@idos-network/client 1.0.0-rc.1.2 → 1.2.0

package/src/index.ts

@@ -1,22 +1,40 @@
+import type {
+  BaseProvider,
+  EncryptionPasswordStore,
+  PublicEncryptionProfile,
+} from "@idos-network/enclave";
+import type { KwilSigner } from "@idos-network/kwil-js";
+
+import {
+  buildInsertableIDOSCredential,
+  matchLevelOrHigher,
+  recordFilter,
+} from "@idos-network/credentials/utils";
+import {
+  createClientKwilSigner,
+  createWebKwilClient,
+  type KwilActionClient,
+  signNearMessage,
+  type Wallet,
+} from "@idos-network/kwil-infra";
 import {
   type AddAttributeInput,
   type AddWalletInput,
   addWallet,
   addWallets,
   addAttribute as createAttribute,
-  createCredentialCopy,
   type DagMessageInput,
   dagMessage,
   dwgMessage,
-  type GetGrantsPaginatedInput,
+  type GetAccessGrantsGrantedInput,
   type GetWalletsOutput,
+  getAccessGrantsGrantedCount,
   getAccessGrantsOwned,
   getAttributes,
   getCredentialOwned,
+  getCredentialShared,
   getCredentials,
   getGrants,
-  getGrantsCount,
-  getSharedCredential,
   getUser,
   getWallets,
   hasProfile,
@@ -29,20 +47,11 @@ import {
   type idOSWallet,
   removeCredential,
   removeWallet,
-  removeWallets,
   revokeAccessGrant,
   type ShareCredentialInput,
   shareCredential,
-} from "@idos-network/core/kwil-actions";
-import {
-  createClientKwilSigner,
-  createWebKwilClient,
-  type KwilActionClient,
-  signNearMessage,
-} from "@idos-network/core/kwil-infra";
-import type { Wallet } from "@idos-network/core/types";
-import { buildInsertableIDOSCredential } from "@idos-network/core/utils";
-import type { KwilSigner } from "@idos-network/kwil-js";
+  type WalletType,
+} from "@idos-network/kwil-infra/actions";
 import {
   base64Decode,
   base64Encode,
@@ -50,17 +59,14 @@ import {
   utf8Decode,
   utf8Encode,
 } from "@idos-network/utils/codecs";
-import type { BaseProvider, PublicEncryptionProfile } from "@idos-network/utils/enclave";
 import { LocalStorageStore, type Store } from "@idos-network/utils/store";
-import { negate } from "es-toolkit";
-import { every, get } from "es-toolkit/compat";
 import invariant from "tiny-invariant";
 
 import { IframeEnclave } from "./enclave/iframe-enclave";
 export { IframeEnclave };
 
 type Properties<T> = {
-  // biome-ignore lint/complexity/noBannedTypes: All functions are to be removed.
+  // oxlint-disable-next-line typescript/no-restricted-types -- All functions are to be removed.
   [K in keyof T as Exclude<T[K], Function> extends never ? never : K]: T[K];
 };
 
@@ -137,16 +143,34 @@ export class idOSClientIdle {
     return hasProfile(this.kwilClient, { address }).then((res) => res.has_profile);
   }
 
-  async withUserSigner(signer: Wallet): Promise<idOSClientWithUserSigner> {
-    const [kwilSigner, walletIdentifier] = await createClientKwilSigner(
-      this.store,
-      this.kwilClient,
-      signer,
-    );
+  async withUserSigner(_signer: Wallet): Promise<idOSClientWithUserSigner> {
+    let signer = _signer;
+    const [kwilSigner, walletIdentifier, walletPublicKey, walletType] =
+      await createClientKwilSigner(this.store, this.kwilClient, signer);
 
     this.kwilClient.setSigner(kwilSigner);
 
-    return new idOSClientWithUserSigner(this, signer, kwilSigner, walletIdentifier);
+    if (walletType === "NEAR") {
+      const originalSigner = signer;
+      signer = {
+        signMessage: async (message: string) => {
+          const signature = await signNearMessage(
+            originalSigner as Parameters<typeof signNearMessage>[0],
+            message,
+          );
+          return { signedMessage: signature } as { signedMessage: string };
+        },
+      } as unknown as Wallet;
+    }
+
+    return new idOSClientWithUserSigner(
+      this,
+      signer,
+      kwilSigner,
+      walletIdentifier,
+      walletPublicKey,
+      walletType,
+    );
   }
 
   async logOut(): Promise<idOSClientIdle> {
@@ -162,12 +186,16 @@ export class idOSClientWithUserSigner implements Omit<Properties<idOSClientIdle>
   readonly signer: Wallet;
   readonly kwilSigner: KwilSigner;
   readonly walletIdentifier: string;
+  readonly walletPublicKey: string | undefined;
+  readonly walletType: WalletType;
 
   constructor(
     idOSClientIdle: idOSClientIdle,
     signer: Wallet,
     kwilSigner: KwilSigner,
     walletIdentifier: string,
+    walletPublicKey: string | undefined,
+    walletType: WalletType,
   ) {
     this.state = "with-user-signer";
     this.store = idOSClientIdle.store;
@@ -176,7 +204,8 @@ export class idOSClientWithUserSigner implements Omit<Properties<idOSClientIdle>
     this.signer = signer;
     this.kwilSigner = kwilSigner;
     this.walletIdentifier = walletIdentifier;
-
+    this.walletPublicKey = walletPublicKey;
+    this.walletType = walletType;
     // @ts-expect-error - TODO: Fix this
     this.enclaveProvider.setSigner(this.signer);
   }
@@ -192,12 +221,17 @@ export class idOSClientWithUserSigner implements Omit<Properties<idOSClientIdle>
     );
   }
 
-  async createUserEncryptionProfile(userId: string): Promise<PublicEncryptionProfile> {
+  async createUserEncryptionProfile(
+    userId: string,
+    forceEncryptionPasswordStore?: EncryptionPasswordStore,
+  ): Promise<PublicEncryptionProfile> {
     await this.enclaveProvider.reconfigure({
       mode: "new",
       userId,
       walletAddress: this.walletIdentifier,
-      encryptionPasswordStore: undefined,
+      walletPublicKey: this.walletPublicKey,
+      walletType: this.walletType,
+      encryptionPasswordStore: forceEncryptionPasswordStore,
       expectedUserEncryptionPublicKey: undefined,
     });
 
@@ -214,7 +248,9 @@ export class idOSClientWithUserSigner implements Omit<Properties<idOSClientIdle>
       userId: kwilUser.id,
       expectedUserEncryptionPublicKey: kwilUser.recipient_encryption_public_key,
       walletAddress: this.walletIdentifier,
+      walletType: this.walletType,
       encryptionPasswordStore: kwilUser.encryption_password_store,
+      walletPublicKey: this.walletPublicKey,
     });
 
     return new idOSClientLoggedIn(this, kwilUser);
@@ -229,6 +265,8 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
   readonly signer: Wallet;
   readonly kwilSigner: KwilSigner;
   readonly walletIdentifier: string;
+  readonly walletPublicKey: string | undefined;
+  readonly walletType: WalletType;
   readonly user: idOSUser;
 
   constructor(idOSClientWithUserSigner: idOSClientWithUserSigner, user: idOSUser) {
@@ -239,6 +277,8 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
     this.signer = idOSClientWithUserSigner.signer;
     this.kwilSigner = idOSClientWithUserSigner.kwilSigner;
     this.walletIdentifier = idOSClientWithUserSigner.walletIdentifier;
+    this.walletPublicKey = idOSClientWithUserSigner.walletPublicKey;
+    this.walletType = idOSClientWithUserSigner.walletType;
     this.user = user;
   }
 
@@ -309,52 +349,7 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
       base64Decode(credential.encryptor_public_key),
     );
 
-    return plaintext as any;
-  }
-
-  async createCredentialCopy(
-    id: string,
-    consumerRecipientEncryptionPublicKey: string,
-    consumerAddress: string,
-    lockedUntil: number,
-  ): Promise<{ id: string }> {
-    const originalCredential = await this.getCredentialById(id);
-    invariant(originalCredential, `"idOSCredential" with id ${id} not found`);
-
-    await this.enclaveProvider.ensureUserEncryptionProfile();
-
-    const decryptedContent = await this.enclaveProvider.decrypt(
-      base64Decode(originalCredential.content),
-      base64Decode(originalCredential.encryptor_public_key),
-    );
-
-    const { content, encryptorPublicKey } = await this.enclaveProvider.encrypt(
-      decryptedContent,
-      base64Decode(consumerRecipientEncryptionPublicKey),
-    );
-
-    const insertableCredential = {
-      ...(await buildInsertableIDOSCredential(
-        originalCredential.user_id,
-        "",
-        base64Encode(content),
-        consumerRecipientEncryptionPublicKey,
-        base64Encode(encryptorPublicKey),
-      )),
-      grantee_wallet_identifier: consumerAddress,
-      locked_until: lockedUntil,
-    };
-
-    const copyId = crypto.randomUUID();
-
-    await createCredentialCopy(this.kwilClient, {
-      original_credential_id: originalCredential.id,
-      ...originalCredential,
-      ...insertableCredential,
-      id: copyId,
-    });
-
-    return { id: copyId };
+    return utf8Decode(plaintext);
   }
 
   async requestDAGMessage(params: DagMessageInput): Promise<string> {
@@ -362,7 +357,7 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
   }
 
   async getGrants(
-    params: GetGrantsPaginatedInput,
+    params: Partial<GetAccessGrantsGrantedInput>,
   ): Promise<{ grants: idOSGrant[]; totalCount: number }> {
     return {
       grants: await getGrants(this.kwilClient, params),
@@ -376,13 +371,13 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
   }
 
   async getGrantsCount(): Promise<number> {
-    return getGrantsCount(this.kwilClient, {
+    return getAccessGrantsGrantedCount(this.kwilClient, {
       user_id: null,
     }).then((res) => res.count);
   }
 
-  async getSharedCredential(id: string): Promise<idOSCredential | undefined> {
-    return getSharedCredential(this.kwilClient, { id }).then((res) => res[0]);
+  async getCredentialShared(id: string): Promise<idOSCredential | undefined> {
+    return getCredentialShared(this.kwilClient, { id }).then((res) => res[0]);
   }
 
   async revokeAccessGrant(id: string): Promise<{ id: string }> {
@@ -392,6 +387,39 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
 
   async addWallet(params: AddWalletInput): Promise<AddWalletInput> {
     await addWallet(this.kwilClient, params);
+
+    // we don't need to add the wallet to MPC if the user is not using MPC
+    if (this.user.encryption_password_store !== "mpc") {
+      console.log("MPC is not enabled or the user is not using MPC");
+      return params;
+    }
+
+    if (!params.wallet_type) {
+      throw new Error("Wallet type is required for MPC users");
+    }
+
+    const messageToSign = await this.enclaveProvider.addAddressMessageToSign(
+      params.address,
+      params.public_key ?? undefined,
+      params.wallet_type,
+    );
+
+    const signature = await this.enclaveProvider.signTypedData(
+      messageToSign.domain,
+      messageToSign.types,
+      messageToSign.value,
+    );
+
+    const result = await this.enclaveProvider.addAddressToMpcSecret(
+      this.user.id,
+      messageToSign.value,
+      signature,
+    );
+
+    if (result !== "success") {
+      console.error(`Failed to add wallet to MPC: ${result}`);
+    }
+
     return params;
   }
 
@@ -400,12 +428,47 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
   }
 
   async removeWallet(id: string): Promise<{ id: string }> {
+    const wallets = await this.getWallets();
+    const wallet = wallets.find((wallet) => wallet.id === id);
+    if (!wallet) {
+      throw new Error(`Wallet with id ${id} not found`);
+    }
+
     await removeWallet(this.kwilClient, { id });
+
+    // we don't need to add the wallet to MPC if the user is not using MPC
+    if (this.user.encryption_password_store !== "mpc") {
+      console.log("MPC is not enabled or the user is not using MPC");
+      return { id };
+    }
+
+    const messageToSign = await this.enclaveProvider.removeAddressMessageToSign(
+      wallet.address,
+      wallet.public_key ?? undefined,
+      wallet.wallet_type,
+    );
+    const signature = await this.enclaveProvider.signTypedData(
+      messageToSign.domain,
+      messageToSign.types,
+      messageToSign.value,
+    );
+    const result = await this.enclaveProvider.removeAddressFromMpcSecret(
+      wallet.user_id,
+      messageToSign.value,
+      signature,
+    );
+    if (result !== "success") {
+      console.error(`Failed to add wallet to MPC: ${result}`);
+    }
+
     return { id };
   }
 
   async removeWallets(ids: string[]): Promise<string[]> {
-    await removeWallets(this.kwilClient, ids);
+    for (const id of ids) {
+      await this.removeWallet(id);
+    }
+
     return ids;
   }
 
@@ -414,19 +477,18 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
       authPublicKey: string;
     }[];
     publicNotesFieldFilters?: {
-      pick: Record<string, unknown[]>;
-      omit: Record<string, unknown[]>;
+      pick: Parameters<typeof recordFilter>[1];
+      omit: Parameters<typeof recordFilter>[2];
     };
     privateFieldFilters?: {
-      pick: Record<string, unknown[]>;
-      omit: Record<string, unknown[]>;
+      pick: Parameters<typeof recordFilter>[1];
+      omit: Parameters<typeof recordFilter>[2];
     };
-  }): Promise<idOSCredential[]> {
-    const matchCriteria = (content: Record<string, unknown>, criteria: Record<string, unknown[]>) =>
-      every(Object.entries(criteria), ([path, targetSet]) =>
-        targetSet.includes(get(content, path)),
-      );
-
+    credentialLevelOrHigherFilter?: {
+      userLevel: "basic" | "plus";
+      requiredAddons: ("liveness" | "email" | "phoneNumber")[];
+    };
+  }): Promise<idOSCredentialListItem[]> {
     const credentials = await this.getAllCredentials();
     const originalCredentials = credentials.filter(
       (cred) => !cred.original_id && !!cred.public_notes,
@@ -440,24 +502,74 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
     });
 
     const publicNotesFieldFilters = requirements.publicNotesFieldFilters;
-    if (publicNotesFieldFilters) {
+    const credentialLevelOrHigherFilter = requirements.credentialLevelOrHigherFilter;
+    const privateFieldFilters = requirements.privateFieldFilters;
+
+    if (credentialLevelOrHigherFilter) {
       result = result.filter((credential) => {
         let publicNotes: Record<string, string>;
+
         try {
           publicNotes = JSON.parse(credential.public_notes);
         } catch (_) {
-          throw new Error(`Credential ${credential.id} has non-JSON public notes".replace("{}`);
+          throw new Error(`Credential ${credential.id} has non-JSON public notes.`);
         }
-        return (
-          matchCriteria(publicNotes, publicNotesFieldFilters.pick) &&
-          negate(() => matchCriteria(publicNotes, publicNotesFieldFilters.omit))
+
+        return matchLevelOrHigher(
+          credentialLevelOrHigherFilter.userLevel,
+          credentialLevelOrHigherFilter.requiredAddons,
+          publicNotes.level,
         );
       });
     }
 
-    const privateFieldFilters = requirements.privateFieldFilters;
-    if (privateFieldFilters) {
-      result = await this.enclaveProvider.filterCredentials(result, privateFieldFilters);
+    if (
+      publicNotesFieldFilters &&
+      (Object.keys(publicNotesFieldFilters.pick).length > 0 ||
+        Object.keys(publicNotesFieldFilters.omit).length > 0)
+    ) {
+      result = result.filter((credential) => {
+        let publicNotes: Record<string, string>;
+
+        try {
+          publicNotes = JSON.parse(credential.public_notes);
+        } catch (_) {
+          throw new Error(`Credential ${credential.id} has non-JSON public notes.`);
+        }
+
+        return recordFilter(
+          publicNotes,
+          publicNotesFieldFilters.pick,
+          publicNotesFieldFilters.omit,
+        );
+      });
+    }
+
+    // Private field filtering requires decryption and the full idOS credential content
+    // it's most "expensive", since it requires a roundtrip to the nodes and roundtrip to enclave.
+    if (
+      privateFieldFilters &&
+      (Object.keys(privateFieldFilters.pick).length > 0 ||
+        Object.keys(privateFieldFilters.omit).length > 0)
+    ) {
+      const fullCredentials = await Promise.all(
+        result.map((credential) => this.getCredentialById(credential.id)),
+      );
+
+      // Check for undefined, it will be sign of some internal error
+      invariant(
+        fullCredentials.every((cred) => cred !== undefined),
+        "Some credentials could not be fetched in full form for private field filtering",
+      );
+
+      const matches = await this.enclaveProvider.filterCredentials(
+        fullCredentials,
+        privateFieldFilters,
+      );
+
+      result = result.filter((credential) =>
+        matches.some((matchedCredential) => matchedCredential.id === credential.id),
+      );
     }
 
     return result;
@@ -468,8 +580,13 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
     {
       consumerEncryptionPublicKey,
       consumerAuthPublicKey,
-    }: { consumerEncryptionPublicKey: string; consumerAuthPublicKey: string },
-  ): Promise<idOSCredential> {
+      lockedUntil = 0,
+    }: {
+      consumerEncryptionPublicKey: string;
+      consumerAuthPublicKey: string;
+      lockedUntil?: number;
+    },
+  ): Promise<ShareCredentialInput> {
     const credential = await this.getCredentialById(credentialId);
     const contentHash = await this.getCredentialContentSha256Hash(credentialId);
 
@@ -489,19 +606,18 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
       base64Decode(consumerEncryptionPublicKey),
     );
 
-    const insertableCredential = {
+    const insertableCredential: ShareCredentialInput = {
       ...credential,
-      ...(await buildInsertableIDOSCredential(
+      ...buildInsertableIDOSCredential(
         credential.user_id,
         "",
         base64Encode(content),
-        consumerAuthPublicKey,
         base64Encode(encryptorPublicKey),
-      )),
+      ),
       original_credential_id: credential.id,
       id: crypto.randomUUID(),
       grantee_wallet_identifier: consumerAuthPublicKey,
-      locked_until: 0,
+      locked_until: lockedUntil,
       content_hash: contentHash,
     };
 
@@ -514,6 +630,7 @@ export class idOSClientLoggedIn implements Omit<Properties<idOSClientWithUserSig
 export type {
   idOSDelegatedWriteGrant,
   idOSCredential,
+  idOSCredentialListItem,
   idOSGrant,
   idOSUser,
   idOSUserAttribute,