@europeum-ebsi/cli 0.0.0

package/dist/scripts/wct/holderWallet

@@ -0,0 +1,39 @@
+using user null
+using user ES256 did2
+
+c0: conformance holder CTWalletCrossAuthorisedInTime authorisedInTime ES256 1.1
+conformance check ct_wallet_cross_authorised_in_time
+
+c1: conformance holder CTWalletCrossAuthorisedDeferred authorisedDeferred ES256 1.1
+conformance check ct_wallet_cross_authorised_deferred
+
+c2: conformance holder CTWalletCrossPreAuthorisedInTime preAuthorisedInTime ES256 1.1
+conformance check ct_wallet_cross_pre_authorised_in_time
+
+c3: conformance holder CTWalletCrossPreAuthorisedDeferred preAuthorisedDeferred ES256 1.1
+conformance check ct_wallet_cross_pre_authorised_deferred
+
+c4: conformance holder CTWalletSameAuthorisedInTime authorisedInTime ES256 1.1
+conformance check ct_wallet_same_authorised_in_time
+
+c5: conformance holder CTWalletSameAuthorisedDeferred authorisedDeferred ES256 1.1
+conformance check ct_wallet_same_authorised_deferred
+
+c6: conformance holder CTWalletSamePreAuthorisedInTime preAuthorisedInTime ES256 1.1
+conformance check ct_wallet_same_pre_authorised_in_time
+
+c7: conformance holder CTWalletSamePreAuthorisedDeferred preAuthorisedDeferred ES256 1.1
+conformance check ct_wallet_same_pre_authorised_deferred
+
+set credentials []
+set credentials.0 c0
+set credentials.1 c1
+set credentials.2 c2
+set credentials.3 c3
+set credentials.4 c4
+set credentials.5 c5
+set credentials.6 c6
+set credentials.7 c7
+
+conformance holder CTWalletQualificationCredential authorisedInTime ES256 1.1 credentials
+conformance check request_ct_wallet_qualification_credential

package/dist/scripts/wct/holderWallet2

@@ -0,0 +1,39 @@
+using user null
+using user ES256 did2
+
+c0: conformance holder CTWalletCrossAuthorisedInTime authorisedInTime ES256 2.0
+conformance check ct_wallet_cross_authorised_in_time 2.0
+
+c1: conformance holder CTWalletCrossAuthorisedDeferred authorisedDeferred ES256 2.0
+conformance check ct_wallet_cross_authorised_deferred 2.0
+
+c2: conformance holder CTWalletCrossPreAuthorisedInTime preAuthorisedInTime ES256 2.0
+conformance check ct_wallet_cross_pre_authorised_in_time 2.0
+
+c3: conformance holder CTWalletCrossPreAuthorisedDeferred preAuthorisedDeferred ES256 2.0
+conformance check ct_wallet_cross_pre_authorised_deferred 2.0
+
+c4: conformance holder CTWalletSameAuthorisedInTime authorisedInTime ES256 2.0
+conformance check ct_wallet_same_authorised_in_time 2.0
+
+c5: conformance holder CTWalletSameAuthorisedDeferred authorisedDeferred ES256 2.0
+conformance check ct_wallet_same_authorised_deferred 2.0
+
+c6: conformance holder CTWalletSamePreAuthorisedInTime preAuthorisedInTime ES256 2.0
+conformance check ct_wallet_same_pre_authorised_in_time 2.0
+
+c7: conformance holder CTWalletSamePreAuthorisedDeferred preAuthorisedDeferred ES256 2.0
+conformance check ct_wallet_same_pre_authorised_deferred 2.0
+
+set credentials []
+set credentials.0 c0
+set credentials.1 c1
+set credentials.2 c2
+set credentials.3 c3
+set credentials.4 c4
+set credentials.5 c5
+set credentials.6 c6
+set credentials.7 c7
+
+conformance holder CTWalletQualificationCredential authorisedInTime ES256 2.0 credentials
+conformance check request_ct_wallet_qualification_credential

package/dist/scripts/wct/issueToHolder

@@ -0,0 +1,38 @@
+using user null
+using user ES256 did2
+set user.issuerState issuer-state
+conformance clientMockInitiate
+
+jwks: conformance get /issuer-mock/jwks
+issuerMockDidNP: compute did2 jwks.keys.0
+
+set preAuthInTimePayload {"authorization_details":[{"type":"openid_credential","format":"jwt_vc","types":["VerifiableCredential","VerifiableAttestation","CTWalletSamePreAuthorisedInTime"],"locations":[""]}]}
+set preAuthInTimePayload.iss user.clientId
+set preAuthInTimePayload.sub issuerMockDidNP
+set preAuthInTimePayload.client_id issuerMockDidNP
+set preAuthInTimePayload.authorization_details[0].locations[0] user.clientId
+set preAuthHeaders {}
+set preAuthHeaders.kid user.keys.ES256.kid
+preAuthorizedInTimeCode: compute signJwt preAuthInTimePayload ES256 preAuthHeaders
+
+set preAuthDeferredPayload {"authorization_details":[{"type":"openid_credential","format":"jwt_vc","types":["VerifiableCredential","VerifiableAttestation","CTWalletSamePreAuthorisedDeferred"],"locations":[""]}]}
+set preAuthDeferredPayload.iss user.clientId
+set preAuthDeferredPayload.sub issuerMockDidNP
+set preAuthDeferredPayload.client_id issuerMockDidNP
+set preAuthDeferredPayload.authorization_details[0].locations[0] user.clientId
+preAuthorizedDeferredCode: compute signJwt preAuthDeferredPayload ES256 preAuthHeaders
+
+userPin: compute userPin issuerMockDidNP
+
+conformance check issue_to_holder_initiate_ct_wallet_same_authorised_in_time 1.1
+conformance check issue_to_holder_validate_ct_wallet_same_authorised_in_time 1.1
+conformance check issue_to_holder_initiate_ct_wallet_same_authorised_deferred 1.1
+conformance check issue_to_holder_validate_ct_wallet_same_authorised_deferred 1.1
+conformance check issue_to_holder_initiate_ct_wallet_same_pre_authorised_in_time 1.1 preAuthorizedInTimeCode userPin
+conformance check issue_to_holder_validate_ct_wallet_same_pre_authorised_in_time 1.1 preAuthorizedInTimeCode userPin
+conformance check issue_to_holder_initiate_ct_wallet_same_pre_authorised_deferred 1.1 preAuthorizedDeferredCode userPin
+conformance check issue_to_holder_validate_ct_wallet_same_pre_authorised_deferred 1.1 preAuthorizedDeferredCode userPin
+
+compute wait 11
+conformance holder CTIssueQualificationCredential authorisedInTime ES256 1.1 [] skip-credential-offer
+conformance check request_ct_issue_to_holder_qualification_credential

package/dist/scripts/wct/issueToHolder2

@@ -0,0 +1,38 @@
+using user null
+using user ES256 did2
+set user.issuerState issuer-state
+conformance clientMockInitiate
+
+jwks: conformance get /issuer-mock/jwks
+issuerMockDidNP: compute did2 jwks.keys.0
+
+set preAuthInTimePayload {"authorization_details":[{"type":"openid_credential","format":"jwt_vc","types":["VerifiableCredential","VerifiableAttestation","CTWalletSamePreAuthorisedInTime"],"locations":[""]}]}
+set preAuthInTimePayload.iss user.clientId
+set preAuthInTimePayload.sub issuerMockDidNP
+set preAuthInTimePayload.client_id issuerMockDidNP
+set preAuthInTimePayload.authorization_details[0].locations[0] user.clientId
+set preAuthHeaders {}
+set preAuthHeaders.kid user.keys.ES256.kid
+preAuthorizedInTimeCode: compute signJwt preAuthInTimePayload ES256 preAuthHeaders
+
+set preAuthDeferredPayload {"authorization_details":[{"type":"openid_credential","format":"jwt_vc","types":["VerifiableCredential","VerifiableAttestation","CTWalletSamePreAuthorisedDeferred"],"locations":[""]}]}
+set preAuthDeferredPayload.iss user.clientId
+set preAuthDeferredPayload.sub issuerMockDidNP
+set preAuthDeferredPayload.client_id issuerMockDidNP
+set preAuthDeferredPayload.authorization_details[0].locations[0] user.clientId
+preAuthorizedDeferredCode: compute signJwt preAuthDeferredPayload ES256 preAuthHeaders
+
+userPin: compute userPin issuerMockDidNP
+
+conformance check issue_to_holder_initiate_ct_wallet_same_authorised_in_time 2.0
+conformance check issue_to_holder_validate_ct_wallet_same_authorised_in_time 2.0
+conformance check issue_to_holder_initiate_ct_wallet_same_authorised_deferred 2.0
+conformance check issue_to_holder_validate_ct_wallet_same_authorised_deferred 2.0
+conformance check issue_to_holder_initiate_ct_wallet_same_pre_authorised_in_time 2.0 preAuthorizedInTimeCode userPin
+conformance check issue_to_holder_validate_ct_wallet_same_pre_authorised_in_time 2.0 preAuthorizedInTimeCode userPin
+conformance check issue_to_holder_initiate_ct_wallet_same_pre_authorised_deferred 2.0 preAuthorizedDeferredCode userPin
+conformance check issue_to_holder_validate_ct_wallet_same_pre_authorised_deferred 2.0 preAuthorizedDeferredCode userPin
+
+compute wait 11
+conformance holder CTIssueQualificationCredential authorisedInTime ES256 2.0 [] skip-credential-offer
+conformance check request_ct_issue_to_holder_qualification_credential

package/dist/scripts/wct/pda1

@@ -0,0 +1,3 @@
+using user null
+using user ES256 did2
+cPda1: conformance holder VerifiablePortableDocumentA1 authorisedDeferred

package/dist/scripts/wct/verifier

@@ -0,0 +1,8 @@
+using user null
+using user ES256
+conformance clientMockInitiate
+conformance check verifier_id_token_exchange
+conformance check verifier_vp_valid_vc
+conformance check verifier_vp_expired_vc
+conformance check verifier_vp_revoked_vc
+conformance check verifier_vp_not_yet_valid_vc

package/dist/scripts/wct/verifier2

@@ -0,0 +1,7 @@
+using user null
+using user ES256
+conformance clientMockInitiate
+conformance check verifier_id_token_exchange 2.0
+conformance check verifier_vp_valid_vc 2.0
+conformance check verifier_vp_expired_vc 2.0
+conformance check verifier_vp_not_yet_valid_vc 2.0

package/dist/utils/Client.js

@@ -0,0 +1,155 @@
+import { createJWT, ES256KSigner } from "@europeum-ebsi/did-jwt";
+import { ethers } from "ethers";
+import { exportJWK, generateKeyPair, importJWK, SignJWT } from "jose";
+import { HardwareWallet } from "./HardwareWallet.js";
+import { encodePrivateKey, encodePublicKey, removePrefix0x } from "./utils.js";
+export class Client {
+    accreditationId;
+    accreditationUrl;
+    clientId;
+    did;
+    didVersion;
+    ethWallet;
+    hardwareWallet;
+    issuerState;
+    keys;
+    proxyId;
+    supportOfficeAccreditationUrl;
+    constructor() {
+        this.keys = {};
+    }
+    async createRandom(alg) {
+        const { privateKeyJwk } = await generateKeys(alg);
+        this.setJwk(alg, privateKeyJwk);
+    }
+    generateDidDocument() {
+        const context = [
+            "https://www.w3.org/ns/did/v1",
+            "https://w3id.org/security/suites/jws-2020/v1",
+        ];
+        const didDocument = {
+            "@context": context,
+            assertionMethod: [],
+            authentication: [],
+            capabilityInvocation: [],
+            id: this.did,
+            verificationMethod: [],
+        };
+        for (const alg of Object.keys(this.keys)) {
+            const key = this.keys[alg];
+            if (!key)
+                continue;
+            didDocument.verificationMethod.push({
+                controller: this.did,
+                id: key.kid,
+                publicKeyJwk: key.publicKeyJwk,
+                type: "JsonWebKey2020",
+            });
+            didDocument.authentication.push(key.kid);
+            didDocument.assertionMethod.push(key.kid);
+            didDocument.capabilityInvocation.push(key.kid);
+        }
+        return didDocument;
+    }
+    privateKeysBase64() {
+        const keys = [];
+        for (const alg of Object.keys(this.keys)) {
+            const key = this.keys[alg];
+            if (!key)
+                continue;
+            keys.push({
+                alg,
+                id: key.kid,
+                privateKeyJwk: key.privateKeyJwk,
+                publicKeyJwk: key.publicKeyJwk,
+                type: "JsonWebKey2020",
+            });
+        }
+        return Buffer.from(JSON.stringify(keys)).toString("base64");
+    }
+    setJwk(alg, privateKeyJwk) {
+        const publicKeyJwk = encodePublicKey({
+            format: "jwk",
+            key: privateKeyJwk,
+        });
+        const publicKeyPem = encodePublicKey({
+            alg,
+            format: "pem",
+            key: publicKeyJwk,
+            sourceType: "publicJwk",
+        });
+        let publicKeyHex = "";
+        let privateKeyHex = "";
+        if (["ES256", "ES256K"].includes(alg)) {
+            privateKeyHex = encodePrivateKey({
+                alg,
+                format: "hex",
+                key: privateKeyJwk,
+            });
+            publicKeyHex = encodePublicKey({
+                alg,
+                format: "hex",
+                key: publicKeyJwk,
+            });
+        }
+        this.keys[alg] = {
+            id: "",
+            isHardwareWallet: false,
+            kid: "",
+            ...(privateKeyHex && { privateKeyHex }),
+            privateKeyJwk,
+            ...(publicKeyHex && { publicKeyHex }),
+            publicKeyJwk,
+            publicKeyPem,
+        };
+    }
+    async signJWT(payload, inputHeader, alg) {
+        if (!this.keys[alg])
+            throw new Error(`There is no key defined for alg ${alg}`);
+        const header = {
+            alg,
+            kid: this.keys[alg].kid,
+            ...(this.didVersion === 2 && {
+                jwk: this.keys[alg].publicKeyJwk,
+            }),
+            ...inputHeader,
+        };
+        if (this.keys[alg].isHardwareWallet) {
+            const jwt = await this.hardwareWallet.signJWT(payload, header);
+            return jwt;
+        }
+        if (alg === "ES256K") {
+            // ES256K is not supported by jose library
+            const signer = ES256KSigner(Buffer.from(removePrefix0x(this.keys.ES256K.privateKeyHex), "hex"));
+            const jwt = createJWT(payload, { signer }, header);
+            return jwt;
+        }
+        const privateKey = await importJWK(this.keys[alg].privateKeyJwk, alg);
+        const jwt = await new SignJWT(payload)
+            .setProtectedHeader(header)
+            .sign(privateKey);
+        return jwt;
+    }
+    toJSON() {
+        return {
+            accreditationId: this.accreditationId,
+            accreditationUrl: this.accreditationUrl,
+            address: this.ethWallet?.address ?? "",
+            clientId: this.clientId,
+            did: this.did,
+            didVersion: this.didVersion,
+            issuerState: this.issuerState,
+            keys: this.keys,
+            proxyId: this.proxyId,
+            supportOfficeAccreditationUrl: this.supportOfficeAccreditationUrl,
+        };
+    }
+}
+export async function generateKeys(alg) {
+    const keys = await generateKeyPair(alg, { extractable: true });
+    return {
+        privateKeyJwk: await exportJWK(keys.privateKey),
+        publicKeyJwk: await exportJWK(keys.publicKey),
+    };
+}
+//# sourceMappingURL=Client.js.map

package/dist/utils/Client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Client.js","sourceRoot":"","sources":["../../src/utils/Client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAItE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAa/E,MAAM,OAAO,MAAM;IACjB,eAAe,CAAU;IAEzB,gBAAgB,CAAU;IAE1B,QAAQ,CAAU;IAElB,GAAG,CAAU;IAEb,UAAU,CAAU;IAEpB,SAAS,CAAuC;IAEhD,cAAc,CAAkB;IAEhC,WAAW,CAAU;IAErB,IAAI,CAKF;IAEF,OAAO,CAAU;IAEjB,6BAA6B,CAAU;IAEvC;QACE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAQ;QACzB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAClC,CAAC;IAED,mBAAmB;QACjB,MAAM,OAAO,GAAG;YACd,8BAA8B;YAC9B,8CAA8C;SAC/C,CAAC;QACF,MAAM,WAAW,GAAgB;YAC/B,UAAU,EAAE,OAAO;YACnB,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;YAClB,oBAAoB,EAAE,EAAE;YACxB,EAAE,EAAE,IAAI,CAAC,GAAG;YACZ,kBAAkB,EAAE,EAAE;SACvB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAA+B,EAAE,CAAC;YACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,WAAW,CAAC,kBAAmB,CAAC,IAAI,CAAC;gBACnC,UAAU,EAAE,IAAI,CAAC,GAAG;gBACpB,EAAE,EAAE,GAAG,CAAC,GAAG;gBACX,YAAY,EAAE,GAAG,CAAC,YAA0B;gBAC5C,IAAI,EAAE,gBAAgB;aACvB,CAAC,CAAC;YACH,WAAW,CAAC,cAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,WAAW,CAAC,eAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3C,WAAW,CAAC,oBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,iBAAiB;QACf,MAAM,IAAI,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAA+B,EAAE,CAAC;YACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG;gBACH,EAAE,EAAE,GAAG,CAAC,GAAG;gBACX,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,IAAI,EAAE,gBAAgB;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,GAAQ,EAAE,aAAkB;QACjC,MAAM,YAAY,GAAG,eAAe,CAAC;YACnC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,aAAa;SACnB,CAAQ,CAAC;QAEV,MAAM,YAAY,GAAG,eAAe,CAAC;YACnC,GAAG;YACH,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,YAAY;YACjB,UAAU,EAAE,WAAW;SACxB,CAAW,CAAC;QAEb,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,aAAa,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,aAAa,GAAG,gBAAgB,CAAC;gBAC/B,GAAG;gBACH,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,aAAa;aACnB,CAAW,CAAC;YACb,YAAY,GAAG,eAAe,CAAC;gBAC7B,GAAG;gBACH,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,YAAY;aAClB,CAAW,CAAC;QACf,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;YACf,EAAE,EAAE,EAAE;YACN,gBAAgB,EAAE,KAAK;YACvB,GAAG,EAAE,EAAE;YACP,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;YACvC,aAAa;YACb,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;YACrC,YAAY;YACZ,YAAY;SACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAsB,EACtB,WAA0B,EAC1B,GAAQ;QAER,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG;YACb,GAAG;YACH,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG;YACvB,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI;gBAC3B,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY;aACjC,CAAC;YACF,GAAG,WAAW;SACf,CAAC;QAEF,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/D,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,0CAA0C;YAC1C,MAAM,MAAM,GAAG,YAAY,CACzB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAO,CAAC,aAAc,CAAC,EAAE,KAAK,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAmB,CAAC,CAAC;YAChE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAc,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;aACnC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM;QACJ,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE;YACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;SAClE,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAI5C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,OAAO;QACL,aAAa,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,YAAY,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/utils/HardwareWallet.js

@@ -0,0 +1,326 @@
+import * as asn1 from "asn1js";
+import Joi from "joi";
+import { base64url } from "multiformats/bases/base64";
+import crypto from "node:crypto";
+import * as pki from "pkijs";
+import { red, yellow } from "./print.js";
+import { askQuestion } from "./utils.js";
+export class HardwareWallet {
+    graphene;
+    mod;
+    session;
+    slot;
+    slotNumber = 0;
+    slots;
+    constructor(library) {
+        this.loadGraphene()
+            .then(() => {
+            this.mod = this.graphene.Module.load(library, "OpenSC");
+        })
+            .catch(() => {
+            console.warn("Failed to load graphene-pk11");
+        });
+    }
+    static verify2(message, signature, publicKeyJwk) {
+        const derFormatSig = convertRawSignatureToDER(signature);
+        const isValid = crypto.verify("sha256", Buffer.from(message), {
+            format: "jwk",
+            key: publicKeyJwk,
+        }, derFormatSig);
+        return isValid;
+    }
+    static verifyJwt(jwt, publicKeyJwk) {
+        const jwtParts = jwt.split(".");
+        if (jwtParts.length !== 3)
+            throw new Error("Invalid JWT format");
+        const [headerBase64url, payloadBase64url, signatureBase64url] = jwtParts;
+        const message = `${headerBase64url}.${payloadBase64url}`;
+        const headerString = Buffer.from(base64url.baseDecode(headerBase64url)).toString();
+        const payloadString = Buffer.from(base64url.baseDecode(payloadBase64url)).toString();
+        const signature = Buffer.from(base64url.baseDecode(signatureBase64url));
+        const result = HardwareWallet.verify2(message, signature, publicKeyJwk);
+        if (!result) {
+            throw new Error("Invalid signature");
+        }
+        return {
+            header: JSON.parse(headerString),
+            payload: JSON.parse(payloadString),
+        };
+    }
+    endSession() {
+        try {
+            if (this.session)
+                this.session.logout();
+        }
+        catch {
+            // empty
+        }
+        try {
+            if (this.mod)
+                this.mod.finalize();
+        }
+        catch {
+            // empty
+        }
+    }
+    async generateKeys() {
+        this.init();
+        await this.login("admin");
+        const privateKeys = this.session.find({
+            class: this.graphene.ObjectClass.PRIVATE_KEY,
+            keyType: this.graphene.KeyType.ECDSA,
+            paramsECDSA: this.graphene.NamedCurve.getByName("secp256r1").value,
+            sign: true,
+            token: true,
+        });
+        if (privateKeys.length > 0) {
+            yellow("A P-256 key pair already exists");
+            return;
+        }
+        try {
+            this.session.generateKeyPair(this.graphene.KeyGenMechanism.ECDSA, 
+            // Public template
+            {
+                keyType: this.graphene.KeyType.ECDSA,
+                paramsECDSA: this.graphene.NamedCurve.getByName("secp256r1").value,
+                token: true,
+                verify: true,
+            }, 
+            // Private template
+            {
+                derive: true,
+                extractable: true,
+                keyType: this.graphene.KeyType.ECDSA,
+                paramsECDSA: this.graphene.NamedCurve.getByName("secp256r1").value,
+                sign: true,
+                token: true,
+            });
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.endSession();
+                if (error.message === "CKR_FUNCTION_NOT_SUPPORTED") {
+                    throw new Error('CKR_FUNCTION_NOT_SUPPORTED: in your OpenPGP app, go to "Settings" > "Key template", then set "Key" to "Signature" and  "Type" to "SECP 256R1", and finally click on "Set Template".', { cause: error });
+                }
+                throw error;
+            }
+        }
+        yellow("Key pair generated successfully!");
+        this.endSession();
+    }
+    getInfo() {
+        this.init();
+        const info = {
+            description: this.slot.slotDescription,
+            isHardware: Boolean(this.slot.flags & this.graphene.SlotFlag.HW_SLOT),
+            isInitialized: Boolean(this.slot.flags & this.graphene.SlotFlag.TOKEN_PRESENT),
+            isRemovable: Boolean(this.slot.flags & this.graphene.SlotFlag.REMOVABLE_DEVICE),
+            password: {
+                max: this.slot.getToken().maxPinLen,
+                min: this.slot.getToken().minPinLen,
+            },
+            serial: this.slot.getToken().serialNumber,
+            slot: this.slotNumber,
+        };
+        this.endSession();
+        return info;
+    }
+    getPublicKey() {
+        this.init();
+        const publicKeys = this.session.find({
+            class: this.graphene.ObjectClass.PUBLIC_KEY,
+            keyType: this.graphene.KeyType.ECDSA,
+        });
+        if (publicKeys.length === 0) {
+            this.endSession();
+            throw new Error('No EC public key found. Run the "generatekey" command first.');
+        }
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+        const publicKey = publicKeys.items(0).toType();
+        const { pointEC } = publicKey.getAttribute({ pointEC: null });
+        const schema = 
+        // @ts-expect-error "Property 'valueHexView' does not exist on type 'ValueBlock'.ts(2339)"
+        asn1.fromBER(pointEC).result.valueBlock.valueHexView;
+        const publicKeyDecoded = new pki.ECPublicKey({
+            namedCurve: "P-256",
+            schema,
+        });
+        this.endSession();
+        return { kty: "EC", ...publicKeyDecoded.toJSON() };
+    }
+    init() {
+        if (!this.mod) {
+            throw new Error("Hardware wallet cannot be used because the graphene-pk11 package was not loaded");
+        }
+        this.endSession();
+        this.mod.initialize();
+        this.slotNumber = 0;
+        // get slots
+        this.slots = this.mod.getSlots(true);
+        if (this.slots.length === 0) {
+            this.mod.finalize();
+            throw new Error("No slots found. Make sure your Ledger is unlocked and the OpenPGP app is open.");
+        }
+        this.slot = this.slots.items(this.slotNumber);
+        if (!(this.slot.flags & this.graphene.SlotFlag.TOKEN_PRESENT)) {
+            this.mod.finalize();
+            throw new Error(`Slot ${this.slotNumber} is not initialized`);
+        }
+        this.session = this.slot.open(this.graphene.SessionFlag.RW_SESSION |
+            this.graphene.SessionFlag.SERIAL_SESSION);
+    }
+    async loadGraphene() {
+        this.graphene = await import("graphene-pk11");
+        if (!this.graphene) {
+            throw new Error("Failed to load graphene-pk11");
+        }
+    }
+    async login(userType, loginMessage) {
+        let attemptsLeft = 3;
+        const isAdmin = userType === "admin";
+        let pin = "";
+        let validPin = false;
+        let loginMsg = isAdmin ? "Enter admin pin: " : "Enter pin: ";
+        if (loginMessage)
+            loginMsg = loginMessage;
+        while (!validPin) {
+            try {
+                pin = await askQuestion(loginMsg, true);
+                this.session.login(pin, isAdmin ? this.graphene.UserType.SO : this.graphene.UserType.USER);
+                validPin = true;
+            }
+            catch (error) {
+                validPin = false;
+                if (error instanceof Error) {
+                    switch (error.message) {
+                        case "CKR_PIN_LEN_RANGE": {
+                            red("Invalid PIN length");
+                            break;
+                        }
+                        case "CKR_USER_NOT_LOGGED_IN": {
+                            attemptsLeft -= 1;
+                            red(`Invalid PIN. You have ${attemptsLeft} attempts before the PIN is locked`);
+                            break;
+                        }
+                        case "CKR_PIN_LOCKED": {
+                            throw new Error(`The PIN is locked. If you want to reset it, open OpenPGP app, go to "Settings" > "Reset" and select "YES"`, { cause: error });
+                        }
+                        case "CKR_GENERAL_ERROR": {
+                            throw new Error(`Hardware wallet error. Make sure your Ledger is unlocked and the OpenPGP app is open`, { cause: error });
+                        }
+                        // No default
+                    }
+                    throw error;
+                }
+            }
+        }
+        return pin;
+    }
+    async setPin(user) {
+        Joi.assert(user, Joi.string().valid("user", "admin"));
+        this.init();
+        const pin = await this.login(user, `Enter current pin for ${user}: `);
+        const newPin = await askQuestion("Enter new pin: ", true);
+        try {
+            this.session.setPin(pin, newPin);
+            this.endSession();
+            yellow(user === "user"
+                ? "New pin configured!"
+                : "New pin configured for admin!");
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                if (error.message === "CKR_PIN_LEN_RANGE") {
+                    throw new Error("Invalid PIN length", { cause: error });
+                }
+                else if (error.message === "CKR_GENERAL_ERROR") {
+                    throw new Error(`Hardware wallet error. Make sure your Ledger is unlocked and the OpenPGP app is open`, { cause: error });
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+    }
+    async sign(message) {
+        this.init();
+        await this.login("user");
+        const privateKeys = this.session.find({
+            class: this.graphene.ObjectClass.PRIVATE_KEY,
+            keyType: this.graphene.KeyType.ECDSA,
+            paramsECDSA: this.graphene.NamedCurve.getByName("secp256r1").value,
+            sign: true,
+            token: true,
+        });
+        if (privateKeys.length === 0) {
+            throw new Error('No EC private key found. Run the "generatekey" command first.');
+        }
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+        const privateKey = privateKeys.items(0).toType();
+        // Hash the message using SHA-256
+        const sign = this.session.createSign("ECDSA_SHA256", privateKey);
+        const signature = sign.once(message);
+        // Split the raw signature into r and s components
+        const r = signature.toString("hex").slice(0, 66); // First 33 bytes may be padded r
+        const s = signature.toString("hex").slice(66); // Next 33 bytes may be padded s
+        const sig = Buffer.from(`${r.slice(2)}${s.slice(2)}`, "hex");
+        this.endSession();
+        return sig;
+    }
+    async signJWT(payload, header) {
+        const headerBase64url = base64url.baseEncode(Buffer.from(JSON.stringify(header)));
+        const payloadBase64url = base64url.baseEncode(Buffer.from(JSON.stringify(payload)));
+        const message = `${headerBase64url}.${payloadBase64url}`;
+        const signature = await this.sign(message);
+        const signatureBase64url = base64url.baseEncode(signature);
+        return `${message}.${signatureBase64url}`;
+    }
+    verify(message, signature) {
+        this.init();
+        const publicKeys = this.session.find({
+            class: this.graphene.ObjectClass.PUBLIC_KEY,
+            keyType: this.graphene.KeyType.ECDSA,
+        });
+        if (publicKeys.length === 0) {
+            throw new Error('No EC public key found. Run the "generatekey" command first.');
+        }
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
+        const publicKey = publicKeys.items(0).toType();
+        const verify = this.session.createVerify("ECDSA_SHA256", publicKey);
+        const isValid = verify.once(message, signature);
+        this.endSession();
+        return isValid;
+    }
+}
+function convertRawSignatureToDER(rawSignature) {
+    if (rawSignature.length !== 64) {
+        throw new Error("Raw signature must be 64 bytes (32 bytes for r and 32 bytes for s)");
+    }
+    // Split raw signature into r and s
+    const r = rawSignature.subarray(0, 32);
+    const s = rawSignature.subarray(32);
+    // Convert r and s to DER integers
+    const rDER = toDERInteger(r);
+    const sDER = toDERInteger(s);
+    // Create DER-encoded SEQUENCE containing the r and s values
+    const derSignature = Buffer.concat([
+        Buffer.from([0x30]), // ASN.1 SEQUENCE tag
+        Buffer.from([rDER.length + sDER.length + 4]), // Total length of SEQUENCE
+        Buffer.from([0x02]), // ASN.1 INTEGER tag for r
+        Buffer.from([rDER.length]), // Length of r
+        rDER, // r value
+        Buffer.from([0x02]), // ASN.1 INTEGER tag for s
+        Buffer.from([sDER.length]), // Length of s
+        sDER, // s value
+    ]);
+    return derSignature;
+}
+// Function to add leading zero if needed
+function toDERInteger(value) {
+    if (value[0] && value[0] & 0x80) {
+        // If the first byte is >= 0x80, prepend 0x00 to indicate a positive integer
+        return Buffer.concat([Buffer.from([0x00]), value]);
+    }
+    return value;
+}
+//# sourceMappingURL=HardwareWallet.js.map