@ethernity-cloud/sdk-js 1.2.0 → 1.4.0

package/nodenithy/build/securelock/src/README-keygen.md

@@ -0,0 +1,41 @@
+# SGX key-gen module (`sgx_report.node`)
+
+The JS SDK ships this module **only as a prebuilt N-API addon**
+(`sgx_report.node`) — never the C source (`get_sgx_report.c`,
+`sgx_report_napi.c`). The identity-key derivation (SGX EREPORT + obfuscated
+MR_SIGNER + HKDF-SHA512 domain-separated derivation) lives entirely in the
+compiled binary, so a developer inspecting the package or build tree never sees
+the algorithm. `get_sgx_report.c` and `sgx_report_napi.c` are gitignored here
+so they can never be committed.
+
+## Where the source lives
+
+The source of truth is the runtime repo, not this package:
+
+- `etny-nodenithy` → `v3/build/{securelock,trustedzone,validator}/src/`
+  (`get_sgx_report.c` + `sgx_report_napi.c`)
+
+## How the `.node` is produced
+
+`sgx_report.node` is a **build artifact of the etny-nodenithy pipeline** — its
+Dockerfile compiles `sgx_report_napi.c` (which `#include`s `get_sgx_report.c`)
+into the addon with a single gcc command against node's `node_api.h`. To refresh
+the copy the SDK ships, take the `sgx_report.node` that pipeline produces and
+commit it here as `securelock/src/sgx_report.node`.
+
+The JS wrappers `sgx_report.js` (loader) and `self_sign.js` (calls
+`deriveIdentityScalar`) ship as source — they contain no algorithm, only calls
+into the addon.
+
+## Why not compile it in the SDK build
+
+The securelock Dockerfile bakes `src/` into binary-fs but does **not** compile
+the addon, so the SDK must carry the prebuilt `.node`. `build.mjs` fails fast if
+`src/sgx_report.node` is missing.
+
+## Honest scope
+
+This hides the SOURCE, not the algorithm: the `.node` still contains the
+executable logic and the enclave image is public. On testnet (no attestation)
+the derived key is reproducible by anyone who runs the image. Key exclusivity
+comes from attestation, not from shipping only the binary.

package/nodenithy/build/securelock/src/etny_exec.js

@@ -2,34 +2,62 @@ const fs = require('fs');
 const path = require('path');
 const { TaskStatus } = require('./task_status');
 
-// Load all JavaScript files from the ./serverless/ folder
-// const serverlessDir = path.join(__dirname, './serverless');
-
-// let backendFunctions = {};
-// fs.readdirSync(serverlessDir).forEach(file => {
-//     if (file.endsWith('.js')) {
-//         const filePath = path.join(serverlessDir, file);
-//         const moduleExports = require(filePath.replace('.js', ''));
-//         backendFunctions = { ...backendFunctions, ...moduleExports };
-//     }
-// });
-const { hello } = require('./serverless/backend');
+// Load EVERY export of ./serverless/backend into the payload's scope. The
+// backend is copied next to this file by ecld-build (and staged the same way
+// by ecld-test locally), so one code path serves both the enclave and local
+// testing. Previously only a function literally named `hello` was reachable
+// (hardcoded destructure); any other exported function threw ReferenceError.
+// A missing backend leaves only ___etny_result___ in scope, which is the
+// stock-enclave behaviour.
+let backendFunctions = {};
+// If the backend fails to load, remember WHY. A silently-swallowed failure
+// (missing npm module, bad require inside backend.js) makes every task die
+// later with a misleading "X is not defined". Only a genuinely absent backend
+// stays silent — that is the stock-enclave configuration.
+let backendImportError = null;
+try {
+    backendFunctions = { ...require('./serverless/backend') };
+} catch (e) {
+    backendFunctions = {};
+    // MODULE_NOT_FOUND messages embed the whole require stack (which always
+    // mentions serverless/backend.js), so parse out WHICH module is missing:
+    // only a missing backend module itself means "no backend shipped".
+    const m = /Cannot find module '([^']+)'/.exec(e.message || '');
+    const missingBackendItself =
+        e.code === 'MODULE_NOT_FOUND' && m && /serverless[\\/]backend/.test(m[1]);
+    if (!missingBackendItself) {
+        backendImportError = `${e.name || 'Error'}: ${(e.message || '').split('\n')[0]}`;
+    }
+}
 
 function ___etny_result___(data) {
     return [0, data];
 }
+
 function executeTask(payload, input) {
-    return exec(payload, input, { '___etny_result___': ___etny_result___, 'hello': hello });
+    if (backendImportError !== null) {
+        return [
+            TaskStatus.IMPORT_ERROR,
+            'BACKEND IMPORT ERROR: ' + backendImportError +
+            ' | The serverless backend failed to load inside the enclave, so none of its' +
+            ' functions are available. Common causes: a module missing from the enclave' +
+            ' image dependencies, or a bad require() inside backend.js.'
+        ];
+    }
+    return exec(payload, input, { '___etny_result___': ___etny_result___, ...backendFunctions });
 }
+
 function exec(payload, input, globals = null) {
     try {
         if (payload && payload !== "") {
+            const scope = globals || {};
             if (input && input !== "") {
-                if (globals) {
-                    globals['___etny_data_set___'] = input;
-                }
-                return ___etny_result___(eval(payload));
-            } else {
+                scope['___etny_data_set___'] = input;
+            }
+            // `with` exposes every backend function and ___etny_data_set___ to
+            // the payload by bare name — matching how payloads are written
+            // (e.g. `processData(___etny_data_set___)`).
+            with (scope) {
                 return ___etny_result___(eval(payload));
             }
         } else {

package/nodenithy/build/securelock/src/models.js

@@ -1,261 +1,275 @@
-class Order {
-    constructor(req, order_id) {
-        this.id = order_id;
-        this.do_owner = req[0];
-        this.dproc = req[1];
-        this.do_req = req[2];
-        this.dp_req = req[3];
-        this.status = req[4];
-    }
-}
-
-class MetadataBase {
-    constructor(metadata, version) {
-        this.metadata = metadata;
-        this._version = version;
-    }
-
-    get version() {
-        return this._version;
-    }
-
-    get ipfs_hash() {
-        throw new Error("Subclass must implement this method");
-    }
-
-    checksum() {
-        throw new Error("Subclass must implement this method");
-    }
-}
-
-class PayloadFactory {
-    static create_payload_metadata(metadata) {
-        if (metadata.includes(":")) {
-            if (metadata.startsWith("v1")) {
-                return new PayloadMetadataV1(metadata);
-            }
-            if (metadata.startsWith("v2")) {
-                return new PayloadMetadataV2(metadata);
-            }
-
-            if (metadata.startsWith("v3")) {
-                return new PayloadMetadataV3(metadata);
-            }
-
-            throw new Error("Invalid payload metadata type");
-        } else {
-            return new PayloadMetadataV0(metadata);
-        }
-    }
-}
-
-class InputFactory {
-    static create_input_metadata(metadata) {
-        if (metadata.includes(":")) {
-            if (metadata.startsWith("v1")) {
-                return new InputMetadataV1(metadata);
-            }
-            if (metadata.startsWith("v2")) {
-                return new InputMetadataV2(metadata);
-            }
-            if (metadata.startsWith("v3")) {
-                return new InputMetadataV3(metadata);
-            }
-
-            throw new Error("Invalid payload metadata type");
-        } else {
-            return new InputMetadataV0(metadata);
-        }
-    }
-}
-
-class InputMetadataV0 extends MetadataBase {
-    constructor(metadata) {
-        super(metadata, "v0");
-        this._ipfs_hash = metadata;
-    }
-
-    get ipfs_hash() {
-        return this._ipfs_hash;
-    }
-
-    get checksum() {
-        return null;
-    }
-}
-
-class PayloadMetadataV0 extends MetadataBase {
-    constructor(metadata) {
-        super(metadata, "v0");
-        this._ipfs_hash = metadata;
-    }
-
-    get ipfs_hash() {
-        return this._ipfs_hash;
-    }
-
-    get checksum() {
-        return null;
-    }
-}
-
-class PayloadMetadataV1 extends MetadataBase {
-    constructor(metadata) {
-        super(metadata, "v1");
-        this._checksum = metadata.split(":")[2];
-        this._ipfs_hash = metadata.split(":")[1];
-    }
-
-    get ipfs_hash() {
-        return this._ipfs_hash;
-    }
-
-    get checksum() {
-        return this._checksum;
-    }
-}
-
-class InputMetadataV1 extends MetadataBase {
-    constructor(metadata) {
-        super(metadata, "v1");
-        this._checksum = metadata.split(":")[2];
-        this._ipfs_hash = metadata.split(":")[1];
-    }
-
-    get ipfs_hash() {
-        return this._ipfs_hash;
-    }
-
-    get checksum() {
-        return this._checksum !== "0" ? this._checksum : this._checksum;
-    }
-}
-
-class PayloadMetadataV2 extends MetadataBase {
-    constructor(metadata) {
-        super(metadata, "v2");
-        this._checksum = metadata.split(":")[2];
-        this._ipfs_hash = metadata.split(":")[1];
-    }
-
-    get ipfs_hash() {
-        return this._ipfs_hash;
-    }
-
-    get checksum() {
-        return this._checksum;
-    }
-}
-
-class PayloadMetadataV3 extends MetadataBase {
-    constructor(metadata) {
-        super(metadata, "v3");
-        this._checksum = metadata.split(":")[2];
-        this._ipfs_hash = metadata.split(":")[1];
-    }
-
-    get ipfs_hash() {
-        return this._ipfs_hash;
-    }
-
-    get checksum() {
-        return this._checksum;
-    }
-}
-
-class InputMetadataV2 extends MetadataBase {
-    constructor(metadata) {
-        super(metadata, "v2");
-        this._checksum = metadata.split(":")[2];
-        this._ipfs_hash = metadata.split(":")[1];
-    }
-
-    get ipfs_hash() {
-        return this._ipfs_hash;
-    }
-
-    get checksum() {
-        return this._checksum !== "0" ? this._checksum : this._checksum;
-    }
-}
-
-class InputMetadataV3 extends MetadataBase {
-    constructor(metadata) {
-        super(metadata, "v3");
-        this._checksum = metadata.split(":")[2];
-        this._ipfs_hash = metadata.split(":")[1];
-    }
-
-    get ipfs_hash() {
-        return this._ipfs_hash;
-    }
-
-    get checksum() {
-        return this._checksum !== "0" ? this._checksum : this._checksum;
-    }
-}
-
-class DOReqMetadata {
-    constructor(req, do_req) {
-        this._do_req_id = do_req;
-        this._do_owner = req[0];
-        this._metadata1 = req[1];
-        this._metadata2 = req[2];
-        this._metadata3 = req[3];
-        this._metadata4 = req[4];
-        this._payload_metadata_obj = PayloadFactory.create_payload_metadata(this.payload_metadata);
-        this._input_metadata_obj = InputFactory.create_input_metadata(this.input_metadata);
-    }
-
-    get do_req_id() {
-        return this._do_req_id;
-    }
-
-    get do_owner() {
-        return this._do_owner;
-    }
-
-    get image_metadata() {
-        return this._metadata1;
-    }
-
-    get public_key() {
-        return this.image_metadata.split(':')[5];
-    }
-
-    get image_hash() {
-        return this.image_metadata.split(':')[1];
-    }
-
-    get payload_metadata() {
-        return this._metadata2;
-    }
-
-    get payload_metadata_obj() {
-        return this._payload_metadata_obj;
-    }
-
-    get input_metadata_obj() {
-        return this._input_metadata_obj;
-    }
-
-    get input_metadata() {
-        return this._metadata3;
-    }
-
-    get node_address() {
-        return this._metadata4;
-    }
-}
-
-module.exports = {
-    Order,
-    MetadataBase,
-    PayloadFactory,
-    InputFactory,
-    InputMetadataV0,
-    PayloadMetadataV0,
-    InputMetadataV1,
-    PayloadMetadataV1,
-    DOReqMetadata
-}
+class Order {
+    constructor(req, order_id) {
+        this.id = order_id;
+        this.do_owner = req[0];
+        this.dproc = req[1];
+        this.do_req = req[2];
+        this.dp_req = req[3];
+        this.status = req[4];
+    }
+}
+
+class MetadataBase {
+    constructor(metadata, version) {
+        this.metadata = metadata;
+        this._version = version;
+    }
+
+    get version() {
+        return this._version;
+    }
+
+    get ipfs_hash() {
+        throw new Error("Subclass must implement this method");
+    }
+
+    checksum() {
+        throw new Error("Subclass must implement this method");
+    }
+
+    // True when this metadata carries a real checksum to validate. Empty input
+    // carries no checksum (checksum is null), so callers can skip validation
+    // without inspecting raw metadata strings themselves.
+    get has_checksum() {
+        return this.checksum != null;
+    }
+}
+
+class PayloadFactory {
+    static create_payload_metadata(metadata) {
+        if (metadata.includes(":")) {
+            if (metadata.startsWith("v1")) {
+                return new PayloadMetadataV1(metadata);
+            }
+            if (metadata.startsWith("v2")) {
+                return new PayloadMetadataV2(metadata);
+            }
+
+            if (metadata.startsWith("v3")) {
+                return new PayloadMetadataV3(metadata);
+            }
+
+            throw new Error("Invalid payload metadata type");
+        } else {
+            return new PayloadMetadataV0(metadata);
+        }
+    }
+}
+
+class InputFactory {
+    static create_input_metadata(metadata) {
+        if (metadata.includes(":")) {
+            if (metadata.startsWith("v1")) {
+                return new InputMetadataV1(metadata);
+            }
+            if (metadata.startsWith("v2")) {
+                return new InputMetadataV2(metadata);
+            }
+            if (metadata.startsWith("v3")) {
+                return new InputMetadataV3(metadata);
+            }
+
+            throw new Error("Invalid payload metadata type");
+        } else {
+            return new InputMetadataV0(metadata);
+        }
+    }
+}
+
+class InputMetadataV0 extends MetadataBase {
+    constructor(metadata) {
+        super(metadata, "v0");
+        this._ipfs_hash = metadata;
+    }
+
+    get ipfs_hash() {
+        return this._ipfs_hash;
+    }
+
+    get checksum() {
+        return null;
+    }
+}
+
+class PayloadMetadataV0 extends MetadataBase {
+    constructor(metadata) {
+        super(metadata, "v0");
+        this._ipfs_hash = metadata;
+    }
+
+    get ipfs_hash() {
+        return this._ipfs_hash;
+    }
+
+    get checksum() {
+        return null;
+    }
+}
+
+class PayloadMetadataV1 extends MetadataBase {
+    constructor(metadata) {
+        super(metadata, "v1");
+        this._checksum = metadata.split(":")[2];
+        this._ipfs_hash = metadata.split(":")[1];
+    }
+
+    get ipfs_hash() {
+        return this._ipfs_hash;
+    }
+
+    get checksum() {
+        return this._checksum;
+    }
+}
+
+class InputMetadataV1 extends MetadataBase {
+    constructor(metadata) {
+        super(metadata, "v1");
+        this._checksum = metadata.split(":")[2];
+        this._ipfs_hash = metadata.split(":")[1];
+    }
+
+    get ipfs_hash() {
+        return this._ipfs_hash;
+    }
+
+    get checksum() {
+        return this._checksum !== "0" ? this._checksum : this._checksum;
+    }
+}
+
+class PayloadMetadataV2 extends MetadataBase {
+    constructor(metadata) {
+        super(metadata, "v2");
+        this._checksum = metadata.split(":")[2];
+        this._ipfs_hash = metadata.split(":")[1];
+    }
+
+    get ipfs_hash() {
+        return this._ipfs_hash;
+    }
+
+    get checksum() {
+        return this._checksum;
+    }
+}
+
+class PayloadMetadataV3 extends MetadataBase {
+    constructor(metadata) {
+        super(metadata, "v3");
+        // An absent checksum (empty or "0" third field) is normalized to null so
+        // the rest of the code can rely on `has_checksum` instead of special-
+        // casing empty strings.
+        const c = (metadata.split(":")[2] || "").trim();
+        this._checksum = (c && c !== "0") ? c : null;
+        this._ipfs_hash = metadata.split(":")[1];
+    }
+
+    get ipfs_hash() {
+        return this._ipfs_hash;
+    }
+
+    get checksum() {
+        return this._checksum;
+    }
+}
+
+class InputMetadataV2 extends MetadataBase {
+    constructor(metadata) {
+        super(metadata, "v2");
+        this._checksum = metadata.split(":")[2];
+        this._ipfs_hash = metadata.split(":")[1];
+    }
+
+    get ipfs_hash() {
+        return this._ipfs_hash;
+    }
+
+    get checksum() {
+        return this._checksum !== "0" ? this._checksum : this._checksum;
+    }
+}
+
+class InputMetadataV3 extends MetadataBase {
+    constructor(metadata) {
+        super(metadata, "v3");
+        // Empty input carries an empty (or "0") checksum field; normalize it to
+        // null so `has_checksum` is false and validation is skipped.
+        const c = (metadata.split(":")[2] || "").trim();
+        this._checksum = (c && c !== "0") ? c : null;
+        this._ipfs_hash = metadata.split(":")[1];
+    }
+
+    get ipfs_hash() {
+        return this._ipfs_hash;
+    }
+
+    get checksum() {
+        return this._checksum;
+    }
+}
+
+class DOReqMetadata {
+    constructor(req, do_req) {
+        this._do_req_id = do_req;
+        this._do_owner = req[0];
+        this._metadata1 = req[1];
+        this._metadata2 = req[2];
+        this._metadata3 = req[3];
+        this._metadata4 = req[4];
+        this._payload_metadata_obj = PayloadFactory.create_payload_metadata(this.payload_metadata);
+        this._input_metadata_obj = InputFactory.create_input_metadata(this.input_metadata);
+    }
+
+    get do_req_id() {
+        return this._do_req_id;
+    }
+
+    get do_owner() {
+        return this._do_owner;
+    }
+
+    get image_metadata() {
+        return this._metadata1;
+    }
+
+    get public_key() {
+        return this.image_metadata.split(':')[5];
+    }
+
+    get image_hash() {
+        return this.image_metadata.split(':')[1];
+    }
+
+    get payload_metadata() {
+        return this._metadata2;
+    }
+
+    get payload_metadata_obj() {
+        return this._payload_metadata_obj;
+    }
+
+    get input_metadata_obj() {
+        return this._input_metadata_obj;
+    }
+
+    get input_metadata() {
+        return this._metadata3;
+    }
+
+    get node_address() {
+        return this._metadata4;
+    }
+}
+
+module.exports = {
+    Order,
+    MetadataBase,
+    PayloadFactory,
+    InputFactory,
+    InputMetadataV0,
+    PayloadMetadataV0,
+    InputMetadataV1,
+    PayloadMetadataV1,
+    DOReqMetadata
+}