@ledgerhq/revault-sdk 0.28.5 → 0.28.8

package/lib/engine.js

@@ -1,7 +1,6 @@
-import { c as LockedDeviceError, d as PAGINATED_STATUS, f as PATHS, i as isTransportStatusError, l as createApiDevice, m as STR_ROLES, o as withDevicePolling, p as SCRIPT_IDS, r as isPskMissingError, s as DisconnectedDevice, u as APPID_VAULT_ADMINISTRATOR } from "./device-Bo6m3O1I.js";
+import { c as LockedDeviceError, d as PAGINATED_STATUS, f as PATHS, i as isTransportStatusError, l as createApiDevice, m as STR_ROLES, o as withDevicePolling, p as SCRIPT_IDS, r as isPskMissingError, s as DisconnectedDevice, u as APPID_VAULT_ADMINISTRATOR } from "./device-WXLkORvV.js";
 import { i as fetchAllCursor, r as fetchAll, t as buildTrpcContext } from "./utils-CW0gdJME.js";
 import invariant from "invariant";
-import { match } from "ts-pattern";
 import { from, lastValueFrom } from "rxjs";
 import { createTRPCClient, httpLink } from "@trpc/client";
 import superjson from "superjson";
@@ -174,20 +173,22 @@ function createRealDevice(options, logger) {
 				keyHandleDataLength,
 				keyHandleData
 			]);
-			return removeStatus(await run((transport) => sendByChunk(transport, [
+			const authentication = await run((transport) => sendByChunk(transport, [
 				224,
 				2,
 				0,
 				0
-			], data))).toString("hex");
+			], data));
+			return removeStatus(authentication).toString("hex");
 		},
 		finalizePairingHandshake: async (params) => {
-			return removeStatus(await run((transport) => sendByChunk(transport, [
+			const bufWithStatus = await run((transport) => sendByChunk(transport, [
 				224,
 				71,
 				0,
 				2
-			], buildAttestation(params)))).toString("hex");
+			], buildAttestation(params)));
+			return removeStatus(bufWithStatus).toString("hex");
 		},
 		generateSeedFragment: async () => {
 			logger.info(`[device] generateSeedFragment`);
@@ -197,7 +198,8 @@ function createRealDevice(options, logger) {
 				buf.writeUInt32BE(derivation, 0);
 				return buf;
 			})]);
-			return removeStatus(await run((transport) => transport.send(224, 68, 0, 0, data))).toString("base64");
+			const response = await run((transport) => transport.send(224, 68, 0, 0, data));
+			return removeStatus(response).toString("base64");
 		},
 		generateWrappingKeyFragment: async () => {
 			logger.info(`[device] generateWrappingKeyFragment`);
@@ -207,10 +209,12 @@ function createRealDevice(options, logger) {
 				buf.writeUInt32BE(derivation, 0);
 				return buf;
 			})]);
-			return removeStatus(await run((transport) => transport.send(224, 68, 1, 0, data))).toString("base64");
+			const response = await run((transport) => transport.send(224, 68, 1, 0, data));
+			return removeStatus(response).toString("base64");
 		},
 		getAttestation: async () => {
-			const buffer = removeStatus(await run((transport) => transport.send(224, 65, 0, 0)));
+			const bufWithStatus = await run((transport) => transport.send(224, 65, 0, 0));
+			const buffer = removeStatus(bufWithStatus);
 			const certLen = buffer.readInt8(98);
 			return {
 				attestation: {
@@ -223,7 +227,8 @@ function createRealDevice(options, logger) {
 		},
 		getConfidentialityKey: async () => {
 			logger.info(`[device] getConfidentialityKey`);
-			const buf = removeStatus(await run((transport) => transport.send(224, 77, 0, 0)));
+			const bufWithStatus = await run((transport) => transport.send(224, 77, 0, 0));
+			const buf = removeStatus(bufWithStatus);
 			const keyLength = buf[0];
 			const key = buf.slice(1, 1 + keyLength);
 			const sig = buf.slice(1 + keyLength + 1);
@@ -235,7 +240,8 @@ function createRealDevice(options, logger) {
 		getConfidentialityPubKey: () => getPublicKey(PATHS.CONFIDENTIALITY, { secp256k1: true }),
 		getDeviceUserId: async () => {
 			logger.info(`[device] getDeviceUserId`);
-			return removeStatus(await run((transport) => transport.send(224, 82, 0, 0))).toString("hex").toUpperCase();
+			const response = await run((transport) => transport.send(224, 82, 0, 0));
+			return removeStatus(response).toString("hex").toUpperCase();
 		},
 		getU2FPubKey: () => getPublicKey(PATHS.U2F, { secp256k1: false }),
 		getValidationPubKey: () => getPublicKey(PATHS.VALIDATION, { secp256k1: true }),
@@ -343,7 +349,8 @@ function createRealDevice(options, logger) {
 			const { challenge: strChallenge } = params;
 			const challenge = Buffer.from(strChallenge, "hex");
 			invariant(challenge.length === 32, "challenge hex is expected to have 32 bytes");
-			return removeStatus(await run((transport) => transport.send(224, 3, 0, 0, challenge))).toString("hex");
+			const response = await run((transport) => transport.send(224, 3, 0, 0, challenge));
+			return removeStatus(response).toString("hex");
 		},
 		setPairing: async ({ pairing }) => {
 			logger.info(`[device] setPairing`);
@@ -376,12 +383,13 @@ function createRealDevice(options, logger) {
 		startKKPatternAsResponder: async (params) => {
 			logger.info(`[device] startKKPatternAsResponder`);
 			const data = buildAttestation(params);
-			const buffer = removeStatus(await run((transport) => sendByChunk(transport, [
+			const bufWithStatus = await run((transport) => sendByChunk(transport, [
 				224,
 				76,
 				0,
 				SCRIPT_IDS.ACCOUNT_MANAGER_SESSION
-			], data)));
+			], data));
+			const buffer = removeStatus(bufWithStatus);
 			const dataLength = buffer.readInt8(0);
 			return {
 				handshake: buffer.slice(1, dataLength + 1).toString("base64"),
@@ -490,9 +498,8 @@ const createClient = (options) => {
 };
 //#endregion
 //#region src/engine/index.ts
-const PSK_NONCE_BYTE_LEN = 32;
 const openSecureChannel = (device, challenge) => {
-	if (challenge.handshake.length === PSK_NONCE_BYTE_LEN * 2) return device.startPskSession({
+	if (challenge.handshake.length === 64) return device.startPskSession({
 		nonce: challenge.handshake,
 		partitionId: challenge.partitionId
 	});
@@ -660,55 +667,40 @@ function createEngine(options, logger) {
 		});
 		if (engine.device && engine.__onboardingId) decorate((engine) => {
 			const { device, client, __onboardingId } = engine;
-			const isPskEnabled = async () => {
-				try {
-					return await client.onboarding.getPskFeatureFlag.query({ onboardingId: __onboardingId }) === true;
-				} catch {
-					return false;
-				}
-			};
 			async function enforcePairing() {
 				const status = await device.hasPairing();
 				if (status === "OK") return;
-				const pskEnabled = await isPskEnabled();
 				let pubKeyPromise;
 				const getPubKey = async () => {
 					pubKeyPromise ??= device.getU2FPubKey().then(({ pubKey }) => pubKey);
 					return pubKeyPromise;
 				};
-				const pairCurrentDevice = async () => {
+				const refreshCurrentPsk = async () => {
 					const pubKey = await getPubKey();
-					await pairDevice({
+					await refreshPsk({
 						device,
-						getPairing: (confidentialityKey) => client.onboarding.pairDevicePartition.mutate({
+						getRefreshPskData: (data) => client.onboarding.refreshPsk.mutate({
 							pubKey,
 							onboardingId: __onboardingId,
-							data: {
-								confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
-								confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
-							}
+							data
 						})
 					});
 				};
-				const refreshCurrentPsk = async () => {
+				if (status === "NO_PAIRING") {
 					const pubKey = await getPubKey();
-					await refreshPsk({
+					await pairDevice({
 						device,
-						getRefreshPskData: (data) => client.onboarding.refreshPsk.mutate({
+						getPairing: (confidentialityKey) => client.onboarding.pairDevicePartition.mutate({
 							pubKey,
 							onboardingId: __onboardingId,
-							data
+							data: {
+								confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
+								confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
+							}
 						})
 					});
-				};
-				await match([status, pskEnabled]).with(["NO_PAIRING", false], async () => {
-					await pairCurrentDevice();
-				}).with(["NO_PAIRING", true], async () => {
-					await pairCurrentDevice();
-					await refreshCurrentPsk();
-				}).with(["PSK_MISSING", false], async () => {}).with(["PSK_MISSING", true], async () => {
-					await refreshCurrentPsk();
-				}).exhaustive();
+				}
+				await refreshCurrentPsk();
 			}
 			return {
 				claimDevice: async (params) => {
@@ -829,13 +821,14 @@ function createEngine(options, logger) {
 						workspaceName: __workspaceName
 					}, buildTrpcContext({ correlationId: opts?.correlationId }));
 					await opts?.onScreenDisplayed?.();
+					const authentication = await device.authenticate({
+						challenge,
+						workspaceName: __workspaceName
+					});
 					const authPayload = {
 						workspaceName: __workspaceName,
 						pubKey,
-						authentication: await device.authenticate({
-							challenge,
-							workspaceName: __workspaceName
-						}),
+						authentication,
 						challengeId: challenge.challengeId,
 						validityDurationSecs: opts?.validityDurationSecs
 					};
@@ -890,40 +883,23 @@ function createEngine(options, logger) {
 		});
 		if (engine.device && engine.__workspaceName && engine.__psdToken) decorate((engine) => {
 			const { client, device } = engine;
-			const isPskEnabled = async () => {
-				try {
-					return await client.debug.getPskFeatureFlag.query() === true;
-				} catch {
-					return false;
-				}
-			};
 			async function enforcePairing() {
 				const status = await device.hasPairing();
 				if (status === "OK") return;
-				const pskEnabled = await isPskEnabled();
-				const pairCurrentDevice = async () => {
-					await pairDevice({
-						device,
-						getPairing: (confidentialityKey) => client.debug.pairDevicePartition.mutate({
-							confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
-							confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
-						})
-					});
-				};
 				const refreshCurrentPsk = async () => {
 					await refreshPsk({
 						device,
 						getRefreshPskData: (data) => client.debug.refreshPsk.mutate(data)
 					});
 				};
-				await match([status, pskEnabled]).with(["NO_PAIRING", false], async () => {
-					await pairCurrentDevice();
-				}).with(["NO_PAIRING", true], async () => {
-					await pairCurrentDevice();
-					await refreshCurrentPsk();
-				}).with(["PSK_MISSING", false], async () => {}).with(["PSK_MISSING", true], async () => {
-					await refreshCurrentPsk();
-				}).exhaustive();
+				if (status === "NO_PAIRING") await pairDevice({
+					device,
+					getPairing: (confidentialityKey) => client.debug.pairDevicePartition.mutate({
+						confidentialityKeyCurve25519: confidentialityKey.confidentialityKeyCurve25519,
+						confidentialityKeySignature: confidentialityKey.confidentialityKeySignature
+					})
+				});
+				await refreshCurrentPsk();
 			}
 			const approveChallenge = async (challenge, params) => {
 				await enforcePairing();
@@ -931,11 +907,8 @@ function createEngine(options, logger) {
 					await openSecureChannel(device, challenge);
 				} catch (err) {
 					if (!isPskMissingError(err)) throw err;
-					if (!await isPskEnabled()) logger.warning("Discarding SW_PSK_MISSING: PSK secure channel is disabled");
-					else {
-						await enforcePairing();
-						await openSecureChannel(device, challenge);
-					}
+					await enforcePairing();
+					await openSecureChannel(device, challenge);
 				}
 				await params?.onScreenDisplayed?.();
 				return await device.validateVaultOperation({ actions: challenge.wActions });