@idos-network/enclave 1.2.0 → 2.2.0

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@idos-network/enclave",
-  "version": "1.2.0",
+  "version": "2.2.0",
   "description": "idOS Enclave JavaScript SDK",
   "homepage": "https://idos.network",
   "license": "MIT",
-  "repository": "github:idos-network/idos-sdk-js",
+  "repository": {
+    "type": "git",
+    "url": "github:idos-network/idos-sdk-js"
+  },
   "files": [
     "dist/**/*",
     "src/**/*"
@@ -31,26 +34,27 @@
     "access": "public"
   },
   "dependencies": {
+    "@idos-network/credentials": "2.2.0",
+    "@idos-network/kwil-infra": "2.2.0",
+    "@idos-network/utils": "2.2.0",
     "scrypt-js": "^3.0.1",
     "tiny-invariant": "^1.3.3",
     "tweetnacl": "^1.0.3",
-    "zod": "4.4.3",
-    "@idos-network/credentials": "1.2.0",
-    "@idos-network/kwil-infra": "1.2.0",
-    "@idos-network/utils": "1.2.0"
+    "zod": "4.5.4"
   },
   "devDependencies": {
-    "@types/chrome": "^0.1.0",
-    "@types/node": "25.6.2",
+    "@types/chrome": "^0.2.5",
+    "@types/node": "25.9.5",
+    "@vitest/coverage-v8": "4.1.11",
     "jsdom": "^22.1.0",
-    "tsdown": "^0.22.0",
-    "typescript": "^5.8.3",
-    "vitest": "4.1.5"
+    "tsdown": "^0.23.0",
+    "typescript": "^5.9.3",
+    "vitest": "4.1.11"
   },
   "peerDependencies": {
-    "@partisiablockchain/abi-client": "^5.207.0",
-    "@partisiablockchain/blockchain-api-transaction-client": "^5.149.0",
-    "ethers": "^6.14.0"
+    "@partisiablockchain/abi-client": "^5.310.0",
+    "@partisiablockchain/blockchain-api-transaction-client": "^5.214.0",
+    "ethers": "^6.17.0"
   },
   "peerDependenciesMeta": {
     "@partisiablockchain/blockchain-api-transaction-client": {
@@ -71,6 +75,7 @@
     "dev": "tsdown  --watch",
     "publint": "pnpx publint --strict",
     "test": "vitest",
+    "coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit"
   }
 }

package/src/base.test.ts

@@ -1,4 +1,4 @@
-import type { idOSCredential } from "@idos-network/credentials/types";
+import type { idOSCredentialRecord as idOSCredential } from "@idos-network/credentials/types";
 
 import { base64Encode, utf8Encode } from "@idos-network/utils/codecs";
 import { describe, expect, it, vi } from "vitest";

package/src/base.ts

@@ -1,4 +1,4 @@
-import type { idOSCredential } from "@idos-network/credentials/types";
+import type { idOSCredentialRecord as idOSCredential } from "@idos-network/credentials/types";
 
 import { recordFilter } from "@idos-network/credentials/utils";
 import { base64Decode, fromBytesToJson, hexEncode } from "@idos-network/utils/codecs";
@@ -238,6 +238,10 @@ export abstract class BaseProvider<K extends EnclaveOptions = EnclaveOptions> {
 
     const decrypted = await Promise.all(
       credentials.map(async (credential: idOSCredential) => {
+        if (!credential.content) {
+          throw new Error(`Credential ${credential.id} has no inline content`);
+        }
+
         const content = await this.decrypt(
           base64Decode(credential.content),
           base64Decode(credential.encryptor_public_key),

package/src/local.test.ts

@@ -1,4 +1,4 @@
-import type { idOSCredential } from "@idos-network/credentials/types";
+import type { idOSCredentialRecord as idOSCredential } from "@idos-network/credentials/types";
 
 import { base64Decode, base64Encode, utf8Encode } from "@idos-network/utils/codecs";
 import { encryptContent } from "@idos-network/utils/cryptography";
@@ -6,10 +6,49 @@ import { MemoryStore } from "@idos-network/utils/store";
 import tweetnacl from "tweetnacl";
 import { describe, expect, it, vi } from "vitest";
 
+import { STORAGE_KEYS } from "./keys.js";
 import { LocalEnclave, type LocalEnclaveOptions } from "./local.js";
 
+// ponytail: real scrypt (N=16384) runs on every obfuscated store read/write, which is
+// several hundred ms per test and times out on CI. The codec only needs a deterministic
+// key of the right length, not a real KDF.
+vi.mock("scrypt-js", () => ({
+  syncScrypt: (
+    _password: Uint8Array,
+    salt: Uint8Array,
+    _n: number,
+    _r: number,
+    _p: number,
+    dkLen: number,
+  ) =>
+    new Uint8Array(Array.from({ length: dkLen }, (_, index) => salt[index % salt.length] ^ index)),
+}));
+
+vi.mock("@idos-network/utils/encryption", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@idos-network/utils/encryption")>();
+
+  return {
+    ...actual,
+    keyDerivation: vi.fn(
+      async () => new Uint8Array(Array.from({ length: 32 }, (_, index) => index)),
+    ),
+  };
+});
+
+// Obfuscated store uses syncScrypt(N=16384); keep tests under vitest's default 5s timeout on CI.
+vi.mock("scrypt-js", () => ({
+  syncScrypt: vi.fn(
+    (_password: Uint8Array, _salt: Uint8Array, _N: number, _r: number, _p: number, dkLen: number) =>
+      new Uint8Array(dkLen).fill(7),
+  ),
+}));
+
 class TestEnclave extends LocalEnclave {
+  userIdPresentOnPrompt: boolean[] = [];
+
   async getPasswordContext() {
+    this.userIdPresentOnPrompt.push((await this.store.get(STORAGE_KEYS.USER_ID)) !== undefined);
+
     return {
       encryptionPasswordStore: "user",
       password: "super-secret",
@@ -18,9 +57,116 @@ class TestEnclave extends LocalEnclave {
   }
 }
 
+class MPCTestEnclave extends LocalEnclave {
+  mpcPassword = "super-secret";
+
+  async getPasswordContext() {
+    return {
+      encryptionPasswordStore: "mpc",
+    } as const;
+  }
+
+  protected async ensureMPCPassword() {
+    return this.mpcPassword;
+  }
+}
+
 describe("LocalEnclave", () => {
   const userId = "9f51b3b2-4cbe-4c2b-8ea3-0b0c1b2f1a11";
 
+  it("rejects passwords whose derived public key does not match expectedUserEncryptionPublicKey", async () => {
+    const store = new MemoryStore();
+    const enclave = new TestEnclave({
+      userId,
+      store,
+      expectedUserEncryptionPublicKey: base64Encode(new Uint8Array(32).fill(1)),
+    } as LocalEnclaveOptions);
+
+    await expect(
+      enclave.createEncryptionProfileFromPassword("super-secret", userId, "user"),
+    ).rejects.toThrow(
+      "Derived encryption public key does not match expectedUserEncryptionPublicKey",
+    );
+  });
+
+  it("accepts passwords whose derived public key matches expectedUserEncryptionPublicKey", async () => {
+    const store = new MemoryStore();
+    const enclave = new TestEnclave({ userId, store } as LocalEnclaveOptions);
+    const { keyPair } = await enclave.createEncryptionProfileFromPassword(
+      "super-secret",
+      userId,
+      "user",
+    );
+
+    const matchingEnclave = new TestEnclave({
+      userId,
+      store: new MemoryStore(),
+      expectedUserEncryptionPublicKey: base64Encode(keyPair.publicKey),
+    } as LocalEnclaveOptions);
+
+    await expect(
+      matchingEnclave.createEncryptionProfileFromPassword("super-secret", userId, "user"),
+    ).resolves.toMatchObject({ userId, encryptionPasswordStore: "user" });
+  });
+
+  it("rejects MPC unlock when the downloaded password derives a mismatched public key", async () => {
+    const store = new MemoryStore();
+    const enclave = new MPCTestEnclave({
+      userId,
+      store,
+      mode: "existing",
+      expectedUserEncryptionPublicKey: base64Encode(new Uint8Array(32).fill(1)),
+    } as LocalEnclaveOptions);
+
+    await expect(enclave.getPrivateEncryptionProfile()).rejects.toThrow(
+      "Derived encryption public key does not match expectedUserEncryptionPublicKey",
+    );
+  });
+
+  it("requires origin authorization after deriving a key and keeps the profile if denied", async () => {
+    const store = new MemoryStore();
+    const enclave = new TestEnclave({ userId, store } as LocalEnclaveOptions);
+    let allowed = false;
+    const guard = vi.spyOn(enclave, "guardKeys").mockImplementation(async () => allowed);
+    const passwordContextSpy = vi.spyOn(enclave, "getPasswordContext");
+
+    await expect(enclave.getPrivateEncryptionProfile()).rejects.toThrow(
+      "Origin is not authorized to use the keys",
+    );
+    expect(passwordContextSpy).toHaveBeenCalledTimes(1);
+    expect(guard).toHaveBeenCalledTimes(1);
+
+    allowed = true;
+    const profile = await enclave.getPrivateEncryptionProfile();
+
+    expect(profile.userId).toBe(userId);
+    expect(passwordContextSpy).toHaveBeenCalledTimes(1);
+    expect(guard).toHaveBeenCalledTimes(2);
+  });
+
+  it("does not check origin authorization when the guard is skipped", async () => {
+    const enclave = new TestEnclave({ userId, store: new MemoryStore() } as LocalEnclaveOptions);
+    const guard = vi.spyOn(enclave, "guardKeys");
+
+    await enclave.getPrivateEncryptionProfile(true);
+
+    expect(guard).not.toHaveBeenCalled();
+  });
+
+  it("does not request a password context for an MM profile without a stored key", async () => {
+    const enclave = new TestEnclave({
+      userId,
+      store: new MemoryStore(),
+      encryptionPasswordStore: "mm",
+    });
+    const passwordContextSpy = vi.spyOn(enclave, "getPasswordContext");
+
+    await expect(enclave.getPrivateEncryptionProfile()).rejects.toThrow(
+      "MM encryption profiles require an externally supplied encryption private key",
+    );
+    expect(passwordContextSpy).not.toHaveBeenCalled();
+  });
+
   it("creates and exposes a public encryption profile", async () => {
     const store = new MemoryStore();
     const enclave = new TestEnclave({ userId, store } as LocalEnclaveOptions);
@@ -110,4 +256,28 @@ describe("LocalEnclave", () => {
     expect(filtered[0]?.content).toBe("");
     expect(passwordContextSpy).toHaveBeenCalledTimes(1);
   });
+
+  it("forgets a cached profile after the remember duration elapses", async () => {
+    vi.useFakeTimers({ toFake: ["Date"] });
+
+    try {
+      vi.setSystemTime(new Date("2026-01-01T00:00:00Z"));
+
+      const store = new MemoryStore();
+      const enclave = new TestEnclave({ userId, store } as LocalEnclaveOptions);
+      const first = await enclave.getPrivateEncryptionProfile();
+
+      expect(await enclave.getPrivateEncryptionProfile()).toBe(first);
+
+      vi.setSystemTime(new Date("2026-01-03T00:00:00Z"));
+      const after = await enclave.getPrivateEncryptionProfile();
+
+      expect(after).not.toBe(first);
+      expect(after.userId).toBe(userId);
+      // First prompt finds an empty store. The second must too: expiry resets before re-entry.
+      expect(enclave.userIdPresentOnPrompt).toEqual([false, false]);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
 });

package/src/local.ts

@@ -96,7 +96,7 @@ export class LocalEnclave<
   async reset(): Promise<void> {
     await super.reset();
     this.storedEncryptionProfile = undefined;
-    this.store.reset();
+    await this.store.reset();
   }
 
   /** @override parent method to reconfigure the enclave */
@@ -266,26 +266,32 @@ export class LocalEnclave<
    * @see BaseProvider#getPrivateEncryptionProfile
    */
   async getPrivateEncryptionProfile(skipGuard = false): Promise<PrivateEncryptionProfile> {
-    // In case there is a no key pair, which matches we don't need a new one.
-    if (this.storedEncryptionProfile) {
-      let canBeUsed = this.storedEncryptionProfile.userId === this.userId;
+    // Remember duration is a key-use check. A long-lived iframe keeps this profile
+    // in memory, so construction-time store expiry is not enough.
+    if (this.storedEncryptionProfile && (await this.store.hasRememberDurationElapsed())) {
+      await this.reset();
+    }
 
-      if (canBeUsed && !skipGuard) {
-        // When users matches, we also need to check
-        // if origin is authorized to use the keys.
-        canBeUsed = await this.guardKeys();
+    if (this.storedEncryptionProfile?.userId === this.userId) {
+      // A matching cached profile still needs origin authorization before key use.
+      // Denying it must keep the profile and the allowlist; only a different user resets.
+      if (!skipGuard && !(await this.guardKeys())) {
+        throw new Error("Origin is not authorized to use the keys");
       }
 
-      if (canBeUsed) {
-        return this.storedEncryptionProfile;
-      }
+      return this.storedEncryptionProfile;
+    }
 
-      // Something did not match, we need to create a new key pair
-      // and reset the enclave.
+    if (this.storedEncryptionProfile) {
       await this.reset();
     }
 
-    // The stored profile can't be used, or we have to create a new one.
+    if (this.options.encryptionPasswordStore === "mm") {
+      throw new Error(
+        "MM encryption profiles require an externally supplied encryption private key",
+      );
+    }
+
     let password: string | undefined;
     let encryptionPasswordStore: EncryptionPasswordStore | undefined;
 
@@ -310,7 +316,18 @@ export class LocalEnclave<
       throw new Error("Password or encryption password store is not found");
     }
 
-    return this.createEncryptionProfileFromPassword(password, this.userId, encryptionPasswordStore);
+    const profile = await this.createEncryptionProfileFromPassword(
+      password,
+      this.userId,
+      encryptionPasswordStore,
+    );
+
+    // Same origin check as the cached path. Password or MPC success is not authorization.
+    if (!skipGuard && !(await this.guardKeys())) {
+      throw new Error("Origin is not authorized to use the keys");
+    }
+
+    return profile;
   }
 
   /** @see BaseProvider#ensureUserEncryptionProfile */
@@ -351,6 +368,13 @@ export class LocalEnclave<
 
     const keyPair = nacl.box.keyPair.fromSecretKey(secretKey);
 
+    const expectedPublicKey = this.options.expectedUserEncryptionPublicKey;
+    if (expectedPublicKey && base64Encode(keyPair.publicKey) !== expectedPublicKey) {
+      throw new Error(
+        "Derived encryption public key does not match expectedUserEncryptionPublicKey",
+      );
+    }
+
     await this.store.set(STORAGE_KEYS.USER_ID, userId);
     await this.storeObfuscated.set(STORAGE_KEYS.OBFUSCATED_PASSWORD, password);
     await this.store.delete(STORAGE_KEYS.DEPRECATED___PASSWORD);

package/dist/base-0xSNl4rW.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-0xSNl4rW.d.mts","names":[],"sources":["../src/types.ts","../src/base.ts"],"mappings":";;;;;KAIY,uBAAA;EACV,MAAA;EACA,uBAAA;EACA,uBAAA,EAAyB,yBAAA;AAAA;AAAA,KAGf,wBAAA;EACV,MAAA;EACA,QAAA;EACA,OAAA,EAAS,IAAA,CAAK,UAAA;EACd,uBAAA,EAAyB,yBAAA;AAAA;AAAA,KAGf,cAAA;EACV,KAAA;EACA,IAAA;EACA,MAAA;EACA,+BAAA;EACA,aAAA;EACA,eAAA;EACA,UAAA,GAAa,UAAA;EACb,uBAAA,GAA0B,yBAAA;AAAA;AAAA,KAGhB,eAAA;EACV,uBAAA;EACA,QAAA;EACA,QAAA;AAAA;AAAA,KAGU,kBAAA;EACV,uBAAA;AAAA;;;uBCtBoB,YAAA,WAAuB,cAAA,GAAiB,cAAA;EAAA,SACnD,OAAA,EAAS,CAAA;EAAA,UAGR,WAAA,IAAe,MAAA,OAAa,KAAA,OAAY,KAAA,UAAe,OAAA;EAAA,QACzD,eAAA;EAER,WAAA,CAAY,OAAA,EAAS,CAAA;EDbI;;;;;ECsBzB,SAAA,CAAU,MAAA;IACR,aAAA,IAAiB,MAAA,UAAgB,KAAA,YAAiB,KAAA,aAAkB,OAAA;IAEpE,WAAA,IAAe,OAAA,aAAoB,OAAA;IAEnC,MAAA,IAAU,OAAA,aAAoB,OAAA;EAAA;EA4BhC,aAAA,CAAoB,MAAA,OAAa,KAAA,OAAY,KAAA,QAAa,OAAA;;;;;;MAkDtD,MAAA,CAAA;;;;EAUJ,KAAA,CAAA,GAAe,OAAA;EDzGL;;;;;ECkHV,WAAA,CAAkB,OAAA,GAAS,OAAA,CAAQ,CAAA,IAAU,OAAA;;;;EAO7C,IAAA,CAAA,GAAc,OAAA;;;;;;AD9GhB;;;;EC2HE,OAAA,CACE,QAAA,EAAU,UAAA,EACV,kBAAA,EAAoB,UAAA,GACnB,OAAA;IAAU,OAAA,EAAS,UAAA;IAAY,kBAAA,EAAoB,UAAA;EAAA;ED3HtD;AAGF;;;;;;;;ECqIE,OAAA,CACE,QAAA,EAAU,UAAA,EACV,gBAAA,EAAkB,UAAA,GACjB,OAAA,CAAQ,UAAA,CAAW,eAAA;EA7JF;;;;;;;EAwKpB,OAAA,CAAc,QAAA,WAAmB,OAAA;;;;EAOjC,2BAAA,CAAA,GAAqC,OAAA;;;;;;EASrC,2BAAA,CAAA,GAAqC,OAAA,CAAQ,uBAAA;;;;;;;EAU7C,SAAA,CAAA,GAAmB,OAAA;;;;;;;;;EAYnB,iBAAA,CACE,WAAA,EAAa,cAAA,IACb,mBAAA;IAAuB,IAAA,EAAM,MAAA;IAA2B,IAAA,EAAM,MAAA;EAAA,IAC7D,OAAA,CAAQ,cAAA;EAoDX,uBAAA,CACE,QAAA,UACA,UAAA,sBACA,iBAAA,WACC,OAAA,CAAQ,uBAAA;EAIX,0BAAA,CACE,QAAA,UACA,UAAA,sBACA,oBAAA,WACC,OAAA,CAAQ,0BAAA;EAIX,qBAAA,CACE,OAAA,UACA,QAAA,EAAU,0BAAA,EACV,UAAA,WACC,OAAA;EAIH,0BAAA,CACE,OAAA,UACA,QAAA,EAAU,6BAAA,EACV,UAAA,WACC,OAAA;AAAA"}

package/dist/client-Bu0aO5sT.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-Bu0aO5sT.d.mts","names":[],"sources":["../src/mpc/client.ts"],"mappings":";;;;cA4Ba,MAAA;EAAA,iBACM,OAAA;EAAA,iBACA,eAAA;EAAA,QACT,OAAA;EAAA,QACA,UAAA;EAAA,QACA,aAAA;EAAA,QACA,eAAA;EAAA,QACA,OAAA;EAAA,QACA,QAAA;EAER,WAAA,CACE,OAAA,UACA,eAAA,EAAiB,UAAA,EACjB,YAAA,UACA,QAAA,UACA,gBAAA,UACA,UAAA,EAAY,UAAA,EACZ,aAAA,UACA,eAAA;EAYF,WAAA,CACE,UAAA,EAAY,UAAA,EACZ,aAAA,UACA,eAAA;EAuCF,YAAA,CACE,EAAA,UACA,eAAA,EAAiB,sBAAA,EACjB,SAAA,EAAW,KAAA,EACX,aAAA,EAAe,MAAA,KACd,OAAA;IAAU,MAAA;EAAA;EAwBb,gBAAA,CAAwB,MAAA,EAAQ,MAAA,GAAS,MAAA;EAUzC,mBAAA,CAA2B,aAAA,EAAe,sBAAA,GAAyB,mBAAA;EAQnE,aAAA,CAAqB,aAAA,EAAe,MAAA,KAAW,sBAAA;EA0B/C,qBAAA,CAA6B,eAAA,EAAiB,wBAAA,GAA2B,qBAAA;EAQzE,eAAA,CAAuB,SAAA,EAAW,UAAA,GAAa,wBAAA;EAyB/C,cAAA,CACE,EAAA,UACA,eAAA,EAAiB,wBAAA,EACjB,SAAA,EAAW,KAAA,EACX,SAAA,EAAW,UAAA,GACV,OAAA;IAAU,MAAA;IAAgB,MAAA,EAAQ,MAAA;EAAA;EA0BrC,uBAAA,CACE,YAAA,UACA,SAAA,sBACA,gBAAA,WACC,uBAAA;EAmDH,0BAAA,CACE,eAAA,UACA,SAAA,sBACA,mBAAA,WACC,0BAAA;EAkDH,UAAA,CACE,MAAA,UACA,OAAA,EAAS,0BAAA,EACT,SAAA,WACC,OAAA;EAgBH,aAAA,CACE,MAAA,UACA,OAAA,EAAS,6BAAA,EACT,SAAA,WACC,OAAA;EAAA,QAgBK,cAAA;EAAA,QAQM,UAAA;EAAA,eAaC,UAAA;AAAA"}