@reclaimprotocol/attestor-core 5.0.1-beta.9 → 5.0.2-beta.1

package/lib/server/utils/iso.js

@@ -1,259 +0,0 @@
-const countries = {
-  AF: "Afghanistan",
-  AX: "\xC5land Islands",
-  AL: "Albania",
-  DZ: "Algeria",
-  AS: "American Samoa",
-  AD: "Andorra",
-  AO: "Angola",
-  AI: "Anguilla",
-  AQ: "Antarctica",
-  AG: "Antigua and Barbuda",
-  AR: "Argentina",
-  AM: "Armenia",
-  AW: "Aruba",
-  AU: "Australia",
-  AT: "Austria",
-  AZ: "Azerbaijan",
-  BS: "Bahamas",
-  BH: "Bahrain",
-  BD: "Bangladesh",
-  BB: "Barbados",
-  BY: "Belarus",
-  BE: "Belgium",
-  BZ: "Belize",
-  BJ: "Benin",
-  BM: "Bermuda",
-  BT: "Bhutan",
-  BO: "Bolivia, Plurinational State of",
-  BQ: "Bonaire, Sint Eustatius and Saba",
-  BA: "Bosnia and Herzegovina",
-  BW: "Botswana",
-  BV: "Bouvet Island",
-  BR: "Brazil",
-  IO: "British Indian Ocean Territory",
-  BN: "Brunei Darussalam",
-  BG: "Bulgaria",
-  BF: "Burkina Faso",
-  BI: "Burundi",
-  KH: "Cambodia",
-  CM: "Cameroon",
-  CA: "Canada",
-  CV: "Cape Verde",
-  KY: "Cayman Islands",
-  CF: "Central African Republic",
-  TD: "Chad",
-  CL: "Chile",
-  CN: "China",
-  CX: "Christmas Island",
-  CC: "Cocos (Keeling) Islands",
-  CO: "Colombia",
-  KM: "Comoros",
-  CG: "Congo",
-  CD: "Congo, the Democratic Republic of the",
-  CK: "Cook Islands",
-  CR: "Costa Rica",
-  CI: "C\xF4te d'Ivoire",
-  HR: "Croatia",
-  CU: "Cuba",
-  CW: "Cura\xE7ao",
-  CY: "Cyprus",
-  CZ: "Czech Republic",
-  DK: "Denmark",
-  DJ: "Djibouti",
-  DM: "Dominica",
-  DO: "Dominican Republic",
-  EC: "Ecuador",
-  EG: "Egypt",
-  SV: "El Salvador",
-  GQ: "Equatorial Guinea",
-  ER: "Eritrea",
-  EE: "Estonia",
-  ET: "Ethiopia",
-  FK: "Falkland Islands (Malvinas)",
-  FO: "Faroe Islands",
-  FJ: "Fiji",
-  FI: "Finland",
-  FR: "France",
-  GF: "French Guiana",
-  PF: "French Polynesia",
-  TF: "French Southern Territories",
-  GA: "Gabon",
-  GM: "Gambia",
-  GE: "Georgia",
-  DE: "Germany",
-  GH: "Ghana",
-  GI: "Gibraltar",
-  GR: "Greece",
-  GL: "Greenland",
-  GD: "Grenada",
-  GP: "Guadeloupe",
-  GU: "Guam",
-  GT: "Guatemala",
-  GG: "Guernsey",
-  GN: "Guinea",
-  GW: "Guinea-Bissau",
-  GY: "Guyana",
-  HT: "Haiti",
-  HM: "Heard Island and McDonald Mcdonald Islands",
-  VA: "Holy See (Vatican City State)",
-  HN: "Honduras",
-  HK: "Hong Kong",
-  HU: "Hungary",
-  IS: "Iceland",
-  IN: "India",
-  ID: "Indonesia",
-  IR: "Iran, Islamic Republic of",
-  IQ: "Iraq",
-  IE: "Ireland",
-  IM: "Isle of Man",
-  IL: "Israel",
-  IT: "Italy",
-  JM: "Jamaica",
-  JP: "Japan",
-  JE: "Jersey",
-  JO: "Jordan",
-  KZ: "Kazakhstan",
-  KE: "Kenya",
-  KI: "Kiribati",
-  XK: "Kosovo",
-  KP: "Korea, Democratic People's Republic of",
-  KR: "Korea, Republic of",
-  KW: "Kuwait",
-  KG: "Kyrgyzstan",
-  LA: "Lao People's Democratic Republic",
-  LV: "Latvia",
-  LB: "Lebanon",
-  LS: "Lesotho",
-  LR: "Liberia",
-  LY: "Libya",
-  LI: "Liechtenstein",
-  LT: "Lithuania",
-  LU: "Luxembourg",
-  MO: "Macao",
-  MK: "North Macedonia",
-  MG: "Madagascar",
-  MW: "Malawi",
-  MY: "Malaysia",
-  MV: "Maldives",
-  ML: "Mali",
-  MT: "Malta",
-  MH: "Marshall Islands",
-  MQ: "Martinique",
-  MR: "Mauritania",
-  MU: "Mauritius",
-  YT: "Mayotte",
-  MX: "Mexico",
-  FM: "Micronesia, Federated States of",
-  MD: "Moldova, Republic of",
-  MC: "Monaco",
-  MN: "Mongolia",
-  ME: "Montenegro",
-  MS: "Montserrat",
-  MA: "Morocco",
-  MZ: "Mozambique",
-  MM: "Myanmar",
-  NA: "Namibia",
-  NR: "Nauru",
-  NP: "Nepal",
-  NL: "Netherlands",
-  AN: "Netherlands Antilles",
-  NC: "New Caledonia",
-  NZ: "New Zealand",
-  NI: "Nicaragua",
-  NE: "Niger",
-  NG: "Nigeria",
-  NU: "Niue",
-  NF: "Norfolk Island",
-  MP: "Northern Mariana Islands",
-  NO: "Norway",
-  OM: "Oman",
-  PK: "Pakistan",
-  PW: "Palau",
-  PS: "Palestine, State of",
-  PA: "Panama",
-  PG: "Papua New Guinea",
-  PY: "Paraguay",
-  PE: "Peru",
-  PH: "Philippines",
-  PN: "Pitcairn",
-  PL: "Poland",
-  PT: "Portugal",
-  PR: "Puerto Rico",
-  QA: "Qatar",
-  RE: "R\xE9union",
-  RO: "Romania",
-  RU: "Russian Federation",
-  RW: "Rwanda",
-  BL: "Saint Barth\xE9lemy",
-  SH: "Saint Helena, Ascension and Tristan da Cunha",
-  KN: "Saint Kitts and Nevis",
-  LC: "Saint Lucia",
-  MF: "Saint Martin (French part)",
-  PM: "Saint Pierre and Miquelon",
-  VC: "Saint Vincent and the Grenadines",
-  WS: "Samoa",
-  SM: "San Marino",
-  ST: "Sao Tome and Principe",
-  SA: "Saudi Arabia",
-  SN: "Senegal",
-  RS: "Serbia",
-  SC: "Seychelles",
-  SL: "Sierra Leone",
-  SG: "Singapore",
-  SX: "Sint Maarten (Dutch part)",
-  SK: "Slovakia",
-  SI: "Slovenia",
-  SB: "Solomon Islands",
-  SO: "Somalia",
-  ZA: "South Africa",
-  GS: "South Georgia and the South Sandwich Islands",
-  SS: "South Sudan",
-  ES: "Spain",
-  LK: "Sri Lanka",
-  SD: "Sudan",
-  SR: "Suriname",
-  SJ: "Svalbard and Jan Mayen",
-  SZ: "Swaziland",
-  SE: "Sweden",
-  CH: "Switzerland",
-  SY: "Syrian Arab Republic",
-  TW: "Taiwan, Province of China",
-  TJ: "Tajikistan",
-  TZ: "Tanzania, United Republic of",
-  TH: "Thailand",
-  TL: "Timor-Leste",
-  TG: "Togo",
-  TK: "Tokelau",
-  TO: "Tonga",
-  TT: "Trinidad and Tobago",
-  TN: "Tunisia",
-  TR: "Turkey",
-  TM: "Turkmenistan",
-  TC: "Turks and Caicos Islands",
-  TV: "Tuvalu",
-  UG: "Uganda",
-  UA: "Ukraine",
-  AE: "United Arab Emirates",
-  GB: "United Kingdom",
-  US: "United States",
-  UM: "United States Minor Outlying Islands",
-  UY: "Uruguay",
-  UZ: "Uzbekistan",
-  VU: "Vanuatu",
-  VE: "Venezuela, Bolivarian Republic of",
-  VN: "Viet Nam",
-  VG: "Virgin Islands, British",
-  VI: "Virgin Islands, U.S.",
-  WF: "Wallis and Futuna",
-  EH: "Western Sahara",
-  YE: "Yemen",
-  ZM: "Zambia",
-  ZW: "Zimbabwe"
-};
-function isValidCountryCode(countryCode) {
-  return countryCode.toUpperCase() in countries;
-}
-export {
-  isValidCountryCode
-};

package/lib/server/utils/keep-alive.js

@@ -1,38 +0,0 @@
-import { MAX_NO_DATA_INTERVAL_MS, PING_INTERVAL_MS } from "../../config/index.js";
-function addKeepAlive(ws, logger) {
-  let sendTimeout;
-  let killTimeout;
-  ws.on("message", () => {
-    logger.trace("data recv, resetting timer");
-    resetTimer();
-  });
-  ws.on("pong", () => {
-    logger.trace("pong received, resetting timer");
-    resetTimer();
-  });
-  ws.on("error", cleanup);
-  ws.on("close", cleanup);
-  function resetTimer() {
-    cleanup();
-    resetSendTimeout();
-    killTimeout = setTimeout(() => {
-      logger.warn(
-        "no data received in a while, closing connection"
-      );
-      ws.close();
-    }, MAX_NO_DATA_INTERVAL_MS);
-  }
-  function resetSendTimeout() {
-    sendTimeout = setTimeout(() => {
-      ws.ping();
-      resetSendTimeout();
-    }, PING_INTERVAL_MS);
-  }
-  function cleanup() {
-    clearTimeout(killTimeout);
-    clearTimeout(sendTimeout);
-  }
-}
-export {
-  addKeepAlive
-};

package/lib/server/utils/nitro-attestation.js

@@ -1,249 +0,0 @@
-import { AsnParser } from "@peculiar/asn1-schema";
-import { SubjectPublicKeyInfo } from "@peculiar/asn1-x509";
-import { Crypto } from "@peculiar/webcrypto";
-import { X509Certificate, X509ChainBuilder } from "@peculiar/x509";
-import { sign } from "cose-js";
-async function getCborDecode() {
-  const { decode } = await import("cbor-x");
-  return decode;
-}
-const AWS_NITRO_ROOT_CERT = `-----BEGIN CERTIFICATE-----
-MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
-MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
-VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
-MTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQL
-DANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEG
-BSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb
-48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZE
-h8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkF
-R+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYC
-MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
-rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
-IwLz3/Y=
------END CERTIFICATE-----`;
-async function validateCertificateChain(targetCert, intermediateCerts, rootCert, crypto) {
-  const errors = [];
-  try {
-    const rootSubject = rootCert.subject;
-    const rootIssuer = rootCert.issuer;
-    if (rootSubject !== rootIssuer) {
-      errors.push("Root certificate is not self-signed");
-    }
-    try {
-      const isRootValid = await rootCert.verify(void 0, crypto);
-      if (!isRootValid) {
-        errors.push("Root certificate signature verification failed");
-      }
-    } catch (error) {
-      errors.push(`Root certificate verification failed: ${error.message}`);
-    }
-    const chainBuilder = new X509ChainBuilder({
-      certificates: [rootCert, ...intermediateCerts]
-    });
-    let chain;
-    try {
-      chain = await chainBuilder.build(targetCert, crypto);
-    } catch (error) {
-      errors.push(`Certificate chain building failed: ${error.message}`);
-      return { isValid: false, errors, chain: [] };
-    }
-    if (!chain || chain.length === 0) {
-      errors.push("No valid certificate chain could be built");
-      return { isValid: false, errors, chain: [] };
-    }
-    const now = /* @__PURE__ */ new Date();
-    for (let i = 0; i < chain.length; i++) {
-      const cert = chain[i];
-      if (now < cert.notBefore) {
-        errors.push(`Certificate ${i} (${cert.subject}) is not yet valid`);
-      }
-      if (now > cert.notAfter) {
-        errors.push(`Certificate ${i} (${cert.subject}) has expired`);
-      }
-      if (i < chain.length - 1) {
-        try {
-          const issuer = chain[i + 1];
-          const isValid = await cert.verify(issuer, crypto);
-          if (!isValid) {
-            errors.push(`Certificate ${i} signature verification failed`);
-          }
-        } catch (error) {
-          errors.push(`Certificate ${i} verification failed: ${error.message}`);
-        }
-      }
-    }
-    return {
-      isValid: errors.length === 0,
-      errors,
-      chain
-    };
-  } catch (error) {
-    errors.push(`Certificate chain validation error: ${error.message}`);
-    return { isValid: false, errors, chain: [] };
-  }
-}
-function extractPublicKeyFromUserData(userDataBuffer) {
-  try {
-    const userDataString = userDataBuffer.toString("utf-8");
-    const teeKMatch = userDataString.match(/^tee_k_public_key:(0x[0-9a-fA-F]{40})$/);
-    const teeTMatch = userDataString.match(/^tee_t_public_key:(0x[0-9a-fA-F]{40})$/);
-    if (teeKMatch) {
-      return {
-        teeType: "tee_k",
-        ethAddress: teeKMatch[1],
-        // Store the full ETH address with 0x prefix
-        pcr0: ""
-      };
-    }
-    if (teeTMatch) {
-      return {
-        teeType: "tee_t",
-        ethAddress: teeTMatch[1],
-        // Store the full ETH address with 0x prefix
-        pcr0: ""
-      };
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-async function validateNitroAttestationAndExtractKey(attestationBytes) {
-  const errors = [];
-  const warnings = [];
-  try {
-    const crypto = new Crypto();
-    const decode = await getCborDecode();
-    let decoded;
-    try {
-      decoded = decode(Buffer.from(attestationBytes));
-    } catch (error) {
-      errors.push(`CBOR decoding failed: ${error.message}`);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    if (!Array.isArray(decoded) || decoded.length < 4) {
-      errors.push("Invalid COSE_Sign1 structure: expected array with 4 elements");
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    const [, , payload] = decoded;
-    if (!payload || payload.length === 0) {
-      errors.push("Empty or missing payload in COSE_Sign1 structure");
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    let doc;
-    try {
-      doc = decode(payload);
-    } catch (error) {
-      errors.push(`Payload decoding failed: ${error.message}`);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    if (doc.module_id.length === 0) {
-      errors.push("Missing or invalid module_id");
-    }
-    if (doc.digest.length === 0) {
-      errors.push("Missing or invalid digest");
-    }
-    if (!doc.pcrs || typeof doc.pcrs !== "object") {
-      errors.push("Missing or invalid pcrs");
-    }
-    if (!Buffer.isBuffer(doc.certificate) || doc.certificate.length === 0) {
-      errors.push("Missing or invalid certificate");
-    }
-    if (!Array.isArray(doc.cabundle) || doc.cabundle.length === 0) {
-      errors.push("Missing or invalid cabundle");
-    }
-    if (errors.length > 0) {
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    const pcr0 = doc.pcrs[0].toString("hex");
-    const intermediateCerts = [];
-    for (let i = 0; i < doc.cabundle.length; i++) {
-      try {
-        const cert = new X509Certificate(doc.cabundle[i].toString("base64"));
-        intermediateCerts.push(cert);
-      } catch (error) {
-        errors.push(`Failed to parse cabundle certificate ${i}: ${error.message}`);
-      }
-    }
-    let targetCert;
-    try {
-      targetCert = new X509Certificate(doc.certificate.toString("base64"));
-    } catch (error) {
-      errors.push(`Failed to parse target certificate: ${error.message}`);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    let rootCert;
-    try {
-      rootCert = new X509Certificate(AWS_NITRO_ROOT_CERT);
-    } catch (error) {
-      errors.push(`Failed to parse AWS Nitro root certificate: ${error.message}`);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    const chainResult = await validateCertificateChain(targetCert, intermediateCerts, rootCert, crypto);
-    if (!chainResult.isValid) {
-      errors.push(...chainResult.errors);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    let publicKeyRaw;
-    try {
-      publicKeyRaw = Buffer.from(targetCert.publicKey.rawData);
-    } catch (error) {
-      errors.push(`Failed to extract public key: ${error.message}`);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    if (publicKeyRaw.length !== 120 || publicKeyRaw[0] !== 48) {
-      errors.push(`Invalid public key format: expected 120-byte DER-encoded key, got ${publicKeyRaw.length} bytes`);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    let spki;
-    try {
-      spki = AsnParser.parse(publicKeyRaw, SubjectPublicKeyInfo);
-    } catch (error) {
-      errors.push(`Failed to parse SubjectPublicKeyInfo: ${error.message}`);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    const ecPoint = Buffer.from(spki.subjectPublicKey);
-    if (ecPoint.length !== 97 || ecPoint[0] !== 4) {
-      errors.push("Invalid EC point: expected 97-byte uncompressed P-384 key");
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    const x = ecPoint.subarray(1, 49);
-    const y = ecPoint.subarray(49, 97);
-    try {
-      const verifier = {
-        key: {
-          x,
-          y
-        }
-      };
-      const options = { defaultType: 18 };
-      await sign.verify(Buffer.from(attestationBytes), verifier, options);
-    } catch (error) {
-      errors.push(`COSE signature verification failed: ${error.message}`);
-      return { isValid: false, errors, warnings, pcr0: "" };
-    }
-    let userDataType;
-    let ethAddress;
-    if (doc.user_data) {
-      const keyInfo = extractPublicKeyFromUserData(doc.user_data);
-      if (keyInfo) {
-        userDataType = keyInfo.teeType;
-        ethAddress = keyInfo.ethAddress;
-      }
-    }
-    return {
-      isValid: errors.length === 0,
-      errors,
-      warnings,
-      userDataType,
-      ethAddress,
-      pcr0
-    };
-  } catch (error) {
-    errors.push(`Unexpected error during validation: ${error.message}`);
-    return { isValid: false, errors, warnings, pcr0: "" };
-  }
-}
-export {
-  validateNitroAttestationAndExtractKey
-};

package/lib/server/utils/oprf-raw.js

@@ -1,61 +0,0 @@
-import { getBytes } from "ethers";
-import { TOPRF_DOMAIN_SEPARATOR } from "../../config/index.js";
-import { getEnvVariable } from "../../utils/env.js";
-import { makeDefaultOPRFOperator } from "../../utils/zk.js";
-async function computeOPRFRaw(plaintext, markers, logger) {
-  if (!markers.length) {
-    return [];
-  }
-  const PRIVATE_KEY_STR = getEnvVariable("TOPRF_SHARE_PRIVATE_KEY");
-  const PUBLIC_KEY_STR = getEnvVariable("TOPRF_SHARE_PUBLIC_KEY");
-  if (!PRIVATE_KEY_STR || !PUBLIC_KEY_STR) {
-    throw new Error("TOPRF keys not configured. Cannot compute oprf-raw.");
-  }
-  const privateKey = getBytes(PRIVATE_KEY_STR);
-  const publicKey = getBytes(PUBLIC_KEY_STR);
-  const operator = makeDefaultOPRFOperator("chacha20", "gnark", logger);
-  const results = [];
-  for (const marker of markers) {
-    const { dataLocation } = marker;
-    if (!dataLocation) {
-      logger.warn("oprf-raw marker missing dataLocation, skipping");
-      continue;
-    }
-    const { fromIndex, length } = dataLocation;
-    const endIndex = fromIndex + length;
-    if (endIndex > plaintext.length) {
-      throw new Error(
-        `oprf-raw marker out of bounds: fromIndex=${fromIndex}, length=${length}, plaintextLength=${plaintext.length}`
-      );
-    }
-    const data = plaintext.slice(fromIndex, endIndex);
-    const request = await operator.generateOPRFRequestData(
-      data,
-      TOPRF_DOMAIN_SEPARATOR,
-      logger
-    );
-    const response = await operator.evaluateOPRF(
-      privateKey,
-      request.maskedData,
-      logger
-    );
-    const nullifier = await operator.finaliseOPRF(
-      publicKey,
-      request,
-      [{ ...response, publicKeyShare: publicKey }],
-      logger
-    );
-    results.push({
-      dataLocation: { fromIndex, length },
-      nullifier
-    });
-    logger.debug(
-      { fromIndex, length, nullifierHex: Buffer.from(nullifier).toString("hex").slice(0, 16) + "..." },
-      "computed oprf-raw nullifier"
-    );
-  }
-  return results;
-}
-export {
-  computeOPRFRaw
-};