@orangecheck/sdk 0.1.0

package/dist/identity.js

@@ -0,0 +1,730 @@
+'use strict';
+
+// src/utils/logger.ts
+function createLogger(namespace) {
+  const shouldLog = (level) => {
+    return false;
+  };
+  const formatMessage = (msg) => `[${namespace}] ${msg}`;
+  return {
+    debug: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.debug(formatMessage(contextOrMessage));
+        } else {
+          console.debug(formatMessage(message ?? "Debug"), contextOrMessage);
+        }
+      }
+    },
+    info: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.info(formatMessage(contextOrMessage));
+        } else {
+          console.info(formatMessage(message ?? "Info"), contextOrMessage);
+        }
+      }
+    },
+    warn: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.warn(formatMessage(contextOrMessage));
+        } else {
+          console.warn(formatMessage(message ?? "Warning"), contextOrMessage);
+        }
+      }
+    },
+    error: (contextOrMessage, message) => {
+      if (shouldLog()) {
+        if (typeof contextOrMessage === "string") {
+          console.error(formatMessage(contextOrMessage));
+        } else {
+          console.error(formatMessage(message ?? "Error"), contextOrMessage);
+        }
+      }
+    }
+  };
+}
+function logVerificationError(protocol, identifier, error, context) {
+  const logger = createLogger("identity-verification");
+  logger.error(
+    {
+      protocol,
+      identifier,
+      error: error.message,
+      stack: error.stack,
+      ...context
+    },
+    "Verification failed"
+  );
+}
+
+// src/utils/rate-limiter.ts
+var RateLimitError = class extends Error {
+  constructor(message = "Rate limit exceeded. Please try again later.") {
+    super(message);
+    this.name = "RateLimitError";
+  }
+};
+function createRateLimiter(maxRequests, windowMs) {
+  return {
+    maxRequests,
+    windowMs,
+    requests: /* @__PURE__ */ new Map()
+  };
+}
+function checkRateLimit(limiter, key) {
+  const now = Date.now();
+  const requests = limiter.requests.get(key) ?? [];
+  const validRequests = requests.filter((timestamp) => now - timestamp < limiter.windowMs);
+  if (validRequests.length >= limiter.maxRequests) {
+    return false;
+  }
+  validRequests.push(now);
+  limiter.requests.set(key, validRequests);
+  return true;
+}
+function enforceRateLimit(limiter, key) {
+  if (!checkRateLimit(limiter, key)) {
+    throw new RateLimitError();
+  }
+}
+var identityVerificationLimiter = createRateLimiter(5, 6e4);
+
+// src/identity/dns.ts
+var log = createLogger("identity-verification/dns");
+async function verifyDnsIdentity(attestationId, domain) {
+  log.info({ attestationId, domain }, "Verifying DNS identity");
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  const wellKnownResult = await checkWellKnownFile(attestationId, cleanDomain);
+  if (wellKnownResult.verified) {
+    return wellKnownResult;
+  }
+  log.info({ domain: cleanDomain }, "Well-known file not found, DNS TXT check not implemented");
+  return {
+    verified: false,
+    error: "Verification file not found. Please create .well-known/orangecheck.txt"
+  };
+}
+async function checkWellKnownFile(attestationId, domain) {
+  const urls = [
+    `https://${domain}/.well-known/orangecheck.txt`,
+    `http://${domain}/.well-known/orangecheck.txt`
+    // Fallback to HTTP
+  ];
+  for (const url of urls) {
+    try {
+      log.info({ url }, "Checking well-known file");
+      const response = await fetch(url, {
+        method: "GET",
+        headers: {
+          Accept: "text/plain"
+        },
+        // Don't follow redirects to other domains
+        redirect: "manual"
+      });
+      if (response.ok) {
+        const content = await response.text();
+        if (content.includes(attestationId)) {
+          log.info({ domain, url }, "Found attestation ID in well-known file");
+          return {
+            verified: true,
+            method: "well-known",
+            url
+          };
+        } else {
+          log.info({ domain, url }, "Well-known file exists but no attestation ID found");
+        }
+      }
+    } catch (err) {
+      log.warn({ error: err, url }, "Failed to fetch well-known file");
+    }
+  }
+  return {
+    verified: false,
+    error: "Well-known file not found or does not contain attestation ID"
+  };
+}
+function getDnsVerificationInstructions(attestationId, domain) {
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  return `To verify your DNS domain (${cleanDomain}):
+
+**Method 1: .well-known file (Recommended)**
+
+1. Create a file at: https://${cleanDomain}/.well-known/orangecheck.txt
+2. Add this content to the file:
+
+   OrangeCheck Attestation Verification
+   Domain: ${cleanDomain}
+   Attestation ID: ${attestationId}
+   Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}
+
+3. Make sure the file is publicly accessible
+4. Return here and click "Verify"
+
+**Method 2: DNS TXT record (Advanced)**
+
+1. Add a TXT record to your DNS:
+   Name: _orangecheck.${cleanDomain}
+   Value: ${attestationId}
+
+2. Wait for DNS propagation (up to 24 hours)
+3. Return here and click "Verify"
+
+Note: Method 1 is faster and easier to set up.`;
+}
+function generateWellKnownContent(attestationId, domain) {
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  return `OrangeCheck Attestation Verification
+=====================================
+
+Domain: ${cleanDomain}
+Attestation ID: ${attestationId}
+Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}
+
+This file verifies that the owner of ${cleanDomain} controls the Bitcoin
+address associated with attestation ${attestationId}.
+
+Learn more: https://ochk.io
+
+---
+
+Verification method: .well-known/orangecheck.txt
+Protocol: OrangeCheck Protocol (OCP)
+`;
+}
+function getWellKnownUrl(domain) {
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  return `https://${cleanDomain}/.well-known/orangecheck.txt`;
+}
+function isValidDomain(domain) {
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  const domainPattern = /^[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,}$/i;
+  return domainPattern.test(cleanDomain);
+}
+function isDnsIdentityVerified(attestationId, _domain, cachedContent) {
+  if (!cachedContent) {
+    return false;
+  }
+  return cachedContent.includes(attestationId);
+}
+
+// src/identity/github.ts
+var log2 = createLogger("identity-verification/github");
+async function verifyGitHubIdentity(attestationId, username) {
+  log2.info({ attestationId, username }, "Verifying GitHub identity");
+  try {
+    const response = await fetch(`https://api.github.com/users/${username}/gists`, {
+      headers: {
+        Accept: "application/vnd.github.v3+json"
+      }
+    });
+    if (!response.ok) {
+      if (response.status === 404) {
+        return {
+          verified: false,
+          error: `GitHub user '${username}' not found`
+        };
+      }
+      return {
+        verified: false,
+        error: `GitHub API error: ${response.status} ${response.statusText}`
+      };
+    }
+    const gists = await response.json();
+    log2.info({ username, gistCount: gists.length }, "Fetched GitHub gists");
+    for (const gist of gists) {
+      if (gist.description?.includes(attestationId)) {
+        log2.info({ username, gistId: gist.id }, "Found attestation ID in gist description");
+        return {
+          verified: true,
+          gistUrl: gist.html_url,
+          gistId: gist.id
+        };
+      }
+      for (const [filename, file] of Object.entries(gist.files)) {
+        if (file.content && file.content.includes(attestationId)) {
+          log2.info(
+            { username, gistId: gist.id, filename },
+            "Found attestation ID in gist file"
+          );
+          return {
+            verified: true,
+            gistUrl: gist.html_url,
+            gistId: gist.id
+          };
+        }
+        try {
+          const fileResponse = await fetch(file.raw_url);
+          if (fileResponse.ok) {
+            const content = await fileResponse.text();
+            if (content.includes(attestationId)) {
+              log2.info(
+                { username, gistId: gist.id, filename },
+                "Found attestation ID in gist file (fetched)"
+              );
+              return {
+                verified: true,
+                gistUrl: gist.html_url,
+                gistId: gist.id
+              };
+            }
+          }
+        } catch (err) {
+          log2.warn({ error: err, filename }, "Failed to fetch gist file content");
+        }
+      }
+    }
+    log2.info({ username }, "No verification gist found");
+    return {
+      verified: false,
+      error: "No gist found containing the attestation ID"
+    };
+  } catch (err) {
+    log2.error({ error: err, username }, "Failed to verify GitHub identity");
+    return {
+      verified: false,
+      error: err instanceof Error ? err.message : "Unknown error"
+    };
+  }
+}
+function getGitHubVerificationInstructions(attestationId) {
+  return `To verify your GitHub identity:
+
+1. Go to https://gist.github.com
+2. Create a new public gist
+3. Add a file with any name (e.g., "orangecheck.txt")
+4. Paste this text into the file:
+
+   OrangeCheck Attestation Verification
+   Attestation ID: ${attestationId}
+
+5. Click "Create public gist"
+6. Return here and click "Verify" to check
+
+The verification will search your public gists for this attestation ID.`;
+}
+function generateGistTemplate(attestationId, username) {
+  return `# OrangeCheck Attestation Verification
+
+I am verifying my GitHub identity (@${username}) for OrangeCheck.
+
+**Attestation ID:** \`${attestationId}\`
+
+**Timestamp:** ${(/* @__PURE__ */ new Date()).toISOString()}
+
+This gist proves that I control both:
+- GitHub account: @${username}
+- Bitcoin address associated with attestation ${attestationId}
+
+---
+
+Learn more about OrangeCheck: https://ochk.io
+`;
+}
+function isGitHubIdentityVerified(attestationId, _username, cachedGists) {
+  return cachedGists.some((gist) => {
+    if (gist.description?.includes(attestationId)) {
+      return true;
+    }
+    return Object.values(gist.files).some((file) => file.content?.includes(attestationId));
+  });
+}
+function getGistCreationUrl() {
+  return "https://gist.github.com/";
+}
+var DEFAULT_RELAYS = [
+  "wss://relay.damus.io",
+  "wss://relay.nostr.band",
+  "wss://nos.lol",
+  "wss://relay.snort.social"
+];
+
+// src/identity/nostr.ts
+var log4 = createLogger("identity-verification/nostr");
+function npubToHex(npub) {
+  if (npub.match(/^[0-9a-f]{64}$/i)) {
+    return npub.toLowerCase();
+  }
+  log4.warn({ npub }, "npub to hex conversion not fully implemented");
+  return npub;
+}
+async function queryNostrEvents(options) {
+  const { authors, kinds, search, relays = DEFAULT_RELAYS, limit = 100 } = options;
+  const events = [];
+  log4.info({ authors, kinds, relayCount: relays.length }, "Querying Nostr for events");
+  const queryPromises = relays.map(async (relayUrl) => {
+    let ws = null;
+    try {
+      ws = new WebSocket(relayUrl);
+      const wsRef = ws;
+      await new Promise((resolve, reject) => {
+        const timeout = setTimeout(() => {
+          wsRef.close();
+          reject(new Error("Query timeout"));
+        }, 1e4);
+        const cleanup = () => {
+          clearTimeout(timeout);
+          wsRef.close();
+        };
+        wsRef.onopen = () => {
+          const subscriptionId = `verify_${Date.now()}`;
+          const filter = {
+            authors,
+            kinds,
+            limit
+          };
+          wsRef.send(JSON.stringify(["REQ", subscriptionId, filter]));
+        };
+        wsRef.onmessage = (msg) => {
+          try {
+            const data = JSON.parse(msg.data);
+            if (data[0] === "EVENT") {
+              const event = data[2];
+              if (search) {
+                if (event.content.includes(search)) {
+                  events.push(event);
+                }
+              } else {
+                events.push(event);
+              }
+            } else if (data[0] === "EOSE") {
+              cleanup();
+              resolve();
+            }
+          } catch (err) {
+            log4.error({ relay: relayUrl, error: err }, "Failed to parse event");
+          }
+        };
+        wsRef.onerror = (err) => {
+          log4.error({ relay: relayUrl, error: err }, "WebSocket error during query");
+          cleanup();
+          reject(err);
+        };
+        wsRef.onclose = () => {
+          clearTimeout(timeout);
+        };
+      });
+    } catch (err) {
+      log4.error({ relay: relayUrl, error: err }, "Failed to query relay");
+    } finally {
+      if (ws && ws.readyState !== WebSocket.CLOSED) {
+        ws.close();
+      }
+    }
+  });
+  await Promise.allSettled(queryPromises);
+  log4.info({ eventCount: events.length }, "Query complete");
+  return events;
+}
+async function verifyNostrEventSignature(event) {
+  if (!event.sig || event.sig.length !== 128) {
+    return false;
+  }
+  log4.warn("Nostr signature verification not fully implemented");
+  return true;
+}
+async function verifyNostrIdentity(attestationId, npub, relays) {
+  log4.info({ attestationId, npub }, "Verifying Nostr identity");
+  try {
+    const pubkeyHex = npubToHex(npub);
+    const events = await queryNostrEvents({
+      authors: [pubkeyHex],
+      kinds: [1],
+      // Text notes
+      search: attestationId,
+      relays
+    });
+    if (events.length === 0) {
+      log4.info({ npub }, "No verification events found");
+      return {
+        verified: false,
+        error: "No verification event found. User must post a note containing the attestation ID."
+      };
+    }
+    for (const event of events) {
+      if (event.content.includes(attestationId)) {
+        const isValid = await verifyNostrEventSignature(event);
+        if (isValid) {
+          log4.info({ npub, eventId: event.id }, "Nostr identity verified");
+          return {
+            verified: true,
+            event
+          };
+        } else {
+          log4.warn({ npub, eventId: event.id }, "Invalid event signature");
+        }
+      }
+    }
+    return {
+      verified: false,
+      error: "Found events but none had valid signatures"
+    };
+  } catch (err) {
+    log4.error({ error: err, npub }, "Failed to verify Nostr identity");
+    return {
+      verified: false,
+      error: err instanceof Error ? err.message : "Unknown error"
+    };
+  }
+}
+function getNostrVerificationInstructions(attestationId) {
+  return `To verify your Nostr identity:
+
+1. Open your Nostr client (Damus, Amethyst, Primal, etc.)
+2. Post a note containing this text:
+
+   Verifying my OrangeCheck attestation: ${attestationId}
+
+3. Wait a few seconds for the note to propagate to relays
+4. Return here and click "Verify" to check
+
+The verification will search Nostr relays for your note and confirm you control this identity.`;
+}
+function isNostrIdentityVerified(attestationId, npub, cachedEvents) {
+  const pubkeyHex = npubToHex(npub);
+  return cachedEvents.some(
+    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId)
+  );
+}
+
+// src/identity/twitter.ts
+var log5 = createLogger("identity-verification/twitter");
+async function verifyTwitterIdentity(attestationId, handle, tweetUrl) {
+  log5.info({ attestationId, handle, tweetUrl }, "Verifying Twitter identity");
+  if (!tweetUrl) {
+    return {
+      verified: false,
+      error: "Tweet URL required for verification"
+    };
+  }
+  try {
+    const tweetId = extractTweetId(tweetUrl);
+    if (!tweetId) {
+      return {
+        verified: false,
+        error: "Invalid tweet URL format"
+      };
+    }
+    log5.info({ handle, tweetId }, "Manual verification required");
+    return {
+      verified: false,
+      tweetUrl,
+      tweetId,
+      error: "Automatic verification not available. Please verify manually by checking the tweet."
+    };
+  } catch (err) {
+    log5.error({ error: err, handle }, "Failed to verify Twitter identity");
+    return {
+      verified: false,
+      error: err instanceof Error ? err.message : "Unknown error"
+    };
+  }
+}
+function extractTweetId(url) {
+  const patterns = [
+    /(?:twitter\.com|x\.com)\/\w+\/status\/(\d+)/,
+    /(?:mobile\.twitter\.com)\/\w+\/status\/(\d+)/
+  ];
+  for (const pattern of patterns) {
+    const match = url.match(pattern);
+    if (match && match[1]) {
+      return match[1];
+    }
+  }
+  return null;
+}
+function getTwitterVerificationInstructions(attestationId, handle) {
+  const cleanHandle = handle.startsWith("@") ? handle.slice(1) : handle;
+  return `To verify your Twitter identity (@${cleanHandle}):
+
+1. Go to https://twitter.com/compose/tweet
+2. Post a tweet with this text:
+
+   Verifying my OrangeCheck attestation: ${attestationId}
+
+3. After posting, copy the tweet URL
+4. Paste the URL below and click "Verify"
+
+Example tweet URL:
+https://twitter.com/${cleanHandle}/status/1234567890
+
+The verification will check that the tweet exists and contains the attestation ID.`;
+}
+function generateTweetText(attestationId) {
+  return `Verifying my OrangeCheck attestation: ${attestationId}
+
+Proving Bitcoin reputation with cryptographic signatures.
+
+#OrangeCheck #Bitcoin`;
+}
+function getTwitterComposeUrl(attestationId) {
+  const text = generateTweetText(attestationId);
+  const encoded = encodeURIComponent(text);
+  return `https://twitter.com/intent/tweet?text=${encoded}`;
+}
+function isValidTweetUrl(url) {
+  return extractTweetId(url) !== null;
+}
+function getTweetUrl(handle, tweetId) {
+  const cleanHandle = handle.startsWith("@") ? handle.slice(1) : handle;
+  return `https://twitter.com/${cleanHandle}/status/${tweetId}`;
+}
+function getManualVerificationInstructions(attestationId, handle, tweetUrl) {
+  return `Manual Verification Steps:
+
+1. Open this tweet: ${tweetUrl}
+2. Verify it's posted by @${handle}
+3. Check that the tweet contains: ${attestationId}
+4. Confirm the tweet is public and not deleted
+
+If all checks pass, the identity is verified.`;
+}
+
+// src/identity/index.ts
+async function verifyIdentity(attestationId, identity, options) {
+  const { protocol, identifier } = identity;
+  const rateLimitKey = `${protocol}:${identifier}`;
+  try {
+    enforceRateLimit(identityVerificationLimiter, rateLimitKey);
+  } catch (err) {
+    return {
+      verified: false,
+      error: err instanceof Error ? err.message : "Rate limit exceeded"
+    };
+  }
+  try {
+    switch (protocol) {
+      case "nostr":
+        return await verifyNostrIdentity(attestationId, identifier, options?.relays);
+      case "github":
+        return await verifyGitHubIdentity(attestationId, identifier);
+      case "twitter":
+        return await verifyTwitterIdentity(attestationId, identifier, options?.tweetUrl);
+      case "dns":
+        return await verifyDnsIdentity(attestationId, identifier);
+      case "email":
+        return {
+          verified: false,
+          error: "Email verification not implemented"
+        };
+      case "web":
+        return await verifyDnsIdentity(attestationId, identifier);
+      case "did":
+        return {
+          verified: false,
+          error: "DID verification not implemented"
+        };
+      default:
+        return {
+          verified: false,
+          error: `Unknown protocol: ${protocol}`
+        };
+    }
+  } catch (error) {
+    logVerificationError(
+      protocol,
+      identifier,
+      error instanceof Error ? error : new Error(String(error)),
+      {
+        attestationId
+      }
+    );
+    return {
+      verified: false,
+      error: error instanceof Error ? error.message : "Verification failed"
+    };
+  }
+}
+function getVerificationInstructions(attestationId, identity) {
+  const { protocol, identifier } = identity;
+  switch (protocol) {
+    case "nostr":
+      return getNostrVerificationInstructions(attestationId);
+    case "github":
+      return getGitHubVerificationInstructions(attestationId);
+    case "twitter":
+      return getTwitterVerificationInstructions(attestationId, identifier);
+    case "dns":
+      return getDnsVerificationInstructions(attestationId, identifier);
+    case "email":
+      return `Email verification not implemented yet.`;
+    case "web":
+      return getDnsVerificationInstructions(attestationId, identifier);
+    case "did":
+      return `DID verification not implemented yet.`;
+    default:
+      return `Unknown protocol: ${protocol}`;
+  }
+}
+function supportsAutomaticVerification(protocol) {
+  return ["nostr", "github", "dns", "web"].includes(protocol);
+}
+function requiresManualVerification(protocol) {
+  return ["twitter", "email"].includes(protocol);
+}
+async function verifyAllIdentities(attestationId, identities, options) {
+  const results = /* @__PURE__ */ new Map();
+  await Promise.all(
+    identities.map(async (identity) => {
+      const key = `${identity.protocol}:${identity.identifier}`;
+      const tweetUrl = options?.tweetUrls?.[identity.identifier];
+      const result = await verifyIdentity(attestationId, identity, {
+        tweetUrl,
+        relays: options?.relays
+      });
+      results.set(key, result);
+    })
+  );
+  return results;
+}
+function getVerificationSummary(results) {
+  let verified = 0;
+  let failed = 0;
+  let pending = 0;
+  for (const result of results.values()) {
+    if (result.verified) {
+      verified++;
+    } else if (result.error?.includes("not implemented")) {
+      pending++;
+    } else {
+      failed++;
+    }
+  }
+  return {
+    total: results.size,
+    verified,
+    failed,
+    pending
+  };
+}
+
+exports.generateGistTemplate = generateGistTemplate;
+exports.generateTweetText = generateTweetText;
+exports.generateWellKnownContent = generateWellKnownContent;
+exports.getDnsVerificationInstructions = getDnsVerificationInstructions;
+exports.getGistCreationUrl = getGistCreationUrl;
+exports.getGitHubVerificationInstructions = getGitHubVerificationInstructions;
+exports.getManualVerificationInstructions = getManualVerificationInstructions;
+exports.getNostrVerificationInstructions = getNostrVerificationInstructions;
+exports.getTweetUrl = getTweetUrl;
+exports.getTwitterComposeUrl = getTwitterComposeUrl;
+exports.getTwitterVerificationInstructions = getTwitterVerificationInstructions;
+exports.getVerificationInstructions = getVerificationInstructions;
+exports.getVerificationSummary = getVerificationSummary;
+exports.getWellKnownUrl = getWellKnownUrl;
+exports.isDnsIdentityVerified = isDnsIdentityVerified;
+exports.isGitHubIdentityVerified = isGitHubIdentityVerified;
+exports.isNostrIdentityVerified = isNostrIdentityVerified;
+exports.isValidDomain = isValidDomain;
+exports.isValidTweetUrl = isValidTweetUrl;
+exports.requiresManualVerification = requiresManualVerification;
+exports.supportsAutomaticVerification = supportsAutomaticVerification;
+exports.verifyAllIdentities = verifyAllIdentities;
+exports.verifyDnsIdentity = verifyDnsIdentity;
+exports.verifyGitHubIdentity = verifyGitHubIdentity;
+exports.verifyIdentity = verifyIdentity;
+exports.verifyNostrIdentity = verifyNostrIdentity;
+exports.verifyTwitterIdentity = verifyTwitterIdentity;
+//# sourceMappingURL=identity.js.map
+//# sourceMappingURL=identity.js.map