quic: remove CryptoKey support from session keys option

panva · aduh95 · commit 3ef0a5b90efa · 2026-03-30T17:20:29.000+02:00
PR-URL: #62335 Refs: #55293 Refs: #62321 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
diff --git a/doc/api/quic.md b/doc/api/quic.md
@@ -1197,9 +1197,13 @@ True to enable TLS keylogging output.
 
 <!-- YAML
 added: v23.8.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/62335
+    description: CryptoKey is no longer accepted.
 -->
 
-* Type: {KeyObject|CryptoKey|KeyObject\[]|CryptoKey\[]}
+* Type: {KeyObject|KeyObject\[]}
 
 The TLS crypto keys to use for sessions.
 
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
@@ -98,7 +98,6 @@ const {
 
 const {
   isKeyObject,
-  isCryptoKey,
 } = require('internal/crypto/keys');
 
 const {
@@ -143,7 +142,6 @@ const {
   kVersionNegotiation,
   kInspect,
   kKeyObjectHandle,
-  kKeyObjectInner,
   kWantsHeaders,
   kWantsTrailers,
 } = require('internal/quic/symbols');
@@ -187,7 +185,6 @@ const onSessionHandshakeChannel = dc.channel('quic.session.handshake');
 /**
  * @typedef {import('../socketaddress.js').SocketAddress} SocketAddress
  * @typedef {import('../crypto/keys.js').KeyObject} KeyObject
- * @typedef {import('../crypto/keys.js').CryptoKey} CryptoKey
  */
 
 /**
@@ -260,7 +257,7 @@ const onSessionHandshakeChannel = dc.channel('quic.session.handshake');
  * @property {boolean} [verifyClient] Verify the client
  * @property {boolean} [tlsTrace] Enable TLS tracing
  * @property {boolean} [verifyPrivateKey] Verify the private key
- * @property {KeyObject|CryptoKey|Array<KeyObject|CryptoKey>} [keys] The keys
+ * @property {KeyObject|KeyObject[]} [keys] The keys
  * @property {ArrayBuffer|ArrayBufferView|Array<ArrayBuffer|ArrayBufferView>} [certs] The certificates
  * @property {ArrayBuffer|ArrayBufferView|Array<ArrayBuffer|ArrayBufferView>} [ca] The certificate authority
  * @property {ArrayBuffer|ArrayBufferView|Array<ArrayBuffer|ArrayBufferView>} [crl] The certificate revocation list
@@ -2171,13 +2168,8 @@ function processTlsOptions(tls, forServer) {
           throw new ERR_INVALID_ARG_VALUE('options.keys', key, 'must be a private key');
         }
         ArrayPrototypePush(keyHandles, key[kKeyObjectHandle]);
-      } else if (isCryptoKey(key)) {
-        if (key.type !== 'private') {
-          throw new ERR_INVALID_ARG_VALUE('options.keys', key, 'must be a private key');
-        }
-        ArrayPrototypePush(keyHandles, key[kKeyObjectInner][kKeyObjectHandle]);
       } else {
-        throw new ERR_INVALID_ARG_TYPE('options.keys', ['KeyObject', 'CryptoKey'], key);
+        throw new ERR_INVALID_ARG_TYPE('options.keys', 'KeyObject', key);
       }
     }
   }
diff --git a/lib/internal/quic/symbols.js b/lib/internal/quic/symbols.js
@@ -18,7 +18,6 @@ const {
 
 const {
   kHandle: kKeyObjectHandle,
-  kKeyObject: kKeyObjectInner,
 } = require('internal/crypto/util');
 
 // Symbols used to hide various private properties and methods from the
@@ -61,7 +60,6 @@ module.exports = {
   kHeaders,
   kInspect,
   kKeyObjectHandle,
-  kKeyObjectInner,
   kListen,
   kNewSession,
   kNewStream,
