lib6/encryption/encapsulated-key-manager.js

/**
 * Copyright (c) "Neo4j"
 * Neo4j Sweden AB [https://neo4j.com]
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
import { newError } from '../error';
/**
 * A manager for encapsulated keys.
 *
 * {@link EnvelopeEncryptionProfile} requires data keys to exist before they can be used for encryption. This
 * manager provides operations for creating and managing such keys.
 *
 * When creating a key, the manager uses the configured {@link KeyEncapsulationService} to generate and encapsulate a
 * new data key and registers the resulting {@link EncapsulatedKeyRecord} with the configured
 * {@link EncapsulatedKeyRecordRepository}.
 *
 * @since 6.3.0
 * @experimental Part of the Client-Side Encrytion preview feature
 */
export class EncapsulatedKeyManager {
    constructor(profile, keyEncapsulationService) {
        this._profile = profile;
        this._keyEncapsulationService = keyEncapsulationService;
    }
    /**
     * Creates a new key via the {@link KeyEncapsulationService} and saves it in the profile's configured {@link EncapsulatedKeyRecordRepository}
     *
     * @param {string} name - The alias the new key should be saved under in the {@link EncapsulatedKeyRecordRepository}
     * @returns {Promise<void>} Promise that resolves when the key is created, saved and ready to use.
     */
    create(name) {
        return __awaiter(this, void 0, void 0, function* () {
            const encapulated = yield this._keyEncapsulationService.encapsulate({});
            return yield this._profile.saveKey(name, encapulated.encapsulation(), encapulated.options());
        });
    }
    /**
     * Finds an encapsulated key by its id.
     *
     * @param {string} id the key id
     * @return the encapsulated key or undefined when no key with the given id exists
     */
    findById(id) {
        return __awaiter(this, void 0, void 0, function* () {
            const record = yield this._profile.findKey({ id });
            if (record != null) {
                return { id: record.id, alias: record.alias };
            }
            else {
                return undefined;
            }
        });
    }
    /**
     * Finds an encapsulated key by its alias.
     *
     * @param {string} alias the key alias
     * @return the encapsulated key or undefined when no key with the given alias exists
     */
    findByAlias(alias) {
        return __awaiter(this, void 0, void 0, function* () {
            const record = yield this._profile.findKey({ alias });
            if (record != null) {
                return { id: record.id, alias: record.alias };
            }
            else {
                return undefined;
            }
        });
    }
    /**
     * Sets the alias of an encapsulated key by id. The alias must not be used by another key. To assign an alias
     * currently used by another key, it must first be deleted from that key.
     *
     * @param {string} id the key id
     * @param {string | undefined} alias the new key alias
     */
    setAliasById(id, alias) {
        return __awaiter(this, void 0, void 0, function* () {
            try {
                return yield this._profile.keyRepository.setAliasById(id, alias);
            }
            catch (e) {
                throw newError('Call to EncapsulatedKeyRepository.setAliasById threw error, see cause', '50N42', e);
            }
        });
    }
    /**
     * Deletes the alias from encapsulated key by id.
     *
     * @param {string} id the key id
     */
    deleteAliasById(id) {
        return __awaiter(this, void 0, void 0, function* () {
            return yield this.setAliasById(id, undefined);
        });
    }
    /**
     * Deletes an encapsulated key by id.
     *
     * @param {string} id the key id, must not be {@literal null}
     */
    deleteById(id) {
        return __awaiter(this, void 0, void 0, function* () {
            try {
                return yield this._profile.keyRepository.deleteById(id);
            }
            catch (e) {
                throw newError('Call to EncapsulatedKeyRepository.deleteById threw error, see cause', '50N42', e);
            }
        });
    }
}