@joclaim/attestor-core 0.2.0 → 0.2.3

package/src/types/signatures.ts

@@ -1,29 +0,0 @@
-export type PrivateKey = string
-
-type Awaitable<T> = T | Promise<T>
-
-export type ServiceSignatureProvider = {
-	/**
-	 * Returns public key in compressed (compact) format used in Joclaim RPC calls
-	 * @param privateKey corresponding private key in raw o hex form
-	 */
-	getPublicKey(privateKey: PrivateKey): Uint8Array
-	/**
-	 * Returns address corresponding to the provided public key
-	 * @param publicKey raw o hex form, compressed or uncompressed
-	 */
-	getAddress(publicKey: Uint8Array): string
-	/**
-	 * Signs data with the provided private key
-	 * @param data raw data to be signed
-	 * @param privateKey private key in raw or hex format
-	 */
-	sign(data: Uint8Array, privateKey: PrivateKey): Awaitable<Uint8Array>
-	/**
-	 * Verifies signature against provided data and an address
-	 * @param data raw data to be verified. Must be same as used in sign() call
-	 * @param signature signature bytes or string
-	 * @param addressBytes address corresponding to a public key
-	 */
-	verify(data: Uint8Array, signature: Uint8Array | string, addressBytes: Uint8Array | string): Awaitable<boolean>
-}

package/src/types/tunnel.ts

@@ -1,25 +0,0 @@
-import type { CreateTunnelRequest } from '#src/proto/api.ts'
-
-export type MakeTunnelBaseOpts<O> = O & {
-	onClose?(err?: Error): void
-	onMessage?(data: Uint8Array): void
-}
-
-export type Tunnel<E> = E & {
-	write(data: Uint8Array): void | Promise<void>
-	close(err?: Error): void | Promise<void>
-}
-
-export type MakeTunnelFn<O, E = {}> = (opts: MakeTunnelBaseOpts<O>) => (
-	Tunnel<E> | Promise<Tunnel<E>>
-)
-
-export type Transcript<T> = {
-	sender: 'client' | 'server'
-	message: T
-}[]
-
-export type TCPSocketProperties = {
-	transcript: Transcript<Uint8Array>
-	createRequest: Pick<CreateTunnelRequest, 'host' | 'port' | 'geoLocation' | 'proxySessionId'>
-}

package/src/types/zk.ts

@@ -1,31 +0,0 @@
-import type { EncryptionAlgorithm, OPRFOperator, ZKEngine, ZKOperator } from '@joclaim/zk-symmetric-crypto'
-
-import type { TOPRFPayload } from '#src/proto/api.ts'
-
-export type ZKOperators = { [E in EncryptionAlgorithm]?: ZKOperator }
-
-export type OPRFOperators = { [E in EncryptionAlgorithm]?: OPRFOperator }
-
-export type PrepareZKProofsBaseOpts = {
-	/** get ZK operator for specified algorithm */
-	zkOperators?: ZKOperators
-
-	oprfOperators?: OPRFOperators
-	/**
-	 * max number of ZK proofs to generate concurrently
-	 * @default 10
-	 */
-	zkProofConcurrency?: number
-	zkEngine?: ZKEngine
-}
-
-export type TOPRFProofParams = TOPRFPayload & {
-	mask: Uint8Array
-	plaintext: Uint8Array
-
-	overshoot?: {
-		ciphertext: Uint8Array
-		iv: Uint8Array
-		recordNumber: number
-	}
-}

package/src/utils/auth.ts

@@ -1,92 +0,0 @@
-import { ethers } from 'ethers'
-
-import { DEFAULT_AUTH_EXPIRY_S } from '#src/config/index.ts'
-import type { AuthenticationRequest, ServiceSignatureType } from '#src/proto/api.ts'
-import { AuthenticatedUserData } from '#src/proto/api.ts'
-import { getEnvVariable } from '#src/utils/env.ts'
-import { AttestorError } from '#src/utils/error.ts'
-import { unixTimestampSeconds } from '#src/utils/generics.ts'
-import { SelectedServiceSignature, SIGNATURES } from '#src/utils/signatures/index.ts'
-
-export async function assertValidAuthRequest(
-	request: AuthenticationRequest | undefined,
-	signatureType: ServiceSignatureType
-) {
-	const publicKey = getEnvVariable('AUTHENTICATION_PUBLIC_KEY')
-	// nothing to verify
-	if(!request) {
-		// if pub key is provided -- but user didn't attempt to
-		// authenticate, then we should throw an error
-		if(publicKey) {
-			throw new AttestorError(
-				'ERROR_AUTHENTICATION_FAILED',
-				'User must be authenticated'
-			)
-		}
-
-		return
-	}
-
-	if(!publicKey) {
-		throw new AttestorError(
-			'ERROR_BAD_REQUEST',
-			'The attestor is not configured for authentication'
-		)
-	}
-
-	const { signature, data } = request
-	if(!data) {
-		throw new AttestorError(
-			'ERROR_AUTHENTICATION_FAILED',
-			'Missing data in auth request'
-		)
-	}
-
-	if(data.expiresAt < unixTimestampSeconds()) {
-		throw new AttestorError(
-			'ERROR_AUTHENTICATION_FAILED',
-			'Authentication request has expired'
-		)
-	}
-
-	const proto = AuthenticatedUserData.encode(data).finish()
-	const signatureAlg = SIGNATURES[signatureType]
-	const address = signatureAlg.getAddress(
-		await ethers.utils.arrayify(publicKey)
-	)
-	const verified = await signatureAlg
-		.verify(proto, signature, address)
-	if(!verified) {
-		throw new AttestorError(
-			'ERROR_AUTHENTICATION_FAILED',
-			'Signature verification failed'
-		)
-	}
-}
-
-/**
- * Create an authentication request with the given data and private key,
- * which can then be used to authenticate with the service.
- */
-export async function createAuthRequest(
-	_data: Partial<AuthenticatedUserData>,
-	privateKey: string
-) {
-	const createdAt = unixTimestampSeconds()
-	const data: AuthenticatedUserData = {
-		createdAt,
-		expiresAt: createdAt + DEFAULT_AUTH_EXPIRY_S,
-		id: '',
-		hostWhitelist: [],
-		..._data,
-	}
-	const proto = AuthenticatedUserData.encode(data).finish()
-	const signature = await SelectedServiceSignature
-		.sign(proto, privateKey)
-	const request: AuthenticationRequest = {
-		data,
-		signature
-	}
-
-	return request
-}

package/src/utils/b64-json.ts

@@ -1,25 +0,0 @@
-import { utils } from 'ethers'
-
-export const B64_JSON_REPLACER = (key: string, value: any) => {
-	if(
-		value instanceof Uint8Array
-		|| (
-			typeof value === 'object'
-			&& value
-			&& 'buffer' in value
-			&& value.buffer instanceof ArrayBuffer
-		)
-	) {
-		return { type: 'uint8array', value: utils.base64.encode(value) }
-	}
-
-	return value
-}
-
-export const B64_JSON_REVIVER = (key: string, value: any) => {
-	if(value?.type === 'uint8array') {
-		return utils.base64.decode(value.value)
-	}
-
-	return value
-}

package/src/utils/bgp-listener.ts

@@ -1,159 +0,0 @@
-import CIDR from 'ip-cidr'
-import type { Logger } from 'pino'
-
-import { BGP_WS_URL } from '#src/config/index.ts'
-import type { BGPAnnouncementOverlapData, BGPListener } from '#src/types/index.ts'
-import { makeWebSocket } from '#src/utils/ws.ts'
-
-const ANNOUNCEMENT_OVERLAP = 'announcement-overlap'
-
-class BGPAnnouncementOverlapEvent extends Event {
-
-	readonly data: BGPAnnouncementOverlapData
-
-	constructor(data: BGPAnnouncementOverlapData) {
-		super(ANNOUNCEMENT_OVERLAP)
-		this.data = data
-	}
-}
-
-/**
- * Listens for BGP announcements and emits events whenever
- * an announcement overlaps with a target IP.
- */
-export function createBgpListener(logger: Logger): BGPListener {
-	let ws: ReturnType<typeof makeWebSocket>
-	let closed = false
-
-	const targetIps = new Set<string>()
-	const eventTarget = new EventTarget()
-
-	openWs()
-
-	return {
-		onOverlap(ips, callback) {
-			for(const ip of ips) {
-				targetIps.add(ip)
-			}
-
-			eventTarget.addEventListener(
-				ANNOUNCEMENT_OVERLAP,
-				_callback
-			)
-
-			return () => {
-				for(const ip of ips) {
-					targetIps.delete(ip)
-				}
-
-				eventTarget.removeEventListener(
-					ANNOUNCEMENT_OVERLAP,
-					_callback
-				)
-			}
-
-			function _callback(event: BGPAnnouncementOverlapEvent) {
-				callback(event.data)
-			}
-		},
-		close() {
-			ws.onclose = null
-			ws.onerror = null
-			ws.close()
-			closed = true
-		}
-	}
-
-	function openWs() {
-		logger.debug('connecting to BGP websocket')
-
-		ws = makeWebSocket(BGP_WS_URL)
-		ws.onopen = onOpen
-		ws.onerror = (ev) => onClose(ev)
-		ws.onclose = () => onClose(new Error('Unexpected close'))
-		ws.onmessage = ({ data }) => {
-			const str = typeof data === 'string' ? data : data.toString()
-			try {
-				onMessage(str)
-			} catch(err) {
-				logger.error({ data, err }, 'error processing BGP message')
-			}
-		}
-	}
-
-	function onOpen(): void {
-		const subscriptionMessage = {
-			type: 'ris_subscribe',
-			data: {
-				type: 'UPDATE',
-			},
-		}
-		ws.send(JSON.stringify(subscriptionMessage))
-
-		logger.info('connected to BGP websocket')
-	}
-
-	function onClose(err?: Error | Event) {
-		if(closed) {
-			return
-		}
-
-		logger.info({ err }, 'BGP websocket closed')
-		if(!err) {
-			return
-		}
-
-		logger.info('reconnecting to BGP websocket')
-		openWs()
-	}
-
-	function onMessage(message: string): void {
-		const data = JSON.parse(message)
-		const announcements = data?.data?.announcements
-
-		logger.trace({ data }, 'got BGP update')
-
-		if(!Array.isArray(announcements)) {
-			return
-		}
-
-		const asPath = data?.data?.path
-
-		for(const announcement of announcements) {
-			const prefixes = announcement?.prefixes
-			const nextHop = announcement?.['next_hop']
-
-			const hasPrefixes = prefixes?.length && (nextHop || asPath)
-			if(!hasPrefixes) {
-				return
-			}
-
-			for(const prefix of prefixes) {
-				if(!overlapsTargetIps(prefix)) {
-					continue
-				}
-
-				// emit event
-				eventTarget.dispatchEvent(
-					new BGPAnnouncementOverlapEvent({ prefix })
-				)
-			}
-		}
-	}
-
-	function overlapsTargetIps(prefix: string): boolean {
-		// ignore all prefixes that end with /0
-		if(prefix.endsWith('/0')) {
-			return false
-		}
-
-		const cidr = new CIDR(prefix)
-		for(const ip of targetIps) {
-			if(cidr.contains(ip)) {
-				return true
-			}
-		}
-
-		return false
-	}
-}

package/src/utils/claims.ts

@@ -1,132 +0,0 @@
-import canonicalize from 'canonicalize'
-import { utils } from 'ethers'
-
-import { DEFAULT_METADATA } from '#src/config/index.ts'
-import { ClaimTunnelResponse } from '#src/proto/api.ts'
-import type { ClaimID, ClaimInfo, CompleteClaimData, ProviderParams } from '#src/types/index.ts'
-import { SIGNATURES, strToUint8Array } from '#src/utils/index.ts'
-
-/**
- * Creates the standard string to sign for a claim.
- * This data is what the attestor will sign when it successfully
- * verifies a claim.
- */
-export function createSignDataForClaim(data: CompleteClaimData) {
-	const identifier = 'identifier' in data
-		? data.identifier
-		: getIdentifierFromClaimInfo(data)
-	const lines = [
-		identifier,
-		// we lowercase the owner to ensure that the
-		// ETH addresses always serialize the same way
-		data.owner.toLowerCase(),
-		data.timestampS.toString(),
-		data.epoch.toString(),
-	]
-
-	return lines.join('\n')
-}
-
-/**
- * Verify the claim tunnel response from a attestor.
- *
- * If you'd only like to verify the claim signature, you can
- * optionally only pass "claim" & "signatures.claimSignature"
- * to this function.
- *
- * The successful run of this function means that the claim
- * is valid, and the attestor that signed the claim is valid.
- */
-export async function assertValidClaimSignatures(
-	{
-		signatures,
-		...res
-	}: Partial<ClaimTunnelResponse>,
-	metadata = DEFAULT_METADATA
-) {
-	if(!signatures) {
-		throw new Error('No signatures provided')
-	}
-
-	const {
-		resultSignature,
-		claimSignature,
-		attestorAddress
-	} = signatures
-
-	const { verify } = SIGNATURES[metadata.signatureType]
-	if(signatures?.resultSignature) {
-		const resBytes = ClaimTunnelResponse
-			.encode(ClaimTunnelResponse.create(res)).finish()
-		const verified
-			= await verify(resBytes, resultSignature, attestorAddress)
-		if(!verified) {
-			throw new Error('Invalid result signature')
-		}
-	}
-
-	// claim wasn't generated -- i.e. the transcript
-	// did not contain the necessary data
-	if(!res.claim) {
-		return
-	}
-
-	const signData = createSignDataForClaim(res.claim)
-	const verifiedClaim = await verify(
-		strToUint8Array(signData),
-		claimSignature,
-		attestorAddress
-	)
-	if(!verifiedClaim) {
-		throw new Error('Invalid claim signature')
-	}
-}
-
-/**
- * Generates a unique identifier for given claim info
- * @param info
- * @returns
- */
-export function getIdentifierFromClaimInfo(info: ClaimInfo): ClaimID {
-	//re-canonicalize context if it's not empty
-	if(info.context?.length > 0) {
-		try {
-			const ctx = JSON.parse(info.context)
-			info.context = canonicalStringify(ctx)!
-		} catch(e) {
-			throw new Error('unable to parse non-empty context. Must be JSON')
-		}
-	}
-
-	const str = `${info.provider}\n${info.parameters}\n${info.context || ''}`
-	//console.log('Identifier: ' + btoa(str))
-	return utils.keccak256(strToUint8Array(str)).toLowerCase()
-}
-
-/**
- * Canonically stringifies an object, so that the same object will always
- * produce the same string despite the order of keys
- */
-export function canonicalStringify(params: { [key: string]: any } | undefined) {
-	if(!params) {
-		return ''
-	}
-
-	// have to cast as ESM isn't correctly typing this
-	return (canonicalize as unknown as ((p: unknown) => string))(params) || ''
-}
-
-export function hashProviderParams(params: ProviderParams<'http'>): string {
-	const filteredParams = {
-		url:params.url,
-		method:params.method,
-		body: params.body,
-		responseMatches: params.responseMatches,
-		responseRedactions: params.responseRedactions
-	}
-
-	const serializedParams = canonicalStringify(filteredParams)
-	return utils.keccak256(
-		strToUint8Array(serializedParams)
-	).toLowerCase()
-}

package/src/utils/env.ts

@@ -1,21 +0,0 @@
-export type TransportType = 'node' | 'react-native' | 'browser'
-
-export function detectEnvironment(): TransportType {
-	if(typeof navigator !== 'undefined' && navigator.product === 'ReactNative') {
-		return 'react-native'
-	}
-
-	if(typeof window !== 'undefined') {
-		return 'browser'
-	}
-
-	return 'node'
-}
-
-export function getEnvVariable(name: string) {
-	if(typeof process === 'undefined') {
-		return undefined
-	}
-
-	return process?.env[name]
-}

package/src/utils/error.ts

@@ -1,76 +0,0 @@
-import { ErrorCode, ErrorData } from '#src/proto/api.ts'
-
-const PROTO_ERROR = ErrorData.fromJSON({})
-
-/**
- * Represents an error that can be thrown by the Attestor Core
- * or server. Provides a code, and optional data
- * to pass along with the error.
- */
-export class AttestorError extends Error {
-
-	readonly name = 'AttestorError'
-	readonly code: keyof typeof ErrorCode
-	readonly data: { [_: string]: any } | undefined
-
-	constructor(
-		code: keyof typeof ErrorCode,
-		message: string,
-		data?: { [_: string]: any }
-	) {
-		super(message)
-		this.code = code
-		this.data = data
-	}
-
-	/**
-	 * Encodes the error as a ErrorData
-	 * protobuf message
-	 */
-	toProto() {
-		return ErrorData.create({
-			code: ErrorCode[this.code],
-			message: this.message,
-			data: JSON.stringify(this.data)
-		})
-	}
-
-	static fromProto(data = PROTO_ERROR) {
-		return new AttestorError(
-			typeof data.code === 'number'
-				? getKeyForValue(ErrorCode, data.code) || 'UNRECOGNIZED'
-				: data.code,
-			data.message,
-			data.data ? JSON.parse(data.data) : undefined
-		)
-	}
-
-	static fromError(
-		err: Error,
-		code: keyof typeof ErrorCode = 'ERROR_INTERNAL'
-	) {
-		if(err instanceof AttestorError) {
-			return err
-		}
-
-		return new AttestorError(code, err.message)
-	}
-
-	static badRequest(message: string, data?: { [_: string]: any }) {
-		return new AttestorError(
-			'ERROR_BAD_REQUEST',
-			message,
-			data
-		)
-	}
-}
-
-function getKeyForValue<T>(obj: T, value: T[keyof T]): keyof T | undefined {
-	for(const key in obj) {
-		if(obj[key] === value) {
-			return key as keyof T
-		}
-	}
-
-	return undefined
-}