mod.ts

import { crypto } from "https://deno.land/std@0.208.0/crypto/crypto.ts";
import { encodeHex } from "https://deno.land/std@0.208.0/encoding/hex.ts";
import {
  assertEquals,
  assertNotEquals,
} from "https://deno.land/std@0.208.0/assert/mod.ts";
import {
  bytesToHex,
  bytesToString,
  hexToBytes,
  stringToBytes,
} from "https://deno.land/x/textras@0.1.8/mod.ts";

/**
 * produce the hex-encoded string of the sha256 hash of string s
 * @param {string} s - the string to hash
 * @returns {Promise<string>} the hex-encoded sha256 of s
 */
const sha256Hex = async (s: string): Promise<string> =>
  encodeHex(await crypto.subtle.digest("SHA-256", stringToBytes(s)));

/**
 * test a string to see if it is a uuid (as generated by randomUUID)
 * @param {string} s - the string to test
 * @returns {boolean} if s is a uuid
 */
const isUUID = (s: string): boolean => {
  const re = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
  return re.test(s);
};

/**
 * re-export crypto.randomUUID in this namespace
 * @returns {string} a random v4 uuid
 */
const randomUUID = (): string => crypto.randomUUID();

const AES_GCM = "AES-GCM";

/**
 * @class Key provides a simple wrapper for AES CryptoKeys allowing for serialization to hex.
 */
class Key {
  static readonly Params: AesKeyGenParams = { name: AES_GCM, length: 256 };
  static readonly Extractable = true;
  static readonly Usages: KeyUsage[] = ["encrypt", "decrypt"];

  readonly cryptoKey: CryptoKey; // internal representation

  /**
   * @constructor
   * @param {CryptoKey} cryptoKey - caller provided key
   */
  constructor(cryptoKey: CryptoKey) {
    assertEquals(cryptoKey.algorithm, Key.Params, "key algorithm");
    assertEquals(cryptoKey.extractable, Key.Extractable, "key extractable");
    assertEquals(cryptoKey.usages, Key.Usages, "key usages");
    this.cryptoKey = cryptoKey;
  }

  /**
   * construct a new Key based on the exported Key hex representation
   * @param {string} hexKey - previously exported Key hex (from toHex())
   * @returns {Promise<Key>} - a new Key constructed from the hexKey
   */
  static async fromHex(hexKey: string): Promise<Key> {
    return new Key(
      await crypto.subtle.importKey(
        "raw",
        hexToBytes(hexKey),
        Key.Params,
        Key.Extractable,
        Key.Usages,
      ),
    );
  }

  /**
   * construct a new Key based on a new random seed
   * @returns {Promise<Key>} - a new Key constructed from the random seed
   */
  static async generate(): Promise<Key> {
    return new Key(
      await crypto.subtle.generateKey(
        Key.Params,
        Key.Extractable,
        Key.Usages,
      ),
    );
  }

  /**
   * export the hex serialization of the Key
   * @returns {Promise<string>} - hex serialization of the Key
   */
  async toHex(): Promise<string> {
    const keyBytes = new Uint8Array(
      await crypto.subtle.exportKey("raw", this.cryptoKey),
    );
    return bytesToHex(keyBytes);
  }
}

/**
 * @class IV provides a simple wrapper for AES IVs allowing for serialization to hex.
 */
class IV {
  static readonly Length = 16;
  readonly bytes: Uint8Array; // internal representation

  /**
   * @constructor
   * @param {Uint8Array} bytes - caller provided iv (len 16 Uint8Array)
   */
  constructor(bytes: Uint8Array) {
    assertEquals(bytes.length, IV.Length, "iv length");
    this.bytes = bytes;
  }

  /**
   * construct a new Key based on the exported IV hex representation
   * @param {string} hexIV - previously exported IV hex (from toHex())
   * @returns {Promise<IV>} - a new IV constructed from the hexIV
   */
  static fromHex(hexIV: string): IV {
    return new IV(hexToBytes(hexIV));
  }

  /**
   * construct a new IV using a provided string as the seed
   * @param {string} s - the seed for the IV
   * @returns {Promise<IV>} a 16-byte long Uint8Array suitable as an AEC-CBC IV
   */
  static async fromString(s: string): Promise<IV> {
    assertNotEquals(s.length, 0, "empty iv input");
    return new IV(stringToBytes(await sha256Hex(s)).slice(0, IV.Length));
  }

  /**
   * construct a new IV based on a new random seed
   * @returns {Promise<IV>} - a new IV constructed from the random seed
   */
  static generate(): IV {
    return new IV(crypto.getRandomValues(new Uint8Array(IV.Length)));
  }

  /**
   * export the hex serialization of the IV
   * @returns {Promise<string>} - hex serialization of the IV
   */
  toHex(): string {
    return bytesToHex(this.bytes);
  }
}

/**
 * encrypt a clear text and hex-encode the resulting encrypted value
 * @param {string} clearText - the string to encrypt
 * @param {Key} key - Key instance
 * @returns {Promise<string>} - the hex-encoding of the encrypted iv + clearText
 */
async function encryptToHex(clearText: string, key: Key): Promise<string> {
  const iv = IV.generate();
  return iv.toHex() + bytesToHex(
    new Uint8Array(
      await crypto.subtle.encrypt(
        { name: AES_GCM, iv: iv.bytes },
        key.cryptoKey,
        stringToBytes(clearText),
      ),
    ),
  );
}

/**
 * @param {string} encrypted - the output of encryptToHex
 * @param {Key} key - Key instance
 * @returns {Promise<string>} - the decrypted clear text
 */
async function decryptFromHex(encrypted: string, key: Key): Promise<string> {
  const iv = IV.fromHex(encrypted.substring(0, 2 * IV.Length));
  return bytesToString(
    new Uint8Array(
      await crypto.subtle.decrypt(
        { name: AES_GCM, iv: iv.bytes },
        key.cryptoKey,
        hexToBytes(encrypted.substring(2 * IV.Length)),
      ),
    ),
  );
}

export { decryptFromHex, encryptToHex, isUUID, IV, Key, randomUUID, sha256Hex };