@orangecheck/sdk 1.6.0 → 1.7.0

package/dist/index.js

@@ -1,11 +1,11 @@
 'use strict';
 
+var base = require('@scure/base');
 var buffer = require('buffer');
 var bip322Js = require('bip322-js');
 var bitcoinMessage = require('bitcoinjs-message');
 var secp256k1_js = require('@noble/curves/secp256k1.js');
 var sha2_js = require('@noble/hashes/sha2.js');
-var base = require('@scure/base');
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -150,6 +150,31 @@ async function createAttestationEnvelope(message, signature, scheme, address, id
     relay_hints
   };
 }
+var HEX_64_RE = /^[0-9a-f]{64}$/;
+function toHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function nostrPubkeyToHex(value) {
+  const trimmed = value.trim().toLowerCase();
+  if (HEX_64_RE.test(trimmed)) return trimmed;
+  if (!trimmed.startsWith("npub1")) return null;
+  try {
+    const decoded = base.bech32.decode(trimmed, 1023);
+    if (decoded.prefix !== "npub") return null;
+    const bytes = base.bech32.fromWords(decoded.words);
+    return bytes.length === 32 ? toHex(Uint8Array.from(bytes)) : null;
+  } catch {
+    return null;
+  }
+}
+function nostrIdentifierForms(identifier) {
+  const hex = nostrPubkeyToHex(identifier);
+  if (!hex) return [identifier];
+  const bytes = Uint8Array.from(hex.match(/../g).map((b) => parseInt(b, 16)));
+  return [base.bech32.encode("npub", base.bech32.toWords(bytes), 1023), hex];
+}
 function createLogger(namespace) {
   const shouldLog = (level) => {
     return false;
@@ -471,6 +496,7 @@ async function queryByAddress(address, relays = DEFAULT_RELAYS) {
 async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
   const events = [];
   const identityTag = `${protocol}:${identifier}`;
+  const identityTags = protocol === "nostr" ? nostrIdentifierForms(identifier).map((f) => `nostr:${f}`) : [identityTag];
   log.info({ protocol, identifier, relayCount: relays.length }, "Querying relays for identity");
   const deadlineAt = Date.now() + FANOUT_DEADLINE_MS;
   const queryPromises = relays.map(async (relayUrl) => {
@@ -489,7 +515,7 @@ async function queryByIdentity(protocol, identifier, relays = DEFAULT_RELAYS) {
               subscriptionId,
               {
                 kinds: [30078],
-                "#i": [identityTag],
+                "#i": identityTags,
                 limit: 10
               }
             ])
@@ -655,6 +681,12 @@ async function publishAttestation(options) {
   );
   return result;
 }
+function eventIndexesEnvelope(event, envelope) {
+  const d = event.tags.find((t) => t[0] === "d")?.[1];
+  const id = envelope.attestation_id;
+  if (d !== id && d !== `orangecheck:${id}`) return false;
+  return event.tags.some((t) => t[0] === "t" && t[1] === envelope.address);
+}
 async function discoverAttestations(options) {
   const { attestationId, address, identity, relays = DEFAULT_RELAYS } = options;
   let events = [];
@@ -673,7 +705,9 @@ async function discoverAttestations(options) {
   const envelopes = [];
   for (const event of events) {
     const envelope = parseAttestationFromEvent(event);
-    if (envelope) {
+    if (envelope && !eventIndexesEnvelope(event, envelope)) {
+      log3.warn({ eventId: event.id }, "Skipping event whose index tags disagree with its envelope");
+    } else if (envelope) {
       const isValid = await verifyAttestationEnvelope(envelope);
       if (isValid) {
         envelopes.push(envelope);
@@ -1157,18 +1191,15 @@ async function check(params) {
   if (!addr && !id && !identity) {
     return { ok: false, sats: 0, days: 0, score: 0, reasons: ["bad_request"] };
   }
-  let envelopes = [];
+  let found = [];
   if (id) {
-    envelopes = await discoverAttestations({ attestationId: id, relays });
+    found = await discoverAttestations({ attestationId: id, relays });
   } else if (addr) {
-    envelopes = await getAttestationsForAddress(addr, relays);
+    found = await getAttestationsForAddress(addr, relays);
   } else if (identity) {
-    envelopes = await getAttestationsForIdentity(
-      identity.protocol,
-      identity.identifier,
-      relays
-    );
+    found = await getAttestationsForIdentity(identity.protocol, identity.identifier, relays);
   }
+  const envelopes = found.filter((e) => signedMatch(e, { addr, id, identity }));
   if (envelopes.length === 0) {
     return { ok: false, sats: 0, days: 0, score: 0, reasons: ["not_found"] };
   }
@@ -1177,6 +1208,7 @@ async function check(params) {
   if (!env) {
     return { ok: false, sats: 0, days: 0, score: 0, reasons: ["not_found"] };
   }
+  const shared = identity ? await backsOtherIdentity(env, identity, relays) : false;
   const outcome = await verify2(
     {
       addr: env.address,
@@ -1191,9 +1223,10 @@ async function check(params) {
   const score = outcome.metrics?.score ?? 0;
   const reasons = [];
   if (!outcome.ok) reasons.push(...outcome.codes);
+  if (shared) reasons.push("stake_shared");
   if (sats < minSats) reasons.push("below_min_sats");
   if (days < minDays) reasons.push("below_min_days");
-  const ok = outcome.ok && sats >= minSats && days >= minDays;
+  const ok = outcome.ok && !shared && sats >= minSats && days >= minDays;
   return {
     ok,
     sats,
@@ -1206,6 +1239,50 @@ async function check(params) {
     ...reasons.length ? { reasons } : {}
   };
 }
+function identityKey(b) {
+  const protocol = b.protocol.trim().toLowerCase();
+  if (protocol === "nostr") {
+    const hex = nostrPubkeyToHex(b.identifier);
+    return hex ? `nostr:${hex}` : null;
+  }
+  return `${protocol}:${b.identifier.trim()}`;
+}
+function signedIdentities(env) {
+  try {
+    return parseCanonicalMessage(env.message).core.identities;
+  } catch {
+    return [];
+  }
+}
+function signedMatch(env, q) {
+  if (q.id) return env.attestation_id.toLowerCase() === q.id.trim().toLowerCase();
+  let signedAddress;
+  try {
+    signedAddress = parseCanonicalMessage(env.message).core.address;
+  } catch {
+    return false;
+  }
+  if (signedAddress !== env.address) return false;
+  if (q.addr) return signedAddress === q.addr;
+  if (q.identity) {
+    const want = identityKey(q.identity);
+    return want !== null && signedIdentities(env).some((b) => identityKey(b) === want);
+  }
+  return false;
+}
+async function backsOtherIdentity(env, identity, relays) {
+  const want = identityKey(identity);
+  const protocol = identity.protocol.trim().toLowerCase();
+  const siblings = await getAttestationsForAddress(env.address, relays);
+  for (const e of [env, ...siblings]) {
+    if (!signedMatch(e, { addr: env.address })) continue;
+    for (const b of signedIdentities(e)) {
+      if (b.protocol.trim().toLowerCase() !== protocol) continue;
+      if (identityKey(b) !== want) return true;
+    }
+  }
+  return false;
+}
 var AUTH_HEADER = "orangecheck-auth";
 var AUTH_ACK = "I authorize this session under the OrangeCheck auth challenge.";
 function randomNonce() {
@@ -1660,8 +1737,8 @@ function getGistCreationUrl() {
   return "https://gist.github.com/";
 }
 var log7 = createLogger("identity-verification/nostr");
-var HEX_64_RE = /^[0-9a-f]{64}$/;
-function toHex(bytes) {
+var HEX_64_RE2 = /^[0-9a-f]{64}$/;
+function toHex2(bytes) {
   let out = "";
   for (const b of bytes) out += b.toString(16).padStart(2, "0");
   return out;
@@ -1675,22 +1752,9 @@ function fromHex(hex) {
   return out;
 }
 function npubToHex(npub) {
-  const trimmed = npub.trim();
-  if (HEX_64_RE.test(trimmed.toLowerCase())) {
-    return trimmed.toLowerCase();
-  }
-  if (!trimmed.toLowerCase().startsWith("npub1")) {
-    throw new Error(`not an npub: ${trimmed.slice(0, 12)}\u2026`);
-  }
-  const decoded = base.bech32.decode(trimmed.toLowerCase(), 1023);
-  if (decoded.prefix !== "npub") {
-    throw new Error(`bech32 prefix mismatch: expected npub, got ${decoded.prefix}`);
-  }
-  const bytes = base.bech32.fromWords(decoded.words);
-  if (bytes.length !== 32) {
-    throw new Error(`invalid npub payload length: ${bytes.length}`);
-  }
-  return toHex(Uint8Array.from(bytes));
+  const hex = nostrPubkeyToHex(npub);
+  if (!hex) throw new Error(`not an npub: ${npub.trim().slice(0, 12)}\u2026`);
+  return hex;
 }
 async function queryNostrEvents(options) {
   const { authors, kinds, search, relays = DEFAULT_RELAYS, limit = 100 } = options;
@@ -1762,7 +1826,7 @@ async function queryNostrEvents(options) {
 }
 async function verifyNostrEventSignature(event) {
   try {
-    if (!event.id || !event.sig || !event.pubkey || typeof event.id !== "string" || typeof event.sig !== "string" || typeof event.pubkey !== "string" || event.sig.length !== 128 || !HEX_64_RE.test(event.id) || !HEX_64_RE.test(event.pubkey)) {
+    if (!event.id || !event.sig || !event.pubkey || typeof event.id !== "string" || typeof event.sig !== "string" || typeof event.pubkey !== "string" || event.sig.length !== 128 || !HEX_64_RE2.test(event.id) || !HEX_64_RE2.test(event.pubkey)) {
       return false;
     }
     const preimage = JSON.stringify([
@@ -1773,7 +1837,7 @@ async function verifyNostrEventSignature(event) {
       event.tags ?? [],
       event.content ?? ""
     ]);
-    const computedId = toHex(sha2_js.sha256(new TextEncoder().encode(preimage)));
+    const computedId = toHex2(sha2_js.sha256(new TextEncoder().encode(preimage)));
     if (computedId !== event.id.toLowerCase()) {
       log7.warn(
         { eventId: event.id, computedId },
@@ -2182,6 +2246,8 @@ exports.isNostrIdentityVerified = isNostrIdentityVerified;
 exports.isValidDomain = isValidDomain;
 exports.isValidTweetUrl = isValidTweetUrl;
 exports.issueChallenge = issueChallenge;
+exports.nostrIdentifierForms = nostrIdentifierForms;
+exports.nostrPubkeyToHex = nostrPubkeyToHex;
 exports.parseAttestationFromEvent = parseAttestationFromEvent;
 exports.parseIdentities = parseIdentities;
 exports.publishAttestation = publishAttestation;