@oxy.so/core 1.7.0 → 1.7.1

package/dist/cjs/crypto/registrationPow.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Registration proof-of-work — the CLIENT half of the anti-automation nonce
+ * `register()` (`mixins/OxyServices.auth.ts`) submits alongside the
+ * registration signature. The message format, difficulty and the full design
+ * rationale (why 16 bits, why sequential nonces are fine, what this is and
+ * isn't a defense against) live in `@oxy.so/protocol`'s
+ * `auth/registrationPow.ts` — this file is only the solve loop.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.solveRegistrationPow = solveRegistrationPow;
+require("./polyfill");
+const sha256_1 = require("@noble/hashes/sha256");
+const utils_1 = require("@noble/hashes/utils");
+const protocol_1 = require("@oxy.so/protocol");
+/**
+ * How many attempts the grind loop runs before yielding to the event loop.
+ *
+ * A synchronous hot loop long enough to matter (an average solve at 16 bits
+ * is 65,536 attempts) would otherwise block the JS thread for its entire
+ * duration — on a mobile app that means no touch response, no animation, for
+ * up to roughly a second. Yielding periodically keeps the UI responsive
+ * during the grind at the cost of a handful of event-loop round trips, which
+ * is imperceptible next to the grind itself.
+ */
+const YIELD_EVERY_N_ATTEMPTS = 2000;
+function yieldToEventLoop() {
+    return new Promise((resolve) => setTimeout(resolve, 0));
+}
+/**
+ * Grind a nonce for `publicKey`/`timestamp` that clears
+ * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
+ *
+ * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * on web/Node/React Native with no native module and no per-attempt bridge
+ * crossing (see the difficulty constant's own doc for why that distinction is
+ * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the
+ * candidate space a hash function spreads solutions across is dense either
+ * way, so a counter finds one exactly as reliably as randomness would, without
+ * needing a randomness source at all.
+ */
+async function solveRegistrationPow(publicKey, timestamp) {
+    for (let nonce = 0;; nonce += 1) {
+        const candidate = String(nonce);
+        const digest = (0, utils_1.bytesToHex)((0, sha256_1.sha256)((0, utils_1.utf8ToBytes)((0, protocol_1.registrationPowMessage)(publicKey, timestamp, candidate))));
+        if ((0, protocol_1.meetsRegistrationPowDifficulty)(digest, protocol_1.REGISTRATION_POW_DIFFICULTY_BITS)) {
+            return candidate;
+        }
+        if (nonce % YIELD_EVERY_N_ATTEMPTS === YIELD_EVERY_N_ATTEMPTS - 1) {
+            await yieldToEventLoop();
+        }
+    }
+}

package/dist/cjs/mixins/OxyServices.auth.js

@@ -41,6 +41,7 @@ Object.defineProperty(exports, "getCommonsApprovalBlockingReason", { enumerable:
 Object.defineProperty(exports, "parseCommonsApprovalExpiresAt", { enumerable: true, get: function () { return commonsApproval_1.parseCommonsApprovalExpiresAt; } });
 const OxyServices_errors_1 = require("../OxyServices.errors");
 const keyManager_1 = require("../crypto/keyManager");
+const registrationPow_1 = require("../crypto/registrationPow");
 const signatureService_1 = require("../crypto/signatureService");
 const protocol_1 = require("@oxy.so/protocol");
 const logger_1 = require("../logger");
@@ -472,10 +473,15 @@ function OxyServicesAuthMixin(Base) {
          */
         async register(publicKey, signature, timestamp) {
             try {
+                // Advisory for now (server soft-enforces — see
+                // `SessionController.register`), but solved unconditionally so every
+                // client is already sending it once the server starts requiring it.
+                const powNonce = await (0, registrationPow_1.solveRegistrationPow)(publicKey, timestamp);
                 const res = await this.makeRequest('POST', '/auth/register', {
                     publicKey,
                     signature,
                     timestamp,
+                    powNonce,
                 }, { cache: false, skipAuth: true });
                 if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
                     throw new OxyServices_errors_1.OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);