@reclaimprotocol/client 0.1.29 → 0.1.31

package/src/{legacy-proof.ts → request-proof.ts}

@@ -4,7 +4,7 @@ import { fetchReclaimJwks, trustedAttestorAddresses } from './jwks.ts'
 import { assertValidProofHashes, getHashFromProof } from './proof-hash.ts'
 import type {
 	HashRequirement,
-	LegacyProof,
+	ReclaimRequestProof,
 	TrustedData,
 } from './proof-types.ts'
 import {
@@ -13,9 +13,9 @@ import {
 } from './verify-attestor-tee.ts'
 import { runTeeVerification, type TeeAttestationConfig } from './verify-tee.ts'
 
-export type { LegacyProof } from './proof-types.ts'
+export type { ReclaimRequestProof } from './proof-types.ts'
 
-/** A proof hash requirement accepted by legacy `verifyProof`. */
+/** A proof hash requirement accepted by `verifyRequestProof`. */
 export type ProofHashRequirement = string | HashRequirement
 
 export interface ResolvedSessionProofValidation {
@@ -30,8 +30,9 @@ export interface ResolvedProviderProofValidation {
 	hashes: ProofHashRequirement[]
 }
 
-/** Options intentionally preserve legacy `verifyProof` vocabulary. */
-export interface LegacyVerifyProofOptions {
+/** Field names match the request spec a provider recipe declares, so a
+ *  caller configuring verification reads the same vocabulary it authored. */
+export interface VerifyRequestProofOptions {
 	hashes?: ProofHashRequirement[]
 	providerId?: string
 	providerVersion?: string
@@ -50,7 +51,7 @@ export interface LegacyVerifyProofOptions {
 	sessionId?: string
 	resolveSession?: (
 		sessionId: string,
-		proofs: LegacyProof[],
+		proofs: ReclaimRequestProof[],
 	) => Promise<ResolvedSessionProofValidation>
 		| ResolvedSessionProofValidation
 	/** Resolve an exact provider without coupling this verifier to HTTP. */
@@ -58,7 +59,7 @@ export interface LegacyVerifyProofOptions {
 		providerId: string,
 		providerVersion: string | undefined,
 		allowedTags: string[] | undefined,
-		proofs: LegacyProof[],
+		proofs: ReclaimRequestProof[],
 	) => Promise<ResolvedProviderProofValidation[]>
 		| ResolvedProviderProofValidation[]
 	expectedSessionId?: string
@@ -66,29 +67,31 @@ export interface LegacyVerifyProofOptions {
 	expectedContext?: Record<string, unknown>
 }
 
-export interface LegacyProofOutcome {
+export interface ReclaimRequestProofOutcome {
 	valid: boolean
 	reason?: string
 	proofHashes?: string[]
 	isTeeAttestationVerified?: boolean
+	/** True when at least one witness's `attestation_report` verified; false
+	 *  when the check ran and no witness carried one. */
 	isAttestorTeeAttestationVerified?: boolean
 	data?: TrustedData[]
 	publicData?: unknown[]
 }
 
-/** Return the provider hashes encoded in an exact legacy proof. */
-export function proofHashes(proof: LegacyProof): string[] {
+/** Return the provider hashes encoded in an exact request proof. */
+export function proofHashes(proof: ReclaimRequestProof): string[] {
 	return getHashFromProof(proof)
 }
 
 /**
- * Verify exact legacy proofs without depending on `@reclaimprotocol/js-sdk`.
+ * Verify exact request proofs without depending on `@reclaimprotocol/js-sdk`.
  * The signed claim is never renamed or reconstructed.
  */
-export async function verifyProof(
-	proofOrProofs: LegacyProof | LegacyProof[],
-	config: LegacyVerifyProofOptions,
-): Promise<LegacyProofOutcome> {
+export async function verifyRequestProof(
+	proofOrProofs: ReclaimRequestProof | ReclaimRequestProof[],
+	config: VerifyRequestProofOptions,
+): Promise<ReclaimRequestProofOutcome> {
 	const proofs = Array.isArray(proofOrProofs) ? proofOrProofs : [proofOrProofs]
 	if(!proofs.length) {
 		return { valid: false, reason: 'no-proofs' }
@@ -97,8 +100,8 @@ export async function verifyProof(
 	try {
 		const effective = await resolveValidation(config, proofs)
 		assertSessionAndContext(proofs, effective)
-		const attestors = await resolveTrustedAttestors(effective)
-		assertVerifiedSignatures(proofs, attestors)
+		const trust = await resolveAttestorTrust(effective)
+		assertVerifiedSignatures(proofs, trust.addresses)
 		await assertContent(proofs, effective)
 
 		let isTeeAttestationVerified: boolean | undefined
@@ -108,12 +111,20 @@ export async function verifyProof(
 		}
 
 		let isAttestorTeeAttestationVerified: boolean | undefined
-		if(effective.attestorTeeAttestation) {
-			await runAttestorTeeVerification(
+		const attestorTeeAttestation = resolveAttestorTeeAttestation(
+			effective.attestorTeeAttestation,
+			trust.imageDigests,
+		)
+		if(attestorTeeAttestation) {
+			// `verified` counts witnesses whose attestation report was checked.
+			// A proof whose witnesses carry no report still passes the address
+			// and signature bindings, but nothing was attested — say so rather
+			// than reporting a TEE attestation that never happened.
+			const summary = await runAttestorTeeVerification(
 				proofs,
-				effective.attestorTeeAttestation,
+				attestorTeeAttestation,
 			)
-			isAttestorTeeAttestationVerified = true
+			isAttestorTeeAttestationVerified = summary.verified > 0
 		}
 
 		return {
@@ -133,8 +144,8 @@ export async function verifyProof(
 }
 
 async function resolveValidation(
-	config: LegacyVerifyProofOptions,
-	proofs: LegacyProof[],
+	config: VerifyRequestProofOptions,
+	proofs: ReclaimRequestProof[],
 ) {
 	let effective = config
 	if(config.sessionId && !hasContentValidation(config)) {
@@ -151,8 +162,9 @@ async function resolveValidation(
 	return effective
 }
 
-async function resolveTrustedAttestors(config: LegacyVerifyProofOptions) {
+async function resolveAttestorTrust(config: VerifyRequestProofOptions) {
 	const addresses = config.attestorAddresses?.map(normalized) ?? []
+	const imageDigests: string[] = []
 	if(config.attestorJwksUrl) {
 		const registry = await fetchReclaimJwks(
 			config.attestorJwksUrl,
@@ -162,6 +174,9 @@ async function resolveTrustedAttestors(config: LegacyVerifyProofOptions) {
 			...(registry['x-reclaim-attestors'] ?? []),
 			...trustedAttestorAddresses(registry.keys),
 		)
+		imageDigests.push(
+			...(registry['x-reclaim-attestor-image-digests'] ?? []),
+		)
 	}
 
 	const unique = [...new Set(addresses)]
@@ -169,11 +184,41 @@ async function resolveTrustedAttestors(config: LegacyVerifyProofOptions) {
 		throw new Error('attestor-trust-required')
 	}
 
-	return unique
+	return {
+		addresses: unique,
+		imageDigests: [...new Set(imageDigests)],
+	}
+}
+
+function resolveAttestorTeeAttestation(
+	configured: AttestorTeeAttestationConfig | undefined,
+	registryImageDigests: string[],
+): AttestorTeeAttestationConfig | undefined {
+	if(!registryImageDigests.length) {
+		return configured
+	}
+
+	const configuredDigests = configured?.expectedImageDigests
+	if(configuredDigests?.length) {
+		const registry = new Set(registryImageDigests)
+		const expectedImageDigests = [...new Set(configuredDigests
+			.map((digest) => digest.trim().toLowerCase())
+			.filter((digest) => registry.has(digest)))]
+		if(!expectedImageDigests.length) {
+			throw new Error('attestor-image-trust-mismatch')
+		}
+
+		return { ...configured, expectedImageDigests }
+	}
+
+	return {
+		...configured,
+		expectedImageDigests: registryImageDigests,
+	}
 }
 
 function assertVerifiedSignatures(
-	proofs: LegacyProof[],
+	proofs: ReclaimRequestProof[],
 	trustedAttestors: string[],
 ) {
 	for(const proof of proofs) {
@@ -201,8 +246,8 @@ function assertVerifiedSignatures(
 }
 
 async function assertContent(
-	proofs: LegacyProof[],
-	config: LegacyVerifyProofOptions,
+	proofs: ReclaimRequestProof[],
+	config: VerifyRequestProofOptions,
 ) {
 	if(config.dangerouslyDisableContentValidation) {
 		return
@@ -245,8 +290,8 @@ async function assertContent(
 }
 
 function assertSessionAndContext(
-	proofs: LegacyProof[],
-	config: LegacyVerifyProofOptions,
+	proofs: ReclaimRequestProof[],
+	config: VerifyRequestProofOptions,
 ) {
 	const expectedSessionId = config.sessionId ?? config.expectedSessionId
 	for(const proof of proofs) {
@@ -267,7 +312,7 @@ function assertSessionAndContext(
 	}
 }
 
-function trustedData(proof: LegacyProof): TrustedData {
+function trustedData(proof: ReclaimRequestProof): TrustedData {
 	const context = contextFrom(proof)
 	const extractedParameters = isRecord(context.extractedParameters)
 		? Object.fromEntries(Object.entries(context.extractedParameters).map(
@@ -279,7 +324,7 @@ function trustedData(proof: LegacyProof): TrustedData {
 }
 
 function collectProofHashes(
-	proofs: LegacyProof[],
+	proofs: ReclaimRequestProof[],
 	hasNoPii: true | undefined,
 ): string[] | undefined {
 	try {
@@ -289,7 +334,7 @@ function collectProofHashes(
 	}
 }
 
-function hasContentValidation(config: LegacyVerifyProofOptions): boolean {
+function hasContentValidation(config: VerifyRequestProofOptions): boolean {
 	return Boolean(
 		config.hashes
 		|| config.providerId
@@ -315,7 +360,7 @@ function normalized(value: string): string {
 	return value.trim().toLowerCase()
 }
 
-function contextFrom(proof: LegacyProof): Record<string, unknown> {
+function contextFrom(proof: ReclaimRequestProof): Record<string, unknown> {
 	const raw = proof.claimData.context
 	if(!raw) {
 		return {}
@@ -329,7 +374,7 @@ function contextFrom(proof: LegacyProof): Record<string, unknown> {
 	}
 }
 
-function sessionIds(proof: LegacyProof): string[] {
+function sessionIds(proof: ReclaimRequestProof): string[] {
 	const context = contextFrom(proof)
 	const ids = [context.reclaimSessionId]
 	try {
@@ -349,7 +394,7 @@ function sessionIds(proof: LegacyProof): string[] {
 }
 
 function contextMatches(
-	proof: LegacyProof,
+	proof: ReclaimRequestProof,
 	expected?: Record<string, unknown>,
 ): boolean {
 	if(!expected) {