Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
TypeScript
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148import * as Effect from "effect/Effect";import { OperationFailure } from "./operation-result.ts";import { Secret } from "../configuration/secrets.ts";
// HKDF separates stored credentials from cookie signing. Keep this byte format// stable so existing customer storage remains readable after an upgrade.export class CredentialFailure extends OperationFailure {}
function credentialCall<A>( read: () => PromiseLike<A>, code: "credential_unreadable" | "credential_save_failed",) { return Effect.tryPromise({ try: read, catch: () => new CredentialFailure(code), });}const unreadable = "credential_unreadable";
function encryptionKey( secret: Secret, installationId: string, purpose: string,) { return Effect.gen(function* () { const material = yield* credentialCall( () => crypto.subtle.importKey( "raw", new TextEncoder().encode(secret.reveal()), "HKDF", false, ["deriveKey"], ), unreadable, ); return yield* credentialCall( () => crypto.subtle.deriveKey( { name: "HKDF", hash: "SHA-256", salt: new TextEncoder().encode(installationId), info: new TextEncoder().encode(purpose), }, material, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"], ), unreadable, ); });}
export function encryptCredential( value: Secret, secret: Secret, installationId: string, purpose: string, context = installationId,) { return Effect.gen(function* () { const iv = crypto.getRandomValues(new Uint8Array(12)); const key = yield* encryptionKey(secret, installationId, purpose); const ciphertext = yield* credentialCall( () => crypto.subtle.encrypt( { name: "AES-GCM", iv, additionalData: new TextEncoder().encode(context), }, key, new TextEncoder().encode(value.reveal()), ), "credential_save_failed", ); return JSON.stringify({ version: 1, iv: Array.from(iv), ciphertext: Array.from(new Uint8Array(ciphertext)), }); });}
export function decryptCredential( value: string, secret: Secret, installationId: string, purpose: string, context = installationId,) { return Effect.gen(function* () { const envelope = yield* Effect.try({ try: () => { const parsed = JSON.parse(value); if (parsed?.version !== 1) throw new CredentialFailure(unreadable); return { iv: new Uint8Array(parsed.iv), ciphertext: new Uint8Array(parsed.ciphertext), }; }, catch: () => new CredentialFailure(unreadable), }); const key = yield* encryptionKey(secret, installationId, purpose); const plaintext = yield* credentialCall( () => crypto.subtle.decrypt( { name: "AES-GCM", iv: envelope.iv, additionalData: new TextEncoder().encode(context), }, key, envelope.ciphertext, ), unreadable, ); return new Secret(new TextDecoder().decode(plaintext)); });}
export function encryptProviderKey( value: Secret, secret: Secret, installationId: string,) { return encryptCredential( value, secret, installationId, "flarebot/provider-credentials/v1", );}export function decryptProviderKey( value: string, secret: Secret, installationId: string,) { return decryptCredential( value, secret, installationId, "flarebot/provider-credentials/v1", );}