@orangecheck/sdk 1.8.0 → 1.10.0

package/dist/index.js

@@ -884,10 +884,6 @@ async function verifySignature({
   scheme
 }) {
   try {
-    if (sig === "demo_signature") {
-      log4.warn("Demo signature detected in verifySignature - should be handled by demo mode");
-      return "sig_invalid";
-    }
     const detectedScheme = scheme || detectSignatureScheme(addr, sig);
     log4.debug(
       { addr, msgLength: msg.length, sigLength: sig.length, scheme: detectedScheme },
@@ -1113,26 +1109,6 @@ async function verify2(input, opts = {}) {
       codes.push("bad_request");
       return { ok: false, codes, network, attestation_id };
     }
-    if (opts.demoMode) {
-      const sats_bonded = 1e6;
-      const days_unspent = 90;
-      const metrics = {
-        sats_bonded,
-        days_unspent,
-        score: computeScore(sats_bonded, days_unspent, { algorithm: "v0" })
-        // ≈ 55.26
-      };
-      codes.push("sig_ok_bip322");
-      codes.push("bond_confirmed");
-      return {
-        ok: true,
-        codes,
-        network,
-        attestation_id,
-        identities: parsed.core.identities,
-        metrics
-      };
-    }
     if ((network === "testnet" || network === "signet") && !opts.testMode) {
       codes.push("network_testmode");
       return { ok: false, codes, network, attestation_id };
@@ -1641,11 +1617,14 @@ function isValidDomain(domain) {
   const domainPattern = /^[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,}$/i;
   return domainPattern.test(cleanDomain);
 }
-function isDnsIdentityVerified(attestationId, _domain, cachedContent) {
-  if (!cachedContent) {
+function isDnsIdentityVerified(attestationId, domain, cachedContent) {
+  if (!cachedContent || !cachedContent.includes(attestationId)) {
     return false;
   }
-  return cachedContent.includes(attestationId);
+  const named = /^Domain:\s*(\S+)\s*$/im.exec(cachedContent);
+  if (!named) return true;
+  const cleanDomain = domain.replace(/^https?:\/\//, "").replace(/\/$/, "").toLowerCase();
+  return named[1].toLowerCase() === cleanDomain;
 }
 
 // src/identity/github.ts
@@ -1789,8 +1768,10 @@ This gist proves that I control both:
 Learn more about OrangeCheck: https://ochk.io
 `;
 }
-function isGitHubIdentityVerified(attestationId, _username, cachedGists) {
+function isGitHubIdentityVerified(attestationId, username, cachedGists) {
+  const login = username.replace(/^@/, "").toLowerCase();
   return cachedGists.some((gist) => {
+    if (gist.owner?.login?.toLowerCase() !== login) return false;
     if (gist.description?.includes(attestationId)) {
       return true;
     }
@@ -1889,6 +1870,9 @@ async function queryNostrEvents(options) {
   return events;
 }
 async function verifyNostrEventSignature(event) {
+  return nostrEventSignatureValid(event);
+}
+function nostrEventSignatureValid(event) {
   try {
     if (!event.id || !event.sig || !event.pubkey || typeof event.id !== "string" || typeof event.sig !== "string" || typeof event.pubkey !== "string" || event.sig.length !== 128 || !HEX_64_RE2.test(event.id) || !HEX_64_RE2.test(event.pubkey)) {
       return false;
@@ -1975,7 +1959,7 @@ The verification will search Nostr relays for your note and confirm you control
 function isNostrIdentityVerified(attestationId, npub, cachedEvents) {
   const pubkeyHex = npubToHex(npub);
   return cachedEvents.some(
-    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId)
+    (event) => event.pubkey === pubkeyHex && event.kind === 1 && event.content.includes(attestationId) && nostrEventSignatureValid(event)
   );
 }