@blocklet/meta 1.16.39 → 1.16.40-beta-20250227-095906-fc9de90b

package/lib/security.d.ts

@@ -5,3 +5,11 @@ export declare function signResponse<T extends Record<string, any>>(data: T, wal
 export declare function verifyResponse<T extends Record<string, any>>(signed: T & {
     $signature?: string;
 }, wallet: WalletObject): Promise<boolean>;
+type VaultRecord = {
+    pk: string;
+    did: string;
+    at: number;
+    sig: string;
+};
+export declare function verifyVault(vaults: VaultRecord[], appId: string, throwOnError?: boolean): Promise<string>;
+export {};

package/lib/security.js

@@ -5,8 +5,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signResponse = signResponse;
 exports.verifyResponse = verifyResponse;
+exports.verifyVault = verifyVault;
 const omit_1 = __importDefault(require("lodash/omit"));
 const json_stable_stringify_1 = __importDefault(require("json-stable-stringify"));
+const wallet_1 = require("@ocap/wallet");
+const did_1 = require("@arcblock/did");
 function signResponse(data, wallet) {
     const payload = (0, json_stable_stringify_1.default)(data);
     const signature = wallet.sign(payload);
@@ -19,3 +22,55 @@ function verifyResponse(signed, wallet) {
     }
     return Promise.resolve(wallet.verify((0, json_stable_stringify_1.default)((0, omit_1.default)(signed, '$signature')), signed.$signature));
 }
+async function verifyVault(vaults, appId, throwOnError = false) {
+    // return empty string if the vaults list is empty
+    if (!Array.isArray(vaults) || vaults.length === 0) {
+        if (throwOnError) {
+            throw new Error('Blocklet vaults list is empty');
+        }
+        return '';
+    }
+    // throws if the vaults list is not in ascending order by `at` field
+    for (let i = 1; i < vaults.length; i++) {
+        if (vaults[i].at <= vaults[i - 1].at) {
+            if (throwOnError) {
+                throw new Error('Blocklet vaults are not in ascending order');
+            }
+            return '';
+        }
+    }
+    // throw if there are duplicate vaults
+    const uniqueVaults = new Set(vaults.map((vault) => vault.did));
+    if (uniqueVaults.size !== vaults.length) {
+        if (throwOnError) {
+            throw new Error('Blocklet vaults list has duplicate vaults');
+        }
+        return '';
+    }
+    // verify signature for each vault
+    let data = Buffer.from(`vault:${appId}`);
+    for (let i = 0; i < vaults.length; i++) {
+        const vault = vaults[i];
+        const wallet = (0, wallet_1.fromPublicKey)(vault.pk, (0, did_1.toTypeInfo)(vault.did));
+        data = Buffer.concat([data, Buffer.from(`\n${vault.did}`)]);
+        try {
+            // eslint-disable-next-line no-await-in-loop
+            if ((await wallet.verify(data, vault.sig)) === false) {
+                if (throwOnError) {
+                    throw new Error(`Blocklet vault signature verification failed for ${vault.did}`);
+                }
+                return '';
+            }
+        }
+        catch (err) {
+            if (process.env.NODE_ENV !== 'test') {
+                console.error(err);
+            }
+            if (throwOnError) {
+                throw new Error(`Blocklet vault signature verification failed for ${vault.did}`);
+            }
+            return '';
+        }
+    }
+    return vaults[vaults.length - 1].did;
+}

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.16.39",
+  "version": "1.16.40-beta-20250227-095906-fc9de90b",
   "description": "Library to parse/validate/fix blocklet meta",
   "main": "./lib/index.js",
   "typings": "./lib/index.d.ts",
@@ -25,18 +25,18 @@
   "author": "wangshijun <wangshijun2020@gmail.com> (http://github.com/wangshijun)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/constant": "1.16.39",
-    "@abtnode/docker-utils": "1.16.39",
-    "@arcblock/did": "1.19.10",
-    "@arcblock/did-ext": "1.19.10",
-    "@arcblock/did-util": "1.19.10",
-    "@arcblock/jwt": "1.19.10",
-    "@blocklet/constant": "1.16.39",
-    "@ocap/asset": "1.19.10",
-    "@ocap/mcrypto": "1.19.10",
-    "@ocap/types": "1.19.10",
-    "@ocap/util": "1.19.10",
-    "@ocap/wallet": "1.19.10",
+    "@abtnode/constant": "1.16.40-beta-20250227-095906-fc9de90b",
+    "@abtnode/docker-utils": "1.16.40-beta-20250227-095906-fc9de90b",
+    "@arcblock/did": "1.19.12",
+    "@arcblock/did-ext": "1.19.12",
+    "@arcblock/did-util": "1.19.12",
+    "@arcblock/jwt": "1.19.12",
+    "@blocklet/constant": "1.16.40-beta-20250227-095906-fc9de90b",
+    "@ocap/asset": "1.19.12",
+    "@ocap/mcrypto": "1.19.12",
+    "@ocap/types": "1.19.12",
+    "@ocap/util": "1.19.12",
+    "@ocap/wallet": "1.19.12",
     "ajv": "^8.11.0",
     "axios": "^1.7.9",
     "cjk-length": "^1.0.0",
@@ -80,5 +80,5 @@
     "ts-node": "^10.9.1",
     "typescript": "^5.6.3"
   },
-  "gitHead": "e3a614757b32dba71dcc187f20060932df31eab6"
+  "gitHead": "c5f6a14ce5435a615c75c4a0033415fcf51fae89"
 }