@reclaimprotocol/attestor-core 5.0.1-beta.2 → 5.0.1-beta.3

package/lib/browser/utils/http-parser.js

@@ -0,0 +1,201 @@
+import { asciiToUint8Array, concatenateUint8Arrays } from "@reclaimprotocol/tls";
+import { findIndexInUint8Array, uint8ArrayToStr } from "../../utils/generics.js";
+import { REDACTION_CHAR_CODE } from "../../utils/redactions.js";
+const HTTP_HEADER_LINE_END = asciiToUint8Array("\r\n");
+function makeHttpResponseParser() {
+  const res = {
+    statusCode: 0,
+    statusMessage: "",
+    headers: {},
+    body: new Uint8Array(),
+    complete: false,
+    headersComplete: false,
+    headerIndices: /* @__PURE__ */ new Map(),
+    headerEndIdx: 0
+  };
+  let remainingBodyBytes = 0;
+  let isChunked = false;
+  let remaining = new Uint8Array();
+  let currentByteIdx = 0;
+  return {
+    res,
+    /**
+           * Parse the next chunk of data
+           * @param data the data to parse
+           */
+    onChunk(data) {
+      remaining = concatenateUint8Arrays([remaining, data]);
+      if (!res.headersComplete) {
+        for (let line = getLine(); typeof line !== "undefined"; line = getLine()) {
+          if (!res.statusCode) {
+            const [, statusCode, statusMessage] = line.match(/HTTP\/\d\.\d (\d+) (.*)/) || [];
+            res.statusCode = Number(statusCode);
+            res.statusMessage = statusMessage;
+            res.statusLineEndIndex = currentByteIdx - HTTP_HEADER_LINE_END.length;
+          } else if (line === "") {
+            res.headersComplete = true;
+            res.headerEndIdx = currentByteIdx - 4;
+            if (res.headers["transfer-encoding"]?.includes("chunked")) {
+              isChunked = true;
+              res.chunks = [];
+              break;
+            } else if (res.headers["content-length"]) {
+              remainingBodyBytes = Number(res.headers["content-length"]);
+              break;
+            } else {
+              remainingBodyBytes = -1;
+              break;
+            }
+          } else if (!res.complete) {
+            const [key, value] = line.split(": ");
+            res.headers[key.toLowerCase()] = value;
+            res.headerIndices[key.toLowerCase()] = {
+              fromIndex: currentByteIdx - line.length - HTTP_HEADER_LINE_END.length,
+              toIndex: currentByteIdx - HTTP_HEADER_LINE_END.length
+            };
+          } else {
+            throw new Error("got more data after response was complete");
+          }
+        }
+      }
+      if (res.headersComplete) {
+        if (remainingBodyBytes) {
+          readBody();
+          if (!remainingBodyBytes && !isChunked) {
+            res.complete = true;
+          }
+        }
+        if (res.headers["content-length"] === "0") {
+          res.complete = true;
+        }
+        if (isChunked) {
+          for (let line = getLine(); typeof line !== "undefined"; line = getLine()) {
+            if (line === "") {
+              continue;
+            }
+            const chunkSize = Number.parseInt(line, 16);
+            if (!chunkSize) {
+              res.complete = true;
+              continue;
+            }
+            res.chunks?.push({
+              fromIndex: currentByteIdx,
+              toIndex: currentByteIdx + chunkSize
+            });
+            remainingBodyBytes = chunkSize;
+            readBody();
+            if (remainingBodyBytes) {
+              break;
+            }
+          }
+        }
+      }
+    },
+    /**
+           * Call to prevent further parsing; indicating the end of the request
+           * Checks that the response is valid & complete, otherwise throws an error
+           */
+    streamEnded() {
+      if (!res.headersComplete) {
+        throw new Error("stream ended before headers were complete");
+      }
+      if (remaining.length) {
+        throw new Error("stream ended before remaining data arrived");
+      }
+      if (remainingBodyBytes > 0) {
+        throw new Error("stream ended before all body bytes were received");
+      }
+      res.complete = true;
+    }
+  };
+  function readBody() {
+    if (res.complete) {
+      throw new Error("got more data after response was complete");
+    }
+    if (!res.bodyStartIndex) {
+      res.bodyStartIndex = currentByteIdx;
+    }
+    let bytesToCopy;
+    if (remainingBodyBytes === -1) {
+      bytesToCopy = remaining.length;
+    } else {
+      bytesToCopy = Math.min(remainingBodyBytes, remaining.length);
+      remainingBodyBytes -= bytesToCopy;
+    }
+    res.body = concatenateUint8Arrays([
+      res.body,
+      remaining.slice(0, bytesToCopy)
+    ]);
+    remaining = remaining.slice(bytesToCopy);
+    currentByteIdx += bytesToCopy;
+  }
+  function getLine() {
+    const idx = findIndexInUint8Array(remaining, HTTP_HEADER_LINE_END);
+    if (idx === -1) {
+      return void 0;
+    }
+    const line = uint8ArrayToStr(remaining.slice(0, idx));
+    remaining = remaining.slice(idx + HTTP_HEADER_LINE_END.length);
+    currentByteIdx += idx + HTTP_HEADER_LINE_END.length;
+    return line;
+  }
+}
+function getHttpRequestDataFromTranscript(receipt) {
+  const clientMsgs = receipt.filter((s) => s.sender === "client");
+  if (clientMsgs[0].message[0] === REDACTION_CHAR_CODE) {
+    throw new Error("First client message request is redacted. Cannot parse");
+  }
+  const request = {
+    method: "",
+    url: "",
+    protocol: "",
+    headers: {}
+  };
+  let requestBuffer = concatenateUint8Arrays(clientMsgs.map((m) => m.message));
+  for (let line = getLine(); typeof line !== "undefined"; line = getLine()) {
+    if (line === "") {
+      break;
+    }
+    if (!request.method) {
+      const [, method, url, protocol] = line.match(/(\w+) (.*) (.*)/) || [];
+      request.method = method.toLowerCase();
+      request.url = url;
+      request.protocol = protocol;
+    } else {
+      let keyIdx = line.indexOf(":");
+      if (keyIdx === -1) {
+        keyIdx = line.length - 1;
+      }
+      const key = line.slice(0, keyIdx).toLowerCase().trim();
+      const value = line.slice(keyIdx + 1).trim();
+      const oldValue = request.headers[key];
+      if (typeof oldValue === "string") {
+        request.headers[key] = [oldValue, value];
+      } else if (Array.isArray(oldValue)) {
+        oldValue.push(value);
+      } else {
+        request.headers[key] = value;
+      }
+    }
+  }
+  if (requestBuffer.length) {
+    request.body = requestBuffer;
+  }
+  if (!request.method) {
+    throw new Error("Client request is incomplete");
+  }
+  return request;
+  function getLine() {
+    const idx = findIndexInUint8Array(requestBuffer, HTTP_HEADER_LINE_END);
+    if (idx === -1) {
+      return void 0;
+    }
+    const line = uint8ArrayToStr(requestBuffer.slice(0, idx));
+    requestBuffer = requestBuffer.slice(idx + HTTP_HEADER_LINE_END.length);
+    return line;
+  }
+}
+export {
+  getHttpRequestDataFromTranscript,
+  makeHttpResponseParser
+};

package/lib/browser/utils/index.browser.js

@@ -0,0 +1,12 @@
+export * from "./generics.js";
+export * from "./logger.js";
+export * from "./redactions.js";
+export * from "./http-parser.js";
+export * from "./zk.js";
+export * from "./claims.js";
+export * from "./error.js";
+export * from "./prepare-packets.js";
+export * from "./signatures/index.js";
+export * from "./auth.js";
+export * from "./b64-json.js";
+export * from "./tls.js";

package/lib/browser/utils/index.d.ts

@@ -0,0 +1,12 @@
+export * from './generics.ts';
+export * from './logger.js';
+export * from './redactions.ts';
+export * from './http-parser.ts';
+export * from './zk.ts';
+export * from './claims.ts';
+export * from './error.ts';
+export * from './prepare-packets.ts';
+export * from './signatures/index.ts';
+export * from './auth.ts';
+export * from './b64-json.ts';
+export * from './tls.ts';

package/lib/browser/utils/index.js

@@ -0,0 +1,12 @@
+export * from "./generics.js";
+export * from "./logger.js";
+export * from "./redactions.js";
+export * from "./http-parser.js";
+export * from "./zk.js";
+export * from "./claims.js";
+export * from "./error.js";
+export * from "./prepare-packets.js";
+export * from "./signatures/index.js";
+export * from "./auth.js";
+export * from "./b64-json.js";
+export * from "./tls.js";

package/lib/browser/utils/logger.browser.js

@@ -0,0 +1,88 @@
+import { getEnvVariable } from "../../utils/env.js";
+const PII_PROPERTIES = ["ownerPrivateKey", "secretParams"];
+const redactedText = "[REDACTED]";
+const envLevel = getEnvVariable("LOG_LEVEL");
+const LOG_LEVELS = ["trace", "debug", "info", "warn", "error", "fatal"];
+function createLogger(level, redactPii, onLog) {
+  const levelIndex = LOG_LEVELS.indexOf(level);
+  function shouldLog(msgLevel) {
+    return LOG_LEVELS.indexOf(msgLevel) >= levelIndex;
+  }
+  function log(msgLevel, ...args) {
+    if (!shouldLog(msgLevel)) {
+      return;
+    }
+    let logData = args.length === 1 ? args[0] : args;
+    if (redactPii) {
+      logData = redact(logData);
+    }
+    const consoleFn = console[msgLevel] || console.log;
+    consoleFn(`[${msgLevel.toUpperCase()}]`, logData);
+    onLog?.(msgLevel, logData);
+  }
+  return {
+    trace: (...args) => log("trace", ...args),
+    debug: (...args) => log("debug", ...args),
+    info: (...args) => log("info", ...args),
+    warn: (...args) => log("warn", ...args),
+    error: (...args) => log("error", ...args),
+    fatal: (...args) => log("fatal", ...args),
+    child: (opts) => {
+      const childLogger = createLogger(level, redactPii, onLog);
+      const originalFns = { ...childLogger };
+      for (const lvl of LOG_LEVELS) {
+        childLogger[lvl] = (...args) => {
+          originalFns[lvl]({ ...opts, ...args[0] }, ...args.slice(1));
+        };
+      }
+      return childLogger;
+    }
+  };
+}
+let logger = createLogger("info", false);
+makeLogger(false, envLevel);
+function makeLogger(redactPii, level, onLog) {
+  logger = createLogger(level || "info", redactPii, onLog);
+  return logger;
+}
+function isObjectProperty(property) {
+  return typeof property === "object" && !Array.isArray(property) && property !== null;
+}
+function getReplacer() {
+  const references = /* @__PURE__ */ new WeakSet();
+  return function(key, value) {
+    const isObject = typeof value === "object" && value !== null;
+    if (isObject) {
+      if (references.has(value)) {
+        return "[CIRCULAR]";
+      }
+      references.add(value);
+    }
+    return value;
+  };
+}
+function redact(json) {
+  const isObject = isObjectProperty(json);
+  if (!isObject && !Array.isArray(json)) {
+    return json;
+  }
+  const redacted = JSON.parse(JSON.stringify(json, getReplacer()));
+  for (const prop in redacted) {
+    if (PII_PROPERTIES.includes(prop)) {
+      redacted[prop] = redactedText;
+    }
+    if (Array.isArray(redacted[prop])) {
+      for (const [index, value] of redacted[prop].entries()) {
+        redacted[prop][index] = redact(value);
+      }
+    } else if (isObjectProperty(redacted[prop])) {
+      redacted[prop] = redact(redacted[prop]);
+    }
+  }
+  return redacted;
+}
+export {
+  logger,
+  makeLogger,
+  redact
+};

package/lib/browser/utils/logger.d.ts

@@ -0,0 +1,14 @@
+import type { Logger } from '#src/types/index.ts';
+import type { LogLevel } from '#src/types/index.ts';
+export declare let logger: Logger;
+/**
+ * Creates a logger instance with optional redaction of PII.
+ * Replaces default logger
+ * See PII_PROPERTIES for the list of properties that will be redacted.
+ *
+ * @param redactPii - whether to redact PII from logs
+ * @param level - the log level to use
+ * @param onLog - a callback to call when a log is written
+ */
+export declare function makeLogger(redactPii: boolean, level?: LogLevel, onLog?: (level: LogLevel, log: any) => void): Logger;
+export declare function redact(json: any): any;

package/lib/browser/utils/logger.js

@@ -0,0 +1,88 @@
+import { getEnvVariable } from "../../utils/env.js";
+const PII_PROPERTIES = ["ownerPrivateKey", "secretParams"];
+const redactedText = "[REDACTED]";
+const envLevel = getEnvVariable("LOG_LEVEL");
+const LOG_LEVELS = ["trace", "debug", "info", "warn", "error", "fatal"];
+function createLogger(level, redactPii, onLog) {
+  const levelIndex = LOG_LEVELS.indexOf(level);
+  function shouldLog(msgLevel) {
+    return LOG_LEVELS.indexOf(msgLevel) >= levelIndex;
+  }
+  function log(msgLevel, ...args) {
+    if (!shouldLog(msgLevel)) {
+      return;
+    }
+    let logData = args.length === 1 ? args[0] : args;
+    if (redactPii) {
+      logData = redact(logData);
+    }
+    const consoleFn = console[msgLevel] || console.log;
+    consoleFn(`[${msgLevel.toUpperCase()}]`, logData);
+    onLog?.(msgLevel, logData);
+  }
+  return {
+    trace: (...args) => log("trace", ...args),
+    debug: (...args) => log("debug", ...args),
+    info: (...args) => log("info", ...args),
+    warn: (...args) => log("warn", ...args),
+    error: (...args) => log("error", ...args),
+    fatal: (...args) => log("fatal", ...args),
+    child: (opts) => {
+      const childLogger = createLogger(level, redactPii, onLog);
+      const originalFns = { ...childLogger };
+      for (const lvl of LOG_LEVELS) {
+        childLogger[lvl] = (...args) => {
+          originalFns[lvl]({ ...opts, ...args[0] }, ...args.slice(1));
+        };
+      }
+      return childLogger;
+    }
+  };
+}
+let logger = createLogger("info", false);
+makeLogger(false, envLevel);
+function makeLogger(redactPii, level, onLog) {
+  logger = createLogger(level || "info", redactPii, onLog);
+  return logger;
+}
+function isObjectProperty(property) {
+  return typeof property === "object" && !Array.isArray(property) && property !== null;
+}
+function getReplacer() {
+  const references = /* @__PURE__ */ new WeakSet();
+  return function(key, value) {
+    const isObject = typeof value === "object" && value !== null;
+    if (isObject) {
+      if (references.has(value)) {
+        return "[CIRCULAR]";
+      }
+      references.add(value);
+    }
+    return value;
+  };
+}
+function redact(json) {
+  const isObject = isObjectProperty(json);
+  if (!isObject && !Array.isArray(json)) {
+    return json;
+  }
+  const redacted = JSON.parse(JSON.stringify(json, getReplacer()));
+  for (const prop in redacted) {
+    if (PII_PROPERTIES.includes(prop)) {
+      redacted[prop] = redactedText;
+    }
+    if (Array.isArray(redacted[prop])) {
+      for (const [index, value] of redacted[prop].entries()) {
+        redacted[prop][index] = redact(value);
+      }
+    } else if (isObjectProperty(redacted[prop])) {
+      redacted[prop] = redact(redacted[prop]);
+    }
+  }
+  return redacted;
+}
+export {
+  logger,
+  makeLogger,
+  redact
+};

package/lib/browser/utils/prepare-packets.d.ts

@@ -0,0 +1,16 @@
+import type { CipherSuite, TLSPacketContext } from '@reclaimprotocol/tls';
+import type { ClaimTunnelRequest_TranscriptMessage as TranscriptMessage } from '#src/proto/api.ts';
+import type { CompleteTLSPacket, Logger, MessageRevealInfo, PrepareZKProofsBaseOpts, Transcript } from '#src/types/index.ts';
+export type PreparePacketsForRevealOpts = {
+    cipherSuite: CipherSuite;
+    logger: Logger;
+    /**
+     * Progress of Zk proof generation
+     */
+    onZkProgress?(blocksDone: number, totalBlocks: number): void;
+} & PrepareZKProofsBaseOpts;
+/**
+ * Prepares the packets for reveal to the server
+ * according to the specified reveal type
+ */
+export declare function preparePacketsForReveal(tlsTranscript: Transcript<CompleteTLSPacket>, reveals: Map<TLSPacketContext, MessageRevealInfo>, { onZkProgress, ...opts }: PreparePacketsForRevealOpts): Promise<TranscriptMessage[]>;

package/lib/browser/utils/prepare-packets.js

@@ -0,0 +1,69 @@
+import { concatenateUint8Arrays, crypto } from "@reclaimprotocol/tls";
+import {
+  TranscriptMessageSenderType
+} from "../../proto/api.js";
+import { makeZkProofGenerator } from "../../utils/zk.js";
+async function preparePacketsForReveal(tlsTranscript, reveals, { onZkProgress, ...opts }) {
+  const transcript = [];
+  const proofGenerator = await makeZkProofGenerator(opts);
+  let zkPacketsDone = 0;
+  await Promise.all(tlsTranscript.map(async ({ message, sender }, i) => {
+    const msg = {
+      sender: sender === "client" ? TranscriptMessageSenderType.TRANSCRIPT_MESSAGE_SENDER_TYPE_CLIENT : TranscriptMessageSenderType.TRANSCRIPT_MESSAGE_SENDER_TYPE_SERVER,
+      message: message.data,
+      reveal: void 0
+    };
+    transcript.push(msg);
+    const reveal = reveals.get(message);
+    if (!reveal || message.type === "plaintext") {
+      return;
+    }
+    switch (reveal?.type) {
+      case "complete":
+        msg.reveal = {
+          directReveal: {
+            key: await crypto.exportKey(message.encKey),
+            iv: message.fixedIv,
+            recordNumber: message.recordNumber
+          }
+        };
+        break;
+      case "zk": {
+        reveal.redactedPlaintext = concatenateUint8Arrays([
+          reveal.redactedPlaintext,
+          message.plaintext.slice(reveal.redactedPlaintext.length)
+        ]);
+        const oprfRawMarkers = reveal.oprfRawMarkers?.map((m) => ({
+          dataLocation: m.dataLocation
+        })) || [];
+        const overshotOprfRawLength = reveal.overshotOprfRawFromPrevBlock?.length ?? 0;
+        await proofGenerator.addPacketToProve(
+          message,
+          reveal,
+          (proofs, toprfs) => msg.reveal = {
+            zkReveal: { proofs, toprfs, oprfRawMarkers, overshotOprfRawLength }
+          },
+          () => {
+            const next = tlsTranscript.slice(i + 1).find((t) => t.sender === sender);
+            return next?.message;
+          }
+        );
+        break;
+      }
+      default:
+        break;
+    }
+  }));
+  const zkPacketsTotal = proofGenerator.getTotalChunksToProve();
+  onZkProgress?.(zkPacketsDone, zkPacketsTotal);
+  await proofGenerator.generateProofs(
+    () => {
+      zkPacketsDone += 1;
+      onZkProgress?.(zkPacketsDone, zkPacketsTotal);
+    }
+  );
+  return transcript;
+}
+export {
+  preparePacketsForReveal
+};

package/lib/browser/utils/redactions.d.ts

@@ -0,0 +1,73 @@
+import type { ArraySlice, OPRFRawMarker, RedactedOrHashedArraySlice, TOPRFProofParams } from '#src/types/index.ts';
+export declare const REDACTION_CHAR = "*";
+export declare const REDACTION_CHAR_CODE: number;
+type SliceWithReveal<T> = {
+    block: T;
+    redactedPlaintext: Uint8Array;
+    /**
+     * If the block has some TOPRF claims -- they'll be set here
+     */
+    toprfs?: TOPRFProofParams[];
+    /**
+     * If the block has oprf-raw markers for server-side OPRF computation
+     */
+    oprfRawMarkers?: OPRFRawMarker[];
+    /**
+     * If text was replaced in the previous block w TOPRF but
+     * it overshot into this block. The "length" specifies how much
+     * of it got overshot into this block
+     */
+    overshotToprfFromPrevBlock?: {
+        length: number;
+    };
+    /**
+     * If an oprf-raw marker from the previous block overshot into this block.
+     * The server will collect plaintext from this block to complete the OPRF.
+     */
+    overshotOprfRawFromPrevBlock?: {
+        length: number;
+    };
+};
+export type RevealedSlices<T> = 'all' | SliceWithReveal<T>[];
+/**
+ * Check if a redacted string is congruent with the original string.
+ * @param redacted the redacted content, redacted content is replaced by '*'
+ * @param original the original content
+ */
+export declare function isRedactionCongruent<T extends string | Uint8Array>(redacted: T, original: T): boolean;
+/**
+ * Is the string fully redacted?
+ */
+export declare function isFullyRedacted<T extends string | Uint8Array>(redacted: T): boolean;
+/**
+ * Given some plaintext blocks and a redaction function, return the blocks that
+ * need to be revealed to the other party
+ *
+ * Use case: we get the response for a request in several blocks, and want to redact
+ * pieces that go through multiple blocks. We can use this function to get the
+ * blocks that need to be revealed to the other party
+ *
+ * @example if we received ["secret is 12","345","678. Thanks"]. We'd want
+ * to redact the "12345678" and reveal the rest. We'd pass in the blocks and
+ * the redact function will return the redactions, namely [10,19].
+ * The function will return the blocks ["secret is **","***. Thanks"].
+ * The middle block is fully redacted, so it's not returned
+ *
+ * @param blocks blocks to reveal
+ * @param redact function that returns the redactions
+ * @returns blocks to reveal
+ */
+export declare function getBlocksToReveal<T extends {
+    plaintext: Uint8Array;
+}>(blocks: T[], redact: (total: Uint8Array) => RedactedOrHashedArraySlice[], performOprf: (plaintext: Uint8Array) => Promise<TOPRFProofParams>): Promise<"all" | SliceWithReveal<T>[]>;
+/**
+ * Redact the following slices from the total
+ */
+export declare function redactSlices(total: Uint8Array, slices: ArraySlice[]): Uint8Array<ArrayBuffer>;
+/**
+ * Converts the binary hash to an ASCII string of the expected length.
+ * If the hash is shorter than the expected length, it will be padded with
+ * '0' characters. If it's longer, it will be truncated.
+ */
+export declare function binaryHashToStr(hash: Uint8Array, expLength: number): string;
+export {};