@0xpolygonid/js-sdk 1.7.5 → 1.8.0

package/dist/node/esm/iden3comm/handlers/auth.js

@@ -5,6 +5,41 @@ import { proving } from '@iden3/js-jwz';
 import * as uuid from 'uuid';
 import { byteDecoder, byteEncoder, mergeObjects } from '../../utils';
 import { getRandomBytes } from '@iden3/js-crypto';
+/**
+ *  createAuthorizationRequest is a function to create protocol authorization request
+ * @param {string} reason - reason to request proof
+ * @param {string} sender - sender did
+ * @param {string} callbackUrl - callback that user should use to send response
+ * @returns `Promise<AuthorizationRequestMessage>`
+ */
+export function createAuthorizationRequest(reason, sender, callbackUrl) {
+    return createAuthorizationRequestWithMessage(reason, '', sender, callbackUrl);
+}
+/**
+ *  createAuthorizationRequestWithMessage is a function to create protocol authorization request with explicit message to sign
+ * @param {string} reason - reason to request proof
+ * @param {string} message - message to sign in the response
+ * @param {string} sender - sender did
+ * @param {string} callbackUrl - callback that user should use to send response
+ * @returns `Promise<AuthorizationRequestMessage>`
+ */
+export function createAuthorizationRequestWithMessage(reason, message, sender, callbackUrl) {
+    const uuidv4 = uuid.v4();
+    const request = {
+        id: uuidv4,
+        thid: uuidv4,
+        from: sender,
+        typ: MediaType.PlainMessage,
+        type: PROTOCOL_MESSAGE_TYPE.AUTHORIZATION_REQUEST_MESSAGE_TYPE,
+        body: {
+            reason: reason,
+            message: message,
+            callbackUrl: callbackUrl,
+            scope: []
+        }
+    };
+    return request;
+}
 /**
  *
  * Allows to process AuthorizationRequest protocol message and produce JWZ response.
@@ -26,10 +61,7 @@ export class AuthHandler {
         this._proofService = _proofService;
     }
     /**
-     * unpacks authorization request
-     * @public
-     * @param {Uint8Array} request - raw byte message
-     * @returns `Promise<AuthorizationRequestMessage>`
+     * @inheritdoc IAuthHandler#parseAuthorizationRequest
      */
     async parseAuthorizationRequest(request) {
         const { unpackedMessage: message } = await this._packerMgr.unpack(request);
@@ -40,15 +72,7 @@ export class AuthHandler {
         return authRequest;
     }
     /**
-     * unpacks authorization request and packs authorization response
-     * @public
-     * @param {did} did  - sender DID
-     * @param {Uint8Array} request - raw byte message
-     * @returns `Promise<{
-      token: string;
-      authRequest: AuthorizationRequestMessage;
-      authResponse: AuthorizationResponseMessage;
-    }>`
+     * @inheritdoc IAuthHandler#handleAuthorizationRequest
      */
     async handleAuthorizationRequest(did, request, opts) {
         const authRequest = await this.parseAuthorizationRequest(request);
@@ -145,4 +169,83 @@ export class AuthHandler {
         }));
         return { authRequest, authResponse, token };
     }
+    /**
+     * @inheritdoc IAuthHandler#handleAuthorizationResponse
+     */
+    async handleAuthorizationResponse(response, request, opts) {
+        if ((request.body.message ?? '') !== (response.body.message ?? '')) {
+            throw new Error('message for signing from request is not presented in response');
+        }
+        if (request.from !== response.to) {
+            throw new Error(`sender of the request is not a target of response - expected ${request.from}, given ${response.to}`);
+        }
+        this.verifyAuthRequest(request);
+        const requestScope = request.body.scope;
+        if (!response.from) {
+            throw new Error(`proof response doesn't contain from field`);
+        }
+        const groupIdToLinkIdMap = new Map();
+        // group requests by query group id
+        for (const proofRequest of requestScope) {
+            const groupId = proofRequest.query.groupId;
+            const proofResp = response.body.scope.find((resp) => resp.id === proofRequest.id);
+            if (!proofResp) {
+                throw new Error(`proof is not given for requestId ${proofRequest.id}`);
+            }
+            const circuitId = proofResp.circuitId;
+            if (circuitId !== proofRequest.circuitId) {
+                throw new Error(`proof is not given for requested circuit expected: ${proofRequest.circuitId}, given ${circuitId}`);
+            }
+            const params = proofRequest.params ?? {};
+            params.verifierDid = DID.parse(request.from);
+            const { linkID } = await this._proofService.verifyZKPResponse(proofResp, {
+                query: proofRequest.query,
+                sender: response.from,
+                params,
+                opts
+            });
+            // write linkId to the proof response
+            // const pubSig = pubSignals as unknown as { linkID?: number };
+            if (linkID && groupId) {
+                groupIdToLinkIdMap.set(groupId, [
+                    ...(groupIdToLinkIdMap.get(groupId) ?? []),
+                    { linkID: linkID, requestId: proofResp.id }
+                ]);
+            }
+        }
+        // verify grouping links
+        for (const [groupId, metas] of groupIdToLinkIdMap.entries()) {
+            // check that all linkIds are the same
+            if (metas.some((meta) => meta.linkID !== metas[0].linkID)) {
+                throw new Error(`Link id validation failed for group ${groupId}, request linkID to requestIds info: ${JSON.stringify(metas)}`);
+            }
+        }
+        return { request, response };
+    }
+    verifyAuthRequest(request) {
+        const groupIdValidationMap = {};
+        const requestScope = request.body.scope;
+        for (const proofRequest of requestScope) {
+            const groupId = proofRequest.query.groupId;
+            if (groupId) {
+                const existingRequests = groupIdValidationMap[groupId] ?? [];
+                //validate that all requests in the group have the same schema, issuer and circuit
+                for (const existingRequest of existingRequests) {
+                    if (existingRequest.query.type !== proofRequest.query.type) {
+                        throw new Error(`all requests in the group should have the same type`);
+                    }
+                    if (existingRequest.query.context !== proofRequest.query.context) {
+                        throw new Error(`all requests in the group should have the same context`);
+                    }
+                    const allowedIssuers = proofRequest.query.allowedIssuers;
+                    const existingRequestAllowedIssuers = existingRequest.query.allowedIssuers;
+                    if (!(allowedIssuers.includes('*') ||
+                        allowedIssuers.every((issuer) => existingRequestAllowedIssuers.includes(issuer)))) {
+                        throw new Error(`all requests in the group should have the same issuer`);
+                    }
+                }
+                groupIdValidationMap[groupId] = [...(groupIdValidationMap[groupId] ?? []), proofRequest];
+            }
+        }
+    }
 }

package/dist/node/esm/kms/key-providers/sec256k1-provider.js

@@ -24,8 +24,11 @@ export class Sec256k1Provider {
      * @param {Uint8Array} seed - byte array seed
      * @returns kms key identifier
      */
-    async newPrivateKeyFromSeed() {
-        const keyPair = this._ec.genKeyPair();
+    async newPrivateKeyFromSeed(seed) {
+        if (seed.length !== 32) {
+            throw new Error('Seed should be 32 bytes');
+        }
+        const keyPair = this._ec.keyFromPrivate(seed);
         const kmsId = {
             type: this.keyType,
             id: providerHelpers.keyPath(this.keyType, keyPair.getPublic().encode('hex', false))

package/dist/node/esm/proof/common.js

@@ -1,8 +1,7 @@
 import { Hash, Proof, ZERO_HASH } from '@iden3/js-merkletree';
 import { buildTreeState, isValidOperation, QueryOperators } from '../circuits';
-import { buildFieldPath } from '../verifiable';
+import { buildFieldPath, getSerializationAttrFromContext, getFieldSlotIndex } from '../verifiable';
 import { Merklizer, Path } from '@iden3/js-jsonld-merklization';
-import { Parser } from '../schema-processor/json';
 import { byteEncoder } from '../utils';
 import { poseidon } from '@iden3/js-crypto';
 /**
@@ -60,7 +59,7 @@ export const toGISTProof = (smtProof) => {
 export const parseCredentialSubject = (credentialSubject) => {
     // credentialSubject is empty
     if (!credentialSubject) {
-        return [{ operator: QueryOperators.$eq, fieldName: '' }];
+        return [{ operator: QueryOperators.$noop, fieldName: '' }];
     }
     const queries = [];
     const entries = Object.entries(credentialSubject);
@@ -95,7 +94,7 @@ export const parseQueryMetadata = async (propertyQuery, ldContextJSON, credentia
         values: [],
         path: new Path()
     };
-    const serAttr = await Parser.getSerializationAttrFromContext(JSON.parse(ldContextJSON), options, credentialType);
+    const serAttr = await getSerializationAttrFromContext(JSON.parse(ldContextJSON), options, credentialType);
     if (!serAttr) {
         query.merklizedSchema = true;
     }
@@ -103,7 +102,7 @@ export const parseQueryMetadata = async (propertyQuery, ldContextJSON, credentia
     // and not a position of merklization root.
     // it has no influence on check in the off-chain circuits, but it aligns with onchain verification standard
     if (!query.merklizedSchema) {
-        query.slotIndex = await Parser.getFieldSlotIndex(propertyQuery.fieldName, credentialType, byteEncoder.encode(ldContextJSON));
+        query.slotIndex = await getFieldSlotIndex(propertyQuery.fieldName, credentialType, byteEncoder.encode(ldContextJSON));
     }
     else {
         try {

package/dist/node/esm/proof/index.js

@@ -1,3 +1,4 @@
 export * from './proof-service';
-export * from './prover';
+export * from './provers';
 export * from './common';
+export * from './verifiers';

package/dist/node/esm/proof/proof-service.js

@@ -4,11 +4,12 @@ import { Hash } from '@iden3/js-merkletree';
 import { AuthV2Inputs, CircuitId, Operators, Query, StateTransitionInputs, ValueProof } from '../circuits';
 import { createVerifiablePresentation } from '../verifiable';
 import { parseCredentialSubject, parseQueryMetadata, toGISTProof, transformQueryValueToBigInts } from './common';
-import { NativeProver } from './prover';
+import { NativeProver } from './provers/prover';
 import { getDocumentLoader } from '@iden3/js-jsonld-merklization';
 import { cacheLoader } from '../schema-processor';
 import { byteDecoder, byteEncoder } from '../utils/encoding';
-import { InputGenerator } from './inputs-generator';
+import { InputGenerator } from './provers/inputs-generator';
+import { PubSignalsVerifier } from './verifiers/pub-signals-verifier';
 /**
  * Proof service is an implementation of IProofService
  * that works with a native groth16 prover
@@ -32,11 +33,30 @@ export class ProofService {
         this._prover = opts?.prover ?? new NativeProver(_circuitStorage);
         this._ldOptions = { ...opts, documentLoader: opts?.documentLoader ?? cacheLoader(opts) };
         this._inputsGenerator = new InputGenerator(_identityWallet, _credentialWallet, _stateStorage);
+        this._pubSignalsVerifier = new PubSignalsVerifier(opts?.documentLoader ?? cacheLoader(opts), _stateStorage);
     }
     /** {@inheritdoc IProofService.verifyProof} */
     async verifyProof(zkp, circuitId) {
         return this._prover.verify(zkp, circuitId);
     }
+    /** {@inheritdoc IProofService.verify} */
+    async verifyZKPResponse(proofResp, opts) {
+        const proofValid = await this._prover.verify(proofResp, proofResp.circuitId);
+        if (!proofValid) {
+            throw Error(`Proof with circuit id ${proofResp.circuitId} and request id ${proofResp.id} is not valid`);
+        }
+        const verifyContext = {
+            pubSignals: proofResp.pub_signals,
+            query: opts.query,
+            verifiablePresentation: proofResp.vp,
+            sender: opts.sender,
+            challenge: BigInt(proofResp.id),
+            opts: opts.opts,
+            params: opts.params
+        };
+        const pubSignals = await this._pubSignalsVerifier.verify(proofResp.circuitId, verifyContext);
+        return { linkID: pubSignals.linkID };
+    }
     /** {@inheritdoc IProofService.generateProof} */
     async generateProof(proofReq, identifier, opts) {
         if (!opts) {

package/dist/node/esm/proof/provers/index.js

@@ -0,0 +1,3 @@
+export * from './inputs-generator';
+export * from './prover';
+export * from './witness_calculator';

package/dist/node/esm/proof/{inputs-generator.js → provers/inputs-generator.js}

@@ -1,18 +1,28 @@
 import { DID, Id, getUnixTimestamp } from '@iden3/js-iden3-core';
-import { ProofType } from '../verifiable';
-import { AtomicQueryMTPV2Inputs, AtomicQueryMTPV2OnChainInputs, AtomicQuerySigV2Inputs, AtomicQuerySigV2OnChainInputs, AtomicQueryV3Inputs, AtomicQueryV3OnChainInputs, CircuitClaim, CircuitId, LinkedMultiQueryInputs, Operators } from '../circuits';
-import { toClaimNonRevStatus, toGISTProof } from './common';
-import { getUserDIDFromCredential } from '../credentials';
-const circuitValidator = {
-    [CircuitId.AtomicQueryMTPV2]: { maxQueriesCount: 1 },
-    [CircuitId.AtomicQueryMTPV2OnChain]: { maxQueriesCount: 1 },
-    [CircuitId.AtomicQuerySigV2]: { maxQueriesCount: 1 },
-    [CircuitId.AtomicQuerySigV2OnChain]: { maxQueriesCount: 1 },
-    [CircuitId.AtomicQueryV3]: { maxQueriesCount: 1 },
-    [CircuitId.AtomicQueryV3OnChain]: { maxQueriesCount: 1 },
-    [CircuitId.AuthV2]: { maxQueriesCount: 0 },
-    [CircuitId.StateTransition]: { maxQueriesCount: 0 },
-    [CircuitId.LinkedMultiQuery10]: { maxQueriesCount: LinkedMultiQueryInputs.queryCount }
+import { ProofType } from '../../verifiable';
+import { AtomicQueryMTPV2Inputs, AtomicQueryMTPV2OnChainInputs, AtomicQuerySigV2Inputs, AtomicQuerySigV2OnChainInputs, AtomicQueryV3Inputs, AtomicQueryV3OnChainInputs, CircuitClaim, CircuitId, defaultValueArraySize, LinkedMultiQueryInputs, Operators, QueryOperators } from '../../circuits';
+import { toClaimNonRevStatus, toGISTProof } from '../common';
+import { getUserDIDFromCredential } from '../../credentials';
+const allOperations = Object.values(QueryOperators);
+const v2Operations = [
+    Operators.NOOP,
+    Operators.EQ,
+    Operators.LT,
+    Operators.GT,
+    Operators.IN,
+    Operators.NIN,
+    Operators.NE
+];
+export const circuitValidator = {
+    [CircuitId.AtomicQueryMTPV2]: { maxQueriesCount: 1, supportedOperations: v2Operations },
+    [CircuitId.AtomicQueryMTPV2OnChain]: { maxQueriesCount: 1, supportedOperations: v2Operations },
+    [CircuitId.AtomicQuerySigV2]: { maxQueriesCount: 1, supportedOperations: v2Operations },
+    [CircuitId.AtomicQuerySigV2OnChain]: { maxQueriesCount: 1, supportedOperations: v2Operations },
+    [CircuitId.AtomicQueryV3]: { maxQueriesCount: 1, supportedOperations: allOperations },
+    [CircuitId.AtomicQueryV3OnChain]: { maxQueriesCount: 1, supportedOperations: allOperations },
+    [CircuitId.AuthV2]: { maxQueriesCount: 0, supportedOperations: [] },
+    [CircuitId.StateTransition]: { maxQueriesCount: 0, supportedOperations: [] },
+    [CircuitId.LinkedMultiQuery10]: { maxQueriesCount: 10, supportedOperations: allOperations }
 };
 export class InputGenerator {
     constructor(_identityWallet, _credentialWallet, _stateStorage) {
@@ -26,7 +36,7 @@ export class InputGenerator {
             circuitInputs.id = DID.idFromDID(identifier);
             circuitInputs.requestID = BigInt(proofReq.id);
             const query = circuitQueries[0];
-            query.operator = query.operator === Operators.SD ? Operators.EQ : query.operator;
+            query.operator = this.transformV2QueryOperator(query.operator);
             circuitInputs.query = query;
             circuitInputs.claim = {
                 issuerID: circuitClaimData.issuerId,
@@ -73,7 +83,7 @@ export class InputGenerator {
             circuitInputs.signature = signature;
             circuitInputs.challenge = params.challenge;
             const query = circuitQueries[0];
-            query.operator = query.operator === Operators.SD ? Operators.EQ : query.operator;
+            query.operator = this.transformV2QueryOperator(query.operator);
             circuitInputs.query = query;
             circuitInputs.claim = {
                 issuerID: circuitClaimData.issuerId,
@@ -103,7 +113,7 @@ export class InputGenerator {
             circuitInputs.profileNonce = BigInt(params.authProfileNonce);
             circuitInputs.skipClaimRevocationCheck = params.skipRevocation;
             const query = circuitQueries[0];
-            query.operator = query.operator === Operators.SD ? Operators.EQ : query.operator;
+            query.operator = this.transformV2QueryOperator(query.operator);
             circuitInputs.query = query;
             circuitInputs.currentTimeStamp = getUnixTimestamp(new Date());
             return circuitInputs.inputsMarshal();
@@ -130,7 +140,7 @@ export class InputGenerator {
             circuitInputs.profileNonce = BigInt(params.authProfileNonce);
             circuitInputs.skipClaimRevocationCheck = params.skipRevocation;
             const query = circuitQueries[0];
-            query.operator = query.operator === Operators.SD ? Operators.EQ : query.operator;
+            query.operator = this.transformV2QueryOperator(query.operator);
             circuitInputs.query = query;
             circuitInputs.currentTimeStamp = getUnixTimestamp(new Date());
             if (authClaimData.treeState) {
@@ -192,7 +202,10 @@ export class InputGenerator {
             circuitInputs.profileNonce = BigInt(params.authProfileNonce);
             circuitInputs.skipClaimRevocationCheck = params.skipRevocation;
             const query = circuitQueries[0];
-            query.values = query.operator === Operators.SD ? new Array(64).fill(0) : query.values;
+            query.values =
+                query.operator === Operators.SD || query.operator === Operators.NOOP
+                    ? new Array(defaultValueArraySize).fill(0)
+                    : query.values;
             circuitInputs.query = query;
             circuitInputs.currentTimeStamp = getUnixTimestamp(new Date());
             circuitInputs.proofType = proofType;
@@ -240,7 +253,10 @@ export class InputGenerator {
             circuitInputs.profileNonce = BigInt(params.authProfileNonce);
             circuitInputs.skipClaimRevocationCheck = params.skipRevocation;
             const query = circuitQueries[0];
-            query.values = query.operator === Operators.SD ? new Array(64).fill(0) : query.values;
+            query.values =
+                query.operator === Operators.SD || query.operator === Operators.NOOP
+                    ? new Array(defaultValueArraySize).fill(0)
+                    : query.values;
             circuitInputs.query = query;
             circuitInputs.currentTimeStamp = getUnixTimestamp(new Date());
             circuitInputs.proofType = proofType;
@@ -370,4 +386,7 @@ export class InputGenerator {
             coreClaim: authCoreClaim
         };
     }
+    transformV2QueryOperator(operator) {
+        return operator === Operators.SD || operator === Operators.NOOP ? Operators.EQ : operator;
+    }
 }

package/dist/node/esm/proof/{prover.js → provers/prover.js}

@@ -1,7 +1,7 @@
 import { witnessBuilder } from './witness_calculator';
-import { byteDecoder } from '../utils';
 import { groth16 } from 'snarkjs';
 import { getCurveFromName } from 'ffjavascript';
+import { byteDecoder } from '../../utils';
 /**
  *  NativeProver service responsible for zk generation and verification of groth16 algorithm with bn128 curve
  * @public

package/dist/node/esm/proof/verifiers/index.js

@@ -0,0 +1,2 @@
+export * from './pub-signals-verifier';
+export * from './query';