@ledgerhq/revault-sdk 0.28.11 → 0.28.14

package/lib/engine.js

@@ -1,7 +1,7 @@
-import { a as isPskMissingError, c as withDevicePolling, d as createApiDevice, f as APPID_VAULT_ADMINISTRATOR, g as STR_ROLES, h as SCRIPT_IDS, l as DisconnectedDevice, m as PATHS, o as isTransportStatusError, p as PAGINATED_STATUS, u as LockedDeviceError } from "./device-DQyYUWPl.js";
+import { _ as DeviceOperationAbortedError, a as isPskMissingError, b as throwIfDeviceOperationAborted, c as withDevicePolling, d as createApiDevice, f as APPID_VAULT_ADMINISTRATOR, g as STR_ROLES, h as SCRIPT_IDS, l as DisconnectedDevice, m as PATHS, o as isTransportStatusError, p as PAGINATED_STATUS, u as LockedDeviceError, v as deviceOperationDelay } from "./device-BnO26Hlr.js";
 import { i as fetchAllCursor, r as fetchAll, t as buildTrpcContext } from "./utils-CW0gdJME.js";
 import invariant from "invariant";
-import { from, lastValueFrom } from "rxjs";
+import { Observable, from, lastValueFrom } from "rxjs";
 import { createTRPCClient, httpLink } from "@trpc/client";
 import superjson from "superjson";
 //#region src/device/real-device.ts
@@ -15,10 +15,11 @@ const splitChunks = (chunk, buffer) => {
 	return chunks;
 };
 const removeStatus = (result) => result.slice(0, result.length - 2);
-const sendByChunk = async (transport, command, data, chunkSize = MAX_CHUNK_LENGTH) => {
+const sendByChunk = async (transport, command, data, signal, chunkSize = MAX_CHUNK_LENGTH) => {
 	const chunks = splitChunks(chunkSize, data);
 	let response = Buffer.from([]);
 	for (let i = 0; i < chunks.length; i++) {
+		throwIfDeviceOperationAborted(signal);
 		const chunk = chunks[i];
 		const apdu = [...command];
 		/* v8 ignore next -- @preserve */
@@ -108,19 +109,31 @@ const genericRetryOnError = (err) => {
 };
 function createRealDevice(options, logger) {
 	const { transportId } = options;
-	async function run(job, retryOnError = genericRetryOnError) {
-		return lastValueFrom(withDevicePolling(transportId)((transport) => from(job(transport)), retryOnError));
+	async function run(job, retryOnError = genericRetryOnError, signal) {
+		throwIfDeviceOperationAborted(signal);
+		const polling = withDevicePolling(transportId)((transport) => from(job(transport)), retryOnError);
+		const abortablePolling = new Observable((subscriber) => {
+			const subscription = polling.subscribe(subscriber);
+			const onAbort = () => subscriber.error(new DeviceOperationAbortedError());
+			signal?.addEventListener("abort", onAbort, { once: true });
+			return () => {
+				signal?.removeEventListener("abort", onAbort);
+				subscription.unsubscribe();
+			};
+		});
+		return lastValueFrom(abortablePolling);
 	}
 	/* v8 ignore next -- @preserve */
 	const noRetry = () => false;
 	/* v8 ignore next -- @preserve */
 	const alwaysRetry = () => true;
 	const poll = async (opts = {}) => {
-		await run(async (_transport) => {}, opts.retryOnError ?? alwaysRetry);
+		await run(async (_transport) => {}, opts.retryOnError ?? alwaysRetry, opts.signal);
 		try {
 			await getPublicKey(PATHS.U2F, {
 				secp256k1: true,
-				retryOnError: noRetry
+				retryOnError: noRetry,
+				signal: opts.signal
 			});
 			return { isAppOpened: true };
 		} catch (err) {
@@ -128,12 +141,12 @@ function createRealDevice(options, logger) {
 			throw err;
 		}
 	};
-	const pollApp = async (appName) => {
-		const res = await run((transport) => transport.send(224, 216, 0, 0, Buffer.from(appName, "utf8")));
-		await new Promise((r) => setTimeout(r, 1e3));
+	const pollApp = async (appName, opts = {}) => {
+		const res = await run((transport) => transport.send(224, 216, 0, 0, Buffer.from(appName, "utf8")), genericRetryOnError, opts.signal);
+		await deviceOperationDelay(1e3, opts.signal);
 		return res.toString("hex");
 	};
-	const getPublicKey = async (pathString, { secp256k1, retryOnError }) => {
+	const getPublicKey = async (pathString, { secp256k1, retryOnError, signal }) => {
 		logger.info(`[device] getPublicKey (${pathString})`);
 		const path = getPathFromPathString(pathString);
 		const data = Buffer.concat([Buffer.from([path.length]), ...path.map((derivation) => {
@@ -142,7 +155,7 @@ function createRealDevice(options, logger) {
 			return buf;
 		})]);
 		const curve = secp256k1 ? 1 : 2;
-		const response = await run((transport) => transport.send(224, 64, curve, 0, data), retryOnError ?? genericRetryOnError);
+		const response = await run((transport) => transport.send(224, 64, curve, 0, data), retryOnError ?? genericRetryOnError, signal);
 		const pubKeyLength = response.readInt8(0);
 		return {
 			pubKey: response.slice(1, pubKeyLength + 1).toString("hex").toUpperCase(),
@@ -212,8 +225,8 @@ function createRealDevice(options, logger) {
 			const response = await run((transport) => transport.send(224, 68, 1, 0, data));
 			return removeStatus(response).toString("base64");
 		},
-		getAttestation: async () => {
-			const bufWithStatus = await run((transport) => transport.send(224, 65, 0, 0));
+		getAttestation: async (opts = {}) => {
+			const bufWithStatus = await run((transport) => transport.send(224, 65, 0, 0), genericRetryOnError, opts.signal);
 			const buffer = removeStatus(bufWithStatus);
 			const certLen = buffer.readInt8(98);
 			return {
@@ -225,9 +238,9 @@ function createRealDevice(options, logger) {
 				buffer
 			};
 		},
-		getConfidentialityKey: async () => {
+		getConfidentialityKey: async (opts = {}) => {
 			logger.info(`[device] getConfidentialityKey`);
-			const bufWithStatus = await run((transport) => transport.send(224, 77, 0, 0));
+			const bufWithStatus = await run((transport) => transport.send(224, 77, 0, 0), genericRetryOnError, opts.signal);
 			const buf = removeStatus(bufWithStatus);
 			const keyLength = buf[0];
 			const key = buf.slice(1, 1 + keyLength);
@@ -245,7 +258,7 @@ function createRealDevice(options, logger) {
 		},
 		getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),
 		getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),
-		hasPairing: async () => {
+		hasPairing: async (opts = {}) => {
 			logger.info(`[device] hasPairing`);
 			const apdu = [
 				224,
@@ -254,14 +267,14 @@ function createRealDevice(options, logger) {
 				0,
 				181
 			];
-			const res = await run((transport) => transport.exchange(Buffer.from(apdu)));
+			const res = await run((transport) => transport.exchange(Buffer.from(apdu)), genericRetryOnError, opts.signal);
 			const swHex = res.subarray(res.length - 2).toString("hex");
 			if (swHex === "6f45" || swHex === "6a87") return "NO_PAIRING";
 			if (swHex === "6065") return "PSK_MISSING";
 			return "OK";
 		},
-		initPairingHandshake: async () => {
-			const res = await run((transport) => transport.send(224, 70, 0, 0));
+		initPairingHandshake: async (opts = {}) => {
+			const res = await run((transport) => transport.send(224, 70, 0, 0), genericRetryOnError, opts.signal);
 			const pubKeyLength = res.readInt8(0);
 			return {
 				pubKey: res.slice(1, pubKeyLength + 1).toString("hex").toUpperCase(),
@@ -352,7 +365,7 @@ function createRealDevice(options, logger) {
 			const response = await run((transport) => transport.send(224, 3, 0, 0, challenge));
 			return removeStatus(response).toString("hex");
 		},
-		setPairing: async ({ pairing }) => {
+		setPairing: async ({ pairing, signal }) => {
 			logger.info(`[device] setPairing`);
 			const psdPayload = Buffer.from(pairing.blob, "base64");
 			const length = Buffer.alloc(2);
@@ -363,11 +376,11 @@ function createRealDevice(options, logger) {
 				78,
 				0,
 				0
-			], final));
+			], final, signal), genericRetryOnError, signal);
 		},
-		signRefreshPskAuth: async () => {
+		signRefreshPskAuth: async ({ signal }) => {
 			logger.info(`[device] signRefreshPskAuth`);
-			const res = await run((transport) => transport.send(224, 85, 0, 0));
+			const res = await run((transport) => transport.send(224, 85, 0, 0), genericRetryOnError, signal);
 			return res.slice(0, res.length - 2).toString("base64");
 		},
 		finalizePskRefresh: async (params) => {
@@ -378,7 +391,7 @@ function createRealDevice(options, logger) {
 				83,
 				0,
 				0
-			], payload));
+			], payload, params.signal), genericRetryOnError, params.signal);
 		},
 		startKKPatternAsResponder: async (params) => {
 			logger.info(`[device] startKKPatternAsResponder`);
@@ -404,7 +417,7 @@ function createRealDevice(options, logger) {
 				73,
 				0,
 				SCRIPT_IDS.ACCOUNT_MANAGER_SESSION
-			], data));
+			], data, params.signal), genericRetryOnError, params.signal);
 		},
 		startPskSession: async (params) => {
 			logger.info(`[device] startPskSession`);
@@ -416,7 +429,7 @@ function createRealDevice(options, logger) {
 				80,
 				0,
 				0
-			], data));
+			], data, params.signal), genericRetryOnError, params.signal);
 		},
 		validateVaultOperation: async (params) => {
 			logger.info(`[device] validateVaultOperation`);
@@ -442,7 +455,7 @@ function createRealDevice(options, logger) {
 					69,
 					0,
 					0
-				], data));
+				], data, params.signal), genericRetryOnError, params.signal);
 				const responseType = response.readInt8(0);
 				let responseStatus = response.readUInt16BE(response.length - 2);
 				switch (responseType) {
@@ -452,7 +465,7 @@ function createRealDevice(options, logger) {
 					case 2:
 						finalResponse = response.slice(3, response.length - 2);
 						while (responseStatus !== 36864) {
-							const resp = await run((transport) => transport.send(0, 192, 0, 0));
+							const resp = await run((transport) => transport.send(0, 192, 0, 0), genericRetryOnError, params.signal);
 							responseStatus = resp.readUInt16BE(resp.length - 2);
 							finalResponse = Buffer.concat([finalResponse, removeStatus(resp)]);
 						}
@@ -467,8 +480,8 @@ function createRealDevice(options, logger) {
 			const res = await run((transport) => transport.exchange(Buffer.from(apduCommand, "hex")));
 			return Buffer.from(res).toString("hex");
 		},
-		getVersion: async () => {
-			const res = await run((transport) => transport.send(176, 1, 0, 0));
+		getVersion: async (opts = {}) => {
+			const res = await run((transport) => transport.send(176, 1, 0, 0), genericRetryOnError, opts.signal);
 			const appNameLen = res.readInt8(1);
 			const appVersionLen = res.readInt8(2 + appNameLen);
 			const appVersionHex = res.slice(3 + appNameLen, 2 + appNameLen + appVersionLen + 1);
@@ -498,24 +511,34 @@ const createClient = (options) => {
 };
 //#endregion
 //#region src/engine/index.ts
-const openSecureChannel = (device, challenge) => {
+const openSecureChannel = (device, challenge, signal) => {
 	if (challenge.handshake.length === 64) return device.startPskSession({
 		nonce: challenge.handshake,
-		partitionId: challenge.partitionId
+		partitionId: challenge.partitionId,
+		signal
 	});
 	return device.startKPatternAsResponder({
 		handshake: challenge.handshake,
 		handshakeAttestation: challenge.handshakeAttestation,
-		partitionId: challenge.partitionId
+		partitionId: challenge.partitionId,
+		signal
 	});
 };
-const pairDevice = async ({ device, getPairing }) => {
-	const pairing = await getPairing(await device.getConfidentialityKey());
-	await device.setPairing({ pairing });
+const pairDevice = async ({ device, getPairing, signal }) => {
+	const pairing = await getPairing(await device.getConfidentialityKey({ signal }));
+	throwIfDeviceOperationAborted(signal);
+	await device.setPairing({
+		pairing,
+		signal
+	});
 };
-const refreshPsk = async ({ device, getRefreshPskData }) => {
-	const eph = await device.initPairingHandshake();
-	const [deviceAttestation, validationKeySignature] = await Promise.all([device.getAttestation(), device.signRefreshPskAuth({ ephemeralKey: eph.pubKey })]);
+const refreshPsk = async ({ device, getRefreshPskData, signal }) => {
+	const eph = await device.initPairingHandshake({ signal });
+	const [deviceAttestation, validationKeySignature] = await Promise.all([device.getAttestation({ signal }), device.signRefreshPskAuth({
+		ephemeralKey: eph.pubKey,
+		signal
+	})]);
+	throwIfDeviceOperationAborted(signal);
 	const refresh = await getRefreshPskData({
 		psdEphemeralKey: Buffer.from(eph.pubKey, "hex").toString("base64"),
 		psdEphemeralKeyAttestation: {
@@ -526,7 +549,11 @@ const refreshPsk = async ({ device, getRefreshPskData }) => {
 		},
 		validationKeySignature
 	});
-	await device.finalizePskRefresh(refresh);
+	throwIfDeviceOperationAborted(signal);
+	await device.finalizePskRefresh({
+		...refresh,
+		signal
+	});
 };
 async function genericRegister({ device, name, role, getChallenge, submitChallenge, onScreenDisplayed }) {
 	const [attestation, u2fPubKey, confidentialityKey] = await Promise.all([
@@ -883,13 +910,14 @@ function createEngine(options, logger) {
 		});
 		if (engine.device && engine.__workspaceName && engine.__psdToken) decorate((engine) => {
 			const { client, device } = engine;
-			async function enforcePairing() {
-				const status = await device.hasPairing();
+			async function enforcePairing(signal) {
+				const status = await device.hasPairing({ signal });
 				if (status === "OK") return;
 				const refreshCurrentPsk = async () => {
 					await refreshPsk({
 						device,
-						getRefreshPskData: (data) => client.debug.refreshPsk.mutate(data)
+						getRefreshPskData: (data) => client.debug.refreshPsk.mutate(data),
+						signal
 					});
 				};
 				if (status === "NO_PAIRING") await pairDevice({
@@ -897,28 +925,37 @@ function createEngine(options, logger) {
 					getPairing: (confidentialityKey) => client.debug.pairDevicePartition.mutate({
 						confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
 						confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
-					})
+					}),
+					signal
 				});
 				await refreshCurrentPsk();
 			}
 			const approveChallenge = async (challenge, params) => {
-				await enforcePairing();
+				await enforcePairing(params?.signal);
 				try {
-					await openSecureChannel(device, challenge);
+					await openSecureChannel(device, challenge, params?.signal);
 				} catch (err) {
 					if (!isPskMissingError(err)) throw err;
-					await enforcePairing();
-					await openSecureChannel(device, challenge);
+					await enforcePairing(params?.signal);
+					await openSecureChannel(device, challenge, params?.signal);
 				}
+				throwIfDeviceOperationAborted(params?.signal);
 				await params?.onScreenDisplayed?.();
-				return await device.validateVaultOperation({ actions: challenge.wActions });
+				throwIfDeviceOperationAborted(params?.signal);
+				return await device.validateVaultOperation({
+					actions: challenge.wActions,
+					signal: params?.signal
+				});
 			};
 			return {
 				approve: async (request, params) => {
+					throwIfDeviceOperationAborted(params?.signal);
 					const { challenge } = await client.requests.getChallenge.query({ id: request.id });
 					if (challenge.challengeType === "PSD") {
 						const signature = await approveChallenge(challenge, params);
+						throwIfDeviceOperationAborted(params?.signal);
 						await params?.onPsdChallengeSigned?.();
+						throwIfDeviceOperationAborted(params?.signal);
 						return client.requests.approve.mutate({
 							id: request.id,
 							data: {
@@ -927,10 +964,13 @@ function createEngine(options, logger) {
 							}
 						}, buildTrpcContext(params));
 					}
-					if (challenge.challengeType === "SOFT") return client.requests.approve.mutate({
-						id: request.id,
-						data: { challengeType: "SOFT" }
-					}, buildTrpcContext(params));
+					if (challenge.challengeType === "SOFT") {
+						throwIfDeviceOperationAborted(params?.signal);
+						return client.requests.approve.mutate({
+							id: request.id,
+							data: { challengeType: "SOFT" }
+						}, buildTrpcContext(params));
+					}
 					throw new Error("Challenge type must be either PSD or SOFT");
 				},
 				approveChallenge,