@cofhe/sdk 0.6.0 → 0.7.0

package/acps/sealing.ts

@@ -0,0 +1,90 @@
+import nacl from 'tweetnacl';
+import { type Hex } from 'viem';
+import { fromHexString, toBeArray, toBigInt, toHexString, isBigIntOrNumber, isString } from './utils.js';
+
+/** 32-byte X25519 keys as bare hex (no 0x prefix) */
+const KEY_HEX_LENGTH = 64;
+
+export type EthEncryptedData = {
+  data: Uint8Array;
+  public_key: Uint8Array;
+  nonce: Uint8Array;
+};
+
+/**
+ * An X25519 sealing keypair, both halves 0x-prefixed 32-byte hex.
+ * The public key travels in the ACP (`sealingKey`); the private key never
+ * leaves the client (`sealingPrivateKey`).
+ */
+export type SealingKeyPair = {
+  privateKey: Hex;
+  publicKey: Hex;
+};
+
+/**
+ * Generates a new sealing keypair. A sealing key is used to encrypt data such
+ * that it can only be unsealed (decrypted) by the owner of the corresponding
+ * private key.
+ */
+export const GenerateSealingKey = (): SealingKeyPair => {
+  const sodiumKeypair = nacl.box.keyPair();
+
+  return {
+    privateKey: `0x${toHexString(sodiumKeypair.secretKey)}`,
+    publicKey: `0x${toHexString(sodiumKeypair.publicKey)}`,
+  };
+};
+
+/**
+ * Seals (encrypts) the provided message for a receiver with the specified public key.
+ *
+ * @param {bigint | number} value - The message to be encrypted.
+ * @param {string} publicKey - The public key of the intended recipient (with or without 0x prefix).
+ * @returns {EthEncryptedData} - The encrypted message.
+ * @throws Will throw if the provided publicKey or value do not meet defined preconditions.
+ */
+export const seal = (value: bigint | number, publicKey: string): EthEncryptedData => {
+  isString(publicKey);
+  isBigIntOrNumber(value);
+  assertKeyLength(publicKey, 'Public');
+
+  // generate ephemeral keypair
+  const ephemeralKeyPair = nacl.box.keyPair();
+
+  const nonce = nacl.randomBytes(nacl.box.nonceLength);
+
+  const encryptedMessage = nacl.box(toBeArray(value), nonce, fromHexString(publicKey), ephemeralKeyPair.secretKey);
+
+  return {
+    data: encryptedMessage,
+    public_key: ephemeralKeyPair.publicKey,
+    nonce: nonce,
+  };
+};
+
+/**
+ * Unseal (decrypt) data with a sealing private key (with or without 0x prefix).
+ * The ephemeral public key travels inside the payload, so the private key alone suffices.
+ */
+export const unsealWithPrivateKey = (privateKey: string, parsedData: EthEncryptedData): bigint => {
+  assertKeyLength(privateKey, 'Private');
+
+  const nonce = parsedData.nonce instanceof Uint8Array ? parsedData.nonce : new Uint8Array(parsedData.nonce);
+  const ephemPublicKey =
+    parsedData.public_key instanceof Uint8Array ? parsedData.public_key : new Uint8Array(parsedData.public_key);
+  const dataToDecrypt = parsedData.data instanceof Uint8Array ? parsedData.data : new Uint8Array(parsedData.data);
+
+  const decryptedMessage = nacl.box.open(dataToDecrypt, nonce, ephemPublicKey, fromHexString(privateKey));
+  if (!decryptedMessage) {
+    throw new Error('Failed to decrypt message');
+  }
+
+  return toBigInt(decryptedMessage);
+};
+
+const assertKeyLength = (key: string, kind: 'Private' | 'Public'): void => {
+  const bare = key.startsWith('0x') ? key.slice(2) : key;
+  if (bare.length !== KEY_HEX_LENGTH) {
+    throw new Error(`${kind} key must be of length ${KEY_HEX_LENGTH}`);
+  }
+};

package/acps/signature.ts

@@ -0,0 +1,89 @@
+import { type EIP712Message, type EIP712Types, type ACPPublic, type ACPSignaturePrimaryType } from './types.js';
+
+// Field order must match the on-chain ACP typehash strings exactly (see ACP.sol / ACPUtils)
+const ACPSignatureAllFields = [
+  { name: 'issuer', type: 'address' },
+  { name: 'expiration', type: 'uint64' },
+  { name: 'recipient', type: 'address' },
+  { name: 'revokerData', type: 'uint256' },
+  { name: 'revokerContract', type: 'address' },
+  { name: 'scope', type: 'uint8' },
+  { name: 'contracts', type: 'address[]' },
+  { name: 'handles', type: 'bytes32[]' },
+  { name: 'sealingKey', type: 'bytes32' },
+  { name: 'issuerSignature', type: 'bytes' },
+] as const;
+
+type ACPSignatureFieldOption = (typeof ACPSignatureAllFields)[number]['name'];
+
+export const SignatureTypes = {
+  ACPIssuerSelf: [
+    'issuer',
+    'expiration',
+    'recipient',
+    'revokerData',
+    'revokerContract',
+    'scope',
+    'contracts',
+    'handles',
+    'sealingKey',
+  ] satisfies ACPSignatureFieldOption[],
+  ACPIssuerShared: [
+    'issuer',
+    'expiration',
+    'recipient',
+    'revokerData',
+    'revokerContract',
+    'scope',
+    'contracts',
+    'handles',
+  ] satisfies ACPSignatureFieldOption[],
+  ACPRecipient: ['sealingKey', 'issuerSignature'] satisfies ACPSignatureFieldOption[],
+} as const;
+
+/**
+ * Get signature types and message for EIP712 signing
+ */
+export const getSignatureTypesAndMessage = <T extends ACPSignatureFieldOption>(
+  primaryType: ACPSignaturePrimaryType,
+  fields: T[] | readonly T[],
+  values: Pick<ACPPublic, T> & Partial<ACPPublic>
+): { types: EIP712Types; primaryType: string; message: EIP712Message } => {
+  const types = {
+    [primaryType]: ACPSignatureAllFields.filter((fieldType) => fields.includes(fieldType.name as T)),
+  };
+
+  const message: Record<T, string | string[] | number | number[] | boolean> = {} as Record<
+    T,
+    string | string[] | number | number[] | boolean
+  >;
+  fields.forEach((field) => {
+    if (field in values) {
+      message[field] = values[field];
+    }
+  });
+
+  return { types, primaryType, message: message as EIP712Message };
+};
+
+/**
+ * Signature utilities for ACP operations
+ */
+export const SignatureUtils = {
+  /**
+   * Get signature parameters for an ACP
+   */
+  getSignatureParams: (acp: ACPPublic, primaryType: ACPSignaturePrimaryType) => {
+    return getSignatureTypesAndMessage(primaryType, SignatureTypes[primaryType], acp);
+  },
+
+  /**
+   * Determine the required signature type based on acp type
+   */
+  getPrimaryType: (acpType: 'self' | 'sharing' | 'recipient'): ACPSignaturePrimaryType => {
+    if (acpType === 'self') return 'ACPIssuerSelf';
+    if (acpType === 'sharing') return 'ACPIssuerShared';
+    if (acpType === 'recipient') return 'ACPRecipient';
+    throw new Error(`Unknown acp type: ${acpType}`);
+  },
+};

package/acps/store.ts

@@ -0,0 +1,172 @@
+import { createStore } from 'zustand/vanilla';
+import { persist } from 'zustand/middleware';
+import { produce } from 'immer';
+import { type ACP, type SerializedACP } from './types.js';
+import { ACPUtils } from './acp.js';
+
+type ChainRecord<T> = Record<number, T>;
+type AccountRecord<T> = Record<string, T>;
+type HashRecord<T> = Record<string, T>;
+
+type ACPsStore = {
+  acps: ChainRecord<AccountRecord<HashRecord<SerializedACP | undefined>>>;
+  activeACPHash: ChainRecord<AccountRecord<string | undefined>>;
+};
+
+// Stores generated acps for each user, a hash indicating the active acp for each user
+// Can be used to create reactive hooks
+export const ACP_STORE_DEFAULTS: ACPsStore = {
+  acps: {},
+  activeACPHash: {},
+};
+
+/**
+ * Store version 3 = ACP with flattened sealing keys (sealingPrivateKey/sealingKey).
+ * Store version 2 = ACP (ACP V3). V2 acps are signed with retired EIP-712
+ * types and cannot verify on-chain anymore — the migration drops them rather
+ * than carrying dead entries (users re-create acps on next use).
+ */
+const ACP_STORE_VERSION = 3;
+
+export const _acpStore = createStore<ACPsStore>()(
+  persist(() => ACP_STORE_DEFAULTS, {
+    name: 'cofhesdk-acps',
+    version: ACP_STORE_VERSION,
+    migrate: (persistedState, version) => {
+      if (version < ACP_STORE_VERSION) return ACP_STORE_DEFAULTS;
+      return persistedState as ACPsStore;
+    },
+  })
+);
+
+export const clearStaleStore = () => {
+  // Any is used here because we do not have types of the previous store
+  const state = _acpStore.getState() as any;
+
+  // Check if the store has the expected structure
+  const hasExpectedStructure =
+    state &&
+    typeof state === 'object' &&
+    'acps' in state &&
+    'activeACPHash' in state &&
+    typeof state.acps === 'object' &&
+    typeof state.activeACPHash === 'object';
+
+  if (hasExpectedStructure) return;
+  // Invalid structure detected - clear the store
+  _acpStore.setState({ acps: {}, activeACPHash: {} });
+};
+
+export const getACP = (
+  chainId: number | undefined,
+  account: string | undefined,
+  hash: string | undefined
+): ACP | undefined => {
+  clearStaleStore();
+  if (chainId == null || account == null || hash == null) return;
+
+  const savedACP = _acpStore.getState().acps[chainId]?.[account]?.[hash];
+  if (savedACP == null) return;
+
+  return ACPUtils.deserialize(savedACP);
+};
+
+export const getActiveACP = (chainId: number | undefined, account: string | undefined): ACP | undefined => {
+  clearStaleStore();
+  if (chainId == null || account == null) return;
+
+  const activeACPHash = _acpStore.getState().activeACPHash[chainId]?.[account];
+  return getACP(chainId, account, activeACPHash);
+};
+
+export const getACPs = (chainId: number | undefined, account: string | undefined): Record<string, ACP> => {
+  clearStaleStore();
+  if (chainId == null || account == null) return {};
+
+  return Object.entries(_acpStore.getState().acps[chainId]?.[account] ?? {}).reduce(
+    (acc, [hash, acp]) => {
+      if (acp == undefined) return acc;
+      return { ...acc, [hash]: ACPUtils.deserialize(acp) };
+    },
+    {} as Record<string, ACP>
+  );
+};
+
+export const setACP = (chainId: number, account: string, acp: ACP) => {
+  clearStaleStore();
+  _acpStore.setState(
+    produce<ACPsStore>((state) => {
+      if (state.acps[chainId] == null) state.acps[chainId] = {};
+      if (state.acps[chainId][account] == null) state.acps[chainId][account] = {};
+      state.acps[chainId][account][acp.hash] = ACPUtils.serialize(acp);
+    })
+  );
+};
+
+export const removeACP = (chainId: number, account: string, hash: string) => {
+  clearStaleStore();
+  _acpStore.setState(
+    produce<ACPsStore>((state) => {
+      if (state.acps[chainId] == null) state.acps[chainId] = {};
+      if (state.activeACPHash[chainId] == null) state.activeACPHash[chainId] = {};
+
+      const accountACPs = state.acps[chainId][account];
+      if (accountACPs == null) return;
+
+      if (accountACPs[hash] == null) return;
+
+      if (state.activeACPHash[chainId][account] === hash) {
+        // if the active acp is the one to be removed - unset it
+        state.activeACPHash[chainId][account] = undefined;
+      }
+      // Remove the acp
+      accountACPs[hash] = undefined;
+    })
+  );
+};
+
+export const getActiveACPHash = (chainId: number | undefined, account: string | undefined): string | undefined => {
+  clearStaleStore();
+  if (chainId == null || account == null) return undefined;
+  return _acpStore.getState().activeACPHash[chainId]?.[account];
+};
+
+export const setActiveACPHash = (chainId: number, account: string, hash: string) => {
+  clearStaleStore();
+  _acpStore.setState(
+    produce<ACPsStore>((state) => {
+      if (state.activeACPHash[chainId] == null) state.activeACPHash[chainId] = {};
+      state.activeACPHash[chainId][account] = hash;
+    })
+  );
+};
+
+export const removeActiveACPHash = (chainId: number, account: string) => {
+  clearStaleStore();
+  _acpStore.setState(
+    produce<ACPsStore>((state) => {
+      if (state.activeACPHash[chainId]) state.activeACPHash[chainId][account] = undefined;
+    })
+  );
+};
+
+export const resetStore = () => {
+  clearStaleStore();
+  _acpStore.setState({ acps: {}, activeACPHash: {} });
+};
+
+export const acpStore = {
+  store: _acpStore,
+
+  getACP,
+  getActiveACP,
+  getACPs,
+  setACP,
+  removeACP,
+
+  getActiveACPHash,
+  setActiveACPHash,
+  removeActiveACPHash,
+
+  resetStore,
+};