mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 16:13:15 +00:00
Linus Rath
de35d1d8e8
- Implemented Zustand store for S/MIME functionality, including state management for key records and public certificates. - Added methods for importing PKCS#12 files and public certificates, binding identities to keys, and managing unlocked keys. - Introduced session storage for remembering unlocked keys across sessions. - Enhanced error handling and loading states during data operations.
81 lines
2.3 KiB
TypeScript
81 lines
2.3 KiB
TypeScript
/** Stored record for an imported S/MIME private key + certificate. */
|
|
export interface SmimeKeyRecord {
|
|
id: string;
|
|
email: string;
|
|
certificate: ArrayBuffer; // DER-encoded X.509 leaf cert
|
|
certificateChain: ArrayBuffer[]; // DER-encoded intermediates
|
|
encryptedPrivateKey: ArrayBuffer; // AES-GCM wrapped PKCS#8 bytes
|
|
salt: ArrayBuffer; // PBKDF2 salt
|
|
iv: ArrayBuffer; // AES-GCM IV
|
|
kdfIterations: number;
|
|
issuer: string;
|
|
subject: string;
|
|
serialNumber: string;
|
|
notBefore: string; // ISO 8601
|
|
notAfter: string; // ISO 8601
|
|
fingerprint: string; // SHA-256 hex of DER cert
|
|
algorithm: string; // e.g. "RSA-2048", "RSA-4096", "ECDSA-P256"
|
|
capabilities: SmimeKeyCapabilities;
|
|
}
|
|
|
|
/** What a certificate can be used for based on KeyUsage/ExtendedKeyUsage. */
|
|
export interface SmimeKeyCapabilities {
|
|
canSign: boolean;
|
|
canEncrypt: boolean;
|
|
}
|
|
|
|
/** Runtime-only unlocked private key handle (never persisted). */
|
|
export interface SmimeUnlockedKey {
|
|
id: string;
|
|
email: string;
|
|
privateKey: CryptoKey; // imported as non-extractable
|
|
}
|
|
|
|
/** A recipient or contact public certificate. */
|
|
export interface SmimePublicCert {
|
|
id: string;
|
|
email: string;
|
|
certificate: ArrayBuffer; // DER-encoded X.509
|
|
issuer: string;
|
|
subject: string;
|
|
notBefore: string;
|
|
notAfter: string;
|
|
fingerprint: string;
|
|
source: 'manual' | 'contact' | 'signed-email';
|
|
contactId?: string;
|
|
}
|
|
|
|
/** Status of S/MIME processing for a single email message. */
|
|
export interface SmimeStatus {
|
|
isSigned: boolean;
|
|
isEncrypted: boolean;
|
|
signatureValid?: boolean;
|
|
signatureError?: string;
|
|
signerCert?: SmimePublicCert;
|
|
signerEmailMatch?: boolean;
|
|
decryptionSuccess?: boolean;
|
|
decryptionError?: string;
|
|
unsupportedReason?: string;
|
|
}
|
|
|
|
/** Metadata extracted from a parsed X.509 certificate. */
|
|
export interface CertificateInfo {
|
|
subject: string;
|
|
issuer: string;
|
|
serialNumber: string;
|
|
notBefore: string;
|
|
notAfter: string;
|
|
fingerprint: string;
|
|
algorithm: string;
|
|
keyUsage?: string[];
|
|
extendedKeyUsage?: string[];
|
|
emailAddresses: string[];
|
|
capabilities: SmimeKeyCapabilities;
|
|
}
|
|
|
|
/** Result of PKCS#12 import parsing. */
|
|
export interface Pkcs12ImportResult {
|
|
keyRecord: SmimeKeyRecord;
|
|
certInfo: CertificateInfo;
|
|
}
|