@1shotapi/ows-signer 0.2.0

package/src/hex.js

@@ -0,0 +1,68 @@
+/**
+ * @param {string} hex - with or without `0x` prefix
+ * @returns {Uint8Array}
+ */
+export function hexToBytes(hex) {
+  if (hex.startsWith("0x") || hex.startsWith("0X")) {
+    hex = hex.slice(2);
+  }
+  const out = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return out;
+}
+
+/**
+ * @param {unknown} value
+ * @param {number} [expectedBytes]
+ * @returns {Uint8Array}
+ */
+export function parse0xHex(value, expectedBytes) {
+  if (typeof value !== "string" || !value.startsWith("0x")) {
+    throw new Error("Expected 0x-prefixed hex string");
+  }
+  const hex = value.slice(2);
+  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {
+    throw new Error("Invalid hex string");
+  }
+  const bytes = hexToBytes(hex);
+  if (expectedBytes !== undefined && bytes.length !== expectedBytes) {
+    throw new Error(`Expected ${expectedBytes} bytes, got ${bytes.length}`);
+  }
+  return bytes;
+}
+
+/**
+ * @param {Uint8Array} bytes
+ * @returns {`0x${string}`}
+ */
+export function to0xHex(bytes) {
+  return `0x${Array.from(bytes)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("")}`;
+}
+
+/**
+ * @param {ArrayBuffer | Uint8Array} buffer
+ * @returns {string}
+ */
+export function bufferToBase64Url(buffer) {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+/**
+ * @param {string} value
+ * @returns {Uint8Array}
+ */
+export function base64UrlToBytes(value) {
+  const pad = "=".repeat((4 - (value.length % 4)) % 4);
+  const b64 = value.replace(/-/g, "+").replace(/_/g, "/") + pad;
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}

package/src/main.js

@@ -0,0 +1,40 @@
+import { handleRequest } from "./handlers.js";
+import {
+  isValidNesting,
+  setTrustedParentOrigin,
+} from "./state.js";
+import { initUi } from "./ui.js";
+import { isValidParentMessage, parseRequest } from "./rpc.js";
+
+function bootstrap() {
+  const root = document.getElementById("ows-signer-root");
+  if (!root) {
+    throw new Error("OWS signer root element missing");
+  }
+  initUi(root);
+
+  if (!isValidNesting()) {
+    console.error("[ows-signer] Must be embedded in a wallet iframe (double iframe).");
+    return;
+  }
+
+  window.addEventListener("message", async (event) => {
+    if (!isValidParentMessage(event)) return;
+    if (!parseRequest(event.data)) return;
+
+    setTrustedParentOrigin(event.origin);
+    const targetOrigin = event.origin;
+    const { method, correlationId, params = {} } = /** @type {{ method: string, correlationId?: string, params?: Record<string, unknown> }} */ (
+      event.data
+    );
+
+    await handleRequest(
+      method,
+      /** @type {Record<string, unknown>} */ (params),
+      correlationId,
+      targetOrigin,
+    );
+  });
+}
+
+bootstrap();

package/src/rpc.js

@@ -0,0 +1,48 @@
+/**
+ * @typedef {(event: string, correlationId: string | undefined, data: Record<string, unknown>) => void} EmitFn
+ */
+
+/**
+ * @param {Window} target
+ * @param {string} targetOrigin
+ * @param {string} event
+ * @param {string | undefined} correlationId
+ * @param {Record<string, unknown>} data
+ */
+export function emitEvent(target, targetOrigin, event, correlationId, data) {
+  target.postMessage(
+    {
+      v: 1,
+      kind: "event",
+      event,
+      correlationId,
+      data,
+    },
+    targetOrigin,
+  );
+}
+
+/**
+ * @param {MessageEvent} event
+ * @returns {boolean}
+ */
+export function isValidParentMessage(event) {
+  if (event.source !== window.parent) return false;
+  if (window.parent === window.top) return false;
+  if (event.source === window) return false;
+  return true;
+}
+
+/**
+ * @param {unknown} data
+ * @returns {data is { v: number, kind: 'request', method: string, correlationId?: string, params?: Record<string, unknown> }}
+ */
+export function parseRequest(data) {
+  if (!data || typeof data !== "object") return false;
+  const msg = /** @type {Record<string, unknown>} */ (data);
+  return (
+    msg.v === 1 &&
+    msg.kind === "request" &&
+    typeof msg.method === "string"
+  );
+}

package/src/state.js

@@ -0,0 +1,96 @@
+/** @type {Uint8Array | null} */
+let recoveryPrivateKey = null;
+
+/** @type {Promise<unknown> | null} */
+let ceremonyPromise = null;
+
+/** @type {string | null} */
+let trustedParentOrigin = null;
+
+/**
+ * @returns {boolean}
+ */
+export function isValidNesting() {
+  try {
+    return window.parent !== window && window.parent !== window.top;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @returns {string}
+ */
+export function getRpId() {
+  return window.location.hostname;
+}
+
+/**
+ * @param {string} origin
+ */
+export function setTrustedParentOrigin(origin) {
+  if (trustedParentOrigin === null) {
+    trustedParentOrigin = origin;
+  }
+}
+
+/**
+ * @returns {string | null}
+ */
+export function getTrustedParentOrigin() {
+  return trustedParentOrigin;
+}
+
+/**
+ * @returns {boolean}
+ */
+export function hasRecoverySession() {
+  return recoveryPrivateKey !== null;
+}
+
+/**
+ * @returns {Uint8Array | null}
+ */
+export function getRecoveryPrivateKey() {
+  return recoveryPrivateKey;
+}
+
+/**
+ * @param {Uint8Array} key
+ */
+export function setRecoveryPrivateKey(key) {
+  clearRecoveryPrivateKey();
+  recoveryPrivateKey = key;
+}
+
+export function clearRecoveryPrivateKey() {
+  if (recoveryPrivateKey) {
+    recoveryPrivateKey.fill(0);
+    recoveryPrivateKey = null;
+  }
+}
+
+/**
+ * @param {() => Promise<T>} fn
+ * @returns {Promise<T>}
+ * @template T
+ */
+export async function withCeremony(fn) {
+  if (ceremonyPromise) {
+    throw new Error("ceremonyInProgress");
+  }
+  const promise = fn();
+  ceremonyPromise = promise;
+  try {
+    return await promise;
+  } finally {
+    ceremonyPromise = null;
+  }
+}
+
+/**
+ * @param {Uint8Array} bytes
+ */
+export function zeroize(bytes) {
+  if (bytes) bytes.fill(0);
+}

package/src/ui.js

@@ -0,0 +1,68 @@
+import { to0xHex } from "./hex.js";
+
+/** @type {HTMLElement | null} */
+let root = null;
+
+/**
+ * @param {HTMLElement} container
+ */
+export function initUi(container) {
+  root = container;
+  root.innerHTML = "";
+  root.className = "ows-signer-ui";
+}
+
+export function clearUi() {
+  if (root) root.innerHTML = "";
+}
+
+/**
+ * @param {Uint8Array} privateKey
+ */
+export function showPrivateKey(privateKey) {
+  if (!root) return;
+  clearUi();
+  const pre = document.createElement("pre");
+  pre.className = "ows-key";
+  pre.textContent = to0xHex(privateKey);
+  const copyBtn = document.createElement("button");
+  copyBtn.type = "button";
+  copyBtn.className = "ows-copy";
+  copyBtn.textContent = "Copy";
+  copyBtn.addEventListener("click", async () => {
+    await navigator.clipboard.writeText(pre.textContent ?? "");
+  });
+  root.append(pre, copyBtn);
+}
+
+/**
+ * @param {string} passwordText
+ * @param {string} buttonText
+ * @param {number} minPasswordLength
+ * @returns {Promise<string>}
+ */
+export function promptPassphrase(passwordText, buttonText, minPasswordLength) {
+  if (!root) {
+    return Promise.reject(new Error("uiNotInitialized"));
+  }
+  clearUi();
+  return new Promise((resolve, reject) => {
+    const input = document.createElement("input");
+    input.type = "password";
+    input.className = "ows-password";
+    input.placeholder = passwordText;
+    const button = document.createElement("button");
+    button.type = "button";
+    button.className = "ows-confirm";
+    button.textContent = buttonText;
+    button.addEventListener("click", () => {
+      if (input.value.length < minPasswordLength) {
+        reject(new Error("passwordTooShort"));
+        return;
+      }
+      resolve(input.value);
+      clearUi();
+    });
+    root.append(input, button);
+  });
+}

package/src/webauthn.js

@@ -0,0 +1,150 @@
+import { getRpId } from "./state.js";
+import { PRF_LABEL_SECP256K1 } from "./constants.js";
+import { bufferToBase64Url } from "./hex.js";
+import { debugLog, describePrfExtensionResults } from "./debug.js";
+
+/**
+ * @param {Uint8Array} [userId]
+ * @returns {Uint8Array}
+ */
+function randomUserId(userId) {
+  if (userId) return userId;
+  return crypto.getRandomValues(new Uint8Array(16));
+}
+
+/**
+ * @param {string} name
+ * @param {{ rpName?: string, userDisplayName?: string, userId?: string }} [options]
+ * @returns {Promise<PublicKeyCredential>}
+ */
+export async function createPasskeyCredential(name, options = {}) {
+  const rpId = getRpId();
+  const rpName =
+    typeof options.rpName === "string" && options.rpName
+      ? options.rpName
+      : "OWS";
+  const userId = options.userId
+    ? Uint8Array.from(atob(options.userId), (c) => c.charCodeAt(0))
+    : randomUserId();
+  const displayName = options.userDisplayName ?? name;
+
+  debugLog("createPasskeyCredential userActivation.isActive", {
+    isActive: navigator.userActivation?.isActive ?? false,
+  });
+
+  const credential = await navigator.credentials.create({
+    publicKey: {
+      rp: { name: rpName, id: rpId },
+      user: {
+        id: userId,
+        name,
+        displayName,
+      },
+      challenge: crypto.getRandomValues(new Uint8Array(32)),
+      pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+      authenticatorSelection: {
+        residentKey: "required",
+        requireResidentKey: true,
+        userVerification: "required",
+      },
+      extensions: {
+        prf: {
+          enable: {
+            first: PRF_LABEL_SECP256K1,
+          },
+        },
+      },
+    },
+  });
+
+  if (!credential || !(credential instanceof PublicKeyCredential)) {
+    throw new Error("credentialCreationFailed");
+  }
+  debugLog("createPasskeyCredential", describePrfExtensionResults(credential));
+  return credential;
+}
+
+/**
+ * @param {Uint8Array} [challenge]
+ * @param {string} [credentialId]
+ * @returns {Promise<PublicKeyCredential>}
+ */
+export async function getPasskeyAssertion(challenge, credentialId) {
+  const rpId = getRpId();
+  const allowCredentials = credentialId
+    ? [
+        {
+          type: "public-key",
+          id: base64UrlToBytes(credentialId),
+        },
+      ]
+    : undefined;
+
+  const credential = await navigator.credentials.get({
+    publicKey: {
+      challenge: challenge ?? crypto.getRandomValues(new Uint8Array(32)),
+      rpId,
+      userVerification: "required",
+      allowCredentials,
+      extensions: {
+        prf: {
+          eval: {
+            first: PRF_LABEL_SECP256K1,
+          },
+        },
+      },
+    },
+  });
+
+  if (!credential || !(credential instanceof PublicKeyCredential)) {
+    throw new Error("credentialGetFailed");
+  }
+  debugLog("getPasskeyAssertion", describePrfExtensionResults(credential));
+  return credential;
+}
+
+/**
+ * @param {string} value
+ * @returns {Uint8Array}
+ */
+function base64UrlToBytes(value) {
+  const pad = "=".repeat((4 - (value.length % 4)) % 4);
+  const b64 = value.replace(/-/g, "+").replace(/_/g, "/") + pad;
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+/**
+ * @param {PublicKeyCredential} credential
+ * @returns {string}
+ */
+export function getCredentialId(credential) {
+  return bufferToBase64Url(credential.rawId);
+}
+
+/**
+ * @param {PublicKeyCredential} credential
+ * @returns {string | null}
+ */
+export function getPasskeyPublicKeyBase64Url(credential) {
+  const response = credential.response;
+  if ("getPublicKey" in response && typeof response.getPublicKey === "function") {
+    const key = response.getPublicKey();
+    return key ? bufferToBase64Url(key) : null;
+  }
+  return null;
+}
+
+/**
+ * @param {PublicKeyCredential} credential
+ * @returns {string | null}
+ */
+export function getAssertionSignatureBase64Url(credential) {
+  const response = credential.response;
+  if ("signature" in response && response.signature) {
+    return bufferToBase64Url(response.signature);
+  }
+  return null;
+}