@calimero-network/mero-js 19.2.0 → 19.3.0

package/dist/index.cjs

@@ -72,6 +72,7 @@ __export(index_exports, {
   parseAuthCallback: () => parseAuthCallback,
   probeNodeHealth: () => probeNodeHealth,
   signDeviceCert: () => signDeviceCert,
+  signLoginStatement: () => signLoginStatement,
   signMemberJoinOp: () => signMemberJoinOp,
   signWarrant: () => signWarrant,
   withCap: () => withCap,
@@ -3690,6 +3691,72 @@ async function signMemberJoinOp(input) {
   return hex(concat(signable, signature, unendorsed));
 }
 
+// src/login/login.ts
+var SIGN_DOMAIN2 = new TextEncoder().encode("calimero.auth.login.v1");
+var AUDIENCE_TAG = {
+  webOrigin: 0,
+  codeSigningId: 1,
+  cli: 2
+};
+function audienceBody(audience) {
+  const encoder = new TextEncoder();
+  switch (audience.kind) {
+    case "webOrigin":
+      return encoder.encode(audience.origin);
+    case "codeSigningId":
+      return encoder.encode(audience.id);
+    case "cli":
+      return new Uint8Array(0);
+  }
+}
+function audienceSigningBytes(audience) {
+  return concat(
+    Uint8Array.from([AUDIENCE_TAG[audience.kind]]),
+    audienceBody(audience)
+  );
+}
+function audienceWire(audience) {
+  const tag = Uint8Array.from([AUDIENCE_TAG[audience.kind]]);
+  if (audience.kind === "cli") {
+    return tag;
+  }
+  const body = audienceBody(audience);
+  return concat(tag, u32le(body.length), body);
+}
+async function signLoginStatement(input) {
+  const node = fromHex(input.node, "node", 32);
+  const challenge = fromHex(input.challenge, "challenge", 32);
+  const sessionKey = fromHex(input.sessionKey, "sessionKey", 32);
+  const key = await importSigningKey(input.deviceSecret);
+  const deviceKey = await derivePublicKey(input.deviceSecret);
+  const issuedAt = u64le(input.issuedAt);
+  const expiresAt = u64le(input.expiresAt);
+  const preimage = await domainHash(SIGN_DOMAIN2, [
+    node,
+    audienceSigningBytes(input.audience),
+    challenge,
+    sessionKey,
+    deviceKey,
+    issuedAt,
+    expiresAt
+  ]);
+  const signature = new Uint8Array(
+    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
+  );
+  return hex(
+    concat(
+      node,
+      audienceWire(input.audience),
+      challenge,
+      sessionKey,
+      deviceKey,
+      issuedAt,
+      expiresAt,
+      signature
+    )
+  );
+}
+
 // src/capabilities.ts
 var CAPABILITIES = {
   CAN_CREATE_CONTEXT: 1 << 0,