@duckity/js 0.1.6 → 0.2.0

package/dist/worker.js

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2019 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const n=Symbol("Comlink.proxy"),e=Symbol("Comlink.endpoint"),t=Symbol("Comlink.releaseProxy"),r=Symbol("Comlink.finalizer"),o=Symbol("Comlink.thrown"),i=n=>"object"==typeof n&&null!==n||"function"==typeof n,a={canHandle:e=>i(e)&&e[n],serialize(n){const{port1:e,port2:t}=new MessageChannel;return c(n,e),[t,[t]]},deserialize:n=>(n.start(),function(n,e){const t=new Map;return n.addEventListener("message",function(n){const{data:e}=n;if(!e||!e.id)return;const r=t.get(e.id);if(r)try{r(e)}finally{t.delete(e.id)}}),d(n,t,[],e)}(n))},s=new Map([["proxy",a],["throw",{canHandle:n=>i(n)&&o in n,serialize({value:n}){let e;return e=n instanceof Error?{isError:!0,value:{message:n.message,name:n.name,stack:n.stack}}:{isError:!1,value:n},[e,[]]},deserialize(n){if(n.isError)throw Object.assign(new Error(n.value.message),n.value);throw n.value}}]]);function c(e,t=globalThis,i=["*"]){t.addEventListener("message",function a(s){if(!s||!s.data)return;if(!function(n,e){for(const t of n){if(e===t||"*"===t)return!0;if(t instanceof RegExp&&t.test(e))return!0}return!1}(i,s.origin))return void console.warn(`Invalid origin '${s.origin}' for comlink proxy`);const{id:u,type:f,path:p}=Object.assign({path:[]},s.data),g=(s.data.argumentList||[]).map(v);let d;try{const t=p.slice(0,-1).reduce((n,e)=>n[e],e),r=p.reduce((n,e)=>n[e],e);switch(f){case"GET":d=r;break;case"SET":t[p.slice(-1)[0]]=v(s.data.value),d=!0;break;case"APPLY":d=r.apply(t,g);break;case"CONSTRUCT":d=function(e){return Object.assign(e,{[n]:!0})}(new r(...g));break;case"ENDPOINT":{const{port1:n,port2:t}=new MessageChannel;c(e,t),d=function(n,e){return m.set(n,e),n}(n,[n])}break;case"RELEASE":d=void 0;break;default:return}}catch(n){d={value:n,[o]:0}}Promise.resolve(d).catch(n=>({value:n,[o]:0})).then(n=>{const[o,i]=h(n);t.postMessage(Object.assign(Object.assign({},o),{id:u}),i),"RELEASE"===f&&(t.removeEventListener("message",a),l(t),r in e&&"function"==typeof e[r]&&e[r]())}).catch(n=>{const[e,r]=h({value:new TypeError("Unserializable return value"),[o]:0});t.postMessage(Object.assign(Object.assign({},e),{id:u}),r)})}),t.start&&t.start()}function l(n){(function(n){return"MessagePort"===n.constructor.name})(n)&&n.close()}function u(n){if(n)throw new Error("Proxy has been released and is not useable")}function f(n){return E(n,new Map,{type:"RELEASE"}).then(()=>{l(n)})}const p=new WeakMap,g="FinalizationRegistry"in globalThis&&new FinalizationRegistry(n=>{const e=(p.get(n)||0)-1;p.set(n,e),0===e&&f(n)});function d(n,r,o=[],i=function(){}){let a=!1;const s=new Proxy(i,{get(e,i){if(u(a),i===t)return()=>{!function(n){g&&g.unregister(n)}(s),f(n),r.clear(),a=!0};if("then"===i){if(0===o.length)return{then:()=>s};const e=E(n,r,{type:"GET",path:o.map(n=>n.toString())}).then(v);return e.then.bind(e)}return d(n,r,[...o,i])},set(e,t,i){u(a);const[s,c]=h(i);return E(n,r,{type:"SET",path:[...o,t].map(n=>n.toString()),value:s},c).then(v)},apply(t,i,s){u(a);const c=o[o.length-1];if(c===e)return E(n,r,{type:"ENDPOINT"}).then(v);if("bind"===c)return d(n,r,o.slice(0,-1));const[l,f]=y(s);return E(n,r,{type:"APPLY",path:o.map(n=>n.toString()),argumentList:l},f).then(v)},construct(e,t){u(a);const[i,s]=y(t);return E(n,r,{type:"CONSTRUCT",path:o.map(n=>n.toString()),argumentList:i},s).then(v)}});return function(n,e){const t=(p.get(e)||0)+1;p.set(e,t),g&&g.register(n,e,n)}(s,n),s}function y(n){const e=n.map(h);return[e.map(n=>n[0]),(t=e.map(n=>n[1]),Array.prototype.concat.apply([],t))];var t}const m=new WeakMap;function h(n){for(const[e,t]of s)if(t.canHandle(n)){const[r,o]=t.serialize(n);return[{type:"HANDLER",name:e,value:r},o]}return[{type:"RAW",value:n},m.get(n)||[]]}function v(n){switch(n.type){case"HANDLER":return s.get(n.name).deserialize(n.value);case"RAW":return n.value}}function E(n,e,t,r){return new Promise(o=>{const i=new Array(4).fill(0).map(()=>Math.floor(Math.random()*Number.MAX_SAFE_INTEGER).toString(16)).join("-");e.set(i,o),n.start&&n.start(),n.postMessage(Object.assign({id:i},t),r)})}function b(n,e){let t=0n;for(const r of n)t=t<<e|BigInt(r);return t}function w(n,e,t){let r=new Array(e).fill(0);void 0===t&&(t=32n),void 0===e&&(e=parseInt((BigInt(n.toString(2).length)/t).toString()));let o=0n;for(let n=t-1n;n>0;n--)o<<=1n,o&=1n;for(let i=e-1;i>0;i--){let e=parseInt((n&o).toString());n>>=t,r[i]=e}return r}function S(n,e,t){let r=1n;for(;0n!==e;)1n==(1n&e)&&(r*=n,r%=t),n**=2n,n%=t,e/=2n;return r}function A(n,e){if([1n,2n,3n,5n,7n].includes(n))return!0;if(0n==(1n&n))return!1;if(n%5n==0n)return!1;for(let t=0n;t<BigInt(e)&&2n+t<n;t++){if(!k(n,2n+t))return!1}return!0}function k(n,e){let t=n-1n,r=t,o=0;for(;r%2n==0n;)r/=2n,o+=1;let i=S(e,r,n);for(let e=0n;e<o;e++){if(1n==i||i==t)return!0;i=S(i,2n,n)}return!1}var M={encode:function(n,e){let t={y:w(e.y,void 0,32n),pi:w(e.pi,void 0,32n)},r=JSON.stringify(t);return`${n}.${btoa(r)}`},solve:async function(n){let e=n.x;for(let t=0;t<n.t;t++)e=e**BigInt(2)%BigInt(n.t);let t=function(n,e){let t=0;0n!==n&&(t=n.toString(2).length);let r=Math.ceil((t+7)/8);return r=Math.ceil(r/e)*e,r}(e,4),r=w(n.x,t,8n),o=w(e,t,8n),i=Array.from((new TextEncoder).encode("duckity"));i.concat(...r),i.concat(...o);let a=await crypto.subtle.digest("SHA-256",new Uint8Array(i)),s=function(n){for(;;)if(A(n+=1n,40))return n}(b(Array.from(new Uint8Array(a)),8n)),c=1n,l=n.x,u=1n;for(let e=0;e<n.t;e++){let e=2n*u;e>=s?(c=c*l%n.n,u=e-s):u=e}return{y:e,pi:c}},decode:function(n){if(1!=(n.match(/\./g)||[]).length)throw Error("The challenge string contained too many or not enough sections.");let[e,t]=n.split(".",2),r=atob(e),o=JSON.parse(r);return{id:o.challenge_id,ip:o.ip,n:b(o.n,32n),x:b(o.x,32n),t:o.t,timestamp:new Date(o.timestamp)}}};c({async solve(n){let e=M.decode(n),t=await M.solve(e);return M.encode(n,t)}});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@duckity/js",
   "type": "module",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "module": "src/index.ts",
   "types": "dist/index.d.ts",
   "collaborators": [
@@ -14,7 +14,6 @@
   "exports": {
     ".": {
       "import": "./dist/index.js",
-      "require": "./dist/index.cjs",
       "types": "./dist/index.d.ts"
     }
   },
@@ -25,7 +24,7 @@
     "prepublishOnly": "bun run clean:all && bun run bundle && bun run clean:types"
   },
   "dependencies": {
-    "@duckity/wasm": "1.1.16"
+    "comlink": "^4.4.2"
   },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^29.0.3",
@@ -34,10 +33,10 @@
     "@rollup/plugin-typescript": "^12.3.0",
     "@rollup/plugin-wasm": "^6.2.2",
     "@types/bun": "latest",
-    "rollup": "^4.62.3",
-    "rollup-plugin-dts": "^6.4.1"
+    "rollup": "^4.62.5",
+    "rollup-plugin-dts": "^6.5.1"
   },
   "peerDependencies": {
-    "typescript": "^5"
+    "typescript": "^5.9.3"
   }
 }

package/src/index.ts

@@ -6,16 +6,26 @@ import { post } from "./requests";
  */
 export interface GetDuckityChallengeOptions {
   /**
-   * The custom-context threat correlation keys to be sent with the request.
-   */
-  keys?: { [key: string]: string };
-
-  /**
-   * The base URL to the API endpoint. Defaults to `https://quack.duckity.com` if not provided.
+   * The base URL to the API endpoint. Defaults to `https://api.duckity.com/d1` if not provided.
+   *
+   * The version must be specified in the URL path.
    *
-   * Update this when self-hosting a Duckling. No trailing slash must be included in the URL.
+   * Only update this when self-hosting a Duckling.
    */
   api?: string;
+
+  // /**
+  //  * When this is `false`, the client will assume it is allowed to get a challenge the first time
+  //  * one is requested. This may not always be true (when the client has an active penalty or used
+  //  * all of their allowed requests in another session), case in which the client may be penalized.
+  //  *
+  //  * When this is `true`, an extra request will be made to the Duckling API to synchronize the
+  //  * client's state with the server's state. This extra request will not issue a challenge, rather
+  //  * only synchronize the client's state with the server's state. If the client is penalized or has
+  //  * to wait before being allowed to get a challenge, the client will be informed of this. It'll
+  //  * avoid getting it unnecessarily penalized at the cost of an extra request.
+  //  */
+  // sync?: boolean;
 }
 
 /**
@@ -40,19 +50,16 @@ export async function solve(
   protectionProfileId: string,
   options?: GetDuckityChallengeOptions,
 ): Promise<string> {
+  if (options?.api && options.api.endsWith("/")) {
+    // Remove the trailing slash from the API URL if provided
+    options.api = options.api.slice(0, -1);
+  }
+
   let response: ChallengeResponse = await post(
-    `${options?.api || "https://quack.duckity.com"}/v1/challenge`,
-    {
-      body: {
-        id: protectionProfileId,
-        keys: options?.keys || {},
-      },
-    },
+    `${options?.api || "https://api.duckity.com/d1"}/challenges/${protectionProfileId}/issue`,
   );
 
   let solution = await wrapper.solve(response.challenge);
 
   return solution;
 }
-
-export default { solve }

package/src/processing/index.ts

@@ -0,0 +1,282 @@
+interface ChallengeMeta {
+  // The challenge's ID.
+  challenge_id: string;
+  // The client's IP.
+  ip: string;
+  // The unix timestamp, in milliseconds, in which the challenge was issued.
+  timestamp: number;
+  // The ID of the protection profile this challenge was issued for.
+  protection_profile_id: string;
+  // The digits of the N Wesolowski VDF parameter, most significant digit first.
+  n: Array<number>;
+  // The digits of the X Wesolowski VDF parameter, most significant digit first.
+  x: Array<number>;
+  // The T Wesolowski VDF parameter.
+  t: number;
+}
+
+export interface Challenge {
+  // The challenge's ID.
+  id: string;
+  // The client's IP.
+  ip: string;
+  // N Wesolowski VDF parameter.
+  n: bigint;
+  // X Wesolowski VDF parameter.
+  x: bigint;
+  // T Wesolowski VDF parameter.
+  t: number;
+  // The timestamp at which this challenge was issued.
+  timestamp: Date;
+}
+
+interface SolutionMeta {
+  y: number[];
+  pi: number[];
+}
+
+export interface Solution {
+  y: bigint;
+  pi: bigint;
+}
+
+/**
+ * Converts an array of digits to a bigint.
+ *
+ * @param digits The digits of the bigint, MSF.
+ * @param bits The amount of bits each digit consists of.
+ * @returns The formed bigint.
+ */
+function getBigintFromDigits(digits: Array<number>, bits: bigint): bigint {
+  let number = 0n;
+
+  for (const digit of digits) {
+    number = (number << bits) | BigInt(digit);
+  }
+
+  return number;
+}
+
+function getBigintWidth(number: bigint, alignment?: number): number {
+  let bitWidth = 0;
+
+  if (number !== 0n) {
+    bitWidth = number.toString(2).length;
+  }
+
+  let byteWidth = Math.ceil((bitWidth + 7) / 8);
+
+  if (alignment !== undefined) {
+    byteWidth = Math.ceil(byteWidth / alignment) * alignment;
+  }
+
+  return byteWidth;
+}
+
+function getDigitsFromBigint(
+  number: bigint,
+  width?: number,
+  digitBits?: bigint,
+): number[] {
+  let bytes: number[] = new Array(width).fill(0);
+
+  if (digitBits === undefined) {
+    digitBits = 32n;
+  }
+
+  if (width === undefined) {
+    width = parseInt(
+      (BigInt(number.toString(2).length) / digitBits).toString(),
+    );
+  }
+
+  let mask = 0n;
+  for (let i = digitBits - 1n; i > 0; i--) {
+    mask <<= 1n;
+    mask &= 1n;
+  }
+
+  for (let i = width - 1; i > 0; i--) {
+    let byte = parseInt((number & mask).toString());
+    number = number >> digitBits;
+    bytes[i] = byte;
+  }
+
+  return bytes;
+}
+
+function modPow(base: bigint, exponent: bigint, modulus: bigint): bigint {
+  let result = 1n;
+
+  while (exponent !== 0n) {
+    // (something & 1n) is faster than (something % 2n)
+    if ((exponent & 1n) === 1n) {
+      result *= base;
+      result %= modulus;
+    }
+
+    base **= 2n;
+    base %= modulus;
+
+    exponent /= 2n;
+  }
+
+  return result;
+}
+
+// Runs `tests` Miller-Rabin primality checks on `number`.
+function isPrime(number: bigint, tests: number): boolean {
+  if ([1n, 2n, 3n, 5n, 7n].includes(number)) {
+    return true;
+  }
+
+  // (something & 1n) is faster than (something % 2n)
+  if ((number & 1n) === 0n) {
+    return false;
+  }
+
+  if (number % 5n === 0n) {
+    return false;
+  }
+
+  let base = 2n;
+
+  for (let i = 0n; i < BigInt(tests) && base + i < number; i++) {
+    let prime = isPrimeForBase(number, base + i);
+
+    if (!prime) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+function isPrimeForBase(number: bigint, base: bigint): boolean {
+  let number_minus_one = number - 1n;
+
+  let odd = number_minus_one;
+  let base_times = 0;
+
+  while (odd % 2n == 0n) {
+    odd /= 2n;
+    base_times += 1;
+  }
+
+  let odd_power = modPow(base, odd, number);
+
+  for (let i = 0n; i < base_times; i++) {
+    if (odd_power == 1n || odd_power == number_minus_one) {
+      return true;
+    }
+
+    odd_power = modPow(odd_power, 2n, number);
+  }
+
+  return false;
+}
+
+function getNextPrime(number: bigint): bigint {
+  while (true) {
+    number += 1n;
+
+    if (isPrime(number, 40)) {
+      return number;
+    }
+  }
+}
+
+export function decode(challenge: string): Challenge {
+  // Counts all dots in the challenge string
+  if ((challenge.match(/\./g) || []).length != 1) {
+    throw Error(
+      "The challenge string contained too many or not enough sections.",
+    );
+  }
+
+  let [base64, _signature] = challenge.split(".", 2);
+  let json = atob(base64 as string);
+  let data: ChallengeMeta = JSON.parse(json as string);
+
+  let decoded: Challenge = {
+    id: data.challenge_id,
+    ip: data.ip,
+    n: getBigintFromDigits(data.n, 32n),
+    x: getBigintFromDigits(data.x, 32n),
+    t: data.t,
+    timestamp: new Date(data.timestamp),
+  };
+
+  return decoded;
+}
+
+/**
+ * Solves a challenge and returns the solution to it.
+ *
+ * The solution must be encoded into the final submittable string with `encode()`.
+ *
+ * Always call this function from a worker. Not doing so will block the UI thread.
+ *
+ * @param challenge The decoded challenge string. See `decode()`.
+ * @returns The solution to the provided challenge.
+ */
+export async function solve(challenge: Challenge): Promise<Solution> {
+  let y = challenge.x;
+
+  for (let i = 0; i < challenge.t; i++) {
+    y = y ** BigInt(2) % BigInt(challenge.t);
+  }
+
+  // Align to 4 bytes since each digit is a u32.
+  let width = getBigintWidth(y, 4);
+
+  let xBytes = getDigitsFromBigint(challenge.x, width, 8n);
+  let yBytes = getDigitsFromBigint(y, width, 8n);
+
+  let bytes = Array.from(new TextEncoder().encode("duckity"));
+  bytes.concat(...xBytes);
+  bytes.concat(...yBytes);
+  let hash = await crypto.subtle.digest("SHA-256", new Uint8Array(bytes));
+  let hashBytes = Array.from(new Uint8Array(hash));
+
+  let z = getBigintFromDigits(hashBytes, 8n);
+  let l = getNextPrime(z);
+
+  let pi = 1n;
+  let acc = challenge.x;
+  let exp_mod_l = 1n;
+
+  for (let i = 0; i < challenge.t; i++) {
+    let doubled = exp_mod_l * 2n;
+
+    if (doubled >= l) {
+      pi = (pi * acc) % challenge.n;
+      exp_mod_l = doubled - l;
+    } else {
+      exp_mod_l = doubled;
+    }
+  }
+
+  return {
+    y,
+    pi,
+  };
+}
+
+export function encode(original: string, solution: Solution): string {
+  let solutionMeta: SolutionMeta = {
+    y: getDigitsFromBigint(solution.y, undefined, 32n),
+    pi: getDigitsFromBigint(solution.pi, undefined, 32n),
+  };
+
+  let solutionMetaJson = JSON.stringify(solutionMeta);
+  let solutionMetaBase64 = btoa(solutionMetaJson);
+
+  return `${original}.${solutionMetaBase64}`;
+}
+
+export default {
+  encode,
+  solve,
+  decode,
+};

package/src/processing/worker.ts

@@ -1,15 +1,16 @@
 import * as Comlink from "comlink";
-import { process } from "@duckity/wasm";
+import processing from ".";
 
 /**
- * Expose the `process` function from the WASM module to the main thread via Comlink.
- *
- * This allows the main thread to call the `process` function in the worker thread, which will
- * handle the processing of the challenges without blocking the main thread.
+ * Solves a challenge in the background.
  */
 const api = {
-  async process(challenge: string) {
-    return process(challenge);
+  async solve(challenge: string) {
+    let decodedChallenge = processing.decode(challenge);
+    let solution = await processing.solve(decodedChallenge);
+    let solutionString = processing.encode(challenge, solution);
+
+    return solutionString;
   },
 };
 

package/src/processing/wrapper.ts

@@ -1,10 +1,9 @@
-import wasm from "@duckity/wasm/worker.wasm";
 import * as Comlink from "comlink";
 
 /**
  * Web Worker that handles the processing of the challenges.
  */
-const worker = new Worker(wasm, {
+const worker = new Worker(new URL("./worker.js", import.meta.url), {
   type: "module",
 });
 

package/src/requests.ts

@@ -61,14 +61,17 @@ export function get<T>(url: string, options?: RequestInit): Promise<T> {
  * @param options Extra options to pass to the Fetch API, such as headers and body.
  * @returns The parsed JSON response from the server if the request is successful.
  */
-export function post<T>(url: string, options?: Omit<RequestInit, "body"> & { body: any }): Promise<T> {
+export function post<T>(
+  url: string,
+  options?: Omit<RequestInit, "body" | "method"> & { body: any },
+): Promise<T> {
   return request(url, {
     method: "POST",
     headers: {
-      "Content-Type": "application/json",
+      ...(options?.body ? { "Content-Type": "application/json" } : {}),
       ...options?.headers,
     },
-    body: options?.body ? JSON.stringify(options.body) : undefined,
     ...options,
+    body: options?.body ? JSON.stringify(options.body) : undefined,
   });
 }