@bsv/wallet-toolbox 1.7.14 → 1.7.15

package/mobile/node_modules/@bsv/sdk/src/auth/utils/__tests/cryptononce.test.ts

@@ -0,0 +1,146 @@
+import { PrivateKey, Utils } from '../../../primitives/index'
+import { WalletInterface } from '../../../wallet/Wallet.interfaces'
+import { createNonce } from '../../../auth/utils/createNonce'
+import { verifyNonce } from '../../../auth/utils/verifyNonce'
+import { CompletedProtoWallet } from '../../../auth/certificates/__tests/CompletedProtoWallet'
+
+describe('createNonce', () => {
+  let mockWallet: WalletInterface
+
+  beforeEach(() => {
+    mockWallet = {
+      createHmac: jest.fn().mockResolvedValue({ hmac: new Uint8Array(16) })
+    } as unknown as WalletInterface
+  })
+
+  afterEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('throws an error if wallet fails to create HMAC', async () => {
+    // Mock failure of HMAC creation
+    (mockWallet.createHmac as jest.Mock).mockRejectedValue(
+      new Error('Failed to create HMAC')
+    )
+
+    await expect(createNonce(mockWallet)).rejects.toThrow(
+      'Failed to create HMAC'
+    )
+  })
+
+  it('creates a 256-bit nonce', async () => {
+    const nonce = await createNonce(mockWallet)
+    expect(Buffer.from(nonce, 'base64').byteLength).toEqual(32)
+  })
+})
+
+describe('verifyNonce', () => {
+  let mockWallet: WalletInterface
+
+  beforeEach(() => {
+    mockWallet = {
+      createHmac: jest.fn().mockResolvedValue({ hmac: new Uint8Array(16) }),
+      verifyHmac: jest.fn().mockResolvedValue({ valid: true })
+    } as unknown as WalletInterface
+  })
+
+  afterEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('does not verify an invalid nonce', async () => {
+    (mockWallet.verifyHmac as jest.Mock).mockResolvedValue({ valid: false })
+
+    const nonce = await createNonce(mockWallet)
+    await expect(verifyNonce(nonce + 'ABC', mockWallet)).rejects.toThrow(
+    /Invalid base64 padding|Invalid base64/i
+  )
+    await expect(verifyNonce(nonce + '=', mockWallet)).resolves.toEqual(false)
+    await expect(
+      verifyNonce(
+        Buffer.from(
+          nonce + Buffer.from('extra').toString('base64'),
+          'base64'
+        ).toString('base64'),
+        mockWallet
+      )
+    ).resolves.toEqual(false)
+  })
+
+  it('returns false for an invalid HMAC verification', async () => {
+    (mockWallet.verifyHmac as jest.Mock).mockResolvedValue({ valid: false })
+
+    const nonce = await createNonce(mockWallet)
+    await expect(verifyNonce(nonce, mockWallet)).resolves.toEqual(false)
+  })
+
+  it('verifies a 256-bit nonce', async () => {
+    (mockWallet.verifyHmac as jest.Mock).mockResolvedValue({ valid: true })
+
+    const nonce1 = await createNonce(mockWallet)
+    const nonce2 = await createNonce(mockWallet)
+
+    expect(Buffer.from(nonce1, 'base64').byteLength).toEqual(32)
+    expect(Buffer.from(nonce2, 'base64').byteLength).toEqual(32)
+
+    await expect(verifyNonce(nonce1, mockWallet)).resolves.toEqual(true)
+    await expect(verifyNonce(nonce2, mockWallet)).resolves.toEqual(true)
+  })
+
+  it('verifies nonce using real createHmac and verifyHmac', async () => {
+    const realWallet = new CompletedProtoWallet(PrivateKey.fromRandom())
+
+    const nonce = await createNonce(realWallet)
+    const isValid = await verifyNonce(nonce, realWallet)
+
+    expect(isValid).toEqual(true)
+  })
+
+  it('SerialNumber use-case', async () => {
+    const clientWallet = new CompletedProtoWallet(PrivateKey.fromRandom())
+    const serverWallet = new CompletedProtoWallet(PrivateKey.fromRandom())
+
+    // Client creates a random nonce that the server can verify
+    const clientNonce = await createNonce(
+      clientWallet,
+      (await serverWallet.getPublicKey({ identityKey: true })).publicKey
+    )
+    // The server verifies the client created the nonce provided
+    await verifyNonce(
+      clientNonce,
+      serverWallet,
+      (await clientWallet.getPublicKey({ identityKey: true })).publicKey
+    )
+    // Server creates a random nonce that the client can verify
+    const serverNonce = await createNonce(
+      serverWallet,
+      (await clientWallet.getPublicKey({ identityKey: true })).publicKey
+    )
+    // The server compute a serial number from the client and server nonce
+    const { hmac: serialNumber } = await serverWallet.createHmac({
+      data: Utils.toArray(clientNonce + serverNonce, 'utf8'),
+      protocolID: [2, 'certificate creation'],
+      keyID: serverNonce + clientNonce,
+      counterparty: (await clientWallet.getPublicKey({ identityKey: true }))
+        .publicKey
+    })
+
+    // Client verifies server's nonce
+    await verifyNonce(
+      serverNonce,
+      clientWallet,
+      (await serverWallet.getPublicKey({ identityKey: true })).publicKey
+    )
+
+    // Client verifies the server included their nonce
+    const { valid } = await clientWallet.verifyHmac({
+      hmac: serialNumber,
+      data: Utils.toArray(clientNonce + serverNonce, 'utf8'),
+      protocolID: [2, 'certificate creation'],
+      keyID: serverNonce + clientNonce,
+      counterparty: (await serverWallet.getPublicKey({ identityKey: true }))
+        .publicKey
+    })
+    expect(valid).toEqual(true)
+  })
+})

package/mobile/node_modules/@bsv/sdk/src/auth/utils/__tests/getVerifiableCertificates.test.ts

@@ -0,0 +1,152 @@
+import { WalletInterface } from '../../../wallet/Wallet.interfaces'
+import { getVerifiableCertificates } from '../../../auth/utils/getVerifiableCertificates'
+import { RequestedCertificateSet } from '../../../auth/types'
+import { VerifiableCertificate } from '../../../auth/certificates/VerifiableCertificate'
+
+describe('getVerifiableCertificates', () => {
+  let mockWallet: WalletInterface
+  let requestedCertificates: RequestedCertificateSet
+  let verifierIdentityKey: string
+
+  beforeEach(() => {
+    mockWallet = {
+      listCertificates: jest.fn(),
+      proveCertificate: jest.fn()
+    } as unknown as WalletInterface
+
+    requestedCertificates = {
+      certifiers: ['certifier1', 'certifier2'],
+      types: {
+        certType1: ['field1', 'field2'],
+        certType2: ['field3']
+      }
+    }
+
+    verifierIdentityKey = 'verifier_public_key'
+  })
+
+  it('retrieves matching certificates based on requested set', async () => {
+    const mockCertificate = {
+      type: 'certType1',
+      serialNumber: 'serial1',
+      subject: 'subject1',
+      certifier: 'certifier1',
+      revocationOutpoint: 'outpoint1',
+      fields: { field1: 'encryptedData1', field2: 'encryptedData2' },
+      signature: 'signature1'
+    };
+
+    (mockWallet.listCertificates as jest.Mock).mockResolvedValue({
+      certificates: [mockCertificate]
+    });
+    (mockWallet.proveCertificate as jest.Mock).mockResolvedValue({
+      keyringForVerifier: { field1: 'key1', field2: 'key2' }
+    })
+
+    const result = await getVerifiableCertificates(
+      mockWallet,
+      requestedCertificates,
+      verifierIdentityKey
+    )
+
+    expect(mockWallet.listCertificates).toHaveBeenCalledWith({
+      certifiers: requestedCertificates.certifiers,
+      types: Object.keys(requestedCertificates.types)
+    }, undefined)
+
+    expect(mockWallet.proveCertificate).toHaveBeenCalledWith({
+      certificate: mockCertificate,
+      fieldsToReveal: requestedCertificates.types[mockCertificate.type],
+      verifier: verifierIdentityKey
+    }, undefined)
+
+    expect(result).toHaveLength(1)
+    expect(result[0]).toBeInstanceOf(VerifiableCertificate)
+    expect(result[0]).toMatchObject({
+      type: 'certType1',
+      serialNumber: 'serial1',
+      subject: 'subject1',
+      certifier: 'certifier1',
+      revocationOutpoint: 'outpoint1',
+      fields: { field1: 'encryptedData1', field2: 'encryptedData2' },
+      signature: 'signature1',
+      keyring: { field1: 'key1', field2: 'key2' }
+    })
+  })
+
+  it('returns an empty array when no matching certificates are found', async () => {
+    (mockWallet.listCertificates as jest.Mock).mockResolvedValue({
+      certificates: []
+    })
+
+    const result = await getVerifiableCertificates(
+      mockWallet,
+      requestedCertificates,
+      verifierIdentityKey
+    )
+
+    expect(result).toEqual([])
+    expect(mockWallet.listCertificates).toHaveBeenCalled()
+    expect(mockWallet.proveCertificate).not.toHaveBeenCalled()
+  })
+
+  it('propagates errors from listCertificates', async () => {
+    (mockWallet.listCertificates as jest.Mock).mockRejectedValue(
+      new Error('listCertificates failed')
+    )
+
+    await expect(
+      getVerifiableCertificates(
+        mockWallet,
+        requestedCertificates,
+        verifierIdentityKey
+      )
+    ).rejects.toThrow('listCertificates failed')
+  })
+
+  it('propagates errors from proveCertificate', async () => {
+    const mockCertificate = {
+      type: 'certType1',
+      serialNumber: 'serial1',
+      subject: 'subject1',
+      certifier: 'certifier1',
+      revocationOutpoint: 'outpoint1',
+      fields: { field1: 'encryptedData1', field2: 'encryptedData2' },
+      signature: 'signature1'
+    };
+
+    (mockWallet.listCertificates as jest.Mock).mockResolvedValue({
+      certificates: [mockCertificate]
+    });
+    (mockWallet.proveCertificate as jest.Mock).mockRejectedValue(
+      new Error('proveCertificate failed')
+    )
+
+    await expect(
+      getVerifiableCertificates(
+        mockWallet,
+        requestedCertificates,
+        verifierIdentityKey
+      )
+    ).rejects.toThrow('proveCertificate failed')
+  })
+
+  it('handles empty requested certificates gracefully', async () => {
+    requestedCertificates = { certifiers: [], types: {} };
+    (mockWallet.listCertificates as jest.Mock).mockResolvedValue({
+      certificates: []
+    })
+
+    const result = await getVerifiableCertificates(
+      mockWallet,
+      requestedCertificates,
+      verifierIdentityKey
+    )
+
+    expect(result).toEqual([])
+    expect(mockWallet.listCertificates).toHaveBeenCalledWith({
+      certifiers: [],
+      types: []
+    }, undefined)
+  })
+})

package/mobile/node_modules/@bsv/sdk/src/auth/utils/__tests/validateCertificates.test.ts

@@ -0,0 +1,164 @@
+import { validateCertificates } from '../../../auth/utils/validateCertificates'
+import { VerifiableCertificate } from '../../../auth/certificates/VerifiableCertificate'
+import { ProtoWallet } from '../../../wallet/index'
+import { PrivateKey } from '../../../primitives/index'
+
+let mockVerify = jest.fn(async () => await Promise.resolve(true))
+let mockDecryptFields = jest.fn(
+  async () => await Promise.resolve({ field1: 'decryptedValue1' })
+)
+const mockInstances: Array<{
+  type: string
+  serialNumber: string
+  subject: string
+  certifier: string
+  revocationOutpoint: string
+  fields: Record<string, string>
+  decryptedFields: Record<string, unknown>
+  verify: jest.Mock<Promise<boolean>>
+  decryptFields: jest.Mock<Promise<Record<string, string>>> // ✅ Explicit return type
+}> = []
+
+jest.mock('../../../auth/certificates/VerifiableCertificate', () => {
+  return {
+    VerifiableCertificate: jest.fn().mockImplementation(() => {
+      const instance = {
+        type: 'requested_type',
+        serialNumber: 'valid_serial',
+        subject: 'valid_subject',
+        certifier: 'valid_certifier',
+        revocationOutpoint: 'outpoint',
+        fields: { field1: 'encryptedData1' },
+        decryptedFields: {},
+        verify: mockVerify,
+        decryptFields: mockDecryptFields
+      }
+      mockInstances.push(instance)
+      return instance
+    })
+  }
+})
+
+describe('validateCertificates', () => {
+  let verifierWallet
+  let message
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockInstances.length = 0 // Clear tracked instances
+
+    // Reset state
+    mockVerify = jest.fn(async () => await Promise.resolve(true))
+    mockDecryptFields = jest.fn(
+      async () => await Promise.resolve({ field1: 'decryptedValue1' })
+    )
+
+    verifierWallet = new ProtoWallet(new PrivateKey(1))
+    message = {
+      identityKey: 'valid_subject',
+      certificates: [
+        {
+          type: 'requested_type',
+          serialNumber: 'valid_serial',
+          subject: 'valid_subject',
+          certifier: 'valid_certifier',
+          revocationOutpoint: 'outpoint',
+          fields: { field1: 'encryptedData1' },
+          decryptedFields: {}
+        }
+      ]
+    }
+  })
+
+  it('completes without errors for valid input', async () => {
+    await expect(
+      validateCertificates(verifierWallet, message)
+    ).resolves.not.toThrow()
+
+    expect(VerifiableCertificate).toHaveBeenCalledTimes(
+      message.certificates.length
+    )
+    expect(mockVerify).toHaveBeenCalledTimes(message.certificates.length)
+    expect(mockDecryptFields).toHaveBeenCalledWith(verifierWallet, undefined, undefined, undefined)
+  })
+
+  it('throws an error for mismatched identity key', async () => {
+    message.identityKey = 'different_subject'
+
+    await expect(validateCertificates(verifierWallet, message)).rejects.toThrow(
+      'The subject of one of your certificates ("valid_subject") is not the same as the request sender ("different_subject").'
+    )
+  })
+
+  it('throws an error if certificate signature is invalid', async () => {
+    mockVerify.mockResolvedValueOnce(false)
+
+    await expect(validateCertificates(verifierWallet, message)).rejects.toThrow(
+      'The signature for the certificate with serial number valid_serial is invalid!'
+    )
+  })
+
+  it('throws an error for unrequested certifier', async () => {
+    const certificatesRequested = {
+      certifiers: ['another_certifier'],
+      types: { requested_type: ['field1'] }
+    }
+
+    await expect(
+      validateCertificates(verifierWallet, message, certificatesRequested)
+    ).rejects.toThrow(
+      'Certificate with serial number valid_serial has an unrequested certifier: valid_certifier'
+    )
+  })
+
+  it('throws an error for unrequested certificate type', async () => {
+    const certificatesRequested = {
+      certifiers: ['valid_certifier'],
+      types: { another_type: ['field1'] }
+    }
+
+    await expect(
+      validateCertificates(verifierWallet, message, certificatesRequested)
+    ).rejects.toThrow('Certificate with type requested_type was not requested')
+  })
+
+  it('decrypts fields without throwing errors', async () => {
+    await expect(
+      validateCertificates(verifierWallet, message)
+    ).resolves.not.toThrow()
+    for (const instance of mockInstances) {
+      expect(instance.decryptFields).toHaveBeenCalledWith(verifierWallet, undefined, undefined, undefined)
+    }
+  })
+
+  it('throws an error if a field decryption fails', async () => {
+    mockDecryptFields.mockRejectedValue(new Error('Decryption failed'))
+    await expect(validateCertificates(verifierWallet, message)).rejects.toThrow(
+      'Decryption failed'
+    )
+  })
+
+  it('handles multiple certificates properly', async () => {
+    const anotherCertificate = {
+      type: 'requested_type',
+      serialNumber: 'another_serial',
+      subject: 'valid_subject',
+      certifier: 'valid_certifier',
+      revocationOutpoint: 'outpoint',
+      fields: { field1: 'encryptedData1' },
+      decryptedFields: {}
+    }
+
+    message.certificates.push(anotherCertificate)
+
+    await expect(
+      validateCertificates(verifierWallet, message)
+    ).resolves.not.toThrow()
+
+    expect(VerifiableCertificate).toHaveBeenCalledTimes(2)
+    expect(mockVerify).toHaveBeenCalledTimes(2)
+    for (const instance of mockInstances) {
+      expect(instance.decryptFields).toHaveBeenCalledWith(verifierWallet, undefined, undefined, undefined)
+    }
+  })
+})

package/mobile/node_modules/@bsv/sdk/src/auth/utils/createNonce.ts

@@ -0,0 +1,33 @@
+import {
+  WalletInterface,
+  WalletCounterparty,
+  Base64String,
+  OriginatorDomainNameStringUnder250Bytes
+} from '../../wallet/Wallet.interfaces.js'
+import * as Utils from '../../primitives/utils.js'
+import Random from '../../primitives/Random.js'
+
+/**
+ * Creates a nonce derived from a wallet
+ * @param wallet
+ * @param counterparty - The counterparty to the nonce creation. Defaults to 'self'.
+ * @returns A random nonce derived with a wallet
+ */
+export async function createNonce(
+  wallet: WalletInterface,
+  counterparty: WalletCounterparty = 'self',
+  originator?: OriginatorDomainNameStringUnder250Bytes
+): Promise<Base64String> {
+  // Generate 16 random bytes for the first half of the data
+  const firstHalf = Random(16)
+  // Create an sha256 HMAC
+  const { hmac } = await wallet.createHmac({
+    protocolID: [2, 'server hmac'],
+    keyID: Utils.toUTF8(firstHalf),
+    data: firstHalf,
+    counterparty
+  }, originator)
+  // Concatenate firstHalf and secondHalf as the nonce bytes
+  const nonceBytes = [...firstHalf, ...hmac]
+  return Utils.toBase64(nonceBytes)
+}

package/mobile/node_modules/@bsv/sdk/src/auth/utils/getVerifiableCertificates.ts

@@ -0,0 +1,46 @@
+import { VerifiableCertificate } from '../certificates/VerifiableCertificate.js'
+import { OriginatorDomainNameStringUnder250Bytes, WalletInterface } from '../../wallet/Wallet.interfaces.js'
+import { RequestedCertificateSet } from '../types.js'
+
+/**
+ * Retrieves an array of verifiable certificates based on the request.
+ *
+ * @private
+ * @param {RequestedCertificateSet} requestedCertificates - The set of certificates requested by the peer.
+ * @param {string} verifierIdentityKey - The public key of the verifier requesting the certificates.
+ * @returns {Promise<VerifiableCertificate[]>} An array of verifiable certificates.
+ */
+export const getVerifiableCertificates = async (
+  wallet: WalletInterface,
+  requestedCertificates: RequestedCertificateSet,
+  verifierIdentityKey: string,
+  originator?: OriginatorDomainNameStringUnder250Bytes
+): Promise<VerifiableCertificate[]> => {
+  // Find matching certificates we have
+  // Note: This may return multiple certificates that match the correct type.
+  const matchingCertificates = await wallet.listCertificates({
+    certifiers: requestedCertificates.certifiers,
+    types: Object.keys(requestedCertificates.types)
+  }, originator)
+
+  // For each certificate requested, create a verifiable cert with selectively revealed fields
+  return await Promise.all(
+    matchingCertificates.certificates.map(async (certificate) => {
+      const { keyringForVerifier } = await wallet.proveCertificate({
+        certificate,
+        fieldsToReveal: requestedCertificates.types[certificate.type],
+        verifier: verifierIdentityKey
+      }, originator)
+      return new VerifiableCertificate(
+        certificate.type,
+        certificate.serialNumber,
+        certificate.subject,
+        certificate.certifier,
+        certificate.revocationOutpoint,
+        certificate.fields,
+        keyringForVerifier,
+        certificate.signature
+      )
+    })
+  )
+}

package/mobile/node_modules/@bsv/sdk/src/auth/utils/index.ts

@@ -0,0 +1,4 @@
+export * from './verifyNonce.js'
+export * from './createNonce.js'
+export * from './getVerifiableCertificates.js'
+export * from './validateCertificates.js'

package/mobile/node_modules/@bsv/sdk/src/auth/utils/validateCertificates.ts

@@ -0,0 +1,73 @@
+import { OriginatorDomainNameStringUnder250Bytes, WalletInterface } from '../../wallet/index.js'
+import { AuthMessage, RequestedCertificateSet } from '../types.js'
+import { VerifiableCertificate } from '../certificates/VerifiableCertificate.js'
+
+/**
+ * Validates and processes the certificates received from a peer.
+ *
+ * @private
+ * @param {AuthMessage} message - The message containing the certificates to validate.
+ * @returns {Promise<void>}
+ * @throws Will throw an error if certificate validation or field decryption fails.
+ */
+export const validateCertificates = async (
+  verifierWallet: WalletInterface,
+  message: AuthMessage,
+  certificatesRequested?: RequestedCertificateSet,
+  originator?: OriginatorDomainNameStringUnder250Bytes
+): Promise<void> => {
+  if ((message.certificates == null) || message.certificates.length === 0) {
+    throw new Error('No certificates were provided in the AuthMessage.')
+  }
+
+  await Promise.all(
+    message.certificates.map(async (incomingCert: VerifiableCertificate) => {
+      if (incomingCert.subject !== message.identityKey) {
+        throw new Error(
+          `The subject of one of your certificates ("${incomingCert.subject}") is not the same as the request sender ("${message.identityKey}").`
+        )
+      }
+
+      // Verify Certificate structure and signature
+      const certToVerify = new VerifiableCertificate(
+        incomingCert.type,
+        incomingCert.serialNumber,
+        incomingCert.subject,
+        incomingCert.certifier,
+        incomingCert.revocationOutpoint,
+        incomingCert.fields,
+        incomingCert.keyring,
+        incomingCert.signature
+      )
+      const isValidCert = await certToVerify.verify()
+      if (!isValidCert) {
+        throw new Error(
+          `The signature for the certificate with serial number ${certToVerify.serialNumber} is invalid!`
+        )
+      }
+
+      // Check if the certificate matches requested certifiers, types, and fields
+      if (certificatesRequested != null) {
+        const { certifiers, types } = certificatesRequested
+
+        // Check certifier matches
+        if (!certifiers.includes(certToVerify.certifier)) {
+          throw new Error(
+            `Certificate with serial number ${certToVerify.serialNumber} has an unrequested certifier: ${certToVerify.certifier}`
+          )
+        }
+
+        // Check type and fields match requested
+        const requestedFields = types[certToVerify.type]
+        if (requestedFields == null) {
+          throw new Error(
+            `Certificate with type ${certToVerify.type} was not requested`
+          )
+        }
+      }
+
+      // Attempt to decrypt fields
+      await certToVerify.decryptFields(verifierWallet, undefined, undefined, originator)
+    })
+  )
+}

package/mobile/node_modules/@bsv/sdk/src/auth/utils/verifyNonce.ts

@@ -0,0 +1,34 @@
+import * as Utils from '../../primitives/utils.js'
+import { WalletInterface, WalletCounterparty, Base64String, OriginatorDomainNameStringUnder250Bytes } from '../../wallet/Wallet.interfaces.js'
+
+/**
+ * Verifies a nonce derived from a wallet
+ * @param nonce - A nonce to verify as a base64 string.
+ * @param wallet
+ * @param counterparty - The counterparty to the nonce creation. Defaults to 'self'.
+ * @returns The status of the validation
+ */
+export async function verifyNonce(
+  nonce: Base64String,
+  wallet: WalletInterface,
+  counterparty: WalletCounterparty = 'self',
+  originator?: OriginatorDomainNameStringUnder250Bytes
+): Promise<boolean> {
+  // Convert nonce from base64 string to Uint8Array
+  const buffer = Utils.toArray(nonce, 'base64')
+
+  // Split the nonce buffer
+  const data = buffer.slice(0, 16)
+  const hmac = buffer.slice(16)
+
+  // Calculate the HMAC
+  const { valid } = await wallet.verifyHmac({
+    data,
+    hmac,
+    protocolID: [2, 'server hmac'],
+    keyID: Utils.toUTF8(data),
+    counterparty
+  }, originator)
+
+  return valid
+}