@ledgerhq/revault-sdk 0.22.10 → 0.23.0

package/lib/engine.cjs

@@ -15,7 +15,7 @@ var _chunkLH4QQXUHcjs = require('./chunk-LH4QQXUH.cjs');
 
 
 
-var _chunk2HKHCIKXcjs = require('./chunk-2HKHCIKX.cjs');
+var _chunk4ZXMEPRBcjs = require('./chunk-4ZXMEPRB.cjs');
 
 // src/engine/index.ts
 var _invariant = require('invariant'); var _invariant2 = _interopRequireDefault(_invariant);
@@ -25,9 +25,6 @@ var _errors = require('@ledgerhq/errors');
 
 var _rxjs = require('rxjs');
 var MAX_CHUNK_LENGTH = 250;
-var FIXME_NOT_IMPLEMENTED = (fnName) => async () => {
-  throw new Error(`Not implemented: ${fnName}`);
-};
 var getPathFromPathString = (pathString) => {
   const parts = pathString.split("'/").map((part) => Number.parseInt(part, 10));
   return parts.map((part) => (part | 2147483648) >>> 0);
@@ -39,7 +36,7 @@ var splitChunks = (chunk, buffer) => {
   }
   return chunks;
 };
-var removeStatus = (result) => result.slice(0, result.length - _chunk2HKHCIKXcjs.STATUS_LENGTH);
+var removeStatus = (result) => result.slice(0, result.length - _chunk4ZXMEPRBcjs.STATUS_LENGTH);
 var sendByChunk = async (transport, command, data, chunkSize = MAX_CHUNK_LENGTH) => {
   const chunks = splitChunks(chunkSize, data);
   let response = Buffer.from([]);
@@ -49,7 +46,7 @@ var sendByChunk = async (transport, command, data, chunkSize = MAX_CHUNK_LENGTH)
     apdu[2] = i && 128;
     response = await transport.send(apdu[0], apdu[1], apdu[2], apdu[3], chunk, [
       36864,
-      ..._chunk2HKHCIKXcjs.PAGINATED_STATUS
+      ..._chunk4ZXMEPRBcjs.PAGINATED_STATUS
     ]);
   }
   return response;
@@ -92,7 +89,7 @@ var buildAttestation = (params) => {
 };
 var genericRetryOnError = (err) => {
   if (err instanceof _errors.LockedDeviceError) return true;
-  if (_chunk2HKHCIKXcjs.isTransportStatusError.call(void 0, err) && err.statusCode === 27913) return true;
+  if (_chunk4ZXMEPRBcjs.isTransportStatusError.call(void 0, err) && err.statusCode === 27913) return true;
   if (err instanceof _errors.DisconnectedDevice) return true;
   return false;
 };
@@ -100,7 +97,7 @@ function createRealDevice(options, logger) {
   const { transportId } = options;
   async function run(job, retryOnError = genericRetryOnError) {
     return _rxjs.lastValueFrom.call(void 0, 
-      _chunk2HKHCIKXcjs.withDevicePolling.call(void 0, transportId)((transport) => _rxjs.from.call(void 0, job(transport)), retryOnError)
+      _chunk4ZXMEPRBcjs.withDevicePolling.call(void 0, transportId)((transport) => _rxjs.from.call(void 0, job(transport)), retryOnError)
     );
   }
   const noRetry = () => false;
@@ -113,10 +110,10 @@ function createRealDevice(options, logger) {
       _nullishCoalesce(opts.retryOnError, () => ( alwaysRetry))
     );
     try {
-      await getPublicKey(_chunk2HKHCIKXcjs.PATHS.U2F, { secp256k1: true, retryOnError: noRetry });
+      await getPublicKey(_chunk4ZXMEPRBcjs.PATHS.U2F, { secp256k1: true, retryOnError: noRetry });
       return { isAppOpened: true };
     } catch (err) {
-      if (_chunk2HKHCIKXcjs.isTransportStatusError.call(void 0, err) && genericRetryOnError(err)) {
+      if (_chunk4ZXMEPRBcjs.isTransportStatusError.call(void 0, err) && genericRetryOnError(err)) {
         return { isAppOpened: false };
       }
       throw err;
@@ -147,18 +144,18 @@ function createRealDevice(options, logger) {
     );
     const pubKeyLength = response.readInt8(0);
     const pubKey = response.slice(1, pubKeyLength + 1).toString("hex").toUpperCase();
-    const signature = response.slice(pubKeyLength + 1, response.length - _chunk2HKHCIKXcjs.STATUS_LENGTH).toString("base64");
+    const signature = response.slice(pubKeyLength + 1, response.length - _chunk4ZXMEPRBcjs.STATUS_LENGTH).toString("base64");
     return { pubKey, signature };
   };
   const device = {
     authenticate: async ({ challenge: { challenge, name, role, keyHandle }, workspaceName }) => {
       logger.info(`[device] Authenticate`);
       _invariant2.default.call(void 0, role !== "READ_ONLY_API_KEY", "Invalid role for authenticate: READ_ONLY_API_KEY");
-      const applicationBuffer = Buffer.from(_chunk2HKHCIKXcjs.APPID_VAULT_ADMINISTRATOR, "hex");
+      const applicationBuffer = Buffer.from(_chunk4ZXMEPRBcjs.APPID_VAULT_ADMINISTRATOR, "hex");
       const nameBuffer = Buffer.from(name);
       const workspaceBuffer = Buffer.from(workspaceName);
       const keyHandleData = Buffer.concat([
-        Buffer.from(_chunk2HKHCIKXcjs.STR_ROLES[role], "hex"),
+        Buffer.from(_chunk4ZXMEPRBcjs.STR_ROLES[role], "hex"),
         Buffer.from([nameBuffer.length]),
         nameBuffer,
         Buffer.from([workspaceBuffer.length]),
@@ -185,8 +182,34 @@ function createRealDevice(options, logger) {
       );
       return removeStatus(bufWithStatus).toString("hex");
     },
-    generateSeedFragment: FIXME_NOT_IMPLEMENTED("generateSeedFragment"),
-    generateWrappingKeyFragment: FIXME_NOT_IMPLEMENTED("generateWrappingKeyFragment"),
+    generateSeedFragment: async () => {
+      logger.info(`[device] generateSeedFragment`);
+      const path = getPathFromPathString(_chunk4ZXMEPRBcjs.PATHS.KEY_MATERIAL);
+      const data = Buffer.concat([
+        Buffer.from([path.length]),
+        ...path.map((derivation) => {
+          const buf = Buffer.alloc(4);
+          buf.writeUInt32BE(derivation, 0);
+          return buf;
+        })
+      ]);
+      const response = await run((transport) => transport.send(224, 68, 0, 0, data));
+      return removeStatus(response).toString("base64");
+    },
+    generateWrappingKeyFragment: async () => {
+      logger.info(`[device] generateWrappingKeyFragment`);
+      const path = getPathFromPathString(_chunk4ZXMEPRBcjs.PATHS.KEY_MATERIAL);
+      const data = Buffer.concat([
+        Buffer.from([path.length]),
+        ...path.map((derivation) => {
+          const buf = Buffer.alloc(4);
+          buf.writeUInt32BE(derivation, 0);
+          return buf;
+        })
+      ]);
+      const response = await run((transport) => transport.send(224, 68, 1, 0, data));
+      return removeStatus(response).toString("base64");
+    },
     getAttestation: async () => {
       const bufWithStatus = await run((transport) => transport.send(224, 65, 0, 0));
       const buffer = removeStatus(bufWithStatus);
@@ -212,10 +235,14 @@ function createRealDevice(options, logger) {
         confidentialityKeySignature: sig.toString("hex")
       };
     },
-    getConfidentialityPubKey: () => getPublicKey(_chunk2HKHCIKXcjs.PATHS.CONFIDENTIALITY, { secp256k1: true }),
-    getDeviceUserId: FIXME_NOT_IMPLEMENTED("getDeviceUserId"),
-    getU2FPubKey: () => getPublicKey(_chunk2HKHCIKXcjs.PATHS.U2F, { secp256k1: false }),
-    getValidationPubKey: () => getPublicKey(_chunk2HKHCIKXcjs.PATHS.VALIDATION, { secp256k1: true }),
+    getConfidentialityPubKey: () => getPublicKey(_chunk4ZXMEPRBcjs.PATHS.CONFIDENTIALITY, { secp256k1: true }),
+    getDeviceUserId: async () => {
+      logger.info(`[device] getDeviceUserId`);
+      const response = await run((transport) => transport.send(224, 82, 0, 0));
+      return removeStatus(response).toString("hex").toUpperCase();
+    },
+    getU2FPubKey: () => getPublicKey(_chunk4ZXMEPRBcjs.PATHS.U2F, { secp256k1: false }),
+    getValidationPubKey: () => getPublicKey(_chunk4ZXMEPRBcjs.PATHS.VALIDATION, { secp256k1: true }),
     hasPairing: async () => {
       logger.info(`[device] hasPairing`);
       const apdu = [224, 81, 0, 0, 181];
@@ -227,19 +254,48 @@ function createRealDevice(options, logger) {
       const res = await run((transport) => transport.send(224, 70, 0, 0));
       const pubKeyLength = res.readInt8(0);
       const pubKey = res.slice(1, pubKeyLength + 1).toString("hex").toUpperCase();
-      const signature = res.slice(pubKeyLength + 1, res.length - _chunk2HKHCIKXcjs.STATUS_LENGTH).toString("base64");
+      const signature = res.slice(pubKeyLength + 1, res.length - _chunk4ZXMEPRBcjs.STATUS_LENGTH).toString("base64");
       return { pubKey, signature };
     },
-    openSession: FIXME_NOT_IMPLEMENTED("openSession"),
+    openSession: async (params) => {
+      logger.info(`[device] openSession`);
+      const { secureChannel } = params;
+      const path = getPathFromPathString(_chunk4ZXMEPRBcjs.PATHS.CONFIDENTIALITY);
+      const dataDerivation = Buffer.concat([
+        Buffer.from([path.length]),
+        ...path.map((derivation) => {
+          const buf = Buffer.alloc(4);
+          buf.writeUInt32BE(derivation, 0);
+          return buf;
+        })
+      ]);
+      const pubKey = Buffer.from(secureChannel.pubKey, "hex");
+      const sigBuffer = Buffer.from(secureChannel.certificate.signature, "base64");
+      const attestationPubBuffer = Buffer.from(secureChannel.certificate.attestationPub, "base64");
+      const certBuffer = Buffer.from(secureChannel.certificate.certificate, "base64");
+      const attestation = Buffer.concat([
+        Buffer.from([sigBuffer.length]),
+        sigBuffer,
+        attestationPubBuffer,
+        Buffer.from([certBuffer.length]),
+        certBuffer
+      ]);
+      const lengthAttestation = Buffer.alloc(2);
+      lengthAttestation.writeUInt16BE(attestation.length, 0);
+      const data = Buffer.concat([dataDerivation, pubKey, lengthAttestation, attestation]);
+      await run(
+        (transport) => sendByChunk(transport, [224, 66, 0, _chunk4ZXMEPRBcjs.SCRIPT_IDS.INIT_SESSION], data)
+      );
+    },
     register: async (params) => {
       const { challenge: strChallenge, u2fRegisterData: _, name, role } = params;
       const challenge = Buffer.from(strChallenge, "hex");
       _invariant2.default.call(void 0, challenge.length === 32, "challenge hex is expected to have 32 bytes");
-      const applicationBuf = Buffer.from(_chunk2HKHCIKXcjs.APPID_VAULT_ADMINISTRATOR, "hex");
+      const applicationBuf = Buffer.from(_chunk4ZXMEPRBcjs.APPID_VAULT_ADMINISTRATOR, "hex");
       _invariant2.default.call(void 0, applicationBuf.length === 32, "application hex is expected to have 32 bytes");
       const userNameBuff = Buffer.from(name);
       const keyHandleData = Buffer.concat([
-        Buffer.from(_chunk2HKHCIKXcjs.STR_ROLES[role], "hex"),
+        Buffer.from(_chunk4ZXMEPRBcjs.STR_ROLES[role], "hex"),
         Buffer.from([userNameBuff.length]),
         userNameBuff
       ]);
@@ -280,17 +336,29 @@ function createRealDevice(options, logger) {
       const final = Buffer.concat([length, psdPayload]);
       await run((transport) => sendByChunk(transport, [224, 78, 0, 0], final));
     },
-    startKKPatternAsResponder: FIXME_NOT_IMPLEMENTED("startKKPatternAsResponder"),
+    startKKPatternAsResponder: async (params) => {
+      logger.info(`[device] startKKPatternAsResponder`);
+      const data = buildAttestation(params);
+      const bufWithStatus = await run(
+        (transport) => sendByChunk(transport, [224, 76, 0, _chunk4ZXMEPRBcjs.SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
+      );
+      const buffer = removeStatus(bufWithStatus);
+      const dataLength = buffer.readInt8(0);
+      return {
+        handshake: buffer.slice(1, dataLength + 1).toString("base64"),
+        signature: buffer.slice(dataLength + 1).toString("base64")
+      };
+    },
     startKPatternAsResponder: async (params) => {
       logger.info(`[device] startKPatternAsResponder`);
       const data = buildAttestation(params);
       await run(
-        (transport) => sendByChunk(transport, [224, 73, 0, _chunk2HKHCIKXcjs.SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
+        (transport) => sendByChunk(transport, [224, 73, 0, _chunk4ZXMEPRBcjs.SCRIPT_IDS.ACCOUNT_MANAGER_SESSION], data)
       );
     },
     validateVaultOperation: async (params) => {
       logger.info(`[device] validateVaultOperation`);
-      const path = getPathFromPathString(_chunk2HKHCIKXcjs.PATHS.VALIDATION);
+      const path = getPathFromPathString(_chunk4ZXMEPRBcjs.PATHS.VALIDATION);
       const paths = Buffer.concat([
         Buffer.from([path.length]),
         ...path.map((derivation) => {
@@ -312,10 +380,10 @@ function createRealDevice(options, logger) {
         const responseType = response.readInt8(0);
         let responseStatus = response.readUInt16BE(response.length - 2);
         switch (responseType) {
-          case _chunk2HKHCIKXcjs.STREAMING_NEXT_ACTION:
+          case _chunk4ZXMEPRBcjs.STREAMING_NEXT_ACTION:
             nextActionId = response.readUIntBE(1, 2);
             break;
-          case _chunk2HKHCIKXcjs.STREAMING_RESPONSE:
+          case _chunk4ZXMEPRBcjs.STREAMING_RESPONSE:
             finalResponse = response.slice(3, response.length - 2);
             while (responseStatus !== 36864) {
               {
@@ -382,7 +450,8 @@ async function genericRegister({
   name,
   role,
   getChallenge,
-  submitChallenge
+  submitChallenge,
+  onScreenDisplayed
 }) {
   const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([
     device.getAttestation(),
@@ -407,6 +476,7 @@ async function genericRegister({
     partitionId: challenge.ciphertext,
     handshakeAttestation: challenge.handshakeAttestation
   });
+  await _optionalChain([onScreenDisplayed, 'optionalCall', _5 => _5()]);
   const register = await device.register({
     challenge: challenge.challenge,
     u2fRegisterData: challenge.u2fRegisterData,
@@ -440,7 +510,7 @@ function createEngine(options, logger) {
     baseUrl: options.baseUrl
   };
   const client = createClient(clientOptions);
-  const apiDevice = _chunk2HKHCIKXcjs.createApiDevice.call(void 0, options, logger);
+  const apiDevice = _chunk4ZXMEPRBcjs.createApiDevice.call(void 0, options, logger);
   const base = {
     client,
     createClient: (overrides) => createClient({ ...clientOptions, ...overrides }),
@@ -528,7 +598,7 @@ function createEngine(options, logger) {
               claim: { role, pubKey, deviceName, confidentialityKey }
             });
           },
-          collectWrappingKeyFragment: async (wrappingKey) => {
+          collectWrappingKeyFragment: async (wrappingKey, params) => {
             const [{ pubKey }, confidentialityKey] = await Promise.all([
               device.getU2FPubKey(),
               device.getConfidentialityPubKey()
@@ -540,6 +610,7 @@ function createEngine(options, logger) {
               }
             });
             const { attestation } = await device.getAttestation();
+            await _optionalChain([params, 'optionalAccess', _6 => _6.onScreenDisplayed, 'optionalCall', _7 => _7()]);
             const blob = await device.generateWrappingKeyFragment();
             await client2.onboarding.submitWrappingKeyFragment.mutate({
               pubKey,
@@ -554,8 +625,8 @@ function createEngine(options, logger) {
               }
             });
           },
-          registerDevice: async (params) => {
-            const { role, name } = params;
+          registerDevice: async (registerParams, params) => {
+            const { role, name } = registerParams;
             const getChallengeMutation = role === "ADMIN" ? client2.onboarding.generateMasterAdminRegistrationChallenge : client2.onboarding.generateSharedOwnerRegistrationChallenge;
             const submitChallengeMutation = role === "ADMIN" ? client2.onboarding.submitMasterAdminRegistration : client2.onboarding.submitSharedOwnerRegistration;
             await genericRegister({
@@ -572,10 +643,11 @@ function createEngine(options, logger) {
                 pubKey,
                 // FIXME this should be renamed to `challengeResponse` on backend side
                 response: challengeResponse
-              })
+              }),
+              onScreenDisplayed: _optionalChain([params, 'optionalAccess', _8 => _8.onScreenDisplayed])
             });
           },
-          reviewSharedOwner: async (challenge) => {
+          reviewSharedOwner: async (challenge, params) => {
             await enforcePairing();
             const { pubKey } = await device.getU2FPubKey();
             await device.startKPatternAsResponder({
@@ -583,6 +655,7 @@ function createEngine(options, logger) {
               handshakeAttestation: challenge.handshakeAttestation,
               partitionId: challenge.partitionId
             });
+            await _optionalChain([params, 'optionalAccess', _9 => _9.onScreenDisplayed, 'optionalCall', _10 => _10()]);
             const signature = await device.validateVaultOperation({
               actions: challenge.wActions
             });
@@ -592,7 +665,7 @@ function createEngine(options, logger) {
               signature
             });
           },
-          collectSeedFragment: async (challenge) => {
+          collectSeedFragment: async (challenge, params) => {
             await enforcePairing();
             const [{ pubKey }, { attestation }] = await Promise.all([
               device.getU2FPubKey(),
@@ -603,6 +676,7 @@ function createEngine(options, logger) {
               handshakeAttestation: challenge.handshakeAttestation,
               partitionId: challenge.partitionId
             });
+            await _optionalChain([params, 'optionalAccess', _11 => _11.onScreenDisplayed, 'optionalCall', _12 => _12()]);
             const challengeResponse = await device.validateVaultOperation({
               actions: challenge.wActions
             });
@@ -641,9 +715,9 @@ function createEngine(options, logger) {
                   pubKey,
                   workspaceName: __workspaceName
                 },
-                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _5 => _5.correlationId]) })
+                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _13 => _13.correlationId]) })
               );
-              await _optionalChain([opts, 'optionalAccess', _6 => _6.onScreenDisplayed, 'optionalCall', _7 => _7()]);
+              await _optionalChain([opts, 'optionalAccess', _14 => _14.onScreenDisplayed, 'optionalCall', _15 => _15()]);
               const authentication = await device.authenticate({
                 challenge,
                 workspaceName: __workspaceName
@@ -652,11 +726,11 @@ function createEngine(options, logger) {
                 workspaceName: __workspaceName,
                 pubKey,
                 authentication,
-                validityDurationSecs: _optionalChain([opts, 'optionalAccess', _8 => _8.validityDurationSecs])
+                validityDurationSecs: _optionalChain([opts, 'optionalAccess', _16 => _16.validityDurationSecs])
               };
               const { token } = await client2.auth.psd.authenticate.mutate(
                 { ...authPayload },
-                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _9 => _9.correlationId]) })
+                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _17 => _17.correlationId]) })
               );
               const withPsdAuth = {
                 __psdToken: token
@@ -701,7 +775,7 @@ function createEngine(options, logger) {
                   apiKeySecret: credentials.apiKeySecret,
                   workspace: __workspaceName
                 },
-                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _10 => _10.correlationId]) })
+                _chunkLH4QQXUHcjs.buildTrpcContext.call(void 0, { correlationId: _optionalChain([opts, 'optionalAccess', _18 => _18.correlationId]) })
               );
               const withApiAuth = {
                 __apiAuth: res
@@ -732,7 +806,7 @@ function createEngine(options, logger) {
             handshakeAttestation: challenge.handshakeAttestation,
             partitionId: challenge.partitionId
           });
-          await _optionalChain([params, 'optionalAccess', _11 => _11.onScreenDisplayed, 'optionalCall', _12 => _12()]);
+          await _optionalChain([params, 'optionalAccess', _19 => _19.onScreenDisplayed, 'optionalCall', _20 => _20()]);
           const signature = await device.validateVaultOperation({
             actions: challenge.wActions
           });
@@ -743,7 +817,7 @@ function createEngine(options, logger) {
             const { challenge } = await client2.requests.getChallenge.query({ id: request.id });
             if (challenge.challengeType === "PSD") {
               const signature = await approveChallenge(challenge, params);
-              await _optionalChain([params, 'optionalAccess', _13 => _13.onPsdChallengeSigned, 'optionalCall', _14 => _14()]);
+              await _optionalChain([params, 'optionalAccess', _21 => _21.onPsdChallengeSigned, 'optionalCall', _22 => _22()]);
               return client2.requests.approve.mutate(
                 {
                   id: request.id,