@reclaimprotocol/attestor-core 5.0.1-beta.13 → 5.0.1-beta.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/external-rpc/index.js +17321 -3
- package/lib/index.d.ts +1 -0
- package/lib/index.js +15391 -11
- package/lib/scripts/build-browser-debug.d.ts +1 -0
- package/package.json +1 -1
- package/lib/avs/abis/avsDirectoryABI.js +0 -343
- package/lib/avs/abis/delegationABI.js +0 -4
- package/lib/avs/abis/registryABI.js +0 -728
- package/lib/avs/client/create-claim-on-avs.js +0 -168
- package/lib/avs/config.js +0 -26
- package/lib/avs/contracts/ReclaimServiceManager.js +0 -0
- package/lib/avs/contracts/common.js +0 -0
- package/lib/avs/contracts/factories/ReclaimServiceManager__factory.js +0 -1183
- package/lib/avs/contracts/factories/index.js +0 -4
- package/lib/avs/contracts/index.js +0 -6
- package/lib/avs/types/index.js +0 -0
- package/lib/avs/utils/contracts.js +0 -53
- package/lib/avs/utils/register.js +0 -74
- package/lib/avs/utils/tasks.js +0 -48
- package/lib/client/create-claim.js +0 -461
- package/lib/client/index.js +0 -3
- package/lib/client/tunnels/make-rpc-tcp-tunnel.js +0 -53
- package/lib/client/tunnels/make-rpc-tls-tunnel.js +0 -127
- package/lib/client/utils/attestor-pool.js +0 -24
- package/lib/client/utils/client-socket.js +0 -120
- package/lib/client/utils/message-handler.js +0 -97
- package/lib/config/index.js +0 -62
- package/lib/external-rpc/benchmark.js +0 -82
- package/lib/external-rpc/event-bus.js +0 -17
- package/lib/external-rpc/handle-incoming-msg.js +0 -241
- package/lib/external-rpc/jsc-polyfills/1.js +0 -80
- package/lib/external-rpc/jsc-polyfills/2.js +0 -15
- package/lib/external-rpc/jsc-polyfills/event.js +0 -19
- package/lib/external-rpc/jsc-polyfills/index.js +0 -2
- package/lib/external-rpc/jsc-polyfills/ws.js +0 -83
- package/lib/external-rpc/setup-browser.js +0 -33
- package/lib/external-rpc/setup-jsc.js +0 -22
- package/lib/external-rpc/types.js +0 -0
- package/lib/external-rpc/utils.js +0 -100
- package/lib/external-rpc/zk.js +0 -58
- package/lib/mechain/abis/governanceABI.js +0 -461
- package/lib/mechain/abis/taskABI.js +0 -512
- package/lib/mechain/client/create-claim-on-mechain.js +0 -33
- package/lib/mechain/client/index.js +0 -1
- package/lib/mechain/constants/index.js +0 -8
- package/lib/mechain/index.js +0 -2
- package/lib/mechain/types/index.js +0 -0
- package/lib/proto/api.js +0 -4250
- package/lib/proto/tee-bundle.js +0 -1296
- package/lib/providers/http/index.js +0 -640
- package/lib/providers/http/patch-parse5-tree.js +0 -34
- package/lib/providers/http/utils.js +0 -283
- package/lib/providers/index.js +0 -7
- package/lib/scripts/build-browser.js +0 -38
- package/lib/scripts/build-jsc.js +0 -47
- package/lib/scripts/build-lib.js +0 -47
- package/lib/scripts/check-avs-registration.js +0 -28
- package/lib/scripts/fallbacks/crypto.js +0 -4
- package/lib/scripts/fallbacks/empty.js +0 -4
- package/lib/scripts/fallbacks/re2.js +0 -7
- package/lib/scripts/fallbacks/snarkjs.js +0 -10
- package/lib/scripts/fallbacks/stwo.js +0 -159
- package/lib/scripts/generate-provider-types.js +0 -101
- package/lib/scripts/generate-receipt.js +0 -101
- package/lib/scripts/generate-toprf-keys.js +0 -24
- package/lib/scripts/jsc-cli-rpc.js +0 -35
- package/lib/scripts/register-avs-operator.js +0 -3
- package/lib/scripts/start-server.js +0 -11
- package/lib/scripts/update-avs-metadata.js +0 -20
- package/lib/scripts/utils.js +0 -10
- package/lib/scripts/whitelist-operator.js +0 -16
- package/lib/server/create-server.js +0 -105
- package/lib/server/handlers/claimTeeBundle.js +0 -232
- package/lib/server/handlers/claimTunnel.js +0 -80
- package/lib/server/handlers/completeClaimOnChain.js +0 -29
- package/lib/server/handlers/createClaimOnChain.js +0 -32
- package/lib/server/handlers/createTaskOnMechain.js +0 -57
- package/lib/server/handlers/createTunnel.js +0 -98
- package/lib/server/handlers/disconnectTunnel.js +0 -8
- package/lib/server/handlers/fetchCertificateBytes.js +0 -57
- package/lib/server/handlers/index.js +0 -25
- package/lib/server/handlers/init.js +0 -33
- package/lib/server/handlers/toprf.js +0 -19
- package/lib/server/index.js +0 -4
- package/lib/server/socket.js +0 -112
- package/lib/server/tunnels/make-tcp-tunnel.js +0 -202
- package/lib/server/utils/apm.js +0 -29
- package/lib/server/utils/assert-valid-claim-request.js +0 -354
- package/lib/server/utils/config-env.js +0 -4
- package/lib/server/utils/dns.js +0 -24
- package/lib/server/utils/gcp-attestation.js +0 -237
- package/lib/server/utils/generics.js +0 -45
- package/lib/server/utils/iso.js +0 -259
- package/lib/server/utils/keep-alive.js +0 -38
- package/lib/server/utils/nitro-attestation.js +0 -249
- package/lib/server/utils/oprf-raw.js +0 -61
- package/lib/server/utils/process-handshake.js +0 -233
- package/lib/server/utils/proxy-session.js +0 -6
- package/lib/server/utils/tee-oprf-mpc-verification.js +0 -86
- package/lib/server/utils/tee-oprf-verification.js +0 -151
- package/lib/server/utils/tee-transcript-reconstruction.js +0 -140
- package/lib/server/utils/tee-verification.js +0 -358
- package/lib/server/utils/validation.js +0 -45
- package/lib/types/bgp.js +0 -0
- package/lib/types/claims.js +0 -0
- package/lib/types/client.js +0 -0
- package/lib/types/general.js +0 -0
- package/lib/types/handlers.js +0 -0
- package/lib/types/index.js +0 -10
- package/lib/types/providers.gen.js +0 -16
- package/lib/types/providers.js +0 -0
- package/lib/types/rpc.js +0 -0
- package/lib/types/signatures.js +0 -0
- package/lib/types/tunnel.js +0 -0
- package/lib/types/zk.js +0 -0
- package/lib/utils/auth.js +0 -71
- package/lib/utils/b64-json.js +0 -17
- package/lib/utils/bgp-listener.js +0 -123
- package/lib/utils/claims.js +0 -89
- package/lib/utils/env.js +0 -19
- package/lib/utils/error.js +0 -54
- package/lib/utils/generics.js +0 -268
- package/lib/utils/http-parser.js +0 -201
- package/lib/utils/index.js +0 -13
- package/lib/utils/logger.js +0 -82
- package/lib/utils/prepare-packets.js +0 -69
- package/lib/utils/redactions.js +0 -135
- package/lib/utils/retries.js +0 -26
- package/lib/utils/signatures/eth.js +0 -31
- package/lib/utils/signatures/index.js +0 -12
- package/lib/utils/socket-base.js +0 -96
- package/lib/utils/tls.js +0 -58
- package/lib/utils/ws.js +0 -22
- package/lib/utils/zk.js +0 -625
|
@@ -1,237 +0,0 @@
|
|
|
1
|
-
import crypto, { X509Certificate } from "crypto";
|
|
2
|
-
let gcpKeysCache = null;
|
|
3
|
-
let gcpKeysCacheTime = 0;
|
|
4
|
-
const GCP_KEYS_CACHE_TTL = 36e5;
|
|
5
|
-
const GCP_CONFIDENTIAL_SPACE_ROOT_CA = `-----BEGIN CERTIFICATE-----
|
|
6
|
-
MIIGCDCCA/CgAwIBAgITYBvRy5g9aYYMh7tJS7pFwafL6jANBgkqhkiG9w0BAQsF
|
|
7
|
-
ADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcT
|
|
8
|
-
DU1vdW50YWluIFZpZXcxEzARBgNVBAoTCkdvb2dsZSBMTEMxFTATBgNVBAsTDEdv
|
|
9
|
-
b2dsZSBDbG91ZDEjMCEGA1UEAxMaQ29uZmlkZW50aWFsIFNwYWNlIFJvb3QgQ0Ew
|
|
10
|
-
HhcNMjQwMTE5MjIxMDUwWhcNMzQwMTE2MjIxMDQ5WjCBizELMAkGA1UEBhMCVVMx
|
|
11
|
-
EzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxEzAR
|
|
12
|
-
BgNVBAoTCkdvb2dsZSBMTEMxFTATBgNVBAsTDEdvb2dsZSBDbG91ZDEjMCEGA1UE
|
|
13
|
-
AxMaQ29uZmlkZW50aWFsIFNwYWNlIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUA
|
|
14
|
-
A4ICDwAwggIKAoICAQCvRuZasczAqhMZe1ODHJ6MFLX8EYVV+RN7xiO9GpuA53iz
|
|
15
|
-
l9Oxgp3NXik3FbYn+7bcIkMMSQpCr6K0jbSQCZT6d5P5PJT5DpNGYjLHkW67/fl+
|
|
16
|
-
Bu7eSMb0qRCa1jS+3OhNK7t7SIaHm1XdmSRghjwoglKRuk3CGrF4Zia9RcE/p2MU
|
|
17
|
-
69GyJZpqHYwTplNr3x4zF+2nJk86GywDP+sGwSPWfcmqY04VQD7ZPDEZZ/qgzdoL
|
|
18
|
-
5ilE92eQnAsy+6m6LxBEHHVcFpfDtNVUIt2VMCWLBeOKUQcn5js756xblInqw/Qt
|
|
19
|
-
QRR0An0yfRjBuGvmMjAwETDo5ETY/fc+nbQVYJzNQTc9EOpFFWPpw/ZjFcN9Amnd
|
|
20
|
-
dxYUETFXPmBYerMez0LKNtGpfKYHHhMMTI3mj0m/V9fCbfh2YbBUnMS2Swd20YSI
|
|
21
|
-
Mi/HiGaqOpGUqXMeQVw7phGTS3QYK8ZM65sC/QhIQzXdsiLDgFBitVnlIu3lIv6C
|
|
22
|
-
uiHvXeSJBRlRxQ8Vu+t6J7hBdl0etWBKAu9Vti46af5cjC03dspkHR3MAUGcrLWE
|
|
23
|
-
TkQ0msQAKvIAlwyQRLuQOI5D6pF+6af1Nbl+vR7sLCbDWdMqm1E9X6KyFKd6e3rn
|
|
24
|
-
E9O4dkFJp35WvR2gqIAkUoa+Vq1MXLFYG4imanZKH0igrIblbawRCr3Gr24FXQID
|
|
25
|
-
AQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
|
|
26
|
-
FgQUF+fBOE6Th1snpKuvIb6S8/mtPL4wHwYDVR0jBBgwFoAUF+fBOE6Th1snpKuv
|
|
27
|
-
Ib6S8/mtPL4wDQYJKoZIhvcNAQELBQADggIBAGtCuV5eHxWcffylK9GPumaD6Yjd
|
|
28
|
-
cs76KDBe3mky5ItBIrEOeZq3z47zM4dbKZHhFuoq4yAaO1MyApnG0w9wIQLBDndI
|
|
29
|
-
ovtkw6j9/64aqPWpNaoB5MB0SahCUCgI83Dx9SRqGmjPI/MTMfwDLdE5EF9gFmVI
|
|
30
|
-
oH62YnG2aa/sc6m/8wIK8WtTJazEI16/8GPG4ZUhwT6aR3IGGnEBPMbMd5VZQ0Hw
|
|
31
|
-
VbHBKWK3UykaSCxnEg8uaNx/rhNaOWuWtos4qL00dYyGV7ZXg4fpAq7244QUgkWV
|
|
32
|
-
AtVcU2SPBjDd30OFHASnenDHRzQdOtHaxLp4a4WaY3jb2V6Sn3LfE8zSy6GevxmN
|
|
33
|
-
COIWW3xnPF8rwKz4ABEPqECe37zzu3W1nzZAFtdkhPBNnlWYkIusTMtU+8v6EPKp
|
|
34
|
-
GIIRphpaDhtGPJQukpENOfk2728lenPycRfjxwA96UKWq0dKZC45MwBEK9Jngn8Q
|
|
35
|
-
cPmpPmx7pSMkSxEX2Vos2JNaNmCKJd2VaXz8M6F2cxscRdh9TbAYAjGEEjE1nLUH
|
|
36
|
-
2YHDS8Y7xYNFIDSFaJAlqGcCUbzjGhrwHGj4voTe9ZvlmngrcA/ptSuBidvsnRDw
|
|
37
|
-
kNPLowCd0NqxYYSLNL7GroYCFPxoBpr+++4vsCaXalbs8iJxdU2EPqG4MB4xWKYg
|
|
38
|
-
uyT5CnJulxSC5CT1
|
|
39
|
-
-----END CERTIFICATE-----`;
|
|
40
|
-
function base64urlDecode(input) {
|
|
41
|
-
let base64 = input.replace(/-/g, "+").replace(/_/g, "/");
|
|
42
|
-
while (base64.length % 4) {
|
|
43
|
-
base64 += "=";
|
|
44
|
-
}
|
|
45
|
-
return Buffer.from(base64, "base64");
|
|
46
|
-
}
|
|
47
|
-
async function fetchGooglePublicKeys(logger) {
|
|
48
|
-
const now = Date.now();
|
|
49
|
-
if (gcpKeysCache && now - gcpKeysCacheTime < GCP_KEYS_CACHE_TTL) {
|
|
50
|
-
if (logger) {
|
|
51
|
-
logger.debug("Using cached Google public keys");
|
|
52
|
-
}
|
|
53
|
-
return gcpKeysCache;
|
|
54
|
-
}
|
|
55
|
-
if (logger) {
|
|
56
|
-
logger.info("Fetching Google public keys from https://www.googleapis.com/oauth2/v3/certs");
|
|
57
|
-
}
|
|
58
|
-
const response = await fetch("https://www.googleapis.com/oauth2/v3/certs");
|
|
59
|
-
if (!response.ok) {
|
|
60
|
-
throw new Error(`Failed to fetch Google keys: ${response.status} ${response.statusText}`);
|
|
61
|
-
}
|
|
62
|
-
const keys = await response.json();
|
|
63
|
-
gcpKeysCache = keys;
|
|
64
|
-
gcpKeysCacheTime = now;
|
|
65
|
-
if (logger) {
|
|
66
|
-
logger.info(`Fetched ${keys.keys.length} Google public keys`);
|
|
67
|
-
}
|
|
68
|
-
return keys;
|
|
69
|
-
}
|
|
70
|
-
function jwkToPublicKey(jwk) {
|
|
71
|
-
return crypto.createPublicKey({
|
|
72
|
-
key: {
|
|
73
|
-
kty: "RSA",
|
|
74
|
-
n: jwk.n,
|
|
75
|
-
e: jwk.e
|
|
76
|
-
},
|
|
77
|
-
format: "jwk"
|
|
78
|
-
});
|
|
79
|
-
}
|
|
80
|
-
function verifyX5cChain(x5cChain, logger) {
|
|
81
|
-
if (!x5cChain || x5cChain.length === 0) {
|
|
82
|
-
throw new Error("Empty x5c certificate chain");
|
|
83
|
-
}
|
|
84
|
-
const leafCertPem = `-----BEGIN CERTIFICATE-----
|
|
85
|
-
${x5cChain[0]}
|
|
86
|
-
-----END CERTIFICATE-----`;
|
|
87
|
-
const leafCert = new X509Certificate(leafCertPem);
|
|
88
|
-
if (logger) {
|
|
89
|
-
logger.info(`x5c leaf certificate: subject=${leafCert.subject}, issuer=${leafCert.issuer}`);
|
|
90
|
-
}
|
|
91
|
-
const rootCert = new X509Certificate(GCP_CONFIDENTIAL_SPACE_ROOT_CA);
|
|
92
|
-
let currentCert = leafCert;
|
|
93
|
-
for (let i = 1; i < x5cChain.length; i++) {
|
|
94
|
-
const intermediatePem = `-----BEGIN CERTIFICATE-----
|
|
95
|
-
${x5cChain[i]}
|
|
96
|
-
-----END CERTIFICATE-----`;
|
|
97
|
-
const intermediateCert = new X509Certificate(intermediatePem);
|
|
98
|
-
const isValid = currentCert.verify(intermediateCert.publicKey);
|
|
99
|
-
if (!isValid) {
|
|
100
|
-
throw new Error(`Certificate chain verification failed at level ${i}`);
|
|
101
|
-
}
|
|
102
|
-
if (logger) {
|
|
103
|
-
logger.debug(`Verified cert level ${i}: ${intermediateCert.subject}`);
|
|
104
|
-
}
|
|
105
|
-
currentCert = intermediateCert;
|
|
106
|
-
}
|
|
107
|
-
const isRootValid = currentCert.verify(rootCert.publicKey);
|
|
108
|
-
if (!isRootValid) {
|
|
109
|
-
throw new Error("Certificate chain does not root to GCP Confidential Space Root CA");
|
|
110
|
-
}
|
|
111
|
-
if (logger) {
|
|
112
|
-
logger.info("x5c certificate chain verified successfully");
|
|
113
|
-
}
|
|
114
|
-
return leafCert.publicKey;
|
|
115
|
-
}
|
|
116
|
-
async function validateGcpAttestationAndExtractKey(attestationBytes, logger) {
|
|
117
|
-
const errors = [];
|
|
118
|
-
try {
|
|
119
|
-
const jwtString = Buffer.from(attestationBytes).toString("utf8");
|
|
120
|
-
const parts = jwtString.split(".");
|
|
121
|
-
if (parts.length !== 3) {
|
|
122
|
-
errors.push("Invalid JWT format: expected 3 parts");
|
|
123
|
-
return { isValid: false, errors };
|
|
124
|
-
}
|
|
125
|
-
const [headerB64, payloadB64, signatureB64] = parts;
|
|
126
|
-
const headerJson = base64urlDecode(headerB64).toString("utf8");
|
|
127
|
-
const payloadJson = base64urlDecode(payloadB64).toString("utf8");
|
|
128
|
-
const header = JSON.parse(headerJson);
|
|
129
|
-
const payload = JSON.parse(payloadJson);
|
|
130
|
-
if (logger) {
|
|
131
|
-
logger.info(`GCP JWT header: kid=${header.kid}, alg=${header.alg}`);
|
|
132
|
-
logger.info(`GCP JWT payload: iss=${payload.iss}, aud=${payload.aud}`);
|
|
133
|
-
}
|
|
134
|
-
const now = Math.floor(Date.now() / 1e3);
|
|
135
|
-
const validIssuers = [
|
|
136
|
-
"https://accounts.google.com",
|
|
137
|
-
"https://confidentialcomputing.googleapis.com"
|
|
138
|
-
];
|
|
139
|
-
if (!validIssuers.includes(payload.iss)) {
|
|
140
|
-
errors.push(`Invalid issuer: expected one of ${validIssuers.join(", ")}, got "${payload.iss}"`);
|
|
141
|
-
}
|
|
142
|
-
if (payload.exp <= now) {
|
|
143
|
-
errors.push(`Token expired: exp=${payload.exp}, now=${now}`);
|
|
144
|
-
}
|
|
145
|
-
if (payload.iat > now + 60) {
|
|
146
|
-
errors.push(`Token issued in future: iat=${payload.iat}, now=${now}`);
|
|
147
|
-
}
|
|
148
|
-
const hasReclaimAudience = payload.aud?.includes("reclaimprotocol.org");
|
|
149
|
-
const hasGcpStsAudience = payload.aud?.includes("sts.googleapis.com");
|
|
150
|
-
if (!hasReclaimAudience && !hasGcpStsAudience) {
|
|
151
|
-
errors.push(`Invalid audience: expected "reclaimprotocol.org" or "sts.googleapis.com", got "${payload.aud}"`);
|
|
152
|
-
}
|
|
153
|
-
if (errors.length > 0) {
|
|
154
|
-
return { isValid: false, errors };
|
|
155
|
-
}
|
|
156
|
-
let publicKey;
|
|
157
|
-
if (header.x5c && header.x5c.length > 0) {
|
|
158
|
-
if (logger) {
|
|
159
|
-
logger.info(`Using x5c certificate chain (${header.x5c.length} certificates)`);
|
|
160
|
-
}
|
|
161
|
-
publicKey = verifyX5cChain(header.x5c, logger);
|
|
162
|
-
} else if (header.kid) {
|
|
163
|
-
if (logger) {
|
|
164
|
-
logger.info(`Using OIDC token with kid: ${header.kid}`);
|
|
165
|
-
}
|
|
166
|
-
const jwks = await fetchGooglePublicKeys(logger);
|
|
167
|
-
const jwk = jwks.keys.find((k) => k.kid === header.kid);
|
|
168
|
-
if (!jwk) {
|
|
169
|
-
errors.push(`No public key found for kid: ${header.kid}`);
|
|
170
|
-
return { isValid: false, errors };
|
|
171
|
-
}
|
|
172
|
-
publicKey = jwkToPublicKey(jwk);
|
|
173
|
-
} else {
|
|
174
|
-
errors.push("JWT header must contain either x5c or kid field");
|
|
175
|
-
return { isValid: false, errors };
|
|
176
|
-
}
|
|
177
|
-
const signedData = `${headerB64}.${payloadB64}`;
|
|
178
|
-
const signature = base64urlDecode(signatureB64);
|
|
179
|
-
const verify = crypto.createVerify("RSA-SHA256");
|
|
180
|
-
verify.update(signedData);
|
|
181
|
-
const isSignatureValid = verify.verify(publicKey, signature);
|
|
182
|
-
if (!isSignatureValid) {
|
|
183
|
-
errors.push("Signature verification failed");
|
|
184
|
-
return { isValid: false, errors };
|
|
185
|
-
}
|
|
186
|
-
if (logger) {
|
|
187
|
-
logger.info("GCP JWT signature verified successfully");
|
|
188
|
-
}
|
|
189
|
-
if (!payload.eat_nonce) {
|
|
190
|
-
errors.push("No eat_nonce field found in JWT payload");
|
|
191
|
-
return { isValid: false, errors };
|
|
192
|
-
}
|
|
193
|
-
const match = payload.eat_nonce.match(/^(tee_[kt])_public_key:0x([0-9a-fA-F]{40})$/);
|
|
194
|
-
if (!match) {
|
|
195
|
-
errors.push(`Invalid eat_nonce format: ${payload.eat_nonce}`);
|
|
196
|
-
return { isValid: false, errors };
|
|
197
|
-
}
|
|
198
|
-
const userDataType = match[1];
|
|
199
|
-
const hexAddress = match[2];
|
|
200
|
-
const ethAddress = new Uint8Array(Buffer.from(hexAddress, "hex"));
|
|
201
|
-
if (logger) {
|
|
202
|
-
logger.info(`Extracted address from eat_nonce: ${payload.eat_nonce}`);
|
|
203
|
-
}
|
|
204
|
-
let pcr0 = "gcp-no-digest";
|
|
205
|
-
if (payload.google?.compute_engine?.image_digest) {
|
|
206
|
-
pcr0 = payload.google.compute_engine.image_digest;
|
|
207
|
-
} else if (payload.submods?.container?.image_digest) {
|
|
208
|
-
pcr0 = payload.submods.container.image_digest;
|
|
209
|
-
}
|
|
210
|
-
if (payload.dbgstat === "enabled" && pcr0.startsWith("sha256:")) {
|
|
211
|
-
pcr0 = "debug_" + pcr0;
|
|
212
|
-
}
|
|
213
|
-
const envVars = payload.submods?.container?.env || {};
|
|
214
|
-
if (logger) {
|
|
215
|
-
const hexAddr = Buffer.from(ethAddress).toString("hex");
|
|
216
|
-
logger.info(`Extracted ETH address from GCP attestation: 0x${hexAddr}, type: ${userDataType}, pcr0: ${pcr0}`);
|
|
217
|
-
if (Object.keys(envVars).length > 0) {
|
|
218
|
-
logger.debug(`Environment variables: ${Object.keys(envVars).join(", ")}`);
|
|
219
|
-
}
|
|
220
|
-
}
|
|
221
|
-
return {
|
|
222
|
-
isValid: true,
|
|
223
|
-
errors: [],
|
|
224
|
-
ethAddress,
|
|
225
|
-
userDataType,
|
|
226
|
-
pcr0,
|
|
227
|
-
envVars
|
|
228
|
-
};
|
|
229
|
-
} catch (error) {
|
|
230
|
-
const errorMsg = error instanceof Error ? error.message : String(error);
|
|
231
|
-
errors.push(`GCP attestation validation error: ${errorMsg}`);
|
|
232
|
-
return { isValid: false, errors };
|
|
233
|
-
}
|
|
234
|
-
}
|
|
235
|
-
export {
|
|
236
|
-
validateGcpAttestationAndExtractKey
|
|
237
|
-
};
|
|
@@ -1,45 +0,0 @@
|
|
|
1
|
-
import { RPCMessages } from "#src/proto/api.js";
|
|
2
|
-
import { getEnvVariable } from "#src/utils/env.js";
|
|
3
|
-
import { AttestorError, strToUint8Array } from "#src/utils/index.js";
|
|
4
|
-
import { SIGNATURES } from "#src/utils/signatures/index.js";
|
|
5
|
-
const PRIVATE_KEY = getEnvVariable("PRIVATE_KEY");
|
|
6
|
-
function signAsAttestor(data, scheme) {
|
|
7
|
-
const { sign } = SIGNATURES[scheme];
|
|
8
|
-
return sign(
|
|
9
|
-
typeof data === "string" ? strToUint8Array(data) : data,
|
|
10
|
-
PRIVATE_KEY
|
|
11
|
-
);
|
|
12
|
-
}
|
|
13
|
-
function getAttestorAddress(scheme) {
|
|
14
|
-
const { getAddress, getPublicKey } = SIGNATURES[scheme];
|
|
15
|
-
const publicKey = getPublicKey(PRIVATE_KEY);
|
|
16
|
-
return getAddress(publicKey);
|
|
17
|
-
}
|
|
18
|
-
function niceParseJsonObject(data, key) {
|
|
19
|
-
if (!data) {
|
|
20
|
-
return {};
|
|
21
|
-
}
|
|
22
|
-
try {
|
|
23
|
-
return JSON.parse(data);
|
|
24
|
-
} catch (e) {
|
|
25
|
-
throw AttestorError.badRequest(
|
|
26
|
-
`Invalid JSON in ${key}: ${e.message}`
|
|
27
|
-
);
|
|
28
|
-
}
|
|
29
|
-
}
|
|
30
|
-
function getInitialMessagesFromQuery(req) {
|
|
31
|
-
const url = new URL(req.url, "http://localhost");
|
|
32
|
-
const messagesB64 = url.searchParams.get("messages");
|
|
33
|
-
if (!messagesB64?.length) {
|
|
34
|
-
return [];
|
|
35
|
-
}
|
|
36
|
-
const msgsBytes = Buffer.from(messagesB64, "base64");
|
|
37
|
-
const msgs = RPCMessages.decode(msgsBytes);
|
|
38
|
-
return msgs.messages;
|
|
39
|
-
}
|
|
40
|
-
export {
|
|
41
|
-
getAttestorAddress,
|
|
42
|
-
getInitialMessagesFromQuery,
|
|
43
|
-
niceParseJsonObject,
|
|
44
|
-
signAsAttestor
|
|
45
|
-
};
|
package/lib/server/utils/iso.js
DELETED
|
@@ -1,259 +0,0 @@
|
|
|
1
|
-
const countries = {
|
|
2
|
-
AF: "Afghanistan",
|
|
3
|
-
AX: "\xC5land Islands",
|
|
4
|
-
AL: "Albania",
|
|
5
|
-
DZ: "Algeria",
|
|
6
|
-
AS: "American Samoa",
|
|
7
|
-
AD: "Andorra",
|
|
8
|
-
AO: "Angola",
|
|
9
|
-
AI: "Anguilla",
|
|
10
|
-
AQ: "Antarctica",
|
|
11
|
-
AG: "Antigua and Barbuda",
|
|
12
|
-
AR: "Argentina",
|
|
13
|
-
AM: "Armenia",
|
|
14
|
-
AW: "Aruba",
|
|
15
|
-
AU: "Australia",
|
|
16
|
-
AT: "Austria",
|
|
17
|
-
AZ: "Azerbaijan",
|
|
18
|
-
BS: "Bahamas",
|
|
19
|
-
BH: "Bahrain",
|
|
20
|
-
BD: "Bangladesh",
|
|
21
|
-
BB: "Barbados",
|
|
22
|
-
BY: "Belarus",
|
|
23
|
-
BE: "Belgium",
|
|
24
|
-
BZ: "Belize",
|
|
25
|
-
BJ: "Benin",
|
|
26
|
-
BM: "Bermuda",
|
|
27
|
-
BT: "Bhutan",
|
|
28
|
-
BO: "Bolivia, Plurinational State of",
|
|
29
|
-
BQ: "Bonaire, Sint Eustatius and Saba",
|
|
30
|
-
BA: "Bosnia and Herzegovina",
|
|
31
|
-
BW: "Botswana",
|
|
32
|
-
BV: "Bouvet Island",
|
|
33
|
-
BR: "Brazil",
|
|
34
|
-
IO: "British Indian Ocean Territory",
|
|
35
|
-
BN: "Brunei Darussalam",
|
|
36
|
-
BG: "Bulgaria",
|
|
37
|
-
BF: "Burkina Faso",
|
|
38
|
-
BI: "Burundi",
|
|
39
|
-
KH: "Cambodia",
|
|
40
|
-
CM: "Cameroon",
|
|
41
|
-
CA: "Canada",
|
|
42
|
-
CV: "Cape Verde",
|
|
43
|
-
KY: "Cayman Islands",
|
|
44
|
-
CF: "Central African Republic",
|
|
45
|
-
TD: "Chad",
|
|
46
|
-
CL: "Chile",
|
|
47
|
-
CN: "China",
|
|
48
|
-
CX: "Christmas Island",
|
|
49
|
-
CC: "Cocos (Keeling) Islands",
|
|
50
|
-
CO: "Colombia",
|
|
51
|
-
KM: "Comoros",
|
|
52
|
-
CG: "Congo",
|
|
53
|
-
CD: "Congo, the Democratic Republic of the",
|
|
54
|
-
CK: "Cook Islands",
|
|
55
|
-
CR: "Costa Rica",
|
|
56
|
-
CI: "C\xF4te d'Ivoire",
|
|
57
|
-
HR: "Croatia",
|
|
58
|
-
CU: "Cuba",
|
|
59
|
-
CW: "Cura\xE7ao",
|
|
60
|
-
CY: "Cyprus",
|
|
61
|
-
CZ: "Czech Republic",
|
|
62
|
-
DK: "Denmark",
|
|
63
|
-
DJ: "Djibouti",
|
|
64
|
-
DM: "Dominica",
|
|
65
|
-
DO: "Dominican Republic",
|
|
66
|
-
EC: "Ecuador",
|
|
67
|
-
EG: "Egypt",
|
|
68
|
-
SV: "El Salvador",
|
|
69
|
-
GQ: "Equatorial Guinea",
|
|
70
|
-
ER: "Eritrea",
|
|
71
|
-
EE: "Estonia",
|
|
72
|
-
ET: "Ethiopia",
|
|
73
|
-
FK: "Falkland Islands (Malvinas)",
|
|
74
|
-
FO: "Faroe Islands",
|
|
75
|
-
FJ: "Fiji",
|
|
76
|
-
FI: "Finland",
|
|
77
|
-
FR: "France",
|
|
78
|
-
GF: "French Guiana",
|
|
79
|
-
PF: "French Polynesia",
|
|
80
|
-
TF: "French Southern Territories",
|
|
81
|
-
GA: "Gabon",
|
|
82
|
-
GM: "Gambia",
|
|
83
|
-
GE: "Georgia",
|
|
84
|
-
DE: "Germany",
|
|
85
|
-
GH: "Ghana",
|
|
86
|
-
GI: "Gibraltar",
|
|
87
|
-
GR: "Greece",
|
|
88
|
-
GL: "Greenland",
|
|
89
|
-
GD: "Grenada",
|
|
90
|
-
GP: "Guadeloupe",
|
|
91
|
-
GU: "Guam",
|
|
92
|
-
GT: "Guatemala",
|
|
93
|
-
GG: "Guernsey",
|
|
94
|
-
GN: "Guinea",
|
|
95
|
-
GW: "Guinea-Bissau",
|
|
96
|
-
GY: "Guyana",
|
|
97
|
-
HT: "Haiti",
|
|
98
|
-
HM: "Heard Island and McDonald Mcdonald Islands",
|
|
99
|
-
VA: "Holy See (Vatican City State)",
|
|
100
|
-
HN: "Honduras",
|
|
101
|
-
HK: "Hong Kong",
|
|
102
|
-
HU: "Hungary",
|
|
103
|
-
IS: "Iceland",
|
|
104
|
-
IN: "India",
|
|
105
|
-
ID: "Indonesia",
|
|
106
|
-
IR: "Iran, Islamic Republic of",
|
|
107
|
-
IQ: "Iraq",
|
|
108
|
-
IE: "Ireland",
|
|
109
|
-
IM: "Isle of Man",
|
|
110
|
-
IL: "Israel",
|
|
111
|
-
IT: "Italy",
|
|
112
|
-
JM: "Jamaica",
|
|
113
|
-
JP: "Japan",
|
|
114
|
-
JE: "Jersey",
|
|
115
|
-
JO: "Jordan",
|
|
116
|
-
KZ: "Kazakhstan",
|
|
117
|
-
KE: "Kenya",
|
|
118
|
-
KI: "Kiribati",
|
|
119
|
-
XK: "Kosovo",
|
|
120
|
-
KP: "Korea, Democratic People's Republic of",
|
|
121
|
-
KR: "Korea, Republic of",
|
|
122
|
-
KW: "Kuwait",
|
|
123
|
-
KG: "Kyrgyzstan",
|
|
124
|
-
LA: "Lao People's Democratic Republic",
|
|
125
|
-
LV: "Latvia",
|
|
126
|
-
LB: "Lebanon",
|
|
127
|
-
LS: "Lesotho",
|
|
128
|
-
LR: "Liberia",
|
|
129
|
-
LY: "Libya",
|
|
130
|
-
LI: "Liechtenstein",
|
|
131
|
-
LT: "Lithuania",
|
|
132
|
-
LU: "Luxembourg",
|
|
133
|
-
MO: "Macao",
|
|
134
|
-
MK: "North Macedonia",
|
|
135
|
-
MG: "Madagascar",
|
|
136
|
-
MW: "Malawi",
|
|
137
|
-
MY: "Malaysia",
|
|
138
|
-
MV: "Maldives",
|
|
139
|
-
ML: "Mali",
|
|
140
|
-
MT: "Malta",
|
|
141
|
-
MH: "Marshall Islands",
|
|
142
|
-
MQ: "Martinique",
|
|
143
|
-
MR: "Mauritania",
|
|
144
|
-
MU: "Mauritius",
|
|
145
|
-
YT: "Mayotte",
|
|
146
|
-
MX: "Mexico",
|
|
147
|
-
FM: "Micronesia, Federated States of",
|
|
148
|
-
MD: "Moldova, Republic of",
|
|
149
|
-
MC: "Monaco",
|
|
150
|
-
MN: "Mongolia",
|
|
151
|
-
ME: "Montenegro",
|
|
152
|
-
MS: "Montserrat",
|
|
153
|
-
MA: "Morocco",
|
|
154
|
-
MZ: "Mozambique",
|
|
155
|
-
MM: "Myanmar",
|
|
156
|
-
NA: "Namibia",
|
|
157
|
-
NR: "Nauru",
|
|
158
|
-
NP: "Nepal",
|
|
159
|
-
NL: "Netherlands",
|
|
160
|
-
AN: "Netherlands Antilles",
|
|
161
|
-
NC: "New Caledonia",
|
|
162
|
-
NZ: "New Zealand",
|
|
163
|
-
NI: "Nicaragua",
|
|
164
|
-
NE: "Niger",
|
|
165
|
-
NG: "Nigeria",
|
|
166
|
-
NU: "Niue",
|
|
167
|
-
NF: "Norfolk Island",
|
|
168
|
-
MP: "Northern Mariana Islands",
|
|
169
|
-
NO: "Norway",
|
|
170
|
-
OM: "Oman",
|
|
171
|
-
PK: "Pakistan",
|
|
172
|
-
PW: "Palau",
|
|
173
|
-
PS: "Palestine, State of",
|
|
174
|
-
PA: "Panama",
|
|
175
|
-
PG: "Papua New Guinea",
|
|
176
|
-
PY: "Paraguay",
|
|
177
|
-
PE: "Peru",
|
|
178
|
-
PH: "Philippines",
|
|
179
|
-
PN: "Pitcairn",
|
|
180
|
-
PL: "Poland",
|
|
181
|
-
PT: "Portugal",
|
|
182
|
-
PR: "Puerto Rico",
|
|
183
|
-
QA: "Qatar",
|
|
184
|
-
RE: "R\xE9union",
|
|
185
|
-
RO: "Romania",
|
|
186
|
-
RU: "Russian Federation",
|
|
187
|
-
RW: "Rwanda",
|
|
188
|
-
BL: "Saint Barth\xE9lemy",
|
|
189
|
-
SH: "Saint Helena, Ascension and Tristan da Cunha",
|
|
190
|
-
KN: "Saint Kitts and Nevis",
|
|
191
|
-
LC: "Saint Lucia",
|
|
192
|
-
MF: "Saint Martin (French part)",
|
|
193
|
-
PM: "Saint Pierre and Miquelon",
|
|
194
|
-
VC: "Saint Vincent and the Grenadines",
|
|
195
|
-
WS: "Samoa",
|
|
196
|
-
SM: "San Marino",
|
|
197
|
-
ST: "Sao Tome and Principe",
|
|
198
|
-
SA: "Saudi Arabia",
|
|
199
|
-
SN: "Senegal",
|
|
200
|
-
RS: "Serbia",
|
|
201
|
-
SC: "Seychelles",
|
|
202
|
-
SL: "Sierra Leone",
|
|
203
|
-
SG: "Singapore",
|
|
204
|
-
SX: "Sint Maarten (Dutch part)",
|
|
205
|
-
SK: "Slovakia",
|
|
206
|
-
SI: "Slovenia",
|
|
207
|
-
SB: "Solomon Islands",
|
|
208
|
-
SO: "Somalia",
|
|
209
|
-
ZA: "South Africa",
|
|
210
|
-
GS: "South Georgia and the South Sandwich Islands",
|
|
211
|
-
SS: "South Sudan",
|
|
212
|
-
ES: "Spain",
|
|
213
|
-
LK: "Sri Lanka",
|
|
214
|
-
SD: "Sudan",
|
|
215
|
-
SR: "Suriname",
|
|
216
|
-
SJ: "Svalbard and Jan Mayen",
|
|
217
|
-
SZ: "Swaziland",
|
|
218
|
-
SE: "Sweden",
|
|
219
|
-
CH: "Switzerland",
|
|
220
|
-
SY: "Syrian Arab Republic",
|
|
221
|
-
TW: "Taiwan, Province of China",
|
|
222
|
-
TJ: "Tajikistan",
|
|
223
|
-
TZ: "Tanzania, United Republic of",
|
|
224
|
-
TH: "Thailand",
|
|
225
|
-
TL: "Timor-Leste",
|
|
226
|
-
TG: "Togo",
|
|
227
|
-
TK: "Tokelau",
|
|
228
|
-
TO: "Tonga",
|
|
229
|
-
TT: "Trinidad and Tobago",
|
|
230
|
-
TN: "Tunisia",
|
|
231
|
-
TR: "Turkey",
|
|
232
|
-
TM: "Turkmenistan",
|
|
233
|
-
TC: "Turks and Caicos Islands",
|
|
234
|
-
TV: "Tuvalu",
|
|
235
|
-
UG: "Uganda",
|
|
236
|
-
UA: "Ukraine",
|
|
237
|
-
AE: "United Arab Emirates",
|
|
238
|
-
GB: "United Kingdom",
|
|
239
|
-
US: "United States",
|
|
240
|
-
UM: "United States Minor Outlying Islands",
|
|
241
|
-
UY: "Uruguay",
|
|
242
|
-
UZ: "Uzbekistan",
|
|
243
|
-
VU: "Vanuatu",
|
|
244
|
-
VE: "Venezuela, Bolivarian Republic of",
|
|
245
|
-
VN: "Viet Nam",
|
|
246
|
-
VG: "Virgin Islands, British",
|
|
247
|
-
VI: "Virgin Islands, U.S.",
|
|
248
|
-
WF: "Wallis and Futuna",
|
|
249
|
-
EH: "Western Sahara",
|
|
250
|
-
YE: "Yemen",
|
|
251
|
-
ZM: "Zambia",
|
|
252
|
-
ZW: "Zimbabwe"
|
|
253
|
-
};
|
|
254
|
-
function isValidCountryCode(countryCode) {
|
|
255
|
-
return countryCode.toUpperCase() in countries;
|
|
256
|
-
}
|
|
257
|
-
export {
|
|
258
|
-
isValidCountryCode
|
|
259
|
-
};
|
|
@@ -1,38 +0,0 @@
|
|
|
1
|
-
import { MAX_NO_DATA_INTERVAL_MS, PING_INTERVAL_MS } from "#src/config/index.js";
|
|
2
|
-
function addKeepAlive(ws, logger) {
|
|
3
|
-
let sendTimeout;
|
|
4
|
-
let killTimeout;
|
|
5
|
-
ws.on("message", () => {
|
|
6
|
-
logger.trace("data recv, resetting timer");
|
|
7
|
-
resetTimer();
|
|
8
|
-
});
|
|
9
|
-
ws.on("pong", () => {
|
|
10
|
-
logger.trace("pong received, resetting timer");
|
|
11
|
-
resetTimer();
|
|
12
|
-
});
|
|
13
|
-
ws.on("error", cleanup);
|
|
14
|
-
ws.on("close", cleanup);
|
|
15
|
-
function resetTimer() {
|
|
16
|
-
cleanup();
|
|
17
|
-
resetSendTimeout();
|
|
18
|
-
killTimeout = setTimeout(() => {
|
|
19
|
-
logger.warn(
|
|
20
|
-
"no data received in a while, closing connection"
|
|
21
|
-
);
|
|
22
|
-
ws.close();
|
|
23
|
-
}, MAX_NO_DATA_INTERVAL_MS);
|
|
24
|
-
}
|
|
25
|
-
function resetSendTimeout() {
|
|
26
|
-
sendTimeout = setTimeout(() => {
|
|
27
|
-
ws.ping();
|
|
28
|
-
resetSendTimeout();
|
|
29
|
-
}, PING_INTERVAL_MS);
|
|
30
|
-
}
|
|
31
|
-
function cleanup() {
|
|
32
|
-
clearTimeout(killTimeout);
|
|
33
|
-
clearTimeout(sendTimeout);
|
|
34
|
-
}
|
|
35
|
-
}
|
|
36
|
-
export {
|
|
37
|
-
addKeepAlive
|
|
38
|
-
};
|