@aptos-labs/ts-sdk 1.27.1-zeta.0 → 1.28.0

package/src/account/FederatedKeylessAccount.ts

@@ -1,328 +0,0 @@
-// Copyright © Aptos Foundation
-// SPDX-License-Identifier: Apache-2.0
-
-import { JwtPayload, jwtDecode } from "jwt-decode";
-import EventEmitter from "eventemitter3";
-import { EphemeralCertificateVariant, HexInput, SigningScheme } from "../types";
-import { AccountAddress, AccountAddressInput } from "../core/accountAddress";
-import { AnyPublicKey, AnySignature, KeylessSignature, EphemeralCertificate, ZeroKnowledgeSig } from "../core/crypto";
-
-import { Account } from "./Account";
-import { EphemeralKeyPair } from "./EphemeralKeyPair";
-import { Hex } from "../core/hex";
-import { AccountAuthenticatorSingleKey } from "../transactions/authenticator/account";
-import { Deserializer, Serializable, Serializer } from "../bcs";
-import { deriveTransactionType } from "../transactions/transactionBuilder/signingMessage";
-import { AnyRawTransaction } from "../transactions/types";
-import { base64UrlDecode } from "../utils/helpers";
-import { FederatedKeylessPublicKey } from "../core/crypto/federatedKeyless";
-import { KeylessAccount, ProofFetchCallback, ProofFetchEvents, TransactionAndProof } from "./KeylessAccount";
-
-/**
- * Account implementation for the Keyless authentication scheme.
- *
- * Used to represent a Keyless based account and sign transactions with it.
- *
- * Use KeylessAccount.fromJWTAndProof to instantiate a KeylessAccount with a JWT, proof and EphemeralKeyPair.
- *
- * When the proof expires or the JWT becomes invalid, the KeylessAccount must be instantiated again with a new JWT,
- * EphemeralKeyPair, and corresponding proof.
- */
-export class FederatedKeylessAccount extends Serializable implements Account {
-  static readonly PEPPER_LENGTH: number = 31;
-
-  /**
-   * The KeylessPublicKey associated with the account
-   */
-  readonly publicKey: FederatedKeylessPublicKey;
-
-  /**
-   * The EphemeralKeyPair used to generate sign.
-   */
-  readonly ephemeralKeyPair: EphemeralKeyPair;
-
-  /**
-   * The claim on the JWT to identify a user.  This is typically 'sub' or 'email'.
-   */
-  readonly uidKey: string;
-
-  /**
-   * The value of the uidKey claim on the JWT.  This intended to be a stable user identifier.
-   */
-  readonly uidVal: string;
-
-  /**
-   * The value of the 'aud' claim on the JWT, also known as client ID.  This is the identifier for the dApp's
-   * OIDC registration with the identity provider.
-   */
-  readonly aud: string;
-
-  /**
-   * A value contains 31 bytes of entropy that preserves privacy of the account. Typically fetched from a pepper provider.
-   */
-  readonly pepper: Uint8Array;
-
-  /**
-   * Account address associated with the account
-   */
-  readonly accountAddress: AccountAddress;
-
-  /**
-   * The zero knowledge signature (if ready) which contains the proof used to validate the EphemeralKeyPair.
-   */
-  proof: ZeroKnowledgeSig | undefined;
-
-  /**
-   * The proof of the EphemeralKeyPair or a promise that provides the proof.  This is used to allow for awaiting on
-   * fetching the proof.
-   */
-  readonly proofOrPromise: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;
-
-  /**
-   * Signing scheme used to sign transactions
-   */
-  readonly signingScheme: SigningScheme;
-
-  /**
-   * The JWT token used to derive the account
-   */
-  readonly jwt: string;
-
-  /**
-   * An event emitter used to assist in handling asycronous proof fetching.
-   */
-  private readonly emitter: EventEmitter<ProofFetchEvents>;
-
-  // Use the static constructor 'create' instead.
-  private constructor(args: {
-    address?: AccountAddress;
-    ephemeralKeyPair: EphemeralKeyPair;
-    iss: string;
-    uidKey: string;
-    uidVal: string;
-    aud: string;
-    pepper: HexInput;
-    jwkAddress: AccountAddress;
-    proof: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;
-    proofFetchCallback?: ProofFetchCallback;
-    jwt: string;
-  }) {
-    super();
-    const { address, ephemeralKeyPair, uidKey, uidVal, aud, pepper, proof, proofFetchCallback, jwt } = args;
-    this.ephemeralKeyPair = ephemeralKeyPair;
-    this.publicKey = FederatedKeylessPublicKey.create(args);
-    this.accountAddress = address ? AccountAddress.from(address) : this.publicKey.authKey().derivedAddress();
-    this.uidKey = uidKey;
-    this.uidVal = uidVal;
-    this.aud = aud;
-    this.jwt = jwt;
-    this.emitter = new EventEmitter<ProofFetchEvents>();
-    this.proofOrPromise = proof;
-    if (proof instanceof ZeroKnowledgeSig) {
-      this.proof = proof;
-    } else {
-      if (proofFetchCallback === undefined) {
-        throw new Error("Must provide callback for async proof fetch");
-      }
-      this.emitter.on("proofFetchFinish", async (status) => {
-        await proofFetchCallback(status);
-        this.emitter.removeAllListeners();
-      });
-      this.init(proof);
-    }
-    this.signingScheme = SigningScheme.SingleKey;
-    const pepperBytes = Hex.fromHexInput(pepper).toUint8Array();
-    if (pepperBytes.length !== KeylessAccount.PEPPER_LENGTH) {
-      throw new Error(`Pepper length in bytes should be ${KeylessAccount.PEPPER_LENGTH}`);
-    }
-    this.pepper = pepperBytes;
-  }
-
-  /**
-   * This initializes the asyncronous proof fetch
-   * @return
-   */
-  async init(promise: Promise<ZeroKnowledgeSig>) {
-    try {
-      this.proof = await promise;
-      this.emitter.emit("proofFetchFinish", { status: "Success" });
-    } catch (error) {
-      if (error instanceof Error) {
-        this.emitter.emit("proofFetchFinish", { status: "Failed", error: error.toString() });
-      } else {
-        this.emitter.emit("proofFetchFinish", { status: "Failed", error: "Unknown" });
-      }
-    }
-  }
-
-  serialize(serializer: Serializer): void {
-    serializer.serializeStr(this.jwt);
-    serializer.serializeStr(this.uidKey);
-    serializer.serializeFixedBytes(this.pepper);
-    this.publicKey.jwkAddress.serialize(serializer);
-    this.ephemeralKeyPair.serialize(serializer);
-    if (this.proof === undefined) {
-      throw new Error("Connot serialize - proof undefined");
-    }
-    this.proof.serialize(serializer);
-  }
-
-  static deserialize(deserializer: Deserializer): FederatedKeylessAccount {
-    const jwt = deserializer.deserializeStr();
-    const uidKey = deserializer.deserializeStr();
-    const pepper = deserializer.deserializeFixedBytes(31);
-    const jwkAddress = AccountAddress.deserialize(deserializer);
-    const ephemeralKeyPair = EphemeralKeyPair.deserialize(deserializer);
-    const proof = ZeroKnowledgeSig.deserialize(deserializer);
-    return FederatedKeylessAccount.create({
-      proof,
-      pepper,
-      jwkAddress,
-      uidKey,
-      jwt,
-      ephemeralKeyPair,
-    });
-  }
-
-  /**
-   * Checks if the proof is expired.  If so the account must be rederived with a new EphemeralKeyPair
-   * and JWT token.
-   * @return boolean
-   */
-  isExpired(): boolean {
-    return this.ephemeralKeyPair.isExpired();
-  }
-
-  /**
-   * Sign a message using Keyless.
-   * @param message the message to sign, as binary input
-   * @return the AccountAuthenticator containing the signature, together with the account's public key
-   */
-  signWithAuthenticator(message: HexInput): AccountAuthenticatorSingleKey {
-    const signature = new AnySignature(this.sign(message));
-    const publicKey = new AnyPublicKey(this.publicKey);
-    return new AccountAuthenticatorSingleKey(publicKey, signature);
-  }
-
-  /**
-   * Sign a transaction using Keyless.
-   * @param transaction the raw transaction
-   * @return the AccountAuthenticator containing the signature of the transaction, together with the account's public key
-   */
-  signTransactionWithAuthenticator(transaction: AnyRawTransaction): AccountAuthenticatorSingleKey {
-    const signature = new AnySignature(this.signTransaction(transaction));
-    const publicKey = new AnyPublicKey(this.publicKey);
-    return new AccountAuthenticatorSingleKey(publicKey, signature);
-  }
-
-  /**
-   * Waits for asyncronous proof fetching to finish.
-   * @return
-   */
-  async waitForProofFetch() {
-    if (this.proofOrPromise instanceof Promise) {
-      await this.proofOrPromise;
-    }
-  }
-
-  /**
-   * Sign the given message using Keyless.
-   * @param message in HexInput format
-   * @returns Signature
-   */
-  sign(data: HexInput): KeylessSignature {
-    const { expiryDateSecs } = this.ephemeralKeyPair;
-    if (this.isExpired()) {
-      throw new Error("EphemeralKeyPair is expired");
-    }
-    if (this.proof === undefined) {
-      throw new Error("Proof not defined");
-    }
-    const ephemeralPublicKey = this.ephemeralKeyPair.getPublicKey();
-    const ephemeralSignature = this.ephemeralKeyPair.sign(data);
-
-    return new KeylessSignature({
-      jwtHeader: base64UrlDecode(this.jwt.split(".")[0]),
-      ephemeralCertificate: new EphemeralCertificate(this.proof, EphemeralCertificateVariant.ZkProof),
-      expiryDateSecs,
-      ephemeralPublicKey,
-      ephemeralSignature,
-    });
-  }
-
-  /**
-   * Sign the given transaction with Keyless.
-   * Signs the transaction and proof to guard against proof malleability.
-   * @param transaction the transaction to be signed
-   * @returns KeylessSignature
-   */
-  signTransaction(transaction: AnyRawTransaction): KeylessSignature {
-    if (this.proof === undefined) {
-      throw new Error("Proof not found");
-    }
-    const raw = deriveTransactionType(transaction);
-    const txnAndProof = new TransactionAndProof(raw, this.proof.proof);
-    const signMess = txnAndProof.hash();
-    return this.sign(signMess);
-  }
-
-  /**
-   * Note - This function is currently incomplete and should only be used to verify ownership of the KeylessAccount
-   *
-   * Verifies a signature given the message.
-   *
-   * TODO: Groth16 proof verification
-   *
-   * @param args.message the message that was signed.
-   * @param args.signature the KeylessSignature to verify
-   * @returns boolean
-   */
-  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {
-    const { message, signature } = args;
-    if (this.isExpired()) {
-      return false;
-    }
-    if (!this.ephemeralKeyPair.getPublicKey().verifySignature({ message, signature: signature.ephemeralSignature })) {
-      return false;
-    }
-    return true;
-  }
-
-  static fromBytes(bytes: Uint8Array): KeylessAccount {
-    return KeylessAccount.deserialize(new Deserializer(bytes));
-  }
-
-  static create(args: {
-    address?: AccountAddress;
-    proof: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;
-    jwt: string;
-    ephemeralKeyPair: EphemeralKeyPair;
-    pepper: HexInput;
-    jwkAddress: AccountAddressInput;
-    uidKey?: string;
-    proofFetchCallback?: ProofFetchCallback;
-  }): FederatedKeylessAccount {
-    const { address, proof, jwt, ephemeralKeyPair, pepper, jwkAddress, uidKey = "sub", proofFetchCallback } = args;
-
-    const jwtPayload = jwtDecode<JwtPayload & { [key: string]: string }>(jwt);
-    const iss = jwtPayload.iss!;
-    if (typeof jwtPayload.aud !== "string") {
-      throw new Error("aud was not found or an array of values");
-    }
-    const aud = jwtPayload.aud!;
-    const uidVal = jwtPayload[uidKey];
-    return new FederatedKeylessAccount({
-      address,
-      proof,
-      ephemeralKeyPair,
-      iss,
-      uidKey,
-      uidVal,
-      aud,
-      pepper,
-      jwkAddress: AccountAddress.from(jwkAddress),
-      jwt,
-      proofFetchCallback,
-    });
-  }
-}

package/src/core/crypto/federatedKeyless.ts

@@ -1,134 +0,0 @@
-// Copyright © Aptos Foundation
-// SPDX-License-Identifier: Apache-2.0
-
-import { AccountPublicKey, PublicKey } from "./publicKey";
-import { Deserializer, Serializer } from "../../bcs";
-import { Hex } from "../hex";
-import { HexInput, AnyPublicKeyVariant, SigningScheme } from "../../types";
-import { AuthenticationKey } from "../authenticationKey";
-import { AccountAddress, AccountAddressInput } from "../accountAddress";
-import { KeylessPublicKey, KeylessSignature } from "./keyless";
-
-/**
- * Represents the FederatedKeylessPublicKey public key
- *
- * These keys use an onchain address as a source of truth for the JWK used to verify signatures.
- *
- * FederatedKeylessPublicKey authentication key is represented in the SDK as `AnyPublicKey`.
- */
-export class FederatedKeylessPublicKey extends AccountPublicKey {
-  /**
-   * The address that contains the JWK set to be used for verification.
-   */
-  readonly jwkAddress: AccountAddress;
-
-  /**
-   * The inner public key which contains the standard Keyless public key.
-   */
-  readonly keylessPublicKey: KeylessPublicKey;
-
-  constructor(jwkAddress: AccountAddressInput, keylessPublicKey: KeylessPublicKey) {
-    super();
-    this.jwkAddress = AccountAddress.from(jwkAddress);
-    this.keylessPublicKey = keylessPublicKey;
-  }
-
-  /**
-   * Get the authentication key for the federated keyless public key
-   *
-   * @returns AuthenticationKey
-   */
-  authKey(): AuthenticationKey {
-    const serializer = new Serializer();
-    serializer.serializeU32AsUleb128(AnyPublicKeyVariant.FederatedKeyless);
-    serializer.serializeFixedBytes(this.bcsToBytes());
-    return AuthenticationKey.fromSchemeAndBytes({
-      scheme: SigningScheme.SingleKey,
-      input: serializer.toUint8Array(),
-    });
-  }
-
-  /**
-   * Get the public key in bytes (Uint8Array).
-   *
-   * @returns Uint8Array representation of the public key
-   */
-  toUint8Array(): Uint8Array {
-    return this.bcsToBytes();
-  }
-
-  /**
-   * Get the public key as a hex string with the 0x prefix.
-   *
-   * @returns string representation of the public key
-   */
-  toString(): string {
-    return Hex.fromHexInput(this.toUint8Array()).toString();
-  }
-
-  /**
-   * Verifies a signed data with a public key
-   *
-   * @param args.message message
-   * @param args.signature The signature
-   * @returns true if the signature is valid
-   */
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars, class-methods-use-this
-  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {
-    throw new Error("Not yet implemented");
-  }
-
-  serialize(serializer: Serializer): void {
-    this.jwkAddress.serialize(serializer);
-    this.keylessPublicKey.serialize(serializer);
-  }
-
-  static deserialize(deserializer: Deserializer): FederatedKeylessPublicKey {
-    const jwkAddress = AccountAddress.deserialize(deserializer);
-    const keylessPublicKey = KeylessPublicKey.deserialize(deserializer);
-    return new FederatedKeylessPublicKey(jwkAddress, keylessPublicKey);
-  }
-
-  static isPublicKey(publicKey: PublicKey): publicKey is FederatedKeylessPublicKey {
-    return publicKey instanceof FederatedKeylessPublicKey;
-  }
-
-  /**
-   * Creates a FederatedKeylessPublicKey from the JWT components plus pepper
-   *
-   * @param args.iss the iss of the identity
-   * @param args.uidKey the key to use to get the uidVal in the JWT token
-   * @param args.uidVal the value of the uidKey in the JWT token
-   * @param args.aud the client ID of the application
-   * @param args.pepper The pepper used to maintain privacy of the account
-   * @returns FederatedKeylessPublicKey
-   */
-  static create(args: {
-    iss: string;
-    uidKey: string;
-    uidVal: string;
-    aud: string;
-    pepper: HexInput;
-    jwkAddress: AccountAddressInput;
-  }): FederatedKeylessPublicKey {
-    return new FederatedKeylessPublicKey(args.jwkAddress, KeylessPublicKey.create(args));
-  }
-
-  static fromJwtAndPepper(args: {
-    jwt: string;
-    pepper: HexInput;
-    jwkAddress: AccountAddressInput;
-    uidKey?: string;
-  }): FederatedKeylessPublicKey {
-    return new FederatedKeylessPublicKey(args.jwkAddress, KeylessPublicKey.fromJwtAndPepper(args));
-  }
-
-  static isInstance(publicKey: PublicKey) {
-    return (
-      "jwkAddress" in publicKey &&
-      publicKey.jwkAddress instanceof AccountAddress &&
-      "keylessPublicKey" in publicKey &&
-      publicKey.keylessPublicKey instanceof KeylessPublicKey
-    );
-  }
-}

package/src/internal/move/jwks/build/jwk/BuildInfo.yaml

@@ -1,56 +0,0 @@
----
-compiled_package_info:
-  package_name: jwk
-  address_alias_instantiation:
-    Extensions: "0000000000000000000000000000000000000000000000000000000000000001"
-    aptos_framework: "0000000000000000000000000000000000000000000000000000000000000001"
-    aptos_fungible_asset: 000000000000000000000000000000000000000000000000000000000000000a
-    aptos_std: "0000000000000000000000000000000000000000000000000000000000000001"
-    aptos_token: "0000000000000000000000000000000000000000000000000000000000000003"
-    core_resources: 000000000000000000000000000000000000000000000000000000000a550c18
-    std: "0000000000000000000000000000000000000000000000000000000000000001"
-    vm: "0000000000000000000000000000000000000000000000000000000000000000"
-    vm_reserved: "0000000000000000000000000000000000000000000000000000000000000000"
-  source_digest: 3437D4FB002907781F0FE5D46FC4E668C8B8F0420AA77751774AD63B0C2730BF
-  build_flags:
-    dev_mode: false
-    test_mode: false
-    override_std: ~
-    generate_docs: false
-    generate_abis: false
-    generate_move_model: true
-    full_model_generation: false
-    install_dir: ~
-    force_recompilation: false
-    additional_named_addresses: {}
-    architecture: ~
-    fetch_deps_only: false
-    skip_fetch_latest_git_deps: false
-    compiler_config:
-      bytecode_version: 6
-      known_attributes:
-        - bytecode_instruction
-        - deprecated
-        - event
-        - expected_failure
-        - "fmt::skip"
-        - legacy_entry_fun
-        - "lint::allow_unsafe_randomness"
-        - "lint::skip"
-        - native_interface
-        - randomness
-        - resource_group
-        - resource_group_member
-        - test
-        - test_only
-        - verify_only
-        - view
-      skip_attribute_checks: false
-      compiler_version: ~
-      language_version: ~
-      experiments:
-        - optimize=on
-dependencies:
-  - AptosFramework
-  - AptosStdlib
-  - MoveStdlib