@smartledger/bsv 5.5.0 → 5.5.2

package/test/transaction/unspentoutput.js

@@ -0,0 +1,92 @@
+'use strict'
+
+var chai = require('chai')
+var expect = chai.expect
+var cloneDeep = require('clone-deep')
+
+var bsv = require('../..')
+var UnspentOutput = bsv.Transaction.UnspentOutput
+
+describe('UnspentOutput', function () {
+  var sampleData1 = {
+    'address': 'mszYqVnqKoQx4jcTdJXxwKAissE3Jbrrc1',
+    'txId': 'a477af6b2667c29670467e4e0728b685ee07b240235771862318e29ddbe58458',
+    'outputIndex': 0,
+    'script': 'OP_DUP OP_HASH160 20 0x88d9931ea73d60eaf7e5671efc0552b912911f2a OP_EQUALVERIFY OP_CHECKSIG',
+    'satoshis': 1020000
+  }
+  var sampleData2 = {
+    'txid': 'e42447187db5a29d6db161661e4bc66d61c3e499690fe5ea47f87b79ca573986',
+    'vout': 1,
+    'address': 'mgBCJAsvzgT2qNNeXsoECg2uPKrUsZ76up',
+    'scriptPubKey': '76a914073b7eae2823efa349e3b9155b8a735526463a0f88ac',
+    'amount': 0.01080000
+  }
+
+  it('roundtrip from raw data', function () {
+    expect(UnspentOutput(sampleData2).toObject()).to.deep.equal(sampleData2)
+  })
+
+  it('can be created without "new" operand', function () {
+    expect(UnspentOutput(sampleData1) instanceof UnspentOutput).to.equal(true)
+  })
+
+  it('fails if no tx id is provided', function () {
+    expect(function () {
+      return new UnspentOutput({})
+    }).to.throw()
+  })
+
+  it('fails if vout is not a number', function () {
+    var sample = cloneDeep(sampleData2)
+    sample.vout = '1'
+    expect(function () {
+      return new UnspentOutput(sample)
+    }).to.throw()
+  })
+
+  it('displays nicely on the console', function () {
+    var expected = '<UnspentOutput: a477af6b2667c29670467e4e0728b685ee07b240235771862318e29ddbe58458:0' +
+                   ', satoshis: 1020000, address: mszYqVnqKoQx4jcTdJXxwKAissE3Jbrrc1>'
+    expect(new UnspentOutput(sampleData1).inspect()).to.equal(expected)
+  })
+
+  describe('checking the constructor parameters', function () {
+    var notDefined = {
+      'txId': 'a477af6b2667c29670467e4e0728b685ee07b240235771862318e29ddbe58458',
+      'outputIndex': 0,
+      'script': 'OP_DUP OP_HASH160 20 0x88d9931ea73d60eaf7e5671efc0552b912911f2a OP_EQUALVERIFY OP_CHECKSIG'
+    }
+    var zero = {
+      'txId': 'a477af6b2667c29670467e4e0728b685ee07b240235771862318e29ddbe58458',
+      'outputIndex': 0,
+      'script': 'OP_DUP OP_HASH160 20 0x88d9931ea73d60eaf7e5671efc0552b912911f2a OP_EQUALVERIFY OP_CHECKSIG',
+      'amount': 0
+    }
+    it('fails when no amount is defined', function () {
+      expect(function () {
+        return new UnspentOutput(notDefined)
+      }).to.throw('Must provide an amount for the output')
+    })
+    it('does not fail when amount is zero', function () {
+      expect(function () {
+        return new UnspentOutput(zero)
+      }).to.not.throw()
+    })
+  })
+
+  it('toString returns txid:vout', function () {
+    var expected = 'a477af6b2667c29670467e4e0728b685ee07b240235771862318e29ddbe58458:0'
+    expect(new UnspentOutput(sampleData1).toString()).to.equal(expected)
+  })
+
+  it('to/from JSON roundtrip', function () {
+    var utxo = new UnspentOutput(sampleData2)
+    var obj = UnspentOutput.fromObject(utxo.toJSON()).toObject()
+    expect(obj).to.deep.equal(sampleData2)
+    var str = JSON.stringify(UnspentOutput.fromObject(obj))
+    expect(JSON.parse(str)).to.deep.equal(sampleData2)
+    var str2 = JSON.stringify(new UnspentOutput(JSON.parse(str)))
+    expect(JSON.parse(str2)).to.deep.equal(sampleData2)
+  })
+})

package/test/util/js.js

@@ -0,0 +1,76 @@
+'use strict'
+
+require('chai').should()
+
+var bsv = require('../..')
+var JSUtil = bsv.util.js
+
+describe('js utils', function () {
+  describe('isValidJSON', function () {
+    var hexa = '8080808080808080808080808080808080808080808080808080808080808080'
+    var json = '{"key": ["value", "value2"]}'
+    var json2 = '["value", "value2", {"key": "value"}]'
+
+    it('does not mistake an integer as valid json object', function () {
+      var valid = JSUtil.isValidJSON(hexa)
+      valid.should.equal(false)
+    })
+
+    it('correctly validates a json object', function () {
+      var valid = JSUtil.isValidJSON(json)
+      valid.should.equal(true)
+    })
+
+    it('correctly validates an array json object', function () {
+      var valid = JSUtil.isValidJSON(json2)
+      valid.should.equal(true)
+    })
+  })
+
+  describe('isNaturalNumber', function () {
+    it('false for float', function () {
+      var a = JSUtil.isNaturalNumber(0.1)
+      a.should.equal(false)
+    })
+
+    it('false for string float', function () {
+      var a = JSUtil.isNaturalNumber('0.1')
+      a.should.equal(false)
+    })
+
+    it('false for string integer', function () {
+      var a = JSUtil.isNaturalNumber('1')
+      a.should.equal(false)
+    })
+
+    it('false for negative integer', function () {
+      var a = JSUtil.isNaturalNumber(-1)
+      a.should.equal(false)
+    })
+
+    it('false for negative integer string', function () {
+      var a = JSUtil.isNaturalNumber('-1')
+      a.should.equal(false)
+    })
+
+    it('false for infinity', function () {
+      var a = JSUtil.isNaturalNumber(Infinity)
+      a.should.equal(false)
+    })
+
+    it('false for NaN', function () {
+      var a = JSUtil.isNaturalNumber(NaN)
+      a.should.equal(false)
+    })
+
+    it('true for zero', function () {
+      var a = JSUtil.isNaturalNumber(0)
+      a.should.equal(true)
+    })
+
+    it('true for positive integer', function () {
+      var a = JSUtil.isNaturalNumber(1000)
+      a.should.equal(true)
+    })
+  })
+})

package/test/util/preconditions.js

@@ -0,0 +1,79 @@
+'use strict'
+
+var should = require('chai').should()
+
+var bsv = require('../..')
+var errors = bsv.errors
+var $ = bsv.util.preconditions
+var PrivateKey = bsv.PrivateKey
+
+describe('preconditions', function () {
+  it('can be used to assert state', function () {
+    (function () {
+      $.checkState(false, 'testing')
+    }).should.throw(errors.InvalidState)
+  })
+  it('throws no false negative', function () {
+    (function () {
+      $.checkState(true, 'testing')
+    }).should.not.throw()
+  })
+
+  it('can be used to check an argument', function () {
+    (function () {
+      $.checkArgument(false, 'testing')
+    }).should.throw(errors.InvalidArgument);
+
+    (function () {
+      $.checkArgument(true, 'testing')
+    }).should.not.throw(errors.InvalidArgument)
+  })
+
+  it('can be used to check an argument type', function () {
+    var error
+    try {
+      $.checkArgumentType(1, 'string', 'argumentName')
+    } catch (e) {
+      error = e
+      e.message.should.equal('Invalid Argument for argumentName, expected string but got number')
+    }
+    should.exist(error)
+  })
+  it('has no false negatives when used to check an argument type', function () {
+    (function () {
+      $.checkArgumentType('a String', 'string', 'argumentName')
+    }).should.not.throw()
+  })
+
+  it('can be used to check an argument type for a class', function () {
+    var error
+    try {
+      $.checkArgumentType(1, PrivateKey)
+    } catch (e) {
+      error = e
+      var fail = !(~e.message.indexOf('Invalid Argument for (unknown name)'))
+      fail.should.equal(false)
+    }
+    should.exist(error)
+  })
+  it('has no false negatives when checking a type for a class', function () {
+    (function () {
+      $.checkArgumentType(new PrivateKey(), PrivateKey)
+    }).should.not.throw()
+  })
+
+  it('formats correctly a message on InvalidArgument()', function () {
+    var error = new errors.InvalidArgument()
+    error.message.should.equal('Invalid Argument')
+  })
+
+  it('formats correctly a message on checkArgument', function () {
+    var error
+    try {
+      $.checkArgument(null, 'parameter must be provided')
+    } catch (e) {
+      error = e
+    }
+    error.message.should.equal('Invalid Argument: parameter must be provided')
+  })
+})

package/test/vcjwt/interop.js

@@ -0,0 +1,126 @@
+'use strict'
+
+/* global describe, it */
+
+// Proves the VC-JWT module is interoperable with the standards-compliant
+// `jose` library in BOTH directions, for ES256 (P-256) and ES256K (secp256k1),
+// and that algorithm pinning / curve binding reject substitution attacks.
+
+var assert = require('assert')
+var crypto = require('crypto')
+var jose = require('jose')
+var vcjwt = require('../../lib/vcjwt')
+
+function genKeys (alg, namedCurve) {
+  var pair = crypto.generateKeyPairSync('ec', { namedCurve: namedCurve })
+  var privateJwk = pair.privateKey.export({ format: 'jwk' })
+  var publicJwk = pair.publicKey.export({ format: 'jwk' })
+  privateJwk.kid = publicJwk.kid = 'test-key-1'
+  privateJwk.alg = publicJwk.alg = alg
+  return { privateJwk: privateJwk, publicJwk: publicJwk }
+}
+
+function resolverFor (publicJwk) {
+  return function () {
+    return Promise.resolve({ jwks: { keys: [publicJwk] } })
+  }
+}
+
+var CASES = [
+  { alg: 'ES256', curve: 'prime256v1' },
+  { alg: 'ES256K', curve: 'secp256k1' }
+]
+
+describe('vcjwt JOSE interop', function () {
+  CASES.forEach(function (c) {
+    it('issues a token that ' + c.alg + ' jose can verify (P1363 encoding)', async function () {
+      var keys = genKeys(c.alg, c.curve)
+      var issued = await vcjwt.issueVcJwt({
+        issuerDid: 'did:web:example.com',
+        subjectId: 'did:web:subject.example',
+        credentialSubject: { name: 'Alice' },
+        privateJwk: keys.privateJwk,
+        alg: c.alg
+      })
+      var joseKey = await jose.importJWK(keys.publicJwk, c.alg)
+      var result = await jose.jwtVerify(issued.jwt, joseKey) // throws if non-compliant
+      assert.strictEqual(result.payload.iss, 'did:web:example.com')
+    })
+
+    it('verifies a ' + c.alg + ' token issued by jose', async function () {
+      var keys = genKeys(c.alg, c.curve)
+      var josePriv = await jose.importJWK(keys.privateJwk, c.alg)
+      var joseJwt = await new jose.SignJWT({ vc: { type: ['VerifiableCredential'] } })
+        .setProtectedHeader({ alg: c.alg, typ: 'JWT', kid: keys.publicJwk.kid })
+        .setIssuer('did:web:example.com')
+        .setSubject('did:web:subject.example')
+        .setIssuedAt()
+        .setExpirationTime('1y')
+        .sign(josePriv)
+      var res = await vcjwt.verifyVcJwt(joseJwt, { didResolver: resolverFor(keys.publicJwk) })
+      assert.strictEqual(res.valid, true, res.error)
+    })
+  })
+
+  it('rejects a token whose alg is not in the allowlist', async function () {
+    var keys = genKeys('ES256', 'prime256v1')
+    var issued = await vcjwt.issueVcJwt({
+      issuerDid: 'did:web:example.com', subjectId: 's', credentialSubject: {}, privateJwk: keys.privateJwk, alg: 'ES256'
+    })
+    var res = await vcjwt.verifyVcJwt(issued.jwt, {
+      allowedAlgs: ['ES256K'],
+      didResolver: resolverFor(keys.publicJwk)
+    })
+    assert.strictEqual(res.valid, false)
+    assert.ok(/Algorithm not allowed/.test(res.error), res.error)
+  })
+
+  it('rejects when the resolved key curve does not match the algorithm', async function () {
+    // ES256 token, but the JWKS serves a secp256k1 key under the same kid.
+    var p256 = genKeys('ES256', 'prime256v1')
+    var k1 = genKeys('ES256K', 'secp256k1')
+    var issued = await vcjwt.issueVcJwt({
+      issuerDid: 'did:web:example.com', subjectId: 's', credentialSubject: {}, privateJwk: p256.privateJwk, alg: 'ES256'
+    })
+    var res = await vcjwt.verifyVcJwt(issued.jwt, { didResolver: resolverFor(k1.publicJwk) })
+    assert.strictEqual(res.valid, false)
+    assert.ok(/curve does not match/.test(res.error), res.error)
+  })
+
+  it('refuses to sign when the key curve does not match the algorithm', async function () {
+    var k1 = genKeys('ES256K', 'secp256k1')
+    var threw = false
+    try {
+      await vcjwt.issueVcJwt({
+        issuerDid: 'did:web:example.com', subjectId: 's', credentialSubject: {}, privateJwk: k1.privateJwk, alg: 'ES256'
+      })
+    } catch (e) {
+      threw = /does not match alg/.test(e.message)
+    }
+    assert.ok(threw, 'expected curve/alg mismatch to throw')
+  })
+
+  it('accepts a legacy DER-encoded token only when allowLegacyDER is set', async function () {
+    // Simulate a <=4.6.0 token: same signing input, but DER-encoded signature.
+    var keys = genKeys('ES256', 'prime256v1')
+    var header = { alg: 'ES256', typ: 'JWT', kid: keys.publicJwk.kid }
+    var payload = { iss: 'did:web:example.com', sub: 's', iat: 1700000000, exp: 4102444800, vc: {} }
+    var headerB64 = vcjwt.base64UrlEncode(Buffer.from(JSON.stringify(header)))
+    var payloadB64 = vcjwt.base64UrlEncode(Buffer.from(JSON.stringify(payload)))
+    var signingInput = headerB64 + '.' + payloadB64
+    var derSig = crypto.sign('sha256', Buffer.from(signingInput), {
+      key: crypto.createPrivateKey({ key: keys.privateJwk, format: 'jwk' }),
+      dsaEncoding: 'der'
+    })
+    var legacyJwt = signingInput + '.' + vcjwt.base64UrlEncode(derSig)
+
+    var rejected = await vcjwt.verifyVcJwt(legacyJwt, { didResolver: resolverFor(keys.publicJwk) })
+    assert.strictEqual(rejected.valid, false, 'legacy DER token must fail by default')
+
+    var accepted = await vcjwt.verifyVcJwt(legacyJwt, {
+      allowLegacyDER: true,
+      didResolver: resolverFor(keys.publicJwk)
+    })
+    assert.strictEqual(accepted.valid, true, accepted.error)
+  })
+})