@opengovsg/formsg-sdk 0.13.0 → 0.15.0

package/.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
         with:
           node-version: 18
       - name: Cache Node.js modules
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           # npm cache files are stored in `~/.npm` on Linux/macOS
           path: ~/.npm
@@ -35,7 +35,7 @@ jobs:
         with:
           node-version: 18
       - name: Cache Node.js modules
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           # npm cache files are stored in `~/.npm` on Linux/macOS
           path: ~/.npm
@@ -47,7 +47,7 @@ jobs:
       - run: npm run test-ci
         env:
           NODE_OPTIONS: '--max-old-space-size=8192'
-      - name: Submit test coverage to Coveralls
-        uses: coverallsapp/github-action@v1.1.2
+      - name: Submit coverage to Coveralls
+        uses: coverallsapp/github-action@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

package/CHANGELOG.md

@@ -4,8 +4,29 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
+#### [v0.15.0](https://github.com/opengovsg/formsg-javascript-sdk/compare/v0.15.0...v0.14.0)
+
+- feat: add verified content to v3 [`#121`](https://github.com/opengovsg/formsg-javascript-sdk/pull/121)
+
+
+#### [v0.14.0](https://github.com/opengovsg/formsg-javascript-sdk/compare/v0.13.0...v0.14.0)
+
+- chore: remove build status from README.md [`#120`](https://github.com/opengovsg/formsg-javascript-sdk/pull/120)
+
+> 6 August 2025
+
+- feat: add signature to supported form fields [`#118`](https://github.com/opengovsg/formsg-javascript-sdk/pull/118)
+- fix: upgrade actions/cache [`#115`](https://github.com/opengovsg/formsg-javascript-sdk/pull/115)
+- Release v0.13.0 [`#114`](https://github.com/opengovsg/formsg-javascript-sdk/pull/114)
+- updated readme with address answerArray [`#112`](https://github.com/opengovsg/formsg-javascript-sdk/pull/112)
+- build(deps-dev): bump braces from 3.0.2 to 3.0.3 [`#109`](https://github.com/opengovsg/formsg-javascript-sdk/pull/109)
+- build(deps): bump follow-redirects from 1.15.4 to 1.15.6 [`#107`](https://github.com/opengovsg/formsg-javascript-sdk/pull/107)
+- add signature to supported form fields [`31db628`](https://github.com/opengovsg/formsg-javascript-sdk/commit/31db628ce44e009b5c19f8c9910bd997d77df586)
+
 #### [v0.13.0](https://github.com/opengovsg/formsg-javascript-sdk/compare/v0.12.0...v0.13.0)
 
+> 15 January 2025
+
 - add address to field type [`#111`](https://github.com/opengovsg/formsg-javascript-sdk/pull/111)
 
 #### [v0.12.0](https://github.com/opengovsg/formsg-javascript-sdk/compare/v0.12.0-alpha.1...v0.12.0)

package/README.md

@@ -1,6 +1,5 @@
 _Please note that this is an SDK for webhooks integration, and_ **_not_** _the FormSG system._
 
-[![Build Status](https://travis-ci.com/opengovsg/formsg-javascript-sdk.svg?branch=master)](https://travis-ci.com/opengovsg/formsg-javascript-sdk)
 [![Coverage Status](https://coveralls.io/repos/github/opengovsg/formsg-javascript-sdk/badge.svg?branch=master)](https://coveralls.io/github/opengovsg/formsg-javascript-sdk?branch=master)
 
 # FormSG Javascript SDK
@@ -181,6 +180,10 @@ Attachments are end-to-end encrypted in the same way as normal form submissions,
 
 _Warning:_ We do not have the ability to scan any attachments for malicious content (e.g. spyware or viruses), so careful handling is needed.
 
+### Processing Local address fields
+
+Address Field is a compound field with 6 inputs in the answerArray. It will always follow the ordinance of [`blockNumber`, `streetName`, `buildingName`, `levelNumber`, `unitNumber`, `postalCode`]
+
 ### Format of Payment Content
 
 These fields will be available if the submission is a payment submission, otherwise, the value will be an empty `{}`.

package/dist/crypto-v3.d.ts

@@ -1,7 +1,10 @@
 import CryptoBase from './crypto-base';
 import { DecryptedContentV3, DecryptParams, DecryptParamsV3, EncryptedContentV3 } from './types';
 export default class CryptoV3 extends CryptoBase {
-    constructor();
+    signingPublicKey?: string;
+    constructor({ signingPublicKey }?: {
+        signingPublicKey?: string;
+    });
     /**
      * Encrypt input with a unique keypair for each submission.
      * @param msg The message to encrypt, will be stringified.
@@ -26,6 +29,7 @@ export default class CryptoV3 extends CryptoBase {
      * @param decryptParams.encryptedSubmissionSecretKey The encrypted submission secret key encoded with base-64.
      * @param decryptParams.version The version of the payload. Used to determine the decryption process to decrypt the content with.
      * @returns The decrypted content if successful. Else, null will be returned.
+     * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
      */
     decrypt: (formSecretKey: string, decryptParams: DecryptParamsV3) => DecryptedContentV3 | null;
     /**

package/dist/crypto-v3.js

@@ -44,9 +44,11 @@ var tweetnacl_util_1 = require("tweetnacl-util");
 var crypto_1 = require("./util/crypto");
 var validate_1 = require("./util/validate");
 var crypto_base_1 = __importDefault(require("./crypto-base"));
+var errors_1 = require("./errors");
 var CryptoV3 = /** @class */ (function (_super) {
     __extends(CryptoV3, _super);
-    function CryptoV3() {
+    function CryptoV3(_a) {
+        var _b = _a === void 0 ? {} : _a, signingPublicKey = _b.signingPublicKey;
         var _this = _super.call(this) || this;
         /**
          * Encrypt input with a unique keypair for each submission.
@@ -76,7 +78,7 @@ var CryptoV3 = /** @class */ (function (_super) {
          */
         _this.decryptFromSubmissionKey = function (submissionSecretKey, decryptParams) {
             try {
-                var encryptedContent = decryptParams.encryptedContent;
+                var encryptedContent = decryptParams.encryptedContent, verifiedContent = decryptParams.verifiedContent;
                 // Do not return the transformed object in `_decrypt` function as a signed
                 // object is not encoded in UTF8 and is encoded in Base-64 instead.
                 var decryptedContent = (0, crypto_1.decryptContent)(submissionSecretKey, encryptedContent);
@@ -91,9 +93,35 @@ var CryptoV3 = /** @class */ (function (_super) {
                     submissionSecretKey: submissionSecretKey,
                     responses: decryptedObject,
                 };
+                /**
+                 * Note on verifiedContent decryption for cryptoV3:
+                 * Although decryption is supported, verifiedContent encryption is not supported
+                 * in cryptoV3 encrypt.
+                 * This is to keep the encryption of verifiedContent and encryptedContent similar to storage mode - where
+                 * verifiedContent and encryptedContent are defined and encrypted separately.
+                 */
+                // decrypt verifiedContent if it exists
+                if (verifiedContent) {
+                    if (!_this.signingPublicKey) {
+                        throw new errors_1.MissingPublicKeyError('Public signing key must be provided when instantiating the Crypto class in order to verify verified content');
+                    }
+                    var decryptedVerifiedContent = (0, crypto_1.decryptContent)(submissionSecretKey, verifiedContent);
+                    if (!decryptedVerifiedContent) {
+                        // Returns null if decrypting verified content failed.
+                        throw new Error('Failed to decrypt verified content');
+                    }
+                    var decryptedVerifiedObject = (0, crypto_1.verifySignedMessage)(decryptedVerifiedContent, _this.signingPublicKey);
+                    returnedObject.verified = decryptedVerifiedObject;
+                }
                 return returnedObject;
             }
             catch (err) {
+                // Should only throw if MissingPublicKeyError.
+                // This library should be able to be used to encrypt and decrypt content
+                // if the content does not contain verified fields.
+                if (err instanceof errors_1.MissingPublicKeyError) {
+                    throw err;
+                }
                 return null;
             }
         };
@@ -105,13 +133,23 @@ var CryptoV3 = /** @class */ (function (_super) {
          * @param decryptParams.encryptedSubmissionSecretKey The encrypted submission secret key encoded with base-64.
          * @param decryptParams.version The version of the payload. Used to determine the decryption process to decrypt the content with.
          * @returns The decrypted content if successful. Else, null will be returned.
+         * @throws {MissingPublicKeyError} if a public key is not provided when instantiating this class and is needed for verifying signed content.
          */
         _this.decrypt = function (formSecretKey, decryptParams) {
-            var encryptedSubmissionSecretKey = decryptParams.encryptedSubmissionSecretKey, rest = __rest(decryptParams, ["encryptedSubmissionSecretKey"]);
-            var submissionSecretKey = (0, crypto_1.decryptContent)(formSecretKey, encryptedSubmissionSecretKey);
-            if (submissionSecretKey === null)
+            try {
+                var encryptedSubmissionSecretKey = decryptParams.encryptedSubmissionSecretKey, rest = __rest(decryptParams, ["encryptedSubmissionSecretKey"]);
+                var submissionSecretKey = (0, crypto_1.decryptContent)(formSecretKey, encryptedSubmissionSecretKey);
+                if (submissionSecretKey === null)
+                    return null;
+                return _this.decryptFromSubmissionKey((0, tweetnacl_util_1.encodeBase64)(submissionSecretKey), rest);
+            }
+            catch (err) {
+                if (err instanceof errors_1.MissingPublicKeyError) {
+                    // rethrow to let the caller decide how to handle missing signing key
+                    throw err;
+                }
                 return null;
-            return _this.decryptFromSubmissionKey((0, tweetnacl_util_1.encodeBase64)(submissionSecretKey), rest);
+            }
         };
         /**
          * Returns true if a pair of public & secret keys are associated with each other
@@ -127,6 +165,7 @@ var CryptoV3 = /** @class */ (function (_super) {
             return (testResponse.toString() ===
                 ((_a = _this.decrypt(secretKey, __assign(__assign({}, cipherResponse), { version: internalValidationVersion }))) === null || _a === void 0 ? void 0 : _a.responses.toString()));
         };
+        _this.signingPublicKey = signingPublicKey;
         return _this;
     }
     return CryptoV3;

package/dist/index.js

@@ -25,7 +25,7 @@ module.exports = function (config) {
             secretKey: webhookSecretKey,
         }),
         crypto: new crypto_1.default({ signingPublicKey: signingPublicKey }),
-        cryptoV3: new crypto_v3_1.default(),
+        cryptoV3: new crypto_v3_1.default({ signingPublicKey: signingPublicKey }),
         verification: new verification_1.default({
             publicKey: verificationPublicKey,
             secretKey: verificationOptions === null || verificationOptions === void 0 ? void 0 : verificationOptions.secretKey,

package/dist/types.d.ts

@@ -6,7 +6,7 @@ export type PackageInitParams = {
     /** Initializes public key used for verifying and decrypting in this package. If not given, will default to "production". */
     mode?: PackageMode;
 };
-export type FieldType = 'section' | 'radiobutton' | 'dropdown' | 'checkbox' | 'nric' | 'email' | 'table' | 'number' | 'rating' | 'yes_no' | 'decimal' | 'textfield' | 'textarea' | 'attachment' | 'date' | 'mobile' | 'homeno' | 'statement' | 'image' | 'country_region' | 'uen' | 'children' | 'address';
+export type FieldType = 'section' | 'radiobutton' | 'dropdown' | 'checkbox' | 'nric' | 'email' | 'table' | 'number' | 'rating' | 'yes_no' | 'decimal' | 'textfield' | 'textarea' | 'attachment' | 'date' | 'mobile' | 'homeno' | 'statement' | 'image' | 'country_region' | 'uen' | 'children' | 'address' | 'signature';
 export type FormField = {
     _id: string;
     question: string;
@@ -41,6 +41,7 @@ export interface DecryptParams {
 export interface DecryptParamsV3 {
     encryptedContent: EncryptedContent;
     encryptedSubmissionSecretKey: EncryptedContent;
+    verifiedContent?: EncryptedContent;
     version: number;
 }
 export type DecryptedContent = {
@@ -50,6 +51,7 @@ export type DecryptedContent = {
 export type DecryptedContentV3 = {
     submissionSecretKey: string;
     responses: FormFieldsV3;
+    verified?: Record<string, any>;
 };
 export type DecryptedFile = {
     filename: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengovsg/formsg-sdk",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/opengovsg/formsg-javascript-sdk.git"
@@ -36,7 +36,6 @@
     "@types/node": "^18.18.9",
     "@typescript-eslint/eslint-plugin": "^4.25.0",
     "auto-changelog": "^2.4.0",
-    "coveralls": "^3.1.1",
     "eslint-config-prettier": "^8.3.0",
     "eslint-plugin-import": "^2.23.3",
     "eslint-plugin-jest": "^24.3.6",