cxp

Documentation

Index

• Constants
• Variables
• func CreateArchive(header *cxf.Header, hpke *HPKEContext) ([]byte, error)
• func CreateUnencryptedArchive(header *cxf.Header) ([]byte, error)
• func DefaultHPKEParams() cxp.HpkeParameters
• func Export(header *cxf.Header, opts ExportOptions) error
• func ExportResponse(header *cxf.Header, recipientPubKey []byte) (*cxp.ExportResponse, error)
• func ExportToBytes(header *cxf.Header, opts ExportOptions) ([]byte, error)
• func GenerateKeyPair() (privateKey, publicKey []byte, err error)
• type ExportOptions
• type HPKEContext
  • func NewHPKEContext(recipientPubKey []byte, params cxp.HpkeParameters) (*HPKEContext, error)
  • func (h *HPKEContext) EncappedKey() []byte
  • func (h *HPKEContext) Encrypt(plaintext []byte, aad []byte) ([]byte, error)
  • func (h *HPKEContext) EncryptToJWE(plaintext []byte) ([]byte, error)
  • func (h *HPKEContext) Params() cxp.HpkeParameters
• type IndexAccount
• type IndexDocument
• type IndexItem

Constants

const (

	// ArchiveAlgorithmDeflate is the only defined archive algorithm per CXP spec.
	// "Currently only one option defined: deflate - RFC 1951 DEFLATE compressed data format"
	ArchiveAlgorithmDeflate = "deflate"
)

Archive constants per CXP specification.

Variables

var (
	ErrNilHeader        = errors.New("header is nil")
	ErrNoOutputPath     = errors.New("output path is required")
	ErrMissingPubKey    = errors.New("recipient public key required for encryption")
	ErrCreateOutputFile = errors.New("failed to create output file")
)

Exporter errors.

var (
	ErrInvalidPublicKey  = errors.New("invalid public key: must be 32 bytes for X25519")
	ErrEncryptionFailed  = errors.New("encryption failed")
	ErrUnsupportedParams = errors.New("unsupported HPKE parameters")
	ErrHKDFExpandFailed  = errors.New("HKDF expand failed")
)

HPKE errors.

Functions

func CreateArchive

func CreateArchive(header *cxf.Header, hpke *HPKEContext) ([]byte, error)

CreateArchive builds the CXP ZIP archive structure. Uses DEFLATE compression (RFC 1951) as required by the spec.

func CreateUnencryptedArchive

func CreateUnencryptedArchive(header *cxf.Header) ([]byte, error)

CreateUnencryptedArchive creates a simple JSON export without encryption.

func DefaultHPKEParams

func DefaultHPKEParams() cxp.HpkeParameters

DefaultHPKEParams returns recommended HPKE parameters.

func Export

func Export(header *cxf.Header, opts ExportOptions) error

Export writes a CXF Header to disk, optionally encrypted.

func ExportResponse

func ExportResponse(header *cxf.Header, recipientPubKey []byte) (*cxp.ExportResponse, error)

ExportResponse creates a CXP ExportResponse from a header and encryption context. Payload is base64url encoded per CXP specification.

func ExportToBytes

func ExportToBytes(header *cxf.Header, opts ExportOptions) ([]byte, error)

ExportToBytes returns the export as bytes.

func GenerateKeyPair

func GenerateKeyPair() (privateKey, publicKey []byte, err error)

GenerateKeyPair generates an X25519 key pair for testing.

Types

type ExportOptions

type ExportOptions struct {
	// OutputPath is the destination file path.
	OutputPath string
	// Encrypt enables HPKE encryption. If false, outputs unencrypted JSON.
	Encrypt bool
	// RecipientPubKey is the X25519 public key for HPKE encryption.
	RecipientPubKey []byte
	// HPKEParams overrides default HPKE parameters if provided.
	HPKEParams *cxp.HpkeParameters
}

ExportOptions configures CXP export behavior.

type HPKEContext

type HPKEContext struct {
	// contains filtered or unexported fields
}

HPKEContext holds encryption state for a single export.

func NewHPKEContext

func NewHPKEContext(recipientPubKey []byte, params cxp.HpkeParameters) (*HPKEContext, error)

NewHPKEContext creates encryption context for a recipient's public key.

func (*HPKEContext) EncappedKey

func (h *HPKEContext) EncappedKey() []byte

EncappedKey returns the encapsulated key (sender's ephemeral public key).

func (*HPKEContext) Encrypt

func (h *HPKEContext) Encrypt(plaintext []byte, aad []byte) ([]byte, error)

Encrypt encrypts plaintext using HPKE.

func (*HPKEContext) EncryptToJWE

func (h *HPKEContext) EncryptToJWE(plaintext []byte) ([]byte, error)

EncryptToJWE encrypts and wraps in JWE Compact Serialization format. Uses standard JOSE HPKE algorithm identifier per draft-ietf-jose-hpke-encrypt.

func (*HPKEContext) Params

func (h *HPKEContext) Params() cxp.HpkeParameters

Params returns the HPKE parameters.

type IndexAccount

type IndexAccount struct {
	ID          string           `json:"id"`
	Username    string           `json:"username"`
	Email       string           `json:"email"`
	FullName    string           `json:"fullName,omitempty"`
	Collections []cxf.Collection `json:"collections"`
	Items       []IndexItem      `json:"items"`
}

IndexAccount contains account metadata for the index.

type IndexDocument

type IndexDocument struct {
	Version             cxf.Version    `json:"version"`
	ExporterRpId        string         `json:"exporterRpId"`
	ExporterDisplayName string         `json:"exporterDisplayName"`
	Timestamp           uint64         `json:"timestamp"`
	Accounts            []IndexAccount `json:"accounts"`
}

IndexDocument contains account metadata without secrets.

type IndexItem

type IndexItem struct {
	ID         string               `json:"id"`
	CreationAt *uint64              `json:"creationAt,omitempty"`
	ModifiedAt *uint64              `json:"modifiedAt,omitempty"`
	Title      string               `json:"title"`
	Subtitle   string               `json:"subtitle,omitempty"`
	Favorite   *bool                `json:"favorite,omitempty"`
	Scope      *cxf.CredentialScope `json:"scope,omitempty"`
	Tags       []string             `json:"tags,omitempty"`
}

IndexItem contains item metadata without credentials.