@metamask-previews/kyc-controller 0.0.0-preview-eb263b0ee → 0.0.0-preview-c61613ed2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +4 -0
- package/dist/KycController-method-action-types.cjs.map +1 -1
- package/dist/KycController-method-action-types.d.cts +4 -2
- package/dist/KycController-method-action-types.d.cts.map +1 -1
- package/dist/KycController-method-action-types.d.mts +4 -2
- package/dist/KycController-method-action-types.d.mts.map +1 -1
- package/dist/KycController-method-action-types.mjs.map +1 -1
- package/dist/KycController.cjs +35 -10
- package/dist/KycController.cjs.map +1 -1
- package/dist/KycController.d.cts +4 -2
- package/dist/KycController.d.cts.map +1 -1
- package/dist/KycController.d.mts +4 -2
- package/dist/KycController.d.mts.map +1 -1
- package/dist/KycController.mjs +35 -10
- package/dist/KycController.mjs.map +1 -1
- package/dist/KycService-method-action-types.cjs.map +1 -1
- package/dist/KycService-method-action-types.d.cts +25 -8
- package/dist/KycService-method-action-types.d.cts.map +1 -1
- package/dist/KycService-method-action-types.d.mts +25 -8
- package/dist/KycService-method-action-types.d.mts.map +1 -1
- package/dist/KycService-method-action-types.mjs.map +1 -1
- package/dist/KycService.cjs +65 -29
- package/dist/KycService.cjs.map +1 -1
- package/dist/KycService.d.cts +48 -16
- package/dist/KycService.d.cts.map +1 -1
- package/dist/KycService.d.mts +48 -16
- package/dist/KycService.d.mts.map +1 -1
- package/dist/KycService.mjs +65 -29
- package/dist/KycService.mjs.map +1 -1
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +1 -1
- package/dist/index.d.cts.map +1 -1
- package/dist/index.d.mts +1 -1
- package/dist/index.d.mts.map +1 -1
- package/dist/index.mjs.map +1 -1
- package/dist/ukyc/constants.cjs +2 -2
- package/dist/ukyc/constants.cjs.map +1 -1
- package/dist/ukyc/constants.d.cts +2 -2
- package/dist/ukyc/constants.d.mts +2 -2
- package/dist/ukyc/constants.mjs +2 -2
- package/dist/ukyc/constants.mjs.map +1 -1
- package/dist/ukyc/jwtChain.cjs +1 -1
- package/dist/ukyc/jwtChain.cjs.map +1 -1
- package/dist/ukyc/jwtChain.d.cts +4 -4
- package/dist/ukyc/jwtChain.d.mts +4 -4
- package/dist/ukyc/jwtChain.mjs +1 -1
- package/dist/ukyc/jwtChain.mjs.map +1 -1
- package/dist/ukyc/wrapEncryptionKey.cjs +2 -3
- package/dist/ukyc/wrapEncryptionKey.cjs.map +1 -1
- package/dist/ukyc/wrapEncryptionKey.d.cts +6 -9
- package/dist/ukyc/wrapEncryptionKey.d.cts.map +1 -1
- package/dist/ukyc/wrapEncryptionKey.d.mts +6 -9
- package/dist/ukyc/wrapEncryptionKey.d.mts.map +1 -1
- package/dist/ukyc/wrapEncryptionKey.mjs +2 -3
- package/dist/ukyc/wrapEncryptionKey.mjs.map +1 -1
- package/package.json +1 -1
- package/dist/ukyc/wrapUserKey.cjs +0 -80
- package/dist/ukyc/wrapUserKey.cjs.map +0 -1
- package/dist/ukyc/wrapUserKey.d.cts +0 -26
- package/dist/ukyc/wrapUserKey.d.cts.map +0 -1
- package/dist/ukyc/wrapUserKey.d.mts +0 -26
- package/dist/ukyc/wrapUserKey.d.mts.map +0 -1
- package/dist/ukyc/wrapUserKey.mjs +0 -76
- package/dist/ukyc/wrapUserKey.mjs.map +0 -1
package/dist/KycController.d.cts
CHANGED
|
@@ -327,8 +327,10 @@ export declare class KycController extends BaseController<typeof controllerName,
|
|
|
327
327
|
* Runs the SumSub document-verification sub-flow end to end:
|
|
328
328
|
*
|
|
329
329
|
* 1. creates a UKYC session, receiving per-secret encryption schemas;
|
|
330
|
-
* 2. verifies
|
|
331
|
-
* the
|
|
330
|
+
* 2. verifies the `encryptionDataKey` schema's `jwtChain` against the
|
|
331
|
+
* idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against
|
|
332
|
+
* the idOS relay JWKS, then confirms each attested session server public
|
|
333
|
+
* key;
|
|
332
334
|
* 3. derives the `data_encryption_key` from the wallet's UKYC
|
|
333
335
|
* `local_user_secret` and wraps it for the session server;
|
|
334
336
|
* 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"KycController.d.cts","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EACV,4CAA4C,EAC5C,4CAA4C,EAC7C,uDAAuD;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;
|
|
1
|
+
{"version":3,"file":"KycController.d.cts","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EACV,4CAA4C,EAC5C,4CAA4C,EAC7C,uDAAuD;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;AAO5C,OAAO,KAAK,EAAE,0BAA0B,EAAE,gDAA+C;AACzF,OAAO,KAAK,EAAE,uBAAuB,EAAE,6CAA4C;AAKnF,OAAO,KAAK,EAEV,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,SAAS,EACV,oBAAmB;AAcpB,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAsF9C;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,0CAA0C;IAC1C,KAAK,EAAE,QAAQ,CAAC;IAChB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,yEAAyE;IACzE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gEAAgE;IAChE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,mBAAmB,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC;;;;;OAKG;IACH,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,iCAAiC,EAAE,OAAO,GAAG,IAAI,CAAC;IAElD,mDAAmD;IACnD,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,8DAA8D;IAC9D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,kBAAkB,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEjD,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,wDAAwD;IACxD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uDAAuD;IACvD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC;;;;OAIG;IACH,YAAY,EAAE,SAAS,CAAC;IAExB;;;;;;OAMG;IACH,aAAa,EAAE,UAAU,GAAG,IAAI,CAAC;IAEjC,+DAA+D;IAC/D,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,qEAAqE;IACrE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;OAIG;IACH,UAAU,EAAE,aAAa,GAAG,IAAI,CAAC;IACjC,+DAA+D;IAC/D,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,mDAAmD;IACnD,MAAM,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC;;;WAGG;QACH,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACxC,CAAC;CACH,CAAC;AA2JF;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,kBAAkB,CAkCjE;AAuHD,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAChE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,KAAK,cAAc,GACf,uBAAuB,GACvB,4CAA4C,GAC5C,4CAA4C,CAAC;AAEjD,MAAM,MAAM,6BAA6B,GAAG,0BAA0B,CACpE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE;QACP;YACE,MAAM,EAAE,aAAa,CAAC;YACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;YAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;SAC1B;KACF,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,6BAA6B,GAC7B,+BAA+B,CAAC;AAEpC,KAAK,aAAa,GAAG,KAAK,CAAC;AAE3B,MAAM,MAAM,sBAAsB,GAAG,SAAS,CAC5C,OAAO,cAAc,EACrB,oBAAoB,GAAG,cAAc,EACrC,mBAAmB,GAAG,aAAa,CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpC;;;OAGG;IACH,cAAc,EAAE,iBAAiB,CAAC;IAClC;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,CAAC;AAuBF;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,cAAc,CAC/C,OAAO,cAAc,EACrB,kBAAkB,EAClB,sBAAsB,CACvB;;IAkDC;;;;;;;;;;;OAWG;gBACS,EACV,SAAS,EACT,KAAK,EACL,cAAc,EACd,2BAAqE,EACrE,wBAA+D,GAChE,EAAE,oBAAoB;IAmDvB;;;;;;;;;;;;;OAaG;IACG,UAAU,CAAC,MAAM,CAAC,EAAE;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,MAAM,CAAC,EAAE,SAAS,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqHjB;;;;;;;;;;;;OAYG;IACG,oBAAoB,CAAC,MAAM,EAAE;QACjC,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjB;;;;;OAKG;IACG,eAAe,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCnE;;;;;;;;;;;;;;;;OAgBG;IACG,0BAA0B,CAAC,MAAM,EAAE;QACvC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,eAAe,EAAE,OAAO,CAAC;QACzB,aAAa,EAAE,OAAO,CAAC;QACvB,iCAAiC,CAAC,EAAE,OAAO,CAAC;KAC7C,GAAG,OAAO,CAAC,IAAI,CAAC;IAuXjB;;OAEG;IACH,eAAe,IAAI,IAAI;IAuEvB;;;;;;;;;OASG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAC/B,OAAO,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAkMhC;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAYnC;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAWlC;;;;OAIG;IACH,kBAAkB,IAAI,MAAM;IAM5B;;;;;;;OAOG;IACG,gBAAgB,CAAC,MAAM,EAAE;QAC7B,OAAO,EAAE,UAAU,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,OAAO,CAAC;IA+CpB;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,GAAG,SAAS;IAIlE;;;;;;;;;;;;OAYG;IACH,mBAAmB,IAAI,mBAAmB,GAAG,IAAI;IAkKjD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAoKpC;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,MAAM,EAAE,aAAa,CAAC;QACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IAoIF;;;;;;;OAOG;IACG,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAmHnD;;;OAGG;IACH,KAAK,IAAI,IAAI;IAyBb;;;;;;;OAOG;IACH,UAAU,IAAI,IAAI;CA4FnB"}
|
package/dist/KycController.d.mts
CHANGED
|
@@ -327,8 +327,10 @@ export declare class KycController extends BaseController<typeof controllerName,
|
|
|
327
327
|
* Runs the SumSub document-verification sub-flow end to end:
|
|
328
328
|
*
|
|
329
329
|
* 1. creates a UKYC session, receiving per-secret encryption schemas;
|
|
330
|
-
* 2. verifies
|
|
331
|
-
* the
|
|
330
|
+
* 2. verifies the `encryptionDataKey` schema's `jwtChain` against the
|
|
331
|
+
* idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against
|
|
332
|
+
* the idOS relay JWKS, then confirms each attested session server public
|
|
333
|
+
* key;
|
|
332
334
|
* 3. derives the `data_encryption_key` from the wallet's UKYC
|
|
333
335
|
* `local_user_secret` and wraps it for the session server;
|
|
334
336
|
* 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"KycController.d.mts","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EACV,4CAA4C,EAC5C,4CAA4C,EAC7C,uDAAuD;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;
|
|
1
|
+
{"version":3,"file":"KycController.d.mts","sourceRoot":"","sources":["../src/KycController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAE3B,kCAAkC;AACnC,OAAO,EAAE,cAAc,EAAE,kCAAkC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,4BAA4B;AACrD,OAAO,KAAK,EACV,4CAA4C,EAC5C,4CAA4C,EAC7C,uDAAuD;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,wBAAwB;AAO5C,OAAO,KAAK,EAAE,0BAA0B,EAAE,gDAA+C;AACzF,OAAO,KAAK,EAAE,uBAAuB,EAAE,6CAA4C;AAKnF,OAAO,KAAK,EAEV,mBAAmB,EACnB,aAAa,EACb,QAAQ,EACR,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,SAAS,EACV,oBAAmB;AAcpB,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAsF9C;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,0CAA0C;IAC1C,KAAK,EAAE,QAAQ,CAAC;IAChB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB,yEAAyE;IACzE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gEAAgE;IAChE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,mBAAmB,EAAE,SAAS,GAAG,IAAI,CAAC;IACtC;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC;;;;;OAKG;IACH,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,iCAAiC,EAAE,OAAO,GAAG,IAAI,CAAC;IAElD,mDAAmD;IACnD,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,8DAA8D;IAC9D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;OAIG;IACH,kBAAkB,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEjD,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,wDAAwD;IACxD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uDAAuD;IACvD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC;;;;OAIG;IACH,YAAY,EAAE,SAAS,CAAC;IAExB;;;;;;OAMG;IACH,aAAa,EAAE,UAAU,GAAG,IAAI,CAAC;IAEjC,+DAA+D;IAC/D,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,qEAAqE;IACrE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B;;;;OAIG;IACH,UAAU,EAAE,aAAa,GAAG,IAAI,CAAC;IACjC,+DAA+D;IAC/D,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC,mDAAmD;IACnD,MAAM,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC;;;WAGG;QACH,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;KACxC,CAAC;CACH,CAAC;AA2JF;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,kBAAkB,CAkCjE;AAuHD,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAChE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,KAAK,cAAc,GACf,uBAAuB,GACvB,4CAA4C,GAC5C,4CAA4C,CAAC;AAEjD,MAAM,MAAM,6BAA6B,GAAG,0BAA0B,CACpE,OAAO,cAAc,EACrB,kBAAkB,CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,GAAG,OAAO,cAAc,gBAAgB,CAAC;IAC/C,OAAO,EAAE;QACP;YACE,MAAM,EAAE,aAAa,CAAC;YACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;YAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;SAC1B;KACF,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,6BAA6B,GAC7B,+BAA+B,CAAC;AAEpC,KAAK,aAAa,GAAG,KAAK,CAAC;AAE3B,MAAM,MAAM,sBAAsB,GAAG,SAAS,CAC5C,OAAO,cAAc,EACrB,oBAAoB,GAAG,cAAc,EACrC,mBAAmB,GAAG,aAAa,CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpC;;;OAGG;IACH,cAAc,EAAE,iBAAiB,CAAC;IAClC;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC,CAAC;AAuBF;;;;;;GAMG;AACH,qBAAa,aAAc,SAAQ,cAAc,CAC/C,OAAO,cAAc,EACrB,kBAAkB,EAClB,sBAAsB,CACvB;;IAkDC;;;;;;;;;;;OAWG;gBACS,EACV,SAAS,EACT,KAAK,EACL,cAAc,EACd,2BAAqE,EACrE,wBAA+D,GAChE,EAAE,oBAAoB;IAmDvB;;;;;;;;;;;;;OAaG;IACG,UAAU,CAAC,MAAM,CAAC,EAAE;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,MAAM,CAAC,EAAE,SAAS,CAAC;KACpB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqHjB;;;;;;;;;;;;OAYG;IACG,oBAAoB,CAAC,MAAM,EAAE;QACjC,MAAM,EAAE,SAAS,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjB;;;;;OAKG;IACG,eAAe,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCnE;;;;;;;;;;;;;;;;OAgBG;IACG,0BAA0B,CAAC,MAAM,EAAE;QACvC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,eAAe,EAAE,OAAO,CAAC;QACzB,aAAa,EAAE,OAAO,CAAC;QACvB,iCAAiC,CAAC,EAAE,OAAO,CAAC;KAC7C,GAAG,OAAO,CAAC,IAAI,CAAC;IAuXjB;;OAEG;IACH,eAAe,IAAI,IAAI;IAuEvB;;;;;;;;;OASG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAC/B,OAAO,EAAE,OAAO,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAkMhC;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAYnC;;;;OAIG;IACH,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAWlC;;;;OAIG;IACH,kBAAkB,IAAI,MAAM;IAM5B;;;;;;;OAOG;IACG,gBAAgB,CAAC,MAAM,EAAE;QAC7B,OAAO,EAAE,UAAU,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,OAAO,CAAC;IA+CpB;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,GAAG,SAAS;IAIlE;;;;;;;;;;;;OAYG;IACH,mBAAmB,IAAI,mBAAmB,GAAG,IAAI;IAkKjD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,WAAW,CAAC,MAAM,CAAC,EAAE;QACzB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAoKpC;;;;;;OAMG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,MAAM,EAAE,aAAa,CAAC;QACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC;IAoIF;;;;;;;OAOG;IACG,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAmHnD;;;OAGG;IACH,KAAK,IAAI,IAAI;IAyBb;;;;;;;OAOG;IACH,UAAU,IAAI,IAAI;CA4FnB"}
|
package/dist/KycController.mjs
CHANGED
|
@@ -14,6 +14,7 @@ import { BaseController } from "@metamask/base-controller";
|
|
|
14
14
|
import { stringToBytes } from "@metamask/utils";
|
|
15
15
|
import { x25519 } from "@noble/curves/ed25519";
|
|
16
16
|
import { decryptCredentials, generateKeyPair } from "./crypto.mjs";
|
|
17
|
+
import { toBase64Url } from "./encoding.mjs";
|
|
17
18
|
import { deriveClientMaterial } from "./ukyc/deriveClientMaterial.mjs";
|
|
18
19
|
import { verifyJwtChain } from "./ukyc/jwtChain.mjs";
|
|
19
20
|
import { getOrCreateLocalUserSecret } from "./ukyc/localUserSecret.mjs";
|
|
@@ -916,8 +917,10 @@ export class KycController extends BaseController {
|
|
|
916
917
|
* Runs the SumSub document-verification sub-flow end to end:
|
|
917
918
|
*
|
|
918
919
|
* 1. creates a UKYC session, receiving per-secret encryption schemas;
|
|
919
|
-
* 2. verifies
|
|
920
|
-
* the
|
|
920
|
+
* 2. verifies the `encryptionDataKey` schema's `jwtChain` against the
|
|
921
|
+
* idOS enclave JWKS and the `ukycCapabilityToken` schema's `jwtChain` against
|
|
922
|
+
* the idOS relay JWKS, then confirms each attested session server public
|
|
923
|
+
* key;
|
|
921
924
|
* 3. derives the `data_encryption_key` from the wallet's UKYC
|
|
922
925
|
* `local_user_secret` and wraps it for the session server;
|
|
923
926
|
* 4. mints a client-signed, read-only `ukyc_capability_token`, wraps it the
|
|
@@ -1595,22 +1598,44 @@ async function _KycController_continueAfterAuthentication() {
|
|
|
1595
1598
|
async function _KycController_createUkycSession(generation) {
|
|
1596
1599
|
const jwtToken = MOCK_JWT_TOKEN;
|
|
1597
1600
|
// Establish a per-session X25519 keypair used to seal both secrets. The
|
|
1598
|
-
// private half stays on the device;
|
|
1599
|
-
//
|
|
1601
|
+
// private half stays on the device; the public half is registered on the
|
|
1602
|
+
// session so the server can open later authorizations. Each encryption
|
|
1603
|
+
// schema from session creation supplies the matching server public key.
|
|
1600
1604
|
const sessionClientPrivateKey = x25519.utils.randomSecretKey();
|
|
1605
|
+
const sessionClientPublicKey = toBase64Url(x25519.getPublicKey(sessionClientPrivateKey));
|
|
1606
|
+
// Residence is the ISO 3166-1 alpha-3 country already resolved for
|
|
1607
|
+
// disclaimers / KYC-required; fetch it if this sub-flow started without
|
|
1608
|
+
// that earlier step.
|
|
1609
|
+
const residenceCountry = this.state.geoCountry ??
|
|
1610
|
+
(await this.messenger.call('KycService:getGeoCountry'));
|
|
1611
|
+
if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
|
|
1612
|
+
return null;
|
|
1613
|
+
}
|
|
1614
|
+
if (residenceCountry !== this.state.geoCountry) {
|
|
1615
|
+
__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_updateIfCurrent).call(this, generation, (state) => {
|
|
1616
|
+
state.geoCountry = residenceCountry;
|
|
1617
|
+
});
|
|
1618
|
+
}
|
|
1601
1619
|
const { sessionId, encryptionDataKey, ukycCapabilityToken: capabilityTokenSchema, } = await this.messenger.call('KycService:createUkycSession', {
|
|
1602
1620
|
jwtToken,
|
|
1621
|
+
sessionClientPublicKey,
|
|
1622
|
+
residenceCountry,
|
|
1603
1623
|
...__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_buildUkycSessionVendorFields).call(this),
|
|
1604
1624
|
});
|
|
1605
1625
|
if (__classPrivateFieldGet(this, _KycController_generation, "f") !== generation) {
|
|
1606
1626
|
return null;
|
|
1607
1627
|
}
|
|
1608
|
-
// Verify each jwtChain against
|
|
1609
|
-
// server public key matches the value attested inside
|
|
1610
|
-
// payload before trusting it for wrapping.
|
|
1611
|
-
|
|
1612
|
-
|
|
1613
|
-
|
|
1628
|
+
// Verify each schema's jwtChain against the matching issuer JWKS, then
|
|
1629
|
+
// confirm the returned server public key matches the value attested inside
|
|
1630
|
+
// the verified JWT payload before trusting it for wrapping.
|
|
1631
|
+
// `encryptionDataKey` is attested by the idOS enclave; `ukycCapabilityToken` by the
|
|
1632
|
+
// idOS relay.
|
|
1633
|
+
const [{ keys: idosEnclaveKeys }, { keys: idosRelayKeys }] = await Promise.all([
|
|
1634
|
+
this.messenger.call('KycService:fetchIdosEnclaveJwks'),
|
|
1635
|
+
this.messenger.call('KycService:fetchIdosRelayJwks'),
|
|
1636
|
+
]);
|
|
1637
|
+
__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, idosEnclaveKeys, encryptionDataKey);
|
|
1638
|
+
__classPrivateFieldGet(this, _KycController_instances, "m", _KycController_assertAttestedServerPublicKey).call(this, idosRelayKeys, capabilityTokenSchema);
|
|
1614
1639
|
// Derive the data_encryption_key from the local_user_secret, mint a
|
|
1615
1640
|
// read-only capability token, and wrap both for the session server. Only
|
|
1616
1641
|
// the wrapped (encrypted) material ever leaves the device.
|