From f3ed546ae81b37678b271f398efc777d1123961c Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 11 Feb 2022 19:10:16 +0100
Subject: [PATCH 1/7] crypto: expose Web Crypto API on the global scope

---
 .eslintrc.js                            |  1 +
 doc/api/cli.md                          | 10 ++++++++++
 doc/api/crypto.md                       | 12 +++++++-----
 doc/api/globals.md                      | 13 +++++++++++++
 doc/node.1                              |  3 +++
 lib/.eslintrc.yaml                      |  2 ++
 lib/internal/bootstrap/pre_execution.js | 13 +++++++++++++
 lib/internal/main/worker_thread.js      |  2 ++
 src/node_options.cc                     |  4 ++++
 src/node_options.h                      |  1 +
 test/common/index.js                    |  3 +++
 test/parallel/test-global-webcrypto.js  | 11 +++++++++++
 12 files changed, 70 insertions(+), 5 deletions(-)
 create mode 100644 test/parallel/test-global-webcrypto.js

diff --git a/.eslintrc.js b/.eslintrc.js
index da17fd47acd4b9..d9ec6f709de542 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -340,5 +340,6 @@ module.exports = {
     Headers: 'readable',
     Request: 'readable',
     Response: 'readable',
+    crypto: 'readable',
   },
 };
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 10500f130a6b28..a551a3fff9cec6 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -288,6 +288,14 @@ added: v17.5.0
 
 Enable experimental support for the [Fetch API][].
 
+### `--experimental-global-webcrypto`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Expose the [Web Crypto API][] on the global scope.
+
 ### `--experimental-import-meta-resolve`
 
 <!-- YAML
@@ -1580,6 +1588,7 @@ Node.js options that are allowed are:
 * `--enable-source-maps`
 * `--experimental-abortcontroller`
 * `--experimental-fetch`
+* `--experimental-global-webcrypto`
 * `--experimental-import-meta-resolve`
 * `--experimental-json-modules`
 * `--experimental-loader`
@@ -1982,6 +1991,7 @@ $ node --max-old-space-size=1536 index.js
 [Source Map]: https://sourcemaps.info/spec.html
 [Subresource Integrity]: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
 [V8 JavaScript code coverage]: https://v8project.blogspot.com/2017/12/javascript-code-coverage.html
+[Web Crypto API]: webcrypto.md
 [`"type"`]: packages.md#type
 [`--cpu-prof-dir`]: #--cpu-prof-dir
 [`--diagnostic-dir`]: #--diagnostic-dirdirectory
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 0e56f12a6fdf3a..d2e7d3924ae01a 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -42,11 +42,13 @@ calling `require('crypto')` will result in an error being thrown.
 When using CommonJS, the error thrown can be caught using try/catch:
 
 ```cjs
-let crypto;
-try {
-  crypto = require('crypto');
-} catch (err) {
-  console.log('crypto support is disabled!');
+{
+  let crypto;
+  try {
+    crypto = require('crypto');
+  } catch (err) {
+    console.log('crypto support is disabled!');
+  }
 }
 ```
 
diff --git a/doc/api/globals.md b/doc/api/globals.md
index 1fa6801dda66c9..d5134cadc08806 100644
--- a/doc/api/globals.md
+++ b/doc/api/globals.md
@@ -307,6 +307,17 @@ added: v0.1.100
 
 Used to print to stdout and stderr. See the [`console`][] section.
 
+## `crypto`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental. Enable this API with the
+> [`--experimental-global-webcrypto`][] CLI flag.
+
+A browser-compatible implementation of the [Web Crypto API][].
+
 ## `Event`
 
 <!-- YAML
@@ -598,7 +609,9 @@ The object that acts as the namespace for all W3C
 [WebAssembly][webassembly-org] related functionality. See the
 [Mozilla Developer Network][webassembly-mdn] for usage and compatibility.
 
+[Web Crypto API]: webcrypto.md
 [`--experimental-fetch`]: cli.md#--experimental-fetch
+[`--experimental-global-webcrypto`]: cli.md#--experimental-global-webcrypto
 [`AbortController`]: https://developer.mozilla.org/en-US/docs/Web/API/AbortController
 [`DOMException`]: https://developer.mozilla.org/en-US/docs/Web/API/DOMException
 [`EventTarget` and `Event` API]: events.md#eventtarget-and-event-api
diff --git a/doc/node.1 b/doc/node.1
index 86a5bd865ae51b..972487be1218ee 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -142,6 +142,9 @@ Enable Source Map V3 support for stack traces.
 .It Fl -experimental-fetch
 Enable experimental support for the Fetch API.
 .
+.It Fl -experimental-global-webcrypto
+Expose the Web Crypto API on the global scope.
+.
 .It Fl -experimental-import-meta-resolve
 Enable experimental ES modules support for import.meta.resolve().
 .
diff --git a/lib/.eslintrc.yaml b/lib/.eslintrc.yaml
index c5e1058a3068e1..e9b7924618975b 100644
--- a/lib/.eslintrc.yaml
+++ b/lib/.eslintrc.yaml
@@ -79,6 +79,8 @@ rules:
       message: "Use `const { atob } = require('buffer');` instead of the global."
     - name: btoa
       message: "Use `const { btoa } = require('buffer');` instead of the global."
+    - name: crypto
+      message: "Use `const { crypto } = require('internal/crypto/webcrypto');` instead of the global."
     - name: global
       message: "Use `const { globalThis } = primordials;` instead of `global`."
     - name: globalThis
diff --git a/lib/internal/bootstrap/pre_execution.js b/lib/internal/bootstrap/pre_execution.js
index 1fe56478e0ab3f..769cd7842921ea 100644
--- a/lib/internal/bootstrap/pre_execution.js
+++ b/lib/internal/bootstrap/pre_execution.js
@@ -36,6 +36,7 @@ function prepareMainThreadExecution(expandArgv1 = false) {
   setupInspectorHooks();
   setupWarningHandler();
   setupFetch();
+  setupWebCrypto();
 
   // Resolve the coverage directory to an absolute path, and
   // overwrite process.env so that the original path gets passed
@@ -162,6 +163,17 @@ function setupFetch() {
   exposeInterface(globalThis, 'Response', undici.Response);
 }
 
+// TODO(aduh95): move this to internal/bootstrap/browser when the CLI flag is
+//               removed.
+function setupWebCrypto() {
+  if (!getOptionValue('--experimental-global-webcrypto')) {
+    return;
+  }
+
+  const webcrypto = require('internal/crypto/webcrypto');
+  defineOperation(globalThis, 'crypto', webcrypto.crypto);
+}
+
 // Setup User-facing NODE_V8_COVERAGE environment variable that writes
 // ScriptCoverage to a specified file.
 function setupCoverageHooks(dir) {
@@ -503,6 +515,7 @@ module.exports = {
   setupCoverageHooks,
   setupWarningHandler,
   setupFetch,
+  setupWebCrypto,
   setupDebugEnv,
   setupPerfHooks,
   prepareMainThreadExecution,
diff --git a/lib/internal/main/worker_thread.js b/lib/internal/main/worker_thread.js
index 5e24b84e14c934..a5816f1f1cf4ee 100644
--- a/lib/internal/main/worker_thread.js
+++ b/lib/internal/main/worker_thread.js
@@ -18,6 +18,7 @@ const {
   setupInspectorHooks,
   setupWarningHandler,
   setupFetch,
+  setupWebCrypto,
   setupDebugEnv,
   setupPerfHooks,
   initializeDeprecations,
@@ -69,6 +70,7 @@ setupDebugEnv();
 
 setupWarningHandler();
 setupFetch();
+setupWebCrypto();
 initializeSourceMapsHandlers();
 
 // Since worker threads cannot switch cwd, we do not need to
diff --git a/src/node_options.cc b/src/node_options.cc
index bac3de2404b5c3..ab3b736e07d8e9 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -319,6 +319,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "experimental Fetch API",
             &EnvironmentOptions::experimental_fetch,
             kAllowedInEnvironment);
+  AddOption("--experimental-global-webcrypto",
+            "expose experimental Web Crypto API on the global scope",
+            &EnvironmentOptions::experimental_global_web_crypto,
+            kAllowedInEnvironment);
   AddOption("--experimental-json-modules", "", NoOp{}, kAllowedInEnvironment);
   AddOption("--experimental-loader",
             "use the specified module as a custom loader",
diff --git a/src/node_options.h b/src/node_options.h
index 6042f5e7f5e804..0ded5d89beef7c 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -108,6 +108,7 @@ class EnvironmentOptions : public Options {
   std::string dns_result_order;
   bool enable_source_maps = false;
   bool experimental_fetch = false;
+  bool experimental_global_web_crypto = false;
   bool experimental_https_modules = false;
   std::string experimental_specifier_resolution;
   bool experimental_wasm_modules = false;
diff --git a/test/common/index.js b/test/common/index.js
index fdffecb9af1048..1870324218de30 100644
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -308,6 +308,9 @@ if (global.fetch) {
     global.Headers,
   );
 }
+if(global.crypto) {
+  knownGlobals.push(global.crypto)
+}
 
 function allowGlobals(...allowlist) {
   knownGlobals = knownGlobals.concat(allowlist);
diff --git a/test/parallel/test-global-webcrypto.js b/test/parallel/test-global-webcrypto.js
new file mode 100644
index 00000000000000..6319700cd23768
--- /dev/null
+++ b/test/parallel/test-global-webcrypto.js
@@ -0,0 +1,11 @@
+// Flags: --experimental-global-webcrypto
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const crypto = require('crypto');
+
+assert.strictEqual(globalThis.crypto, crypto.webcrypto);

From 2189ef94c3632ec4ad1ad7dbd03041e74869c764 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Fri, 11 Feb 2022 19:43:49 +0100
Subject: [PATCH 2/7] lint

Co-authored-by: mscdex <mscdex@users.noreply.github.com>
---
 test/common/index.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/common/index.js b/test/common/index.js
index 1870324218de30..30481fb783537c 100644
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -308,8 +308,8 @@ if (global.fetch) {
     global.Headers,
   );
 }
-if(global.crypto) {
-  knownGlobals.push(global.crypto)
+if (global.crypto) {
+  knownGlobals.push(global.crypto);
 }
 
 function allowGlobals(...allowlist) {

From 30c76d546722498a0aa3468c0f84d3d5408496c1 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 12 Feb 2022 13:46:07 +0100
Subject: [PATCH 3/7] fix error when node is compiled without OpenSSL

---
 lib/internal/bootstrap/pre_execution.js | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/internal/bootstrap/pre_execution.js b/lib/internal/bootstrap/pre_execution.js
index 769cd7842921ea..ca74d4231e513d 100644
--- a/lib/internal/bootstrap/pre_execution.js
+++ b/lib/internal/bootstrap/pre_execution.js
@@ -3,6 +3,7 @@
 const {
   NumberParseInt,
   ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
   SafeMap,
   SafeWeakMap,
   StringPrototypeStartsWith,
@@ -170,8 +171,15 @@ function setupWebCrypto() {
     return;
   }
 
-  const webcrypto = require('internal/crypto/webcrypto');
-  defineOperation(globalThis, 'crypto', webcrypto.crypto);
+  let crypto;
+  ObjectDefineProperty(globalThis, 'crypto',
+                       ObjectGetOwnPropertyDescriptor({
+                         get crypto() {
+                           crypto ??= require('internal/crypto/webcrypto').crypto;
+                           return crypto;
+                         }
+                       }, 'crypto'));
+
 }
 
 // Setup User-facing NODE_V8_COVERAGE environment variable that writes

From 643bd8a545c55c4481c5bc68ee7141f833f57db7 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sat, 12 Feb 2022 15:26:35 +0100
Subject: [PATCH 4/7] fixup! fix error when node is compiled without OpenSSL

---
 test/common/index.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/common/index.js b/test/common/index.js
index 30481fb783537c..e2407fe4e052b4 100644
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -308,7 +308,7 @@ if (global.fetch) {
     global.Headers,
   );
 }
-if (global.crypto) {
+if (hasCrypto && global.crypto) {
   knownGlobals.push(global.crypto);
 }
 

From aa84cfcdedec04c278e48bf2eaa6b12a9f86c35a Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 13 Feb 2022 12:11:54 +0100
Subject: [PATCH 5/7] expose other webcrypto interfaces

---
 .eslintrc.js                                  |  3 ++
 doc/api/globals.md                            | 39 +++++++++++++++++++
 lib/.eslintrc.yaml                            |  6 +++
 lib/internal/bootstrap/pre_execution.js       | 13 +++++--
 lib/internal/crypto/webcrypto.js              |  1 +
 test/common/index.js                          |  3 ++
 .../parallel/test-global-webcrypto-classes.js | 13 +++++++
 test/parallel/test-global-webcrypto.js        |  2 +
 8 files changed, 76 insertions(+), 4 deletions(-)
 create mode 100644 test/parallel/test-global-webcrypto-classes.js

diff --git a/.eslintrc.js b/.eslintrc.js
index d9ec6f709de542..297044ad8a8833 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -341,5 +341,8 @@ module.exports = {
     Request: 'readable',
     Response: 'readable',
     crypto: 'readable',
+    Crypto: 'writable',
+    CryptoKey: 'writable',
+    SubtleCrypto: 'writable',
   },
 };
diff --git a/doc/api/globals.md b/doc/api/globals.md
index d5134cadc08806..f4ea4fb474724f 100644
--- a/doc/api/globals.md
+++ b/doc/api/globals.md
@@ -307,6 +307,19 @@ added: v0.1.100
 
 Used to print to stdout and stderr. See the [`console`][] section.
 
+## `Crypto`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental. Enable this API with the
+> [`--experimental-global-webcrypto`][] CLI flag.
+
+A browser-compatible implementation of {Crypto}. This global is available
+only if the Node.js binary was compiled with including support for the
+`crypto` module.
+
 ## `crypto`
 
 <!-- YAML
@@ -318,6 +331,19 @@ added: REPLACEME
 
 A browser-compatible implementation of the [Web Crypto API][].
 
+## `CryptoKey`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental. Enable this API with the
+> [`--experimental-global-webcrypto`][] CLI flag.
+
+A browser-compatible implementation of {CryptoKey}. This global is available
+only if the Node.js binary was compiled with including support for the
+`crypto` module.
+
 ## `Event`
 
 <!-- YAML
@@ -545,6 +571,19 @@ added: v17.0.0
 
 The WHATWG [`structuredClone`][] method.
 
+## `SubtleCrypto`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental. Enable this API with the
+> [`--experimental-global-webcrypto`][] CLI flag.
+
+A browser-compatible implementation of {SubtleCrypto}. This global is available
+only if the Node.js binary was compiled with including support for the
+`crypto` module.
+
 ## `DOMException`
 
 <!-- YAML
diff --git a/lib/.eslintrc.yaml b/lib/.eslintrc.yaml
index e9b7924618975b..709c5f4c93e1e3 100644
--- a/lib/.eslintrc.yaml
+++ b/lib/.eslintrc.yaml
@@ -81,6 +81,10 @@ rules:
       message: "Use `const { btoa } = require('buffer');` instead of the global."
     - name: crypto
       message: "Use `const { crypto } = require('internal/crypto/webcrypto');` instead of the global."
+    - name: Crypto
+      message: "Use `const { Crypto } = require('internal/crypto/webcrypto');` instead of the global."
+    - name: CryptoKey
+      message: "Use `const { CryptoKey } = require('internal/crypto/webcrypto');` instead of the global."
     - name: global
       message: "Use `const { globalThis } = primordials;` instead of `global`."
     - name: globalThis
@@ -91,6 +95,8 @@ rules:
       message: "Use `const { queueMicrotask } = require('internal/process/task_queues');` instead of the global."
     - name: structuredClone
       message: "Use `const { structuredClone } = require('internal/structured_clone');` instead of the global."
+    - name: SubtleCrypto
+      message: "Use `const { SubtleCrypto } = require('internal/crypto/webcrypto');` instead of the global."
   # Custom rules in tools/eslint-rules
   node-core/lowercase-name-for-primitive: error
   node-core/non-ascii-character: error
diff --git a/lib/internal/bootstrap/pre_execution.js b/lib/internal/bootstrap/pre_execution.js
index ca74d4231e513d..ca7063ac90d87d 100644
--- a/lib/internal/bootstrap/pre_execution.js
+++ b/lib/internal/bootstrap/pre_execution.js
@@ -171,15 +171,20 @@ function setupWebCrypto() {
     return;
   }
 
-  let crypto;
+  let webcrypto;
   ObjectDefineProperty(globalThis, 'crypto',
                        ObjectGetOwnPropertyDescriptor({
                          get crypto() {
-                           crypto ??= require('internal/crypto/webcrypto').crypto;
-                           return crypto;
+                           webcrypto ??= require('internal/crypto/webcrypto');
+                           return webcrypto.crypto;
                          }
                        }, 'crypto'));
-
+  if (internalBinding('config').hasOpenSSL) {
+    webcrypto ??= require('internal/crypto/webcrypto');
+    exposeInterface(globalThis, 'Crypto', webcrypto.Crypto);
+    exposeInterface(globalThis, 'CryptoKey', webcrypto.CryptoKey);
+    exposeInterface(globalThis, 'SubtleCrypto', webcrypto.SubtleCrypto);
+  }
 }
 
 // Setup User-facing NODE_V8_COVERAGE environment variable that writes
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index 72499d27ab854a..7429a03284eae7 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -811,6 +811,7 @@ ObjectDefineProperties(
 
 module.exports = {
   Crypto,
+  CryptoKey,
   SubtleCrypto,
   crypto,
 };
diff --git a/test/common/index.js b/test/common/index.js
index e2407fe4e052b4..46a59b54d52459 100644
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -310,6 +310,9 @@ if (global.fetch) {
 }
 if (hasCrypto && global.crypto) {
   knownGlobals.push(global.crypto);
+  knownGlobals.push(global.Crypto);
+  knownGlobals.push(global.CryptoKey);
+  knownGlobals.push(global.SubtleCrypto);
 }
 
 function allowGlobals(...allowlist) {
diff --git a/test/parallel/test-global-webcrypto-classes.js b/test/parallel/test-global-webcrypto-classes.js
new file mode 100644
index 00000000000000..083592bd92278c
--- /dev/null
+++ b/test/parallel/test-global-webcrypto-classes.js
@@ -0,0 +1,13 @@
+// Flags: --experimental-global-webcrypto --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const webcrypto = require('internal/crypto/webcrypto');
+
+assert.strictEqual(Crypto, webcrypto.Crypto);
+assert.strictEqual(CryptoKey, webcrypto.CryptoKey);
+assert.strictEqual(SubtleCrypto, webcrypto.SubtleCrypto);
diff --git a/test/parallel/test-global-webcrypto.js b/test/parallel/test-global-webcrypto.js
index 6319700cd23768..70f84a1b3a0643 100644
--- a/test/parallel/test-global-webcrypto.js
+++ b/test/parallel/test-global-webcrypto.js
@@ -9,3 +9,5 @@ const assert = require('assert');
 const crypto = require('crypto');
 
 assert.strictEqual(globalThis.crypto, crypto.webcrypto);
+assert.strictEqual(Crypto, crypto.webcrypto.constructor);
+assert.strictEqual(SubtleCrypto, crypto.webcrypto.subtle.constructor);

From abebfdf69b5ce243597b4f72be301c544c3aa440 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 13 Feb 2022 12:26:54 +0100
Subject: [PATCH 6/7] fixup! expose other webcrypto interfaces

---
 .eslintrc.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.eslintrc.js b/.eslintrc.js
index 297044ad8a8833..c7c7cc56051b1c 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -341,8 +341,8 @@ module.exports = {
     Request: 'readable',
     Response: 'readable',
     crypto: 'readable',
-    Crypto: 'writable',
-    CryptoKey: 'writable',
-    SubtleCrypto: 'writable',
+    Crypto: 'readable',
+    CryptoKey: 'readable',
+    SubtleCrypto: 'readable',
   },
 };

From 3f7d902b3723ee953725034028e22bbb625e0c91 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 13 Feb 2022 21:27:19 +0100
Subject: [PATCH 7/7] lint

---
 doc/api/crypto.md | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index d2e7d3924ae01a..e5b83eb4ff5dd0 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -41,14 +41,14 @@ calling `require('crypto')` will result in an error being thrown.
 
 When using CommonJS, the error thrown can be caught using try/catch:
 
+<!-- eslint-skip -->
+
 ```cjs
-{
-  let crypto;
-  try {
-    crypto = require('crypto');
-  } catch (err) {
-    console.log('crypto support is disabled!');
-  }
+let crypto;
+try {
+  crypto = require('crypto');
+} catch (err) {
+  console.log('crypto support is disabled!');
 }
 ```