@abaxxtech/id 0.0.0

package/src/jose/algorithms/signing/ed25519.ts

@@ -0,0 +1,61 @@
+import * as Ed25519 from '@noble/ed25519';
+import type { PrivateJwk, PublicJwk, SignatureAlgorithm } from '../../../types/jose-types.js';
+
+import { Encoder } from '../../../utils/encoder.js';
+import { DwnError, DwnErrorCode } from '../../../core/dwn-error.js';
+
+function validateKey(jwk: PrivateJwk | PublicJwk): void {
+  if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') {
+    throw new DwnError(DwnErrorCode.Ed25519InvalidJwk, 'invalid jwk. kty MUST be OKP. crv MUST be Ed25519');
+  }
+}
+
+function publicKeyToJwk(publicKeyBytes: Uint8Array): PublicJwk {
+  const x = Encoder.bytesToBase64Url(publicKeyBytes);
+
+  const publicJwk: PublicJwk = {
+    alg : 'EdDSA',
+    kty : 'OKP',
+    crv : 'Ed25519',
+    x
+  };
+
+  return publicJwk;
+}
+
+export const ed25519: SignatureAlgorithm = {
+  sign: async (content: Uint8Array, privateJwk: PrivateJwk): Promise<Uint8Array> => {
+    validateKey(privateJwk);
+
+    const contentHex = Ed25519.etc.bytesToHex(content);
+    const privateKeyBytes = Encoder.base64UrlToBytes(privateJwk.d);
+    const privateKeyHex = Ed25519.etc.bytesToHex(privateKeyBytes);
+
+    return Ed25519.signAsync(contentHex, privateKeyHex);
+  },
+
+  verify: async (content: Uint8Array, signature: Uint8Array, publicJwk: PublicJwk): Promise<boolean> => {
+    validateKey(publicJwk);
+
+    const publicKeyBytes = Encoder.base64UrlToBytes(publicJwk.x);
+
+    return Ed25519.verifyAsync(signature, content, publicKeyBytes);
+  },
+
+  generateKeyPair: async (): Promise<{publicJwk: PublicJwk, privateJwk: PrivateJwk}> => {
+    const privateKeyBytes = Ed25519.utils.randomPrivateKey();
+    const privateKeyHex = Ed25519.etc.bytesToHex(privateKeyBytes);
+    const publicKeyBytes = await Ed25519.getPublicKeyAsync(privateKeyHex);
+
+    const d = Encoder.bytesToBase64Url(privateKeyBytes);
+
+    const publicJwk = publicKeyToJwk(publicKeyBytes);
+    const privateJwk: PrivateJwk = { ...publicJwk, d };
+
+    return { publicJwk, privateJwk };
+  },
+
+  publicKeyToJwk: async (publicKeyBytes: Uint8Array): Promise<PublicJwk> => {
+    return publicKeyToJwk(publicKeyBytes);
+  }
+};

package/src/jose/algorithms/signing/signature-algorithms.ts

@@ -0,0 +1,15 @@
+import type { SignatureAlgorithm } from '../../../types/jose-types.js';
+
+import { ed25519 } from './ed25519.js';
+import { Secp256k1 } from '../../../utils/secp256k1.js';
+
+// the key should be the appropriate `crv` value
+export const signatureAlgorithms: Record<string, SignatureAlgorithm> = {
+  'Ed25519'   : ed25519,
+  'secp256k1' : {
+    sign            : Secp256k1.sign,
+    verify          : Secp256k1.verify,
+    generateKeyPair : Secp256k1.generateKeyPair,
+    publicKeyToJwk  : Secp256k1.publicKeyToJwk
+  },
+};

package/src/jose/jws/general/builder.ts

@@ -0,0 +1,48 @@
+import type { GeneralJws } from '../../../types/jws-types.js';
+import type { Signer } from '../../../types/signer.js';
+
+import { Encoder } from '../../../utils/encoder.js';
+
+export class GeneralJwsBuilder {
+  private jws: GeneralJws;
+
+  private constructor(jws: GeneralJws) {
+    this.jws = jws;
+  }
+
+  static async create(payload: Uint8Array, signers: Signer[] = []): Promise<GeneralJwsBuilder> {
+    const jws: GeneralJws = {
+      payload    : Encoder.bytesToBase64Url(payload),
+      signatures : []
+    };
+
+    const builder = new GeneralJwsBuilder(jws);
+
+    for (const signer of signers) {
+      await builder.addSignature(signer);
+    }
+
+    return builder;
+  }
+
+  async addSignature(signer: Signer): Promise<void> {
+    const protectedHeader = {
+      kid : signer.keyId,
+      alg : signer.algorithm
+    };
+    const protectedHeaderString = JSON.stringify(protectedHeader);
+    const protectedHeaderBase64UrlString = Encoder.stringToBase64Url(protectedHeaderString);
+
+    const signingInputString = `${protectedHeaderBase64UrlString}.${this.jws.payload}`;
+    const signingInputBytes = Encoder.stringToBytes(signingInputString);
+
+    const signatureBytes = await signer.sign(signingInputBytes);
+    const signature = Encoder.bytesToBase64Url(signatureBytes);
+
+    this.jws.signatures.push({ protected: protectedHeaderBase64UrlString, signature });
+  }
+
+  getJws(): GeneralJws {
+    return this.jws;
+  }
+}

package/src/jose/jws/general/signer.ts

@@ -0,0 +1,29 @@
+import * as jose from 'jose';
+import type { GeneralJws } from '../../../types/jws-types.js';
+
+export class GeneralJwsSigner {
+  private jws: GeneralJws;
+
+  constructor(jws: GeneralJws) {
+    this.jws = jws;
+  }
+
+  static async signJWT(payload: any): Promise<any> {
+    const s = new TextEncoder().encode('XaA6JrXR1G0');
+    const alg = 'HS256';
+    return await new jose.SignJWT(payload)
+      .setProtectedHeader({ alg })
+      .setIssuedAt()
+      .setIssuer(payload.iss)
+      .setSubject(payload.sub)
+      .setAudience(payload.aud || 'verifier')
+      .setExpirationTime('24h')
+      .sign(s);
+  }
+
+  static async verifyJWT(token: string): Promise<any> {
+    const s = new TextEncoder().encode('XaA6JrXR1G0');
+    return jose.jwtVerify(token, s);
+  }
+
+}

package/src/jose/jws/general/verifier.ts

@@ -0,0 +1,113 @@
+import type { Cache } from '../../../types/cache.js';
+import type { DidResolver } from '../../../did/did-resolver.js';
+import type { GeneralJws } from '../../../types/jws-types.js';
+import type { PublicJwk } from '../../../types/jose-types.js';
+import type { VerificationMethod } from '../../../types/did-types.js';
+
+import { Jws } from '../../../utils/jws.js';
+import { MemoryCache } from '../../../utils/memory-cache.js';
+import { validateJsonSchema } from '../../../schema-validator.js';
+import { DwnError, DwnErrorCode } from '../../../core/dwn-error.js';
+
+type VerificationResult = {
+  /** DIDs of all signers */
+  signers: string[];
+};
+
+/**
+ * Verifies the signature(s) of a General JWS.
+ */
+export class GeneralJwsVerifier {
+
+  private static _singleton: GeneralJwsVerifier;
+
+  cache: Cache;
+
+  private constructor(cache?: Cache) {
+    this.cache = cache || new MemoryCache(600);
+  }
+
+  private static get singleton(): GeneralJwsVerifier {
+    if (GeneralJwsVerifier._singleton === undefined) {
+      GeneralJwsVerifier._singleton = new GeneralJwsVerifier();
+    }
+
+    return GeneralJwsVerifier._singleton;
+  }
+
+  /**
+   * Verifies the signatures of the given General JWS.
+   * @returns the list of signers that have valid signatures.
+   */
+  public static async verifySignatures(jws: GeneralJws, didResolver: DidResolver): Promise<VerificationResult> {
+    return await GeneralJwsVerifier.singleton.verifySignatures(jws, didResolver);
+  }
+
+  /**
+   * Verifies the signatures of the given General JWS.
+   * @returns the list of signers that have valid signatures.
+   */
+  public async verifySignatures(jws: GeneralJws, didResolver: DidResolver): Promise<VerificationResult> {
+    const signers: string[] = [];
+
+    for (const signatureEntry of jws.signatures) {
+      let isVerified: boolean;
+      const kid = Jws.getKid(signatureEntry);
+
+      const cacheKey = `${signatureEntry.protected}.${jws.payload}.${signatureEntry.signature}`;
+      const cachedValue = await this.cache.get(cacheKey);
+
+      // explicit `undefined` check to differentiate `false`
+      if (cachedValue === undefined) {
+        const publicJwk = await GeneralJwsVerifier.getPublicKey(kid, didResolver);
+        isVerified = await Jws.verifySignature(jws.payload, signatureEntry, publicJwk);
+        await this.cache.set(cacheKey, isVerified);
+      } else {
+        isVerified = cachedValue;
+      }
+
+      const did = Jws.extractDid(kid);
+
+      if (isVerified) {
+        signers.push(did);
+      } else {
+        throw new DwnError(DwnErrorCode.GeneralJwsVerifierInvalidSignature, `Signature verification failed for ${did}`);
+      }
+    }
+
+    return { signers };
+  }
+
+  /**
+   * Gets the public key given a fully qualified key ID (`kid`) by resolving the DID to its DID Document.
+   */
+  private static async getPublicKey(kid: string, didResolver: DidResolver): Promise<PublicJwk> {
+    // `resolve` throws exception if DID is invalid, DID method is not supported,
+    // or resolving DID fails
+    const did = Jws.extractDid(kid);
+    const { didDocument } = await didResolver.resolve(did);
+    const { verificationMethod: verificationMethods = [] } = didDocument || {};
+
+    let verificationMethod: VerificationMethod | undefined;
+
+    for (const method of verificationMethods) {
+      // consider optimizing using a set for O(1) lookups if needed
+      // key ID in DID Document may or may not be fully qualified. e.g.
+      // `did:ion:alice#key1` or `#key1`
+      if (kid.endsWith(method.id)) {
+        verificationMethod = method;
+        break;
+      }
+    }
+
+    if (!verificationMethod) {
+      throw new DwnError(DwnErrorCode.GeneralJwsVerifierGetPublicKeyNotFound, 'public key needed to verify signature not found in DID Document');
+    }
+
+    validateJsonSchema('JwkVerificationMethod', verificationMethod);
+
+    const { publicKeyJwk: publicJwk } = verificationMethod;
+
+    return publicJwk as PublicJwk;
+  }
+}

package/src/schema-validator.ts

@@ -0,0 +1,34 @@
+import * as precompiledValidators from '../generated/precompiled-validators.js';
+import { DwnError, DwnErrorCode } from './core/dwn-error.js';
+
+/**
+ * Validates the given payload using JSON schema keyed by the given schema name. Throws if the given payload fails validation.
+ * @param schemaName the schema name use to look up the JSON schema to be used for schema validation.
+ *                   The list of schema names can be found in compile-validators.js
+ * @param payload javascript object to be validated
+ */
+export function validateJsonSchema(schemaName: string, payload: any): void {
+  // const validateFn = validator.getSchema(schemaName);
+  const validateFn = (precompiledValidators as any)[schemaName];
+
+  if (!validateFn) {
+    throw new DwnError(DwnErrorCode.SchemaValidatorSchemaNotFound, `schema for ${schemaName} not found.`);
+  }
+
+  validateFn(payload);
+
+  if (!validateFn.errors) {
+    return;
+  }
+
+  // AJV is configured by default to stop validating after the 1st error is encountered which means
+  // there will only ever be one error;
+  const [ errorObj ] = validateFn.errors;
+  let { instancePath, message } = errorObj;
+
+  if (!instancePath) {
+    instancePath = schemaName;
+  }
+
+  throw new DwnError(DwnErrorCode.SchemaValidationFailure, `${instancePath}: ${message}`);
+}

package/src/store/blockstore-level.ts

@@ -0,0 +1,113 @@
+import { CID } from 'multiformats';
+import type { AbortOptions, AwaitIterable } from 'interface-store';
+import type { Blockstore, Pair } from 'interface-blockstore';
+
+import { createLevelDatabase, LevelWrapper } from './level-wrapper.js';
+
+// `level` works in Node.js 12+ and Electron 5+ on Linux, Mac OS, Windows and
+// FreeBSD, including any future Node.js and Electron release thanks to Node-API, including ARM
+// platforms like Raspberry Pi and Android, as well as in Chrome, Firefox, Edge, Safari, iOS Safari
+//  and Chrome for Android.
+
+/**
+ * Blockstore implementation using LevelDB for storing the actual messages (in the case of MessageStore)
+ * or the data associated with messages (in the case of a DataStore).
+ */
+export class BlockstoreLevel implements Blockstore {
+  config: BlockstoreLevelConfig;
+
+  db: LevelWrapper<Uint8Array>;
+
+  constructor(config: BlockstoreLevelConfig, db?: LevelWrapper<Uint8Array>) {
+    this.config = {
+      createLevelDatabase,
+      ...config
+    };
+
+    this.db = db ?? new LevelWrapper<Uint8Array>({ ...this.config, valueEncoding: 'binary' });
+  }
+
+  async open(): Promise<void> {
+    return this.db.open();
+  }
+
+  async close(): Promise<void> {
+    return this.db.close();
+  }
+
+  async partition(name: string): Promise<BlockstoreLevel> {
+    const db = await this.db.partition(name);
+    return new BlockstoreLevel({ ...this.config, location: '' }, db);
+  }
+
+  async put(key: CID | string, val: Uint8Array, options?: AbortOptions): Promise<CID> {
+    await this.db.put(String(key), val, options);
+    return CID.parse(key.toString());
+  }
+
+  async get(key: CID | string, options?: AbortOptions): Promise<Uint8Array> {
+    const result = await this.db.get(String(key), options);
+    return result!;
+  }
+
+  async has(key: CID | string, options?: AbortOptions): Promise<boolean> {
+    return this.db.has(String(key), options);
+  }
+
+  async delete(key: CID | string, options?: AbortOptions): Promise<void> {
+    return this.db.delete(String(key), options);
+  }
+
+  async isEmpty(options?: AbortOptions): Promise<boolean> {
+    return this.db.isEmpty(options);
+  }
+
+  async * putMany(source: AwaitIterable<Pair>, options?: AbortOptions): AsyncIterable<CID> {
+    for await (const entry of source) {
+      await this.put(entry.cid, entry.block, options);
+
+      yield entry.cid;
+    }
+  }
+
+  async * getMany(source: AwaitIterable<CID>, options?: AbortOptions): AsyncIterable<Pair> {
+    for await (const key of source) {
+      yield {
+        cid   : key,
+        block : await this.get(key, options)
+      };
+    }
+  }
+
+  async * getAll(options?: AbortOptions): AsyncIterable<Pair> {
+    // @ts-expect-error keyEncoding is 'buffer' but types for db.iterator always return the key type as 'string'
+    const li: AsyncGenerator<[Uint8Array, Uint8Array]> = this.db.iterator({
+      keys        : true,
+      keyEncoding : 'buffer'
+    }, options);
+
+    for await (const [key, value] of li) {
+      yield { cid: CID.decode(key), block: value };
+    }
+  }
+
+  async * deleteMany(source: AwaitIterable<CID>, options?: AbortOptions): AsyncIterable<CID> {
+    for await (const key of source) {
+      await this.delete(key, options);
+
+      yield key;
+    }
+  }
+
+  /**
+   * deletes all entries
+   */
+  async clear(): Promise<void> {
+    return this.db.clear();
+  }
+}
+
+type BlockstoreLevelConfig = {
+  location: string,
+  createLevelDatabase?: typeof createLevelDatabase,
+};

package/src/store/data-store-level.ts

@@ -0,0 +1,188 @@
+import type { ImportResult } from 'ipfs-unixfs-importer';
+import type { AssociateResult, DataStore, GetResult, PutResult } from '../types/data-store.js';
+
+import { BlockstoreLevel } from './blockstore-level.js';
+import { createLevelDatabase } from './level-wrapper.js';
+import { exporter } from 'ipfs-unixfs-exporter';
+import { importer } from 'ipfs-unixfs-importer';
+import { Readable } from 'readable-stream';
+
+// `BlockstoreLevel` doesn't support being a `Set` (i.e. it always requires a value), so use a placeholder instead.
+const PLACEHOLDER_VALUE = new Uint8Array();
+
+/**
+ * A simple implementation of {@link DataStore} that works in both the browser and server-side.
+ * Leverages LevelDB under the hood.
+ *
+ * It has the following structure (`+` represents a sublevel and `->` represents a key->value pair):
+ *   'data' + <tenant> + <dataCid> -> <data>
+ *   'references' + <tenant> + <dataCid> + <messageCid> -> PLACEHOLDER_VALUE
+ *
+ * This allows for the <data> to be shared for everything that uses the same <dataCid> while also making
+ * sure that the <data> can only be deleted if there are no <messageCid> for any <tenant> still using it.
+ */
+export class DataStoreLevel implements DataStore {
+  config: DataStoreLevelConfig;
+
+  blockstore: BlockstoreLevel;
+
+  constructor(config: DataStoreLevelConfig = {}) {
+    this.config = {
+      blockstoreLocation: 'data/DATASTORE',
+      createLevelDatabase,
+      ...config
+    };
+
+    this.blockstore = new BlockstoreLevel({
+      location            : this.config.blockstoreLocation!,
+      createLevelDatabase : this.config.createLevelDatabase,
+    });
+  }
+
+  public async open(): Promise<void> {
+    await this.blockstore.open();
+  }
+
+  async close(): Promise<void> {
+    await this.blockstore.close();
+  }
+
+  async put(tenant: string, messageCid: string, dataCid: string, dataStream: Readable): Promise<PutResult> {
+    const blockstoreForReferenceCounting = await this.getBlockstoreForReferenceCounting(tenant, dataCid);
+    await blockstoreForReferenceCounting.put(messageCid, PLACEHOLDER_VALUE);
+
+    const blockstoreForData = await this.getBlockstoreForStoringData(tenant, dataCid);
+
+    const asyncDataBlocks = importer([{ content: dataStream }], blockstoreForData, { cidVersion: 1 });
+
+    // NOTE: the last block contains the root CID as well as info to derive the data size
+    let dataDagRoot!: ImportResult;
+    for await (dataDagRoot of asyncDataBlocks) { ; }
+
+    return {
+      dataCid  : String(dataDagRoot.cid),
+      dataSize : Number(dataDagRoot.unixfs?.fileSize() ?? dataDagRoot.size)
+    };
+  }
+
+  public async get(tenant: string, messageCid: string, dataCid: string): Promise<GetResult | undefined> {
+    const blockstoreForReferenceCounting = await this.getBlockstoreForReferenceCounting(tenant, dataCid);
+
+    const allowed = await blockstoreForReferenceCounting.has(messageCid);
+    if (!allowed) {
+      return undefined;
+    }
+
+    const blockstoreForData = await this.getBlockstoreForStoringData(tenant, dataCid);
+
+    const exists = await blockstoreForData.has(dataCid);
+    if (!exists) {
+      return undefined;
+    }
+
+    // data is chunked into dag-pb unixfs blocks. re-inflate the chunks.
+    const dataDagRoot = await exporter(dataCid, blockstoreForData);
+    const contentIterator = dataDagRoot.content();
+
+    const dataStream = new Readable({
+      async read(): Promise<void> {
+        const result = await contentIterator.next();
+        if (result.done) {
+          this.push(null); // end the stream
+        } else {
+          this.push(result.value);
+        }
+      }
+    });
+
+    let dataSize = dataDagRoot.size;
+
+    if (dataDagRoot.type === 'file' || dataDagRoot.type === 'directory') {
+      dataSize = dataDagRoot.unixfs.fileSize();
+    }
+
+    return {
+      dataCid  : String(dataDagRoot.cid),
+      dataSize : Number(dataSize),
+      dataStream,
+    };
+  }
+
+  public async associate(tenant: string, messageCid: string, dataCid: string): Promise<AssociateResult | undefined> {
+    const blockstoreForReferenceCounting = await this.getBlockstoreForReferenceCounting(tenant, dataCid);
+
+    const noExistingReference = await blockstoreForReferenceCounting.isEmpty();
+    if (noExistingReference) {
+      return undefined;
+    }
+
+    const blockstoreForData = await this.getBlockstoreForStoringData(tenant, dataCid);
+
+    const dataExists = await blockstoreForData.has(dataCid);
+    if (!dataExists) {
+      return undefined;
+    }
+
+    await blockstoreForReferenceCounting.put(messageCid, PLACEHOLDER_VALUE);
+
+    const dataDagRoot = await exporter(dataCid, blockstoreForData);
+
+    let dataSize = dataDagRoot.size;
+
+    if (dataDagRoot.type === 'file' || dataDagRoot.type === 'directory') {
+      dataSize = dataDagRoot.unixfs.fileSize();
+    }
+
+    return {
+      dataCid  : String(dataDagRoot.cid),
+      dataSize : Number(dataSize)
+    };
+  }
+
+  public async delete(tenant: string, messageCid: string, dataCid: string): Promise<void> {
+    const blockstoreForReferenceCounting = await this.getBlockstoreForReferenceCounting(tenant, dataCid);
+    await blockstoreForReferenceCounting.delete(messageCid);
+
+    const wasLastReference = await blockstoreForReferenceCounting.isEmpty();
+    if (!wasLastReference) {
+      return;
+    }
+
+    const blockstoreForData = await this.getBlockstoreForStoringData(tenant, dataCid);
+    await blockstoreForData.clear();
+  }
+
+  /**
+   * Deletes everything in the store. Mainly used in tests.
+   */
+  public async clear(): Promise<void> {
+    await this.blockstore.clear();
+  }
+
+  /**
+   * Gets the blockstore used for reference counting purposes for the given `dataCid` in the given `tenant`.
+   */
+  private async getBlockstoreForReferenceCounting(tenant: string, dataCid: string): Promise<BlockstoreLevel> {
+    const referenceCountingPartitionName = 'references';
+    const blockstoreForReferenceCounting = await this.blockstore.partition(referenceCountingPartitionName);
+    const blockstoreForReferenceCountingByTenant = await blockstoreForReferenceCounting.partition(tenant);
+    const blockstoreForReferenceCountingDataCid = await blockstoreForReferenceCountingByTenant.partition(dataCid);
+    return blockstoreForReferenceCountingDataCid;
+  }
+
+  /**
+   * Gets the blockstore used for storing data for the given `dataCid` in the given `tenant`.
+   */
+  private async getBlockstoreForStoringData(tenant: string, dataCid: string): Promise<BlockstoreLevel> {
+    const dataPartitionName = 'data';
+    const blockstoreForData = await this.blockstore.partition(dataPartitionName);
+    const blockstoreOfGivenTenant = await blockstoreForData.partition(tenant);
+    const blockstoreOfGivenDataCid = await blockstoreOfGivenTenant.partition(dataCid);
+    return blockstoreOfGivenDataCid;
+  }
+}
+
+type DataStoreLevelConfig = {
+  blockstoreLocation?: string,
+  createLevelDatabase?: typeof createLevelDatabase,
+};