@ledgerhq/revault-sdk 0.27.15 → 0.28.0

package/lib/engine.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_device = require("./device-B6QZOEDT.cjs");
+const require_device = require("./device-dbZH_1Pt.cjs");
 const require_utils = require("./utils-CavXJGCh.cjs");
 let invariant = require("invariant");
 invariant = require_rolldown_runtime.__toESM(invariant, 1);
+let ts_pattern = require("ts-pattern");
 let rxjs = require("rxjs");
 let _trpc_client = require("@trpc/client");
 let superjson = require("superjson");
@@ -66,6 +67,43 @@ const buildAttestation = (params) => {
 	totalLengthBuffer.writeUInt16BE(data.length, 0);
 	return Buffer.concat([totalLengthBuffer, data]);
 };
+const buildPskRefreshPayload = (params) => {
+	const sigBuffer = Buffer.from(params.handshakeAttestation.signature, "base64");
+	const sigLengthBuffer = Buffer.alloc(1);
+	sigLengthBuffer.writeUIntBE(sigBuffer.length, 0, 1);
+	const certBuffer = Buffer.from(params.handshakeAttestation.certificate, "base64");
+	const certLengthBuffer = Buffer.alloc(1);
+	certLengthBuffer.writeUIntBE(certBuffer.length, 0, 1);
+	const pubBuffer = Buffer.from(params.handshakeAttestation.attestationPub, "base64");
+	const certChainData = Buffer.concat([
+		sigLengthBuffer,
+		sigBuffer,
+		pubBuffer,
+		certLengthBuffer,
+		certBuffer
+	]);
+	const handshakeBuffer = Buffer.from(params.handshake, "base64");
+	(0, invariant.default)(handshakeBuffer.length <= 255, `PSK refresh handshake too long: ${handshakeBuffer.length} bytes (max 255)`);
+	const handshakeLengthBuffer = Buffer.alloc(1);
+	handshakeLengthBuffer.writeUInt8(handshakeBuffer.length, 0);
+	const encryptedPayloadBuffer = Buffer.from(params.encryptedPairingPayload, "base64");
+	(0, invariant.default)(encryptedPayloadBuffer.length <= 255, `PSK encrypted payload too long: ${encryptedPayloadBuffer.length} bytes (max 255)`);
+	const encryptedPayloadLengthBuffer = Buffer.alloc(1);
+	encryptedPayloadLengthBuffer.writeUInt8(encryptedPayloadBuffer.length, 0);
+	const certChainDataLengthBuff = Buffer.alloc(2);
+	certChainDataLengthBuff.writeUInt16BE(certChainData.length, 0);
+	const data = Buffer.concat([
+		handshakeLengthBuffer,
+		handshakeBuffer,
+		certChainDataLengthBuff,
+		certChainData,
+		encryptedPayloadLengthBuffer,
+		encryptedPayloadBuffer
+	]);
+	const totalLengthBuffer = Buffer.alloc(2);
+	totalLengthBuffer.writeUInt16BE(data.length, 0);
+	return Buffer.concat([totalLengthBuffer, data]);
+};
 /* v8 ignore next -- @preserve */
 const genericRetryOnError = (err) => {
 	if (err instanceof require_device.LockedDeviceError) return true;
@@ -215,8 +253,10 @@ function createRealDevice(options, logger) {
 				181
 			];
 			const res = await run((transport) => transport.exchange(Buffer.from(apdu)));
-			const hex = Buffer.from(res).toString("hex");
-			return hex !== "6f45" && hex !== "6a87";
+			const swHex = res.subarray(res.length - 2).toString("hex");
+			if (swHex === "6f45" || swHex === "6a87") return "NO_PAIRING";
+			if (swHex === "6065") return "PSK_MISSING";
+			return "OK";
 		},
 		initPairingHandshake: async () => {
 			const res = await run((transport) => transport.send(224, 70, 0, 0));
@@ -322,6 +362,21 @@ function createRealDevice(options, logger) {
 				0
 			], final));
 		},
+		signRefreshPskAuth: async () => {
+			logger.info(`[device] signRefreshPskAuth`);
+			const res = await run((transport) => transport.send(224, 85, 0, 0));
+			return res.slice(0, res.length - 2).toString("base64");
+		},
+		finalizePskRefresh: async (params) => {
+			logger.info(`[device] finalizePskRefresh`);
+			const payload = buildPskRefreshPayload(params);
+			await run((transport) => sendByChunk(transport, [
+				224,
+				83,
+				0,
+				0
+			], payload));
+		},
 		startKKPatternAsResponder: async (params) => {
 			logger.info(`[device] startKKPatternAsResponder`);
 			const data = buildAttestation(params);
@@ -347,6 +402,18 @@ function createRealDevice(options, logger) {
 				require_device.SCRIPT_IDS.ACCOUNT_MANAGER_SESSION
 			], data));
 		},
+		startPskSession: async (params) => {
+			logger.info(`[device] startPskSession`);
+			(0, invariant.default)(params.nonce.length === 64, `PSK nonce must be 32 bytes (64 hex chars), got ${params.nonce.length} chars`);
+			(0, invariant.default)(params.partitionId.length === 32, `partitionId must be 16 bytes (32 hex chars), got ${params.partitionId.length} chars`);
+			const data = Buffer.concat([Buffer.from(params.nonce, "hex"), Buffer.from(params.partitionId, "hex")]);
+			await run((transport) => sendByChunk(transport, [
+				224,
+				80,
+				0,
+				0
+			], data));
+		},
 		validateVaultOperation: async (params) => {
 			logger.info(`[device] validateVaultOperation`);
 			const path = getPathFromPathString(require_device.PATHS.VALIDATION);
@@ -427,6 +494,37 @@ const createClient = (options) => {
 };
 //#endregion
 //#region src/engine/index.ts
+const PSK_NONCE_BYTE_LEN = 32;
+const openSecureChannel = (device, challenge) => {
+	if (challenge.handshake.length === PSK_NONCE_BYTE_LEN * 2) return device.startPskSession({
+		nonce: challenge.handshake,
+		partitionId: challenge.partitionId
+	});
+	return device.startKPatternAsResponder({
+		handshake: challenge.handshake,
+		handshakeAttestation: challenge.handshakeAttestation,
+		partitionId: challenge.partitionId
+	});
+};
+const pairDevice = async ({ device, getPairing }) => {
+	const pairing = await getPairing(await device.getConfidentialityKey());
+	await device.setPairing({ pairing });
+};
+const refreshPsk = async ({ device, getRefreshPskData }) => {
+	const eph = await device.initPairingHandshake();
+	const [deviceAttestation, validationKeySignature] = await Promise.all([device.getAttestation(), device.signRefreshPskAuth({ ephemeralKey: eph.pubKey })]);
+	const refresh = await getRefreshPskData({
+		psdEphemeralKey: Buffer.from(eph.pubKey, "hex").toString("base64"),
+		psdEphemeralKeyAttestation: {
+			codeHash: deviceAttestation.attestation.codeHash,
+			attestationPub: deviceAttestation.attestation.attestationPub,
+			certificate: deviceAttestation.attestation.certificate,
+			signature: eph.signature
+		},
+		validationKeySignature
+	});
+	await device.finalizePskRefresh(refresh);
+};
 async function genericRegister({ device, name, role, getChallenge, submitChallenge, onScreenDisplayed }) {
 	const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([
 		device.getAttestation(),
@@ -566,18 +664,55 @@ function createEngine(options, logger) {
 		});
 		if (engine.device && engine.__onboardingId) decorate((engine) => {
 			const { device, client, __onboardingId } = engine;
+			const isPskEnabled = async () => {
+				try {
+					return await client.onboarding.getPskFeatureFlag.query({ onboardingId: __onboardingId }) === true;
+				} catch {
+					return false;
+				}
+			};
 			async function enforcePairing() {
-				if (await device.hasPairing()) return;
-				const [{ pubKey }, confidentialityKey] = await Promise.all([device.getU2FPubKey(), device.getConfidentialityKey()]);
-				const pairing = await client.onboarding.pairDevicePartition.mutate({
-					pubKey,
-					onboardingId: __onboardingId,
-					data: {
-						confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
-						confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
-					}
-				});
-				await device.setPairing({ pairing });
+				const status = await device.hasPairing();
+				if (status === "OK") return;
+				const pskEnabled = await isPskEnabled();
+				let pubKeyPromise;
+				const getPubKey = async () => {
+					pubKeyPromise ??= device.getU2FPubKey().then(({ pubKey }) => pubKey);
+					return pubKeyPromise;
+				};
+				const pairCurrentDevice = async () => {
+					const pubKey = await getPubKey();
+					await pairDevice({
+						device,
+						getPairing: (confidentialityKey) => client.onboarding.pairDevicePartition.mutate({
+							pubKey,
+							onboardingId: __onboardingId,
+							data: {
+								confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
+								confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
+							}
+						})
+					});
+				};
+				const refreshCurrentPsk = async () => {
+					const pubKey = await getPubKey();
+					await refreshPsk({
+						device,
+						getRefreshPskData: (data) => client.onboarding.refreshPsk.mutate({
+							pubKey,
+							onboardingId: __onboardingId,
+							data
+						})
+					});
+				};
+				await (0, ts_pattern.match)([status, pskEnabled]).with(["NO_PAIRING", false], async () => {
+					await pairCurrentDevice();
+				}).with(["NO_PAIRING", true], async () => {
+					await pairCurrentDevice();
+					await refreshCurrentPsk();
+				}).with(["PSK_MISSING", false], async () => {}).with(["PSK_MISSING", true], async () => {
+					await refreshCurrentPsk();
+				}).exhaustive();
 			}
 			return {
 				claimDevice: async (params) => {
@@ -639,11 +774,7 @@ function createEngine(options, logger) {
 				reviewSharedOwner: async (challenge, params) => {
 					await enforcePairing();
 					const { pubKey } = await device.getU2FPubKey();
-					await device.startKPatternAsResponder({
-						handshake: challenge.handshake,
-						handshakeAttestation: challenge.handshakeAttestation,
-						partitionId: challenge.partitionId
-					});
+					await openSecureChannel(device, challenge);
 					await params?.onScreenDisplayed?.();
 					const signature = await device.validateVaultOperation({ actions: challenge.wActions });
 					await client.onboarding.submitReviewByMasterAdminSignature.mutate({
@@ -655,11 +786,7 @@ function createEngine(options, logger) {
 				reviewExternalSigners: async (challenge, params) => {
 					await enforcePairing();
 					const { pubKey } = await device.getU2FPubKey();
-					await device.startKPatternAsResponder({
-						handshake: challenge.handshake,
-						handshakeAttestation: challenge.handshakeAttestation,
-						partitionId: challenge.partitionId
-					});
+					await openSecureChannel(device, challenge);
 					await params?.onScreenDisplayed?.();
 					const signature = await device.validateVaultOperation({ actions: challenge.wActions });
 					await client.onboarding.submitExternalSignersRegistration.mutate({
@@ -671,11 +798,7 @@ function createEngine(options, logger) {
 				collectSeedFragment: async (challenge, params) => {
 					await enforcePairing();
 					const [{ pubKey }, { attestation }] = await Promise.all([device.getU2FPubKey(), device.getAttestation()]);
-					await device.startKPatternAsResponder({
-						handshake: challenge.handshake,
-						handshakeAttestation: challenge.handshakeAttestation,
-						partitionId: challenge.partitionId
-					});
+					await openSecureChannel(device, challenge);
 					await params?.onScreenDisplayed?.();
 					const challengeResponse = await device.validateVaultOperation({ actions: challenge.wActions });
 					const kkPattern = await device.startKKPatternAsResponder({
@@ -771,22 +894,53 @@ function createEngine(options, logger) {
 		});
 		if (engine.device && engine.__workspaceName && engine.__psdToken) decorate((engine) => {
 			const { client, device } = engine;
+			const isPskEnabled = async () => {
+				try {
+					return await client.debug.getPskFeatureFlag.query() === true;
+				} catch {
+					return false;
+				}
+			};
 			async function enforcePairing() {
-				if (await device.hasPairing()) return;
-				const confidentialityKey = await device.getConfidentialityKey();
-				const pairing = await client.debug.pairDevicePartition.mutate({
-					confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
-					confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
-				});
-				await device.setPairing({ pairing });
+				const status = await device.hasPairing();
+				if (status === "OK") return;
+				const pskEnabled = await isPskEnabled();
+				const pairCurrentDevice = async () => {
+					await pairDevice({
+						device,
+						getPairing: (confidentialityKey) => client.debug.pairDevicePartition.mutate({
+							confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
+							confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
+						})
+					});
+				};
+				const refreshCurrentPsk = async () => {
+					await refreshPsk({
+						device,
+						getRefreshPskData: (data) => client.debug.refreshPsk.mutate(data)
+					});
+				};
+				await (0, ts_pattern.match)([status, pskEnabled]).with(["NO_PAIRING", false], async () => {
+					await pairCurrentDevice();
+				}).with(["NO_PAIRING", true], async () => {
+					await pairCurrentDevice();
+					await refreshCurrentPsk();
+				}).with(["PSK_MISSING", false], async () => {}).with(["PSK_MISSING", true], async () => {
+					await refreshCurrentPsk();
+				}).exhaustive();
 			}
 			const approveChallenge = async (challenge, params) => {
 				await enforcePairing();
-				await device.startKPatternAsResponder({
-					handshake: challenge.handshake,
-					handshakeAttestation: challenge.handshakeAttestation,
-					partitionId: challenge.partitionId
-				});
+				try {
+					await openSecureChannel(device, challenge);
+				} catch (err) {
+					if (!require_device.isPskMissingError(err)) throw err;
+					if (!await isPskEnabled()) logger.warning("Discarding SW_PSK_MISSING: PSK secure channel is disabled");
+					else {
+						await enforcePairing();
+						await openSecureChannel(device, challenge);
+					}
+				}
 				await params?.onScreenDisplayed?.();
 				return await device.validateVaultOperation({ actions: challenge.wActions });
 			};