-import * as crypto from 'crypto'
-import * as Promise from 'bluebird'
-import { join } from 'path'
-
-import {
- SIGNATURE_ALGORITHM,
- SIGNATURE_ENCODING,
- PRIVATE_CERT_NAME,
- CONFIG,
- BCRYPT_SALT_SIZE,
- PUBLIC_CERT_NAME
-} from '../initializers'
-import {
- readFilePromise,
- bcryptComparePromise,
- bcryptGenSaltPromise,
- bcryptHashPromise,
- accessPromise,
- opensslExecPromise
-} from './core-utils'
+import { BCRYPT_SALT_SIZE, PRIVATE_RSA_KEY_SIZE } from '../initializers'
+import { ActorModel } from '../models/activitypub/actor'
+import { bcryptComparePromise, bcryptGenSaltPromise, bcryptHashPromise, createPrivateKey, getPublicKey } from './core-utils'
+import { jsig } from './custom-jsonld-signature'
import { logger } from './logger'
-function checkSignature (publicKey: string, data: string, hexSignature: string) {
- const verify = crypto.createVerify(SIGNATURE_ALGORITHM)
+async function createPrivateAndPublicKeys () {
+ logger.info('Generating a RSA key...')
- let dataString
- if (typeof data === 'string') {
- dataString = data
- } else {
- try {
- dataString = JSON.stringify(data)
- } catch (err) {
- logger.error('Cannot check signature.', err)
- return false
- }
- }
+ const { key } = await createPrivateKey(PRIVATE_RSA_KEY_SIZE)
+ const { publicKey } = await getPublicKey(key)
- verify.update(dataString, 'utf8')
-
- const isValid = verify.verify(publicKey, hexSignature, SIGNATURE_ENCODING)
- return isValid
+ return { privateKey: key, publicKey }
}
-function sign (data: string|Object) {
- const sign = crypto.createSign(SIGNATURE_ALGORITHM)
-
- let dataString: string
- if (typeof data === 'string') {
- dataString = data
- } else {
- try {
- dataString = JSON.stringify(data)
- } catch (err) {
- logger.error('Cannot sign data.', err)
- return Promise.resolve('')
- }
+function isSignatureVerified (fromActor: ActorModel, signedDocument: object) {
+ const publicKeyObject = {
+ '@context': jsig.SECURITY_CONTEXT_URL,
+ '@id': fromActor.url,
+ '@type': 'CryptographicKey',
+ owner: fromActor.url,
+ publicKeyPem: fromActor.publicKey
}
- sign.update(dataString, 'utf8')
+ const publicKeyOwnerObject = {
+ '@context': jsig.SECURITY_CONTEXT_URL,
+ '@id': fromActor.url,
+ publicKey: [ publicKeyObject ]
+ }
- return getMyPrivateCert().then(myKey => {
- return sign.sign(myKey, SIGNATURE_ENCODING)
- })
-}
+ const options = {
+ publicKey: publicKeyObject,
+ publicKeyOwner: publicKeyOwnerObject
+ }
-function comparePassword (plainPassword: string, hashPassword: string) {
- return bcryptComparePromise(plainPassword, hashPassword)
+ return jsig.promises.verify(signedDocument, options)
+ .catch(err => {
+ logger.error('Cannot check signature.', err)
+ return false
+ })
}
-function createCertsIfNotExist () {
- return certsExist().then(exist => {
- if (exist === true) {
- return undefined
- }
+function signObject (byActor: ActorModel, data: any) {
+ const options = {
+ privateKeyPem: byActor.privateKey,
+ creator: byActor.url,
+ algorithm: 'RsaSignature2017'
+ }
- return createCerts()
- })
+ return jsig.promises.sign(data, options)
}
-function cryptPassword (password: string) {
- return bcryptGenSaltPromise(BCRYPT_SALT_SIZE).then(salt => bcryptHashPromise(password, salt))
+function comparePassword (plainPassword: string, hashPassword: string) {
+ return bcryptComparePromise(plainPassword, hashPassword)
}
-function getMyPrivateCert () {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
- return readFilePromise(certPath, 'utf8')
-}
+async function cryptPassword (password: string) {
+ const salt = await bcryptGenSaltPromise(BCRYPT_SALT_SIZE)
-function getMyPublicCert () {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PUBLIC_CERT_NAME)
- return readFilePromise(certPath, 'utf8')
+ return bcryptHashPromise(password, salt)
}
// ---------------------------------------------------------------------------
export {
- checkSignature,
+ isSignatureVerified,
comparePassword,
- createCertsIfNotExist,
+ createPrivateAndPublicKeys,
cryptPassword,
- getMyPrivateCert,
- getMyPublicCert,
- sign
-}
-
-// ---------------------------------------------------------------------------
-
-function certsExist () {
- const certPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
-
- // If there is an error the certificates do not exist
- return accessPromise(certPath)
- .then(() => true)
- .catch(() => false)
-}
-
-function createCerts () {
- return certsExist().then(exist => {
- if (exist === true) {
- const errorMessage = 'Certs already exist.'
- logger.warning(errorMessage)
- throw new Error(errorMessage)
- }
-
- logger.info('Generating a RSA key...')
-
- const privateCertPath = join(CONFIG.STORAGE.CERT_DIR, PRIVATE_CERT_NAME)
- const genRsaOptions = {
- 'out': privateCertPath,
- '2048': false
- }
- return opensslExecPromise('genrsa', genRsaOptions)
- .then(() => {
- logger.info('RSA key generated.')
- logger.info('Managing public key...')
-
- const publicCertPath = join(CONFIG.STORAGE.CERT_DIR, 'peertube.pub')
- const rsaOptions = {
- 'in': privateCertPath,
- 'pubout': true,
- 'out': publicCertPath
- }
- return opensslExecPromise('rsa', rsaOptions)
- .then(() => logger.info('Public key managed.'))
- .catch(err => {
- logger.error('Cannot create public key on this pod.')
- throw err
- })
- })
- .catch(err => {
- logger.error('Cannot create private key on this pod.')
- throw err
- })
- })
+ signObject
}