@eluvio/elv-client-js 4.2.21 → 4.2.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eluvio/elv-client-js",
-  "version": "4.2.21",
+  "version": "4.2.23",
   "description": "Javascript client for the Eluvio Content Fabric",
   "main": "src/index.js",
   "author": "Kevin Talmadge",

package/src/Crypto.js

@@ -82,7 +82,19 @@ const Crypto = {
     return Utils.B64(cap);
   },
 
-  async DecryptCap(encryptedCap, privateKey) {
+  // accepts either a raw private key string (legacy usage) or a signer
+  async DecryptCap(encryptedCap, signerOrPrivateKey) {
+    let privateKey;
+    if(typeof signerOrPrivateKey === "string") {
+      privateKey = signerOrPrivateKey;
+    } else if(signerOrPrivateKey && signerOrPrivateKey.remoteSigner) {
+      return await signerOrPrivateKey.DecryptCap(encryptedCap);
+    } else if(signerOrPrivateKey && typeof signerOrPrivateKey._signingKey === "function") {
+      privateKey = signerOrPrivateKey._signingKey().privateKey;
+    } else {
+      throw Error("Crypto.DecryptCap: second argument must be a signer or a private key string");
+    }
+
     const elvCrypto = await Crypto.ElvCrypto();
     privateKey = new Uint8Array(Buffer.from(privateKey.replace("0x", ""), "hex"));
 

package/src/ElvClient.js

@@ -1348,7 +1348,7 @@ class ElvClient {
 
     ValidatePresence("message", message);
 
-    return await this.Crypto.DecryptCap(message, this.signer._signingKey().privateKey);
+    return await this.Crypto.DecryptCap(message, this.signer);
   }
 
   /**

package/src/RemoteSigner.js

@@ -47,7 +47,7 @@ class RemoteSigner extends Ethers.Signer {
         body.code = this.userIdCode;
       }
 
-      const {addr, eth, token} = await Utils.ResponseToJson(
+      const {addr, eth, token, pubkey} = await Utils.ResponseToJson(
         this.HttpClient.Request({
           path: UrlJoin("as", "wlt", "login", this.userIdCode ? "code" : "jwt"),
           method: "POST",
@@ -61,9 +61,10 @@ class RemoteSigner extends Ethers.Signer {
       this.authToken = token;
       this.address = Utils.FormatAddress(addr);
       this.id = eth;
+      this.publicKey = pubkey;
     }
 
-    if(!this.address) {
+    if(!this.address || !this.publicKey) {
       const keys = await Utils.ResponseToJson(
         this.HttpClient.Request({
           method: "GET",
@@ -74,12 +75,18 @@ class RemoteSigner extends Ethers.Signer {
         })
       );
 
-      const address = keys.eth[0];
+      if(!this.address) {
+        const address = keys.eth[0];
 
-      if(address && address.startsWith("0x")) {
-        this.address = address;
-      } else {
-        this.address = Utils.HashToAddress(keys.eth[0]);
+        if(address && address.startsWith("0x")) {
+          this.address = address;
+        } else {
+          this.address = Utils.HashToAddress(keys.eth[0]);
+        }
+      }
+
+      if(!this.publicKey) {
+        this.publicKey = keys.pubkey && keys.pubkey[0];
       }
     }
 
@@ -170,6 +177,63 @@ class RemoteSigner extends Ethers.Signer {
     return this.address;
   }
 
+  _normalizePublicKey(key) {
+    const with0x = key.startsWith("0x") ? key : `0x${key}`;
+    return with0x.length === 2 + 128 ? `0x04${with0x.slice(2)}` : with0x;
+  }
+
+  /**
+   * This signer's public key, as provided by the authd service
+   *
+   * @return {Promise<string>} - The public key, in uncompressed hex like SigningKey.publicKey
+   */
+  async PublicKey() {
+    if(!this.publicKey) {
+      throw Error("RemoteSigner: public key not available - call Initialize() first");
+    }
+
+    return this._normalizePublicKey(this.publicKey);
+  }
+
+  /** so remote signers can be used interchangeably with local signers */
+  _signingKey() {
+    if(!this.publicKey) {
+      throw Error("RemoteSigner: public key not available - call Initialize() first");
+    }
+
+    const publicKey = this._normalizePublicKey(this.publicKey);
+    return {
+      publicKey,
+      get privateKey() {
+        throw Error("RemoteSigner: remote signer does not have direct access to a private key");
+      }
+    };
+  }
+
+  /**
+   * Decrypt a secp256k1 ECIES-encrypted blob (e.g. a fabric encryption conk) that was wrapped
+   * for this signer's public key, via the authd service's generic decrypt endpoint.
+   *
+   * @param {string} encryptedData - Base64-encoded ECIES-encrypted blob
+   * @return {Promise<Object>} - The decrypted, JSON-parsed contents
+   */
+  async DecryptCap(encryptedData) {
+    const {data} = await Utils.ResponseToJson(
+      this.HttpClient.Request({
+        method: "POST",
+        path: UrlJoin("as", "wlt", "decrypt", "eth", this.id),
+        headers: {
+          Authorization: `Bearer ${this.authToken}`
+        },
+        body: {
+          data: encryptedData
+        }
+      })
+    );
+
+    return JSON.parse(Buffer.from(data, "base64").toString());
+  }
+
   async signDigest(digest) {
     if(!this.signatureCache[digest]) {
       this.signatureCache[digest] = new Promise(async (resolve, reject) => {

package/src/client/ContentAccess.js

@@ -2718,7 +2718,7 @@ exports.LinkData = async function({libraryId, objectId, versionHash, writeToken,
 
 exports.CreateEncryptionConk = async function({libraryId, objectId, versionHash, writeToken, createKMSConk=true}) {
   if(this.signer.remoteSigner) {
-    return;
+    await this.signer.PublicKey();
   }
 
   ValidateParameters({libraryId, objectId, versionHash});
@@ -2743,7 +2743,7 @@ exports.CreateEncryptionConk = async function({libraryId, objectId, versionHash,
     });
 
   if(existingUserCap) {
-    this.encryptionConks[objectId] = await this.Crypto.DecryptCap(existingUserCap, this.signer._signingKey().privateKey);
+    this.encryptionConks[objectId] = await this.Crypto.DecryptCap(existingUserCap, this.signer);
   } else {
     this.encryptionConks[objectId] = await this.Crypto.GeneratePrimaryConk({
       spaceId: this.contentSpaceId,
@@ -2846,7 +2846,7 @@ exports.EncryptionConk = async function({libraryId, objectId, versionHash, write
       });
 
     if(existingUserCap) {
-      this.encryptionConks[objectId] = await this.Crypto.DecryptCap(existingUserCap, this.signer._signingKey().privateKey);
+      this.encryptionConks[objectId] = await this.Crypto.DecryptCap(existingUserCap, this.signer);
     } else if(writeToken) {
       await this.CreateEncryptionConk({libraryId, objectId, versionHash, writeToken, createKMSConk: false});
     } else {

package/src/client/ContentManagement.js

@@ -680,7 +680,7 @@ exports.CopyContentObject = async function({libraryId, originalVersionHash, opti
   const userCapKey = `eluv.caps.iusr${this.utils.AddressToHash(this.signer.address)}`;
 
   if(metadata[userCapKey]) {
-    const userConkKey = await this.Crypto.DecryptCap(metadata[userCapKey], this.signer._signingKey().privateKey);
+    const userConkKey = await this.Crypto.DecryptCap(metadata[userCapKey], this.signer);
     userConkKey.qid = objectId;
 
     await this.ReplaceMetadata({
@@ -733,7 +733,7 @@ exports.CreateNonOwnerCap = async function({objectId, libraryId, publicKey, writ
     throw Error("No user cap found for current user");
   }
 
-  const userConk = await this.Crypto.DecryptCap(userCapValue, this.signer._signingKey().privateKey);
+  const userConk = await this.Crypto.DecryptCap(userCapValue, this.signer);
 
   const publicAddress = this.utils.PublicKeyToAddress(publicKey);