Use browser crypto for SCRAM

.github/workflows/tests.yml

@@ -36,6 +36,8 @@ jobs:
           # - os: macos-latest
           #   node-version: "20"
           #   edgedb-version: "stable"
+    env:
+      NODE_OPTIONS: ${{ matrix.node-version == '18' && '--experimental-global-webcrypto' || '' }}
 
     steps:
       - uses: actions/checkout@v2

README.md

@@ -39,6 +39,9 @@ writing some simple queries.
 ### Requirements
 
 - Node.js 18+
+  - The driver requires the Browser API `crypto` to be available as a global.
+    Therefore, for Node versions before 19, you _must_ run `node` with the
+    special command line flag `--experimental-global-webcrypto`.
 - For TypeScript users:
   - TypeScript 4.4+ is required
   - `yarn add @types/node --dev`

compileForDeno.ts

@@ -135,7 +135,7 @@ export async function run({
 
         let resolvedImportPath = resolveImportPath(importPath, sourcePath);
 
-        for (const name of ["adapter", "adapter.shared", "adapter.crypto"]) {
+        for (const name of ["adapter", "adapter.shared"]) {
           if (resolvedImportPath.endsWith(`/${name}.node.ts`)) {
             resolvedImportPath = resolvedImportPath.replace(
               `/${name}.node.ts`,

integration-tests/legacy/package.json

@@ -6,7 +6,7 @@
     "typecheck": "echo 'Integration tests, skipping typecheck...'",
     "generate": "../../packages/generate/dist/cli.js",
     "build": "echo 'Integration tests, no build output...'",
-    "test": "NODE_OPTIONS=\"--experimental-vm-modules\" yarn generate edgeql-js && yarn generate queries --file && yarn generate interfaces && jest --detectOpenHandles --forceExit --passWithNoTests",
+    "test": "yarn generate edgeql-js && yarn generate queries --file && yarn generate interfaces && jest --detectOpenHandles --forceExit --passWithNoTests",
     "test:ci": "tsx ./testRunner.ts"
   },
   "devDependencies": {

integration-tests/lts/package.json

@@ -7,7 +7,7 @@
     "generate": "../../packages/generate/dist/cli.js",
     "build": "echo 'Integration tests, no build output...'",
     "test": "yarn test:ts && yarn test:non_ts",
-    "test:ts": "NODE_OPTIONS=\"--experimental-vm-modules\" pwd && yarn generate edgeql-js && yarn generate queries --file && yarn generate interfaces && jest --detectOpenHandles --forceExit",
+    "test:ts": "pwd && yarn generate edgeql-js && yarn generate queries --file && yarn generate interfaces && jest --detectOpenHandles --forceExit",
     "test:non_ts": "yarn test:esm && yarn test:cjs && yarn test:mts && yarn test:deno",
     "test:esm": "yarn generate queries --target esm --file esm/queries && yarn generate edgeql-js --target esm --output-dir esm/edgeql-js && cd esm && node test.js",
     "test:cjs": "yarn generate queries --target cjs --file cjs/queries && yarn generate edgeql-js --target cjs --output-dir cjs/edgeql-js && cd cjs && node test.js",

integration-tests/nightly/package.json

@@ -6,7 +6,7 @@
     "typecheck": "echo 'Integration tests, skipping typecheck...'",
     "generate": "../../packages/generate/dist/cli.js",
     "build": "echo 'Integration tests, no build output...'",
-    "test": "NODE_OPTIONS=\"--experimental-vm-modules\" yarn generate edgeql-js && yarn generate queries --file && yarn generate interfaces && jest --detectOpenHandles --forceExit --passWithNoTests",
+    "test": "yarn generate edgeql-js && yarn generate queries --file && yarn generate interfaces && jest --detectOpenHandles --forceExit --passWithNoTests",
     "test:ci": "tsx ./testRunner.ts"
   },
   "devDependencies": {

integration-tests/stable/package.json

@@ -6,7 +6,7 @@
     "typecheck": "echo 'Integration tests, skipping typecheck...'",
     "generate": "../../packages/generate/dist/cli.js",
     "build": "echo 'Integration tests, no build output...'",
-    "test": "NODE_OPTIONS=\"--experimental-vm-modules\" yarn generate edgeql-js && yarn generate queries --file && yarn generate interfaces && jest --detectOpenHandles --forceExit --passWithNoTests",
+    "test": "yarn generate edgeql-js && yarn generate queries --file && yarn generate interfaces && jest --detectOpenHandles --forceExit --passWithNoTests",
     "test:ci": "tsx ./testRunner.ts"
   },
   "devDependencies": {

packages/ai/src/core.ts

@@ -1,7 +1,6 @@
 import type { Client } from "edgedb";
 import type { ResolvedConnectConfig } from "edgedb/dist/conUtils.js";
-import { getHTTPSCRAMAuth } from "edgedb/dist/httpScram.js";
-import cryptoUtils from "edgedb/dist/adapter.crypto.node.js";
+import { HTTPSCRAMAuth } from "edgedb/dist/httpScram.js";
 import {
   getAuthenticatedFetch,
   type AuthenticatedFetch,
@@ -13,8 +12,6 @@ export function createAI(client: Client, options: AIOptions) {
   return new EdgeDBAI(client, options);
 }
 
-const httpSCRAMAuth = getHTTPSCRAMAuth(cryptoUtils.default);
-
 export class EdgeDBAI {
   /** @internal */
   private readonly authenticatedFetch: Promise<AuthenticatedFetch>;
@@ -41,7 +38,7 @@ export class EdgeDBAI {
       await (client as any).pool._getNormalizedConnectConfig()
     ).connectionParams;
 
-    return getAuthenticatedFetch(connectConfig, httpSCRAMAuth, "ext/ai/");
+    return getAuthenticatedFetch(connectConfig, "ext/ai/");
   }
 
   withConfig(options: Partial<AIOptions>) {

packages/driver/src/browserClient.ts

@@ -1,17 +1,15 @@
 import { BaseClientPool, Client, type ConnectOptions } from "./baseClient";
 import { getConnectArgumentsParser } from "./conUtils";
-import cryptoUtils from "./browserCrypto";
 import { EdgeDBError } from "./errors";
 import { FetchConnection } from "./fetchConn";
-import { getHTTPSCRAMAuth } from "./httpScram";
 import { Options } from "./options";
 
 const parseConnectArguments = getConnectArgumentsParser(null);
-const httpSCRAMAuth = getHTTPSCRAMAuth(cryptoUtils);
 
 class FetchClientPool extends BaseClientPool {
   isStateless = true;
-  _connectWithTimeout = FetchConnection.createConnectWithTimeout(httpSCRAMAuth);
+  _connectWithTimeout =
+    FetchConnection.connectWithTimeout.bind(FetchConnection);
 }
 
 export function createClient(): Client {

packages/driver/src/browserCrypto.ts

@@ -1,32 +1,29 @@
-import type { CryptoUtils } from "./utils";
+export async function randomBytes(size: number): Promise<Uint8Array> {
+  return crypto.getRandomValues(new Uint8Array(size));
+}
 
-const cryptoUtils: CryptoUtils = {
-  async randomBytes(size: number): Promise<Uint8Array> {
-    return crypto.getRandomValues(new Uint8Array(size));
-  },
+export async function H(msg: Uint8Array): Promise<Uint8Array> {
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", msg));
+}
 
-  async H(msg: Uint8Array): Promise<Uint8Array> {
-    return new Uint8Array(await crypto.subtle.digest("SHA-256", msg));
-  },
-
-  async HMAC(key: Uint8Array, msg: Uint8Array): Promise<Uint8Array> {
-    return new Uint8Array(
-      await crypto.subtle.sign(
-        "HMAC",
-        await crypto.subtle.importKey(
-          "raw",
-          key,
-          {
-            name: "HMAC",
-            hash: { name: "SHA-256" },
-          },
-          false,
-          ["sign"]
-        ),
-        msg
-      )
-    );
-  },
-};
-
-export default cryptoUtils;
+export async function HMAC(
+  key: Uint8Array,
+  msg: Uint8Array
+): Promise<Uint8Array> {
+  return new Uint8Array(
+    await crypto.subtle.sign(
+      "HMAC",
+      await crypto.subtle.importKey(
+        "raw",
+        key,
+        {
+          name: "HMAC",
+          hash: { name: "SHA-256" },
+        },
+        false,
+        ["sign"]
+      ),
+      msg
+    )
+  );
+}

packages/driver/src/fetchConn.ts

@@ -27,7 +27,6 @@ import type { ICodec } from "./codecs/ifaces";
 import type { CodecsRegistry } from "./codecs/registry";
 import type { NormalizedConnectConfig } from "./conUtils";
 import { InternalClientError, ProtocolError } from "./errors";
-import type { HttpSCRAMAuth } from "./httpScram";
 import {
   Cardinality,
   OutputFormat,
@@ -205,22 +204,17 @@ export class AdminUIFetchConnection extends BaseFetchConnection {
 }
 
 export class FetchConnection extends BaseFetchConnection {
-  static createConnectWithTimeout(httpSCRAMAuth: HttpSCRAMAuth) {
-    return async function connectWithTimeout(
-      config: NormalizedConnectConfig,
-      registry: CodecsRegistry
-    ) {
-      const fetch = await getAuthenticatedFetch(
-        config.connectionParams,
-        httpSCRAMAuth
-      );
+  static async connectWithTimeout(
+    config: NormalizedConnectConfig,
+    registry: CodecsRegistry
+  ) {
+    const fetch = await getAuthenticatedFetch(config.connectionParams);
 
-      const conn = new FetchConnection(fetch, registry);
+    const conn = new FetchConnection(fetch, registry);
 
-      conn.connected = true;
-      conn.connWaiter.set();
+    conn.connected = true;
+    conn.connWaiter.set();
 
-      return conn;
-    };
+    return conn;
   }
 }