@le-space/orbitdb-identity-provider-webauthn-did 0.2.12 → 0.3.0

package/README.md

@@ -39,7 +39,7 @@ Note: WebAuthn varsig support in this repo relies on our forked `@le-space/iso-*
 npm install @le-space/orbitdb-identity-provider-webauthn-did
 ```
 
-Note: `@orbitdb/core` is patched (via `patch-package`) to support Ed25519 keystore keys.
+Note: Ed25519 keystore DIDs are handled without patching OrbitDB. The provider generates the requested libp2p key type and stores it through OrbitDB's public keystore API.
 
 ## WebAuthn Configuration
 
@@ -186,7 +186,7 @@ sequenceDiagram
   Auth-->>WebAuthn: Attestation
   WebAuthn-->>App: Credential
 
-  App->>KS: getKey()/createKey(Ed25519)
+  App->>KS: getKey() or add generated Ed25519 key
   KS-->>App: Keystore keypair
 
   opt encryptKeystore=true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/orbitdb-identity-provider-webauthn-did",
-  "version": "0.2.12",
+  "version": "0.3.0",
   "description": "WebAuthn-based DID identity provider for OrbitDB for hardware-secured wallets and biometric Passkey authentication",
   "main": "src/index.js",
   "type": "module",
@@ -10,7 +10,6 @@
     "./standalone": "./src/standalone/index.js"
   },
   "scripts": {
-    "postinstall": "patch-package",
     "test": "npm run test:all",
     "test:all": "playwright test",
     "test:headed": "playwright test tests/webauthn-focused.test.js --headed --project=chromium",
@@ -59,14 +58,14 @@
   },
   "homepage": "https://github.com/le-space/orbitdb-identity-provider-webauthn-did#readme",
   "peerDependencies": {
-    "@orbitdb/core": "^3.0.0"
+    "@orbitdb/core": "^4.0.0"
   },
   "dependencies": {
     "@ipld/dag-ucan": "^3.4.3",
-    "@ipld/dag-cbor": "^9.2.5",
+    "@ipld/dag-cbor": "^10.0.1",
     "@le-space/ucanto-principal": "^9.1.2",
-    "@libp2p/logger": "^5.1.5",
-    "@libp2p/crypto": "^5.1.8",
+    "@libp2p/logger": "^6.2.9",
+    "@libp2p/crypto": "^5.1.20",
     "@simplewebauthn/browser": "^13.0.0",
     "cbor-web": "^9.0.1",
     "iso-base": "npm:@le-space/iso-base",
@@ -74,17 +73,28 @@
     "iso-passkeys": "npm:@le-space/iso-passkeys",
     "iso-web": "^2.1.0",
     "iso-webauthn-varsig": "npm:@le-space/iso-webauthn-varsig",
-    "multiformats": "^13.0.0",
-    "patch-package": "^8.0.1",
+    "multiformats": "^14.0.0",
     "vite-plugin-node-polyfills": "^0.24.0"
   },
   "devDependencies": {
-    "@orbitdb/core": "^3.0.0",
+    "@chainsafe/libp2p-noise": "^17.0.0",
+    "@chainsafe/libp2p-yamux": "^8.0.1",
+    "@helia/bitswap": "^4.0.1",
+    "@helia/http": "^4.0.1",
+    "@helia/libp2p": "^1.0.1",
+    "@ipld/dag-json": "^11.0.0",
+    "@libp2p/gossipsub": "^16.0.3",
+    "@libp2p/identify": "^4.1.8",
+    "@libp2p/websockets": "^10.1.15",
+    "@orbitdb/core": "^4.0.0",
+    "@orbitdb/simple-encryption": "^0.0.2",
     "@playwright/test": "^1.55.0",
+    "blockstore-level": "^4.0.1",
     "chai": "^5.0.0",
+    "datastore-level": "^13.0.1",
     "eslint": "^9.0.0",
-    "helia": "^5.0.0",
-    "libp2p": "^2.0.0",
+    "helia": "^7.0.1",
+    "libp2p": "^3.3.4",
     "mocha": "^10.0.0"
   },
   "engines": {

package/src/keystore/provider.js

@@ -4,6 +4,8 @@
 
 import { logger } from '@libp2p/logger';
 import { generateKeyPair } from '@libp2p/crypto/keys';
+import { varint } from 'multiformats';
+import { base58btc } from 'multiformats/bases/base58';
 import * as KeystoreEncryption from './encryption.js';
 import { WebAuthnDIDProvider } from '../webauthn/provider.js';
 
@@ -119,11 +121,6 @@ export class OrbitDBWebAuthnIdentityProvider {
     }
 
     try {
-      // Import multiformats modules
-      const multiformats = await import('multiformats');
-      const varint = multiformats.varint;
-      const { base58btc } = await import('multiformats/bases/base58');
-
       if (this.encryptKeystore) {
         const encryptedData = this.unlockedKeypair
           ? {
@@ -157,10 +154,12 @@ export class OrbitDBWebAuthnIdentityProvider {
           identityId.substring(0, 32) + '...',
           this.keystoreKeyType
         );
-        keystoreKey = await this.keystore.createKey(
-          identityId,
-          this.keystoreKeyType
-        );
+        const keyType =
+          this.keystoreKeyType === 'secp256k1' ? 'secp256k1' : 'Ed25519';
+        keystoreKey = await generateKeyPair(keyType);
+        await this.keystore.addKey(identityId, {
+          privateKey: keystoreKey.raw,
+        });
       }
 
       identityLog(

package/src/varsig/identity.js

@@ -17,6 +17,31 @@ const IDENTITY_CODEC = dagCbor;
 const IDENTITY_HASHER = sha256;
 const IDENTITY_HASH_ENCODING = base58btc;
 
+/**
+ * OrbitDB KeyStore verifyMessage expects signature and publicKey as base16 strings.
+ * Replicated oplog entries often carry Uint8Arrays; passing those through makes
+ * verifySignature() fail silently (see @orbitdb/core keystore). This affects the
+ * main database log and nested access-controller manifest DBs alike.
+ *
+ * @param {Uint8Array|string} value
+ * @returns {string|Uint8Array}
+ */
+function toOrbitDbBase16KeyMaterial(value) {
+  if (value instanceof Uint8Array) {
+    let hex = '';
+    for (let i = 0; i < value.length; i++) {
+      hex += value[i].toString(16).padStart(2, '0');
+    }
+    return hex;
+  }
+  if (ArrayBuffer.isView(value) && !(value instanceof Uint8Array)) {
+    return toOrbitDbBase16KeyMaterial(
+      new Uint8Array(value.buffer, value.byteOffset, value.byteLength)
+    );
+  }
+  return value;
+}
+
 /**
  * Encode an identity value as CBOR and compute its CID hash.
  * @param {Object} value - Identity payload.
@@ -115,7 +140,11 @@ async function verifyOplogSignatureHybrid(
   if (varsigOk) return true;
   if (fallbackIdentities && typeof fallbackIdentities.verify === 'function') {
     try {
-      return await fallbackIdentities.verify(signature, publicKey, data);
+      return await fallbackIdentities.verify(
+        toOrbitDbBase16KeyMaterial(signature),
+        toOrbitDbBase16KeyMaterial(publicKey),
+        data
+      );
     } catch {
       return false;
     }
@@ -352,15 +381,19 @@ export function wrapWithVarsigVerification(
 
   // Hybrid verify: tries default keystore verification, then varsig verification
   const hybridVerify = async (signature, publicKey, data) => {
-    // Try default keystore verification first
+    // Try default keystore verification (Uint8Array -> base16 for OrbitDB keystore)
     try {
-      const result = await defaultIdentities.verify(signature, publicKey, data);
+      const result = await defaultIdentities.verify(
+        toOrbitDbBase16KeyMaterial(signature),
+        toOrbitDbBase16KeyMaterial(publicKey),
+        data
+      );
       if (result) return true;
     } catch {
       // Default verification failed, try varsig
     }
 
-    // Try varsig verification (varsig uses Uint8Array public keys)
+    // Try varsig verification (raw bytes; varsig envelope decode)
     if (publicKey instanceof Uint8Array) {
       try {
         return await verifyVarsigForPayload(

package/src/webauthn/provider.js

@@ -6,6 +6,8 @@
  */
 
 import { logger } from '@libp2p/logger';
+import { varint } from 'multiformats';
+import { base58btc } from 'multiformats/bases/base58';
 import * as KeystoreEncryption from '../keystore/encryption.js';
 import {
   buildAuthenticatorSelection,
@@ -341,11 +343,6 @@ export class WebAuthnDIDProvider {
    */
   static async createDID(credentialInfo) {
     try {
-      // Import multiformats modules with correct exports
-      const multiformats = await import('multiformats');
-      const varint = multiformats.varint;
-      const { base58btc } = await import('multiformats/bases/base58');
-
       // Extract public key coordinates
       const { x, y } = credentialInfo.publicKey;