@bsv/wallet-toolbox 1.5.6 → 1.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/wallet-toolbox",
-  "version": "1.5.6",
+  "version": "1.5.8",
   "description": "BRC100 conforming wallet, wallet storage and wallet signer components",
   "main": "./out/src/index.js",
   "types": "./out/src/index.d.ts",
@@ -32,7 +32,7 @@
   "dependencies": {
     "@bsv/auth-express-middleware": "^1.2.0",
     "@bsv/payment-express-middleware": "^1.2.1",
-    "@bsv/sdk": "^1.6.8",
+    "@bsv/sdk": "^1.6.11",
     "express": "^4.21.2",
     "idb": "^8.0.2",
     "knex": "^3.1.0",

package/src/CWIStyleWalletManager.ts

@@ -70,6 +70,57 @@ import { PrivilegedKeyManager } from './sdk/PrivilegedKeyManager'
  */
 export const PBKDF2_NUM_ROUNDS = 7777
 
+/**
+ * PBKDF-2 that prefers the browser / Node 20+ WebCrypto implementation and
+ * silently falls back to the existing JS code.
+ *
+ * @param passwordBytes   Raw password bytes.
+ * @param salt            Salt bytes.
+ * @param iterations      Number of rounds.
+ * @param keyLen          Desired key length in bytes.
+ * @param hash            Digest algorithm (default "sha512").
+ * @returns               Derived key bytes.
+ */
+async function pbkdf2NativeOrJs(
+  passwordBytes: number[],
+  salt: number[],
+  iterations: number,
+  keyLen: number,
+  hash: 'sha256' | 'sha512' = 'sha512'
+): Promise<number[]> {
+  // ----- fast-path: WebCrypto (both browser & recent Node expose globalThis.crypto.subtle)
+  const subtle = (globalThis as any)?.crypto?.subtle as SubtleCrypto | undefined
+  if (subtle) {
+    try {
+      const baseKey = await subtle.importKey(
+        'raw',
+        new Uint8Array(passwordBytes),
+        { name: 'PBKDF2' },
+        /*extractable*/ false,
+        ['deriveBits']
+      )
+
+      const bits = await subtle.deriveBits(
+        {
+          name: 'PBKDF2',
+          salt: new Uint8Array(salt),
+          iterations,
+          hash: hash.toUpperCase() as AlgorithmIdentifier
+        },
+        baseKey,
+        keyLen * 8
+      )
+      return Array.from(new Uint8Array(bits))
+    } catch (err) {
+      console.warn('[pbkdf2] WebCrypto path failed → falling back to JS implementation', err)
+      /* fall through */
+    }
+  }
+
+  // ----- slow-path: old JavaScript implementation
+  return Hash.pbkdf2(passwordBytes, salt, iterations, keyLen, hash)
+}
+
 /**
  * Unique Identifier for the default profile (16 zero bytes).
  */
@@ -734,7 +785,7 @@ export class CWIStyleWalletManager implements WalletInterface {
       if (!this.currentUMPToken) {
         throw new Error('Provide presentation or recovery key first.')
       }
-      const derivedPasswordKey = Hash.pbkdf2(
+      const derivedPasswordKey = await pbkdf2NativeOrJs(
         Utils.toArray(password, 'utf8'),
         this.currentUMPToken.passwordSalt,
         PBKDF2_NUM_ROUNDS,
@@ -777,7 +828,13 @@ export class CWIStyleWalletManager implements WalletInterface {
       const recoveryKey = Random(32)
       await this.recoveryKeySaver(recoveryKey)
       const passwordSalt = Random(32)
-      const passwordKey = Hash.pbkdf2(Utils.toArray(password, 'utf8'), passwordSalt, PBKDF2_NUM_ROUNDS, 32, 'sha512')
+      const passwordKey = await pbkdf2NativeOrJs(
+        Utils.toArray(password, 'utf8'),
+        passwordSalt,
+        PBKDF2_NUM_ROUNDS,
+        32,
+        'sha512'
+      )
       const rootPrimaryKey = Random(32)
       const rootPrivilegedKey = Random(32)
 
@@ -1177,7 +1234,7 @@ export class CWIStyleWalletManager implements WalletInterface {
     }
 
     const passwordSalt = Random(32)
-    const newPasswordKey = Hash.pbkdf2(
+    const newPasswordKey = await pbkdf2NativeOrJs(
       Utils.toArray(newPassword, 'utf8'),
       passwordSalt,
       PBKDF2_NUM_ROUNDS,
@@ -1615,7 +1672,7 @@ export class CWIStyleWalletManager implements WalletInterface {
       })
 
       // Decrypt the root privileged key using the confirmed password
-      const derivedPasswordKey = Hash.pbkdf2(
+      const derivedPasswordKey = await pbkdf2NativeOrJs(
         Utils.toArray(password, 'utf8'),
         this.currentUMPToken!.passwordSalt,
         PBKDF2_NUM_ROUNDS,

package/src/WalletPermissionsManager.ts

@@ -568,10 +568,13 @@ export class WalletPermissionsManager implements WalletInterface {
       }
     }
 
-    // Update the cache regardless of ephemeral status
-    const expiry = params.expiry || Math.floor(Date.now() / 1000) + 3600 * 24 * 30
-    const key = this.buildRequestKey(matching.request as PermissionRequest)
-    this.cachePermission(key, expiry)
+    // Only cache non-ephemeral permissions
+    // Ephemeral permissions should not be cached as they are one-time authorizations
+    if (!params.ephemeral) {
+      const expiry = params.expiry || Math.floor(Date.now() / 1000) + 3600 * 24 * 30
+      const key = this.buildRequestKey(matching.request as PermissionRequest)
+      this.cachePermission(key, expiry)
+    }
   }
 
   /**
@@ -825,10 +828,6 @@ export class WalletPermissionsManager implements WalletInterface {
         reason,
         renewal: false
       })
-      if (granted) {
-        // Unknown expiry until grantPermission() is called; cache for now with TTL only
-        this.cachePermission(cacheKey, 0)
-      }
       return granted
     }
   }
@@ -891,9 +890,6 @@ export class WalletPermissionsManager implements WalletInterface {
         reason,
         renewal: false
       })
-      if (granted) {
-        this.cachePermission(cacheKey, 0)
-      }
       return granted
     }
   }
@@ -975,9 +971,6 @@ export class WalletPermissionsManager implements WalletInterface {
         reason,
         renewal: false
       })
-      if (granted) {
-        this.cachePermission(cacheKey, 0)
-      }
       return granted
     }
   }
@@ -1026,7 +1019,7 @@ export class WalletPermissionsManager implements WalletInterface {
             `Spending authorization insufficient for ${satoshis}, no user consent (seekPermission=false).`
           )
         }
-        const granted = await this.requestPermissionFlow({
+        return await this.requestPermissionFlow({
           type: 'spending',
           originator,
           spending: { satoshis, lineItems },
@@ -1034,27 +1027,19 @@ export class WalletPermissionsManager implements WalletInterface {
           renewal: true,
           previousToken: token
         })
-        if (granted) {
-          this.cachePermission(cacheKey, 0)
-        }
-        return granted
       }
     } else {
       // no token
       if (!seekPermission) {
         throw new Error(`No spending authorization found, (seekPermission=false).`)
       }
-      const granted = await this.requestPermissionFlow({
+      return await this.requestPermissionFlow({
         type: 'spending',
         originator,
         spending: { satoshis, lineItems },
         reason,
         renewal: false
       })
-      if (granted) {
-        this.cachePermission(cacheKey, 0)
-      }
-      return granted
     }
   }
 
@@ -1102,7 +1087,7 @@ export class WalletPermissionsManager implements WalletInterface {
     }
 
     // 3) Let ensureProtocolPermission handle the rest.
-    const granted = await this.ensureProtocolPermission({
+    return await this.ensureProtocolPermission({
       originator,
       privileged: false,
       protocolID: [1, `action label ${label}`],
@@ -1111,10 +1096,6 @@ export class WalletPermissionsManager implements WalletInterface {
       seekPermission,
       usageType: 'generic'
     })
-    if (granted) {
-      this.cachePermission(cacheKey, 0)
-    }
-    return granted
   }
 
   /**

package/test/bsv-ts-sdk/LocalKVStore.test.ts

@@ -53,18 +53,22 @@ describe('LocalKVStore tests', () => {
   })
 
   test('4 promise test', async () => {
-    jest.useFakeTimers();
-    let resolveNewLock: () => void = () => {};
-    const newLock = new Promise<void>(resolve => { resolveNewLock = resolve; });
-    const t = Date.now();
-    setTimeout(() => { resolveNewLock(); }, 1000);
-    jest.advanceTimersByTime(1000);
-    await newLock;
-    const elapsed = Date.now() - t;
-    logger(`Elapsed time: ${elapsed} ms`);
-    expect(elapsed).toBeGreaterThanOrEqual(1000);
-    jest.useRealTimers();
-  });
+    jest.useFakeTimers()
+    let resolveNewLock: () => void = () => {}
+    const newLock = new Promise<void>(resolve => {
+      resolveNewLock = resolve
+    })
+    const t = Date.now()
+    setTimeout(() => {
+      resolveNewLock()
+    }, 1000)
+    jest.advanceTimersByTime(1000)
+    await newLock
+    const elapsed = Date.now() - t
+    logger(`Elapsed time: ${elapsed} ms`)
+    expect(elapsed).toBeGreaterThanOrEqual(1000)
+    jest.useRealTimers()
+  })
 
   test('5 set x 4 get set x 4 get', async () => {
     for (const { storage, wallet } of ctxs) {