@idos-network/client 1.5.0 → 2.2.2

package/src/index.test.ts

@@ -0,0 +1,521 @@
+// @vitest-environment node
+
+import type { BaseProvider } from "@idos-network/enclave";
+
+import { createMmTokenAuth, KwilActionClient } from "@idos-network/kwil-infra";
+import { NodeKwil } from "@idos-network/kwil-js";
+import { BlobGateway, createBlobContentReference } from "@idos-network/utils/blob-gateway";
+import { base64Encode, base64UrlEncode, utf8Encode } from "@idos-network/utils/codecs";
+import { MemoryStore } from "@idos-network/utils/store";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  idOSClientConfiguration,
+  idOSClientIdle,
+  idOSClientLoggedIn,
+  type idOSClientWithUserSigner,
+  toDelegatedWriteGrantBaseParams,
+} from "./index.js";
+
+const mmToken = base64UrlEncode(
+  utf8Encode(
+    JSON.stringify({
+      payload: {
+        signing_public_key: base64UrlEncode(new Uint8Array(32).fill(7)),
+        storage_id: "storage-abc",
+      },
+      signature: base64UrlEncode(new Uint8Array(64).fill(9)),
+    }),
+  ),
+);
+
+function idleClient(): idOSClientIdle {
+  const kwilClient = {
+    signer: undefined,
+    setSigner(signer: unknown) {
+      kwilClient.signer = signer as never;
+    },
+    call: vi.fn(async () => [{ has_profile: true }]),
+    execute: vi.fn(async () => "tx-hash"),
+    client: { auth: { logoutKGW: async () => {} } },
+  } as unknown as KwilActionClient;
+  const enclaveProvider = {
+    setSigner: () => {},
+    reset: async () => {},
+  } as unknown as BaseProvider;
+
+  return new idOSClientIdle(
+    new MemoryStore(),
+    kwilClient,
+    enclaveProvider,
+    new BlobGateway({ url: "https://blob.example" }),
+  );
+}
+
+function header(call: Parameters<typeof fetch> | undefined, name: string): string | null {
+  if (!call) {
+    return null;
+  }
+
+  return new Headers(call[1]?.headers).get(name);
+}
+
+function nodeIdleClient(): idOSClientIdle {
+  const nodeKwil = new NodeKwil({
+    kwilProvider: "https://nodes.example",
+    chainId: "test-chain",
+  }) as NodeKwil & {
+    authenticateKGWAndSetCookie: ReturnType<typeof vi.fn<() => Promise<string>>>;
+    getKgwCookie: ReturnType<typeof vi.fn<() => string | undefined>>;
+  };
+  let cookie: string | undefined;
+  nodeKwil.getKgwCookie = vi.fn(() => cookie);
+  nodeKwil.authenticateKGWAndSetCookie = vi.fn(async () => {
+    cookie = "kgw_session=fresh; Path=/";
+    return cookie;
+  });
+  nodeKwil.auth.logoutKGW = async () => ({}) as never;
+
+  return new idOSClientIdle(
+    new MemoryStore(),
+    new KwilActionClient(nodeKwil),
+    { setSigner: () => {}, reset: async () => {} } as unknown as BaseProvider,
+    new BlobGateway({ url: "https://blob.example" }),
+  );
+}
+
+describe("UKYC blob authorization is scoped to the signed session", () => {
+  it("binds the MM capability when the signer is selected", async () => {
+    const idle = idleClient();
+
+    const withSigner = await idle.withUserSigner(createMmTokenAuth(mmToken));
+
+    expect(withSigner.blobGateway.hasAccessToken).toBe(true);
+    expect(idle.blobGateway.hasAccessToken).toBe(false);
+  });
+
+  it("drops the MM capability on logout", async () => {
+    const withSigner = await idleClient().withUserSigner(createMmTokenAuth(mmToken));
+
+    expect((await withSigner.logOut()).blobGateway.hasAccessToken).toBe(false);
+  });
+
+  it("resets the enclave on logout", async () => {
+    const idle = idleClient();
+    const reset = vi.fn(async () => {});
+    idle.enclaveProvider.reset = reset;
+    const withSigner = await idle.withUserSigner(createMmTokenAuth(mmToken));
+
+    await withSigner.logOut();
+
+    expect(reset).toHaveBeenCalledOnce();
+  });
+
+  it("leaves a non-MM session without UKYC authorization", async () => {
+    const idle = idleClient();
+    const customSigner = {
+      publicAddress: "0x1234567890123456789012345678901234567890",
+      publicKey: base64UrlEncode(new Uint8Array(32).fill(3)),
+      signatureType: "ed25519",
+      walletType: "EVM",
+      signMessage: async () => new Uint8Array(64),
+    };
+
+    const withSigner = await idle.withUserSigner(customSigner as never);
+
+    expect(withSigner.blobGateway.hasAccessToken).toBe(false);
+  });
+});
+
+function ed25519Signer(fill: number) {
+  return {
+    publicAddress: `0x${String(fill).repeat(40)}`,
+    publicKey: base64UrlEncode(new Uint8Array(32).fill(fill)),
+    signatureType: "ed25519",
+    walletType: "EVM",
+    signMessage: async () => new Uint8Array(64),
+  } as never;
+}
+
+describe("signer switching on a shared idle client", () => {
+  const grantId = crypto.randomUUID();
+  const user = {
+    id: crypto.randomUUID(),
+    recipient_encryption_public_key: base64Encode(new Uint8Array(32).fill(7)),
+    encryption_password_store: "user" as const,
+  };
+
+  it("stops an older wrapper from reading or writing as the newer caller", async () => {
+    const idle = idleClient();
+    const withA = await idle.withUserSigner(ed25519Signer(1));
+    const loggedInA = new idOSClientLoggedIn(withA, user);
+    const withB = await idle.withUserSigner(ed25519Signer(2));
+    const loggedInB = new idOSClientLoggedIn(withB, user);
+
+    await expect(withA.hasProfile()).rejects.toThrow(/stale/);
+    await expect(loggedInA.getAllCredentials()).rejects.toThrow(/stale/);
+    await expect(loggedInA.revokeAccessGrant(grantId)).rejects.toThrow(/stale/);
+    await expect(withA.createUserEncryptionProfile("user-a")).rejects.toThrow(/stale/);
+    expect(idle.kwilClient.execute).not.toHaveBeenCalled();
+
+    await expect(withB.hasProfile()).resolves.toBe(true);
+    await expect(loggedInB.revokeAccessGrant(grantId)).resolves.toEqual({ id: grantId });
+    expect(idle.kwilClient.execute).toHaveBeenCalledOnce();
+  });
+
+  it("leaves the newer session alone when an older wrapper logs out", async () => {
+    const idle = idleClient();
+    const reset = vi.fn(async () => {});
+    idle.enclaveProvider.reset = reset;
+    const withA = await idle.withUserSigner(ed25519Signer(1));
+    const withB = await idle.withUserSigner(ed25519Signer(2));
+
+    await withA.logOut();
+
+    expect(reset).not.toHaveBeenCalled();
+    await expect(withB.hasProfile()).resolves.toBe(true);
+
+    await withB.logOut();
+
+    expect(reset).toHaveBeenCalledOnce();
+    await expect(withB.hasProfile()).rejects.toThrow(/stale/);
+  });
+
+  it("stops a kwil client saved before the signer changed", async () => {
+    const idle = idleClient();
+    const signTypedData = vi.fn();
+    idle.enclaveProvider.signTypedData = signTypedData;
+    const withA = await idle.withUserSigner(ed25519Signer(1));
+    const loggedInA = new idOSClientLoggedIn(withA, user);
+    const savedWith = withA.kwilClient;
+    const savedLoggedIn = loggedInA.kwilClient;
+    const savedEnclave = withA.enclaveProvider;
+
+    await idle.withUserSigner(ed25519Signer(2));
+
+    await expect(savedWith.execute({} as never)).rejects.toThrow(/stale/);
+    await expect(savedLoggedIn.call({} as never)).rejects.toThrow(/stale/);
+    expect(() => savedEnclave.signTypedData({}, {}, {})).toThrow(/stale/);
+    expect(idle.kwilClient.execute).not.toHaveBeenCalled();
+    expect(signTypedData).not.toHaveBeenCalled();
+  });
+
+  it("does not return a client that can act as the newer signer", async () => {
+    const idle = idleClient();
+    const withA = await idle.withUserSigner(ed25519Signer(1));
+    const loggedInA = new idOSClientLoggedIn(withA, user);
+    const withB = await idle.withUserSigner(ed25519Signer(2));
+
+    const fromWith = await withA.logOut();
+    const fromLoggedIn = await loggedInA.logOut();
+
+    await expect(fromWith.kwilClient.execute({} as never)).rejects.toThrow(/stale/);
+    await expect(fromLoggedIn.kwilClient.execute({} as never)).rejects.toThrow(/stale/);
+    expect(() => fromWith.kwilClient.setSigner(undefined)).toThrow(/stale/);
+    expect(() => fromWith.enclaveProvider.setSigner({} as never)).toThrow(/stale/);
+    await expect(fromWith.withUserSigner(ed25519Signer(3))).rejects.toThrow(/stale/);
+    await expect(withB.hasProfile()).resolves.toBe(true);
+  });
+
+  it("does not install a new signer while logout is still resetting the enclave", async () => {
+    const idle = idleClient();
+    let releaseReset = (): void => {};
+    const resetGate = new Promise<void>((resolve) => {
+      releaseReset = resolve;
+    });
+    let markResetStarted = (): void => {};
+    const resetStarted = new Promise<void>((resolve) => {
+      markResetStarted = resolve;
+    });
+    idle.enclaveProvider.reset = vi.fn(async () => {
+      markResetStarted();
+      await resetGate;
+    });
+    const withA = await idle.withUserSigner(ed25519Signer(1));
+
+    const loggingOut = withA.logOut();
+    await resetStarted;
+    const switching = idle.withUserSigner(ed25519Signer(2));
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+    expect(idle.kwilClient.signer).toBeUndefined();
+
+    releaseReset();
+    await loggingOut;
+    await switching;
+    expect(idle.kwilClient.signer).not.toBeUndefined();
+  });
+
+  it("retries enclave reset until it finishes, unless a newer signer owns the session", async () => {
+    const idle = idleClient();
+    let failReset = true;
+    const reset = vi.fn(async () => {
+      if (failReset) throw new Error("reset failed");
+    });
+    idle.enclaveProvider.reset = reset;
+    const withA = await idle.withUserSigner(ed25519Signer(1));
+
+    await expect(withA.logOut()).rejects.toThrow(/reset failed/);
+    expect(idle.kwilClient.signer).toBeUndefined();
+
+    failReset = false;
+    await withA.logOut();
+    expect(reset).toHaveBeenCalledTimes(2);
+
+    const withC = await idle.withUserSigner(ed25519Signer(3));
+    failReset = true;
+    await expect(withC.logOut()).rejects.toThrow(/reset failed/);
+    const withD = await idle.withUserSigner(ed25519Signer(4));
+    await withC.logOut();
+
+    expect(reset).toHaveBeenCalledTimes(3);
+    await expect(withD.hasProfile()).resolves.toBe(true);
+  });
+
+  it("does not reconfigure the enclave after a newer signer takes over during login", async () => {
+    const idle = idleClient();
+    let releaseGetUser = (): void => {};
+    const getUserGate = new Promise<void>((resolve) => {
+      releaseGetUser = resolve;
+    });
+    let markGetUserStarted = (): void => {};
+    const getUserStarted = new Promise<void>((resolve) => {
+      markGetUserStarted = resolve;
+    });
+    vi.spyOn(idle.kwilClient, "call").mockImplementation(async (params) => {
+      if (params?.name === "get_user") {
+        markGetUserStarted();
+        await getUserGate;
+        return [user];
+      }
+      return [{ has_profile: true }];
+    });
+    const reconfigure = vi.fn(async () => {});
+    idle.enclaveProvider.reconfigure = reconfigure;
+    const withA = await idle.withUserSigner(ed25519Signer(1));
+
+    const loggingIn = withA.logIn();
+    await getUserStarted;
+    await idle.withUserSigner(ed25519Signer(2));
+    releaseGetUser();
+
+    await expect(loggingIn).rejects.toThrow(/stale/);
+    expect(reconfigure).not.toHaveBeenCalled();
+  });
+});
+
+describe("Node client defaults", () => {
+  it("defaults to MemoryStore outside the browser", () => {
+    class FakeEnclave {
+      constructor(_options: unknown) {}
+    }
+
+    const config = new idOSClientConfiguration({
+      nodeUrl: "https://nodes.example",
+      enclaveOptions: {} as never,
+      enclaveProvider: FakeEnclave as never,
+    });
+
+    expect(config.store).toBeInstanceOf(MemoryStore);
+  });
+});
+
+describe("Node KGW-authenticated blob sessions", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("sends the KGW cookie and MM AccessToken, then drops both on logout", async () => {
+    const ciphertext = utf8Encode("ciphertext");
+    const fetchFn = vi.fn<typeof fetch>(async () => {
+      return new Response("ciphertext", {
+        headers: { "content-length": String(ciphertext.byteLength) },
+      });
+    });
+    vi.stubGlobal("fetch", fetchFn);
+
+    const withSigner = await nodeIdleClient().withUserSigner(createMmTokenAuth(mmToken));
+    expect(withSigner.blobGateway.hasAccessToken).toBe(true);
+
+    await expect(
+      withSigner.blobGateway.fetchBlob({
+        credentialId: "credential-1",
+        expectedSize: ciphertext.byteLength,
+      }),
+    ).resolves.toEqual(ciphertext);
+
+    expect(header(fetchFn.mock.calls[0], "cookie")).toBe("kgw_session=fresh; Path=/");
+    expect(header(fetchFn.mock.calls[0], "authorization")).toBe(`AccessToken ${mmToken}`);
+
+    const idle = await withSigner.logOut();
+    expect(idle.blobGateway.hasAccessToken).toBe(false);
+
+    fetchFn.mockClear();
+    await idle.blobGateway.fetchBlob({
+      credentialId: "credential-1",
+      expectedSize: ciphertext.byteLength,
+    });
+
+    expect(header(fetchFn.mock.calls[0], "cookie")).toBeNull();
+    expect(header(fetchFn.mock.calls[0], "authorization")).toBeNull();
+  });
+
+  it("returns blob-backed ciphertext without decrypting", async () => {
+    const ciphertext = utf8Encode("encrypted-bytes");
+    const { uri, size } = await createBlobContentReference(ciphertext);
+    const credentialId = crypto.randomUUID();
+    const fetchFn = vi.fn<typeof fetch>(async () => {
+      return new Response("encrypted-bytes", {
+        headers: { "content-length": String(size) },
+      });
+    });
+    vi.stubGlobal("fetch", fetchFn);
+
+    const withSigner = await nodeIdleClient().withUserSigner(createMmTokenAuth(mmToken));
+    vi.spyOn(withSigner.kwilClient, "call").mockResolvedValue([
+      {
+        id: credentialId,
+        user_id: crypto.randomUUID(),
+        public_notes: "{}",
+        content: null,
+        content_uri: uri,
+        content_size: size,
+        encryptor_public_key: base64Encode(new Uint8Array(32).fill(1)),
+        issuer_auth_public_key: "issuer-key",
+        inserter_type: "user",
+        inserter_id: "wallet",
+      },
+    ]);
+
+    const client = new idOSClientLoggedIn(withSigner, {
+      id: crypto.randomUUID(),
+      recipient_encryption_public_key: base64Encode(new Uint8Array(32).fill(7)),
+      encryption_password_store: "user",
+    });
+
+    const credential = await client.getCredentialWithEncryptedContent(credentialId);
+
+    expect(credential.content).toBe(base64Encode(ciphertext));
+    expect(credential.content_uri).toBeNull();
+    expect(header(fetchFn.mock.calls[0], "cookie")).toBe("kgw_session=fresh; Path=/");
+    expect(header(fetchFn.mock.calls[0], "authorization")).toBe(`AccessToken ${mmToken}`);
+  });
+});
+
+const NACL_BOX_ENCRYPTION_OVERHEAD_BYTES = 24 + 16; // nonce + authentication tag
+const credentialPlaintext = utf8Encode("private credential content");
+
+async function createCredentialForWallet(walletType: "MM" | "EVM"): Promise<{
+  credential: Awaited<ReturnType<idOSClientLoggedIn["createCredential"]>>;
+  preliminaryInput: Record<string, unknown> | undefined;
+  uploadedBytes: Uint8Array | undefined;
+}> {
+  let preliminaryInput: Record<string, unknown> | undefined;
+  let uploadedBytes: Uint8Array | undefined;
+  const kwilSigner = walletType === "MM" ? createMmTokenAuth(mmToken) : {};
+  const kwilClient = {
+    signer: kwilSigner,
+    execute: async ({ inputs }: { inputs: Record<string, unknown> }) => {
+      preliminaryInput = inputs;
+    },
+  } as unknown as KwilActionClient;
+  const blobGateway = new BlobGateway({
+    url: "https://blob.example",
+    accessToken: walletType === "MM" ? mmToken : undefined,
+    fetchFn: async (_input, init) => {
+      const body = init?.body;
+      if (!(body instanceof FormData)) throw new Error("Expected multipart upload");
+      const original = body.get("original");
+      if (!(original instanceof Blob)) throw new Error("Expected original blob");
+
+      uploadedBytes = new Uint8Array(await original.arrayBuffer());
+      const { cid } = await createBlobContentReference(uploadedBytes);
+      return Response.json({
+        request_id: preliminaryInput?.request_id,
+        original_cid: cid,
+      });
+    },
+  });
+  const withSigner = {
+    store: new MemoryStore(),
+    kwilClient,
+    enclaveProvider: {},
+    signer: {},
+    kwilSigner,
+    walletIdentifier: "wallet",
+    walletPublicKey: undefined,
+    walletType,
+    blobGateway,
+  } as unknown as idOSClientWithUserSigner;
+  const client = new idOSClientLoggedIn(withSigner, {
+    id: crypto.randomUUID(),
+    recipient_encryption_public_key: base64Encode(new Uint8Array(32).fill(7)),
+    encryption_password_store: "user",
+  });
+
+  return {
+    credential: await client.createCredential("public notes", credentialPlaintext),
+    preliminaryInput,
+    uploadedBytes,
+  };
+}
+
+describe("credential blob storage", () => {
+  it("creates MM credentials with ukyc:// and the encrypted byte size", async () => {
+    const { credential, preliminaryInput, uploadedBytes } = await createCredentialForWallet("MM");
+
+    expect(credential.content_uri).toMatch(/^ukyc:\/\/storage-abc\/blobs\//);
+    expect(preliminaryInput?.content_uri).toBe(credential.content_uri);
+    expect(preliminaryInput?.content_size).toBe(
+      credentialPlaintext.byteLength + NACL_BOX_ENCRYPTION_OVERHEAD_BYTES,
+    );
+    expect(uploadedBytes?.byteLength).toBe(preliminaryInput?.content_size);
+  });
+
+  it("creates non-MM credentials through the IPFS CID-validation flow", async () => {
+    const { credential, preliminaryInput, uploadedBytes } = await createCredentialForWallet("EVM");
+
+    expect(credential.content_uri).toMatch(/^ipfs:\/\//);
+    expect(preliminaryInput?.content_uri).toBe(credential.content_uri);
+    expect(preliminaryInput?.content_size).toBe(
+      credentialPlaintext.byteLength + NACL_BOX_ENCRYPTION_OVERHEAD_BYTES,
+    );
+    expect(uploadedBytes?.byteLength).toBe(preliminaryInput?.content_size);
+  });
+
+  it("returns the dwg message string and maps params via toDelegatedWriteGrantBaseParams", async () => {
+    const callAction = vi.fn(async () => [{ message: "mock-dwg-message" }]);
+    const kwilClient = {
+      call: callAction,
+    } as unknown as KwilActionClient;
+    const client = new idOSClientLoggedIn({ kwilClient } as unknown as idOSClientWithUserSigner, {
+      id: crypto.randomUUID(),
+      recipient_encryption_public_key: base64Encode(new Uint8Array(32).fill(7)),
+      encryption_password_store: "user",
+    });
+
+    const dwgInput = {
+      id: crypto.randomUUID(),
+      owner_wallet_identifier: "0x311CEe6648df431EbbeA38dfB680C28661c893Ea",
+      grantee_wallet_identifier: "0x1111111111111111111111111111111111111111",
+      issuer_public_key: "issuer-key",
+      access_grant_timelock: "2026-01-01T00:00:00Z",
+      not_usable_before: "2026-01-01T00:00:00Z",
+      not_usable_after: "2026-01-02T00:00:00Z",
+    };
+
+    const message = await client.requestDWGMessage(dwgInput);
+    const params = toDelegatedWriteGrantBaseParams(dwgInput);
+
+    expect(message).toBe("mock-dwg-message");
+    expect(params).toEqual({
+      id: dwgInput.id,
+      ownerWalletIdentifier: dwgInput.owner_wallet_identifier,
+      consumerWalletIdentifier: dwgInput.grantee_wallet_identifier,
+      issuerPublicKey: dwgInput.issuer_public_key,
+      accessGrantTimelock: dwgInput.access_grant_timelock,
+      notUsableBefore: dwgInput.not_usable_before,
+      notUsableAfter: dwgInput.not_usable_after,
+    });
+    expect(callAction).toHaveBeenCalledWith({ name: "dwg_message", inputs: dwgInput });
+  });
+});