@novasamatech/host-papp 0.7.6 → 0.7.8-0

package/dist/identity/impl.js

@@ -57,7 +57,7 @@ function createCachedIdentityRequester(storage, getKey) {
             if (emptyIdentities.length === 0) {
                 return okAsync(existing);
             }
-            return request(accounts)
+            return request(emptyIdentities)
                 .andThen(writeCache)
                 .map(fetched => ({
                 ...existing,

package/dist/sso/auth/attestationService.js

@@ -159,18 +159,20 @@ function createPeopleSigner(verifier) {
         publicKey: baseSigner.publicKey,
         signBytes: baseSigner.signBytes,
         signTx: async (callData, signedExtensions, metadata, atBlockNumber, hasher) => {
-            // Add People chain custom signed extensions
+            // polkadot-api auto-derives all signed extensions whose default state is encodable as
+            // a zero byte (Option::None, struct(Option<_>) = None, etc.). The People runtime's
+            // `pallet_verify_signature::VerifySignature` ({ Disabled, Signed }) extension uses
+            // identifier "VerifyMultiSignature" but has no built-in handler in polkadot-api, so it
+            // must be supplied manually. Value 0x00 = `Disabled` (passthrough — the standard
+            // extrinsic signature authenticates the call). Variant tag order was flipped in
+            // polkadot-sdk#11897 specifically so generic signers can encode the passthrough state
+            // as a single zero byte.
             const extensionsWithCustom = {
                 ...signedExtensions,
                 VerifyMultiSignature: {
                     identifier: 'VerifyMultiSignature',
-                    value: new Uint8Array([1]), // 1u8 = Option::Some with empty data
-                    additionalSigned: new Uint8Array([]), // Empty additional data
-                },
-                AsPerson: {
-                    identifier: 'AsPerson',
-                    value: new Uint8Array([0]), // 0u8 = Option::None
-                    additionalSigned: new Uint8Array([]), // Empty additional data
+                    value: new Uint8Array([0]),
+                    additionalSigned: new Uint8Array([]),
                 },
             };
             return baseSigner.signTx(callData, extensionsWithCustom, metadata, atBlockNumber, hasher);

package/dist/sso/auth/impl.js

@@ -46,7 +46,8 @@ export function createAuth({ metadata, hostMetadata, statementStore, ssoSessionR
         }));
         const handshakeTopic = encrKeys.andThen(({ publicKey }) => createHandshakeTopic(localAccount, publicKey));
         const dataPrepared = Result.combine([handshakePayload, handshakeTopic, encrKeys]).andTee(([payload]) => pairingStatus.write({ step: 'pairing', payload: createDeeplink(payload) }));
-        return dataPrepared.asyncAndThen(([, handshakeTopic, encrKeys]) => {
+        return dataPrepared
+            .asyncAndThen(([, handshakeTopic, encrKeys]) => {
             const pappResponse = waitForStatements(callback => statementStore.subscribeStatements({ matchAll: [handshakeTopic] }, page => callback(page.statements)), signal, (statements, resolve) => {
                 for (const statement of statements) {
                     if (!statement.data)
@@ -62,7 +63,7 @@ export function createAuth({ metadata, hostMetadata, statementStore, ssoSessionR
                     }
                 }
             });
-            const sessionWithSecretsPayload = pappResponse.map(session => ({
+            return pappResponse.map(session => ({
                 session,
                 secretsPayload: {
                     id: session.id,
@@ -71,15 +72,14 @@ export function createAuth({ metadata, hostMetadata, statementStore, ssoSessionR
                     entropy: account.entropy,
                 },
             }));
-            return sessionWithSecretsPayload
-                .andTee(({ session }) => {
-                pairingStatus.write({ step: 'finished', session });
-            })
-                .orTee(e => {
-                if (!(e instanceof AbortError)) {
-                    pairingStatus.write({ step: 'pairingError', message: e.message });
-                }
-            });
+        })
+            .andTee(({ session }) => {
+            pairingStatus.write({ step: 'finished', session });
+        })
+            .orTee(e => {
+            if (!(e instanceof AbortError)) {
+                pairingStatus.write({ step: 'pairingError', message: e.message });
+            }
         });
     }
     const authModule = {
@@ -162,10 +162,10 @@ function retrieveSession({ payload, encrSecret, localAccount, }) {
     return createEncryption(symmetricKey)
         .decrypt(encrypted)
         .map(decrypted => {
-        const [pappEncrPublicKey, pappAccountId] = HandshakeResponseSensitiveData.dec(decrypted);
-        const sharedSecret = createSharedSecret(encrSecret, pappEncrPublicKey);
-        const peerAccount = createRemoteSessionAccount(createAccountId(pappAccountId), sharedSecret);
-        return createStoredUserSession(localAccount, peerAccount);
+        const { sharedSecretDerivationKey, rootUserAccountId, identityAccountId } = HandshakeResponseSensitiveData.dec(decrypted);
+        const sharedSecret = createSharedSecret(encrSecret, sharedSecretDerivationKey);
+        const peerAccount = createRemoteSessionAccount(createAccountId(rootUserAccountId), sharedSecret);
+        return createStoredUserSession(localAccount, peerAccount, createAccountId(identityAccountId));
     });
 }
 function createDeeplink(payload) {

package/dist/sso/auth/scale/handshake.d.ts

@@ -16,4 +16,8 @@ export declare const HandshakeResponsePayload: import("scale-ts").Codec<{
         tmpKey: Uint8Array<ArrayBufferLike>;
     };
 }>;
-export declare const HandshakeResponseSensitiveData: import("scale-ts").Codec<[Uint8Array<ArrayBufferLike>, Uint8Array<ArrayBufferLike>]>;
+export declare const HandshakeResponseSensitiveData: import("scale-ts").Codec<{
+    sharedSecretDerivationKey: Uint8Array<ArrayBufferLike>;
+    rootUserAccountId: Uint8Array<ArrayBufferLike>;
+    identityAccountId: Uint8Array<ArrayBufferLike>;
+}>;

package/dist/sso/auth/scale/handshake.js

@@ -1,5 +1,5 @@
 import { Enum } from '@novasamatech/scale';
-import { Bytes, Option, Struct, Tuple, str } from 'scale-ts';
+import { Bytes, Option, Struct, str } from 'scale-ts';
 import { EncrPubKey, SsPubKey } from '../../../crypto.js';
 const optStr = Option(str);
 export const HandshakeData = Enum({
@@ -15,4 +15,8 @@ export const HandshakeData = Enum({
 export const HandshakeResponsePayload = Enum({
     v1: Struct({ encrypted: Bytes(), tmpKey: Bytes(65) }),
 });
-export const HandshakeResponseSensitiveData = Tuple(Bytes(65), Bytes(32));
+export const HandshakeResponseSensitiveData = Struct({
+    sharedSecretDerivationKey: Bytes(65),
+    rootUserAccountId: Bytes(32),
+    identityAccountId: Bytes(32),
+});

package/dist/sso/sessionManager/impl.js

@@ -5,6 +5,11 @@ import { createSsoStatementProver } from '../ssoSessionProver.js';
 import { createUserSession } from './userSession.js';
 export function createSsoSessionManager({ ssoSessionRepository, userSecretRepository, statementStore, storage, }) {
     const localSessions = createState({});
+    const sessionUnsubscribes = new Map();
+    const releaseSession = (id) => {
+        sessionUnsubscribes.get(id)?.();
+        sessionUnsubscribes.delete(id);
+    };
     const disconnect = (session) => {
         return ssoSessionRepository.filter(s => s.id !== session.id).map(() => undefined);
     };
@@ -13,12 +18,12 @@ export function createSsoSessionManager({ ssoSessionRepository, userSecretReposi
         const toRemove = new Set(Object.keys(activeSessions));
         const toAdd = new Set();
         for (const userSession of userSessions) {
+            toRemove.delete(userSession.id);
             if (userSession.id in activeSessions)
                 continue;
             const session = createSession(userSession, statementStore, storage, userSecretRepository);
-            toRemove.delete(userSession.id);
             toAdd.add(session);
-            session.subscribe(message => {
+            const unsubscribe = session.subscribe(message => {
                 switch (message.data.tag) {
                     case 'v1': {
                         switch (message.data.value.tag) {
@@ -29,8 +34,13 @@ export function createSsoSessionManager({ ssoSessionRepository, userSecretReposi
                 }
                 return okAsync(false);
             });
+            sessionUnsubscribes.set(session.id, unsubscribe);
         }
         if (toRemove.size > 0) {
+            for (const id of toRemove) {
+                releaseSession(id);
+                activeSessions[id]?.dispose();
+            }
             localSessions.write(prev => {
                 return Object.fromEntries(Object.entries(prev).filter(([id]) => !toRemove.has(id)));
             });
@@ -56,6 +66,7 @@ export function createSsoSessionManager({ ssoSessionRepository, userSecretReposi
         },
         dispose() {
             for (const session of Object.values(localSessions.read())) {
+                releaseSession(session.id);
                 session.dispose();
             }
         },

package/dist/sso/sessionManager/userSession.js

@@ -35,6 +35,7 @@ export function createUserSession({ userSession, statementStore, encryption, sto
         id: userSession.id,
         localAccount: userSession.localAccount,
         remoteAccount: userSession.remoteAccount,
+        identityAccountId: userSession.identityAccountId,
         signPayload(payload) {
             return requestQueue.call(() => {
                 const messageId = nanoid();
@@ -141,7 +142,9 @@ export function createUserSession({ userSession, statementStore, encryption, sto
         },
         subscribe(callback) {
             return session.subscribe(RemoteMessageCodec, messages => {
-                processedMessages.read().andThen(processed => {
+                processedMessages
+                    .read()
+                    .andThen(processed => {
                     const results = messages.map(message => {
                         if (message.type === 'request' && message.payload.status === 'parsed') {
                             const payload = message.payload;
@@ -165,6 +168,9 @@ export function createUserSession({ userSession, statementStore, encryption, sto
                         }
                         return okAsync();
                     });
+                })
+                    .orTee(error => {
+                    console.error('Error while updating processed sso messages:', error);
                 });
             });
         },

package/dist/sso/userSessionRepository.d.ts

@@ -1,18 +1,161 @@
-import type { LocalSessionAccount, RemoteSessionAccount } from '@novasamatech/statement-store';
+import type { AccountId, LocalSessionAccount, RemoteSessionAccount } from '@novasamatech/statement-store';
 import type { StorageAdapter } from '@novasamatech/storage-adapter';
+import type { CodecType } from 'scale-ts';
 export type UserSessionRepository = ReturnType<typeof createUserSessionRepository>;
-export type StoredUserSession = {
+export type StoredUserSession = CodecType<typeof storedUserSessionCodec>;
+declare const storedUserSessionCodec: import("scale-ts").Codec<{
     id: string;
-    localAccount: LocalSessionAccount;
-    remoteAccount: RemoteSessionAccount;
-};
-export declare function createStoredUserSession(localAccount: LocalSessionAccount, remoteAccount: RemoteSessionAccount): StoredUserSession;
+    localAccount: {
+        accountId: AccountId;
+        pin: string | undefined;
+    };
+    remoteAccount: {
+        accountId: AccountId;
+        publicKey: Uint8Array<ArrayBufferLike>;
+        pin: string | undefined;
+    };
+    identityAccountId: AccountId;
+}>;
+export declare function createStoredUserSession(localAccount: LocalSessionAccount, remoteAccount: RemoteSessionAccount, identityAccountId: AccountId): StoredUserSession;
 export declare const createUserSessionRepository: (storage: StorageAdapter) => {
-    add(value: StoredUserSession): import("neverthrow").ResultAsync<StoredUserSession, Error>;
-    filter(fn: (value: StoredUserSession) => boolean): import("neverthrow").ResultAsync<StoredUserSession[], Error>;
-    mutate(fn: (value: StoredUserSession[]) => StoredUserSession[]): import("neverthrow").ResultAsync<StoredUserSession[], Error>;
-    read(): import("neverthrow").ResultAsync<StoredUserSession[], Error>;
-    write(value: StoredUserSession[]): import("neverthrow").ResultAsync<null, Error> | import("neverthrow").ResultAsync<StoredUserSession[], Error>;
+    add(value: {
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }): import("neverthrow").ResultAsync<{
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }, Error>;
+    filter(fn: (value: {
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }) => boolean): import("neverthrow").ResultAsync<{
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }[], Error>;
+    mutate(fn: (value: {
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }[]) => {
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }[]): import("neverthrow").ResultAsync<{
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }[], Error>;
+    read(): import("neverthrow").ResultAsync<{
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }[], Error>;
+    write(value: {
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }[]): import("neverthrow").ResultAsync<null, Error> | import("neverthrow").ResultAsync<{
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }[], Error>;
     clear(): import("neverthrow").ResultAsync<void, Error>;
-    subscribe(fn: (value: StoredUserSession[]) => void): VoidFunction;
+    subscribe(fn: (value: {
+        id: string;
+        localAccount: {
+            accountId: AccountId;
+            pin: string | undefined;
+        };
+        remoteAccount: {
+            accountId: AccountId;
+            publicKey: Uint8Array<ArrayBufferLike>;
+            pin: string | undefined;
+        };
+        identityAccountId: AccountId;
+    }[]) => void): VoidFunction;
 };
+export {};

package/dist/sso/userSessionRepository.js

@@ -1,4 +1,4 @@
-import { LocalSessionAccountCodec, RemoteSessionAccountCodec } from '@novasamatech/statement-store';
+import { AccountIdCodec, LocalSessionAccountCodec, RemoteSessionAccountCodec } from '@novasamatech/statement-store';
 import { fieldListView } from '@novasamatech/storage-adapter';
 import { nanoid } from 'nanoid';
 import { fromHex, toHex } from 'polkadot-api/utils';
@@ -7,12 +7,14 @@ const storedUserSessionCodec = Struct({
     id: str,
     localAccount: LocalSessionAccountCodec,
     remoteAccount: RemoteSessionAccountCodec,
+    identityAccountId: AccountIdCodec,
 });
-export function createStoredUserSession(localAccount, remoteAccount) {
+export function createStoredUserSession(localAccount, remoteAccount, identityAccountId) {
     return {
         id: nanoid(12),
         localAccount: localAccount,
         remoteAccount: remoteAccount,
+        identityAccountId,
     };
 }
 export const createUserSessionRepository = (storage) => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/host-papp",
   "type": "module",
-  "version": "0.7.6",
+  "version": "0.7.8-0",
   "description": "Polkadot app integration",
   "license": "Apache-2.0",
   "repository": {
@@ -29,10 +29,10 @@
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@novasamatech/host-api": "0.7.6",
-    "@novasamatech/scale": "0.7.6",
-    "@novasamatech/statement-store": "0.7.6",
-    "@novasamatech/storage-adapter": "0.7.6",
+    "@novasamatech/host-api": "0.7.8-0",
+    "@novasamatech/scale": "0.7.8-0",
+    "@novasamatech/statement-store": "0.7.8-0",
+    "@novasamatech/storage-adapter": "0.7.8-0",
     "@polkadot-labs/hdkd-helpers": "^0.0.30",
     "nanoevents": "9.1.0",
     "nanoid": "5.1.9",