CryptoService

@webda/core

Class: CryptoService<T>

Defined in: packages/core/src/services/cryptoservice.service.ts:402

Webda Modda

Extends

Service<T>

Type Parameters

T

T extends CryptoServiceParameters = CryptoServiceParameters

Implements

StringEncrypter

Constructors

Constructor

new CryptoService<T>(name, params): CryptoService<T>

Defined in: packages/core/src/services/service.ts:191

Service

Parameters

name

string

The name of the service

params

T

The parameters block define in the configuration file

Returns

CryptoService<T>

Inherited from

Service.constructor

Properties

_compiledCapabilities

protected _compiledCapabilities: Record<string, any> = {}

Defined in: packages/core/src/services/iservice.ts:49

Capabilities detected at compile-time from @WebdaCapability-tagged interfaces.

Populated during Service.resolve by reading the service's entry in webda.module.json. Each key is a capability name (e.g., "request-filter"), and the value is an empty object {} by default. Override getCapabilities to provide capability-specific configuration or to conditionally disable capabilities.

See

getCapabilities

Inherited from

Service._compiledCapabilities

[WEBDA_EVENTS]

[WEBDA_EVENTS]: object

Defined in: packages/core/src/services/service.ts:165

Set the Webda events here

Inherited from

Service.[WEBDA_EVENTS]

age

age: number

Defined in: packages/core/src/services/cryptoservice.service.ts:459

current

current: string

Defined in: packages/core/src/services/cryptoservice.service.ts:458

currentAsymetricKey

currentAsymetricKey: object

Defined in: packages/core/src/services/cryptoservice.service.ts:457

privateKey

privateKey: string

publicKey

publicKey: string

currentSymetricKey

currentSymetricKey: string

Defined in: packages/core/src/services/cryptoservice.service.ts:456

jwks

jwks: object = {}

Defined in: packages/core/src/services/cryptoservice.service.ts:466

JWKS cache: public JWK of each key id, null when the key cannot be exported as a JWK

Index Signature

[key: string]: JsonWebKey

keys

keys: object

Defined in: packages/core/src/services/cryptoservice.service.ts:460

Index Signature

[key: string]: KeysDefinition

keysFileSignature?

protected optional keysFileSignature?: string

Defined in: packages/core/src/services/cryptoservice.service.ts:472

Modification time, size and inode of the keys file last read, to reload it only when it changes

logger

protected logger: Logger

Defined in: packages/core/src/services/service.ts:178

Logger with class context

Inherited from

Service.logger

metrics?

protected optional metrics?: object

Defined in: packages/core/src/services/service.ts:182

Get metrics

Inherited from

Service.metrics

name

readonly name: string

Defined in: packages/core/src/services/iservice.ts:26

Inherited from

Service.name

parameters

readonly parameters: T

Defined in: packages/core/src/services/iservice.ts:27

Inherited from

Service.parameters

createConfiguration?

static optional createConfiguration?: (params) => any

Defined in: packages/core/src/services/iservice.ts:32

Create configuration set by the application on load

Parameters

params

any

Returns

any

Inherited from

Service.createConfiguration

filterConfiguration?

static optional filterConfiguration?: (params) => any

Defined in: packages/core/src/services/iservice.ts:37

Create configuration set by the application on load

Parameters

params

any

Returns

any

Inherited from

Service.filterConfiguration

Parameters

static Parameters: typeof ServiceParameters = ServiceParameters

Defined in: packages/core/src/services/service.ts:161

Service parameters

Inherited from

Service.Parameters

Methods

__clean()

abstract __clean(): Promise<void>

Defined in: packages/core/src/services/service.ts:494

Clean the service data, can only be used in test mode

Returns

Promise<void>

Inherited from

Service.__clean

addListener()

addListener<Key>(eventName, listener): this

Defined in: packages/core/src/events/asynceventemitter.ts:83

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void | Promise<void>

the event listener

Returns

this

this for chaining

See

EventEmitter.addListener

Inherited from

Service.addListener

addRoute()

protected addRoute(url, methods, executer, openapi?, override?): void

Defined in: packages/core/src/services/service.ts:386

Add a route dynamicaly

Parameters

url

string

of the route can contains dynamic part like {uuid}

methods

HttpMethodType[]

the HTTP methods

executer

Function

Method to execute for this route

openapi?

OpenAPIWebdaDefinition = {}

the OpenAPI specification

override?

boolean = false

whether to override existing

Returns

void

Inherited from

Service.addRoute

authorizeClientEvent()

authorizeClientEvent(_event, _context): boolean

Defined in: packages/core/src/services/service.ts:339

Authorize a public event subscription

Parameters

_event

string

the event name

_context

OperationContext

the execution context

Returns

boolean

true if the condition is met

Inherited from

Service.authorizeClientEvent

checkKey()

checkKey(keyId): Promise<boolean>

Defined in: packages/core/src/services/cryptoservice.service.ts:778

Parameters

keyId

string

the key identifier

Returns

Promise<boolean>

true if the condition is met

computeParameters()

computeParameters(): void

Defined in: packages/core/src/services/service.ts:200

Used to compute or derivate input parameter to attribute

Returns

void

Deprecated

Inherited from

Service.computeParameters

decrypt()

decrypt(token): Promise<any>

Defined in: packages/core/src/services/cryptoservice.service.ts:1520

Decrypt data

Parameters

token

string

the token

Returns

Promise<any>

the result

Implementation of

StringEncrypter.decrypt

emit()

emit<Key>(event, data): Promise<void>

Defined in: packages/core/src/services/service.ts:475

Emit the event with data and wait for Promise to finish if listener returned a Promise

Type Parameters

Key

Key extends never

Parameters

event

Key

the event name

data

object[Key]

the data to process

Returns

Promise<void>

Inherited from

Service.emit

encrypt()

encrypt(data): Promise<string>

Defined in: packages/core/src/services/cryptoservice.service.ts:855

Encrypt data

Parameters

data

any

the data to process

Returns

Promise<string>

the result string

Implementation of

StringEncrypter.encrypt

encryptConfigurationFile()

encryptConfigurationFile(file, migrate?, upgrade?): Promise<number>

Defined in: packages/core/src/services/cryptoservice.service.ts:1118

Encrypt the marked values of a configuration file, keeping its comments

Prefix a value with encrypt:[<encrypter>:] (SecretString once decrypted) or sencrypt:[<encrypter>:] (plain string once decrypted) then run this command.

Parameters

file

string

the configuration file (json, jsonc or yaml) to update

migrate?

string

re-encrypt the already encrypted values with this encrypter, the default one when empty

upgrade?

boolean

re-encrypt the already encrypted values with their own encrypter, to its current format or key

Returns

Promise<number>

the number of values changed

generateAsymetricKeys()

generateAsymetricKeys(): object

Defined in: packages/core/src/services/cryptoservice.service.ts:674

Generate asymetric key

Returns

object

the result

privateKey

privateKey: string

publicKey

publicKey: string

generateSymetricKey()

generateSymetricKey(): string

Defined in: packages/core/src/services/cryptoservice.service.ts:688

Generate symetric key

Returns

string

the result string

getCapabilities()

getCapabilities(): Record<string, any>

Defined in: packages/core/src/services/iservice.ts:77

Return the capabilities of this service.

By default returns capabilities detected at compile-time from

Returns

Record<string, any>

the result

Webda Capability-tagged

interfaces in webda.module.json.

Override to disable capabilities based on configuration:

getCapabilities() {
  const caps = super.getCapabilities();
  if (!this.parameters.enabled) delete caps["request-filter"];
  return caps;
}

Inherited from

Service.getCapabilities

getClientEvents()

getClientEvents(): string[]

Defined in: packages/core/src/services/service.ts:327

Return the events that an external system can subscribe to

Returns

string[]

the list of results

Inherited from

Service.getClientEvents

getCurrentKeys()

getCurrentKeys(): Promise<{ id: string; keys: KeysDefinition; }>

Defined in: packages/core/src/services/cryptoservice.service.ts:696

Return current key set

Returns

Promise<{ id: string; keys: KeysDefinition; }>

the result

getJWKS()

getJWKS(): object

Defined in: packages/core/src/services/cryptoservice.service.ts:506

Public signing keys as a JSON Web Key Set (RFC 7517)

Only the asymmetric public keys are published, the symmetric keys never leave the service. The kid matches the one jwtSign writes for asymmetric tokens (A<keyId>), so any JOSE library can verify them. Keys of an old rotation stay published while they are in the registry: tokens they signed remain verifiable.

Returns

object

the key set

keys

keys: JsonWebKey[]

getJWKSMaxAge()

getJWKSMaxAge(): number

Defined in: packages/core/src/services/cryptoservice.service.ts:540

Cache duration of the JWKS in seconds

A tenth of the key active lifespan, between one minute and one hour: verifiers see a new key well before the previous one stops signing, and unknown kid refetches remain rare.

Returns

number

the max-age

getJWKSUrl()

getJWKSUrl(): string

Defined in: packages/core/src/services/cryptoservice.service.ts:494

Url of the JWKS route, relative to the application root

Returns

string

the url or undefined when the JWKS is not exposed (no url parameter)

getJWTHeader()

getJWTHeader(token): any

Defined in: packages/core/src/services/cryptoservice.service.ts:877

Parse the JWT header section

Parameters

token

string

the token

Returns

any

the result

getJWTKey()

getJWTKey(header, callback): Promise<void>

Defined in: packages/core/src/services/cryptoservice.service.ts:802

Get JWT key based on kid

Parameters

any

the JWT header

callback

any

the callback function

Returns

Promise<void>

getKeysFile()

getKeysFile(): string

Defined in: packages/core/src/services/cryptoservice.service.ts:586

Absolute path of the keys file

Returns

string

the path or undefined when the keys are in the registry

getMaxListeners()

getMaxListeners(): number

Defined in: packages/core/src/events/asynceventemitter.ts:90

Returns

number

Inherited from

Service.getMaxListeners

getMetric()

getMetric<T>(type, configuration): T

Defined in: packages/core/src/services/service.ts:309

Add service name label

Type Parameters

T

T = Gauge<string> | Counter<string> | Histogram<string>

Parameters

type

CustomConstructor<T, [MetricConfiguration<T>]>

the type to look up

configuration

MetricConfiguration<T>

the configuration

Returns

T

the result

Inherited from

Service.getMetric

getName()

getName(): string

Defined in: packages/core/src/services/service.ts:485

Get service name

Returns

string

the result string

Inherited from

Service.getName

getNextId()

getNextId(): object

Defined in: packages/core/src/services/cryptoservice.service.ts:1536

Get next id

Returns

object

the result

age

age: number

id

id: string

getOpenApiReplacements()

getOpenApiReplacements(): any

Defined in: packages/core/src/services/service.ts:415

Return variables for replacement in openapi

Returns

any

the result

Inherited from

Service.getOpenApiReplacements

getOperationId()

getOperationId(id): string

Defined in: packages/core/src/services/service.ts:373

If undefined is returned it cancel the operation registration

Parameters

id

string

the identifier

Returns

string

the result

Inherited from

Service.getOperationId

getParameters()

getParameters(): T

Defined in: packages/core/src/services/service.ts:208

Get the service parameters

Returns

T

the result

Inherited from

Service.getParameters

getService()

getService<T>(name): ServicesMap[T]

Defined in: packages/core/src/services/service.ts:299

Get a service by name

Type Parameters

T

T extends keyof ServicesMap

Parameters

name

T

the name to use

Returns

ServicesMap[T]

the result map

Deprecated

Use useService, might reconsider

Inherited from

Service.getService

getState()

getState(): ServiceStates

Defined in: packages/core/src/services/service.ts:171

Get the current state

Returns

ServiceStates

the result

Inherited from

Service.getState

getUrl()

getUrl(url, _methods): string

Defined in: packages/core/src/services/service.ts:350

Return the full path url based on parameters

Parameters

url

string

relative url to service

_methods

HttpMethodType[]

in case we need filtering (like Store)

Returns

string

absolute url or undefined if need to skip the Route

Inherited from

Service.getUrl

hmac()

hmac(data, keyId?): Promise<string>

Defined in: packages/core/src/services/cryptoservice.service.ts:722

Retrieve a HMAC for a string

Parameters

data

any

the data to process

keyId?

string

to use

Returns

Promise<string>

the result string

hmacVerify()

hmacVerify(data, hmac): Promise<boolean>

Defined in: packages/core/src/services/cryptoservice.service.ts:736

Verify a HMAC for a string

Parameters

data

any

the data to process

hmac

string

the HMAC instance

Returns

Promise<boolean>

true if the condition is met

init()

init(): Promise<CryptoService<T>>

Defined in: packages/core/src/services/cryptoservice.service.ts:477

Returns

Promise<CryptoService<T>>

Overrides

Service.init

initMetrics()

initMetrics(): void

Defined in: packages/core/src/services/service.ts:289

Init the metrics

Returns

void

Inherited from

Service.initMetrics

initOperations()

initOperations(): void

Defined in: packages/core/src/services/service.ts:422

Init the operations from

Returns

void

Operation

decorators on this service

Inherited from

Service.initOperations

jwtSign()

jwtSign(data, options?): Promise<string>

Defined in: packages/core/src/services/cryptoservice.service.ts:753

JWT token generation

Parameters

data

any

the data to process

options?

JWTOptions

the options

Returns

Promise<string>

the result string

jwtVerify()

jwtVerify(token, options?): Promise<any>

Defined in: packages/core/src/services/cryptoservice.service.ts:828

JWT token verification

Parameters

token

string

the token

options?

JWTOptions

the options

Returns

Promise<any>

the result

listeners()

listeners(eventName): Function[]

Defined in: packages/core/src/events/asynceventemitter.ts:183

Get all listeners for an event

Parameters

eventName

never

the event name

Returns

Function[]

the list of results

Inherited from

Service.listeners

load()

load(): Promise<boolean>

Defined in: packages/core/src/services/cryptoservice.service.ts:567

Load keys from registry, or from the keys file if keysFile is set

Returns

Promise<boolean>

true if the condition is met

loadCapabilities()

protected loadCapabilities(): void

Defined in: packages/core/src/services/service.ts:269

Load capabilities from webda.module.json metadata into _compiledCapabilities.

Called during resolve after dependency injection. Reads the service's type name from parameters, looks it up in the application's module metadata (moddas or beans section), and populates _compiledCapabilities with an empty object for each declared capability name.

Fails silently if the application is not available (e.g., in unit tests where services are instantiated without a full application context).

Returns

void

Example

// If webda.module.json contains:
// { "moddas": { "MyApp/HawkService": { "capabilities": ["request-filter", "cors-filter"] } } }
// Then after resolve(), this.getCapabilities() returns:
// { "request-filter": {}, "cors-filter": {} }

See

getCapabilities

Inherited from

Service.loadCapabilities

log()

log(level, ...args): void

Defined in: packages/core/src/services/service.ts:515

Parameters

level

WorkerLogLevel

to log

args

...any[]

additional arguments

Returns

void

Inherited from

Service.log

off()

off<Key>(eventName, listener): this

Defined in: packages/core/src/events/asynceventemitter.ts:141

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void

the event listener

Returns

this

this for chaining

See

EventEmitter.off

Inherited from

Service.off

on()

on<Key>(eventName, listener): this

Defined in: packages/core/src/events/asynceventemitter.ts:119

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void

the event listener

Returns

this

this for chaining

See

EventEmitter.once

Inherited from

Service.on

once()

once<Key>(eventName, listener): this

Defined in: packages/core/src/events/asynceventemitter.ts:108

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void

the event listener

Returns

this

this for chaining

See

EventEmitter.once

Inherited from

Service.once

readKeysFile()

protected readKeysFile(file): Promise<KeysRegistry>

Defined in: packages/core/src/services/cryptoservice.service.ts:629

Read and validate the keys file

Parameters

file

string

the absolute path

Returns

Promise<KeysRegistry>

the keys

refreshKeysFile()

protected refreshKeysFile(): Promise<boolean>

Defined in: packages/core/src/services/cryptoservice.service.ts:597

Read the keys file if it changed since the last read

A file that cannot be read or is invalid fails when no keys are loaded yet. Afterwards it is logged and the current keys are kept, so a broken secret update does not break the running service.

Returns

Promise<boolean>

true once the keys are loaded

removeAllListeners()

removeAllListeners<Key>(eventName?): this

Defined in: packages/core/src/events/asynceventemitter.ts:150

Type Parameters

Key

Key extends never

Parameters

eventName?

Key

the event name

Returns

this

this for chaining

See

EventEmitter.removeAllListeners

Inherited from

Service.removeAllListeners

removeListener()

removeListener<Key>(eventName, listener): this

Defined in: packages/core/src/events/asynceventemitter.ts:130

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void

the event listener

Returns

this

this for chaining

See

EventEmitter.removeListener

Inherited from

Service.removeListener

resolve()

resolve(): this

Defined in: packages/core/src/services/service.ts:235

Resolve parameters and load metadata. @Route-declared routes are scanned and registered by Router.discoverRoutes(services) from Core.init() once every service has resolved — nothing to do per-service here.

Returns

this

the result

Inherited from

Service.resolve

rotate()

rotate(): Promise<void>

Defined in: packages/core/src/services/cryptoservice.service.ts:1545

Rotate keys

Returns

Promise<void>

serveJWKS()

serveJWKS(context): Promise<void>

Defined in: packages/core/src/services/cryptoservice.service.ts:558

Parameters

context

OperationContext

the execution context

Returns

Promise<void>

setKeys()

protected setKeys(load): void

Defined in: packages/core/src/services/cryptoservice.service.ts:659

Set the keys from their registry format

Parameters

load

KeysRegistry

the keys

Returns

void

setMaxListeners()

setMaxListeners(n): this

Defined in: packages/core/src/events/asynceventemitter.ts:97

Parameters

n

number

Returns

this

Inherited from

Service.setMaxListeners

stop()

stop(): Promise<void>

Defined in: packages/core/src/services/service.ts:216

Shutdown the current service if action need to be taken

Returns

Promise<void>

Inherited from

Service.stop

toJSON()

toJSON(): string

Defined in: packages/core/src/services/service.ts:454

Prevent service to be serialized

Returns

string

the result

Inherited from

Service.toJSON

toString()

toString(): string

Defined in: packages/core/src/services/service.ts:224

Return service representation

Returns

string

the result

Inherited from

Service.toString

checkFiles()

protected static checkFiles(files, options?): number

Defined in: packages/core/src/services/cryptoservice.service.ts:1209

Check that the secrets of configuration files are encrypted

Parameters

files

string[]

the files to check

options?

check options

exclude?

string

secret paths not checked, comma-separated

format?

"text" | "json"

output format: text or json

none?

boolean

accept the values kept in clear text with crypt:none:

strict?

boolean

report the values still marked encrypt: as failures

Returns

number

1 when a secret is not encrypted, 0 otherwise

cryptoGenerateKeys()

static cryptoGenerateKeys(out?): Promise<string>

Defined in: packages/core/src/services/cryptoservice.service.ts:1481

Generate a keys file for the keysFile parameter

The keys use the default algorithms: RSA 2048 bits and a 256 bits symmetric key.

Parameters

out?

string = "keys.json"

the keys file to write

Returns

Promise<string>

the written file

decryptConfiguration()

static decryptConfiguration(data, path?, options?): Promise<any>

Defined in: packages/core/src/services/cryptoservice.service.ts:1048

Decrypt the crypt: and scrypt: values of a configuration

crypt:<encrypter>:<data> becomes a SecretString
scrypt:<encrypter>:<data> becomes a plain string, for a module that cannot handle SecretString

The input is not modified: a decrypted copy is returned. Only plain objects and arrays are traversed.

A value still marked encrypt: is kept as is, with a warning.

Parameters

data

any

the configuration, or a single value

path?

(string | number)[] = []

the path of data, for messages

options?

ConfigurationEncryptionOptions = {}

the encryption settings and the application path

Returns

Promise<any>

the decrypted copy

decryptValue()

protected static decryptValue(encrypter, data, path, pass?): Promise<string>

Defined in: packages/core/src/services/cryptoservice.service.ts:1016

Decrypt one value with an encrypter, with a message that never contains the value

Parameters

encrypter

string

the encrypter name

data

string

the encrypted data

path

(string | number)[]

the configuration path

pass?

EncryptionPass

the current pass, to configure the encrypter

Returns

Promise<string>

the plain value

decryptValues()

protected static decryptValues(data, pass, path): Promise<any>

Defined in: packages/core/src/services/cryptoservice.service.ts:1063

Decrypt the values of a configuration, see decryptConfiguration

Parameters

data

any

the configuration, or a single value

pass

EncryptionPass

the current pass

path

(string | number)[]

the path of data

Returns

Promise<any>

the decrypted copy

encryptConfiguration()

static encryptConfiguration(data, options?, path?): Promise<any>

Defined in: packages/core/src/services/cryptoservice.service.ts:942

Encrypt the encrypt:[<encrypter>:]<plain> and sencrypt:[<encrypter>:]<plain> values of a configuration

The structure is modified in place, so a comment-preserving document loaded with FileUtils.load can be saved back with its comments.

encrypt:<plain> uses the default encrypter, parameters.configurationEncryption.default. The output always names its encrypter.

Parameters

data

any

the configuration, or a single value

options?

object & ConfigurationEncryptionOptions = {}

options

path?

(string | number)[] = []

the path of data, for error messages

Returns

Promise<any>

the encrypted data

encryptConfigurationFile()

static encryptConfigurationFile(file?, migrate?, upgrade?, check?, strict?, format?, none?, exclude?): Promise<number>

Defined in: packages/core/src/services/cryptoservice.service.ts:1151

Encrypt the secrets of the configuration files, keeping their comments, or check them

Encrypts the values marked encrypt: or sencrypt:, and the plain values of the secret fields: the fields typed SecretString or tagged @secret in their service parameters, marked x-webda-secret in the compiled schemas. The plain secrets are encrypted with the default encrypter.

Without file, it updates the application configuration and the file of the selected deployment.

With check, nothing is written: it fails when a secret is not encrypted. It needs no key, so it runs in CI. Only the paths are reported, never the values.

It only needs the loaded application: the configuration is not decrypted and no service is created.

Parameters

file?

string

the configuration file (json, jsonc or yaml) to update

migrate?

string

re-encrypt the already encrypted values with this encrypter, the default one when empty

upgrade?

boolean

re-encrypt the already encrypted values with their own encrypter, to its current format or key

check?

boolean = false

only check that the secrets are encrypted, write nothing

strict?

boolean = true

with check, report the values still marked encrypt: as failures

format?

"text" | "json" = "text"

with check, output format: text or json

none?

boolean = true

with check, accept the values kept in clear text with crypt:none:, false to fail on them

exclude?

string

secret paths to leave alone, comma-separated: not checked, not auto-encrypted

Returns

Promise<number>

with check, 1 when a secret is not encrypted, otherwise 0

encryptFile()

static encryptFile(file, migrate?, upgrade?, exclude?): Promise<number>

Defined in: packages/core/src/services/cryptoservice.service.ts:1301

Encrypt the secrets of a configuration file, keeping its comments

The values marked encrypt: or sencrypt:, and the plain values of the secret fields, with the default encrypter.

Parameters

file

string

the configuration file (json, jsonc or yaml) to update

migrate?

string

re-encrypt the already encrypted values with this encrypter, the default one when empty

upgrade?

boolean

re-encrypt the already encrypted values with their own encrypter, to its current format or key

exclude?

string | string[]

secret paths not auto-encrypted, comma-separated patterns, see secretPathExcluder

Returns

Promise<number>

the number of values changed

encryptValues()

protected static encryptValues(data, pass, path): Promise<any>

Defined in: packages/core/src/services/cryptoservice.service.ts:966

Encrypt the values of a configuration, see encryptConfiguration

Parameters

data

any

the configuration, or a single value

pass

EncryptionPass

the current pass

path

(string | number)[]

the path of data

Returns

Promise<any>

the encrypted data

findFileSecrets()

static findFileSecrets(data, exclude?): SecretFinding[]

Defined in: packages/core/src/services/cryptoservice.service.ts:1262

Find the unencrypted secrets of a configuration or deployment file

A service the file overrides without its type takes the type of the application configuration, and the file parameters are also checked against the services of the application.

Parameters

data

any

the file content, as plain JSON

exclude?

string | string[]

secret paths to leave out, comma-separated patterns, see secretPathExcluder

Returns

SecretFinding[]

the findings, with their location in data, without the values

getConfigurationFiles()

protected static getConfigurationFiles(file?): string[]

Defined in: packages/core/src/services/cryptoservice.service.ts:1185

The configuration files to encrypt or check

Parameters

file?

string

the file given on the command line

Returns

string[]

the absolute paths: the file, or the application configuration and the selected deployment file

getEncrypter()

static getEncrypter(name): StringEncrypter

Defined in: packages/core/src/services/cryptoservice.service.ts:435

Get a registered encrypter

Parameters

name

string

the encrypter name

Returns

StringEncrypter

the encrypter or undefined

getEncryptionSettings()

protected static getEncryptionSettings(data?): ConfigurationEncryption

Defined in: packages/core/src/services/cryptoservice.service.ts:1098

Get the encryption settings of the application, merged with the ones of a configuration file

Parameters

data?

any

the configuration file content

Returns

ConfigurationEncryption

the settings

getPkiKeyring()

protected static getPkiKeyring(data?): PkiKeyring

Defined in: packages/core/src/services/cryptoservice.service.ts:1354

Get the keyring of the pki encrypter, as configured for the application

Parameters

data?

any

a configuration file content, its settings override the application ones

Returns

PkiKeyring

the keyring

pkiGenerate()

static pkiGenerate(kid, bits?, out?): Promise<{ privateKey: string; publicKey: string; }>

Defined in: packages/core/src/services/cryptoservice.service.ts:1374

Generate a key pair for the pki encrypter

The public key is written in the public keys directory, to commit. The private key is written outside of it, to store in the runtime secrets (a Kubernetes Secret for example), never in the repository.

Parameters

kid

string

the key id

bits?

number = 4096

the RSA modulus length

out?

string

the private key file

Returns

Promise<{ privateKey: string; publicKey: string; }>

the written files

pkiList()

static pkiList(file): Promise<{ activeKey?: string; publicKeys: string[]; values: Record<string, number>; }>

Defined in: packages/core/src/services/cryptoservice.service.ts:1429

List the public keys of the pki encrypter and the number of values encrypted with each key in a file

A key with no value left can be retired.

Parameters

file

string

the configuration file to inspect

Returns

Promise<{ activeKey?: string; publicKeys: string[]; values: Record<string, number>; }>

the active key, the public keys and the values count by kid

registerEncrypter()

static registerEncrypter(name, encrypter): void

Defined in: packages/core/src/services/cryptoservice.service.ts:420

Values written as encrypt:<name>:<plain> are then encrypted by it with webda config encrypt, and crypt:<name>:<data> values are decrypted by it when the configuration is loaded.

Register it as a side effect of a module that the application loads (a Modda file), so it is available before the services are created.

Parameters

name

string

the name to use, letters, digits, _, - and . only

encrypter

StringEncrypter

the encrypter implementation

Returns

void

requireEncrypter()

protected static requireEncrypter(name, path): StringEncrypter

Defined in: packages/core/src/services/cryptoservice.service.ts:445

Get the encrypter for a value, with a helpful error if missing

Parameters

name

string

the encrypter name

path

(string | number)[]

the configuration path, for the error message

Returns

StringEncrypter

the encrypter

startPass()

protected static startPass(data, options, path, mode): EncryptionPass

Defined in: packages/core/src/services/cryptoservice.service.ts:889

Start an encryption or decryption pass

Parameters

data

any

the configuration

options

ConfigurationEncryptionOptions

the options

path

(string | number)[]

the path of data

mode

"encrypt" | "decrypt"

encrypt or decrypt

Returns

EncryptionPass

the pass

useEncrypter()

protected static useEncrypter(name, pass, path): Promise<StringEncrypter>

Defined in: packages/core/src/services/cryptoservice.service.ts:911

Get an encrypter, configured for this pass

Parameters

name

string

the encrypter name

pass

EncryptionPass

the current pass

path

(string | number)[]

the configuration path, for messages

Returns

Promise<StringEncrypter>

the encrypter

Class: CryptoService<T>

Webda Modda​

Extends​

Type Parameters​

T​

Implements​

Constructors​

Constructor​

Parameters​

name​

params​

Returns​

Inherited from​

Properties​

_compiledCapabilities​

See​

Inherited from​

[WEBDA_EVENTS]​

Inherited from​

age​

current​

currentAsymetricKey​

privateKey​

publicKey​

currentSymetricKey​

jwks​

Index Signature​

keys​

Index Signature​

keysFileSignature?​

logger​

Inherited from​

metrics?​

Inherited from​

name​

Inherited from​

parameters​

Inherited from​

createConfiguration?​

Parameters​

params​

Returns​

Inherited from​

filterConfiguration?​

Parameters​

params​

Returns​

Inherited from​

Parameters​

Inherited from​

Methods​

__clean()​

Returns​

Inherited from​

addListener()​

Type Parameters​

Key​

Parameters​

eventName​

listener​

Returns​

See​

Inherited from​

addRoute()​

Parameters​

url​

methods​

executer​

openapi?​

override?​

Returns​

Inherited from​

authorizeClientEvent()​

Parameters​

_event​

_context​

Returns​

Inherited from​

checkKey()​

Parameters​

Webda Modda

Extends

Type Parameters

T

Implements

Constructors

Constructor

Parameters

name

params

Returns

Inherited from

Properties

_compiledCapabilities

See

Inherited from

[WEBDA_EVENTS]

Inherited from

age

current

currentAsymetricKey

privateKey

publicKey

currentSymetricKey

jwks

Index Signature

keys

Index Signature

keysFileSignature?

logger

Inherited from

metrics?

Inherited from

name

Inherited from

parameters

Inherited from

createConfiguration?

Parameters

params

Returns

Inherited from

filterConfiguration?

Parameters

params

Returns

Inherited from

Parameters

Inherited from

Methods

__clean()

Returns

Inherited from

addListener()

Type Parameters

Key

Parameters

eventName

listener

Returns

See

Inherited from

addRoute()

Parameters

url

methods

executer

openapi?

override?

Returns

Inherited from

authorizeClientEvent()

Parameters

_event

_context

Returns

Inherited from

checkKey()

Parameters

keyId