@reclaimprotocol/attestor-core 5.0.1-beta.1 → 5.0.1-beta.2

package/lib/server/handlers/claimTeeBundle.js

@@ -0,0 +1,232 @@
+import { ClaimTeeBundleResponse } from "../../proto/api.js";
+import { VerificationBundle } from "../../proto/tee-bundle.js";
+import { substituteParamValues } from "../../providers/http/index.js";
+import { assertValidProviderTranscript } from "../../server/utils/assert-valid-claim-request.js";
+import { getAttestorAddress, niceParseJsonObject, signAsAttestor } from "../../server/utils/generics.js";
+import { verifyOprfMpcOutputs } from "../../server/utils/tee-oprf-mpc-verification.js";
+import { verifyOprfProofs } from "../../server/utils/tee-oprf-verification.js";
+import { reconstructTlsTranscript } from "../../server/utils/tee-transcript-reconstruction.js";
+import { verifyTeeBundle } from "../../server/utils/tee-verification.js";
+import { AttestorError } from "../../utils/error.js";
+import { createSignDataForClaim, getIdentifierFromClaimInfo } from "../../utils/index.js";
+const claimTeeBundle = async (teeBundleRequest, { logger, client }) => {
+  const {
+    verificationBundle,
+    data
+  } = teeBundleRequest;
+  const res = ClaimTeeBundleResponse.create({ request: teeBundleRequest });
+  logger.info("Starting TEE bundle verification");
+  const teeData = await verifyTeeBundle(verificationBundle, logger);
+  const timestampS = Math.floor(teeData.kOutputPayload.timestampMs / 1e3);
+  logger.info("Verifying OPRF proofs");
+  const bundle = VerificationBundle.decode(verificationBundle);
+  const zkOprfResults = await verifyOprfProofs(
+    { ...teeData, oprfVerifications: bundle.oprfVerifications },
+    logger
+  );
+  logger.info("Verifying OPRF MPC outputs");
+  const oprfMpcResults = verifyOprfMpcOutputs(
+    teeData.kOutputPayload,
+    teeData.tOutputPayload,
+    logger
+  );
+  const allOprfResults = validateAndCombineOprfResults(zkOprfResults, oprfMpcResults, logger);
+  logger.info("Starting TLS transcript reconstruction with OPRF replacements");
+  const transcriptData = await reconstructTlsTranscript(teeData, logger, allOprfResults);
+  logger.info("Creating plaintext transcript from TEE data");
+  const plaintextTranscript = createPlaintextTranscriptFromTeeData(transcriptData, logger);
+  logger.info("Running direct provider validation on TEE reconstructed data");
+  if (!data) {
+    throw new AttestorError("ERROR_INVALID_CLAIM", "No claim data provided in TEE bundle request");
+  }
+  const validatedClaim = await validateTeeProviderReceipt(
+    plaintextTranscript,
+    data,
+    logger,
+    { version: client.metadata.clientVersion },
+    transcriptData.certificateInfo
+  );
+  const ctx = niceParseJsonObject(validatedClaim.context, "context");
+  ctx.pcr0_k = teeData.teekPcr0;
+  ctx.pcr0_t = teeData.teetPcr0;
+  ctx.tee_session_id = teeData.teeSessionId;
+  validatedClaim.context = JSON.stringify(ctx);
+  res.claim = {
+    ...validatedClaim,
+    identifier: getIdentifierFromClaimInfo(validatedClaim),
+    // Use timestampS from TEE_K bundle for claim signing
+    timestampS,
+    // hardcode for compatibility with V1 claims
+    epoch: 1
+  };
+  logger.info({ claim: res.claim }, "TEE bundle claim validation successful");
+  res.signatures = {
+    attestorAddress: getAttestorAddress(
+      client.metadata.signatureType
+    ),
+    claimSignature: res.claim ? await signAsAttestor(
+      createSignDataForClaim(res.claim),
+      client.metadata.signatureType
+    ) : new Uint8Array(),
+    resultSignature: await signAsAttestor(
+      ClaimTeeBundleResponse.encode(res).finish(),
+      client.metadata.signatureType
+    )
+  };
+  logger.info("TEE bundle claim processing completed");
+  return res;
+};
+function createPlaintextTranscriptFromTeeData(transcriptData, logger) {
+  const transcript = [];
+  if (transcriptData.revealedRequest && transcriptData.revealedRequest.length > 0) {
+    transcript.push({
+      sender: "client",
+      message: transcriptData.revealedRequest
+    });
+    logger.debug("Added TEE revealed request to plaintext transcript", {
+      length: transcriptData.revealedRequest.length
+    });
+  }
+  if (transcriptData.reconstructedResponse && transcriptData.reconstructedResponse.length > 0) {
+    transcript.push({
+      sender: "server",
+      message: transcriptData.reconstructedResponse
+    });
+    logger.debug("Added TEE consolidated response to plaintext transcript", {
+      length: transcriptData.reconstructedResponse.length
+    });
+  }
+  if (transcriptData.certificateInfo) {
+    logger.info("Certificate information available for validation", {
+      commonName: transcriptData.certificateInfo.commonName,
+      issuerCommonName: transcriptData.certificateInfo.issuerCommonName,
+      dnsNames: transcriptData.certificateInfo.dnsNames,
+      notBefore: new Date(transcriptData.certificateInfo.notBeforeUnix * 1e3).toISOString(),
+      notAfter: new Date(transcriptData.certificateInfo.notAfterUnix * 1e3).toISOString()
+    });
+  }
+  logger.info("Created plaintext transcript from TEE data", {
+    totalMessages: transcript.length,
+    hasRequest: !!transcriptData.revealedRequest?.length,
+    hasResponse: !!transcriptData.reconstructedResponse?.length,
+    hasCertificateInfo: !!transcriptData.certificateInfo
+  });
+  return transcript;
+}
+async function validateTeeProviderReceipt(plaintextTranscript, claimInfo, logger, providerCtx, certificateInfo) {
+  logger.info("Starting direct TEE provider validation", {
+    provider: claimInfo.provider,
+    transcriptMessages: plaintextTranscript.length,
+    hasCertificateInfo: !!certificateInfo
+  });
+  if (certificateInfo) {
+    validateTlsCertificate(claimInfo, certificateInfo, logger);
+  }
+  const validatedClaim = await assertValidProviderTranscript(
+    plaintextTranscript,
+    claimInfo,
+    logger,
+    providerCtx
+  );
+  logger.info("TEE provider validation completed successfully", {
+    provider: validatedClaim.provider,
+    owner: validatedClaim.owner || "unknown"
+  });
+  return validatedClaim;
+}
+function isHostnameValidForCertificate(hostname, certName) {
+  if (hostname === certName) {
+    return true;
+  }
+  if (certName.startsWith("*.")) {
+    const wildcardDomain = certName.slice(2);
+    if (hostname.endsWith(wildcardDomain)) {
+      const subdomainPart = hostname.slice(0, -wildcardDomain.length);
+      if (subdomainPart.endsWith(".")) {
+        const subdomain = subdomainPart.slice(0, -1);
+        return !subdomain.includes(".");
+      }
+    }
+  }
+  return false;
+}
+function validateTlsCertificate(claimInfo, certificateInfo, logger) {
+  let claimedHostname;
+  const paramsWithTemplates = niceParseJsonObject(claimInfo.parameters, "params");
+  const params = substituteParamValues(paramsWithTemplates, void 0, true).newParams;
+  if ("url" in params && typeof params.url === "string") {
+    claimedHostname = new URL(params.url).hostname;
+  }
+  if (!claimedHostname) {
+    logger.warn("Could not extract hostname from claim for certificate validation", {
+      provider: claimInfo.provider
+    });
+    throw new AttestorError(
+      "ERROR_INVALID_CLAIM",
+      "Certificate validation failed: hostname not found"
+    );
+  }
+  logger.info("Validating TLS certificate for claimed hostname", {
+    claimedHostname,
+    certificateCommonName: certificateInfo.commonName,
+    certificateDnsNames: certificateInfo.dnsNames
+  });
+  const isValidForHostname = isHostnameValidForCertificate(claimedHostname, certificateInfo.commonName) || certificateInfo.dnsNames.some((name) => isHostnameValidForCertificate(claimedHostname, name));
+  if (!isValidForHostname) {
+    throw new AttestorError(
+      "ERROR_INVALID_CLAIM",
+      `Certificate validation failed: hostname '${claimedHostname}' not valid for certificate (CN: ${certificateInfo.commonName}, SANs: ${certificateInfo.dnsNames.join(", ")})`
+    );
+  }
+  const now = Date.now() / 1e3;
+  if (now < certificateInfo.notBeforeUnix || now > certificateInfo.notAfterUnix) {
+    throw new AttestorError(
+      "ERROR_INVALID_CLAIM",
+      `Certificate validation failed: certificate not valid at current time (valid from ${new Date(certificateInfo.notBeforeUnix * 1e3).toISOString()} to ${new Date(certificateInfo.notAfterUnix * 1e3).toISOString()})`
+    );
+  }
+  logger.info("TLS certificate validation passed", {
+    claimedHostname,
+    validatedAgainst: isHostnameValidForCertificate(claimedHostname, certificateInfo.commonName) ? `CommonName: ${certificateInfo.commonName}` : `SAN: ${certificateInfo.dnsNames.find((name) => isHostnameValidForCertificate(claimedHostname, name))}`
+  });
+}
+function validateAndCombineOprfResults(zkOprfResults, oprfMpcResults, logger) {
+  const allOprfResults = [...zkOprfResults, ...oprfMpcResults];
+  if (allOprfResults.length === 0) {
+    return allOprfResults;
+  }
+  logger.info(`Combined ${zkOprfResults.length} ZK OPRF + ${oprfMpcResults.length} OPRF MPC results`);
+  const seen = {};
+  for (const result of zkOprfResults) {
+    seen[result.position] = { length: result.length, source: "zk" };
+  }
+  for (const result of oprfMpcResults) {
+    const existing = seen[result.position];
+    if (existing) {
+      if (existing.length !== result.length) {
+        throw new AttestorError(
+          "ERROR_INVALID_CLAIM",
+          `OPRF range conflict at position ${result.position}: ZK length ${existing.length} vs MPC length ${result.length}`
+        );
+      }
+      logger.warn(`Duplicate OPRF range at position ${result.position} from both ZK and MPC - using MPC result`);
+    }
+    for (const [pos, data] of Object.entries(seen)) {
+      const position = Number(pos);
+      const existingEnd = position + data.length;
+      const newEnd = result.position + result.length;
+      const overlaps = result.position < existingEnd && newEnd > position && result.position !== position;
+      if (overlaps) {
+        throw new AttestorError(
+          "ERROR_INVALID_CLAIM",
+          `Overlapping OPRF ranges: [${position}:${existingEnd}] (${data.source}) and [${result.position}:${newEnd}] (mpc)`
+        );
+      }
+    }
+    seen[result.position] = { length: result.length, source: "mpc" };
+  }
+  return allOprfResults;
+}
+export {
+  claimTeeBundle
+};

package/lib/server/handlers/claimTunnel.d.ts

@@ -0,0 +1,2 @@
+import type { RPCHandler } from '#src/types/index.ts';
+export declare const claimTunnel: RPCHandler<'claimTunnel'>;

package/lib/server/handlers/claimTunnel.js

@@ -0,0 +1,80 @@
+import { MAX_CLAIM_TIMESTAMP_DIFF_S } from "../../config/index.js";
+import { ClaimTunnelResponse } from "../../proto/api.js";
+import { getApm } from "../../server/utils/apm.js";
+import { assertTranscriptsMatch, assertValidClaimRequest } from "../../server/utils/assert-valid-claim-request.js";
+import { getAttestorAddress, signAsAttestor } from "../../server/utils/generics.js";
+import { AttestorError, createSignDataForClaim, getIdentifierFromClaimInfo, unixTimestampSeconds } from "../../utils/index.js";
+const claimTunnel = async (claimRequest, { tx, logger, client }) => {
+  const {
+    request,
+    data: { timestampS } = {}
+  } = claimRequest;
+  const tunnel = client.getTunnel(request?.id);
+  try {
+    await tunnel.close();
+  } catch (err) {
+    logger.debug({ err }, "error closing tunnel");
+  }
+  if (tx) {
+    const transcriptBytes = tunnel.transcript.reduce(
+      (acc, { message }) => acc + message.length,
+      0
+    );
+    tx?.setLabel("transcriptBytes", transcriptBytes.toString());
+  }
+  if (tunnel.createRequest?.host !== request?.host || tunnel.createRequest?.port !== request?.port || tunnel.createRequest?.geoLocation !== request?.geoLocation || tunnel.createRequest?.proxySessionId !== request?.proxySessionId) {
+    throw AttestorError.badRequest("Tunnel request does not match");
+  }
+  assertTranscriptsMatch(claimRequest.transcript, tunnel.transcript);
+  const res = ClaimTunnelResponse.create({ request: claimRequest });
+  try {
+    const now = unixTimestampSeconds();
+    if (Math.floor(timestampS - now) > MAX_CLAIM_TIMESTAMP_DIFF_S) {
+      throw new AttestorError(
+        "ERROR_INVALID_CLAIM",
+        `Timestamp provided ${timestampS} is too far off. Current time is ${now}`
+      );
+    }
+    const assertTx = getApm()?.startTransaction("assertValidClaimRequest", { childOf: tx });
+    try {
+      const claim = await assertValidClaimRequest(
+        claimRequest,
+        client.metadata,
+        logger
+      );
+      res.claim = {
+        ...claim,
+        identifier: getIdentifierFromClaimInfo(claim),
+        // hardcode for compatibility with V1 claims
+        epoch: 1
+      };
+    } catch (err) {
+      assertTx?.setOutcome("failure");
+      throw err;
+    } finally {
+      assertTx?.end();
+    }
+  } catch (err) {
+    logger.error({ err }, "invalid claim request");
+    const attestorErr = AttestorError.fromError(err, "ERROR_INVALID_CLAIM");
+    res.error = attestorErr.toProto();
+  }
+  res.signatures = {
+    attestorAddress: getAttestorAddress(
+      client.metadata.signatureType
+    ),
+    claimSignature: res.claim ? await signAsAttestor(
+      createSignDataForClaim(res.claim),
+      client.metadata.signatureType
+    ) : new Uint8Array(),
+    resultSignature: await signAsAttestor(
+      ClaimTunnelResponse.encode(res).finish(),
+      client.metadata.signatureType
+    )
+  };
+  client.removeTunnel(request.id);
+  return res;
+};
+export {
+  claimTunnel
+};

package/lib/server/handlers/completeClaimOnChain.d.ts

@@ -0,0 +1,2 @@
+import type { RPCHandler } from '#src/types/index.ts';
+export declare const completeClaimOnChain: RPCHandler<'completeClaimOnChain'>;

package/lib/server/handlers/completeClaimOnChain.js

@@ -0,0 +1,29 @@
+import { EventLog } from "ethers";
+import { getContracts } from "../../avs/utils/contracts.js";
+import { getEnvVariable } from "../../utils/env.js";
+import { AttestorError, ethersStructToPlainObject } from "../../utils/index.js";
+const ACCEPT_CLAIM_PAYMENT_REQUESTS = getEnvVariable("ACCEPT_CLAIM_PAYMENT_REQUESTS") === "1";
+const completeClaimOnChain = async ({ chainId: chainIdNum, taskIndex, completedTaskJson }) => {
+  if (!ACCEPT_CLAIM_PAYMENT_REQUESTS) {
+    throw new AttestorError(
+      "ERROR_PAYMENT_REFUSED",
+      "Payment requests are not accepted at this time"
+    );
+  }
+  const chainId = chainIdNum.toString();
+  const { contract } = getContracts(chainId.toString());
+  const task = JSON.parse(completedTaskJson);
+  const tx = await contract.taskCompleted(task, taskIndex);
+  const rslt = await tx.wait();
+  const logs = rslt?.logs ?? [];
+  const eventLogs = logs.filter((log) => log instanceof EventLog);
+  const obj = eventLogs[0]?.args;
+  const plainObj = ethersStructToPlainObject(obj);
+  return {
+    txHash: rslt?.hash ?? "",
+    taskCompletedObjectJson: JSON.stringify(plainObj)
+  };
+};
+export {
+  completeClaimOnChain
+};

package/lib/server/handlers/createClaimOnChain.d.ts

@@ -0,0 +1,2 @@
+import type { RPCHandler } from '#src/types/index.ts';
+export declare const createClaimOnChain: RPCHandler<'createClaimOnChain'>;

package/lib/server/handlers/createClaimOnChain.js

@@ -0,0 +1,32 @@
+import { getContracts } from "../../avs/utils/contracts.js";
+import { createNewClaimRequestOnChain } from "../../avs/utils/tasks.js";
+import { getEnvVariable } from "../../utils/env.js";
+import { AttestorError, ethersStructToPlainObject } from "../../utils/index.js";
+const ACCEPT_CLAIM_PAYMENT_REQUESTS = getEnvVariable("ACCEPT_CLAIM_PAYMENT_REQUESTS") === "1";
+const createClaimOnChain = async ({ chainId: chainIdNum, jsonCreateClaimRequest, requestSignature }) => {
+  if (!ACCEPT_CLAIM_PAYMENT_REQUESTS) {
+    throw new AttestorError(
+      "ERROR_PAYMENT_REFUSED",
+      "Payment requests are not accepted at this time"
+    );
+  }
+  const chainId = chainIdNum.toString();
+  const { wallet } = getContracts(chainId.toString());
+  const request = JSON.parse(jsonCreateClaimRequest);
+  const { task, tx } = await createNewClaimRequestOnChain({
+    request,
+    owner: request.owner,
+    payer: wallet,
+    chainId,
+    requestSignature
+  });
+  const plainTask = ethersStructToPlainObject(task);
+  return {
+    txHash: tx?.hash ?? "",
+    taskIndex: Number(task.taskIndex),
+    jsonTask: JSON.stringify(plainTask)
+  };
+};
+export {
+  createClaimOnChain
+};

package/lib/server/handlers/createTaskOnMechain.d.ts

@@ -0,0 +1,2 @@
+import type { RPCHandler } from '#src/types/index.ts';
+export declare const createTaskOnMechain: RPCHandler<'createTaskOnMechain'>;

package/lib/server/handlers/createTaskOnMechain.js

@@ -0,0 +1,57 @@
+import { Contract, JsonRpcProvider, randomBytes, Wallet } from "ethers";
+import { governanceABI } from "../../mechain/abis/governanceABI.js";
+import { taskABI } from "../../mechain/abis/taskABI.js";
+import { GOVERNANCE_CONTRACT_ADDRESS, RPC_URL, TASK_CONTRACT_ADDRESS } from "../../mechain/constants/index.js";
+import { getEnvVariable } from "../../utils/env.js";
+const createTaskOnMechain = async ({
+  timestamp
+}) => {
+  const { taskContract } = await getContracts();
+  const seed = randomBytes(32);
+  const result = await taskContract.createNewTaskRequest.staticCall(
+    seed,
+    timestamp
+  );
+  const taskId = result[0];
+  const requiredAttestors = await taskContract.requiredAttestors();
+  const hosts = [];
+  for (let i = 0; i < requiredAttestors; i++) {
+    hosts.push(result[1][i].host);
+  }
+  const tx = await taskContract.createNewTaskRequest(seed, timestamp);
+  await tx.wait();
+  return {
+    taskId,
+    requiredAttestors,
+    hosts
+  };
+};
+async function getContracts() {
+  const privateKey = getEnvVariable("MECHAIN_PRIVATE_KEY");
+  const taskContractAddress = getEnvVariable("TASK_CONTRACT_ADDRESS") || TASK_CONTRACT_ADDRESS;
+  const governanceContractAddress = getEnvVariable("GOVERNANCE_CONTRACT_ADDRESS") || GOVERNANCE_CONTRACT_ADDRESS;
+  if (!privateKey) {
+    throw new Error("MECHAIN_PRIVATE_KEY environment variable is not set");
+  }
+  try {
+    const provider = new JsonRpcProvider(RPC_URL);
+    await provider.getNetwork();
+    const signer = new Wallet(privateKey, provider);
+    const taskContract = new Contract(
+      taskContractAddress,
+      taskABI,
+      signer
+    );
+    const governanceContract = new Contract(
+      governanceContractAddress,
+      governanceABI,
+      signer
+    );
+    return { taskContract, governanceContract };
+  } catch (error) {
+    throw new Error(`Failed to initialize contracts: ${error.message || error}`);
+  }
+}
+export {
+  createTaskOnMechain
+};

package/lib/server/handlers/createTunnel.d.ts

@@ -0,0 +1,2 @@
+import type { RPCHandler } from '#src/types/index.ts';
+export declare const createTunnel: RPCHandler<'createTunnel'>;

package/lib/server/handlers/createTunnel.js

@@ -0,0 +1,98 @@
+import { makeTcpTunnel } from "../../server/tunnels/make-tcp-tunnel.js";
+import { getApm } from "../../server/utils/apm.js";
+import { resolveHostnames } from "../../server/utils/dns.js";
+import { AttestorError } from "../../utils/index.js";
+const createTunnel = async ({ id, ...opts }, { tx, logger, client }) => {
+  if (client.tunnels[id]) {
+    throw AttestorError.badRequest(`Tunnel "${id}" already exists`);
+  }
+  const allowedHosts = client.metadata?.auth?.data?.hostWhitelist;
+  if (allowedHosts?.length && !allowedHosts.includes(opts.host)) {
+    throw AttestorError.badRequest(
+      `Host "${opts.host}" not allowed by auth request`
+    );
+  }
+  let cancelBgp;
+  const apm = getApm();
+  const sessionTx = apm?.startTransaction("tunnelConnection", { childOf: tx });
+  sessionTx?.setLabel("tunnelId", id.toString());
+  sessionTx?.setLabel("hostPort", `${opts.host}:${opts.port}`);
+  sessionTx?.setLabel("geoLocation", opts.geoLocation);
+  sessionTx?.setLabel("proxySessionId", opts.proxySessionId);
+  try {
+    const tunnel = await makeTcpTunnel({
+      ...opts,
+      logger,
+      onMessage(message) {
+        if (!client.isOpen) {
+          logger.warn("client is closed, dropping message");
+          return;
+        }
+        return client.sendMessage({ tunnelMessage: { tunnelId: id, message } });
+      },
+      onClose(err) {
+        cancelBgp?.();
+        if (err) {
+          apm?.captureError(err, { parent: sessionTx });
+          sessionTx?.setOutcome("failure");
+        } else {
+          sessionTx?.setOutcome("success");
+        }
+        sessionTx?.end();
+        if (!client.isOpen) {
+          return;
+        }
+        client.sendMessage({
+          tunnelDisconnectEvent: {
+            tunnelId: id,
+            error: err ? AttestorError.fromError(err).toProto() : void 0
+          }
+        }).catch((err2) => {
+          logger.error(
+            { err: err2 },
+            "failed to send tunnel disconnect event"
+          );
+        });
+      }
+    });
+    try {
+      await checkForBgp(tunnel);
+    } catch (err) {
+      logger.warn(
+        { err, host: opts.host },
+        "failed to start BGP overlap check"
+      );
+    }
+    client.tunnels[id] = tunnel;
+    return {};
+  } catch (err) {
+    apm?.captureError(err, { parent: sessionTx });
+    sessionTx?.setOutcome("failure");
+    sessionTx?.end();
+    cancelBgp?.();
+    throw err;
+  }
+  async function checkForBgp(tunnel) {
+    if (!client.bgpListener) {
+      return;
+    }
+    const ips = await resolveHostnames(opts.host);
+    cancelBgp = client.bgpListener.onOverlap(ips, (info) => {
+      logger.warn(
+        { info, host: opts.host },
+        "BGP announcement overlap detected"
+      );
+      sessionTx?.addLabels({ bgpOverlap: true, ...info });
+      void tunnel?.close(
+        new AttestorError(
+          "ERROR_BGP_ANNOUNCEMENT_OVERLAP",
+          `BGP announcement overlap detected for ${opts.host}`
+        )
+      );
+    });
+    logger.debug({ ips }, "checking for BGP overlap");
+  }
+};
+export {
+  createTunnel
+};

package/lib/server/handlers/disconnectTunnel.d.ts

@@ -0,0 +1,2 @@
+import type { RPCHandler } from '#src/types/index.ts';
+export declare const disconnectTunnel: RPCHandler<'disconnectTunnel'>;

package/lib/server/handlers/disconnectTunnel.js

@@ -0,0 +1,8 @@
+const disconnectTunnel = async ({ id }, { client }) => {
+  const tunnel = client.getTunnel(id);
+  await tunnel.close();
+  return {};
+};
+export {
+  disconnectTunnel
+};

package/lib/server/handlers/fetchCertificateBytes.d.ts

@@ -0,0 +1,2 @@
+import type { RPCHandler } from '#src/types/handlers.ts';
+export declare const fetchCertificateBytes: RPCHandler<'fetchCertificateBytes'>;

package/lib/server/handlers/fetchCertificateBytes.js

@@ -0,0 +1,57 @@
+import { concatenateUint8Arrays, loadX509FromPem } from "@reclaimprotocol/tls";
+import { CERT_ALLOWED_MIMETYPES, MAX_CERT_SIZE_BYTES } from "../../config/index.js";
+import { AttestorError } from "../../utils/error.js";
+const fetchCertificateBytes = async ({ url }) => {
+  const res = await fetch(url, {
+    redirect: "follow",
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!res.ok) {
+    res.body?.cancel("Not ok");
+    throw new AttestorError(
+      "ERROR_CERTIFICATE_FETCH_FAILED",
+      `Failed to fetch certificate from URL: ${url}, status: ${res.status}`
+    );
+  }
+  const contentType = res.headers.get("content-type");
+  if (!contentType || !CERT_ALLOWED_MIMETYPES.includes(contentType)) {
+    res.body?.cancel("Mismatch");
+    throw new AttestorError(
+      "ERROR_CERTIFICATE_FETCH_FAILED",
+      `Invalid content-type when fetching certificate from URL: ${url}, content-type: ${contentType}`
+    );
+  }
+  if (!res.body) {
+    throw new AttestorError(
+      "ERROR_CERTIFICATE_FETCH_FAILED",
+      `No body in response when fetching certificate from URL: ${url}`
+    );
+  }
+  let total = 0;
+  const byteArr = [];
+  for await (const chunk of res.body) {
+    total += chunk.length;
+    if (total > MAX_CERT_SIZE_BYTES) {
+      res.body.cancel("Too many bytes");
+      throw new AttestorError(
+        "ERROR_CERTIFICATE_FETCH_FAILED",
+        `Certificate size exceeds maximum limit of ${MAX_CERT_SIZE_BYTES}b`
+      );
+    }
+    byteArr.push(chunk);
+  }
+  const bytes = concatenateUint8Arrays(byteArr);
+  try {
+    const cert = loadX509FromPem(bytes);
+    TLS_INTERMEDIATE_CA_CACHE[url] = cert;
+  } catch (err) {
+    throw new AttestorError(
+      "ERROR_CERTIFICATE_FETCH_FAILED",
+      `Failed to parse certificate, error: ${err.message}`
+    );
+  }
+  return { bytes: concatenateUint8Arrays(byteArr) };
+};
+export {
+  fetchCertificateBytes
+};

package/lib/server/handlers/index.d.ts

@@ -0,0 +1,4 @@
+import type { RPCHandler, RPCType } from '#src/types/index.ts';
+export declare const HANDLERS: {
+    [T in RPCType]: RPCHandler<T>;
+};

package/lib/server/handlers/index.js

@@ -0,0 +1,25 @@
+import { claimTeeBundle } from "../../server/handlers/claimTeeBundle.js";
+import { claimTunnel } from "../../server/handlers/claimTunnel.js";
+import { completeClaimOnChain } from "../../server/handlers/completeClaimOnChain.js";
+import { createClaimOnChain } from "../../server/handlers/createClaimOnChain.js";
+import { createTaskOnMechain } from "../../server/handlers/createTaskOnMechain.js";
+import { createTunnel } from "../../server/handlers/createTunnel.js";
+import { disconnectTunnel } from "../../server/handlers/disconnectTunnel.js";
+import { fetchCertificateBytes } from "../../server/handlers/fetchCertificateBytes.js";
+import { init } from "../../server/handlers/init.js";
+import { toprf } from "../../server/handlers/toprf.js";
+const HANDLERS = {
+  createTunnel,
+  disconnectTunnel,
+  claimTunnel,
+  claimTeeBundle,
+  init,
+  createClaimOnChain,
+  completeClaimOnChain,
+  toprf,
+  createTaskOnMechain,
+  fetchCertificateBytes
+};
+export {
+  HANDLERS
+};

package/lib/server/handlers/init.d.ts

@@ -0,0 +1,2 @@
+import type { RPCHandler } from '#src/types/index.ts';
+export declare const init: RPCHandler<'init'>;