@novasamatech/host-papp 0.7.9 → 0.8.0-0

package/dist/sso/auth/impl.js

@@ -1,230 +1,168 @@
-import { enumValue } from '@novasamatech/scale';
-import { createAccountId, createEncryption, createLocalSessionAccount, createRemoteSessionAccount, khash, } from '@novasamatech/statement-store';
-import { generateMnemonic } from '@polkadot-labs/hdkd-helpers';
-import { Result, ResultAsync, err, fromPromise, fromThrowable, ok } from 'neverthrow';
-import { mergeUint8, toHex } from 'polkadot-api/utils';
-import { createEncrSecret, createSharedSecret, deriveSr25519Account, getEncrPub, stringToBytes } from '../../crypto.js';
+import { createAccountId, createLocalSessionAccount, createRemoteSessionAccount } from '@novasamatech/statement-store';
+import { ResultAsync, errAsync, okAsync } from 'neverthrow';
 import { createFlowId, emitHostPappDebugMessage } from '../../debugBus.js';
 import { AbortError } from '../../helpers/abortError.js';
 import { createState, readonly } from '../../helpers/state.js';
 import { toError } from '../../helpers/utils.js';
 import { createStoredUserSession } from '../userSessionRepository.js';
-import { HandshakeData, HandshakeResponsePayload, HandshakeResponseSensitiveData } from './scale/handshake.js';
-export function createAuth({ metadata, hostMetadata, statementStore, ssoSessionRepository, userSecretRepository, }) {
+import { startPairingV2 } from './v2/service.js';
+export function createAuth({ hostMetadata, deviceIdentity, deviceIdentityStore, statementStore, ssoSessionRepository, userSecretRepository, onAuthSuccess, }) {
     const pairingStatus = createState({ step: 'none' });
     let authResult = null;
-    let abort = null;
-    function handshake(account, signal, flowId) {
-        const localAccount = createLocalSessionAccount(createAccountId(account.publicKey));
-        pairingStatus.write({ step: 'initial' });
-        const encrKeys = createEncrKeys(account.entropy);
-        const handshakePayload = encrKeys.andThen(({ publicKey }) => createHandshakePayloadV1({
-            ssPublicKey: account.publicKey,
-            encrPublicKey: publicKey,
-            metadata,
-            hostMetadata,
-        }));
-        const handshakeTopic = encrKeys.andThen(({ publicKey }) => createHandshakeTopic(localAccount, publicKey));
-        const dataPrepared = Result.combine([handshakePayload, handshakeTopic, encrKeys]).andTee(([payload]) => {
-            const deeplink = createDeeplink(payload);
-            pairingStatus.write({ step: 'pairing', payload: deeplink });
-            emitHostPappDebugMessage({
-                layer: 'sso',
-                event: 'deeplink_generated',
-                flowId,
-                timestamp: Date.now(),
-                payload: { deeplink },
-            });
-        });
-        return dataPrepared
-            .asyncAndThen(([, handshakeTopic, encrKeys]) => {
-            emitHostPappDebugMessage({
-                layer: 'sso',
-                event: 'awaiting_response',
-                flowId,
-                timestamp: Date.now(),
-                payload: { topic: toHex(handshakeTopic) },
-            });
-            const pappResponse = waitForStatements(callback => statementStore.subscribeStatements({ matchAll: [handshakeTopic] }, page => callback(page.statements)), signal, (statements, resolve) => {
-                for (const statement of statements) {
-                    if (!statement.data)
-                        continue;
-                    const session = retrieveSession({
-                        localAccount,
-                        encrSecret: encrKeys.secret,
-                        payload: statement.data,
-                    }).unwrapOr(null);
-                    if (session) {
-                        emitHostPappDebugMessage({
-                            layer: 'sso',
-                            event: 'response_received',
-                            flowId,
-                            timestamp: Date.now(),
-                            payload: { sessionId: session.id },
-                        });
-                        resolve(session);
-                        break;
-                    }
-                }
-            });
-            return pappResponse.map(session => ({
-                session,
-                secretsPayload: {
-                    id: session.id,
-                    ssSecret: account.secret,
-                    encrSecret: encrKeys.secret,
-                    entropy: account.entropy,
-                },
-            }));
-        })
-            .andTee(({ session }) => {
-            pairingStatus.write({ step: 'finished', session });
-        })
-            .orTee(e => {
-            if (!(e instanceof AbortError)) {
-                pairingStatus.write({ step: 'pairingError', message: e.message });
-            }
-        });
-    }
-    const authModule = {
+    let abortHandle = null;
+    return {
         pairingStatus: readonly(pairingStatus),
         authenticate() {
-            if (authResult) {
+            if (authResult)
                 return authResult;
-            }
-            abort = new AbortController();
-            const account = deriveSr25519Account(generateMnemonic(), '//wallet//sso');
-            const ssoFlowId = createFlowId();
+            const flowId = createFlowId();
+            pairingStatus.write({ step: 'initial' });
             emitHostPappDebugMessage({
                 layer: 'sso',
                 event: 'pairing_started',
-                flowId: ssoFlowId,
+                flowId,
                 timestamp: Date.now(),
-                payload: { metadata },
+                payload: { metadata: hostMetadata },
             });
-            authResult = handshake(account, abort.signal, ssoFlowId)
-                .andThen(({ session, secretsPayload }) => {
-                return userSecretRepository
-                    .write(secretsPayload.id, {
-                    ssSecret: secretsPayload.ssSecret,
-                    encrSecret: secretsPayload.encrSecret,
-                    entropy: secretsPayload.entropy,
-                })
-                    .andThen(() => ssoSessionRepository.add(session))
-                    .map(() => session);
-            })
+            let aborted = false;
+            let pairingAbort = null;
+            abortHandle = () => {
+                aborted = true;
+                pairingAbort?.();
+            };
+            const resolveDeviceIdentity = () => deviceIdentity
+                ? ResultAsync.fromPromise(Promise.resolve(deviceIdentity()), toError)
+                : deviceIdentityStore.loadOrCreate();
+            const flow = ResultAsync.combine([
+                resolveDeviceIdentity(),
+                deviceIdentityStore.readLastProcessedHandshakeStatement(),
+            ]).andThen(([identity, initialHex]) => {
+                if (aborted)
+                    return okAsync(null);
+                const pairing = startPairingV2({
+                    statementStore,
+                    deviceIdentity: identity,
+                    metadata: hostMetadata ?? {},
+                    initialProcessedDataHex: initialHex,
+                    onStatementProcessed: hex => {
+                        void deviceIdentityStore.writeLastProcessedHandshakeStatement(hex);
+                    },
+                });
+                pairingAbort = pairing.abort;
+                pairingStatus.write({ step: 'pairing', payload: pairing.qrPayload });
+                emitHostPappDebugMessage({
+                    layer: 'sso',
+                    event: 'deeplink_generated',
+                    flowId,
+                    timestamp: Date.now(),
+                    payload: { deeplink: pairing.qrPayload },
+                });
+                emitHostPappDebugMessage({
+                    layer: 'sso',
+                    event: 'awaiting_response',
+                    flowId,
+                    timestamp: Date.now(),
+                    payload: {},
+                });
+                return ResultAsync.fromPromise(new Promise((resolve, reject) => {
+                    let settled = false;
+                    const settle = (cb) => {
+                        if (settled)
+                            return;
+                        settled = true;
+                        cb();
+                    };
+                    const sub = pairing.state$.subscribe({
+                        next: state => onState(state, s => settle(() => resolve(s)), e => settle(() => reject(e)), () => sub?.unsubscribe()),
+                        complete: () => {
+                            if (aborted)
+                                settle(() => reject(new AbortError('Aborted by user.')));
+                        },
+                        error: e => settle(() => reject(toError(e))),
+                    });
+                }), toError).andThen(success => persistAndNotify(identity, success, flowId));
+            });
+            authResult = flow
+                .orElse(e => (e instanceof AbortError ? okAsync(null) : errAsync(e)))
                 .andTee(session => {
-                if (session) {
+                if (session === null) {
+                    pairingStatus.reset();
+                }
+                else {
+                    pairingStatus.write({ step: 'finished', session });
                     emitHostPappDebugMessage({
                         layer: 'sso',
                         event: 'session_established',
-                        flowId: ssoFlowId,
+                        flowId,
                         timestamp: Date.now(),
                         payload: { sessionId: session.id },
                     });
                 }
-            })
-                .orElse(e => (e instanceof AbortError ? ok(null) : err(e)))
-                .andTee(() => {
-                abort = null;
+                abortHandle = null;
             })
                 .orTee(e => {
-                authResult = null;
-                abort = null;
+                pairingStatus.write({ step: 'pairingError', message: e.message });
                 emitHostPappDebugMessage({
                     layer: 'sso',
                     event: 'pairing_failed',
-                    flowId: ssoFlowId,
+                    flowId,
                     timestamp: Date.now(),
                     payload: { reason: e.message },
                 });
+                authResult = null;
+                abortHandle = null;
             });
             return authResult;
+            function onState(state, resolve, reject, unsubscribe) {
+                switch (state.tag) {
+                    case 'Idle':
+                    case 'Submitted':
+                        return;
+                    case 'Pending':
+                        pairingStatus.write({ step: 'pending', stage: state.reason });
+                        return;
+                    case 'Success':
+                        unsubscribe();
+                        emitHostPappDebugMessage({
+                            layer: 'sso',
+                            event: 'response_received',
+                            flowId,
+                            timestamp: Date.now(),
+                            payload: { identityAccountId: state.identityAccountId },
+                        });
+                        resolve(state);
+                        return;
+                    case 'Failed':
+                        unsubscribe();
+                        reject(new Error(state.reason));
+                        return;
+                }
+            }
         },
         abortAuthentication() {
-            if (abort) {
-                abort.abort(new AbortError('Aborted by user.'));
-                abort = null;
-            }
+            abortHandle?.();
+            abortHandle = null;
             authResult = null;
             pairingStatus.reset();
         },
     };
-    return authModule;
-}
-const createHandshakeTopic = fromThrowable((account, encrPublicKey) => khash(account.accountId, mergeUint8([encrPublicKey, stringToBytes('topic')])), toError);
-const createHandshakePayloadV1 = fromThrowable(({ encrPublicKey, ssPublicKey, metadata, hostMetadata, }) => {
-    const hostVersion = hostMetadata?.hostVersion;
-    const osType = hostMetadata?.osType;
-    const osVersion = hostMetadata?.osVersion;
-    return HandshakeData.enc(enumValue('v1', {
-        ssPublicKey,
-        encrPublicKey,
-        metadata,
-        hostVersion,
-        osType,
-        osVersion,
-    }));
-}, toError);
-function parseHandshakePayload(payload) {
-    const decoded = HandshakeResponsePayload.dec(payload);
-    switch (decoded.tag) {
-        case 'v1':
-            return decoded.value;
-        default:
-            throw new Error('Unsupported handshake payload version');
-    }
-}
-const createEncrKeys = fromThrowable((entropy) => {
-    const secret = createEncrSecret(entropy);
-    return {
-        secret,
-        publicKey: getEncrPub(secret),
-    };
-}, toError);
-function retrieveSession({ payload, encrSecret, localAccount, }) {
-    const { encrypted, tmpKey } = parseHandshakePayload(payload);
-    const symmetricKey = createSharedSecret(encrSecret, tmpKey);
-    return createEncryption(symmetricKey)
-        .decrypt(encrypted)
-        .map(decrypted => {
-        const { sharedSecretDerivationKey, rootUserAccountId, identityAccountId } = HandshakeResponseSensitiveData.dec(decrypted);
-        const sharedSecret = createSharedSecret(encrSecret, sharedSecretDerivationKey);
-        const remoteAccount = createRemoteSessionAccount(createAccountId(identityAccountId), sharedSecret);
-        return createStoredUserSession(localAccount, remoteAccount, createAccountId(rootUserAccountId));
-    });
-}
-function createDeeplink(payload) {
-    return `polkadotapp://pair?handshake=${toHex(payload)}`;
-}
-function waitForStatements(subscribe, signal, callback) {
-    return fromPromise(new Promise((resolve, reject) => {
-        const unsubscribe = subscribe(statements => {
-            const abortError = processSignal(signal).match(() => null, e => e);
-            if (abortError) {
-                unsubscribe();
-                reject(abortError);
-                return;
-            }
-            try {
-                callback(statements, value => {
-                    unsubscribe();
-                    resolve(value);
-                });
-            }
-            catch (e) {
-                unsubscribe();
-                reject(e);
-            }
+    function persistAndNotify(identity, success, _flowId) {
+        const localAccount = createLocalSessionAccount(createAccountId(identity.statementAccountPublicKey));
+        const remoteAccount = createRemoteSessionAccount(createAccountId(success.peerStatementAccountId ?? new Uint8Array(32)), success.deviceEncPubKey);
+        const session = createStoredUserSession(localAccount, remoteAccount, createAccountId(success.rootAccountId ?? new Uint8Array(32)), {
+            identityAccountId: createAccountId(success.identityAccountId),
+            identityChatPublicKey: success.identityChatPublicKey,
         });
-    }), toError);
-}
-function processSignal(signal) {
-    try {
-        signal.throwIfAborted();
-        return ok();
-    }
-    catch (e) {
-        return err(toError(e));
+        return userSecretRepository
+            .write(session.id, {
+            ssSecret: identity.statementAccountSecret,
+            encrSecret: identity.encryptionPrivateKey,
+            entropy: new Uint8Array(0),
+            identityChatPrivateKey: success.identityChatPrivateKey,
+        })
+            .andThen(() => ssoSessionRepository.add(session))
+            .andThen(() => onAuthSuccess
+            ? ResultAsync.fromPromise(Promise.resolve(onAuthSuccess({ session, identityChatPrivateKey: success.identityChatPrivateKey })), toError).map(() => session)
+            : okAsync(session));
     }
 }

package/dist/sso/auth/scale/handshakeV2.d.ts

@@ -0,0 +1,260 @@
+/**
+ * SCALE codecs for the V2 SSO handshake (multi-device shape).
+ *
+ * The host emits a `VersionedHandshakeProposal::V2` via QR carrying its
+ * `Device { statementAccountId, encryptionPublicKey }` and metadata. The
+ * authorising peer (PApp) responds over the Statement Store with a
+ * `VersionedHandshakeResponse`; its body is ECDH-encrypted to the host's
+ * encryption public key with the peer's ephemeral `tmpKey`. The inner payload
+ * after decrypt is `EncryptedHandshakeResponseV2 = Pending | Success | Failed`.
+ *
+ * `Success` carries:
+ *   - `identityAccountId`     — user identity sr25519 accountId (32 bytes).
+ *                               Adressing for chat / username lookup / session
+ *                               topic derivation.
+ *   - `rootAccountId`         — user root sr25519 accountId (32 bytes). Parent
+ *                               for soft-derivation of product accounts; PApp
+ *                               and host MUST derive identically so a dapp sees
+ *                               the same address on every device.
+ *   - `identityChatPrivateKey`— user identity chat P-256 private scalar (32 bytes),
+ *                               shared per the multi-device spec so this device
+ *                               can decrypt traffic addressed to the user identity
+ *   - `deviceEncPubKey`       — encryption public key of the PApp device (65 bytes,
+ *                               P-256 uncompressed). Tells the host which key to
+ *                               use when addressing chat envelopes back to the
+ *                               authorising PApp device.
+ *
+ * Total wire length of `Success` is 32 + 32 + 32 + 65 = 161 bytes. Transit security
+ * comes from the outer envelope's ECDH-AES wrap; no per-field signature is
+ * carried — multi-device authorisation is asserted by the user-identity-signed
+ * roster events (`DeviceAdded`/`DeviceRemoved`) published separately.
+ */
+export declare const MetadataKey: import("scale-ts").Codec<{
+    tag: "Custom";
+    value: string;
+} | {
+    tag: "HostName";
+    value: undefined;
+} | {
+    tag: "HostVersion";
+    value: undefined;
+} | {
+    tag: "HostIcon";
+    value: undefined;
+} | {
+    tag: "PlatformType";
+    value: undefined;
+} | {
+    tag: "PlatformVersion";
+    value: undefined;
+}>;
+export declare const MetadataEntry: import("scale-ts").Codec<[{
+    tag: "Custom";
+    value: string;
+} | {
+    tag: "HostName";
+    value: undefined;
+} | {
+    tag: "HostVersion";
+    value: undefined;
+} | {
+    tag: "HostIcon";
+    value: undefined;
+} | {
+    tag: "PlatformType";
+    value: undefined;
+} | {
+    tag: "PlatformVersion";
+    value: undefined;
+}, string]>;
+export declare const Device: import("scale-ts").Codec<{
+    statementAccountId: Uint8Array<ArrayBufferLike>;
+    encryptionPublicKey: Uint8Array<ArrayBufferLike>;
+}>;
+export declare const HandshakeProposalV2: import("scale-ts").Codec<{
+    device: {
+        statementAccountId: Uint8Array<ArrayBufferLike>;
+        encryptionPublicKey: Uint8Array<ArrayBufferLike>;
+    };
+    metadata: [{
+        tag: "Custom";
+        value: string;
+    } | {
+        tag: "HostName";
+        value: undefined;
+    } | {
+        tag: "HostVersion";
+        value: undefined;
+    } | {
+        tag: "HostIcon";
+        value: undefined;
+    } | {
+        tag: "PlatformType";
+        value: undefined;
+    } | {
+        tag: "PlatformVersion";
+        value: undefined;
+    }, string][];
+}>;
+/**
+ * V2 lives at SCALE discriminant 1; index 0 is reserved for legacy V1 which
+ * neither side emits. The `_v1Reserved` slot pushes V2 to discriminant 1.
+ */
+export declare const VersionedHandshakeProposal: import("scale-ts").Codec<{
+    tag: "_v1Reserved";
+    value: undefined;
+} | {
+    tag: "V2";
+    value: {
+        device: {
+            statementAccountId: Uint8Array<ArrayBufferLike>;
+            encryptionPublicKey: Uint8Array<ArrayBufferLike>;
+        };
+        metadata: [{
+            tag: "Custom";
+            value: string;
+        } | {
+            tag: "HostName";
+            value: undefined;
+        } | {
+            tag: "HostVersion";
+            value: undefined;
+        } | {
+            tag: "HostIcon";
+            value: undefined;
+        } | {
+            tag: "PlatformType";
+            value: undefined;
+        } | {
+            tag: "PlatformVersion";
+            value: undefined;
+        }, string][];
+    };
+}>;
+/** 32 + 32 + 32 + 65 = 161 bytes (spec v0.2.1) */
+export declare const HandshakeSuccessV2: import("scale-ts").Codec<{
+    identityAccountId: Uint8Array<ArrayBufferLike>;
+    rootAccountId: Uint8Array<ArrayBufferLike>;
+    identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
+    deviceEncPubKey: Uint8Array<ArrayBufferLike>;
+}>;
+export type HandshakeSuccessV2Value = {
+    identityAccountId: Uint8Array;
+    /** Nullable for v0.2 peers (Android `feature/location-for-handshake`). */
+    rootAccountId: Uint8Array | null;
+    identityChatPrivateKey: Uint8Array;
+    deviceEncPubKey: Uint8Array;
+};
+/** 32 + 32 + 65 = 129 bytes (spec v0.2 — Android `feature/location-for-handshake`) */
+export declare const HandshakeSuccessV2Legacy: import("scale-ts").Codec<{
+    identityAccountId: Uint8Array<ArrayBufferLike>;
+    identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
+    deviceEncPubKey: Uint8Array<ArrayBufferLike>;
+}>;
+export type DecodedHandshakeResponseV2 = {
+    tag: 'Pending';
+    value: {
+        tag: 'AllowanceAllocation';
+        value: undefined;
+    };
+} | {
+    tag: 'Success';
+    value: HandshakeSuccessV2Value;
+} | {
+    tag: 'Failed';
+    value: string;
+};
+/**
+ * Length-dispatched decoder for the inner `EncryptedHandshakeResponseV2`
+ * plaintext. v0.2 (Android) ships 129-byte Success bodies without
+ * `rootAccountId`; v0.2.1 ships 161-byte bodies with it. Surfaces
+ * `rootAccountId: null` for the legacy case — chat doesn't need it.
+ */
+export declare const decodeEncryptedHandshakeResponseV2: (bytes: Uint8Array) => DecodedHandshakeResponseV2;
+/**
+ * Derive the user identity chat P-256 public key from the shared private
+ * scalar received in `HandshakeSuccessV2`. Both desktop and mobile must derive
+ * identically (uncompressed 65-byte form) so downstream session topics agree.
+ */
+export declare const deriveIdentityChatPublicKey: (privateKey: Uint8Array) => Uint8Array;
+/**
+ * Inner Pending sub-statuses. Only `AllowanceAllocation` today.
+ *
+ * Encoded with its own SCALE discriminant byte — the peer's SCALE library does
+ * NOT elide enum-variant indices for sealed interfaces (verified on the wire:
+ * `Pending(AllowanceAllocation)` arrives as `0x00 0x00`). Both sides must keep
+ * the discriminant when encoding so dispatch agrees.
+ */
+export declare const HandshakeStatusV2: import("scale-ts").Codec<{
+    tag: "AllowanceAllocation";
+    value: undefined;
+}>;
+export type EncryptedHandshakeResponseV2Value = {
+    tag: 'Pending';
+    value: {
+        tag: 'AllowanceAllocation';
+        value: undefined;
+    };
+} | {
+    tag: 'Success';
+    value: HandshakeSuccessV2Value;
+} | {
+    tag: 'Failed';
+    value: string;
+};
+/**
+ * Inner handshake response variant. Wire shape (matches peer SCALE encoding):
+ *
+ *   - Pending → 0x00 || HandshakeStatusV2 (today: 0x00 for AllowanceAllocation), 2 bytes total
+ *   - Success → 0x01 || HandshakeSuccessV2 (161 bytes), 162 bytes total
+ *   - Failed  → 0x02 || SCALE-encoded UTF-8 reason string
+ *
+ * Earlier builds shipped a custom length-dispatched codec assuming elision —
+ * that assumption was wrong and produced false `Failed("")` reads on every
+ * `Pending` response. Native scale-ts `Enum` preserves the discriminant and
+ * matches the peer's wire format directly.
+ */
+export declare const EncryptedHandshakeResponseV2: import("scale-ts").Codec<{
+    tag: "Pending";
+    value: {
+        tag: "AllowanceAllocation";
+        value: undefined;
+    };
+} | {
+    tag: "Success";
+    value: {
+        identityAccountId: Uint8Array<ArrayBufferLike>;
+        rootAccountId: Uint8Array<ArrayBufferLike>;
+        identityChatPrivateKey: Uint8Array<ArrayBufferLike>;
+        deviceEncPubKey: Uint8Array<ArrayBufferLike>;
+    };
+} | {
+    tag: "Failed";
+    value: string;
+}>;
+export declare const HandshakeResponseV2: import("scale-ts").Codec<{
+    encrypted: Uint8Array<ArrayBufferLike>;
+    tmpKey: Uint8Array<ArrayBufferLike>;
+}>;
+/** Legacy V1 response shape — decoded for backward compat, never emitted by the V2 path. */
+export declare const HandshakeResponseV1: import("scale-ts").Codec<{
+    encrypted: Uint8Array<ArrayBufferLike>;
+    tmpKey: Uint8Array<ArrayBufferLike>;
+}>;
+export declare const EncryptedHandshakeResponseV1: import("scale-ts").Codec<{
+    encryptionKey: Uint8Array<ArrayBufferLike>;
+    accountId: Uint8Array<ArrayBufferLike>;
+}>;
+export declare const VersionedHandshakeResponse: import("scale-ts").Codec<{
+    tag: "V2";
+    value: {
+        encrypted: Uint8Array<ArrayBufferLike>;
+        tmpKey: Uint8Array<ArrayBufferLike>;
+    };
+} | {
+    tag: "V1";
+    value: {
+        encrypted: Uint8Array<ArrayBufferLike>;
+        tmpKey: Uint8Array<ArrayBufferLike>;
+    };
+}>;