR"); diff --git a/js/deltic/src/hkdf.ts b/js/deltic/src/hkdf.ts index 8e4aaf3..542bf37 100644 --- a/js/deltic/src/hkdf.ts +++ b/js/deltic/src/hkdf.ts @@ -52,8 +52,8 @@ function readPolicy(options: DeriveOptions): DerivePolicy { /** The `polymorph:webcrypto/hkdf@0.1.0` interface. */ export const hkdf = { Ikm, - importIkm: (raw: Uint8Array, options: DeriveOptions) => importIkmKey(raw, options), - unwrapIkm: (input: UnwrapInput, options: DeriveOptions) => { + importIkm: (raw: Uint8Array, options: DeriveOptions): Promise => importIkmKey(raw, options), + unwrapIkm: (input: UnwrapInput, options: DeriveOptions): Promise => { const { bytes } = consumeUnwrapInput(input); return importIkmKey(bytes, options); }, @@ -111,14 +111,16 @@ async function prepareFrom( /** The `polymorph:webcrypto/hkdf-sha2@0.1.0` interface. */ export const hkdfSha2 = { - prepare: (variant: string, input: Ikm, salt: Uint8Array, info: Uint8Array) => + prepare: (variant: string, input: Ikm, salt: Uint8Array, info: Uint8Array): Promise => prepare(sha2Hash(variant), input, salt, info), - prepareFrom: (variant: string, input: DeriveInput, salt: Uint8Array, info: Uint8Array) => + prepareFrom: (variant: string, input: DeriveInput, salt: Uint8Array, info: Uint8Array): Promise => prepareFrom(sha2Hash(variant), input, salt, info), }; /** The `polymorph:webcrypto/hkdf-sha1@0.1.0` interface. */ export const hkdfSha1 = { - prepare: (input: Ikm, salt: Uint8Array, info: Uint8Array) => prepare("SHA-1", input, salt, info), - prepareFrom: (input: DeriveInput, salt: Uint8Array, info: Uint8Array) => prepareFrom("SHA-1", input, salt, info), + prepare: (input: Ikm, salt: Uint8Array, info: Uint8Array): Promise => + prepare("SHA-1", input, salt, info), + prepareFrom: (input: DeriveInput, salt: Uint8Array, info: Uint8Array): Promise => + prepareFrom("SHA-1", input, salt, info), }; diff --git a/js/deltic/src/keyWrap.ts b/js/deltic/src/keyWrap.ts index 8310078..d4707fc 100644 --- a/js/deltic/src/keyWrap.ts +++ b/js/deltic/src/keyWrap.ts @@ -175,8 +175,18 @@ export class KwKey { /** The `polymorph:webcrypto/key-wrap@0.1.0` interface: its resource classes. */ export const keyWrap = { KwKey, KwKeyOptions }; +/** The `aes-kw` minting interface's shape. */ +interface AesKw { + importKeyRaw(variant: string, raw: Uint8Array, options: KwKeyOptions): Promise; + importKeyJwk(variant: string, jwk: string, options: KwKeyOptions): Promise; + generateKey(variant: string, options: KwKeyOptions): Promise; + deriveKey(variant: string, input: DeriveInput, options: KwKeyOptions): Promise; + unwrapKeyRaw(variant: string, input: UnwrapInput, options: KwKeyOptions): Promise; + unwrapKeyJwk(variant: string, input: UnwrapInput, options: KwKeyOptions): Promise; +} + /** The `polymorph:webcrypto/aes-kw@0.1.0` interface (reference: webcrypto.js:3317). */ -export const aesKw = { +export const aesKw: AesKw = { async importKeyRaw(variant: string, raw: Uint8Array, options: KwKeyOptions): Promise { const policy = kwPolicyOf(options); const usages = kwUsages(policy); diff --git a/js/deltic/src/mac.ts b/js/deltic/src/mac.ts index 372826a..61ac609 100644 --- a/js/deltic/src/mac.ts +++ b/js/deltic/src/mac.ts @@ -246,27 +246,34 @@ function sha2Hmac(variant: string): HashSpec { /** The `polymorph:webcrypto/hmac-sha1@0.1.0` interface. */ export const hmacSha1 = { - importKeyRaw: (raw: Uint8Array, options: MacKeyOptions) => importHmacKey(SHA1_HMAC, raw, options), - importKeyJwk: (jwk: string, options: MacKeyOptions) => importHmacKeyJwk(SHA1_HMAC, jwk, options), - generateKey: (length: number | undefined, options: MacKeyOptions) => generateHmacKey(SHA1_HMAC, length, options), - deriveKey: (input: DeriveInput, length: number | undefined, options: MacKeyOptions) => + importKeyRaw: (raw: Uint8Array, options: MacKeyOptions): Promise => importHmacKey(SHA1_HMAC, raw, options), + importKeyJwk: (jwk: string, options: MacKeyOptions): Promise => importHmacKeyJwk(SHA1_HMAC, jwk, options), + generateKey: (length: number | undefined, options: MacKeyOptions): Promise => + generateHmacKey(SHA1_HMAC, length, options), + deriveKey: (input: DeriveInput, length: number | undefined, options: MacKeyOptions): Promise => deriveHmacKey(SHA1_HMAC, input, length, options), - unwrapKeyRaw: (input: UnwrapInput, options: MacKeyOptions) => unwrapHmacKeyRaw(SHA1_HMAC, input, options), - unwrapKeyJwk: (input: UnwrapInput, options: MacKeyOptions) => unwrapHmacKeyJwk(SHA1_HMAC, input, options), + unwrapKeyRaw: (input: UnwrapInput, options: MacKeyOptions): Promise => + unwrapHmacKeyRaw(SHA1_HMAC, input, options), + unwrapKeyJwk: (input: UnwrapInput, options: MacKeyOptions): Promise => + unwrapHmacKeyJwk(SHA1_HMAC, input, options), }; /** The `polymorph:webcrypto/hmac-sha2@0.1.0` interface. */ export const hmacSha2 = { - importKeyRaw: (variant: string, raw: Uint8Array, options: MacKeyOptions) => + importKeyRaw: (variant: string, raw: Uint8Array, options: MacKeyOptions): Promise => importHmacKey(sha2Hmac(variant), raw, options), - importKeyJwk: (variant: string, jwk: string, options: MacKeyOptions) => + importKeyJwk: (variant: string, jwk: string, options: MacKeyOptions): Promise => importHmacKeyJwk(sha2Hmac(variant), jwk, options), - generateKey: (variant: string, length: number | undefined, options: MacKeyOptions) => + generateKey: (variant: string, length: number | undefined, options: MacKeyOptions): Promise => generateHmacKey(sha2Hmac(variant), length, options), - deriveKey: (variant: string, input: DeriveInput, length: number | undefined, options: MacKeyOptions) => - deriveHmacKey(sha2Hmac(variant), input, length, options), - unwrapKeyRaw: (variant: string, input: UnwrapInput, options: MacKeyOptions) => + deriveKey: ( + variant: string, + input: DeriveInput, + length: number | undefined, + options: MacKeyOptions, + ): Promise => deriveHmacKey(sha2Hmac(variant), input, length, options), + unwrapKeyRaw: (variant: string, input: UnwrapInput, options: MacKeyOptions): Promise => unwrapHmacKeyRaw(sha2Hmac(variant), input, options), - unwrapKeyJwk: (variant: string, input: UnwrapInput, options: MacKeyOptions) => + unwrapKeyJwk: (variant: string, input: UnwrapInput, options: MacKeyOptions): Promise => unwrapHmacKeyJwk(sha2Hmac(variant), input, options), }; diff --git a/js/deltic/src/rsaSignature.ts b/js/deltic/src/rsaSignature.ts index 5ad59a9..9e42c7e 100644 --- a/js/deltic/src/rsaSignature.ts +++ b/js/deltic/src/rsaSignature.ts @@ -270,22 +270,31 @@ async function importRsaSigningKeyJwk( return new SigningKey(key, rsaSigningAlgorithm(name, entry, modulusLength)); } -function rsaSigningInterface(name: "RSASSA-PKCS1-v1_5" | "RSA-PSS") { +/** The minting-object shape returned by `rsaSigningInterface` for one RSA signing scheme. */ +interface RsaSigningInterface { + generateKey(variant: string, modulus: string, options: SigningKeyOptions): Promise<[SigningKey, VerifyingKey]>; + importSigningKeyPkcs8(variant: string, pkcs8: Uint8Array, options: SigningKeyOptions): Promise; + importSigningKeyJwk(variant: string, jwk: string, options: SigningKeyOptions): Promise; + unwrapSigningKeyPkcs8(variant: string, input: UnwrapInput, options: SigningKeyOptions): Promise; + unwrapSigningKeyJwk(variant: string, input: UnwrapInput, options: SigningKeyOptions): Promise; +} + +function rsaSigningInterface(name: "RSASSA-PKCS1-v1_5" | "RSA-PSS"): RsaSigningInterface { return { - generateKey: (variant: string, modulus: string, options: SigningKeyOptions) => + generateKey: (variant: string, modulus: string, options: SigningKeyOptions): Promise<[SigningKey, VerifyingKey]> => generateRsaSigningKey(name, variant, modulus, options), - importSigningKeyPkcs8: (variant: string, pkcs8: Uint8Array, options: SigningKeyOptions) => + importSigningKeyPkcs8: (variant: string, pkcs8: Uint8Array, options: SigningKeyOptions): Promise => importRsaSigningKeyPkcs8(name, variant, pkcs8, options), - importSigningKeyJwk: (variant: string, jwk: string, options: SigningKeyOptions) => + importSigningKeyJwk: (variant: string, jwk: string, options: SigningKeyOptions): Promise => importRsaSigningKeyJwk(name, variant, jwk, options), - unwrapSigningKeyPkcs8: (variant: string, input: UnwrapInput, options: SigningKeyOptions) => { + unwrapSigningKeyPkcs8: (variant: string, input: UnwrapInput, options: SigningKeyOptions): Promise => { const { bytes } = consumeUnwrapInput(input); return redactingInvalidKey( `unwrapped ${name} pkcs8`, () => importRsaSigningKeyPkcs8(name, variant, bytes, options), ); }, - unwrapSigningKeyJwk: (variant: string, input: UnwrapInput, options: SigningKeyOptions) => { + unwrapSigningKeyJwk: (variant: string, input: UnwrapInput, options: SigningKeyOptions): Promise => { const { bytes } = consumeUnwrapInput(input); requireSigningGrant(signingPolicyOf(options)); const jwk = unwrappedJwk(bytes, "sig", ["sign"]); @@ -298,7 +307,7 @@ function rsaSigningInterface(name: "RSASSA-PKCS1-v1_5" | "RSA-PSS") { } /** The `polymorph:webcrypto/rsassa-pkcs1-v15-sign@0.1.0` interface. */ -export const rsassaPkcs1V15Sign = rsaSigningInterface("RSASSA-PKCS1-v1_5"); +export const rsassaPkcs1V15Sign: RsaSigningInterface = rsaSigningInterface("RSASSA-PKCS1-v1_5"); /** The `polymorph:webcrypto/rsa-pss-sign@0.1.0` interface. */ -export const rsaPssSign = rsaSigningInterface("RSA-PSS"); +export const rsaPssSign: RsaSigningInterface = rsaSigningInterface("RSA-PSS");