@idos-network/enclave 1.1.0

package/src/base.ts

@@ -0,0 +1,306 @@
+import type { idOSCredential } from "@idos-network/credentials/types";
+
+import { recordFilter } from "@idos-network/credentials/utils";
+import { base64Decode, fromBytesToJson, hexEncode } from "@idos-network/utils/codecs";
+
+import type {
+  AddAddressMessageToSign,
+  AddAddressSignatureMessage,
+  RemoveAddressMessageToSign,
+  RemoveAddressSignatureMessage,
+} from "./mpc/types";
+import type { EnclaveOptions, PublicEncryptionProfile } from "./types";
+
+export abstract class BaseProvider<K extends EnclaveOptions = EnclaveOptions> {
+  readonly options: K;
+
+  // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains
+  protected _signMethod?: (domain: any, types: any, value: any) => Promise<string>;
+  private _signMethodType?: "signTypedData" | "signMessage" | "signer";
+
+  constructor(options: K) {
+    this.options = options;
+  }
+
+  /**
+   * Sets the signer for the enclave.
+   *
+   * @param signer - The signer to set, is later used for MPC if allowed.
+   */
+  setSigner(signer: {
+    signTypedData?: (domain: string, types: string[], value: string) => Promise<string>;
+    // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains
+    signMessage?: (message: string) => Promise<any>;
+    // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains
+    signer?: (message: string) => Promise<any>;
+  }): void {
+    if (signer.signTypedData) {
+      // EVM wallet
+      this._signMethod = signer.signTypedData.bind(signer);
+      this._signMethodType = "signTypedData";
+    } else if (signer.signMessage) {
+      // XRPL wallet
+      this._signMethod = signer.signMessage.bind(signer);
+      this._signMethodType = "signMessage";
+    } else if (signer.signer) {
+      // Stellar wallet
+      this._signMethod = signer.signer.bind(signer);
+      this._signMethodType = "signer";
+    } else {
+      if (["signMessage", "signer"].some((key) => key in signer)) {
+        this._signMethod = signer.signMessage
+          ? // @ts-expect-error - signMessage for xrpl and near, signer for stellar
+            signer.signMessage.bind(signer)
+          : // @ts-expect-error - signMessage for xrpl and near, signer for stellar
+            signer.signer?.bind(signer);
+      } else {
+        throw new Error("No sign method found in passed signer");
+      }
+    }
+  }
+
+  // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains
+  async signTypedData(domain: any, types: any, value: any): Promise<string> {
+    if (!this._signMethod || !this._signMethodType) {
+      throw new Error("Signer is not set");
+    }
+
+    let signature: string;
+
+    // Handle different signing methods based on wallet type
+    if (this._signMethodType === "signTypedData") {
+      // EVM wallets: use all 3 arguments
+      signature =
+        await // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains
+        (this._signMethod as (domain: any, types: any, value: any) => Promise<string>)(
+          domain,
+          types,
+          value,
+        );
+    } else if (this._signMethodType === "signMessage" || this._signMethodType === "signer") {
+      // XRPL/NEAR/Stellar/FaceSign wallets: use only the value as message
+      const messageString = JSON.stringify(value);
+      // oxlint-disable-next-line typescript/no-explicit-any -- TODO: Change this when we know how to MPC & other chains
+      const response = await (this._signMethod as (message: any) => Promise<any>)(messageString);
+
+      // Extract signature from response object
+      if (typeof response === "string") {
+        signature = response;
+      } else if (response?.result?.signedMessage) {
+        signature = response.result.signedMessage;
+      } else if (response?.signedMessage) {
+        signature = response.signedMessage;
+      } else if (response instanceof Uint8Array && response.length === 64) {
+        // ed25519 signature size
+        return hexEncode(response);
+      } else {
+        throw new Error(
+          `Unexpected response format from ${this._signMethodType}: ${JSON.stringify(response)}`,
+        );
+      }
+    } else {
+      throw new Error(`Unknown sign method type: ${this._signMethodType}`);
+    }
+
+    return signature;
+  }
+
+  /**
+   * Helper method to get the user ID.
+   *
+   * @returns The user ID.
+   */
+  get userId(): string {
+    if (!this.options.userId) {
+      throw new Error("User ID is not present");
+    }
+    return this.options.userId;
+  }
+
+  /**
+   * Resets the enclave (storage etc.)
+   */
+  async reset(): Promise<void> {
+    // Implement this if needed in child classes
+  }
+
+  /**
+   * Reconfigures the enclave (theme etc).
+   *
+   * @param options - The options to reconfigure.
+   */
+  async reconfigure(options: Partial<K> = {}): Promise<void> {
+    Object.assign(this.options, options);
+  }
+
+  /**
+   * Loads the enclave (create iframe, open connection, etc.)
+   */
+  async load(): Promise<void> {
+    await this.reconfigure();
+  }
+
+  /**
+   * Encrypts a message to a receiver.
+   * This method also checks if the user is authorized to use the keys.
+   *
+   * @param _message - The message to encrypt.
+   * @param _receiverPublicKey - The public key of the receiver.
+   *
+   * @returns The encrypted message.
+   */
+  async encrypt(
+    _message: Uint8Array,
+    _receiverPublicKey: Uint8Array,
+  ): Promise<{ content: Uint8Array; encryptorPublicKey: Uint8Array }> {
+    throw new Error("Method 'encrypt' has to be implemented in the subclass.");
+  }
+
+  /**
+   * Decrypts a message from a sender.
+   * This method also checks if the user is authorized to use the keys.
+   *
+   * @param _message - The message to decrypt.
+   * @param _senderPublicKey - The public key of the sender.
+   *
+   * @returns The decrypted message.
+   */
+  async decrypt(
+    _message: Uint8Array,
+    _senderPublicKey: Uint8Array,
+  ): Promise<Uint8Array<ArrayBufferLike>> {
+    throw new Error("Method 'decrypt' has to be implemented in the subclass.");
+  }
+
+  /**
+   * This method is used to confirm the user action.
+   *
+   * @param _message - The message to confirm.
+   *
+   * @returns `true` if the user action is confirmed, `false` otherwise.
+   */
+  async confirm(_message: string): Promise<boolean> {
+    throw new Error("Method 'confirm' has to be implemented in the subclass.");
+  }
+
+  /**
+   * This method is used to backup the password context.
+   */
+  async backupUserEncryptionProfile(): Promise<void> {
+    throw new Error("Method 'backupUserEncryptionProfile' has to be implemented in the subclass.");
+  }
+
+  /**
+   * Gets the public encryption profile.
+   *
+   * @returns The public encryption profile.
+   */
+  async ensureUserEncryptionProfile(): Promise<PublicEncryptionProfile> {
+    throw new Error("Method 'ensureUserEncryptionProfile' has to be implemented in the subclass.");
+  }
+
+  /**
+   * This method authorizes the origin in case of enclave
+   * to use the keys, without user providing the password or MPC again.
+   *
+   * @returns `true` if the user action is authorized, `false` otherwise.
+   */
+  async guardKeys(): Promise<boolean> {
+    return true;
+  }
+
+  /**
+   * Filters the credentials based on the private field filters.
+   *
+   * @param credentials - The credentials to filter.
+   * @param privateFieldFilters - The private field filters.
+   *
+   * @returns The filtered credentials without the content.
+   */
+  async filterCredentials(
+    credentials: idOSCredential[],
+    privateFieldFilters: { pick: Record<string, unknown[]>; omit: Record<string, unknown[]> },
+  ): Promise<idOSCredential[]> {
+    if (
+      Object.keys(privateFieldFilters.pick).length === 0 &&
+      Object.keys(privateFieldFilters.omit).length === 0
+    ) {
+      // No filtering needed
+      return credentials.map((credential) => ({
+        ...credential,
+        content: "", // Content should never leave the enclave!!!
+      }));
+    }
+
+    // We need to be sure first that we have the encryption profile
+    // otherwise we can end up with a lot of signatures for each credential
+    await this.ensureUserEncryptionProfile();
+
+    const decrypted = await Promise.all(
+      credentials.map(async (credential: idOSCredential) => {
+        const content = await this.decrypt(
+          base64Decode(credential.content),
+          base64Decode(credential.encryptor_public_key),
+        );
+
+        let json: Record<string, unknown>;
+
+        try {
+          json = fromBytesToJson(content);
+        } catch (_e) {
+          throw new Error(`Credential ${credential.id} decrypted contents are not valid JSON`);
+        }
+
+        return {
+          ...credential,
+          content: json,
+        };
+      }),
+    );
+
+    return decrypted
+      .filter(({ content }) =>
+        recordFilter(
+          content as Record<string, unknown>,
+          privateFieldFilters.pick,
+          privateFieldFilters.omit,
+        ),
+      )
+      .map((credential) => ({
+        ...credential,
+        content: "", // Content should never leave the enclave!!!
+      }));
+  }
+
+  async addAddressMessageToSign(
+    _address: string,
+    _publicKey: string | undefined,
+    _addressToAddType: string,
+  ): Promise<AddAddressMessageToSign> {
+    throw new Error("Method 'addAddressMessageToSign' has to be implemented in the subclass.");
+  }
+
+  async removeAddressMessageToSign(
+    _address: string,
+    _publicKey: string | undefined,
+    _addressToRemoveType: string,
+  ): Promise<RemoveAddressMessageToSign> {
+    throw new Error("Method 'removeAddressMessageToSign' has to be implemented in the subclass.");
+  }
+
+  async addAddressToMpcSecret(
+    _userId: string,
+    _message: AddAddressSignatureMessage,
+    _signature: string,
+  ): Promise<string> {
+    throw new Error("Method 'addAddressToMpcSecret' has to be implemented in the subclass.");
+  }
+
+  async removeAddressFromMpcSecret(
+    _userId: string,
+    _message: RemoveAddressSignatureMessage,
+    _signature: string,
+  ): Promise<string> {
+    throw new Error("Method 'removeAddressFromMpcSecret' has to be implemented in the subclass.");
+  }
+}

package/src/index.ts

@@ -0,0 +1,3 @@
+export { BaseProvider } from "./base";
+export * from "./keys";
+export * from "./types";

package/src/keys.ts

@@ -0,0 +1,10 @@
+export const STORAGE_KEYS = {
+  DEPRECATED___ENCRYPTION_PRIVATE_KEY: "encryption-private-key",
+  DEPRECATED___ENCRYPTION_SECRET_KEY: "encryption-secret-key",
+  OBFUSCATED_BASE64_ENCRYPTION_SECRET_KEY: "obfuscated-base64-encryption-secret-key",
+  ENCRYPTION_PUBLIC_KEY: "encryption-public-key",
+  DEPRECATED___PASSWORD: "password",
+  OBFUSCATED_PASSWORD: "obfuscated-password",
+  USER_ID: "user-id",
+  ENCRYPTION_PASSWORD_STORE: "encryption-password-store",
+};

package/src/local.test.ts

@@ -0,0 +1,113 @@
+import type { idOSCredential } from "@idos-network/credentials/types";
+
+import { base64Decode, base64Encode, utf8Encode } from "@idos-network/utils/codecs";
+import { encryptContent } from "@idos-network/utils/cryptography";
+import { MemoryStore } from "@idos-network/utils/store";
+import tweetnacl from "tweetnacl";
+import { describe, expect, it, vi } from "vitest";
+
+import { LocalEnclave, type LocalEnclaveOptions } from "./local.js";
+
+class TestEnclave extends LocalEnclave {
+  async getPasswordContext() {
+    return {
+      encryptionPasswordStore: "user",
+      password: "super-secret",
+      duration: 1,
+    } as const;
+  }
+}
+
+describe("LocalEnclave", () => {
+  const userId = "9f51b3b2-4cbe-4c2b-8ea3-0b0c1b2f1a11";
+
+  it("creates and exposes a public encryption profile", async () => {
+    const store = new MemoryStore();
+    const enclave = new TestEnclave({ userId, store } as LocalEnclaveOptions);
+
+    const profile = await enclave.createEncryptionProfileFromPassword(
+      "super-secret",
+      userId,
+      "user",
+    );
+
+    expect(profile.userId).toBe(userId);
+    expect(profile.encryptionPasswordStore).toBe("user");
+
+    const publicProfile = await enclave.ensureUserEncryptionProfile();
+    const publicKeyBytes = base64Decode(publicProfile.userEncryptionPublicKey);
+
+    expect(publicProfile.userId).toBe(userId);
+    expect(publicProfile.encryptionPasswordStore).toBe("user");
+    expect(publicKeyBytes).toHaveLength(32);
+  });
+
+  it("encrypts and decrypts with its keypair", async () => {
+    const store = new MemoryStore();
+    const enclave = new TestEnclave({ userId, store } as LocalEnclaveOptions);
+    const { keyPair } = await enclave.getPrivateEncryptionProfile();
+
+    const message = new Uint8Array([1, 2, 3, 4]);
+    const { content, encryptorPublicKey } = await enclave.encrypt(message, keyPair.publicKey);
+    const decrypted = await enclave.decrypt(content, encryptorPublicKey);
+
+    expect(decrypted).toEqual(message);
+  });
+
+  it("filters credentials and strips content", async () => {
+    const store = new MemoryStore();
+    const enclave = new TestEnclave({ userId, store });
+    const { keyPair } = await enclave.getPrivateEncryptionProfile();
+
+    // Reset enclave locals
+    // @ts-expect-error This is fine, it's a custom method simulates the private encryption profile
+    enclave.storedEncryptionProfile = undefined;
+
+    const matches = { type: "kyc", level: "basic" };
+    const misses = { type: "aml", level: "basic" };
+
+    const ephemeralKeyPair = tweetnacl.box.keyPair();
+
+    const matchesEncryption = encryptContent(
+      utf8Encode(JSON.stringify(matches)),
+      keyPair.publicKey,
+      ephemeralKeyPair.secretKey,
+    );
+    const missesEncryption = encryptContent(
+      utf8Encode(JSON.stringify(misses)),
+      keyPair.publicKey,
+      ephemeralKeyPair.secretKey,
+    );
+
+    const passwordContextSpy = vi.spyOn(enclave, "getPasswordContext");
+
+    const credentials: idOSCredential[] = [
+      {
+        id: "cred-1",
+        user_id: "user-1",
+        public_notes: "{}",
+        content: base64Encode(matchesEncryption),
+        encryptor_public_key: base64Encode(ephemeralKeyPair.publicKey),
+        issuer_auth_public_key: "issuer",
+      },
+      {
+        id: "cred-2",
+        user_id: "user-1",
+        public_notes: "{}",
+        content: base64Encode(missesEncryption),
+        encryptor_public_key: base64Encode(ephemeralKeyPair.publicKey),
+        issuer_auth_public_key: "issuer",
+      },
+    ];
+
+    const filtered = await enclave.filterCredentials(credentials, {
+      pick: { type: ["kyc"] },
+      omit: {},
+    });
+
+    expect(filtered).toHaveLength(1);
+    expect(filtered[0]?.id).toBe("cred-1");
+    expect(filtered[0]?.content).toBe("");
+    expect(passwordContextSpy).toHaveBeenCalledTimes(1);
+  });
+});