@nevermined-io/core-kit 1.9.0 → 1.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -11,6 +11,15 @@ export declare class NvmApiKey implements JWTPayload {
|
|
|
11
11
|
* The chain id of the network the key is valid for. If zero the key is not having any network limitation
|
|
12
12
|
*/
|
|
13
13
|
aud?: string;
|
|
14
|
+
/**
|
|
15
|
+
* RFC 8707 resource indicator (the credential's audience) — the resource server this key is
|
|
16
|
+
* confined to, e.g. `https://api.<tier>.nevermined.app` (#2432). NVM uses `rsc` rather than the
|
|
17
|
+
* standard `aud` because `aud` already carries the chain id (above). Set only on the OAuth mint
|
|
18
|
+
* path from the AgentBinding's `resource`; absent ⇒ unrestricted (dashboard/CLI/legacy keys).
|
|
19
|
+
* MUST be left `undefined` (never `null`) when absent so it is omitted from `JSON.stringify(this)`
|
|
20
|
+
* and the key's `hash()` stays byte-identical to a pre-#2432 key.
|
|
21
|
+
*/
|
|
22
|
+
rsc?: string;
|
|
14
23
|
/**
|
|
15
24
|
* The public address of the account the key is issued for.
|
|
16
25
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"NvmApiKey.d.ts","sourceRoot":"","sources":["../../src/models/NvmApiKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,MAAM,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAIvD,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAGtE,qBAAa,SAAU,YAAW,UAAU;IAC1C;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;OAEG;IACH,GAAG,SAAO;IAEV;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE7B;;OAEG;IAGH;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAA;IAEvB;;;;;;;;;;;OAWG;WACiB,QAAQ,CAC1B,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,OAAO,GAAG,YAAY,EACrC,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,iBAAiB,EAAE,MAAM,EACzB,cAAc,GAAE,MAAM,GAAG,MAAa,EACtC,gBAAgB,KAAK,EACrB,gBAAgB,SAAO,GACtB,OAAO,CAAC,MAAM,CAAC;IA4BlB;;;;;OAKG;WACiB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAK7E;;;;OAIG;WACiB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAcxE;;;;OAIG;IACI,OAAO,CAAC,OAAO,SAAI,GAAG,OAAO;IAiBpC;;;;;OAKG;IACU,KAAK,CAChB,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,OAAO,GAAG,YAAY,GACpC,OAAO,CAAC,MAAM,CAAC;IAalB;;;;;OAKG;IACU,OAAO,CAClB,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,OAAO,GAAG,YAAY,EACrC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"NvmApiKey.d.ts","sourceRoot":"","sources":["../../src/models/NvmApiKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,MAAM,CAAA;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAIvD,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAGtE,qBAAa,SAAU,YAAW,UAAU;IAC1C;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;OAEG;IACH,GAAG,SAAO;IAEV;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE7B;;OAEG;IAGH;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IAEZ;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAA;IAEvB;;;;;;;;;;;OAWG;WACiB,QAAQ,CAC1B,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,OAAO,GAAG,YAAY,EACrC,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,EACvB,iBAAiB,EAAE,MAAM,EACzB,cAAc,GAAE,MAAM,GAAG,MAAa,EACtC,gBAAgB,KAAK,EACrB,gBAAgB,SAAO,GACtB,OAAO,CAAC,MAAM,CAAC;IA4BlB;;;;;OAKG;WACiB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAK7E;;;;OAIG;WACiB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAcxE;;;;OAIG;IACI,OAAO,CAAC,OAAO,SAAI,GAAG,OAAO;IAiBpC;;;;;OAKG;IACU,KAAK,CAChB,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,OAAO,GAAG,YAAY,GACpC,OAAO,CAAC,MAAM,CAAC;IAalB;;;;;OAKG;IACU,OAAO,CAClB,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,OAAO,GAAG,YAAY,EACrC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC;IAkBlB;;;;OAIG;WACW,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,SAAS;IAYlD;;;;OAIG;WACW,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS;IAKnD;;;;OAIG;WACW,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IAIjD;;;OAGG;IACI,SAAS,IAAI,MAAM;IAI1B;;;OAGG;IACI,QAAQ,IAAI,MAAM;IAIzB;;;;OAIG;WACW,SAAS,CAAC,GAAG,EAAE,MAAM;IAInC;;;OAGG;IACI,IAAI;IAIX;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM;CAG/B"}
|
package/dist/models/NvmApiKey.js
CHANGED
|
@@ -114,7 +114,8 @@ export class NvmApiKey {
|
|
|
114
114
|
sub: this.iss,
|
|
115
115
|
jti: this.hash(),
|
|
116
116
|
exp: this.exp,
|
|
117
|
-
o11y: heliconeApiKey
|
|
117
|
+
o11y: heliconeApiKey,
|
|
118
|
+
rsc: this.rsc
|
|
118
119
|
}).setProtectedHeader({
|
|
119
120
|
alg: 'ES256K'
|
|
120
121
|
})// .setIssuedAt() // WARNING: If enabled, the hash will change for the same NvmApiKey
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../src/models/NvmApiKey.ts"],"sourcesContent":["import { JWTPayload, decodeJwt } from 'jose'\nimport { Account } from 'viem'\nimport { SmartAccount } from 'viem/account-abstraction'\nimport { bytesToHex } from 'viem/utils'\nimport { getChecksumAddress } from '../nevermined/utils/BlockchainViemUtils.js'\nimport { EthSignJWT } from '../nevermined/utils/JwtUtils.js'\nimport { SignatureUtils } from '../nevermined/utils/SignatureUtils.js'\nimport { decryptMessage, encryptMessage, urlSafeBase64Decode } from '../utils/helpers.js'\n\nexport class NvmApiKey implements JWTPayload {\n /**\n * The public address of the account issuing the key.\n */\n iss?: string\n\n /**\n * The chain id of the network the key is valid for. If zero the key is not having any network limitation\n */\n aud?: string\n\n /**\n * The public address of the account the key is issued for.\n */\n sub?: string\n\n /**\n * The version of the key\n */\n ver = 'v1'\n\n /**\n * The ZeroDev session key (primary network). Kept for back-compat and as the\n * fallback when `zsks` has no entry for the requested network.\n */\n zsk?: string\n\n /**\n * Per-network ZeroDev session keys (#1929), keyed by chainId. Each carries\n * that network's chain-bound enable signature, so a single API key works on\n * every supported network. The backend selects the entry for the operation's\n * chain; absent → fall back to `zsk`.\n */\n zsks?: Record<string, string>\n\n /**\n * The Marketplace auth token\n */\n // nvt?: string\n\n /**\n * JWT Expiration Time\n *\n * @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4 RFC7519#section-4.1.4}\n */\n exp?: number\n\n /**\n * JWT Issued At\n *\n * @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}\n */\n iat?: number;\n\n /**\n * Additional attributes\n */\n [propName: string]: any\n\n /**\n * It generates a new serialized and encrypted NvmApiKey including the ZeroDev session key and the Marketplace auth token.\n * The string representing this key can be used to authenticate against the Nevermined API.\n * @param signatureUtils The SignatureUtils instance\n * @param issuerAccount The account issuing the key\n * @param zeroDevSessionKey The ZeroDev session key\n * @param receiverAddress The address of the account the key is issued for\n * @param receiverPublicKey The public key of the account the key is issued for\n * @param chainId The chain id of the network the key is valid for\n * @param additionalParams Addintional params to be added to the Key generated\n * @returns The encrypted string representing the @see {@link NvmApiKey}\n */\n public static async generate(\n signatureUtils: SignatureUtils,\n issuerAccount: Account | SmartAccount,\n zeroDevSessionKey: string | undefined,\n receiverAddress: string,\n receiverPublicKey: string,\n expirationTime: number | string = '1y',\n additionalParams = {},\n nvmApiKeyVersion = 'v1',\n ): Promise<string> {\n const issuerAddress = getChecksumAddress(issuerAccount.address)\n const chainId = signatureUtils.client.chain?.id || 0\n const sub = getChecksumAddress(receiverAddress)\n\n const eip712Data = {\n message: 'Sign this message to generate the Encrypted Nevermined API Key',\n ...(chainId > 0 && { chainId }),\n }\n const params = {\n iss: issuerAddress,\n aud: chainId.toString(),\n sub,\n ver: nvmApiKeyVersion,\n zsk: zeroDevSessionKey,\n eip712Data,\n ...additionalParams,\n }\n\n const signedJWT = await new EthSignJWT(params)\n .setProtectedHeader({ alg: 'ES256K' })\n .setIssuedAt()\n .setExpirationTime(expirationTime)\n .ethSign(signatureUtils, issuerAccount)\n\n return encryptMessage(signedJWT, receiverPublicKey)\n }\n\n /**\n * Given an encrypted JWT and a private key, it decrypts and decodes the JWT into a NvmApiKey\n * @param encryptedJwt The encrypted JWT\n * @param privateKey The private key representing the account\n * @returns The @see {@link NvmApiKey}\n */\n public static async decryptAndDecode(encryptedJwt: string, privateKey: string) {\n const decrypted = await decryptMessage(encryptedJwt, privateKey)\n return NvmApiKey.fromJWT(decrypted)\n }\n\n /**\n * Given a signed JWT, it recovers the signer address\n * @param jwtString The signed JWT\n * @returns The signer address\n */\n public static async getSignerAddress(jwtString: string): Promise<string> {\n try {\n const tokens = jwtString.split('.')\n const signature = bytesToHex(urlSafeBase64Decode(tokens[2]))\n return SignatureUtils.recoverSignerAddress(`${tokens[0]}.${tokens[1]}`, signature)\n } catch (e) {\n if (e instanceof Error) {\n throw new Error(`Error recovering signer address: ${e.message}`)\n } else {\n throw new Error(`Error recovering signer address`)\n }\n }\n }\n\n /**\n * It checks if the NVM API Key attributes are valid\n * @param chainId The chain id of the network the key is valid for\n * @returns true if the key is valid, false otherwise\n */\n public isValid(chainId = 0): boolean {\n if (this.exp) {\n const now = new Date()\n if (now.getTime() > Number(this.exp) * 1000) return false\n }\n if (chainId !== 0) {\n // #1929: a multi-network key's real per-network validity lives in `zsks`\n // (keyed by chainId); `aud` is only the primary-network hint. Consult\n // `zsks` first — otherwise `isValid(secondaryChain)` wrongly returns false\n // for a valid key (e.g. aud=8453, zsks={8453,4217} → isValid(4217)). Fall\n // back to the `aud` check for legacy single-network keys.\n if (this.zsks?.[String(chainId)]) return true\n if (Number(this.aud) !== chainId) return false\n }\n return true\n }\n\n /**\n * It generates a signed JWT from the NvmApiKey\n * @param signatureUtils The SignatureUtils instance\n * @param issuerAccount The account issuing the key\n * @returns the string in JWT format represeting the NvmApiKey\n */\n public async toJWT(\n signatureUtils: SignatureUtils,\n issuerAccount: Account | SmartAccount,\n ): Promise<string> {\n const params: Record<string, any> = {}\n Object.keys(this)\n .filter((val) => val !== undefined)\n .forEach((key) => {\n if (!key.startsWith('_')) params[key] = this[key]\n })\n\n const jwt = new EthSignJWT(params).setProtectedHeader({ alg: 'ES256K' }).setIssuedAt(this.iat)\n if (this.exp) jwt.setExpirationTime(this.exp)\n return jwt.ethSign(signatureUtils, issuerAccount)\n }\n\n /**\n * It generates the hash in JWT format of the NvmApiKey\n * @param signatureUtils the SignatureUtils instance\n * @param issuerAccount the account issuing the key\n * @returns a JWT string representing the hash of the NvmApiKey\n */\n public async hashJWT(\n signatureUtils: SignatureUtils,\n issuerAccount: Account | SmartAccount,\n heliconeApiKey?: string,\n ): Promise<string> {\n const issuerAddress = getChecksumAddress(issuerAccount.address)\n\n return (\n new EthSignJWT({\n iss: issuerAddress, // the account generating the hash (node/provider, etc) is the issuer of the hash\n sub: this.iss, // the issuer of the NVMApiKey (the user) is the subject of the hash\n jti: this.hash(),\n exp: this.exp,\n o11y: heliconeApiKey,\n })\n .setProtectedHeader({ alg: 'ES256K' })\n // .setIssuedAt() // WARNING: If enabled, the hash will change for the same NvmApiKey\n .ethSign(signatureUtils, issuerAccount)\n )\n }\n\n /**\n * It regenerates the NvmApiKey from a JSON object\n * @param jwt JWTPayload in JSON format\n * @returns the @see {@link NvmApiKey}\n */\n public static fromJSON(jwt: JWTPayload): NvmApiKey {\n const nvmKey = new NvmApiKey()\n const str = JSON.stringify(jwt)\n const _obj = JSON.parse(str)\n Object.keys(_obj)\n .filter((val) => val !== undefined)\n .forEach((key) => {\n nvmKey[key] = _obj[key]\n })\n return nvmKey\n }\n\n /**\n * It regenerates the NvmApiKey from a JWT\n * @param jwtString the string in JWT format represeting the NvmApiKey\n * @returns the @see {@link NvmApiKey}\n */\n public static fromJWT(jwtString: string): NvmApiKey {\n const jwt = NvmApiKey.decodeJWT(jwtString)\n return NvmApiKey.fromJSON(jwt)\n }\n\n /**\n * It regenerates the NvmApiKey from a string\n * @param str the string represeting the NvmApiKey\n * @returns the @see {@link NvmApiKey}\n */\n public static deserialize(str: string): NvmApiKey {\n return NvmApiKey.fromJSON(JSON.parse(str))\n }\n\n /**\n * It serializes the NVM Api Key into a string\n * @returns a string representing the NVM API Key\n */\n public serialize(): string {\n return this.toString()\n }\n\n /**\n * It serializes the NVM Api Key into a string\n * @returns a string representing the NVM API Key\n */\n public toString(): string {\n return JSON.stringify(this)\n }\n\n /**\n * It decodes a string JWT into a JWTPayload\n * @param str jwt string\n * @returns the JWTPayload\n */\n public static decodeJWT(str: string) {\n return decodeJwt(str)\n }\n\n /**\n * It generates the hash of the NvmApiKey\n * @returns a string representing the hash of the NvmApiKey\n */\n public hash() {\n return SignatureUtils.hash(this.serialize())\n }\n\n /**\n * Given a serialized string, it generates the hash\n * @param serialized the serialized string\n * @returns the hash\n */\n static hash(serialized: string) {\n return SignatureUtils.hash(serialized)\n }\n}\n"],"names":["decodeJwt","bytesToHex","getChecksumAddress","EthSignJWT","SignatureUtils","decryptMessage","encryptMessage","urlSafeBase64Decode","NvmApiKey","generate","signatureUtils","issuerAccount","zeroDevSessionKey","receiverAddress","receiverPublicKey","expirationTime","additionalParams","nvmApiKeyVersion","issuerAddress","address","chainId","client","chain","id","sub","eip712Data","message","params","iss","aud","toString","ver","zsk","signedJWT","setProtectedHeader","alg","setIssuedAt","setExpirationTime","ethSign","decryptAndDecode","encryptedJwt","privateKey","decrypted","fromJWT","getSignerAddress","jwtString","tokens","split","signature","recoverSignerAddress","e","Error","isValid","exp","now","Date","getTime","Number","zsks","String","toJWT","Object","keys","filter","val","undefined","forEach","key","startsWith","jwt","iat","hashJWT","heliconeApiKey","jti","hash","o11y","fromJSON","nvmKey","str","JSON","stringify","_obj","parse","decodeJWT","deserialize","serialize","serialized"],"mappings":"AAAA,SAAqBA,SAAS,QAAQ,OAAM;AAG5C,SAASC,UAAU,QAAQ,aAAY;AACvC,SAASC,kBAAkB,QAAQ,6CAA4C;AAC/E,SAASC,UAAU,QAAQ,kCAAiC;AAC5D,SAASC,cAAc,QAAQ,wCAAuC;AACtE,SAASC,cAAc,EAAEC,cAAc,EAAEC,mBAAmB,QAAQ,sBAAqB;AAEzF,OAAO,MAAMC;IA2DX;;;;;;;;;;;GAWC,GACD,aAAoBC,SAClBC,cAA8B,EAC9BC,aAAqC,EACrCC,iBAAqC,EACrCC,eAAuB,EACvBC,iBAAyB,EACzBC,iBAAkC,IAAI,EACtCC,mBAAmB,CAAC,CAAC,EACrBC,mBAAmB,IAAI,EACN;QACjB,MAAMC,gBAAgBhB,mBAAmBS,cAAcQ,OAAO;QAC9D,MAAMC,UAAUV,eAAeW,MAAM,CAACC,KAAK,EAAEC,MAAM;QACnD,MAAMC,MAAMtB,mBAAmBW;QAE/B,MAAMY,aAAa;YACjBC,SAAS;YACT,GAAIN,UAAU,KAAK;gBAAEA;YAAQ,CAAC;QAChC;QACA,MAAMO,SAAS;YACbC,KAAKV;YACLW,KAAKT,QAAQU,QAAQ;YACrBN;YACAO,KAAKd;YACLe,KAAKpB;YACLa;YACA,GAAGT,gBAAgB;QACrB;QAEA,MAAMiB,YAAY,MAAM,IAAI9B,WAAWwB,QACpCO,kBAAkB,CAAC;YAAEC,KAAK;QAAS,GACnCC,WAAW,GACXC,iBAAiB,CAACtB,gBAClBuB,OAAO,CAAC5B,gBAAgBC;QAE3B,OAAOL,eAAe2B,WAAWnB;IACnC;IAEA;;;;;GAKC,GACD,aAAoByB,iBAAiBC,YAAoB,EAAEC,UAAkB,EAAE;QAC7E,MAAMC,YAAY,MAAMrC,eAAemC,cAAcC;QACrD,OAAOjC,UAAUmC,OAAO,CAACD;IAC3B;IAEA;;;;GAIC,GACD,aAAoBE,iBAAiBC,SAAiB,EAAmB;QACvE,IAAI;YACF,MAAMC,SAASD,UAAUE,KAAK,CAAC;YAC/B,MAAMC,YAAY/C,WAAWM,oBAAoBuC,MAAM,CAAC,EAAE;YAC1D,OAAO1C,eAAe6C,oBAAoB,CAAC,GAAGH,MAAM,CAAC,EAAE,CAAC,CAAC,EAAEA,MAAM,CAAC,EAAE,EAAE,EAAEE;QAC1E,EAAE,OAAOE,GAAG;YACV,IAAIA,aAAaC,OAAO;gBACtB,MAAM,IAAIA,MAAM,CAAC,iCAAiC,EAAED,EAAExB,OAAO,EAAE;YACjE,OAAO;gBACL,MAAM,IAAIyB,MAAM,CAAC,+BAA+B,CAAC;YACnD;QACF;IACF;IAEA;;;;GAIC,GACD,AAAOC,QAAQhC,UAAU,CAAC,EAAW;QACnC,IAAI,IAAI,CAACiC,GAAG,EAAE;YACZ,MAAMC,MAAM,IAAIC;YAChB,IAAID,IAAIE,OAAO,KAAKC,OAAO,IAAI,CAACJ,GAAG,IAAI,MAAM,OAAO;QACtD;QACA,IAAIjC,YAAY,GAAG;YACjB,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,0EAA0E;YAC1E,0DAA0D;YAC1D,IAAI,IAAI,CAACsC,IAAI,EAAE,CAACC,OAAOvC,SAAS,EAAE,OAAO;YACzC,IAAIqC,OAAO,IAAI,CAAC5B,GAAG,MAAMT,SAAS,OAAO;QAC3C;QACA,OAAO;IACT;IAEA;;;;;GAKC,GACD,MAAawC,MACXlD,cAA8B,EAC9BC,aAAqC,EACpB;QACjB,MAAMgB,SAA8B,CAAC;QACrCkC,OAAOC,IAAI,CAAC,IAAI,EACbC,MAAM,CAAC,CAACC,MAAQA,QAAQC,WACxBC,OAAO,CAAC,CAACC;YACR,IAAI,CAACA,IAAIC,UAAU,CAAC,MAAMzC,MAAM,CAACwC,IAAI,GAAG,IAAI,CAACA,IAAI;QACnD;QAEF,MAAME,MAAM,IAAIlE,WAAWwB,QAAQO,kBAAkB,CAAC;YAAEC,KAAK;QAAS,GAAGC,WAAW,CAAC,IAAI,CAACkC,GAAG;QAC7F,IAAI,IAAI,CAACjB,GAAG,EAAEgB,IAAIhC,iBAAiB,CAAC,IAAI,CAACgB,GAAG;QAC5C,OAAOgB,IAAI/B,OAAO,CAAC5B,gBAAgBC;IACrC;IAEA;;;;;GAKC,GACD,MAAa4D,QACX7D,cAA8B,EAC9BC,aAAqC,EACrC6D,cAAuB,EACN;QACjB,MAAMtD,gBAAgBhB,mBAAmBS,cAAcQ,OAAO;QAE9D,OACE,IAAIhB,WAAW;YACbyB,KAAKV;YACLM,KAAK,IAAI,CAACI,GAAG;YACb6C,KAAK,IAAI,CAACC,IAAI;YACdrB,KAAK,IAAI,CAACA,GAAG;YACbsB,MAAMH;QACR,GACGtC,kBAAkB,CAAC;YAAEC,KAAK;QAAS,EACpC,qFAAqF;SACpFG,OAAO,CAAC5B,gBAAgBC;IAE/B;IAEA;;;;GAIC,GACD,OAAciE,SAASP,GAAe,EAAa;QACjD,MAAMQ,SAAS,IAAIrE;QACnB,MAAMsE,MAAMC,KAAKC,SAAS,CAACX;QAC3B,MAAMY,OAAOF,KAAKG,KAAK,CAACJ;QACxBjB,OAAOC,IAAI,CAACmB,MACTlB,MAAM,CAAC,CAACC,MAAQA,QAAQC,WACxBC,OAAO,CAAC,CAACC;YACRU,MAAM,CAACV,IAAI,GAAGc,IAAI,CAACd,IAAI;QACzB;QACF,OAAOU;IACT;IAEA;;;;GAIC,GACD,OAAclC,QAAQE,SAAiB,EAAa;QAClD,MAAMwB,MAAM7D,UAAU2E,SAAS,CAACtC;QAChC,OAAOrC,UAAUoE,QAAQ,CAACP;IAC5B;IAEA;;;;GAIC,GACD,OAAce,YAAYN,GAAW,EAAa;QAChD,OAAOtE,UAAUoE,QAAQ,CAACG,KAAKG,KAAK,CAACJ;IACvC;IAEA;;;GAGC,GACD,AAAOO,YAAoB;QACzB,OAAO,IAAI,CAACvD,QAAQ;IACtB;IAEA;;;GAGC,GACD,AAAOA,WAAmB;QACxB,OAAOiD,KAAKC,SAAS,CAAC,IAAI;IAC5B;IAEA;;;;GAIC,GACD,OAAcG,UAAUL,GAAW,EAAE;QACnC,OAAO9E,UAAU8E;IACnB;IAEA;;;GAGC,GACD,AAAOJ,OAAO;QACZ,OAAOtE,eAAesE,IAAI,CAAC,IAAI,CAACW,SAAS;IAC3C;IAEA;;;;GAIC,GACD,OAAOX,KAAKY,UAAkB,EAAE;QAC9B,OAAOlF,eAAesE,IAAI,CAACY;IAC7B;;QA7QA;;GAEC,QACDvD,MAAM;;AA2QR"}
|
|
1
|
+
{"version":3,"sources":["../../src/models/NvmApiKey.ts"],"sourcesContent":["import { JWTPayload, decodeJwt } from 'jose'\nimport { Account } from 'viem'\nimport { SmartAccount } from 'viem/account-abstraction'\nimport { bytesToHex } from 'viem/utils'\nimport { getChecksumAddress } from '../nevermined/utils/BlockchainViemUtils.js'\nimport { EthSignJWT } from '../nevermined/utils/JwtUtils.js'\nimport { SignatureUtils } from '../nevermined/utils/SignatureUtils.js'\nimport { decryptMessage, encryptMessage, urlSafeBase64Decode } from '../utils/helpers.js'\n\nexport class NvmApiKey implements JWTPayload {\n /**\n * The public address of the account issuing the key.\n */\n iss?: string\n\n /**\n * The chain id of the network the key is valid for. If zero the key is not having any network limitation\n */\n aud?: string\n\n /**\n * RFC 8707 resource indicator (the credential's audience) — the resource server this key is\n * confined to, e.g. `https://api.<tier>.nevermined.app` (#2432). NVM uses `rsc` rather than the\n * standard `aud` because `aud` already carries the chain id (above). Set only on the OAuth mint\n * path from the AgentBinding's `resource`; absent ⇒ unrestricted (dashboard/CLI/legacy keys).\n * MUST be left `undefined` (never `null`) when absent so it is omitted from `JSON.stringify(this)`\n * and the key's `hash()` stays byte-identical to a pre-#2432 key.\n */\n rsc?: string\n\n /**\n * The public address of the account the key is issued for.\n */\n sub?: string\n\n /**\n * The version of the key\n */\n ver = 'v1'\n\n /**\n * The ZeroDev session key (primary network). Kept for back-compat and as the\n * fallback when `zsks` has no entry for the requested network.\n */\n zsk?: string\n\n /**\n * Per-network ZeroDev session keys (#1929), keyed by chainId. Each carries\n * that network's chain-bound enable signature, so a single API key works on\n * every supported network. The backend selects the entry for the operation's\n * chain; absent → fall back to `zsk`.\n */\n zsks?: Record<string, string>\n\n /**\n * The Marketplace auth token\n */\n // nvt?: string\n\n /**\n * JWT Expiration Time\n *\n * @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4 RFC7519#section-4.1.4}\n */\n exp?: number\n\n /**\n * JWT Issued At\n *\n * @see {@link https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6 RFC7519#section-4.1.6}\n */\n iat?: number;\n\n /**\n * Additional attributes\n */\n [propName: string]: any\n\n /**\n * It generates a new serialized and encrypted NvmApiKey including the ZeroDev session key and the Marketplace auth token.\n * The string representing this key can be used to authenticate against the Nevermined API.\n * @param signatureUtils The SignatureUtils instance\n * @param issuerAccount The account issuing the key\n * @param zeroDevSessionKey The ZeroDev session key\n * @param receiverAddress The address of the account the key is issued for\n * @param receiverPublicKey The public key of the account the key is issued for\n * @param chainId The chain id of the network the key is valid for\n * @param additionalParams Addintional params to be added to the Key generated\n * @returns The encrypted string representing the @see {@link NvmApiKey}\n */\n public static async generate(\n signatureUtils: SignatureUtils,\n issuerAccount: Account | SmartAccount,\n zeroDevSessionKey: string | undefined,\n receiverAddress: string,\n receiverPublicKey: string,\n expirationTime: number | string = '1y',\n additionalParams = {},\n nvmApiKeyVersion = 'v1',\n ): Promise<string> {\n const issuerAddress = getChecksumAddress(issuerAccount.address)\n const chainId = signatureUtils.client.chain?.id || 0\n const sub = getChecksumAddress(receiverAddress)\n\n const eip712Data = {\n message: 'Sign this message to generate the Encrypted Nevermined API Key',\n ...(chainId > 0 && { chainId }),\n }\n const params = {\n iss: issuerAddress,\n aud: chainId.toString(),\n sub,\n ver: nvmApiKeyVersion,\n zsk: zeroDevSessionKey,\n eip712Data,\n ...additionalParams,\n }\n\n const signedJWT = await new EthSignJWT(params)\n .setProtectedHeader({ alg: 'ES256K' })\n .setIssuedAt()\n .setExpirationTime(expirationTime)\n .ethSign(signatureUtils, issuerAccount)\n\n return encryptMessage(signedJWT, receiverPublicKey)\n }\n\n /**\n * Given an encrypted JWT and a private key, it decrypts and decodes the JWT into a NvmApiKey\n * @param encryptedJwt The encrypted JWT\n * @param privateKey The private key representing the account\n * @returns The @see {@link NvmApiKey}\n */\n public static async decryptAndDecode(encryptedJwt: string, privateKey: string) {\n const decrypted = await decryptMessage(encryptedJwt, privateKey)\n return NvmApiKey.fromJWT(decrypted)\n }\n\n /**\n * Given a signed JWT, it recovers the signer address\n * @param jwtString The signed JWT\n * @returns The signer address\n */\n public static async getSignerAddress(jwtString: string): Promise<string> {\n try {\n const tokens = jwtString.split('.')\n const signature = bytesToHex(urlSafeBase64Decode(tokens[2]))\n return SignatureUtils.recoverSignerAddress(`${tokens[0]}.${tokens[1]}`, signature)\n } catch (e) {\n if (e instanceof Error) {\n throw new Error(`Error recovering signer address: ${e.message}`)\n } else {\n throw new Error(`Error recovering signer address`)\n }\n }\n }\n\n /**\n * It checks if the NVM API Key attributes are valid\n * @param chainId The chain id of the network the key is valid for\n * @returns true if the key is valid, false otherwise\n */\n public isValid(chainId = 0): boolean {\n if (this.exp) {\n const now = new Date()\n if (now.getTime() > Number(this.exp) * 1000) return false\n }\n if (chainId !== 0) {\n // #1929: a multi-network key's real per-network validity lives in `zsks`\n // (keyed by chainId); `aud` is only the primary-network hint. Consult\n // `zsks` first — otherwise `isValid(secondaryChain)` wrongly returns false\n // for a valid key (e.g. aud=8453, zsks={8453,4217} → isValid(4217)). Fall\n // back to the `aud` check for legacy single-network keys.\n if (this.zsks?.[String(chainId)]) return true\n if (Number(this.aud) !== chainId) return false\n }\n return true\n }\n\n /**\n * It generates a signed JWT from the NvmApiKey\n * @param signatureUtils The SignatureUtils instance\n * @param issuerAccount The account issuing the key\n * @returns the string in JWT format represeting the NvmApiKey\n */\n public async toJWT(\n signatureUtils: SignatureUtils,\n issuerAccount: Account | SmartAccount,\n ): Promise<string> {\n const params: Record<string, any> = {}\n Object.keys(this)\n .filter((val) => val !== undefined)\n .forEach((key) => {\n if (!key.startsWith('_')) params[key] = this[key]\n })\n\n const jwt = new EthSignJWT(params).setProtectedHeader({ alg: 'ES256K' }).setIssuedAt(this.iat)\n if (this.exp) jwt.setExpirationTime(this.exp)\n return jwt.ethSign(signatureUtils, issuerAccount)\n }\n\n /**\n * It generates the hash in JWT format of the NvmApiKey\n * @param signatureUtils the SignatureUtils instance\n * @param issuerAccount the account issuing the key\n * @returns a JWT string representing the hash of the NvmApiKey\n */\n public async hashJWT(\n signatureUtils: SignatureUtils,\n issuerAccount: Account | SmartAccount,\n heliconeApiKey?: string,\n ): Promise<string> {\n const issuerAddress = getChecksumAddress(issuerAccount.address)\n\n return (\n new EthSignJWT({\n iss: issuerAddress, // the account generating the hash (node/provider, etc) is the issuer of the hash\n sub: this.iss, // the issuer of the NVMApiKey (the user) is the subject of the hash\n jti: this.hash(),\n exp: this.exp,\n o11y: heliconeApiKey,\n rsc: this.rsc, // RFC 8707 resource/audience (#2432); undefined ⇒ omitted, token unchanged\n })\n .setProtectedHeader({ alg: 'ES256K' })\n // .setIssuedAt() // WARNING: If enabled, the hash will change for the same NvmApiKey\n .ethSign(signatureUtils, issuerAccount)\n )\n }\n\n /**\n * It regenerates the NvmApiKey from a JSON object\n * @param jwt JWTPayload in JSON format\n * @returns the @see {@link NvmApiKey}\n */\n public static fromJSON(jwt: JWTPayload): NvmApiKey {\n const nvmKey = new NvmApiKey()\n const str = JSON.stringify(jwt)\n const _obj = JSON.parse(str)\n Object.keys(_obj)\n .filter((val) => val !== undefined)\n .forEach((key) => {\n nvmKey[key] = _obj[key]\n })\n return nvmKey\n }\n\n /**\n * It regenerates the NvmApiKey from a JWT\n * @param jwtString the string in JWT format represeting the NvmApiKey\n * @returns the @see {@link NvmApiKey}\n */\n public static fromJWT(jwtString: string): NvmApiKey {\n const jwt = NvmApiKey.decodeJWT(jwtString)\n return NvmApiKey.fromJSON(jwt)\n }\n\n /**\n * It regenerates the NvmApiKey from a string\n * @param str the string represeting the NvmApiKey\n * @returns the @see {@link NvmApiKey}\n */\n public static deserialize(str: string): NvmApiKey {\n return NvmApiKey.fromJSON(JSON.parse(str))\n }\n\n /**\n * It serializes the NVM Api Key into a string\n * @returns a string representing the NVM API Key\n */\n public serialize(): string {\n return this.toString()\n }\n\n /**\n * It serializes the NVM Api Key into a string\n * @returns a string representing the NVM API Key\n */\n public toString(): string {\n return JSON.stringify(this)\n }\n\n /**\n * It decodes a string JWT into a JWTPayload\n * @param str jwt string\n * @returns the JWTPayload\n */\n public static decodeJWT(str: string) {\n return decodeJwt(str)\n }\n\n /**\n * It generates the hash of the NvmApiKey\n * @returns a string representing the hash of the NvmApiKey\n */\n public hash() {\n return SignatureUtils.hash(this.serialize())\n }\n\n /**\n * Given a serialized string, it generates the hash\n * @param serialized the serialized string\n * @returns the hash\n */\n static hash(serialized: string) {\n return SignatureUtils.hash(serialized)\n }\n}\n"],"names":["decodeJwt","bytesToHex","getChecksumAddress","EthSignJWT","SignatureUtils","decryptMessage","encryptMessage","urlSafeBase64Decode","NvmApiKey","generate","signatureUtils","issuerAccount","zeroDevSessionKey","receiverAddress","receiverPublicKey","expirationTime","additionalParams","nvmApiKeyVersion","issuerAddress","address","chainId","client","chain","id","sub","eip712Data","message","params","iss","aud","toString","ver","zsk","signedJWT","setProtectedHeader","alg","setIssuedAt","setExpirationTime","ethSign","decryptAndDecode","encryptedJwt","privateKey","decrypted","fromJWT","getSignerAddress","jwtString","tokens","split","signature","recoverSignerAddress","e","Error","isValid","exp","now","Date","getTime","Number","zsks","String","toJWT","Object","keys","filter","val","undefined","forEach","key","startsWith","jwt","iat","hashJWT","heliconeApiKey","jti","hash","o11y","rsc","fromJSON","nvmKey","str","JSON","stringify","_obj","parse","decodeJWT","deserialize","serialize","serialized"],"mappings":"AAAA,SAAqBA,SAAS,QAAQ,OAAM;AAG5C,SAASC,UAAU,QAAQ,aAAY;AACvC,SAASC,kBAAkB,QAAQ,6CAA4C;AAC/E,SAASC,UAAU,QAAQ,kCAAiC;AAC5D,SAASC,cAAc,QAAQ,wCAAuC;AACtE,SAASC,cAAc,EAAEC,cAAc,EAAEC,mBAAmB,QAAQ,sBAAqB;AAEzF,OAAO,MAAMC;IAqEX;;;;;;;;;;;GAWC,GACD,aAAoBC,SAClBC,cAA8B,EAC9BC,aAAqC,EACrCC,iBAAqC,EACrCC,eAAuB,EACvBC,iBAAyB,EACzBC,iBAAkC,IAAI,EACtCC,mBAAmB,CAAC,CAAC,EACrBC,mBAAmB,IAAI,EACN;QACjB,MAAMC,gBAAgBhB,mBAAmBS,cAAcQ,OAAO;QAC9D,MAAMC,UAAUV,eAAeW,MAAM,CAACC,KAAK,EAAEC,MAAM;QACnD,MAAMC,MAAMtB,mBAAmBW;QAE/B,MAAMY,aAAa;YACjBC,SAAS;YACT,GAAIN,UAAU,KAAK;gBAAEA;YAAQ,CAAC;QAChC;QACA,MAAMO,SAAS;YACbC,KAAKV;YACLW,KAAKT,QAAQU,QAAQ;YACrBN;YACAO,KAAKd;YACLe,KAAKpB;YACLa;YACA,GAAGT,gBAAgB;QACrB;QAEA,MAAMiB,YAAY,MAAM,IAAI9B,WAAWwB,QACpCO,kBAAkB,CAAC;YAAEC,KAAK;QAAS,GACnCC,WAAW,GACXC,iBAAiB,CAACtB,gBAClBuB,OAAO,CAAC5B,gBAAgBC;QAE3B,OAAOL,eAAe2B,WAAWnB;IACnC;IAEA;;;;;GAKC,GACD,aAAoByB,iBAAiBC,YAAoB,EAAEC,UAAkB,EAAE;QAC7E,MAAMC,YAAY,MAAMrC,eAAemC,cAAcC;QACrD,OAAOjC,UAAUmC,OAAO,CAACD;IAC3B;IAEA;;;;GAIC,GACD,aAAoBE,iBAAiBC,SAAiB,EAAmB;QACvE,IAAI;YACF,MAAMC,SAASD,UAAUE,KAAK,CAAC;YAC/B,MAAMC,YAAY/C,WAAWM,oBAAoBuC,MAAM,CAAC,EAAE;YAC1D,OAAO1C,eAAe6C,oBAAoB,CAAC,GAAGH,MAAM,CAAC,EAAE,CAAC,CAAC,EAAEA,MAAM,CAAC,EAAE,EAAE,EAAEE;QAC1E,EAAE,OAAOE,GAAG;YACV,IAAIA,aAAaC,OAAO;gBACtB,MAAM,IAAIA,MAAM,CAAC,iCAAiC,EAAED,EAAExB,OAAO,EAAE;YACjE,OAAO;gBACL,MAAM,IAAIyB,MAAM,CAAC,+BAA+B,CAAC;YACnD;QACF;IACF;IAEA;;;;GAIC,GACD,AAAOC,QAAQhC,UAAU,CAAC,EAAW;QACnC,IAAI,IAAI,CAACiC,GAAG,EAAE;YACZ,MAAMC,MAAM,IAAIC;YAChB,IAAID,IAAIE,OAAO,KAAKC,OAAO,IAAI,CAACJ,GAAG,IAAI,MAAM,OAAO;QACtD;QACA,IAAIjC,YAAY,GAAG;YACjB,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,0EAA0E;YAC1E,0DAA0D;YAC1D,IAAI,IAAI,CAACsC,IAAI,EAAE,CAACC,OAAOvC,SAAS,EAAE,OAAO;YACzC,IAAIqC,OAAO,IAAI,CAAC5B,GAAG,MAAMT,SAAS,OAAO;QAC3C;QACA,OAAO;IACT;IAEA;;;;;GAKC,GACD,MAAawC,MACXlD,cAA8B,EAC9BC,aAAqC,EACpB;QACjB,MAAMgB,SAA8B,CAAC;QACrCkC,OAAOC,IAAI,CAAC,IAAI,EACbC,MAAM,CAAC,CAACC,MAAQA,QAAQC,WACxBC,OAAO,CAAC,CAACC;YACR,IAAI,CAACA,IAAIC,UAAU,CAAC,MAAMzC,MAAM,CAACwC,IAAI,GAAG,IAAI,CAACA,IAAI;QACnD;QAEF,MAAME,MAAM,IAAIlE,WAAWwB,QAAQO,kBAAkB,CAAC;YAAEC,KAAK;QAAS,GAAGC,WAAW,CAAC,IAAI,CAACkC,GAAG;QAC7F,IAAI,IAAI,CAACjB,GAAG,EAAEgB,IAAIhC,iBAAiB,CAAC,IAAI,CAACgB,GAAG;QAC5C,OAAOgB,IAAI/B,OAAO,CAAC5B,gBAAgBC;IACrC;IAEA;;;;;GAKC,GACD,MAAa4D,QACX7D,cAA8B,EAC9BC,aAAqC,EACrC6D,cAAuB,EACN;QACjB,MAAMtD,gBAAgBhB,mBAAmBS,cAAcQ,OAAO;QAE9D,OACE,IAAIhB,WAAW;YACbyB,KAAKV;YACLM,KAAK,IAAI,CAACI,GAAG;YACb6C,KAAK,IAAI,CAACC,IAAI;YACdrB,KAAK,IAAI,CAACA,GAAG;YACbsB,MAAMH;YACNI,KAAK,IAAI,CAACA,GAAG;QACf,GACG1C,kBAAkB,CAAC;YAAEC,KAAK;QAAS,EACpC,qFAAqF;SACpFG,OAAO,CAAC5B,gBAAgBC;IAE/B;IAEA;;;;GAIC,GACD,OAAckE,SAASR,GAAe,EAAa;QACjD,MAAMS,SAAS,IAAItE;QACnB,MAAMuE,MAAMC,KAAKC,SAAS,CAACZ;QAC3B,MAAMa,OAAOF,KAAKG,KAAK,CAACJ;QACxBlB,OAAOC,IAAI,CAACoB,MACTnB,MAAM,CAAC,CAACC,MAAQA,QAAQC,WACxBC,OAAO,CAAC,CAACC;YACRW,MAAM,CAACX,IAAI,GAAGe,IAAI,CAACf,IAAI;QACzB;QACF,OAAOW;IACT;IAEA;;;;GAIC,GACD,OAAcnC,QAAQE,SAAiB,EAAa;QAClD,MAAMwB,MAAM7D,UAAU4E,SAAS,CAACvC;QAChC,OAAOrC,UAAUqE,QAAQ,CAACR;IAC5B;IAEA;;;;GAIC,GACD,OAAcgB,YAAYN,GAAW,EAAa;QAChD,OAAOvE,UAAUqE,QAAQ,CAACG,KAAKG,KAAK,CAACJ;IACvC;IAEA;;;GAGC,GACD,AAAOO,YAAoB;QACzB,OAAO,IAAI,CAACxD,QAAQ;IACtB;IAEA;;;GAGC,GACD,AAAOA,WAAmB;QACxB,OAAOkD,KAAKC,SAAS,CAAC,IAAI;IAC5B;IAEA;;;;GAIC,GACD,OAAcG,UAAUL,GAAW,EAAE;QACnC,OAAO/E,UAAU+E;IACnB;IAEA;;;GAGC,GACD,AAAOL,OAAO;QACZ,OAAOtE,eAAesE,IAAI,CAAC,IAAI,CAACY,SAAS;IAC3C;IAEA;;;;GAIC,GACD,OAAOZ,KAAKa,UAAkB,EAAE;QAC9B,OAAOnF,eAAesE,IAAI,CAACa;IAC7B;;QA9QA;;GAEC,QACDxD,MAAM;;AA4QR"}
|