@atproto/identity 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @atproto/identity
 
+## 0.3.2
+
+### Patch Changes
+
+- Updated dependencies [[`e1b5f253`](https://github.com/bluesky-social/atproto/commit/e1b5f2537a5ba4d8b951a741269b604856028ae5)]:
+  - @atproto/crypto@0.3.0
+
+## 0.3.1
+
+### Patch Changes
+
+- [#1788](https://github.com/bluesky-social/atproto/pull/1788) [`84e2d4d2`](https://github.com/bluesky-social/atproto/commit/84e2d4d2b6694f344d80c18672c78b650189d423) Thanks [@bnewbold](https://github.com/bnewbold)! - update license to "MIT or Apache2"
+
+- Updated dependencies [[`84e2d4d2`](https://github.com/bluesky-social/atproto/commit/84e2d4d2b6694f344d80c18672c78b650189d423)]:
+  - @atproto/common-web@0.2.3
+  - @atproto/crypto@0.2.3
+
 ## 0.3.0
 
 ### Minor Changes

package/LICENSE.txt

@@ -0,0 +1,7 @@
+Dual MIT/Apache-2.0 License
+
+Copyright (c) 2022-2023 Bluesky PBC, and Contributors
+
+Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/README.md

@@ -37,4 +37,9 @@ if (data.handle != handle) {
 
 ## License
 
-MIT License
+This project is dual-licensed under MIT and Apache 2.0 terms:
+
+- MIT license ([LICENSE-MIT.txt](https://github.com/bluesky-social/atproto/blob/main/LICENSE-MIT.txt) or http://opensource.org/licenses/MIT)
+- Apache License, Version 2.0, ([LICENSE-APACHE.txt](https://github.com/bluesky-social/atproto/blob/main/LICENSE-APACHE.txt) or http://www.apache.org/licenses/LICENSE-2.0)
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/dist/did/atproto-data.d.ts

@@ -4,3 +4,4 @@ export { getDid, getHandle, getPdsEndpoint as getPds, getFeedGenEndpoint as getF
 export declare const getKey: (doc: DidDocument) => string | undefined;
 export declare const parseToAtprotoDocument: (doc: DidDocument) => Partial<AtprotoData>;
 export declare const ensureAtpDocument: (doc: DidDocument) => AtprotoData;
+export declare const ensureAtprotoKey: (doc: DidDocument) => string;

package/dist/index.js

@@ -21170,6 +21170,7 @@ __export(src_exports3, {
   UnsupportedDidWebPathError: () => UnsupportedDidWebPathError,
   didDocument: () => didDocument,
   ensureAtpDocument: () => ensureAtpDocument,
+  ensureAtprotoKey: () => ensureAtprotoKey,
   getDid: () => getDid,
   getFeedGen: () => getFeedGenEndpoint,
   getHandle: () => getHandle,
@@ -24175,16 +24176,30 @@ var decompressPubkey2 = (compressed) => {
 };
 
 // ../crypto/src/p256/operations.ts
-var verifyDidSig = async (did, data, sig) => {
+var verifyDidSig = async (did, data, sig, opts) => {
   const { jwtAlg, keyBytes } = parseDidKey(did);
   if (jwtAlg !== P256_JWT_ALG) {
     throw new Error(`Not a P-256 did:key: ${did}`);
   }
-  return verifySig(keyBytes, data, sig);
+  return verifySig(keyBytes, data, sig, opts);
 };
-var verifySig = async (publicKey, data, sig) => {
+var verifySig = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha2562(data);
-  return p256.verify(sig, msgHash, publicKey, { lowS: true });
+  if (!allowMalleable && !isCompactFormat(sig)) {
+    return false;
+  }
+  return p256.verify(sig, msgHash, publicKey, {
+    lowS: !allowMalleable
+  });
+};
+var isCompactFormat = (sig) => {
+  try {
+    const parsed = p256.Signature.fromCompact(sig);
+    return equals(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
 };
 
 // ../crypto/src/p256/plugin.ts
@@ -24196,16 +24211,30 @@ var p256Plugin = {
 var plugin_default = p256Plugin;
 
 // ../crypto/src/secp256k1/operations.ts
-var verifyDidSig2 = async (did, data, sig) => {
+var verifyDidSig2 = async (did, data, sig, opts) => {
   const { jwtAlg, keyBytes } = parseDidKey(did);
   if (jwtAlg !== SECP256K1_JWT_ALG) {
     throw new Error(`Not a secp256k1 did:key: ${did}`);
   }
-  return verifySig2(keyBytes, data, sig);
+  return verifySig2(keyBytes, data, sig, opts);
 };
-var verifySig2 = async (publicKey, data, sig) => {
+var verifySig2 = async (publicKey, data, sig, opts) => {
+  const allowMalleable = opts?.allowMalleableSig ?? false;
   const msgHash = await sha2562(data);
-  return secp256k1.verify(sig, msgHash, publicKey, { lowS: true });
+  if (!allowMalleable && !isCompactFormat2(sig)) {
+    return false;
+  }
+  return secp256k1.verify(sig, msgHash, publicKey, {
+    lowS: !allowMalleable
+  });
+};
+var isCompactFormat2 = (sig) => {
+  try {
+    const parsed = secp256k1.Signature.fromCompact(sig);
+    return equals(parsed.toCompactRawBytes(), sig);
+  } catch {
+    return false;
+  }
 };
 
 // ../crypto/src/secp256k1/plugin.ts
@@ -24294,13 +24323,13 @@ var multibaseToBytes = (mb) => {
 };
 
 // ../crypto/src/verify.ts
-var verifySignature = (didKey, data, sig) => {
+var verifySignature = (didKey, data, sig, opts) => {
   const parsed = parseDidKey(didKey);
   const plugin = plugins_default.find((p) => p.jwtAlg === parsed.jwtAlg);
   if (!plugin) {
-    throw new Error(`Unsupported signature alg: :${parsed.jwtAlg}`);
+    throw new Error(`Unsupported signature alg: ${parsed.jwtAlg}`);
   }
-  return plugin.verifySignature(didKey, data, sig);
+  return plugin.verifySignature(didKey, data, sig, opts);
 };
 
 // ../common-web/src/check.ts
@@ -28097,6 +28126,13 @@ var ensureAtpDocument = (doc) => {
   }
   return { did, signingKey, handle, pds };
 };
+var ensureAtprotoKey = (doc) => {
+  const { signingKey } = parseToAtprotoDocument(doc);
+  if (!signingKey) {
+    throw new Error(`Could not parse signingKey from doc: ${doc}`);
+  }
+  return signingKey;
+};
 
 // src/errors.ts
 var DidNotFoundError = class extends Error {
@@ -28188,8 +28224,8 @@ var BaseResolver = class {
     if (did.startsWith("did:key:")) {
       return did;
     } else {
-      const data = await this.resolveAtprotoData(did, forceRefresh);
-      return data.signingKey;
+      const didDocument2 = await this.ensureResolve(did, forceRefresh);
+      return ensureAtprotoKey(didDocument2);
     }
   }
   async verifySignature(did, data, sig, forceRefresh = false) {
@@ -28434,6 +28470,7 @@ var IdResolver = class {
   UnsupportedDidWebPathError,
   didDocument,
   ensureAtpDocument,
+  ensureAtprotoKey,
   getDid,
   getFeedGen,
   getHandle,