@ethernity-cloud/sdk-js 1.5.4 → 1.5.5

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -1,586 +1,586 @@
-// Force stdout/stderr to be synchronous (blocking). Under SCONE 6 + Node, when
-// the process exits quickly (e.g. the PUBLIC_KEY cert-harvest run, which prints
-// the cert then returns) Node's pipe-buffered stdout can be torn down before it
-// flushes, so the harvested "PUBLIC_KEY:" line is lost and the CI cannot read
-// the certificate. Setting the fd handles to blocking makes every console.log
-// write synchronously.
-try { if (process.stdout._handle && process.stdout._handle.setBlocking) process.stdout._handle.setBlocking(true); } catch (e) {}
-try { if (process.stderr._handle && process.stderr._handle.setBlocking) process.stderr._handle.setBlocking(true); } catch (e) {}
-
-require('dotenv').config();
-require('dotenv').config({path: './app/.env'});
-require('dotenv').config({path: '/app/.env'});
-
-const ethers = require('ethers');
-const fs = require("fs");
-const etny_crypto = require("./etny_crypto");
-const {DOReqMetadata, Order} = require("./models");
-const {getWalletAddress} = require("./wallet");
-const {executeTask} = require("./etny_exec");
-const {TaskStatus} = require("./task_status");
-const SwiftStreamService = require("./swift_stream_service");
-
-const contract_abi = require('./pox_abi');
-const image_registry_abi = require('./image_registry_abi');
-const {sha256} = require("./etny_crypto");
-const {generateCertFromMrEnclave} = require("./self_sign");
-const esr_wallet = require("./esr_wallet");
-
-// Baked per network by CI (render_network.sh): "mainnet" | "testnet". On testnet
-// the enclave self-signs its cert from MR_ENCLAVE (non-CAS mode); on mainnet the
-// cert/key are provisioned by CAS into the injection paths.
-const NETWORK_TYPE = "__ETNY_NETWORK_TYPE__";
-
-class EtnySecureLock {
-    static debug = false;
-
-    constructor(swiftStreamClient) {
-        console.log('Initializing...');
-        this.version = 'v3';
-        this.swiftStreamService = swiftStreamClient;
-        this.etny_bucket = "__ETNY_BUCKET__";
-        this.setInitializers();
-    }
-
-    setInitializers() {
-        this.is_valid_client_data = true;
-        // Testnet holds the self-derived identity key HERE, in memory only, and
-        // never writes it. Stays null on mainnet, where CAS injects the key into
-        // key_file and every consumer reads that path exactly as before.
-        this.identity_private_key_pem = null;
-        this.key_file = "/private/__ENCLAVE_NAME_SECURELOCK__/key.pem";
-        this.cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/cert.pem";
-        this.pub_cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/enclave_pub_cert.pem";
-        this.payload = "payload.etny.securelock";
-        this.input = "input.txt.securelock";
-        this.result_file = "/app/result.txt";
-        this.transaction_file = "/app/transaction.txt";
-        this.smart_contract_address = "__ETNY_SMART_CONTRACT_ADDRESS__";
-        this.image_registry_address = '__ETNY_IMAGE_REGISTRY_ADDRESS__';
-        this.chain_id = __ETNY_CHAIN_ID__;
-        this.web3_provider = "__ETNY_WEB3_PROVIDER__";
-        this.signed_tx_as_bytes = null;
-        this.client_challenge = "";
-
-        if (this.etny_mode === "TEST") {
-            this.key_file = "/private/key.pem";
-            this.cert_file = "/app/cert.pem";
-            this.payload = "./app/payload.js";
-            this.input = "./app/input.txt";
-            this.result_file = "./app/result.txt";
-            this.transaction_file = "./app/transaction.txt";
-            this.pub_cert_file = "./app/enclave_pub_cert.pem";
-        }
-
-        if (this.etny_mode === "LOCAL_TEST") {
-            this.key_file = "./certs/key.pem";
-            this.cert_file = "./certs/cert.pem";
-            this.payload = "./app/payload.js";
-            this.input = "./app/input.txt";
-            this.result_file = "./app/result.txt";
-            this.transaction_file = "./app/transaction.txt";
-            this.pub_cert_file = "./app/enclave_pub_cert.pem";
-        }
-    }
-
-    async create() {
-        //overriding default values with those read from .env file
-        this.loadEnv();
-        this.printEnv();
-        await this.savePublicCert();
-        this.initWeb3();
-        if (this.etny_mode === "PRODUCTION") {
-            this.resetPrivateCertFile();
-        }
-
-        return true;
-    }
-
-    loadEnv() {
-        if (process.env.ETNY_CHAIN_ID) {
-            this.chain_id = parseInt(process.env.ETNY_CHAIN_ID);
-        }
-
-        if (process.env.ETNY_SMART_CONTRACT_ADDRESS) {
-            this.smart_contract_address = process.env.ETNY_SMART_CONTRACT_ADDRESS.trim();
-        }
-
-        if (process.env.ETNY_WEB3_PROVIDER) {
-            this.web3_provider = process.env.ETNY_WEB3_PROVIDER.trim();
-        }
-
-        if (process.env.IMAGE_REGISTRY_ADDRESS) {
-            this.image_registry_address = process.env.IMAGE_REGISTRY_ADDRESS.trim();
-        }
-
-        if (process.env.ETNY_BUCKET) {
-            this.etny_bucket = process.env.ETNY_BUCKET.trim();
-        }
-
-        if (process.env.ETNY_CLIENT_CHALLENGE) {
-            this.client_challenge = process.env.ETNY_CLIENT_CHALLENGE.trim();
-        }
-        if (process.env.ETNY_ORDER_ID) {
-            this.order_id = parseInt(process.env.ETNY_ORDER_ID);
-        }
-    }
-
-    printEnv() {
-        console.log('CHAIN ID:', this.chain_id);
-        console.log('SMART CONTRACT ADDRESS:', this.smart_contract_address);
-        console.log('WEB3 PROVIDER:', this.web3_provider);
-        console.log('ENCRYPTED CHALLENGE:', this.client_challenge);
-        console.log('ORDER ID:', this.order_id);
-    }
-
-    initWeb3() {
-        // Create an ethers.js provider connected to the Bloxberg network
-        this.w3 = new ethers.providers.JsonRpcProvider(this.web3_provider);
-        // Create an instance of the contract using the ABI and address
-        this.etny = new ethers.Contract(this.smart_contract_address, contract_abi, this.w3);
-        this.image_registry = new ethers.Contract(this.image_registry_address, image_registry_abi, this.w3);
-        // this.iamge_registry_signer = new ethers.Contract(this.image_registry_address, image_registry_abi.abi, this.walletSigner);
-    }
-
-    async readEnv() {
-        try {
-            console.log('Getting .env if exists...');
-            const envFile = await this.swiftStreamService.getFileContent(this.etny_bucket, ".env");
-            console.log("Env:", envFile);
-            console.log("Saving .env file...");
-            await fs.promises.writeFile('.env', envFile);
-            require('dotenv').config();
-
-            this.version = 'v3';
-            this.etny_mode = process.env.ETNY_MODE;
-            console.log(`ETNY Nodenithy [${this.version}] - running in ${this.etny_mode} MODE`);
-            //console.log(process.env);
-
-            return true;
-        } catch (e) {
-            return false;
-        }
-    }
-
-    // v4 checksum validation: the DO-request is submitted on-chain by the owner,
-    // so the metadata checksum is already authenticated by the transaction sender;
-    // we only confirm the file content hashes to that recorded checksum. Empty
-    // input carries no checksum (has_checksum === false) and is skipped. Kept
-    // identical across securelock / trustedzone / validator so all three agree.
-    async validateClientPayload(payload_data, input_data) {
-        await this.getDORequestMetadata();
-
-        const pmeta = this._metadata.payload_metadata_obj;
-        if (pmeta.has_checksum) {
-            const expected = pmeta.checksum.toLowerCase().replace(/^0x/, '');
-            if (sha256(payload_data) !== expected) {
-                this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
-                this.task_result = 'PAYLOAD CHECKSUM DOESN\'T MATCH';
-                this.is_valid_client_data = false;
-                return;
-            }
-        } else {
-            // payload is required and must carry a checksum
-            this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
-            this.task_result = 'PAYLOAD CHECKSUM DOESN\'T EXIST';
-            this.is_valid_client_data = false;
-            return;
-        }
-
-        const imeta = this._metadata.input_metadata_obj;
-        if (imeta.has_checksum) {
-            const expected = imeta.checksum.toLowerCase().replace(/^0x/, '');
-            if (sha256(input_data) !== expected) {
-                this.task_code = TaskStatus.INPUT_CHECKSUM_ERROR;
-                this.task_result = 'INPUT CHECKSUM DOESN\'T MATCH';
-                this.is_valid_client_data = false;
-            }
-        }
-    }
-
-    wait(timeout) {
-        return new Promise(resolve => {
-            setTimeout(resolve, timeout);
-        });
-    }
-
-    async waitForObjectInBucket(bucketName, objectName, timeout = 600) {
-        let i = 0;
-        console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
-        while (true) {
-            await this.wait(1000);
-            i++;
-            if (i % 20 === 0)
-                console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
-            if (i > timeout) {
-                break;
-            }
-            const [status, result] = await this.swiftStreamService.isObjectInBucket(bucketName, objectName);
-            if (result) {
-                break;
-            }
-        }
-
-        console.log('TrustedZone finished the execution');
-    }
-
-    async waitForPayloadAndInput() {
-        console.log('Waiting for payload and input');
-        await this.waitForObjectInBucket(this.etny_bucket, this.payload);
-        await this.waitForObjectInBucket(this.etny_bucket, this.input);
-    }
-
-    async getFileContentAndDecrypt(bucketName, objectName) {
-        try {
-            const encryptedBase64 = await this.swiftStreamService.getFileContent(bucketName, objectName);
-
-            const encryptedTuple = etny_crypto.encryptedDataFromBase64Json(encryptedBase64);
-            const decryptedResult = etny_crypto.decrypt(this.privateKeyMaterial(), encryptedTuple);
-            return decryptedResult.toString();
-        } catch (e) {
-            console.log(`Failed to get ${objectName} file`);
-            return false;
-        }
-    }
-
-    async getTrustedZonePublicKey() {
-        try {
-            console.log('Getting the public key of the trusted zone enclave');
-            let imageHash = this._metadata.image_hash;
-            console.log('imageHash:', imageHash);
-            if (EtnySecureLock.debug) {
-                imageHash = 'v3-hash-1';
-            }
-            this.trustedZonePublicKey = await this.image_registry.getTrustedZoneImageCertPublicKey(imageHash);
-            console.log('Public key of the TrustedZone enclave from smart contract:', this.trustedZonePublicKey);
-        } catch (e) {
-            console.log('getTrustedZonePublicKey', e);
-        }
-    }
-
-    async encryptFileAndPushToSwiftStream(fileData, fileName) {
-        try {
-            console.log(`Started saving file ${fileName}.securelock...`);
-            const encryptedInput = etny_crypto.encrypt(this.trustedZonePublicKey, fileData);
-            const encryptedInputBase64 = etny_crypto.encryptedDataToBase64Json(encryptedInput);
-
-            // File name should end with the '.securelock' extension
-            fileName += '.securelock';
-            // const data = Buffer.from(encryptedInputBase64, 'utf8');
-            const status = this.swiftStreamService.putFileContent(this.etny_bucket, fileName, '', encryptedInputBase64);
-            if (status) {
-                console.log(`File ${fileName} encrypted and saved to swift stream successfully`);
-            }
-        } catch (e) {
-            console.log('encryptFileAndPushToSwiftStream', e);
-        }
-    }
-
-    async getDORequestMetadata() {
-        const o_result = await this.etny.functions._getOrder(this.order_id);
-        const order = new Order(o_result, this.order_id);
-        //console.log('order', order);
-        this._order_metadata = order;
-        const o_metadata = await this.etny.functions._getDORequestMetadata(order.do_req);
-        this._metadata = new DOReqMetadata(o_metadata, order.do_req);
-        //console.log('metadata', this._metadata);
-    }
-
-    resetPrivateCertFile() {
-        // Wipes the CAS-injected key from disk after it has been loaded
-        // (mainnet PRODUCTION hygiene). On testnet the key was never written --
-        // it lives only in memory -- so there is nothing on disk to wipe and the
-        // truncate/read below would throw on a file that does not exist.
-        //
-        // The in-memory key is deliberately NOT cleared here: waitForPayloadAndInput
-        // still needs it later to decrypt the payload/input, which runs after
-        // create() has called this. Clearing it would break the task on testnet only.
-        if (this.identity_private_key_pem) {
-            return;
-        }
-        try {
-            fs.truncate(this.key_file, 0, function () {
-                //console.log('Private certificate file was cleaned.')
-            });
-        } catch (e) {
-            //console.log('Error while removing the private key file content', e);
-        }
-        try {
-            fs.readFileSync(this.key_file, 'utf8');
-        } catch (e) {
-            // Nothing to read back; the wipe above is what mattered.
-        }
-    }
-
-    // Testnet non-CAS mode: derive a deterministic self-signed cert/key from this
-    // enclave's identity. The CERTIFICATE is written (it is public, and
-    // savePublicCert reads it back to publish it); the PRIVATE KEY is kept ONLY
-    // in memory and never touches the filesystem.
-    //
-    // Why memory-only: on testnet there is no CAS and no attestation, so nothing
-    // provisions or protects the key from outside the enclave. Not writing it at
-    // all removes every at-rest attack on it outright, instead of relying on the
-    // file protection being keyed by something trustworthy on this path.
-    //
-    // MAINNET IS UNCHANGED: this method returns immediately there, CAS still
-    // injects cert+key into key_file/cert_file, and every consumer still reads
-    // key_file exactly as before (this.identity_private_key_pem stays null, and
-    // privateKeyMaterial() falls back to the path).
-    //
-    // Idempotent: the key is a pure function of the enclave identity, so it is
-    // identical across restarts without needing to persist it.
-    generateSelfSignedCertIfTestnet() {
-        if (NETWORK_TYPE !== "testnet") return;
-        console.log("[SecureLock] TESTNET: self-signing certificate from MR_ENCLAVE (no CAS) [TESTNET-INSECURE]");
-        const {privateKeyPem, certPem, mrEnclaveHex} = generateCertFromMrEnclave("SecureLock Enclave");
-        console.log(`[SecureLock] MR_ENCLAVE: ${mrEnclaveHex}`);
-        for (const f of [this.cert_file, this.pub_cert_file]) {
-            try { fs.mkdirSync(require('path').dirname(f), {recursive: true}); } catch (e) {}
-        }
-        // Private key: memory only. Deliberately NOT written to this.key_file.
-        this.identity_private_key_pem = privateKeyPem;
-        fs.writeFileSync(this.cert_file, certPem);
-    }
-
-    // The enclave's identity private key, in whatever form this network provides
-    // it: the in-memory PEM on testnet, or the CAS-injected key_file path on
-    // mainnet. etny_crypto accepts either, so callers do not branch on network.
-    privateKeyMaterial() {
-        return this.identity_private_key_pem || this.key_file;
-    }
-
-    async savePublicCert() {
-        try {
-            const content = await fs.promises.readFile(this.cert_file, 'utf8');
-            await fs.promises.writeFile(this.pub_cert_file, content);
-            //console.log(`Public certificate saved to ${this.pub_cert_file}`);
-            console.log(`PUBLIC_KEY:`);
-            console.log(content);
-
-            // ESR (RFC §5.2): emit the enclave's ESR wallet ADDRESS on the same
-            // harvest channel as the cert, so publish (or the remote extraction
-            // service) can capture it. It MUST be derived here rather than by the
-            // service: on mainnet the identity key is CAS-provisioned and exists
-            // only inside this enclave, so nobody outside can compute the address.
-            // Only the address is emitted — the private key never leaves.
-            this.emitEsrWalletAddress();
-
-            await this.swiftStreamService.putFileContent(this.etny_bucket, 'cert.pem', this.pub_cert_file);
-        } catch (err) {
-            console.error(err);
-        }
-    }
-
-    // ESR wallet address emission (RFC §5.2). Gated on ESR_CONTRACT_ADDRESS being
-    // set, exactly like the Python securelock, so non-ESR images print nothing.
-    // Derived from the enclave's own identity private key (the certificate key);
-    // only the ADDRESS is logged, never the key. Any failure is reported as
-    // ESR_WALLET_ERROR and never breaks cert harvest or a task.
-    emitEsrWalletAddress() {
-        if (!String(process.env.ESR_CONTRACT_ADDRESS || "").trim()) return;
-        try {
-            // The identity key the enclave actually holds: the CAS-provisioned
-            // key_file on mainnet (nothing in-enclave can re-derive it), or the
-            // in-memory PEM on testnet (never written to disk). Hashed as-is,
-            // matching the Python SDK.
-            const identityPriv = this.identity_private_key_pem
-                || fs.readFileSync(this.key_file, 'utf8');
-            const esrAddress = esr_wallet.deriveWalletAddress(identityPriv);
-            console.log(`ESR_WALLET_ADDRESS: ${esrAddress}`);
-            if (!esr_wallet.isSecretIdentity(NETWORK_TYPE)) {
-                console.warn(esr_wallet.INSECURE_IDENTITY_WARNING);
-            }
-        } catch (e) {
-            // Never let ESR derivation break harvest/a task: report it the way
-            // every other enclave-side config problem is reported.
-            console.error(`ESR_WALLET_ERROR: ${e && e.message ? e.message : e}`);
-        }
-    }
-
-    async saveResult() {
-        try {
-            await this.getTrustedZonePublicKey();
-            await this.encryptFileAndPushToSwiftStream(this.task_result, 'result.txt');
-            await this.encryptFileAndPushToSwiftStream(this.task_code.toString(), 'result_code.txt');
-
-            const encrypted = etny_crypto.encryptWithPublicKey(this._metadata.public_key, this.task_result);
-            //console.log('Encrypted result:', encrypted.toString('hex'));
-            const result = await this.swiftStreamService.putFileContent(this.etny_bucket, 'result.txt', this.result_file, encrypted.toString('hex'));
-            //console.log('Save result put: ', result);
-        } catch (e) {
-            console.log('Save result: ', e);
-        }
-    }
-
-    // Make StateRegistry usable from payload code, if ESR is enabled.
-    //
-    // Wires ecld_state to this enclave's identity key, the SwiftStream client
-    // and bucket the node shares with us, the registry address baked in at build
-    // time, and the provider. Payload code then just does:
-    //
-    //     const {StateRegistry} = require('./ecld_state');
-    //     await new StateRegistry().commit('key', s => ...);
-    //
-    // No-op when ESR is disabled, so non-ESR enclaves are unaffected. Never
-    // throws: a setup problem must not stop the task from running -- payload
-    // code that then uses StateRegistry gets a clear error from the registry
-    // itself rather than a task that died before starting.
-    configureStateRegistry() {
-        const contractAddress = String(process.env.ESR_CONTRACT_ADDRESS || "").trim();
-        if (!contractAddress) return;
-        try {
-            const ecld_state = require("./ecld_state");
-            ecld_state.configure({
-                identityPriv: this.identity_private_key_pem || fs.readFileSync(this.key_file, 'utf8'),
-                swiftStreamService: this.swiftStreamService,
-                bucket: this.etny_bucket,
-                contractAddress: contractAddress,
-                provider: this.w3,
-            });
-            console.log(`StateRegistry ready (ESR ${contractAddress})`);
-        } catch (e) {
-            console.error(`ESR_STATE_ERROR: could not configure StateRegistry: ${e && e.message ? e.message : e}`);
-        }
-    }
-
-    async execute() {
-        const payload_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.payload);
-        const input_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.input);
-        console.log('Validating client payload and input...');
-        await this.validateClientPayload(payload_data, input_data);
-
-        if (this.is_valid_client_data) {
-            console.log('Client payload and input are valid');
-        } else {
-            console.log('Client payload and input are NOT valid');
-            return false;
-        }
-
-        this.configureStateRegistry();
-
-        const task_result = executeTask(payload_data, input_data);
-        console.log('TASK RESULT (code, data):', task_result);
-        this.task_code = task_result[0];
-        this.task_result = task_result[1];
-
-        return true;
-    }
-
-}
-
-function initSwiftStreamClient() {
-    console.log('Initializing SwiftStream Service...');
-    const swiftStreamClient = new SwiftStreamService(
-        EtnySecureLock.debug ? "localhost" : "etny-swift-stream",
-        9000,
-        "swiftstreamadmin",
-        "swiftstreamadmin");
-    console.log('SwiftStream Service started.');
-    console.log('################################');
-
-    return swiftStreamClient;
-}
-
-// Set as soon as the enclave object exists so the top-level catch can report a
-// failure result even when the throw happens deep inside execute().
-let currentApp = null;
-
-/**
- * Best-effort: write a failure result so the trustedzone stops waiting.
- *
- * Securelock only publishes the result and its code; the trustedzone reads
- * those and builds the signed transaction. Without them that wait runs to its
- * timeout and the whole order stalls with no diagnosis.
- *
- * Guarded throughout: this runs while already handling a failure, so it must
- * never throw or hang.
- */
-async function reportFailure(app, err) {
-    if (!app) {
-        console.log('cannot report failure: enclave died before initialization');
-        return;
-    }
-    try {
-        // Keep a specific code if one was already set (checksum mismatch, ...).
-        if (app.task_code === undefined || app.task_code === null || app.task_code === '') {
-            app.task_code = TaskStatus.SYSTEM_ERROR;
-        }
-        if (!app.task_result) {
-            app.task_result = `ENCLAVE ERROR: ${err && err.message ? err.message : err}`;
-        }
-        await app.saveResult();
-        console.log(`failure reported (task_code=${app.task_code})`);
-    } catch (reportErr) {
-        console.log('could not report the failure result:', reportErr);
-    }
-}
-
-async function execute() {
-    console.log('########################################');
-    console.log('########################################');
-    console.log('########## [ETNY SecureLock] ##########');
-    console.log('########################################');
-    console.log('########################################');
-    console.log('');
-    console.log('');
-    console.log('');
-
-    const swiftStreamClient = initSwiftStreamClient();
-
-    const app = new EtnySecureLock(swiftStreamClient);
-    // Exposed so the top-level handler can still publish a failure result if
-    // anything below throws (see reportFailure).
-    currentApp = app;
-
-    // Testnet: materialize the self-signed cert/key from MR_ENCLAVE into the
-    // file paths before anything reads them (harvest + decrypt). No-op on mainnet
-    // (CAS provides those files).
-    app.generateSelfSignedCertIfTestnet();
-
-    const hasReadEnvFile = await app.readEnv();
-    if (!hasReadEnvFile && !EtnySecureLock.debug) {
-        console.log(`Failed reading .env file.`);
-        await app.savePublicCert();
-        return;
-    }
-
-    if (process.env.ETNY_MODE === "PUBLIC_KEY") {
-        await app.savePublicCert();
-    } else {
-        console.log('Creating the application...');
-        const created = await app.create();
-
-        if (!created) {
-            console.log(`Failed at creation step, not able decoding input metadata, exiting.`);
-            return;
-        }
-
-        console.log('Waiting for payload and input to be downloaded...');
-        await app.waitForPayloadAndInput();
-
-        if (app.is_valid_client_data) {
-            console.log('Executing client code...');
-            const wasExecuted = await app.execute();
-            if (!wasExecuted) {
-                console.log('Failed execution of SecureLock enclave.')
-                return;
-            }
-        } else {
-            console.log(`Failed client payload and input validation, ${app.task_result}, exiting.`);
-            return;
-        }
-
-        await app.saveResult();
-        console.log('Finished process.');
-    }
-}
-
-(async () => {
-    try {
-        await execute();
-    } catch (e) {
-        console.log(e);
-        await reportFailure(currentApp, e);
-        process.exitCode = 1;
-    }
-})();
+// Force stdout/stderr to be synchronous (blocking). Under SCONE 6 + Node, when
+// the process exits quickly (e.g. the PUBLIC_KEY cert-harvest run, which prints
+// the cert then returns) Node's pipe-buffered stdout can be torn down before it
+// flushes, so the harvested "PUBLIC_KEY:" line is lost and the CI cannot read
+// the certificate. Setting the fd handles to blocking makes every console.log
+// write synchronously.
+try { if (process.stdout._handle && process.stdout._handle.setBlocking) process.stdout._handle.setBlocking(true); } catch (e) {}
+try { if (process.stderr._handle && process.stderr._handle.setBlocking) process.stderr._handle.setBlocking(true); } catch (e) {}
+
+require('dotenv').config();
+require('dotenv').config({path: './app/.env'});
+require('dotenv').config({path: '/app/.env'});
+
+const ethers = require('ethers');
+const fs = require("fs");
+const etny_crypto = require("./etny_crypto");
+const {DOReqMetadata, Order} = require("./models");
+const {getWalletAddress} = require("./wallet");
+const {executeTask} = require("./etny_exec");
+const {TaskStatus} = require("./task_status");
+const SwiftStreamService = require("./swift_stream_service");
+
+const contract_abi = require('./pox_abi');
+const image_registry_abi = require('./image_registry_abi');
+const {sha256} = require("./etny_crypto");
+const {generateCertFromMrEnclave} = require("./self_sign");
+const esr_wallet = require("./esr_wallet");
+
+// Baked per network by CI (render_network.sh): "mainnet" | "testnet". On testnet
+// the enclave self-signs its cert from MR_ENCLAVE (non-CAS mode); on mainnet the
+// cert/key are provisioned by CAS into the injection paths.
+const NETWORK_TYPE = "__ETNY_NETWORK_TYPE__";
+
+class EtnySecureLock {
+    static debug = false;
+
+    constructor(swiftStreamClient) {
+        console.log('Initializing...');
+        this.version = 'v3';
+        this.swiftStreamService = swiftStreamClient;
+        this.etny_bucket = "__ETNY_BUCKET__";
+        this.setInitializers();
+    }
+
+    setInitializers() {
+        this.is_valid_client_data = true;
+        // Testnet holds the self-derived identity key HERE, in memory only, and
+        // never writes it. Stays null on mainnet, where CAS injects the key into
+        // key_file and every consumer reads that path exactly as before.
+        this.identity_private_key_pem = null;
+        this.key_file = "/private/__ENCLAVE_NAME_SECURELOCK__/key.pem";
+        this.cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/cert.pem";
+        this.pub_cert_file = "/app/__ENCLAVE_NAME_SECURELOCK__/enclave_pub_cert.pem";
+        this.payload = "payload.etny.securelock";
+        this.input = "input.txt.securelock";
+        this.result_file = "/app/result.txt";
+        this.transaction_file = "/app/transaction.txt";
+        this.smart_contract_address = "__ETNY_SMART_CONTRACT_ADDRESS__";
+        this.image_registry_address = '__ETNY_IMAGE_REGISTRY_ADDRESS__';
+        this.chain_id = __ETNY_CHAIN_ID__;
+        this.web3_provider = "__ETNY_WEB3_PROVIDER__";
+        this.signed_tx_as_bytes = null;
+        this.client_challenge = "";
+
+        if (this.etny_mode === "TEST") {
+            this.key_file = "/private/key.pem";
+            this.cert_file = "/app/cert.pem";
+            this.payload = "./app/payload.js";
+            this.input = "./app/input.txt";
+            this.result_file = "./app/result.txt";
+            this.transaction_file = "./app/transaction.txt";
+            this.pub_cert_file = "./app/enclave_pub_cert.pem";
+        }
+
+        if (this.etny_mode === "LOCAL_TEST") {
+            this.key_file = "./certs/key.pem";
+            this.cert_file = "./certs/cert.pem";
+            this.payload = "./app/payload.js";
+            this.input = "./app/input.txt";
+            this.result_file = "./app/result.txt";
+            this.transaction_file = "./app/transaction.txt";
+            this.pub_cert_file = "./app/enclave_pub_cert.pem";
+        }
+    }
+
+    async create() {
+        //overriding default values with those read from .env file
+        this.loadEnv();
+        this.printEnv();
+        await this.savePublicCert();
+        this.initWeb3();
+        if (this.etny_mode === "PRODUCTION") {
+            this.resetPrivateCertFile();
+        }
+
+        return true;
+    }
+
+    loadEnv() {
+        if (process.env.ETNY_CHAIN_ID) {
+            this.chain_id = parseInt(process.env.ETNY_CHAIN_ID);
+        }
+
+        if (process.env.ETNY_SMART_CONTRACT_ADDRESS) {
+            this.smart_contract_address = process.env.ETNY_SMART_CONTRACT_ADDRESS.trim();
+        }
+
+        if (process.env.ETNY_WEB3_PROVIDER) {
+            this.web3_provider = process.env.ETNY_WEB3_PROVIDER.trim();
+        }
+
+        if (process.env.IMAGE_REGISTRY_ADDRESS) {
+            this.image_registry_address = process.env.IMAGE_REGISTRY_ADDRESS.trim();
+        }
+
+        if (process.env.ETNY_BUCKET) {
+            this.etny_bucket = process.env.ETNY_BUCKET.trim();
+        }
+
+        if (process.env.ETNY_CLIENT_CHALLENGE) {
+            this.client_challenge = process.env.ETNY_CLIENT_CHALLENGE.trim();
+        }
+        if (process.env.ETNY_ORDER_ID) {
+            this.order_id = parseInt(process.env.ETNY_ORDER_ID);
+        }
+    }
+
+    printEnv() {
+        console.log('CHAIN ID:', this.chain_id);
+        console.log('SMART CONTRACT ADDRESS:', this.smart_contract_address);
+        console.log('WEB3 PROVIDER:', this.web3_provider);
+        console.log('ENCRYPTED CHALLENGE:', this.client_challenge);
+        console.log('ORDER ID:', this.order_id);
+    }
+
+    initWeb3() {
+        // Create an ethers.js provider connected to the Bloxberg network
+        this.w3 = new ethers.providers.JsonRpcProvider(this.web3_provider);
+        // Create an instance of the contract using the ABI and address
+        this.etny = new ethers.Contract(this.smart_contract_address, contract_abi, this.w3);
+        this.image_registry = new ethers.Contract(this.image_registry_address, image_registry_abi, this.w3);
+        // this.iamge_registry_signer = new ethers.Contract(this.image_registry_address, image_registry_abi.abi, this.walletSigner);
+    }
+
+    async readEnv() {
+        try {
+            console.log('Getting .env if exists...');
+            const envFile = await this.swiftStreamService.getFileContent(this.etny_bucket, ".env");
+            console.log("Env:", envFile);
+            console.log("Saving .env file...");
+            await fs.promises.writeFile('.env', envFile);
+            require('dotenv').config();
+
+            this.version = 'v3';
+            this.etny_mode = process.env.ETNY_MODE;
+            console.log(`ETNY Nodenithy [${this.version}] - running in ${this.etny_mode} MODE`);
+            //console.log(process.env);
+
+            return true;
+        } catch (e) {
+            return false;
+        }
+    }
+
+    // v4 checksum validation: the DO-request is submitted on-chain by the owner,
+    // so the metadata checksum is already authenticated by the transaction sender;
+    // we only confirm the file content hashes to that recorded checksum. Empty
+    // input carries no checksum (has_checksum === false) and is skipped. Kept
+    // identical across securelock / trustedzone / validator so all three agree.
+    async validateClientPayload(payload_data, input_data) {
+        await this.getDORequestMetadata();
+
+        const pmeta = this._metadata.payload_metadata_obj;
+        if (pmeta.has_checksum) {
+            const expected = pmeta.checksum.toLowerCase().replace(/^0x/, '');
+            if (sha256(payload_data) !== expected) {
+                this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
+                this.task_result = 'PAYLOAD CHECKSUM DOESN\'T MATCH';
+                this.is_valid_client_data = false;
+                return;
+            }
+        } else {
+            // payload is required and must carry a checksum
+            this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
+            this.task_result = 'PAYLOAD CHECKSUM DOESN\'T EXIST';
+            this.is_valid_client_data = false;
+            return;
+        }
+
+        const imeta = this._metadata.input_metadata_obj;
+        if (imeta.has_checksum) {
+            const expected = imeta.checksum.toLowerCase().replace(/^0x/, '');
+            if (sha256(input_data) !== expected) {
+                this.task_code = TaskStatus.INPUT_CHECKSUM_ERROR;
+                this.task_result = 'INPUT CHECKSUM DOESN\'T MATCH';
+                this.is_valid_client_data = false;
+            }
+        }
+    }
+
+    wait(timeout) {
+        return new Promise(resolve => {
+            setTimeout(resolve, timeout);
+        });
+    }
+
+    async waitForObjectInBucket(bucketName, objectName, timeout = 600) {
+        let i = 0;
+        console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
+        while (true) {
+            await this.wait(1000);
+            i++;
+            if (i % 20 === 0)
+                console.log(`Checking if object ${objectName} exists in bucket ${bucketName}`);
+            if (i > timeout) {
+                break;
+            }
+            const [status, result] = await this.swiftStreamService.isObjectInBucket(bucketName, objectName);
+            if (result) {
+                break;
+            }
+        }
+
+        console.log('TrustedZone finished the execution');
+    }
+
+    async waitForPayloadAndInput() {
+        console.log('Waiting for payload and input');
+        await this.waitForObjectInBucket(this.etny_bucket, this.payload);
+        await this.waitForObjectInBucket(this.etny_bucket, this.input);
+    }
+
+    async getFileContentAndDecrypt(bucketName, objectName) {
+        try {
+            const encryptedBase64 = await this.swiftStreamService.getFileContent(bucketName, objectName);
+
+            const encryptedTuple = etny_crypto.encryptedDataFromBase64Json(encryptedBase64);
+            const decryptedResult = etny_crypto.decrypt(this.privateKeyMaterial(), encryptedTuple);
+            return decryptedResult.toString();
+        } catch (e) {
+            console.log(`Failed to get ${objectName} file`);
+            return false;
+        }
+    }
+
+    async getTrustedZonePublicKey() {
+        try {
+            console.log('Getting the public key of the trusted zone enclave');
+            let imageHash = this._metadata.image_hash;
+            console.log('imageHash:', imageHash);
+            if (EtnySecureLock.debug) {
+                imageHash = 'v3-hash-1';
+            }
+            this.trustedZonePublicKey = await this.image_registry.getTrustedZoneImageCertPublicKey(imageHash);
+            console.log('Public key of the TrustedZone enclave from smart contract:', this.trustedZonePublicKey);
+        } catch (e) {
+            console.log('getTrustedZonePublicKey', e);
+        }
+    }
+
+    async encryptFileAndPushToSwiftStream(fileData, fileName) {
+        try {
+            console.log(`Started saving file ${fileName}.securelock...`);
+            const encryptedInput = etny_crypto.encrypt(this.trustedZonePublicKey, fileData);
+            const encryptedInputBase64 = etny_crypto.encryptedDataToBase64Json(encryptedInput);
+
+            // File name should end with the '.securelock' extension
+            fileName += '.securelock';
+            // const data = Buffer.from(encryptedInputBase64, 'utf8');
+            const status = this.swiftStreamService.putFileContent(this.etny_bucket, fileName, '', encryptedInputBase64);
+            if (status) {
+                console.log(`File ${fileName} encrypted and saved to swift stream successfully`);
+            }
+        } catch (e) {
+            console.log('encryptFileAndPushToSwiftStream', e);
+        }
+    }
+
+    async getDORequestMetadata() {
+        const o_result = await this.etny.functions._getOrder(this.order_id);
+        const order = new Order(o_result, this.order_id);
+        //console.log('order', order);
+        this._order_metadata = order;
+        const o_metadata = await this.etny.functions._getDORequestMetadata(order.do_req);
+        this._metadata = new DOReqMetadata(o_metadata, order.do_req);
+        //console.log('metadata', this._metadata);
+    }
+
+    resetPrivateCertFile() {
+        // Wipes the CAS-injected key from disk after it has been loaded
+        // (mainnet PRODUCTION hygiene). On testnet the key was never written --
+        // it lives only in memory -- so there is nothing on disk to wipe and the
+        // truncate/read below would throw on a file that does not exist.
+        //
+        // The in-memory key is deliberately NOT cleared here: waitForPayloadAndInput
+        // still needs it later to decrypt the payload/input, which runs after
+        // create() has called this. Clearing it would break the task on testnet only.
+        if (this.identity_private_key_pem) {
+            return;
+        }
+        try {
+            fs.truncate(this.key_file, 0, function () {
+                //console.log('Private certificate file was cleaned.')
+            });
+        } catch (e) {
+            //console.log('Error while removing the private key file content', e);
+        }
+        try {
+            fs.readFileSync(this.key_file, 'utf8');
+        } catch (e) {
+            // Nothing to read back; the wipe above is what mattered.
+        }
+    }
+
+    // Testnet non-CAS mode: derive a deterministic self-signed cert/key from this
+    // enclave's identity. The CERTIFICATE is written (it is public, and
+    // savePublicCert reads it back to publish it); the PRIVATE KEY is kept ONLY
+    // in memory and never touches the filesystem.
+    //
+    // Why memory-only: on testnet there is no CAS and no attestation, so nothing
+    // provisions or protects the key from outside the enclave. Not writing it at
+    // all removes every at-rest attack on it outright, instead of relying on the
+    // file protection being keyed by something trustworthy on this path.
+    //
+    // MAINNET IS UNCHANGED: this method returns immediately there, CAS still
+    // injects cert+key into key_file/cert_file, and every consumer still reads
+    // key_file exactly as before (this.identity_private_key_pem stays null, and
+    // privateKeyMaterial() falls back to the path).
+    //
+    // Idempotent: the key is a pure function of the enclave identity, so it is
+    // identical across restarts without needing to persist it.
+    generateSelfSignedCertIfTestnet() {
+        if (NETWORK_TYPE !== "testnet") return;
+        console.log("[SecureLock] TESTNET: self-signing certificate from MR_ENCLAVE (no CAS) [TESTNET-INSECURE]");
+        const {privateKeyPem, certPem, mrEnclaveHex} = generateCertFromMrEnclave("SecureLock Enclave");
+        console.log(`[SecureLock] MR_ENCLAVE: ${mrEnclaveHex}`);
+        for (const f of [this.cert_file, this.pub_cert_file]) {
+            try { fs.mkdirSync(require('path').dirname(f), {recursive: true}); } catch (e) {}
+        }
+        // Private key: memory only. Deliberately NOT written to this.key_file.
+        this.identity_private_key_pem = privateKeyPem;
+        fs.writeFileSync(this.cert_file, certPem);
+    }
+
+    // The enclave's identity private key, in whatever form this network provides
+    // it: the in-memory PEM on testnet, or the CAS-injected key_file path on
+    // mainnet. etny_crypto accepts either, so callers do not branch on network.
+    privateKeyMaterial() {
+        return this.identity_private_key_pem || this.key_file;
+    }
+
+    async savePublicCert() {
+        try {
+            const content = await fs.promises.readFile(this.cert_file, 'utf8');
+            await fs.promises.writeFile(this.pub_cert_file, content);
+            //console.log(`Public certificate saved to ${this.pub_cert_file}`);
+            console.log(`PUBLIC_KEY:`);
+            console.log(content);
+
+            // ESR (RFC §5.2): emit the enclave's ESR wallet ADDRESS on the same
+            // harvest channel as the cert, so publish (or the remote extraction
+            // service) can capture it. It MUST be derived here rather than by the
+            // service: on mainnet the identity key is CAS-provisioned and exists
+            // only inside this enclave, so nobody outside can compute the address.
+            // Only the address is emitted — the private key never leaves.
+            this.emitEsrWalletAddress();
+
+            await this.swiftStreamService.putFileContent(this.etny_bucket, 'cert.pem', this.pub_cert_file);
+        } catch (err) {
+            console.error(err);
+        }
+    }
+
+    // ESR wallet address emission (RFC §5.2). Gated on ESR_CONTRACT_ADDRESS being
+    // set, exactly like the Python securelock, so non-ESR images print nothing.
+    // Derived from the enclave's own identity private key (the certificate key);
+    // only the ADDRESS is logged, never the key. Any failure is reported as
+    // ESR_WALLET_ERROR and never breaks cert harvest or a task.
+    emitEsrWalletAddress() {
+        if (!String(process.env.ESR_CONTRACT_ADDRESS || "").trim()) return;
+        try {
+            // The identity key the enclave actually holds: the CAS-provisioned
+            // key_file on mainnet (nothing in-enclave can re-derive it), or the
+            // in-memory PEM on testnet (never written to disk). Hashed as-is,
+            // matching the Python SDK.
+            const identityPriv = this.identity_private_key_pem
+                || fs.readFileSync(this.key_file, 'utf8');
+            const esrAddress = esr_wallet.deriveWalletAddress(identityPriv);
+            console.log(`ESR_WALLET_ADDRESS: ${esrAddress}`);
+            if (!esr_wallet.isSecretIdentity(NETWORK_TYPE)) {
+                console.warn(esr_wallet.INSECURE_IDENTITY_WARNING);
+            }
+        } catch (e) {
+            // Never let ESR derivation break harvest/a task: report it the way
+            // every other enclave-side config problem is reported.
+            console.error(`ESR_WALLET_ERROR: ${e && e.message ? e.message : e}`);
+        }
+    }
+
+    async saveResult() {
+        try {
+            await this.getTrustedZonePublicKey();
+            await this.encryptFileAndPushToSwiftStream(this.task_result, 'result.txt');
+            await this.encryptFileAndPushToSwiftStream(this.task_code.toString(), 'result_code.txt');
+
+            const encrypted = etny_crypto.encryptWithPublicKey(this._metadata.public_key, this.task_result);
+            //console.log('Encrypted result:', encrypted.toString('hex'));
+            const result = await this.swiftStreamService.putFileContent(this.etny_bucket, 'result.txt', this.result_file, encrypted.toString('hex'));
+            //console.log('Save result put: ', result);
+        } catch (e) {
+            console.log('Save result: ', e);
+        }
+    }
+
+    // Make StateRegistry usable from payload code, if ESR is enabled.
+    //
+    // Wires ecld_state to this enclave's identity key, the SwiftStream client
+    // and bucket the node shares with us, the registry address baked in at build
+    // time, and the provider. Payload code then just does:
+    //
+    //     const {StateRegistry} = require('./ecld_state');
+    //     await new StateRegistry().commit('key', s => ...);
+    //
+    // No-op when ESR is disabled, so non-ESR enclaves are unaffected. Never
+    // throws: a setup problem must not stop the task from running -- payload
+    // code that then uses StateRegistry gets a clear error from the registry
+    // itself rather than a task that died before starting.
+    configureStateRegistry() {
+        const contractAddress = String(process.env.ESR_CONTRACT_ADDRESS || "").trim();
+        if (!contractAddress) return;
+        try {
+            const ecld_state = require("./ecld_state");
+            ecld_state.configure({
+                identityPriv: this.identity_private_key_pem || fs.readFileSync(this.key_file, 'utf8'),
+                swiftStreamService: this.swiftStreamService,
+                bucket: this.etny_bucket,
+                contractAddress: contractAddress,
+                provider: this.w3,
+            });
+            console.log(`StateRegistry ready (ESR ${contractAddress})`);
+        } catch (e) {
+            console.error(`ESR_STATE_ERROR: could not configure StateRegistry: ${e && e.message ? e.message : e}`);
+        }
+    }
+
+    async execute() {
+        const payload_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.payload);
+        const input_data = await this.getFileContentAndDecrypt(this.etny_bucket, this.input);
+        console.log('Validating client payload and input...');
+        await this.validateClientPayload(payload_data, input_data);
+
+        if (this.is_valid_client_data) {
+            console.log('Client payload and input are valid');
+        } else {
+            console.log('Client payload and input are NOT valid');
+            return false;
+        }
+
+        this.configureStateRegistry();
+
+        const task_result = executeTask(payload_data, input_data);
+        console.log('TASK RESULT (code, data):', task_result);
+        this.task_code = task_result[0];
+        this.task_result = task_result[1];
+
+        return true;
+    }
+
+}
+
+function initSwiftStreamClient() {
+    console.log('Initializing SwiftStream Service...');
+    const swiftStreamClient = new SwiftStreamService(
+        EtnySecureLock.debug ? "localhost" : "etny-swift-stream",
+        9000,
+        "swiftstreamadmin",
+        "swiftstreamadmin");
+    console.log('SwiftStream Service started.');
+    console.log('################################');
+
+    return swiftStreamClient;
+}
+
+// Set as soon as the enclave object exists so the top-level catch can report a
+// failure result even when the throw happens deep inside execute().
+let currentApp = null;
+
+/**
+ * Best-effort: write a failure result so the trustedzone stops waiting.
+ *
+ * Securelock only publishes the result and its code; the trustedzone reads
+ * those and builds the signed transaction. Without them that wait runs to its
+ * timeout and the whole order stalls with no diagnosis.
+ *
+ * Guarded throughout: this runs while already handling a failure, so it must
+ * never throw or hang.
+ */
+async function reportFailure(app, err) {
+    if (!app) {
+        console.log('cannot report failure: enclave died before initialization');
+        return;
+    }
+    try {
+        // Keep a specific code if one was already set (checksum mismatch, ...).
+        if (app.task_code === undefined || app.task_code === null || app.task_code === '') {
+            app.task_code = TaskStatus.SYSTEM_ERROR;
+        }
+        if (!app.task_result) {
+            app.task_result = `ENCLAVE ERROR: ${err && err.message ? err.message : err}`;
+        }
+        await app.saveResult();
+        console.log(`failure reported (task_code=${app.task_code})`);
+    } catch (reportErr) {
+        console.log('could not report the failure result:', reportErr);
+    }
+}
+
+async function execute() {
+    console.log('########################################');
+    console.log('########################################');
+    console.log('########## [ETNY SecureLock] ##########');
+    console.log('########################################');
+    console.log('########################################');
+    console.log('');
+    console.log('');
+    console.log('');
+
+    const swiftStreamClient = initSwiftStreamClient();
+
+    const app = new EtnySecureLock(swiftStreamClient);
+    // Exposed so the top-level handler can still publish a failure result if
+    // anything below throws (see reportFailure).
+    currentApp = app;
+
+    // Testnet: materialize the self-signed cert/key from MR_ENCLAVE into the
+    // file paths before anything reads them (harvest + decrypt). No-op on mainnet
+    // (CAS provides those files).
+    app.generateSelfSignedCertIfTestnet();
+
+    const hasReadEnvFile = await app.readEnv();
+    if (!hasReadEnvFile && !EtnySecureLock.debug) {
+        console.log(`Failed reading .env file.`);
+        await app.savePublicCert();
+        return;
+    }
+
+    if (process.env.ETNY_MODE === "PUBLIC_KEY") {
+        await app.savePublicCert();
+    } else {
+        console.log('Creating the application...');
+        const created = await app.create();
+
+        if (!created) {
+            console.log(`Failed at creation step, not able decoding input metadata, exiting.`);
+            return;
+        }
+
+        console.log('Waiting for payload and input to be downloaded...');
+        await app.waitForPayloadAndInput();
+
+        if (app.is_valid_client_data) {
+            console.log('Executing client code...');
+            const wasExecuted = await app.execute();
+            if (!wasExecuted) {
+                console.log('Failed execution of SecureLock enclave.')
+                return;
+            }
+        } else {
+            console.log(`Failed client payload and input validation, ${app.task_result}, exiting.`);
+            return;
+        }
+
+        await app.saveResult();
+        console.log('Finished process.');
+    }
+}
+
+(async () => {
+    try {
+        await execute();
+    } catch (e) {
+        console.log(e);
+        await reportFailure(currentApp, e);
+        process.exitCode = 1;
+    }
+})();