@metamask-previews/profile-sync-controller 33.0.0-preview-452564c37 → 33.0.0-preview-c4f7eb130
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -11,6 +11,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|
|
11
11
|
|
|
12
12
|
- Bump `immer` from `^9.0.21` to `^11.1.18` ([#10382](https://github.com/MetaMask/core/pull/10382))
|
|
13
13
|
|
|
14
|
+
### Fixed
|
|
15
|
+
|
|
16
|
+
- Rely on `@metamask/key-tree` crypto implementation for HMAC-SHA-512 instead of hardcoded `noble` implementation ([#10424](https://github.com/MetaMask/core/pull/10424))
|
|
17
|
+
- `@metamask/key-tree` uses WebCrypto API if available and fallback to `noble` otherwise.
|
|
18
|
+
- One note, we expect the platform to provide a fully-compliant WebCrypto (`crypto.subtle`) implementation for this to work (`@metamask/key-tree` detection is global and not "per crypto functions").
|
|
19
|
+
|
|
14
20
|
## [33.0.0]
|
|
15
21
|
|
|
16
22
|
### Changed
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"message-signing.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"message-signing.d.ts","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,uCAAuC,CAAC;AAkC5E;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,IAAI,EACJ,KAAK,EACL,IAAS,GACV,EAAE;IACD,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,UAAU,EAChB,IAAI,SAAK,GACR,OAAO,CAAC,MAAM,CAAC,CAKjB"}
|
|
@@ -1,8 +1,7 @@
|
|
|
1
1
|
import { SLIP10Node } from '@metamask/key-tree';
|
|
2
2
|
import { assert, bytesToHex, concatBytes, createDataView, hexToBytes, stringToBytes, } from '@metamask/utils';
|
|
3
3
|
import { secp256k1 } from '@noble/curves/secp256k1';
|
|
4
|
-
import {
|
|
5
|
-
import { sha256, sha512 } from '@noble/hashes/sha2';
|
|
4
|
+
import { sha256 } from '@noble/hashes/sha2';
|
|
6
5
|
import { keccak_256 as keccak256 } from '@noble/hashes/sha3';
|
|
7
6
|
/**
|
|
8
7
|
* Native SIP-6 message-signing helpers for AuthenticationController /
|
|
@@ -40,17 +39,6 @@ export const MESSAGE_SIGNING_SNAP_ID = 'npm:@metamask/message-signing-snap';
|
|
|
40
39
|
*/
|
|
41
40
|
const SIP_6_MAGIC_VALUE = `1399742832'`;
|
|
42
41
|
const HARDENED_VALUE = 0x80000000;
|
|
43
|
-
/**
|
|
44
|
-
* HMAC-SHA-512 for `@metamask/key-tree`.
|
|
45
|
-
*
|
|
46
|
-
* Passed into `SLIP10Node.fromSeed` so SIP-6 never uses Web Crypto.
|
|
47
|
-
* `@metamask/key-tree` treats any `crypto.subtle` as complete and then HMAC
|
|
48
|
-
* via `importKey` / `sign`. React Native only implements `digest`; its
|
|
49
|
-
* SubtleCrypto cannot HMAC. Noble HMAC is byte-identical without SubtleCrypto.
|
|
50
|
-
*/
|
|
51
|
-
const NOBLE_HMAC_SHA512 = {
|
|
52
|
-
hmacSha512: async (key, data) => hmac(sha512, key, data),
|
|
53
|
-
};
|
|
54
42
|
/**
|
|
55
43
|
* Copy of `@metamask/snaps-rpc-methods` `getDerivationPathArray`.
|
|
56
44
|
*
|
|
@@ -90,7 +78,7 @@ export async function deriveSip6PrivateKey({ seed, input, salt = '', }) {
|
|
|
90
78
|
...computedDerivationPath,
|
|
91
79
|
],
|
|
92
80
|
curve: 'secp256k1',
|
|
93
|
-
}
|
|
81
|
+
});
|
|
94
82
|
assert(privateKey, 'Failed to derive SIP-6 entropy.');
|
|
95
83
|
return hexToBytes(privateKey);
|
|
96
84
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"message-signing.js","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,MAAM,EACN,UAAU,EACV,WAAW,EACX,cAAc,EACd,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"message-signing.js","sourceRoot":"","sources":["../../../src/shared/utils/message-signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACL,MAAM,EACN,UAAU,EACV,WAAW,EACX,cAAc,EACd,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oCAAoC,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,aAA6B,CAAC;AAExD,MAAM,cAAc,GAAG,UAAU,CAAC;AAElC;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAAgB;IAC9C,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,sCAAsC;QACtC,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,GAAG,cAAc,GAAY,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,IAAI,EACJ,KAAK,EACL,IAAI,GAAG,EAAE,GAKV;IACC,MAAM,IAAI,GAAG,SAAS,CACpB,WAAW,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;IACF,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE5D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC;QAC/C,cAAc,EAAE;YACd,IAAI;YACJ,SAAS,iBAAiB,EAAE;YAC5B,GAAG,sBAAsB;SAC1B;QACD,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IAEH,MAAM,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,OAAO,oBAAoB,CAAC;QAC1B,IAAI;QACJ,KAAK,EAAE,uBAAuB;QAC9B,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAAe,EACf,IAAgB,EAChB,IAAI,GAAG,EAAE;IAET,MAAM,UAAU,GAAG,MAAM,8BAA8B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrD,OAAO,KAAK,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;AACzC,CAAC","sourcesContent":["import type { HardenedBIP32Node } from '@metamask/key-tree';\nimport { SLIP10Node } from '@metamask/key-tree';\nimport {\n assert,\n bytesToHex,\n concatBytes,\n createDataView,\n hexToBytes,\n stringToBytes,\n} from '@metamask/utils';\nimport { secp256k1 } from '@noble/curves/secp256k1';\nimport { sha256 } from '@noble/hashes/sha2';\nimport { keccak_256 as keccak256 } from '@noble/hashes/sha3';\n\n/**\n * Native SIP-6 message-signing helpers for AuthenticationController /\n * UserStorageController.\n *\n * These are intentional copies of the message-signing snap crypto path so auth\n * and user-storage can derive/sign without booting\n * `npm:@metamask/message-signing-snap`. Behavior must stay byte-identical to:\n *\n * - SIP-6 derivation:\n * `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` /\n * `getEntropyDerivationPath` / `getDerivationPathArray`\n * (https://github.com/MetaMask/snaps/blob/main/packages/snaps-rpc-methods/src/utils.ts)\n * - Magic constant:\n * `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`\n * - Pubkey + `metamask:…` signing:\n * `@metamask/message-signing-snap` `getPublicEntropyKey` /\n * `signMessageWithEntropyKey`\n * (https://github.com/MetaMask/message-signing-snap/blob/main/src/entropy-keys.ts)\n *\n * `deriveEntropyFromSeed` is not a public export of\n * `@metamask/snaps-rpc-methods` today (and no core package depends on that\n * package), so the SIP-6 math is vendored here rather than imported.\n */\n\n/**\n * Snap ID used as the SIP-6 `input` so derived keys match\n * `@metamask/message-signing-snap` (`snap_getEntropy` origin).\n */\nexport const MESSAGE_SIGNING_SNAP_ID = 'npm:@metamask/message-signing-snap';\n\n/**\n * Copy of `@metamask/snaps-utils` `SIP_6_MAGIC_VALUE`\n * (`0xd36e6170 - 0x80000000`).\n *\n * @see https://metamask.github.io/SIPs/SIPS/sip-6\n */\nconst SIP_6_MAGIC_VALUE = `1399742832'` as `${number}'`;\n\nconst HARDENED_VALUE = 0x80000000;\n\n/**\n * Copy of `@metamask/snaps-rpc-methods` `getDerivationPathArray`.\n *\n * Maps a 32-byte hash to eight hardened BIP-32 indices for `@metamask/key-tree`.\n *\n * @param hash - 32-byte hash.\n * @returns Hardened BIP-32 path nodes.\n */\nfunction getDerivationPathArray(hash: Uint8Array): HardenedBIP32Node[] {\n const array: HardenedBIP32Node[] = [];\n const view = createDataView(hash);\n\n for (let index = 0; index < 8; index++) {\n const uint32 = view.getUint32(index * 4);\n // eslint-disable-next-line no-bitwise\n const pathIndex = (uint32 | HARDENED_VALUE) >>> 0;\n array.push(`bip32:${pathIndex - HARDENED_VALUE}'` as const);\n }\n\n return array;\n}\n\n/**\n * Copy of `@metamask/snaps-rpc-methods` `deriveEntropyFromSeed` (SIP-6),\n * returning raw private-key bytes instead of a `0x`-prefixed hex string.\n *\n * @param options - Derivation options.\n * @param options.seed - BIP-39 mnemonic seed.\n * @param options.input - SIP-6 input (snap ID for `snap_getEntropy`).\n * @param options.salt - Optional salt. Internal auth uses `''`.\n * @returns 32-byte private key.\n */\nexport async function deriveSip6PrivateKey({\n seed,\n input,\n salt = '',\n}: {\n seed: Uint8Array;\n input: string;\n salt?: string;\n}): Promise<Uint8Array> {\n const hash = keccak256(\n concatBytes([stringToBytes(input), keccak256(stringToBytes(salt))]),\n );\n const computedDerivationPath = getDerivationPathArray(hash);\n\n const { privateKey } = await SLIP10Node.fromSeed({\n derivationPath: [\n seed,\n `bip32:${SIP_6_MAGIC_VALUE}`,\n ...computedDerivationPath,\n ],\n curve: 'secp256k1',\n });\n\n assert(privateKey, 'Failed to derive SIP-6 entropy.');\n return hexToBytes(privateKey);\n}\n\n/**\n * Derives the message-signing private key via SIP-6, matching\n * `snap_getEntropy` for the message-signing snap with empty salt\n * (internal `metamask` origin).\n *\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns 32-byte private key.\n */\nexport async function deriveMessageSigningPrivateKey(\n seed: Uint8Array,\n salt = '',\n): Promise<Uint8Array> {\n return deriveSip6PrivateKey({\n seed,\n input: MESSAGE_SIGNING_SNAP_ID,\n salt,\n });\n}\n\n/**\n * Copy of message-signing-snap `getPublicEntropyKey`: secp256k1 pubkey hex\n * for the SIP-6 message-signing private key.\n *\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns Public key hex with `0x` prefix.\n */\nexport async function getMessageSigningPublicKey(\n seed: Uint8Array,\n salt = '',\n): Promise<string> {\n const privateKey = await deriveMessageSigningPrivateKey(seed, salt);\n return bytesToHex(secp256k1.getPublicKey(privateKey));\n}\n\n/**\n * Copy of message-signing-snap `signMessageWithEntropyKey`: sha256(message)\n * then compact secp256k1 signature.\n *\n * @param message - Message to sign (must be validated by the caller).\n * @param seed - BIP-39 mnemonic seed from an HD keyring.\n * @param salt - Optional SIP-6 salt. Auth / user-storage use `''`.\n * @returns Compact secp256k1 signature hex with `0x` prefix.\n */\nexport async function signMessageWithMessageSigningKey(\n message: string,\n seed: Uint8Array,\n salt = '',\n): Promise<string> {\n const privateKey = await deriveMessageSigningPrivateKey(seed, salt);\n const digest = sha256(message);\n const signature = secp256k1.sign(digest, privateKey);\n return `0x${signature.toCompactHex()}`;\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@metamask-previews/profile-sync-controller",
|
|
3
|
-
"version": "33.0.0-preview-
|
|
3
|
+
"version": "33.0.0-preview-c4f7eb130",
|
|
4
4
|
"description": "The profile sync helps developers synchronize data across multiple clients and devices in a privacy-preserving way. All data saved in the user storage database is encrypted client-side to preserve privacy. The user storage provides a modular design, giving developers the flexibility to construct and manage their storage spaces in a way that best suits their needs",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"Ethereum",
|
|
@@ -90,8 +90,8 @@
|
|
|
90
90
|
"loglevel": "^1.8.1"
|
|
91
91
|
},
|
|
92
92
|
"devDependencies": {
|
|
93
|
-
"@lavamoat/allow-scripts": "^
|
|
94
|
-
"@lavamoat/preinstall-always-fail": "^
|
|
93
|
+
"@lavamoat/allow-scripts": "^5.1.0",
|
|
94
|
+
"@lavamoat/preinstall-always-fail": "^3.0.0",
|
|
95
95
|
"@metamask/auto-changelog": "^6.2.1",
|
|
96
96
|
"@metamask/eth-hd-keyring": "^15.0.0",
|
|
97
97
|
"@metamask/keyring-api": "^24.0.0",
|
|
@@ -106,7 +106,7 @@
|
|
|
106
106
|
"jest-environment-jsdom": "^30.4.1",
|
|
107
107
|
"nock": "^13.5.6",
|
|
108
108
|
"rimraf": "^6.1.3",
|
|
109
|
-
"ts-jest": "^29.4.
|
|
109
|
+
"ts-jest": "^29.4.14",
|
|
110
110
|
"tsx": "^4.23.15",
|
|
111
111
|
"typedoc": "^0.25.13",
|
|
112
112
|
"typedoc-plugin-missing-exports": "^2.0.0",
|