@idos-network/kwil-infra 3.0.1 → 5.0.0

package/src/create-kgw-authenticated-fetch.test.ts

@@ -1,7 +1,6 @@
 // @vitest-environment node
 
 import { type KwilSigner, NodeKwil } from "@idos-network/kwil-js";
-import { base64UrlEncode, utf8Encode } from "@idos-network/utils/codecs";
 import { describe, expect, it, vi } from "vitest";
 
 import {
@@ -9,19 +8,6 @@ import {
   createKgwAuthenticatedFetch,
 } from "./create-kgw-authenticated-fetch";
 import { KwilActionClient } from "./create-kwil-client";
-import { createMmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
-
-const mmEnvelopeToken = base64UrlEncode(
-  utf8Encode(
-    JSON.stringify({
-      payload: {
-        signing_public_key: base64UrlEncode(new Uint8Array(32).fill(7)),
-        storage_id: "storage-abc",
-      },
-      signature: base64UrlEncode(new Uint8Array(64).fill(9)),
-    }),
-  ),
-);
 
 function createTestClient(
   initialCookie?: string,
@@ -279,6 +265,33 @@ describe("createKgwAuthenticatedFetch", () => {
     expect(cookieHeader(fetchFn.mock.calls[0])).toBe("kgw_session=valid; Path=/");
   });
 
+  it.each(["MM_TOKEN_INVALID", "MM_TOKEN_EXPIRED"])(
+    "does not reauthenticate when blob-gateway rejects the storage token (%s)",
+    async (code) => {
+      const { authFetch, fetchFn, refresh } = createTestClient("kgw_session=valid; Path=/");
+      fetchFn.mockResolvedValueOnce(Response.json({ error: "token", code }, { status: 401 }));
+
+      const response = await authFetch("https://blob.example/blob/v1/storage");
+
+      expect(response.status).toBe(401);
+      await expect(response.json()).resolves.toMatchObject({ code });
+      expect(refresh).not.toHaveBeenCalled();
+      expect(fetchFn).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("logs in to KGW again when blob-gateway reports a missing session", async () => {
+    const { authFetch, fetchFn, refresh } = createTestClient("kgw_session=expired; Path=/");
+    fetchFn.mockResolvedValueOnce(
+      Response.json({ error: "session", code: "WIPE_UNAUTHORIZED" }, { status: 401 }),
+    );
+
+    await authFetch("https://blob.example/blob/v1/storage", { method: "DELETE" });
+
+    expect(refresh).toHaveBeenCalledTimes(1);
+    expect(fetchFn).toHaveBeenCalledTimes(2);
+  });
+
   it("shares one refresh across parallel auth failures", async () => {
     const { authFetch, fetchFn, refresh } = createTestClient("kgw_session=expired; Path=/");
     fetchFn
@@ -347,17 +360,7 @@ describe("createKgwAuthenticatedBlobGateway", () => {
     return new KwilActionClient(nodeKwil);
   }
 
-  it("infers UKYC authorization from an MM signer", () => {
-    const gateway = createKgwAuthenticatedBlobGateway({
-      url: "https://blob.example",
-      kwilClient: kgwSessionClient(),
-      signer: createMmTokenAuth(mmEnvelopeToken),
-    });
-
-    expect(gateway.hasAccessToken).toBe(true);
-  });
-
-  it("accepts an explicit MM authority for a non-MM signer, and none otherwise", () => {
+  it("sends a storage token only when one is given", () => {
     const kwilClient = kgwSessionClient();
     const signer = {} as KwilSigner;
 
@@ -366,7 +369,7 @@ describe("createKgwAuthenticatedBlobGateway", () => {
         url: "https://blob.example",
         kwilClient,
         signer,
-        mmAuth: createMmTokenAuth(mmEnvelopeToken),
+        accessToken: "storage-token",
       }).hasAccessToken,
     ).toBe(true);
     expect(
@@ -374,4 +377,21 @@ describe("createKgwAuthenticatedBlobGateway", () => {
         .hasAccessToken,
     ).toBe(false);
   });
+
+  it("sends the KGW cookie and the storage token on the same request", async () => {
+    const fetchFn = vi.fn<typeof fetch>(async () => new Response(null, { status: 204 }));
+    const gateway = createKgwAuthenticatedBlobGateway({
+      url: "https://blob.example",
+      kwilClient: kgwSessionClient(),
+      signer: {} as KwilSigner,
+      fetchFn,
+    }).withAccessToken("storage-token");
+
+    await gateway.deleteStorage();
+
+    const [, init] = fetchFn.mock.calls[0];
+    const headers = new Headers(init?.headers);
+    expect(headers.get("Cookie")).toBe("kgw_session=valid; Path=/");
+    expect(headers.get("Authorization")).toBe("AccessToken storage-token");
+  });
 });

package/src/create-kgw-authenticated-fetch.ts

@@ -2,9 +2,6 @@ import { type KwilSigner, NodeKwil } from "@idos-network/kwil-js";
 import { BlobGateway, type BlobGatewayParams } from "@idos-network/utils/blob-gateway";
 
 import type { KwilActionClient } from "./create-kwil-client";
-import type { MmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
-
-import { isMmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
 
 const KGW_AUTH_ERROR_CODE = -901;
 
@@ -23,10 +20,10 @@ export type CreateKgwAuthenticatedBlobGatewayParams = CreateKgwAuthenticatedFetc
   url: string;
   maxFetchBytes?: BlobGatewayParams["maxFetchBytes"];
   /**
-   * UKYC storage authority for blob requests. Defaults to `signer` when that signer
-   * is itself an MM authentication object, so the capability is never passed twice.
+   * UKYC storage token, sent as `Authorization: AccessToken <token>` next to the KGW session
+   * cookie. Only MM operators use it; `BlobGateway.withAccessToken()` swaps it per request.
    */
-  mmAuth?: MmTokenAuth;
+  accessToken?: string;
 };
 
 type KgwSessionNodeKwil = NodeKwil & {
@@ -37,16 +34,13 @@ type KgwSessionNodeKwil = NodeKwil & {
 export function createKgwAuthenticatedBlobGateway({
   url,
   maxFetchBytes,
-  mmAuth,
+  accessToken,
   ...fetchParams
 }: CreateKgwAuthenticatedBlobGatewayParams): BlobGateway {
-  const storageAuth =
-    mmAuth ?? (isMmTokenAuth(fetchParams.signer) ? fetchParams.signer : undefined);
-
   return new BlobGateway({
     url,
     maxFetchBytes,
-    accessToken: storageAuth?.accessToken,
+    accessToken,
     fetchFn: createKgwAuthenticatedFetch(fetchParams),
   });
 }
@@ -302,20 +296,22 @@ function withCookie(
   return [input, { ...init, headers }];
 }
 
-async function defaultKgwAuthFailurePredicate(response: Response): Promise<boolean> {
-  if (response.status === 401) {
-    return true;
-  }
+// blob-gateway also answers 401 for a bad UKYC storage token. A new KGW session doesn't fix that.
+const STORAGE_TOKEN_AUTH_ERROR_CODES = new Set(["MM_TOKEN_INVALID", "MM_TOKEN_EXPIRED"]);
 
+async function defaultKgwAuthFailurePredicate(response: Response): Promise<boolean> {
   const contentType = response.headers.get("content-type");
   if (!contentType?.includes("application/json")) {
-    return false;
+    return response.status === 401;
   }
 
   try {
-    const body = (await response.json()) as { error?: { code?: number } };
+    const body = (await response.json()) as { code?: unknown; error?: { code?: number } };
+    if (response.status === 401) {
+      return !(typeof body.code === "string" && STORAGE_TOKEN_AUTH_ERROR_CODES.has(body.code));
+    }
     return body.error?.code === KGW_AUTH_ERROR_CODE;
   } catch {
-    return false;
+    return response.status === 401;
   }
 }

package/src/create-kwil-client.test.ts

@@ -0,0 +1,40 @@
+import type { NodeKwil } from "@idos-network/kwil-js";
+
+import { describe, expect, it, vi } from "vitest";
+
+import { KwilActionClient, KwilCallError } from "./create-kwil-client";
+
+function clientAnswering(data: { result?: unknown[]; error?: string }) {
+  const call = vi.fn(async () => ({ status: 200, data }));
+  return new KwilActionClient({ call } as unknown as NodeKwil);
+}
+
+const params = { name: "get_user_as_mm_operator", inputs: { storage_token: "t" } } as const;
+
+describe("KwilActionClient.call", () => {
+  it("resolves to an empty result for a failed view by default", async () => {
+    const client = clientAnswering({ result: [], error: "storage token: expired" });
+
+    await expect(client.call(params)).resolves.toEqual([]);
+  });
+
+  it("throws KwilCallError with the action error when throwOnCallError is set", async () => {
+    const client = clientAnswering({ result: [], error: "storage token: expired" });
+    client.throwOnCallError = true;
+
+    const error = await client.call(params).catch((e: unknown) => e);
+
+    expect(error).toBeInstanceOf(KwilCallError);
+    expect(error).toMatchObject({
+      actionName: "get_user_as_mm_operator",
+      message: "storage token: expired",
+    });
+  });
+
+  it("returns the rows of a successful view when throwOnCallError is set", async () => {
+    const client = clientAnswering({ result: [{ id: "1" }] });
+    client.throwOnCallError = true;
+
+    await expect(client.call(params)).resolves.toEqual([{ id: "1" }]);
+  });
+});

package/src/create-kwil-client.ts

@@ -36,12 +36,33 @@ type AllKwilExecuteAction = {
 
 type KwilExecuteActionRequestParams = AllKwilExecuteAction[ActionName];
 
+/**
+ * A view action ran but failed (its `error()` or a runtime error). kwild reports that in the
+ * call response's `error` field, not as an HTTP/RPC error, so it is only thrown when
+ * `KwilActionClient.throwOnCallError` is set.
+ */
+export class KwilCallError extends Error {
+  readonly name = "KwilCallError";
+
+  constructor(
+    readonly actionName: string,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
 /**
  * A client for interacting with kwil with type-safe abstractions for `call` and `execute`.
  * Has utility methods for creating actions and setting a signer.
  */
 export class KwilActionClient {
   signer?: KwilSigner;
+  /**
+   * When true, `call` throws `KwilCallError` if the view action reports an error. When false
+   * (default) such a call resolves to its (empty) result, as it always has.
+   */
+  throwOnCallError = false;
   readonly client: NodeKwil | WebKwil;
 
   constructor(client: NodeKwil | WebKwil) {
@@ -81,6 +102,10 @@ export class KwilActionClient {
     };
 
     const response = await this.client.call(action as CallBody, signer);
+    const actionError = response?.data?.error;
+    if (this.throwOnCallError && actionError) {
+      throw new KwilCallError(params.name, actionError);
+    }
     return response?.data?.result as T;
   }
 

package/src/create-kwil-signer.test.ts

@@ -1,72 +1,7 @@
-import { base64UrlEncode, utf8Encode } from "@idos-network/utils/codecs";
-import { MemoryStore } from "@idos-network/utils/store";
 import nacl from "tweetnacl";
-import { describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 
-import type { KwilActionClient } from "./create-kwil-client";
-
-import { createClientKwilSigner, createServerKwilSigner } from "./create-kwil-signer";
-import { createMmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
-
-function mmToken(signingKeyByte: number): string {
-  return base64UrlEncode(
-    utf8Encode(
-      JSON.stringify({
-        payload: {
-          signing_public_key: base64UrlEncode(new Uint8Array(32).fill(signingKeyByte)),
-          storage_id: "storage-abc",
-        },
-        signature: base64UrlEncode(new Uint8Array(64).fill(9)),
-      }),
-    ),
-  );
-}
-
-function kwilClientWithLogout(logoutKGW: () => Promise<void>): KwilActionClient {
-  return { client: { auth: { logoutKGW } } } as unknown as KwilActionClient;
-}
-
-describe("createClientKwilSigner with MM authentication", () => {
-  it("reports the MM signing identity as address and public key", async () => {
-    const auth = createMmTokenAuth(mmToken(7));
-    const logoutKGW = vi.fn(async () => {});
-
-    const [signer, address, publicKey, walletType] = await createClientKwilSigner(
-      new MemoryStore(),
-      kwilClientWithLogout(logoutKGW),
-      auth,
-    );
-
-    expect(signer).toBe(auth);
-    expect(walletType).toBe("MM");
-    expect(address).toBe(base64UrlEncode(auth.identifier));
-    expect(publicKey).toBe(address);
-  });
-
-  it("clears the KGW session only when the MM signing identity changes", async () => {
-    const store = new MemoryStore();
-    const logoutKGW = vi.fn(async () => {});
-    const kwilClient = kwilClientWithLogout(logoutKGW);
-
-    await createClientKwilSigner(store, kwilClient, createMmTokenAuth(mmToken(7)));
-    expect(logoutKGW).toHaveBeenCalledTimes(1);
-
-    // Same identity, freshly issued token: the existing KGW cookie stays valid.
-    await createClientKwilSigner(store, kwilClient, createMmTokenAuth(mmToken(7)));
-    expect(logoutKGW).toHaveBeenCalledTimes(1);
-
-    await createClientKwilSigner(store, kwilClient, createMmTokenAuth(mmToken(8)));
-    expect(logoutKGW).toHaveBeenCalledTimes(2);
-  });
-});
-
-describe("createServerKwilSigner with MM authentication", () => {
-  it("uses the MM authentication object as the Kwil signer", async () => {
-    const auth = createMmTokenAuth(mmToken(7));
-
-    expect(await createServerKwilSigner(auth)).toEqual([auth, base64UrlEncode(auth.identifier)]);
-  });
-});
+import { createServerKwilSigner } from "./create-kwil-signer";
 
 describe("createServerKwilSigner with Nacl sign key pair", () => {
   it("emits lowercase hex SignerAddress matching kwild ed25519 @caller format", async () => {

package/src/create-kwil-signer.ts

@@ -6,15 +6,13 @@ import type { KeyPair as NearKeyPair } from "near-api-js";
 import type { KeyPair as XrpKeyPair } from "ripple-keypairs/src/types";
 
 import { KwilSigner } from "@idos-network/kwil-js";
-import { base64UrlEncode, bs58Encode, hexDecode, hexEncode } from "@idos-network/utils/codecs";
+import { bs58Encode, hexDecode, hexEncode } from "@idos-network/utils/codecs";
 import nacl from "tweetnacl";
 
 import type { WalletType } from "./actions";
 import type { KwilActionClient } from "./create-kwil-client";
-import type { MmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
 
 import { FaceSignSignerProvider } from "./facesign/facesign-signer";
-import { isMmTokenAuth } from "./mm-token/create-mm-token-kwil-signer";
 import {
   createNearWalletKwilSigner,
   implicitAddressFromPublicKey,
@@ -30,7 +28,6 @@ export type Wallet =
   | JsonRpcSigner
   | NearWallet
   | CustomKwilSigner
-  | MmTokenAuth
   | FaceSignSignerProvider;
 
 /**
@@ -111,8 +108,7 @@ export type KwilSignerType =
   | nacl.SignKeyPair
   | JsonRpcSigner
   | StellarKeypair
-  | XrpKeyPair
-  | MmTokenAuth;
+  | XrpKeyPair;
 
 export type SignerAddress = string;
 export type SignerPublicKey = string | undefined;
@@ -126,10 +122,6 @@ export type SignerPublicKey = string | undefined;
 export async function createServerKwilSigner(
   signer: KwilSignerType,
 ): Promise<[KwilSigner, SignerAddress]> {
-  if (isMmTokenAuth(signer)) {
-    return [signer, base64UrlEncode(signer.identifier)];
-  }
-
   if (isNaclSignKeyPair(signer)) {
     return [
       new KwilSigner(
@@ -247,23 +239,6 @@ export async function createClientKwilSigner(
     ];
   }
 
-  if (isMmTokenAuth(wallet)) {
-    const currentAddress = base64UrlEncode(wallet.identifier);
-    const storedAddress = await store.get<string>("signer-address");
-
-    if (storedAddress !== currentAddress) {
-      // A different MM signing identity must not re-use the previous KGW cookie.
-      store.set("signer-address", currentAddress);
-      try {
-        await kwilClient.client.auth.logoutKGW();
-      } catch (error) {
-        console.log("error logoutKGW", error);
-      }
-    }
-
-    return [wallet, currentAddress, currentAddress, "MM"];
-  }
-
   if (isCustomKwilSigner(wallet) || wallet instanceof FaceSignSignerProvider) {
     const storedAddress = await store.get<string>("signer-address");
 

package/src/index.ts

@@ -1,7 +1,6 @@
 export * from "./create-kwil-client";
 export * from "./create-kgw-authenticated-fetch";
 export * from "./create-kwil-signer";
-export * from "./mm-token/create-mm-token-kwil-signer";
 export {
   getNearFullAccessPublicKeys,
   implicitAddressFromPublicKey,

package/dist/index-Bk8YCFlx.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-Bk8YCFlx.d.mts","names":[],"sources":["../src/wait-for-kwil-tx.ts","../src/create-kwil-client.ts","../src/mm-token/create-mm-token-kwil-signer.ts","../src/create-kgw-authenticated-fetch.ts","../src/create-kwil-signer.ts","../src/near/create-near-wallet-kwil-signer.ts","../src/actions/actions.ts","../src/actions/index.ts"],"mappings":";;;;;;;;;;;;cAca,0BAA0B;WAInC;WACA;WACA;WACA;WANO;EAET,YACE,gBACA,cACA,aACA;;cAMS,+BAA+B;WAIxC;WACA;WAJO;EAET,YACE,gBACA,oBACA;IAAY;;;;;KCnBX;EACH;EACA;;KAGG,qBAAqB;KACrB,mBAAmB;KAEnB,uBACF,QAAQ;EACP,MAAM;EAEN,QAAQ,OAAO,YAAY;;KAI1B,8BAA8B,kBAAkB;KAEhD,0BACF,QAAQ,aAAa,kBAAkB;EAAU;;KAG/C,iCAAiC,qBAAqB;;;;;cAM9C;;EACX,SAAS;WACA,QAAQ,WAAW;EAE5B,YAAY,QAAQ,WAAW;;;;EAyB/B,KAAW,aACT,QAAQ,6BACR,SAAQ,yBACP,QAAQ;;;;;;;EAkBX,QACE,QAAQ,gCACR,SAAQ,wBACR,wBACC;;;;;;;;EA8BH,UAAgB,iBAAiB;EAIjC,UAAU,QAAQ;;;;;cA6BP,uBAAuB,QAAQ,2BAA2B,QAAQ;;;;cAMlE,sBAAsB,QAAQ,2BAA2B,QAAQ;;;;UCxJ7D;EACf,SAAS,iBAAiB;EAC1B;;UAGe;EACf;EACA;;;;;;;KAQU,cAAc;WACf,gBAAgB,iBAAiB;;WAEjC;;;;;WAKA;;iBAGK,cAAc,iBAAiB,SAAS;;iBAaxC,iBAAiB,QAAQ;iBAQzB,4BAA4B,QAAQ,YAAY;;;;;;;;;;;iBA2ChD,kBAAkB,0BAA0B,kBAAkB;;;;;KC3FlE,2BAA2B,UAAU,aAAa;KAElD;EACV,YAAY;EACZ,QAAQ;EACR,iBAAiB;EACjB,gBAAgB;;KAGN,0CAA0C;EACpD;EACA,gBAAgB;;;;;EAKhB,SAAS;;iBAQK,oCACd,KACA,eACA,WACG,eACF,0CAA0C;iBAY7B,8BACd,YACA,QACA,SACA,iBACC,2CAA2C;;;KC/BlC,WACR,WACA,gBACA,SACA,mBACA,cACA;UAgDa,yBAAyB;EACxC;EACA;EACA;EACA;EACA,cAAc,SAAS,wBAAwB,QAAQ;;KAqB7C,iBACR,UACA,WACA,KAAK,cACL,gBACA,UACA,YACA;KAEQ;KACA;;;;;;;iBAQU,uBACpB,QAAQ,iBACP,SAAS,YAAY;iBAoEF,uBACpB,OAAO,OACP,YAAY,kBACZ,QAAQ,WACP,SAAS,YAAY,eAAe,iBAAiB;;;iBC5FxC,6BAA6B;iBAKvB,4BACpB,uBACC;iBAmImB,gBACpB,QAAQ,QACR,iBACA,qBACC;;;cCjPU,iBAAiB,MAAM;cACvB;KAED,qBAAqB;cAEpB,kBAAkB,EAAE,QAAQ;cAC5B;KAED,kCAAkC;cAEjC,+BAA+B,EAAE,QAAQ;KAe1C;EACV;EACA,aAAa,SAAS,cAAc,SAAS,cAAc,SAAS,aAAa,SAAS;;cAG/E,cAAc,eAAe;cAylB7B,8BAA8B,EAAE;EAC3C,IAAI,EAAE;EACN,iCAAiC,EAAE;EACnC,2BAA2B,EAAE,QAAQ;;KAO3B,yBAAyB,EAAE,aAAa;;iBAG9B,kBACpB,YAAY,kBACZ,QAAQ,yBACP;cASU,uCAAuC,EAAE;EACpD,IAAI,EAAE;EACN,iCAAiC,EAAE;EACnC,2BAA2B,EAAE,QAAQ;;KAO3B,kCAAkC,EAAE,aAAa;iBAEvC,2BACpB,YAAY,kBACZ,QAAQ,kCACP;cAUU,qBAAqB,EAAE;EAClC,IAAI,EAAE;EACN,iCAAiC,EAAE;EACnC,2BAA2B,EAAE,QAAQ;;KAO3B,gBAAgB,EAAE,aAAa;iBAErB,QAAQ,YAAY,mBAAmB,QAAQ;cAYxD,8BAA8B,EAAE;EAC3C,IAAI,EAAE;;KAKI,yBAAyB,EAAE,aAAa;cAEvC,+BAA+B,EAAE;EAC5C,IAAI,EAAE;EACN,iCAAiC,EAAE;EACnC,2BAA2B,EAAE,QAAQ;EACrC,UAAU,EAAE;;KAQF,0BAA0B,EAAE,aAAa;iBAE/B,kBACpB,YAAY,kBACZ,QAAQ,yBACP,QAAQ;cAUE,mCAAmC,EAAE;EAChD,IAAI,EAAE;EACN,SAAS,EAAE;EACX,SAAS,EAAE;EACX,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE;EAC1C,aAAa,EAAE,QAAQ;EACvB,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE;EAC1C,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE;EACzC,WAAW,EAAE;;KAqBH,8BAA8B,EAAE,aAAa;;iBAGnC,uBACpB,YAAY,kBACZ,QAAQ,8BACP;cASU,6BAA6B,EAAE;EAC1C,SAAS,EAAE;EACX,aAAa,EAAE,QAAQ;EACvB,SAAS,EAAE;EACX,YAAY,EAAE;EACd,WAAW,EAAE;;KASH,wBAAwB,EAAE,aAAa;cAEtC,8BAA8B,EAAE;EAC3C,SAAS,EAAE;;KAKD,yBAAyB,EAAE,aAAa;iBAE9B,iBACpB,YAAY,kBACZ,QAAQ,wBACP,QAAQ;cAaE,sBAAsB,EAAE;EACnC,IAAI,EAAE;EACN,SAAS,EAAE;EACX,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE;EAC1C,aAAa,EAAE,QAAQ;EACvB,YAAY,EAAE;EACd,WAAW,EAAE;EACb,WAAW,EAAE;;KAWH,iBAAiB,EAAE,aAAa;iBAEtB,UACpB,YAAY,kBACZ,QAAQ,iBACP;cASU,wBAAwB,EAAE;EACrC,IAAI,EAAE;EACN,SAAS,EAAE;EACX,SAAS,EAAE;EACX,YAAY,EAAE,YAAY,EAAE;EAC5B,aAAa,EAAE,QAAQ;EACvB,SAAS,EAAE;EACX,WAAW,EAAE;EACb,UAAU,EAAE,YAAY,EAAE;;KAYhB,mBAAmB,EAAE,aAAa;iBAExB,WAAW,YAAY,mBAAmB,QAAQ;cAO3D,yBAAyB,EAAE;EACtC,IAAI,EAAE;;KAKI,oBAAoB,EAAE,aAAa;iBAEzB,aACpB,YAAY,kBACZ,QAAQ,oBACP;cASU,wCAAwC,EAAE;EACrD,YAAY,EAAE;EACd,eAAe,EAAE;EACjB,wBAAwB,EAAE;EAC1B,sBAAsB,EAAE;EACxB,aAAa,EAAE;EACf,cAAc,EAAE;EAChB,cAAc,EAAE;EAChB,cAAc,EAAE;EAChB,wBAAwB,EAAE;EAC1B,mBAAmB,EAAE;;KAcX,mCAAmC,EAAE,aACxC;;iBAIa,4BACpB,YAAY,kBACZ,QAAQ,mCACP;cASU,4BAA4B,EAAE;EACzC,IAAI,EAAE;EACN,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,aAAa,EAAE,YAAY,EAAE;EAC7B,cAAc,EAAE,YAAY,EAAE;EAC9B,wBAAwB,EAAE;EAC1B,eAAe,EAAE,YAAY,EAAE;EAC/B,aAAa,EAAE,YAAY,EAAE;EAC7B,aAAa,EAAE,YAAY,EAAE;;KAanB,uBAAuB,EAAE,aAAa;iBAE5B,eACpB,YAAY,mBACX,QAAQ;cAOE,uCAAuC,EAAE;EACpD,SAAS,EAAE;EACX,iCAAiC,EAAE,YAAY,EAAE,YAAY,EAAE;;KAMrD,kCAAkC,EAAE,aAAa;cAEhD,wCAAwC,EAAE;EACrD,IAAI,EAAE;EACN,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,sBAAsB,EAAE;EACxB,wBAAwB,EAAE;EAC1B,eAAe,EAAE,YAAY,EAAE;EAC/B,aAAa,EAAE,YAAY,EAAE;EAC7B,aAAa,EAAE,YAAY,EAAE;;KAYnB,mCAAmC,EAAE,aACxC;iBAGa,2BACpB,YAAY,kBACZ,QAAQ,kCACP,QAAQ;cAQE,oCAAoC,EAAE;EACjD,iBAAiB,EAAE;EACnB,cAAc,EAAE;;KAMN,+BAA+B,EAAE,aAAa;;;;;;iBAOpC,wBACpB,YAAY,kBACZ,QAAQ,+BACP;cASU,6BAA6B,EAAE;EAC1C,IAAI,EAAE;;KAKI,wBAAwB,EAAE,aAAa;;;;;;;iBAQ7B,iBACpB,YAAY,kBACZ,QAAQ,wBACP;cASU,oCAAoC,EAAE;EACjD,eAAe,EAAE;;KAKP,+BAA+B,EAAE,aAAa;;;;;iBAMpC,wBACpB,YAAY,kBACZ,QAAQ,+BACP;cASU,uCAAuC,EAAE;EACpD,YAAY,EAAE;EACd,SAAS,EAAE;EACX,aAAa,EAAE;EACf,cAAc,EAAE;EAChB,wBAAwB,EAAE;EAC1B,mBAAmB,EAAE;EACrB,aAAa,EAAE;EACf,cAAc,EAAE;EAChB,cAAc,EAAE;EAChB,sBAAsB,EAAE;EACxB,wBAAwB,EAAE;EAC1B,2BAA2B,EAAE;EAC7B,cAAc,EAAE;;KAiBN,kCAAkC,EAAE,aAAa;iBAEvC,2BACpB,YAAY,kBACZ,QAAQ,kCACP;cASU,8CAA8C,EAAE;EAC3D,YAAY,EAAE;EACd,wBAAwB,EAAE;EAC1B,+BAA+B,EAAE;EACjC,aAAa,EAAE;EACf,sBAAsB,EAAE;EACxB,uBAAuB,EAAE;EACzB,uBAAuB,EAAE;EACzB,iCAAiC,EAAE;EACnC,4BAA4B,EAAE;EAC9B,2BAA2B,EAAE;EAC7B,SAAS,EAAE;EACX,kBAAkB,EAAE;EACpB,mBAAmB,EAAE;EACrB,6BAA6B,EAAE;EAC/B,wBAAwB,EAAE;EAC1B,cAAc,EAAE;EAChB,WAAW,EAAE;EACb,aAAa,EAAE;EACf,uBAAuB,EAAE;EACzB,QAAQ,EAAE;EACV,2BAA2B,EAAE;EAC7B,gBAAgB,EAAE;EAClB,eAAe,EAAE;EACjB,eAAe,EAAE;;KA4BP,yCAAyC,EAAE,aAC9C;;;;;;;;;;;;;;;;;;;;;;iBAwBa,kCACpB,YAAY,kBACZ,QAAQ,yCACP;cAUU,sCAAsC,EAAE;EACnD,IAAI,EAAE;;KAKI,iCAAiC,EAAE,aAAa;cAE/C,uCAAuC,EAAE;EACpD,kBAAkB,EAAE;;KAKV,kCAAkC,EAAE,aAAa;iBAEvC,0BACpB,YAAY,kBACZ,QAAQ,iCACP,QAAQ;cAUE,+BAA+B,EAAE;EAC5C,IAAI,EAAE;;KAKI,0BAA0B,EAAE,aAAa;cAExC,gCAAgC,EAAE;EAC7C,IAAI,EAAE;EACN,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,SAAS,EAAE,YAAY,EAAE;EACzB,aAAa,EAAE,YAAY,EAAE;EAC7B,cAAc,EAAE,YAAY,EAAE;EAC9B,sBAAsB,EAAE;EACxB,wBAAwB,EAAE;EAC1B,eAAe,EAAE,YAAY,EAAE;EAC/B,aAAa,EAAE,YAAY,EAAE;;KAcnB,2BAA2B,EAAE,aAAa;iBAEhC,mBACpB,YAAY,kBACZ,QAAQ,0BACP,QAAQ;cAQE,gCAAgC,EAAE;EAC7C,IAAI,EAAE;;KAKI,2BAA2B,EAAE,aAAa;cAEzC,iCAAiC,EAAE;EAC9C,IAAI,EAAE;EACN,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,SAAS,EAAE,YAAY,EAAE;EACzB,aAAa,EAAE,YAAY,EAAE;EAC7B,cAAc,EAAE,YAAY,EAAE;EAC9B,sBAAsB,EAAE;EACxB,wBAAwB,EAAE;EAC1B,eAAe,EAAE,YAAY,EAAE;EAC/B,aAAa,EAAE,YAAY,EAAE;;KAcnB,4BAA4B,EAAE,aAAa;;iBAGjC,oBACpB,YAAY,kBACZ,QAAQ,2BACP,QAAQ;cAQE,mCAAmC,EAAE;EAChD,cAAc,EAAE;;KAKN,8BAA8B,EAAE,aAAa;cAE5C,oCAAoC,EAAE;EACjD,IAAI,EAAE;;KAKI,+BAA+B,EAAE,aAAa;iBAEpC,uBACpB,YAAY,kBACZ,QAAQ,8BACP,QAAQ;cAUE,mCAAmC,EAAE;EAChD,IAAI,EAAE;EACN,SAAS,EAAE;EACX,eAAe,EAAE;EACjB,OAAO,EAAE;;KAQC,8BAA8B,EAAE,aAAa;;iBAGnC,uBACpB,YAAY,kBACZ,QAAQ,8BACP;cASU,yBAAyB,EAAE;EACtC,IAAI,EAAE;EACN,eAAe,EAAE;EACjB,OAAO,EAAE;;KAOC,oBAAoB,EAAE,aAAa;iBAEzB,aACpB,YAAY,kBACZ,QAAQ,oBACP;cASU,2BAA2B,EAAE;EACxC,IAAI,EAAE;EACN,SAAS,EAAE;EACX,eAAe,EAAE;EACjB,OAAO,EAAE;EACT,aAAa,EAAE;;KASL,sBAAsB,EAAE,aAAa;iBAE3B,cAAc,YAAY,mBAAmB,QAAQ;cAO9D,0BAA0B,EAAE;EACvC,IAAI,EAAE;EACN,eAAe,EAAE;EACjB,OAAO,EAAE;;KAOC,qBAAqB,EAAE,aAAa;iBAE1B,cACpB,YAAY,kBACZ,QAAQ,qBACP;cASU,4BAA4B,EAAE;EACzC,IAAI,EAAE;;KAKI,uBAAuB,EAAE,aAAa;iBAE5B,gBACpB,YAAY,kBACZ,QAAQ,uBACP;cASU,2BAA2B,EAAE;EACxC,IAAI,EAAE;EACN,uBAAuB,EAAE;EACzB,eAAe,EAAE;EACjB,OAAO,EAAE;;KAQC,sBAAsB,EAAE,aAAa;iBAE3B,eACpB,YAAY,kBACZ,QAAQ,sBACP;cASU,uBAAuB,EAAE;EACpC,yBAAyB,EAAE;EAC3B,2BAA2B,EAAE;EAC7B,mBAAmB,EAAE;EACrB,IAAI,EAAE;EACN,uBAAuB,EAAE;EACzB,mBAAmB,EAAE;EACrB,kBAAkB,EAAE;;KAWV,kBAAkB,EAAE,aAAa;cAEhC,wBAAwB,EAAE;EACrC,SAAS,EAAE;;KAKD,mBAAmB,EAAE,aAAa;;;;;;;;;iBAUxB,WACpB,YAAY,kBACZ,QAAQ,kBACP,QAAQ;cAUE,8BAA8B,EAAE;EAC3C,IAAI,EAAE;;KAKI,yBAAyB,EAAE,aAAa;;iBAG9B,kBACpB,YAAY,kBACZ,QAAQ,yBACP;cASU,kCAAkC,EAAE;EAC/C,IAAI,EAAE;EACN,kBAAkB,EAAE;EACpB,8BAA8B,EAAE;EAChC,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,cAAc,EAAE,YAAY,EAAE;EAC9B,eAAe,EAAE;EACjB,aAAa,EAAE;;KAYL,6BAA6B,EAAE,aAAa;iBAElC,qBACpB,YAAY,mBACX,QAAQ;cAOE,mCAAmC,EAAE;EAChD,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE;EACvC,MAAM,EAAE;EACR,MAAM,EAAE;;KAOE,8BAA8B,EAAE,aAAa;cAE5C,oCAAoC,EAAE;EACjD,IAAI,EAAE;EACN,kBAAkB,EAAE;EACpB,8BAA8B,EAAE;EAChC,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,cAAc,EAAE,YAAY,EAAE;EAC9B,eAAe,EAAE;EACjB,aAAa,EAAE;;KAYL,+BAA+B,EAAE,aAAa;;;;;;iBAOpC,uBACpB,YAAY,kBACZ,QAAQ,8BACP,QAAQ;cAQE,wCAAwC,EAAE;EACrD,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE;;KAK7B,mCAAmC,EAAE,aACxC;cAGI,yCAAyC,EAAE;EACtD,OAAO,EAAE;;KAKC,oCAAoC,EAAE,aACzC;iBAGa,4BACpB,YAAY,kBACZ,QAAQ,mCACP,QAAQ;cAUE,kCAAkC,EAAE;EAC/C,IAAI,EAAE;;KAKI,6BAA6B,EAAE,aAAa;cAE3C,mCAAmC,EAAE;EAChD,KAAK,EAAE;;KAKG,8BAA8B,EAAE,aAAa;iBAEnC,sBACpB,YAAY,kBACZ,QAAQ,6BACP,QAAQ;cAUE,yCAAyC,EAAE;EACtD,eAAe,EAAE;;KAKP,oCAAoC,EAAE,aACzC;cAGI,0CAA0C,EAAE;EACvD,IAAI,EAAE;EACN,kBAAkB,EAAE;EACpB,8BAA8B,EAAE;EAChC,SAAS,EAAE;EACX,cAAc,EAAE;EAChB,cAAc,EAAE,YAAY,EAAE;EAC9B,eAAe,EAAE;EACjB,aAAa,EAAE;;KAYL,qCAAqC,EAAE,aAC1C;iBAGa,6BACpB,YAAY,kBACZ,QAAQ,oCACP,QAAQ;cAQE,uBAAuB,EAAE;EACpC,SAAS,EAAE;;KAKD,kBAAkB,EAAE,aAAa;cAEhC,wBAAwB,EAAE;EACrC,aAAa,EAAE;;KAKL,mBAAmB,EAAE,aAAa;;;;;iBAMxB,WACpB,YAAY,kBACZ,QAAQ,kBACP,QAAQ;cAaE,2BAA2B,EAAE;EACxC,SAAS,EAAE;;KAKD,sBAAsB,EAAE,aAAa;iBAE3B,eACpB,YAAY,kBACZ,QAAQ,sBACP;cASU,6BAA6B,EAAE;EAC1C,SAAS,EAAE;;KAKD,wBAAwB,EAAE,aAAa;cAEtC,8BAA8B,EAAE;EAC3C,UAAU,EAAE;;KAKF,yBAAyB,EAAE,aAAa;iBAE9B,iBACpB,YAAY,kBACZ,QAAQ,wBACP,QAAQ;cAUE,6BAA6B,EAAE;EAC1C,SAAS,EAAE;;KAKD,wBAAwB,EAAE,aAAa;iBAE7B,iBACpB,YAAY,kBACZ,QAAQ,wBACP;cASU,yBAAyB,EAAE;EACtC,SAAS,EAAE;EACX,OAAO,EAAE;;KAMC,oBAAoB,EAAE,aAAa;cAElC,0BAA0B,EAAE;EACvC,SAAS,EAAE;;KAKD,qBAAqB,EAAE,aAAa;iBAE1B,aACpB,YAAY,kBACZ,QAAQ,oBACP,QAAQ;cAUE,iCAAiC,EAAE;EAC9C,OAAO,EAAE;EACT,iBAAiB,EAAE;;KAMT,4BAA4B,EAAE,aAAa;cAE1C,kCAAkC,EAAE;EAC/C,gBAAgB,EAAE;;KAKR,6BAA6B,EAAE,aAAa;iBAElC,qBACpB,YAAY,kBACZ,QAAQ,4BACP,QAAQ;cAUE,8BAA8B,EAAE;EAC3C,OAAO,EAAE;;KAKC,yBAAyB,EAAE,aAAa;;iBAG9B,kBACpB,YAAY,kBACZ,QAAQ,yBACP;cASU,0BAA0B,EAAE;EACvC,eAAe,EAAE;;KAKP,qBAAqB,EAAE,aAAa;;iBAG1B,aAAa,YAAY,mBAAmB,QAAQ;iBASpD,iBAAiB,YAAY,mBAAmB;cAQzD,mCAAmC,EAAE;EAChD,QAAQ,EAAE;;KAKA,8BAA8B,EAAE,aAAa;iBAEnC,uBACpB,YAAY,kBACZ,QAAQ,8BACP;cASU,yBAAyB,EAAE;EACtC,eAAe,EAAE;;KAKP,oBAAoB,EAAE,aAAa;cAElC,0BAA0B,EAAE;EACvC,YAAY,EAAE;;KAKJ,qBAAqB,EAAE,aAAa;iBAE1B,aACpB,YAAY,kBACZ,QAAQ,oBACP,QAAQ;cAUE,6BAA6B,EAAE;EAC1C,eAAe,EAAE;;KAKP,wBAAwB,EAAE,aAAa;iBAE7B,iBACpB,YAAY,kBACZ,QAAQ,wBACP;cASU,qCAAqC,EAAE;EAClD,OAAO,EAAE;EACT,gBAAgB,EAAE;;KAMR,gCAAgC,EAAE,aAAa;iBAErC,yBACpB,YAAY,kBACZ,QAAQ,gCACP;;;KCthES,WAAW;KACX,YAAY;KACZ,iBAAiB;KACjB,yBAAyB;KACzB,oBAAoB;KACpB,aAAa;KACb,0BAA0B;KAE1B;EACV;EACA;EACA;EACA;EACA;EACA;EACA;;iBAGc,gCACd,QAAQ,0BACP;iBA0BmB,WACpB,YAAY,kBACZ,SAAS,mBACR;iBAImB,cAAc,YAAY,kBAAkB,gBAAgB;cAIrE;iBAES,UACpB,YAAY,kBACZ,SAAQ,QAAQ,+BAKf,QAAQ"}

package/src/mm-token/create-mm-token-kwil-signer.test.ts

@@ -1,148 +0,0 @@
-import { base64UrlEncode, utf8Encode } from "@idos-network/utils/codecs";
-import { describe, expect, it } from "vitest";
-
-import {
-  createMmTokenAuth,
-  isMmTokenAuth,
-  mmTokenCredentialContentUri,
-  mmTokenStorageId,
-  type MmTokenEnvelope,
-} from "./create-mm-token-kwil-signer.js";
-
-const signingPublicKeyBytes = new Uint8Array(Array.from({ length: 32 }, (_, index) => index + 1));
-const signatureBytes = new Uint8Array(Array.from({ length: 64 }, (_, index) => index + 64));
-
-function createEnvelope(overrides: Partial<MmTokenEnvelope> = {}): MmTokenEnvelope {
-  return {
-    payload: {
-      version: 1,
-      aud: ["metamask:user-storage:ukyc", "idos:kwil"],
-      signing_public_key: base64UrlEncode(signingPublicKeyBytes),
-      storage_id: "storage-abc",
-    },
-    signature: base64UrlEncode(signatureBytes),
-    ...overrides,
-  };
-}
-
-function encodeEnvelope(envelope: MmTokenEnvelope): string {
-  return base64UrlEncode(utf8Encode(JSON.stringify(envelope)));
-}
-
-async function signMessage(signer: ReturnType<typeof createMmTokenAuth>): Promise<Uint8Array> {
-  return await (signer.signer as (message: Uint8Array) => Promise<Uint8Array>)(
-    new Uint8Array([1, 2, 3]),
-  );
-}
-
-describe("createMmTokenAuth", () => {
-  it("uses mm_token auth type and decoded signing_public_key bytes as identity", () => {
-    const signer = createMmTokenAuth(encodeEnvelope(createEnvelope()));
-
-    expect(signer.signatureType).toBe("mm_token");
-    expect(signer.identifier).toEqual(signingPublicKeyBytes);
-  });
-
-  it("returns the exact encoded envelope bytes from signMessage", async () => {
-    const encoded = encodeEnvelope(createEnvelope());
-    const signer = createMmTokenAuth(encoded);
-
-    expect(await signMessage(signer)).toEqual(utf8Encode(encoded));
-  });
-
-  it("accepts a decoded envelope object and returns its encoded form", async () => {
-    const envelope = createEnvelope();
-    const signer = createMmTokenAuth(envelope);
-
-    expect(await signMessage(signer)).toEqual(utf8Encode(encodeEnvelope(envelope)));
-  });
-
-  it("rejects raw JSON envelope strings (must be base64url-encoded)", () => {
-    expect(() => createMmTokenAuth(JSON.stringify(createEnvelope()))).toThrow(
-      "Invalid mm_token envelope encoding",
-    );
-  });
-
-  it("rejects invalid signature length", () => {
-    expect(() =>
-      createMmTokenAuth(
-        encodeEnvelope(createEnvelope({ signature: base64UrlEncode(new Uint8Array(63)) })),
-      ),
-    ).toThrow("Invalid mm_token signature length: expected 64, got 63");
-  });
-
-  it("rejects signing_public_key with the wrong byte length", () => {
-    expect(() =>
-      createMmTokenAuth(
-        encodeEnvelope(
-          createEnvelope({
-            payload: {
-              version: 1,
-              signing_public_key: base64UrlEncode(new Uint8Array(31)),
-            },
-          }),
-        ),
-      ),
-    ).toThrow("Invalid mm_token signing_public_key length: expected 32, got 31");
-  });
-
-  it("carries the exact encoded capability as a non-enumerable access token", () => {
-    const encoded = encodeEnvelope(createEnvelope());
-    const auth = createMmTokenAuth(encoded);
-
-    expect(auth.accessToken).toBe(encoded);
-    expect(isMmTokenAuth(auth)).toBe(true);
-    // Blob authorization must not leak through logging or serialization.
-    expect(Object.keys(auth)).not.toContain("accessToken");
-    expect(JSON.stringify(auth)).not.toContain(encoded);
-  });
-
-  it("re-encodes a decoded envelope object into the access token", () => {
-    const envelope = createEnvelope();
-
-    expect(createMmTokenAuth(envelope).accessToken).toBe(encodeEnvelope(envelope));
-  });
-
-  it("does not recognize a non-MM signer as MM authentication", () => {
-    expect(isMmTokenAuth({ identifier: "a", signer: () => {}, signatureType: "ed25519" })).toBe(
-      false,
-    );
-  });
-
-  it("keeps the token payload and exposes its storage_id", () => {
-    const signer = createMmTokenAuth(encodeEnvelope(createEnvelope()));
-
-    expect(signer.mmTokenPayload.storage_id).toBe("storage-abc");
-    expect(mmTokenStorageId(signer)).toBe("storage-abc");
-  });
-
-  it("builds the credential ukyc:// URI from a base64url-encoded token", () => {
-    const credentialId = "0198c21d-79cb-7000-8000-000000000001";
-    const encodedToken = encodeEnvelope(createEnvelope());
-    const signer = createMmTokenAuth(encodedToken);
-    const credential = {
-      id: credentialId,
-      content_uri: mmTokenCredentialContentUri(signer, credentialId),
-    };
-
-    expect(credential).toEqual({
-      id: credentialId,
-      content_uri: `ukyc://storage-abc/blobs/${credentialId}`,
-    });
-  });
-
-  it("fails when the token payload has no storage_id", () => {
-    const signer = createMmTokenAuth(
-      encodeEnvelope(
-        createEnvelope({
-          payload: {
-            version: 1,
-            signing_public_key: base64UrlEncode(signingPublicKeyBytes),
-          },
-        }),
-      ),
-    );
-
-    expect(() => mmTokenStorageId(signer)).toThrow("mm_token payload is missing storage_id");
-  });
-});