@raytio/core 8.1.2 → 9.0.2

package/dist/verifications/verifyCheck/operations/checkOwnVerification.d.ts

@@ -0,0 +1,15 @@
+import { UId, VerificationPayload } from "@raytio/types";
+declare type SingleVerToCheck = {
+    verObject: VerificationPayload<false>;
+    signature: string;
+    userId: UId;
+    value: unknown;
+};
+/**
+ * checks that a json object was signed by the provided signature. Unless you're
+ * dealing with bundled verifications, you should use `getOwnRealVerifications`
+ * or `getSomeoneElsesRealVerifications` instead.
+ */
+export declare const checkJsonSignature: (data: unknown, signature: string) => Promise<boolean>;
+export declare const checkOwnVerification: ({ verObject, signature, userId, value, }: SingleVerToCheck) => Promise<boolean>;
+export {};

package/dist/verifications/verifyCheck/operations/checkOwnVerification.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkOwnVerification = exports.checkJsonSignature = exports.checkSignature = void 0;
+const util_1 = require("../../../util");
+let cache; // eslint-disable-line fp/no-let
+const base64ToArrayBuffer = (str) => Uint8Array.from(atob(str), c => c.charCodeAt(0));
+async function getJwk() {
+    // eslint-disable-next-line fp/no-mutation
+    cache || (cache = fetch("https://api-docs.rayt.io/lookups/raytio.pem")
+        .then(r => r.text())
+        .then(pem => crypto.subtle.importKey("spki", base64ToArrayBuffer(pem.split("-----")[2].trim()), { name: "RSA-PSS", hash: "SHA-512" }, false, ["verify"])));
+    return cache;
+}
+/** @internal exported only for tests */
+async function checkSignature(publicCryptoKey, signature, data) {
+    // the logic must match https://gitlab.com/raytio/mono/-/blob/devo/common/signing/signing/sign.py
+    const signatureBuf = base64ToArrayBuffer(signature);
+    const isVerified = await crypto.subtle.verify({ name: "RSA-PSS", hash: "SHA-512", saltLength: 512 / 8 }, publicCryptoKey, signatureBuf, new TextEncoder().encode(data));
+    return isVerified;
+}
+exports.checkSignature = checkSignature;
+/**
+ * checks that a json object was signed by the provided signature. Unless you're
+ * dealing with bundled verifications, you should use `getOwnRealVerifications`
+ * or `getSomeoneElsesRealVerifications` instead.
+ */
+const checkJsonSignature = async (data, signature) => {
+    const jwk = await getJwk();
+    const stringified = (0, util_1.canonicalJsonify)(data);
+    const result = await checkSignature(jwk, signature, stringified);
+    return result;
+};
+exports.checkJsonSignature = checkJsonSignature;
+const checkOwnVerification = async ({ verObject, signature, userId, value, }) => {
+    if (!userId)
+        throw new Error("No userId supplied");
+    return (0, exports.checkJsonSignature)(Object.assign(Object.assign({}, verObject), { sub: userId, value }), signature);
+};
+exports.checkOwnVerification = checkOwnVerification;

package/dist/verifications/verifyCheck/operations/checkSomeoneElsesVerifications.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/verifications/{checkVerifications.js → verifyCheck/operations/checkSomeoneElsesVerifications.js}

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkVerifications = void 0;
-const util_1 = require("../util");
+exports.checkSomeoneElsesVerifications = void 0;
+const util_1 = require("../../../util");
 /** @internal */
-const checkVerifications = async ({ apiUrl, toVerify, controller, }) => {
+const checkSomeoneElsesVerifications = async ({ apiUrl, toVerify, controller, }) => {
     const response = await fetch(`${apiUrl}/extract_verify/v2/verify_check`, {
         method: "POST",
         body: JSON.stringify(toVerify),
@@ -13,4 +13,4 @@ const checkVerifications = async ({ apiUrl, toVerify, controller, }) => {
     // extra `m` items are garbage and don't have the verified field.
     return response.filter(ver => "verified" in ver);
 };
-exports.checkVerifications = checkVerifications;
+exports.checkSomeoneElsesVerifications = checkSomeoneElsesVerifications;

package/dist/verifications/verifyCheck/operations/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./checkOwnVerification";
+export * from "./checkSomeoneElsesVerifications";

package/dist/verifications/verifyCheck/operations/index.js

@@ -0,0 +1,14 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./checkOwnVerification"), exports);
+__exportStar(require("./checkSomeoneElsesVerifications"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raytio/core",
-  "version": "8.1.2",
+  "version": "9.0.2",
   "license": "MIT",
   "main": "index",
   "types": "index",
@@ -15,22 +15,22 @@
     "test": "jest"
   },
   "dependencies": {
-    "@raytio/maxcryptor": "3.0.1",
-    "@raytio/types": "5.2.0",
-    "ramda": "0.27.1"
+    "@raytio/maxcryptor": "3.1.0",
+    "@raytio/types": "6.0.0",
+    "ramda": "0.28.0"
   },
   "devDependencies": {
-    "@types/ramda": "0.27.44",
-    "jest": "27.1.0",
+    "@types/ramda": "0.27.64",
+    "jest": "27.5.1",
     "localstorage-polyfill": "1.0.1",
-    "ts-jest": "27.0.5"
+    "ts-jest": "27.1.3"
   },
   "jest": {
     "transform": {
       "^.+\\.(t|j)sx?$": "ts-jest"
     },
     "testEnvironment": "node",
-    "collectCoverage": true,
+    "collectCoverage": false,
     "coverageThreshold": {
       "global": {
         "statements": 100

package/dist/verifications/getRealVerifications.d.ts

@@ -1,22 +0,0 @@
-import { ProfileObject, Verification, RealVer } from "@raytio/types";
-declare type Props = {
-    apiUrl: string;
-    verifications: Verification[];
-    profileObjects: ProfileObject[];
-    controller?: AbortController;
-    /**
-     * do NOT use this option. If the value of a field
-     * equals the value of this prop, that field will be treated
-     * as verified, even if the API says it's not verified. See
-     * #614 for context. @deprecated
-     */
-    UNSAFE_treatNoValueAsVerified?: string;
-};
-/**
- * Given a list of verifications and decrypted profile objects, this function calls
- * the Raytio API to verify the credibility of these verifications, returning only valid
- * verifications.
- * @returns a list of fileNames/values that are verified.
- */
-export declare const getRealVerifications: ({ apiUrl, verifications, profileObjects, controller, UNSAFE_treatNoValueAsVerified, }: Props) => Promise<RealVer[]>;
-export {};