/**
* HSM (Hardware Security Module) Adapter
* Abstract interface for HSM integration
*/
import type { HSMConfig, HSMAdapter as IHSMAdapter, WalletErrorCode } from '../types.js';
import { WalletManagerError } from '../types.js';
/**
* Local HSM Adapter (software-based fallback)
* This is a placeholder for actual HSM integration
*/
export class LocalHSMAdapter implements IHSMAdapter {
private initialized = false;
private keys = new Map<string, Uint8Array>();
async initialize(): Promise<void> {
this.initialized = true;
}
async encrypt(data: Uint8Array, keyId: string): Promise<Uint8Array> {
if (!this.initialized) {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'HSM not initialized'
);
}
const key = this.keys.get(keyId);
if (!key) {
throw new WalletManagerError(
'HSM_ERROR' as WalletErrorCode,
`Key ${keyId} not found in HSM`
);
}
// Simple XOR encryption (for demonstration only - NOT secure!)
// In production, this would use actual HSM encryption
const encrypted = new Uint8Array(data.length);
for (let i = 0; i < data.length; i++) {
encrypted[i] = (data[i] ?? 0) ^ (key[i % key.length] ?? 0);
}
return encrypted;
}
async decrypt(data: Uint8Array, keyId: string): Promise<Uint8Array> {
// XOR encryption is symmetric
return this.encrypt(data, keyId);
}
async generateKey(keyId: string): Promise<void> {
if (!this.initialized) {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'HSM not initialized'
);
}
const key = new Uint8Array(32);
crypto.getRandomValues(key);
this.keys.set(keyId, key);
}
async deleteKey(keyId: string): Promise<void> {
this.keys.delete(keyId);
}
isAvailable(): boolean {
return this.initialized;
}
}
/**
* AWS CloudHSM Adapter placeholder
*/
export class AWSCloudHSMAdapter implements IHSMAdapter {
private readonly config: HSMConfig;
private initialized = false;
constructor(config: HSMConfig) {
this.config = config;
}
/** Get the HSM configuration */
getConfig(): HSMConfig {
return this.config;
}
async initialize(): Promise<void> {
// In production, this would initialize the AWS CloudHSM connection
// using the AWS SDK and PKCS#11 interface
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'AWS CloudHSM integration not yet implemented'
);
}
async encrypt(_data: Uint8Array, _keyId: string): Promise<Uint8Array> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'AWS CloudHSM integration not yet implemented'
);
}
async decrypt(_data: Uint8Array, _keyId: string): Promise<Uint8Array> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'AWS CloudHSM integration not yet implemented'
);
}
async generateKey(_keyId: string): Promise<void> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'AWS CloudHSM integration not yet implemented'
);
}
async deleteKey(_keyId: string): Promise<void> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'AWS CloudHSM integration not yet implemented'
);
}
isAvailable(): boolean {
return this.initialized;
}
}
/**
* Azure Key Vault Adapter placeholder
*/
export class AzureKeyVaultAdapter implements IHSMAdapter {
private readonly config: HSMConfig;
private initialized = false;
constructor(config: HSMConfig) {
this.config = config;
}
/** Get the HSM configuration */
getConfig(): HSMConfig {
return this.config;
}
async initialize(): Promise<void> {
// In production, this would initialize Azure Key Vault connection
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'Azure Key Vault integration not yet implemented'
);
}
async encrypt(_data: Uint8Array, _keyId: string): Promise<Uint8Array> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'Azure Key Vault integration not yet implemented'
);
}
async decrypt(_data: Uint8Array, _keyId: string): Promise<Uint8Array> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'Azure Key Vault integration not yet implemented'
);
}
async generateKey(_keyId: string): Promise<void> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'Azure Key Vault integration not yet implemented'
);
}
async deleteKey(_keyId: string): Promise<void> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'Azure Key Vault integration not yet implemented'
);
}
isAvailable(): boolean {
return this.initialized;
}
}
/**
* HashiCorp Vault Adapter placeholder
*/
export class HashiCorpVaultAdapter implements IHSMAdapter {
private readonly config: HSMConfig;
private initialized = false;
constructor(config: HSMConfig) {
this.config = config;
}
/** Get the HSM configuration */
getConfig(): HSMConfig {
return this.config;
}
async initialize(): Promise<void> {
// In production, this would initialize HashiCorp Vault connection
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'HashiCorp Vault integration not yet implemented'
);
}
async encrypt(_data: Uint8Array, _keyId: string): Promise<Uint8Array> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'HashiCorp Vault integration not yet implemented'
);
}
async decrypt(_data: Uint8Array, _keyId: string): Promise<Uint8Array> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'HashiCorp Vault integration not yet implemented'
);
}
async generateKey(_keyId: string): Promise<void> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'HashiCorp Vault integration not yet implemented'
);
}
async deleteKey(_keyId: string): Promise<void> {
throw new WalletManagerError(
'HSM_UNAVAILABLE' as WalletErrorCode,
'HashiCorp Vault integration not yet implemented'
);
}
isAvailable(): boolean {
return this.initialized;
}
}
/**
* Create an HSM adapter based on configuration
* @param config - HSM configuration
* @returns The appropriate HSM adapter
*/
export function createHSMAdapter(config: HSMConfig): IHSMAdapter {
if (!config.enabled) {
return new LocalHSMAdapter();
}
switch (config.provider) {
case 'aws-cloudhsm':
return new AWSCloudHSMAdapter(config);
case 'azure-keyvault':
return new AzureKeyVaultAdapter(config);
case 'hashicorp-vault':
return new HashiCorpVaultAdapter(config);
case 'local':
default:
return new LocalHSMAdapter();
}
}
