@propxchain/core-client 0.15.0-canary.53 → 0.15.1-canary.54
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyAuditLog.d.ts","sourceRoot":"","sources":["../../src/audit/verifyAuditLog.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"verifyAuditLog.d.ts","sourceRoot":"","sources":["../../src/audit/verifyAuditLog.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,KAAK,mBAAmB,EAAqB,MAAM,iBAAiB,CAAC;AAiC9E,kEAAkE;AAClE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,QAAQ,EAAE,UAAU,CAAC;IACrB,WAAW,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,OAAO,EAAE,UAAU,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,uBAAuB,CAAC;IAC7B;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAkBD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,YAAY,CAAC,CAkEvB"}
|
|
@@ -7,18 +7,20 @@
|
|
|
7
7
|
// 3. confirm the response's stated head matches the certified head;
|
|
8
8
|
// 4. recompute the chain from the events and confirm it matches.
|
|
9
9
|
//
|
|
10
|
-
// Uses
|
|
11
|
-
//
|
|
12
|
-
//
|
|
13
|
-
//
|
|
14
|
-
//
|
|
10
|
+
// Uses @icp-sdk/core (agent, principal) with @dfinity/certificate-verification
|
|
11
|
+
// 4.x, which depends on it, so the HashTree/Principal types line up. 4.x is
|
|
12
|
+
// required: the IC now publishes a subnet's canister ranges under
|
|
13
|
+
// /canister_ranges/<subnet>/... in the delegation (and drops them from
|
|
14
|
+
// /subnet/<id>/canister_ranges). 3.x only reads the old path and fails with
|
|
15
|
+
// "Could not find canister ranges for subnet" on those certificates; 4.x reads
|
|
16
|
+
// both. This leaf module's boundary is plain Uint8Array/string.
|
|
15
17
|
//
|
|
16
18
|
// Live verification keeps the certificate-freshness window tight. Forensic
|
|
17
19
|
// verification of a sealed historical bundle (ADR 0013, proof model ii)
|
|
18
20
|
// relaxes it by design — the bundle proves a fact as-of the certificate's
|
|
19
21
|
// /time, not a current one.
|
|
20
|
-
import { lookup_path, lookupResultToBuffer } from "@
|
|
21
|
-
import { Principal } from "@
|
|
22
|
+
import { lookup_path, lookupResultToBuffer } from "@icp-sdk/core/agent";
|
|
23
|
+
import { Principal } from "@icp-sdk/core/principal";
|
|
22
24
|
import { recomputeHeadHash } from "./auditChain.js";
|
|
23
25
|
let cachedVerify;
|
|
24
26
|
async function loadVerifyCertification() {
|
|
@@ -33,10 +35,11 @@ async function loadVerifyCertification() {
|
|
|
33
35
|
return fn;
|
|
34
36
|
}
|
|
35
37
|
const FIVE_MINUTES_MS = 5 * 60 * 1000;
|
|
36
|
-
|
|
38
|
+
/** Detached copy, so a view into a larger buffer never leaks neighbouring bytes. */
|
|
39
|
+
function toBytes(u8) {
|
|
37
40
|
const copy = new Uint8Array(u8.length);
|
|
38
41
|
copy.set(u8);
|
|
39
|
-
return copy
|
|
42
|
+
return copy;
|
|
40
43
|
}
|
|
41
44
|
function equalBytes(a, b) {
|
|
42
45
|
if (a.length !== b.length)
|
|
@@ -58,9 +61,9 @@ export async function verifyCertifiedAuditLog(opts) {
|
|
|
58
61
|
const verifyCertification = await loadVerifyCertification();
|
|
59
62
|
tree = await verifyCertification({
|
|
60
63
|
canisterId: Principal.fromText(opts.canisterId),
|
|
61
|
-
encodedCertificate:
|
|
62
|
-
encodedTree:
|
|
63
|
-
rootKey:
|
|
64
|
+
encodedCertificate: toBytes(log.certificate[0]),
|
|
65
|
+
encodedTree: toBytes(log.witness),
|
|
66
|
+
rootKey: toBytes(opts.rootKey),
|
|
64
67
|
maxCertificateTimeOffsetMs: opts.maxCertificateTimeOffsetMs ?? FIVE_MINUTES_MS,
|
|
65
68
|
});
|
|
66
69
|
}
|
|
@@ -74,7 +77,7 @@ export async function verifyCertifiedAuditLog(opts) {
|
|
|
74
77
|
// 2. Read the certified headHash for this transaction from the witness tree.
|
|
75
78
|
// The path segment is the UTF-8 bytes of the transactionId — exactly the key
|
|
76
79
|
// ledger_manager certified (Text.encodeUtf8(transactionId)).
|
|
77
|
-
const lookup = lookup_path([
|
|
80
|
+
const lookup = lookup_path([new TextEncoder().encode(transactionId)], tree);
|
|
78
81
|
const certifiedBuf = lookupResultToBuffer(lookup);
|
|
79
82
|
if (!certifiedBuf) {
|
|
80
83
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyAuditLog.js","sourceRoot":"","sources":["../../src/audit/verifyAuditLog.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,4CAA4C;AAC5C,uDAAuD;AACvD,8EAA8E;AAC9E,sEAAsE;AACtE,mEAAmE;AACnE,EAAE;AACF
|
|
1
|
+
{"version":3,"file":"verifyAuditLog.js","sourceRoot":"","sources":["../../src/audit/verifyAuditLog.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,8EAA8E;AAC9E,4CAA4C;AAC5C,uDAAuD;AACvD,8EAA8E;AAC9E,sEAAsE;AACtE,mEAAmE;AACnE,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,kEAAkE;AAClE,uEAAuE;AACvE,4EAA4E;AAC5E,+EAA+E;AAC/E,gEAAgE;AAChE,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,4BAA4B;AAE5B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAA4B,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAgB9E,IAAI,YAA+C,CAAC;AACpD,KAAK,UAAU,uBAAuB;IACpC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAG7D,CAAC;IACF,MAAM,EAAE,GAAG,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACvE,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,YAAY,GAAG,EAAE,CAAC;IAClB,OAAO,EAAE,CAAC;AACZ,CAAC;AA8BD,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,oFAAoF;AACpF,SAAS,OAAO,CAAC,EAAc;IAC7B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACb,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAmB;IAEnB,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACpC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAErC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,CAAC;IAC/E,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAC5D,IAAI,GAAG,MAAM,mBAAmB,CAAC;YAC/B,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YAC/C,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC/C,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACjC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAC9B,0BAA0B,EACxB,IAAI,CAAC,0BAA0B,IAAI,eAAe;SACrD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,oCAAoC,MAAM,CAAC,GAAG,CAAC,EAAE;YACzD,UAAU;SACX,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,MAAM,GAAG,WAAW,CACxB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EACzC,IAAI,CACL,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,gDAAgD;YACxD,UAAU;SACX,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;IAEnD,gEAAgE;IAChE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,kDAAkD;YAC1D,UAAU;SACX,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EACJ,uEAAuE;YACzE,UAAU;SACX,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@propxchain/core-client",
|
|
3
|
-
"version": "0.15.
|
|
3
|
+
"version": "0.15.1-canary.54",
|
|
4
4
|
"description": "Typed TypeScript client for the PropXchain core canisters on the Internet Computer. Includes a deterministic mock mode for local development and tests.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -40,10 +40,10 @@
|
|
|
40
40
|
},
|
|
41
41
|
"dependencies": {
|
|
42
42
|
"@dfinity/agent": "^1.4.0",
|
|
43
|
-
"@dfinity/certificate-verification": "^
|
|
43
|
+
"@dfinity/certificate-verification": "^4.0.0",
|
|
44
44
|
"@dfinity/principal": "^1.4.0",
|
|
45
45
|
"@icp-sdk/auth": "^7.0.0",
|
|
46
|
-
"@icp-sdk/core": "^
|
|
46
|
+
"@icp-sdk/core": "^6.0.0"
|
|
47
47
|
},
|
|
48
48
|
"devDependencies": {
|
|
49
49
|
"@types/node": "^22.10.2",
|
|
@@ -7,20 +7,22 @@
|
|
|
7
7
|
// 3. confirm the response's stated head matches the certified head;
|
|
8
8
|
// 4. recompute the chain from the events and confirm it matches.
|
|
9
9
|
//
|
|
10
|
-
// Uses
|
|
11
|
-
//
|
|
12
|
-
//
|
|
13
|
-
//
|
|
14
|
-
//
|
|
10
|
+
// Uses @icp-sdk/core (agent, principal) with @dfinity/certificate-verification
|
|
11
|
+
// 4.x, which depends on it, so the HashTree/Principal types line up. 4.x is
|
|
12
|
+
// required: the IC now publishes a subnet's canister ranges under
|
|
13
|
+
// /canister_ranges/<subnet>/... in the delegation (and drops them from
|
|
14
|
+
// /subnet/<id>/canister_ranges). 3.x only reads the old path and fails with
|
|
15
|
+
// "Could not find canister ranges for subnet" on those certificates; 4.x reads
|
|
16
|
+
// both. This leaf module's boundary is plain Uint8Array/string.
|
|
15
17
|
//
|
|
16
18
|
// Live verification keeps the certificate-freshness window tight. Forensic
|
|
17
19
|
// verification of a sealed historical bundle (ADR 0013, proof model ii)
|
|
18
20
|
// relaxes it by design — the bundle proves a fact as-of the certificate's
|
|
19
21
|
// /time, not a current one.
|
|
20
22
|
|
|
21
|
-
import { lookup_path, lookupResultToBuffer } from "@
|
|
22
|
-
import type { HashTree } from "@
|
|
23
|
-
import { Principal } from "@
|
|
23
|
+
import { lookup_path, lookupResultToBuffer } from "@icp-sdk/core/agent";
|
|
24
|
+
import type { HashTree } from "@icp-sdk/core/agent";
|
|
25
|
+
import { Principal } from "@icp-sdk/core/principal";
|
|
24
26
|
import { type CertifiedAuditEvent, recomputeHeadHash } from "./auditChain.js";
|
|
25
27
|
|
|
26
28
|
// @dfinity/certificate-verification ships an ESM .d.ts (named exports, no
|
|
@@ -30,9 +32,9 @@ import { type CertifiedAuditEvent, recomputeHeadHash } from "./auditChain.js";
|
|
|
30
32
|
// verifier works in Node, browser bundlers, and typecheck alike.
|
|
31
33
|
interface VerifyCertificationParams {
|
|
32
34
|
canisterId: Principal;
|
|
33
|
-
encodedCertificate:
|
|
34
|
-
encodedTree:
|
|
35
|
-
rootKey:
|
|
35
|
+
encodedCertificate: Uint8Array;
|
|
36
|
+
encodedTree: Uint8Array;
|
|
37
|
+
rootKey: Uint8Array;
|
|
36
38
|
maxCertificateTimeOffsetMs: number;
|
|
37
39
|
}
|
|
38
40
|
type VerifyCertificationFn = (p: VerifyCertificationParams) => Promise<HashTree>;
|
|
@@ -84,10 +86,11 @@ export interface VerifyOptions {
|
|
|
84
86
|
|
|
85
87
|
const FIVE_MINUTES_MS = 5 * 60 * 1000;
|
|
86
88
|
|
|
87
|
-
|
|
89
|
+
/** Detached copy, so a view into a larger buffer never leaks neighbouring bytes. */
|
|
90
|
+
function toBytes(u8: Uint8Array): Uint8Array {
|
|
88
91
|
const copy = new Uint8Array(u8.length);
|
|
89
92
|
copy.set(u8);
|
|
90
|
-
return copy
|
|
93
|
+
return copy;
|
|
91
94
|
}
|
|
92
95
|
|
|
93
96
|
function equalBytes(a: Uint8Array, b: Uint8Array): boolean {
|
|
@@ -113,9 +116,9 @@ export async function verifyCertifiedAuditLog(
|
|
|
113
116
|
const verifyCertification = await loadVerifyCertification();
|
|
114
117
|
tree = await verifyCertification({
|
|
115
118
|
canisterId: Principal.fromText(opts.canisterId),
|
|
116
|
-
encodedCertificate:
|
|
117
|
-
encodedTree:
|
|
118
|
-
rootKey:
|
|
119
|
+
encodedCertificate: toBytes(log.certificate[0]),
|
|
120
|
+
encodedTree: toBytes(log.witness),
|
|
121
|
+
rootKey: toBytes(opts.rootKey),
|
|
119
122
|
maxCertificateTimeOffsetMs:
|
|
120
123
|
opts.maxCertificateTimeOffsetMs ?? FIVE_MINUTES_MS,
|
|
121
124
|
});
|
|
@@ -131,7 +134,7 @@ export async function verifyCertifiedAuditLog(
|
|
|
131
134
|
// The path segment is the UTF-8 bytes of the transactionId — exactly the key
|
|
132
135
|
// ledger_manager certified (Text.encodeUtf8(transactionId)).
|
|
133
136
|
const lookup = lookup_path(
|
|
134
|
-
[
|
|
137
|
+
[new TextEncoder().encode(transactionId)],
|
|
135
138
|
tree,
|
|
136
139
|
);
|
|
137
140
|
const certifiedBuf = lookupResultToBuffer(lookup);
|