@onekeyfe/hwk-ledger-adapter 1.2.1 → 1.2.2-alpha.1

package/dist/index.mjs

@@ -734,6 +734,10 @@ var _LedgerAdapter = class _LedgerAdapter {
     // The Ledger device itself still requires a per-call confirmation — that's
     // the Ledger app's safety boundary, not ours to bypass.
     this._btcHighIndexConfirmedThisSession = false;
+    // Runtime relay configuration mutates connector-wide DMK state. Serialize
+    // the complete configure → genuine check → clear lifecycle so concurrent
+    // callers cannot reset or overwrite each other's one-shot relay.
+    this._deviceAuthenticityQueueTail = Promise.resolve();
     // Shared across concurrent callers — only `cancel()` aborts.
     this._doConnectAbortController = null;
     this._installProgressLastEmittedValue = -Infinity;
@@ -1284,6 +1288,75 @@ var _LedgerAdapter = class _LedgerAdapter {
       return this.errorToFailure(err);
     }
   }
+  /**
+   * Runs Ledger's official genuine check (DMK GenuineCheckDeviceAction) over the
+   * SAME secure-channel backend as app install
+   * (wss://scriptrunner.api.live.ledger.com/update/genuine). It returns Ledger's
+   * HSM verdict (`verified`) and a stable per-device id = sha3-256 of the device
+   * attestation public key, which DMK reads inside that session. The id survives
+   * wipe/recovery and cannot be forged from a seed.
+   *
+   * Requires network access to Ledger's backend and an on-device
+   * "Allow secure connection" confirmation the first time.
+   */
+  async verifyDeviceAuthenticity(connectId, params = {}) {
+    const waitForPrevious = this._deviceAuthenticityQueueTail;
+    let releaseQueue = () => void 0;
+    this._deviceAuthenticityQueueTail = new Promise((resolve) => {
+      releaseQueue = resolve;
+    });
+    await waitForPrevious;
+    try {
+      return await this._verifyDeviceAuthenticityExclusive(connectId, params);
+    } finally {
+      releaseQueue();
+    }
+  }
+  async _verifyDeviceAuthenticityExclusive(connectId, params) {
+    const relayUrl = params.ledgerGenuineCheckWebSocketUrl;
+    try {
+      if (relayUrl) {
+        if (!this.connector.configure) {
+          return failure2(
+            HardwareErrorCode3.MethodNotSupported,
+            "This Ledger connector does not support genuine-check relay configuration"
+          );
+        }
+        await this.connector.configure({ ledgerGenuineCheckWebSocketUrl: relayUrl });
+        this.resetState();
+      }
+      const result = await this.connectorCall(connectId, "getDeviceGenuineCheck", {});
+      if (!result.isGenuine) {
+        return success({
+          vendor: "ledger",
+          verified: false
+        });
+      }
+      if (!result.deviceId) {
+        return failure2(
+          HardwareErrorCode3.UnknownError,
+          `Genuine check completed (isGenuine=${result.isGenuine}) but no deviceId was captured`
+        );
+      }
+      return success({
+        vendor: "ledger",
+        verified: result.isGenuine,
+        deviceId: result.deviceId
+      });
+    } catch (err) {
+      return this.errorToFailure(err);
+    } finally {
+      if (relayUrl) {
+        try {
+          await this.connector.configure?.({ ledgerGenuineCheckWebSocketUrl: void 0 });
+          this.resetState();
+        } catch {
+          this.connector.reset();
+          this.resetState();
+        }
+      }
+    }
+  }
   on(event, listener) {
     this.emitter.on(event, listener);
   }
@@ -4035,6 +4108,30 @@ var HARDWARE_ERROR_CODE_VALUES = new Set(
   Object.values(HardwareErrorCode8).filter((value) => typeof value === "number")
 );
 var BLE_CONNECT_SCAN_TIMEOUT_MS = 1500;
+var LEDGER_RELAY_ALLOWED_ROOT_DOMAINS = ["onekeytest.com", "onekey.com"];
+function isAllowedLedgerRelayHost(hostname) {
+  return LEDGER_RELAY_ALLOWED_ROOT_DOMAINS.some(
+    (root) => hostname === root || hostname.endsWith(`.${root}`)
+  );
+}
+var LEDGER_RELAY_PATH_PREFIX = "/v1/ledger/session/";
+var LEDGER_RELAY_TOKEN_PATTERN = /^[A-Za-z0-9_-]{32,256}$/;
+var MAX_LEDGER_RELAY_URL_LENGTH = 2048;
+function assertAllowedLedgerRelayUrl(rawUrl) {
+  if (!rawUrl || rawUrl.length > MAX_LEDGER_RELAY_URL_LENGTH) {
+    throw new Error("Ledger genuine-check relay URL is invalid");
+  }
+  let parsed;
+  try {
+    parsed = new URL(rawUrl);
+  } catch {
+    throw new Error("Ledger genuine-check relay URL is invalid");
+  }
+  const token = parsed.pathname.startsWith(LEDGER_RELAY_PATH_PREFIX) ? parsed.pathname.slice(LEDGER_RELAY_PATH_PREFIX.length) : "";
+  if (parsed.protocol !== "wss:" || !isAllowedLedgerRelayHost(parsed.hostname) || parsed.port !== "" || parsed.username !== "" || parsed.password !== "" || parsed.search !== "" || parsed.hash !== "" || !LEDGER_RELAY_TOKEN_PATTERN.test(token)) {
+    throw new Error("Ledger genuine-check relay URL is not allowed");
+  }
+}
 async function defaultLedgerKitImporter(pkg) {
   switch (pkg) {
     case "@ledgerhq/device-management-kit":
@@ -4556,6 +4653,41 @@ var LedgerConnectorBase = class {
           ctx.clearCanceller(sessionId);
         }
       }
+      case "getDeviceGenuineCheck": {
+        try {
+          const dmk = await ctx.getOrCreateDmk();
+          const kit = await ctx.importLedgerKit("@ledgerhq/device-management-kit");
+          const action = dmk.executeDeviceAction({
+            sessionId,
+            deviceAction: new kit.GenuineCheckDeviceAction({ input: {} })
+          });
+          let deviceId;
+          const output = await deviceActionToPromise(
+            action,
+            (interaction) => ctx.emit("ui-event", {
+              type: collapseSignerInteraction(interaction),
+              payload: { sessionId }
+            }),
+            // Generous timeout: covers websocket round-trips + the on-device
+            // "Allow secure connection" tap (the idle watchdog does not pause
+            // for it, only for unlock-device).
+            5 * 6e4,
+            (cancel) => ctx.registerCanceller(sessionId, cancel),
+            (intermediateValue) => {
+              const iv = intermediateValue;
+              if (iv?.deviceId instanceof Uint8Array && iv.deviceId.length === 32 && !deviceId) {
+                deviceId = Buffer.from(iv.deviceId).toString("hex");
+              }
+            }
+          );
+          return { isGenuine: output.isGenuine, deviceId };
+        } catch (err) {
+          ctx.invalidateSession(sessionId);
+          throw ctx.wrapError(err);
+        } finally {
+          ctx.clearCanceller(sessionId);
+        }
+      }
       default:
         throw new Error(`LedgerConnector: unknown method "${method}"`);
     }
@@ -4588,8 +4720,23 @@ var LedgerConnectorBase = class {
   // IConnector -- Reset
   // ---------------------------------------------------------------------------
   reset() {
+    this._ledgerGenuineCheckWebSocketUrl = void 0;
     this._resetAll();
   }
+  async configure(config) {
+    const nextUrl = config.ledgerGenuineCheckWebSocketUrl;
+    if (nextUrl) {
+      assertAllowedLedgerRelayUrl(nextUrl);
+      if (this._providedDmk) {
+        throw new Error("Cannot change Ledger genuine-check relay on a pre-built DMK");
+      }
+    }
+    if (nextUrl === this._ledgerGenuineCheckWebSocketUrl) {
+      return;
+    }
+    this._resetAll();
+    this._ledgerGenuineCheckWebSocketUrl = nextUrl;
+  }
   // ---------------------------------------------------------------------------
   // Private -- DMK / Manager lifecycle
   // ---------------------------------------------------------------------------
@@ -4615,7 +4762,11 @@ var LedgerConnectorBase = class {
     );
     const transportFactory = await this._createTransport();
     debugLog("[DMK] _getOrCreateDmk: transportFactory type:", typeof transportFactory);
-    const dmk = new DeviceManagementKitBuilder().addTransport(transportFactory).build();
+    const builder = new DeviceManagementKitBuilder().addTransport(transportFactory);
+    if (this._ledgerGenuineCheckWebSocketUrl) {
+      builder.addConfig({ webSocketUrl: this._ledgerGenuineCheckWebSocketUrl });
+    }
+    const dmk = builder.build();
     this._dmk = dmk;
     debugLog("[DMK] _getOrCreateDmk: DMK created");
     return dmk;