lint and import

Browsers import a crypto key

Author: seebees

modules/kms-keyring-browser/package.json

@@ -3,7 +3,8 @@
   "private": true,
   "version": "0.0.1",
   "scripts": {
-    "prepublishOnly": "tsc -p tsconfig.json && tsc -p tsconfig.module.json",
+    "prepublishOnly": "npm run build",
+    "build": "tsc -b tsconfig.json && tsc -b tsconfig.module.json",
     "lint": "standard src/*.ts test/**/*.ts",
     "mocha": "mocha --require ts-node/register test/**/*test.ts",
     "test": "npm run lint && npm run coverage",
@@ -18,13 +19,14 @@
   "dependencies": {
     "@aws-crypto/material-management-browser": "^0.0.1",
     "@aws-crypto/kms-keyring": "^0.0.1",
+    "@aws-crypto/web-crypto-backend": "^0.0.1",
     "@aws-sdk/types": "0.1.0-preview.1",
     "tslib": "^1.9.3"
   },
   "devDependencies": {
     "@types/chai": "^4.1.4",
     "@types/mocha": "^5.2.5",
-    "@types/node": "^8.10.40",
+    "@types/node": "^11.11.4",
     "@typescript-eslint/eslint-plugin": "^1.4.2",
     "@typescript-eslint/parser": "^1.4.2",
     "aws-sdk": "^2.412.0",

modules/kms-keyring-browser/src/index.ts

@@ -15,29 +15,67 @@
 
 import {
   KmsKeyring,
-  KmsKeyringInput,
-  KMSConstructible,
-  KmsClientSupplier,
+  KmsKeyringInput, // eslint-disable-line no-unused-vars
+  KMSConstructible, // eslint-disable-line no-unused-vars
+  KmsClientSupplier, // eslint-disable-line no-unused-vars
   getClient,
   limitRegions,
   excludeRegions,
   cacheClients
 } from '@aws-crypto/kms-keyring'
 import {
-  WebCryptoAlgorithmSuite,
-  immutableClass
+  WebCryptoAlgorithmSuite, // eslint-disable-line no-unused-vars
+  WebCryptoEncryptionMaterial, // eslint-disable-line no-unused-vars
+  WebCryptoDecryptionMaterial, // eslint-disable-line no-unused-vars
+  EncryptionContext, // eslint-disable-line no-unused-vars
+  EncryptedDataKey, // eslint-disable-line no-unused-vars
+  immutableClass,
+  importCryptoKey
 } from '@aws-crypto/material-management-browser'
-import {KMS, KMSConfiguration} from '@aws-sdk/client-kms-browser'
+import { getWebCryptoBackend } from '@aws-crypto/web-crypto-backend'
+import { KMS, KMSConfiguration } from '@aws-sdk/client-kms-browser' // eslint-disable-line no-unused-vars
 
 export type KmsKeyringWebCryptoInput = KmsKeyringInput<KMS>
 export type KMSWebCryptoConstructible = KMSConstructible<KMS, KMSConfiguration>
 export type KmsWebCryptoClientSupplier = KmsClientSupplier<KMS>
 
 export class KmsKeyringNode extends KmsKeyring<WebCryptoAlgorithmSuite, KMS> {
-  constructor(input: KmsKeyringWebCryptoInput){
-    super(input)
+  async _onEncrypt (material: WebCryptoEncryptionMaterial, context?: EncryptionContext) {
+    const _material = await super._onEncrypt(material, context)
+
+    /* Check for early return (Postcondition): If a cryptoKey has already been imported, return. */
+    if (_material.hasUnencryptedDataKey && _material.hasCryptoKey) {
+      return _material
+    }
+
+    const backend = await getWebCryptoBackend()
+    const cryptoKey = await importCryptoKey(backend, _material)
+    // The trace is only set when the material does not already have
+    // an hasUnencryptedDataKey.  This is an implementation detail :(
+    const [trace] = _material.keyringTrace
+
+    return _material.setCryptoKey(cryptoKey, trace)
+  }
+
+  async _onDecrypt (material: WebCryptoDecryptionMaterial, encryptedDataKeys: EncryptedDataKey[], context?: EncryptionContext) {
+    const _material = await super._onDecrypt(material, encryptedDataKeys, context)
+
+    /* Check for early return (Postcondition): If a cryptoKey has already been imported, return. */
+    if (_material.hasUnencryptedDataKey && _material.hasCryptoKey) {
+      return _material
+    }
+
+    const backend = await getWebCryptoBackend()
+    const cryptoKey = await importCryptoKey(backend, _material)
+    // Now that a cryptoKey has been imported, the unencrypted data key can be zeroed.
+    _material.zeroUnencryptedDataKey()
+    // The trace is only set when the material does not already have
+    // an hasUnencryptedDataKey.  This is an implementation detail :(
+    const [trace] = _material.keyringTrace
+
+    return _material.setCryptoKey(cryptoKey, trace)
   }
 }
 immutableClass(KmsKeyringNode)
 
-export {getClient, limitRegions, excludeRegions, cacheClients}
+export { getClient, limitRegions, excludeRegions, cacheClients }