@blocklet/did-space-js 0.5.58

package/dist/security/request-signature.js

@@ -0,0 +1,140 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyDelegation = exports.verifyRequest = exports.signRequest = void 0;
+const jwt_1 = require("@arcblock/jwt");
+const isEmpty_1 = __importDefault(require("lodash/isEmpty"));
+const isObject_1 = __importDefault(require("lodash/isObject"));
+const isString_1 = __importDefault(require("lodash/isString"));
+const isUndefined_1 = __importDefault(require("lodash/isUndefined"));
+const json_stable_stringify_1 = __importDefault(require("json-stable-stringify"));
+const did_1 = require("@arcblock/did");
+const mcrypto_1 = require("@ocap/mcrypto");
+const wallet_1 = require("@ocap/wallet");
+const is_url_1 = __importDefault(require("is-url"));
+const debug_1 = __importDefault(require("debug"));
+const logger_1 = require("../libs/logger");
+const debug = (0, debug_1.default)('request-signature');
+// verifyDelegation to get actual appDid
+function verifyDelegation(delegation, delegatee) {
+    const { from, to, userPk, permissions } = (0, jwt_1.decode)(delegation);
+    if (!(0, jwt_1.verify)(delegation, userPk)) {
+        throw new Error('delegation is not valid');
+    }
+    if (!(0, did_1.isFromPublicKey)(from, userPk)) {
+        throw new Error(`delegation.userPk(${userPk}) does not match with delegator(${from})`);
+    }
+    if (to !== delegatee.address) {
+        throw new Error(`delegation.to(${to}) is not delegatee(${delegatee.address})`);
+    }
+    if (!Array.isArray(permissions) || permissions.length === 0) {
+        throw new Error('delegation has no permissions');
+    }
+    if (!permissions.some((item) => item.role === 'DIDSpaceAgent')) {
+        throw new Error('delegation has no DIDSpaceAgent permission');
+    }
+    return from;
+}
+exports.verifyDelegation = verifyDelegation;
+/**
+ * @FIXME 这还不是最终的解决方案，目前需要完善边界的情况，需要更多的时间 @jianchao
+ * @description
+ * @param {{ url: string }} { url }
+ * @return {string}  {string}
+ */
+function getSignUrl({ url }) {
+    let signUrl = url;
+    if ((0, is_url_1.default)(encodeURI(url))) {
+        const Url = new URL(url);
+        signUrl = `${Url.pathname}${Url.search}`;
+        debug('getSignUrl', { signUrl });
+    }
+    return signUrl;
+}
+function signRequest({ url, method, data, headers, wallet, delegation, }) {
+    if ((0, isEmpty_1.default)(url)) {
+        throw new Error(`url(${url}) cannot be empty`);
+    }
+    if (!(0, isObject_1.default)(data)) {
+        throw new Error(`data(${data}) is not an object`);
+    }
+    if (delegation) {
+        verifyDelegation(delegation, wallet);
+    }
+    const signUrl = getSignUrl({ url });
+    // @ts-expect-error
+    const signData = (0, isString_1.default)(data?.data) ? data : {};
+    const token = (0, jwt_1.sign)(wallet.address, wallet.secretKey, {
+        digest: mcrypto_1.Hasher.SHA3.hash256((0, json_stable_stringify_1.default)({
+            url: signUrl,
+            method,
+            data: signData,
+        })),
+        // 请求在一个小时内都是不过期的
+        exp: String(Math.floor(Date.now() / 1000) + 60 * 60),
+    });
+    return {
+        url,
+        method,
+        data,
+        headers: Object.assign(headers ?? {}, {
+            'x-app-did': wallet.address,
+            'x-app-pk': wallet.publicKey,
+            'x-app-token': token,
+            'x-app-delegation': delegation || '',
+        }),
+    };
+}
+exports.signRequest = signRequest;
+function verifyRequest({ url, method, data, headers, }) {
+    let appDid = headers['x-app-did'];
+    const appPk = headers['x-app-pk'];
+    const appToken = headers['x-app-token'];
+    const delegation = headers['x-app-delegation'];
+    if ((0, isUndefined_1.default)(appDid)) {
+        throw new Error('x-app-did must be present in request headers');
+    }
+    if ((0, isUndefined_1.default)(appPk)) {
+        throw new Error('x-app-pk must be present in request headers');
+    }
+    if ((0, isUndefined_1.default)(appToken)) {
+        throw new Error('x-app-token must be present in request headers');
+    }
+    if (!(0, did_1.isValid)(appDid)) {
+        throw new Error(`appDid(${appDid}) must be a valid did`);
+    }
+    if (!(0, did_1.isFromPublicKey)(appDid, appPk)) {
+        throw new Error(`appDid(${appDid}) and appPk(${appPk}) do not match`);
+    }
+    if (!(0, jwt_1.verify)(appToken, appPk)) {
+        throw new Error(`appToken(${appToken}) is invalid`);
+    }
+    if (delegation) {
+        appDid = verifyDelegation(delegation, (0, wallet_1.fromPublicKey)(appPk, (0, did_1.toTypeInfo)(appDid)));
+    }
+    const payload = (0, jwt_1.decode)(appToken, true);
+    if ((0, isUndefined_1.default)(payload.digest)) {
+        throw new Error('payload.digest must exists');
+    }
+    const verifyData = (0, isString_1.default)(data?.data) ? data : {};
+    const signUrl = url;
+    const expectedDigest = mcrypto_1.Hasher.SHA3.hash256((0, json_stable_stringify_1.default)({
+        url: signUrl,
+        method,
+        data: verifyData,
+    }));
+    if (payload.digest !== expectedDigest) {
+        logger_1.logger.info('verifyRequest', {
+            url,
+            signUrl,
+            method,
+            data,
+            headers,
+        });
+        throw new Error('payload.digest do not match');
+    }
+    return appDid;
+}
+exports.verifyRequest = verifyRequest;

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@blocklet/did-space-js",
+  "version": "0.5.58",
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "Decentralized file space managed by DID",
+  "author": {
+    "name": "arcblock",
+    "email": "blocklet@arcblock.io",
+    "url": "https://github.com/blocklet"
+  },
+  "homepage": "",
+  "license": "ISC",
+  "main": "dist/index.js",
+  "typings": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "lint": "eslint src tests",
+    "lint:fix": "npm run lint -- --fix",
+    "test": "jest --forceExit --detectOpenHandles",
+    "coverage": "npm run test -- --coverage",
+    "prebuild": "rm -fr dist",
+    "build": "tsc",
+    "watch": "npm run build -- --watch",
+    "verify": "npm run lint && npm run test && npm run build",
+    "link": "yarn link"
+  },
+  "dependencies": {
+    "@arcblock/did": "^1.18.136",
+    "@arcblock/jwt": "^1.18.136",
+    "@arcblock/validator": "^1.18.136",
+    "@blocklet/env": "1.16.32",
+    "@did-space/core": "0.5.58",
+    "@ocap/mcrypto": "^1.18.136",
+    "@ocap/util": "^1.18.136",
+    "@ocap/wallet": "^1.18.136",
+    "agentkeepalive": "^4.5.0",
+    "axios": "^1.7.7",
+    "base64-url": "^2.3.3",
+    "dayjs": "^1.11.13",
+    "debug": "^4.3.7",
+    "filehound": "^1.17.6",
+    "form-data": "^4.0.1",
+    "fs-extra": "^11.2.0",
+    "got": "11.8.6",
+    "hasha": "^5.2.2",
+    "is-url": "^1.2.4",
+    "joi": "^17.13.3",
+    "json-stable-stringify": "^1.1.1",
+    "lodash": "^4.17.21",
+    "mime-types": "^2.1.35",
+    "p-all": "3.0.0",
+    "p-queue": "6.6.2",
+    "ufo": "^1.5.4",
+    "xbytes": "^1.9.1"
+  },
+  "devDependencies": {
+    "@arcblock/eslint-config-ts": "^0.3.3",
+    "@types/fs-extra": "^9.0.13",
+    "@types/jest": "^28.1.8",
+    "@types/js-yaml": "^4.0.9",
+    "@types/json-stable-stringify": "^1.1.0",
+    "@types/lodash": "^4.17.12",
+    "@types/mime-types": "^2.1.4",
+    "@types/node": "18.19.31",
+    "@types/valid-url": "^1.0.7",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "eslint": "^8.57.1",
+    "jest": "^28.1.3",
+    "lint-staged": "^13.3.0",
+    "ts-jest": "^28.0.8",
+    "typescript": "^4.9.5"
+  },
+  "gitHead": "3c6d028ee695f85769ce2d257687bbf24d6f9de8"
+}