@docknetwork/wallet-sdk-wasm 1.7.0 → 1.7.6

package/src/services/credential/pex-helpers.js

@@ -5,10 +5,10 @@ export const EPSILON_INT = 1;
 
 export const MAX_DATE_PLACEHOLDER = 884541351600000;
 export const MIN_DATE_PLACEHOLDER = -17592186044415;
-export const MAX_INTEGER = 100 ** 9;
-export const MIN_INTEGER = -4294967295;
-export const MAX_NUMBER = 100 ** 5;
-export const MIN_NUMBER = -4294967294;
+export const MAX_INTEGER = Number.MAX_SAFE_INTEGER;
+export const MIN_INTEGER = Number.MIN_SAFE_INTEGER;
+export const MAX_NUMBER = Number.MAX_SAFE_INTEGER;
+export const MIN_NUMBER = Number.MIN_SAFE_INTEGER;
 
 /*
   PEX Filter rules:

package/src/services/credential/pex-helpers.test.js

@@ -302,7 +302,7 @@ describe('pex helpers', () => {
           {
             attributeName: 'credentialSubject.age',
             min: 0,
-            max: 10000000000,
+            max: Number.MAX_SAFE_INTEGER,
             proofRequestMax: undefined,
             proofRequestMin: 0,
             format: undefined,
@@ -357,7 +357,7 @@ describe('pex helpers', () => {
           {
             attributeName: 'credentialSubject.age',
             min: 0,
-            max: 10000000000,
+            max: Number.MAX_SAFE_INTEGER,
             proofRequestMax: undefined,
             proofRequestMin: 0,
             format: undefined,

package/src/services/edv/index.test.js

@@ -47,5 +47,234 @@ describe('EDVService', () => {
         expect(JSON.stringify(agreementKey)).toBe(derivedTestAgreementKey);
       });
     });
+
+    describe('deriveBiometricKey', () => {
+      it('should derive a key from biometric data', () => {
+        const biometricData = Buffer.from('mock-biometric-data');
+        const identifier = 'user@example.com';
+
+        const key = service.deriveBiometricKey(biometricData, identifier);
+
+        expect(key).toBeDefined();
+        expect(Buffer.isBuffer(key)).toBe(true);
+        expect(key.length).toBe(32); // HKDF_LENGTH
+      });
+
+      it('should produce consistent keys for same inputs', () => {
+        const biometricData = Buffer.from('mock-biometric-data');
+        const identifier = 'user@example.com';
+
+        const key1 = service.deriveBiometricKey(biometricData, identifier);
+        const key2 = service.deriveBiometricKey(biometricData, identifier);
+
+        expect(key1.equals(key2)).toBe(true);
+      });
+
+      it('should produce different keys for different identifiers', () => {
+        const biometricData = Buffer.from('mock-biometric-data');
+        const identifier1 = 'user1@example.com';
+        const identifier2 = 'user2@example.com';
+
+        const key1 = service.deriveBiometricKey(biometricData, identifier1);
+        const key2 = service.deriveBiometricKey(biometricData, identifier2);
+
+        expect(key1.equals(key2)).toBe(false);
+      });
+
+      it('should produce different keys for different biometric data', () => {
+        const biometricData1 = Buffer.from('mock-biometric-data-1');
+        const biometricData2 = Buffer.from('mock-biometric-data-2');
+        const identifier = 'user@example.com';
+
+        const key1 = service.deriveBiometricKey(biometricData1, identifier);
+        const key2 = service.deriveBiometricKey(biometricData2, identifier);
+
+        expect(key1.equals(key2)).toBe(false);
+      });
+    });
+
+    describe('deriveBiometricEncryptionKey', () => {
+      it('should derive encryption key and IV', async () => {
+        const biometricData = Buffer.from('mock-biometric-data');
+        const identifier = 'user@example.com';
+
+        const result = await service.deriveBiometricEncryptionKey(
+          biometricData,
+          identifier,
+        );
+
+        expect(result).toBeDefined();
+        expect(result.key).toBeDefined();
+        expect(result.iv).toBeDefined();
+        expect(Buffer.isBuffer(result.key)).toBe(true);
+        expect(Buffer.isBuffer(result.iv)).toBe(true);
+        expect(result.key.length).toBe(32); // HKDF_LENGTH
+        expect(result.iv.length).toBe(16); // AES-GCM IV length
+      });
+
+      it('should produce consistent keys but different IVs for same inputs', async () => {
+        const biometricData = Buffer.from('mock-biometric-data');
+        const identifier = 'user@example.com';
+
+        const result1 = await service.deriveBiometricEncryptionKey(
+          biometricData,
+          identifier,
+        );
+        const result2 = await service.deriveBiometricEncryptionKey(
+          biometricData,
+          identifier,
+        );
+
+        expect(result1.key.equals(result2.key)).toBe(true);
+        // IVs should be different (random)
+        expect(result1.iv.equals(result2.iv)).toBe(false);
+      });
+    });
+
+    describe('encryptMasterKey and decryptMasterKey', () => {
+      it('should encrypt and decrypt master key successfully', async () => {
+        const masterKey = new Uint8Array(32).fill(42);
+        const encryptionKey = Buffer.from(new Uint8Array(32).fill(1));
+        const iv = Buffer.from(new Uint8Array(16).fill(2));
+
+        const encrypted = await service.encryptMasterKey(
+          masterKey,
+          encryptionKey,
+          iv,
+        );
+        expect(encrypted).toBeDefined();
+        expect(encrypted instanceof Uint8Array).toBe(true);
+        expect(encrypted.length).toBeGreaterThan(0);
+
+        const decrypted = await service.decryptMasterKey(
+          encrypted,
+          encryptionKey,
+          iv,
+        );
+        expect(decrypted).toBeDefined();
+        expect(decrypted instanceof Uint8Array).toBe(true);
+        expect(new Uint8Array(decrypted)).toEqual(masterKey);
+      });
+
+      it('should fail to decrypt with wrong key', async () => {
+        const masterKey = new Uint8Array(32).fill(42);
+        const encryptionKey = Buffer.from(new Uint8Array(32).fill(1));
+        const wrongKey = Buffer.from(new Uint8Array(32).fill(99));
+        const iv = Buffer.from(new Uint8Array(16).fill(2));
+
+        const encrypted = await service.encryptMasterKey(
+          masterKey,
+          encryptionKey,
+          iv,
+        );
+
+        await expect(
+          service.decryptMasterKey(encrypted, wrongKey, iv),
+        ).rejects.toThrow('Decryption failed: Invalid key or corrupted data');
+      });
+
+      it('should fail to decrypt with wrong IV', async () => {
+        const masterKey = new Uint8Array(32).fill(42);
+        const encryptionKey = Buffer.from(new Uint8Array(32).fill(1));
+        const iv = Buffer.from(new Uint8Array(16).fill(2));
+        const wrongIv = Buffer.from(new Uint8Array(16).fill(99));
+
+        const encrypted = await service.encryptMasterKey(
+          masterKey,
+          encryptionKey,
+          iv,
+        );
+
+        await expect(
+          service.decryptMasterKey(encrypted, encryptionKey, wrongIv),
+        ).rejects.toThrow('Decryption failed: Invalid key or corrupted data');
+      });
+
+      it('should produce different ciphertext for same plaintext with different IVs', async () => {
+        const masterKey = new Uint8Array(32).fill(42);
+        const encryptionKey = Buffer.from(new Uint8Array(32).fill(1));
+        const iv1 = Buffer.from(new Uint8Array(16).fill(2));
+        const iv2 = Buffer.from(new Uint8Array(16).fill(3));
+
+        const encrypted1 = await service.encryptMasterKey(
+          masterKey,
+          encryptionKey,
+          iv1,
+        );
+        const encrypted2 = await service.encryptMasterKey(
+          masterKey,
+          encryptionKey,
+          iv2,
+        );
+
+        expect(encrypted1).not.toEqual(encrypted2);
+      });
+
+      it('should handle empty master key', async () => {
+        const masterKey = new Uint8Array(0);
+        const encryptionKey = Buffer.from(new Uint8Array(32).fill(1));
+        const iv = Buffer.from(new Uint8Array(16).fill(2));
+
+        const encrypted = await service.encryptMasterKey(
+          masterKey,
+          encryptionKey,
+          iv,
+        );
+        const decrypted = await service.decryptMasterKey(
+          encrypted,
+          encryptionKey,
+          iv,
+        );
+
+        expect(new Uint8Array(decrypted)).toEqual(masterKey);
+      });
+    });
+
+    describe('integration: biometric encryption workflow', () => {
+      it('should complete full encryption workflow', async () => {
+        const biometricData = Buffer.from('mock-biometric-data');
+        const identifier = 'user@example.com';
+        const masterKey = new Uint8Array(32).fill(123);
+
+        // Derive encryption key and IV from biometric data
+        const {key, iv} = await service.deriveBiometricEncryptionKey(
+          biometricData,
+          identifier,
+        );
+
+        // Encrypt master key
+        const encrypted = await service.encryptMasterKey(masterKey, key, iv);
+
+        // Decrypt master key
+        const decrypted = await service.decryptMasterKey(encrypted, key, iv);
+
+        // Verify decrypted matches original
+        expect(new Uint8Array(decrypted)).toEqual(masterKey);
+      });
+
+      it('should fail workflow with different biometric data', async () => {
+        const biometricData1 = Buffer.from('mock-biometric-data-1');
+        const biometricData2 = Buffer.from('mock-biometric-data-2');
+        const identifier = 'user@example.com';
+        const masterKey = new Uint8Array(32).fill(123);
+
+        // Encrypt with first biometric data
+        const {key: key1, iv} = await service.deriveBiometricEncryptionKey(
+          biometricData1,
+          identifier,
+        );
+        const encrypted = await service.encryptMasterKey(masterKey, key1, iv);
+
+        // Try to decrypt with second biometric data (should fail)
+        const {key: key2} = await service.deriveBiometricEncryptionKey(
+          biometricData2,
+          identifier,
+        );
+
+        await expect(
+          service.decryptMasterKey(encrypted, key2, iv),
+        ).rejects.toThrow('Decryption failed: Invalid key or corrupted data');
+      });
+    });
   });
 });

package/src/services/edv/service-rpc.js

@@ -38,4 +38,27 @@ export class EDVServiceRpc extends RpcService {
   delete(params: any) {
     return this.call('delete', params);
   }
+
+  deriveBiometricKey(biometricData: Buffer, identifier: string) {
+    return this.call('deriveBiometricKey', {biometricData, identifier});
+  }
+
+  deriveBiometricEncryptionKey(biometricData: Buffer, identifier: string) {
+    return this.call('deriveBiometricEncryptionKey', {
+      biometricData,
+      identifier,
+    });
+  }
+
+  encryptMasterKey(masterKey: Uint8Array, encryptionKey: Buffer, iv: Buffer) {
+    return this.call('encryptMasterKey', {masterKey, encryptionKey, iv});
+  }
+
+  decryptMasterKey(
+    encryptedKey: Uint8Array,
+    decryptionKey: Buffer,
+    iv: Buffer,
+  ) {
+    return this.call('decryptMasterKey', {encryptedKey, decryptionKey, iv});
+  }
 }

package/src/services/edv/service.ts

@@ -17,6 +17,11 @@ import {getKeypairFromDoc} from '@docknetwork/universal-wallet/methods/keypairs'
 import {logger} from '@docknetwork/wallet-sdk-data-store/src/logger';
 import {didService} from '@docknetwork/wallet-sdk-wasm/src/services/dids/service';
 import {Ed25519Keypair} from '@docknetwork/credential-sdk/keypairs';
+import hkdf from 'futoin-hkdf';
+import crypto from '@docknetwork/universal-wallet/crypto';
+
+export const HKDF_LENGTH = 32;
+export const HKDF_HASH = 'SHA-256';
 
 /**
  * Service class for managing Encrypted Data Vaults
@@ -39,6 +44,10 @@ export class EDVService {
     EDVService.prototype.update,
     EDVService.prototype.insert,
     EDVService.prototype.delete,
+    EDVService.prototype.deriveBiometricKey,
+    EDVService.prototype.deriveBiometricEncryptionKey,
+    EDVService.prototype.encryptMasterKey,
+    EDVService.prototype.decryptMasterKey,
   ];
 
   /**
@@ -269,6 +278,116 @@ export class EDVService {
   delete(params: any) {
     return this.storageInterface.delete(params);
   }
+
+  /**
+   * Derives a key from biometric data using HKDF
+   * @param {Buffer} biometricData - Biometric data from provider
+   * @param {string} identifier - User's identifier as salt (email, phone number, etc.)
+   * @returns {Buffer} Derived key
+   * @example
+   * const key = edvService.deriveBiometricKey(biometricData, 'user@example.com');
+   */
+  deriveBiometricKey(biometricData: Buffer, identifier: string): Buffer {
+    const salt = identifier;
+    return hkdf(biometricData, HKDF_LENGTH, { salt, hash: HKDF_HASH });
+  }
+
+  /**
+   * Generates a key for encrypting/decrypting the master key
+   * @param {Buffer} biometricData - Biometric data from provider
+   * @param {string} identifier - User's identifier as salt (email, phone number, etc.)
+   * @returns {Promise<Object>} Encryption key and IV for AES encryption
+   * @returns {Buffer} returns.key - Encryption key
+   * @returns {Buffer} returns.iv - Initialization vector
+   * @example
+   * const { key, iv } = await edvService.deriveBiometricEncryptionKey(biometricData, 'user@example.com');
+   */
+  async deriveBiometricEncryptionKey(
+    biometricData: Buffer,
+    identifier: string
+  ): Promise<{ key: Buffer; iv: Buffer }> {
+    const key = this.deriveBiometricKey(biometricData, identifier);
+    const randomBytes = crypto.getRandomValues(new Uint8Array(16));
+    const iv = Buffer.from(randomBytes);
+
+    return {
+      key,
+      iv
+    };
+  }
+
+  /**
+   * Encrypts the master key using a key derived from biometric data
+   * @param {Uint8Array} masterKey - The CloudWalletVault master key to encrypt
+   * @param {Buffer} encryptionKey - Key derived from biometric data
+   * @param {Buffer} iv - Initialization vector
+   * @returns {Promise<Uint8Array>} Encrypted master key
+   * @example
+   * const encrypted = await edvService.encryptMasterKey(masterKey, encryptionKey, iv);
+   */
+  async encryptMasterKey(
+    masterKey: Uint8Array,
+    encryptionKey: Buffer,
+    iv: Buffer
+  ): Promise<Uint8Array> {
+    const keyData = new Uint8Array(encryptionKey);
+    const ivData = new Uint8Array(iv);
+
+    const key = await crypto.subtle.importKey(
+      'raw',
+      keyData,
+      { name: 'AES-GCM' },
+      false,
+      ['encrypt']
+    );
+
+    const encryptedBuffer = await crypto.subtle.encrypt(
+      { name: 'AES-GCM', iv: ivData },
+      key,
+      masterKey
+    );
+
+    return new Uint8Array(encryptedBuffer);
+  }
+
+  /**
+   * Decrypts the master key using biometric-derived key
+   * @param {Uint8Array} encryptedKey - The encrypted master key
+   * @param {Buffer} decryptionKey - Key derived from biometric data
+   * @param {Buffer} iv - Initialization vector
+   * @returns {Promise<Uint8Array>} The decrypted master key
+   * @throws {Error} If decryption fails
+   * @example
+   * const masterKey = await edvService.decryptMasterKey(encryptedKey, decryptionKey, iv);
+   */
+  async decryptMasterKey(
+    encryptedKey: Uint8Array,
+    decryptionKey: Buffer,
+    iv: Buffer
+  ): Promise<Uint8Array> {
+    try {
+      const keyData = new Uint8Array(decryptionKey);
+      const ivData = new Uint8Array(iv);
+
+      const key = await crypto.subtle.importKey(
+        'raw',
+        keyData,
+        { name: 'AES-GCM' },
+        false,
+        ['decrypt']
+      );
+
+      const decryptedBuffer = await crypto.subtle.decrypt(
+        { name: 'AES-GCM', iv: ivData },
+        key,
+        encryptedKey
+      );
+
+      return new Uint8Array(decryptedBuffer);
+    } catch (error) {
+      throw new Error('Decryption failed: Invalid key or corrupted data');
+    }
+  }
 }
 
 /**

package/src/services/pex/config.ts

@@ -7,6 +7,10 @@ export const validation = {
     assert(params.credentials, 'credentials is required');
     assert(params.presentationDefinition, 'presentationDefinition is required');
   },
+  evaluateCredentials: (params: EvaluateCredentialsParams) => {
+    assert(params.credentials, 'credentials is required');
+    assert(params.presentationDefinition, 'presentationDefinition is required');
+  },
   evaluatePresentation: (params: EvaluatePresentationParams) => {
     assert(params.presentation, 'presentation is required');
     assert(params.presentationDefinition, 'presentationDefinition is required');

package/src/services/pex/service-rpc.js

@@ -24,4 +24,8 @@ export class PEXServiceRPC extends RpcService {
   async presentationFrom(params: CreatePresentationParams) {
     return this.call('presentationFrom', params);
   }
+
+  async isCredentialSelectionValid(params: EvaluateCredentialsParams) {
+    return this.call('isCredentialSelectionValid', params);
+  }
 }

package/src/services/pex/service.ts

@@ -78,6 +78,7 @@ class PEXService {
     PEXService.prototype.filterCredentials,
     PEXService.prototype.evaluatePresentation,
     PEXService.prototype.presentationFrom,
+    PEXService.prototype.isCredentialSelectionValid,
   ];
 
   filterCredentials(params: FilterCredentialsParams) {
@@ -92,6 +93,18 @@ class PEXService {
     return result;
   }
 
+  isCredentialSelectionValid(params: EvaluateCredentialsParams) {
+    validation.evaluateCredentials(params);
+    const {credentials, presentationDefinition, holderDIDs} = params;
+    const result = pex.selectFrom(
+      removeOptionalAttribute(presentationDefinition),
+      credentials,
+      holderDIDs,
+    );
+
+    return result.errors.length === 0;
+  }
+
   evaluatePresentation(params: EvaluatePresentationParams) {
     validation.evaluatePresentation(params);
     const {presentation, presentationDefinition} = params;