@1shotapi/ows-signer 0.3.1 → 0.3.3

package/README.md

@@ -41,6 +41,7 @@ Only accepts messages when `event.source === window.parent`. Replies use the par
 | `signDigest` | `digests[]`, `credentialId?`, ceremony UI? | `KeyDerived` (PRF path), `DigestSigned` (`results[]`) |
 | `executeBatch` | batch fields + ceremony UI? | `KeyDerived` (when keys derived), `BatchExecuted` |
 | `revealPrivateKey` | `credentialId?`, ceremony UI? | `KeyDerived`, then `PrivateKeyRevealed` (after user dismisses DOM key UI) |
+| `importPrivateKey` | — | DOM hex input; `KeyDerived`, `RecoverySessionStarted` |
 | `createRecoveryData` | passphrase fields + ceremony UI? | `KeyDerived`, `RecoveryDataCreated` |
 | `recoverKey` | envelope + passphrase fields + ceremony UI? | DOM display; `RecoverySessionStarted` or re-bind → `RecoverySessionCleared` |
 | `getPublicKey` | `credentialId?`, `challenge?`, ceremony UI? | `KeyDerived`, `PublicKey`, `ChallengeSigned?` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1shotapi/ows-signer",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "OWS Signing Layer — plain JavaScript WebAuthn PRF key custody with curve-based signing (on-chain via EIP-8244)",
   "type": "module",
   "files": [

package/src/constants.js

@@ -21,6 +21,7 @@ export const METHODS = [
   "createCredential",
   "signDigest",
   "revealPrivateKey",
+  "importPrivateKey",
   "createRecoveryData",
   "recoverKey",
   "getPublicKey",

package/src/handlers.js

@@ -16,7 +16,7 @@ import {
   normalizePrfOutputToArrayBuffer,
 } from "./crypto/prf.js";
 import { getPublicKeyAsync as edGetPublicKeyAsync } from "./crypto/vendor/noble-ed25519.js";
-import { getPublicKey as secpGetPublicKey } from "./crypto/vendor/noble-secp256k1.js";
+import { getPublicKey as secpGetPublicKey, utils as secpUtils } from "./crypto/vendor/noble-secp256k1.js";
 import { debugLog, describePrfExtensionResults } from "./debug.js";
 import { decryptPrivateKey, encryptPrivateKey } from "./crypto/recovery.js";
 import { signWithScheme, validateSignPayload } from "./crypto/sign.js";
@@ -30,7 +30,15 @@ import {
   withCeremony,
   zeroize,
 } from "./state.js";
-import { clearUi, CeremonyDeniedError, promptCeremonyConfirm, promptPassphrase, showPrivateKey } from "./ui.js";
+import {
+  clearUi,
+  CeremonyDeniedError,
+  promptCeremonyConfirm,
+  promptPassphrase,
+  promptPrivateKey,
+  showPrivateKey,
+  updateCeremonyCopy,
+} from "./ui.js";
 import {
   createPasskeyCredential,
   getAssertionSignatureBase64Url,
@@ -126,6 +134,10 @@ export async function handleRequest(
         await handleRevealPrivateKey(params, correlationId, targetOrigin);
         return;
 
+      case "importPrivateKey":
+        await handleImportPrivateKey(params, correlationId, targetOrigin);
+        return;
+
       case "createRecoveryData":
         await handleCreateRecoveryData(params, correlationId, targetOrigin);
         return;
@@ -191,9 +203,14 @@ function ceremonyFieldsFromParams(params) {
  *
  * @param {PublicKeyCredential} credential
  * @param {string} [credentialId]
+ * @param {(() => void) | undefined} [onBeforeFollowUpGet]
  * @returns {Promise<PublicKeyCredential>}
  */
-async function credentialForKeyDerivation(credential, credentialId) {
+async function credentialForKeyDerivation(
+  credential,
+  credentialId,
+  onBeforeFollowUpGet,
+) {
   debugLog("ceremony extension results", describePrfExtensionResults(credential));
 
   const rawPrf = credential.getClientExtensionResults()?.prf?.results?.first;
@@ -206,7 +223,11 @@ async function credentialForKeyDerivation(credential, credentialId) {
   debugLog("no PRF results on registration; running assertion with prf.eval", {
     credentialId: id,
   });
-  // Same RPC — no second Confirm (one screen per call).
+  if (typeof onBeforeFollowUpGet === "function") {
+    onBeforeFollowUpGet();
+  }
+  // Prefer keeping the parent Confirm panel open (call from runOnConfirm) so
+  // the user still sees why this second WebAuthn prompt appears.
   const assertion = await getPasskeyAssertion(undefined, id);
   debugLog(
     "assertion extension results",
@@ -234,14 +255,31 @@ async function handleCreateCredential(params, correlationId, targetOrigin) {
       : {};
 
   await withCeremony(async () => {
-    const credential = await promptCeremonyConfirm(options, () =>
-      createPasskeyCredential(name, options),
-    );
-    const credentialId = getCredentialId(credential);
-    const prfCredential = await credentialForKeyDerivation(
-      credential,
-      credentialId,
-    );
+    // Create + optional PRF follow-up get stay under one Confirm panel so the
+    // explanation remains visible for every WebAuthn prompt in this RPC.
+    /** @type {PublicKeyCredential | undefined} */
+    let registrationCredential;
+    const prfCredential = await promptCeremonyConfirm(options, async () => {
+      registrationCredential = await createPasskeyCredential(name, options);
+      const credentialId = getCredentialId(registrationCredential);
+      return credentialForKeyDerivation(
+        registrationCredential,
+        credentialId,
+        () => {
+          updateCeremonyCopy({
+            explanationHeader: "Unlock your new passkey",
+            explanationText:
+              "Confirm with your passkey again to finish setting up this wallet.",
+            confirmButtonText: options.confirmButtonText,
+            denyButtonText: options.denyButtonText,
+          });
+        },
+      );
+    });
+    if (!registrationCredential) {
+      throw new Error("createCredential: registration credential missing");
+    }
+    const credentialId = getCredentialId(registrationCredential);
     const keys = await deriveKeysFromCredential(prfCredential);
     emitKeyDerived(
       targetOrigin,
@@ -252,7 +290,7 @@ async function handleCreateCredential(params, correlationId, targetOrigin) {
 
     emitEvent(window.parent, targetOrigin, "CredentialCreated", correlationId, {
       credentialId,
-      cosePublicKey: getCosePublicKeyBase64Url(credential),
+      cosePublicKey: getCosePublicKeyBase64Url(registrationCredential),
       secp256k1PublicKey: to0xHex(keys.secp256k1PublicKey),
     });
     zeroize(keys.secp256k1PrivateKey);
@@ -462,6 +500,64 @@ async function handleRevealPrivateKey(params, correlationId, targetOrigin) {
   );
 }
 
+/**
+ * Paste a secp256k1 private key hex into the Signing Layer and start a recovery
+ * session (same session semantics as `recoverKey` without a backup envelope).
+ *
+ * @param {Record<string, unknown>} _params
+ * @param {string | undefined} correlationId
+ * @param {string} targetOrigin
+ */
+async function handleImportPrivateKey(_params, correlationId, targetOrigin) {
+  const raw = await promptPrivateKey();
+  let privateKey;
+  try {
+    privateKey = parseImportedPrivateKeyHex(raw);
+  } catch {
+    emitInvalid(correlationId, targetOrigin, "invalidPrivateKey");
+    return;
+  }
+  if (!secpUtils.isValidPrivateKey(privateKey)) {
+    zeroize(privateKey);
+    emitInvalid(correlationId, targetOrigin, "invalidPrivateKey");
+    return;
+  }
+
+  setRecoveryPrivateKey(privateKey);
+
+  const secp256k1PublicKey = secpGetPublicKey(privateKey, false);
+  const ed25519Seed = await ed25519SeedFromSecp256k1Scalar(privateKey);
+  const ed25519PublicKey = await edGetPublicKeyAsync(ed25519Seed);
+  emitKeyDerived(
+    targetOrigin,
+    correlationId,
+    secp256k1PublicKey,
+    ed25519PublicKey,
+  );
+  zeroize(ed25519Seed);
+
+  emitEvent(
+    window.parent,
+    targetOrigin,
+    "RecoverySessionStarted",
+    correlationId,
+    { recoverySessionActive: true },
+  );
+}
+
+/**
+ * @param {string} raw
+ * @returns {Uint8Array}
+ */
+function parseImportedPrivateKeyHex(raw) {
+  const trimmed = raw.trim();
+  const withPrefix =
+    trimmed.startsWith("0x") || trimmed.startsWith("0X")
+      ? trimmed
+      : `0x${trimmed}`;
+  return parse0xHex(withPrefix, 32);
+}
+
 /**
  * @param {Record<string, unknown>} params
  * @param {string | undefined} correlationId

package/src/ui.js

@@ -131,6 +131,22 @@ export function resolveCeremonyUi(fields) {
   };
 }
 
+/**
+ * Update header/body on an open ceremony Confirm panel (e.g. before a follow-up
+ * WebAuthn get). No-op if the ceremony UI is not showing.
+ *
+ * @param {CeremonyUiFields | Record<string, unknown> | undefined} fields
+ */
+export function updateCeremonyCopy(fields) {
+  if (!root) return;
+  const header = root.querySelector(".ows-ceremony-header");
+  const text = root.querySelector(".ows-ceremony-text");
+  if (!header && !text) return;
+  const ui = resolveCeremonyUi(fields);
+  if (header) header.textContent = ui.header;
+  if (text) text.textContent = ui.explanation;
+}
+
 /**
  * Show Confirm/Cancel. On Confirm, runs `runOnConfirm` **synchronously from the
  * click handler** so WebAuthn keeps user activation / document focus on mobile.
@@ -302,3 +318,68 @@ export function promptPassphrase(passwordText, buttonText, minPasswordLength) {
     root.append(input, button);
   });
 }
+
+/**
+ * Prompt for a secp256k1 private key hex (with or without `0x`). Resolves with
+ * the trimmed hex string the user entered; rejects on Cancel.
+ *
+ * @returns {Promise<string>}
+ */
+export function promptPrivateKey() {
+  if (!root) {
+    return Promise.reject(new Error("uiNotInitialized"));
+  }
+  cancelPendingCeremonyConfirm();
+  clearUi();
+  return new Promise((resolve, reject) => {
+    const header = document.createElement("h2");
+    header.className = "ows-ceremony-header";
+    header.textContent = "Import private key";
+    const body = document.createElement("p");
+    body.className = "ows-ceremony-text";
+    body.textContent =
+      "Paste your secp256k1 private key. It stays in this secure panel and is never sent to the host.";
+    const input = document.createElement("input");
+    input.type = "password";
+    input.className = "ows-password";
+    input.placeholder = "0x…";
+    input.autocomplete = "off";
+    input.spellcheck = false;
+    const errorEl = document.createElement("p");
+    errorEl.className = "ows-ceremony-text";
+    errorEl.style.color = "tomato";
+    errorEl.hidden = true;
+    const confirmBtn = document.createElement("button");
+    confirmBtn.type = "button";
+    confirmBtn.className = "ows-confirm";
+    confirmBtn.textContent = "Import";
+    const denyBtn = document.createElement("button");
+    denyBtn.type = "button";
+    denyBtn.className = "ows-deny";
+    denyBtn.textContent = "Cancel";
+    const actions = document.createElement("div");
+    actions.className = "ows-actions";
+    actions.append(confirmBtn, denyBtn);
+
+    const finish = (fn) => {
+      clearUi();
+      fn();
+    };
+
+    confirmBtn.addEventListener("click", () => {
+      const value = input.value.trim();
+      if (!value) {
+        errorEl.textContent = "Enter a private key.";
+        errorEl.hidden = false;
+        return;
+      }
+      finish(() => resolve(value));
+    });
+    denyBtn.addEventListener("click", () => {
+      finish(() => reject(new CeremonyDeniedError()));
+    });
+
+    root.append(header, body, input, errorEl, actions);
+    input.focus();
+  });
+}