@structured-id/ui-core 2.0.0 → 3.0.0

package/src/browser-vp/storage.ts

@@ -1,163 +0,0 @@
-/**
- * IndexedDB storage for Browser VP.
- *
- * Database: sid-browser-vp
- *   ├── bindings       — per-service binding entries (key: service_sector)
- *   └── profile-state  — profile state + encrypted blob (key: profile_id)
- */
-
-import type { ProfileState, BindingEntry } from "./types";
-
-const DB_NAME = "sid-browser-vp";
-const DB_VERSION = 1;
-const STORE_BINDINGS = "bindings";
-const STORE_PROFILE = "profile-state";
-
-/**
- * Open (or create) the IndexedDB database.
- */
-function openDb(): Promise<IDBDatabase> {
-  return new Promise((resolve, reject) => {
-    const request = indexedDB.open(DB_NAME, DB_VERSION);
-
-    request.onupgradeneeded = () => {
-      const db = request.result;
-      if (!db.objectStoreNames.contains(STORE_BINDINGS)) {
-        db.createObjectStore(STORE_BINDINGS, { keyPath: "serviceSector" });
-      }
-      if (!db.objectStoreNames.contains(STORE_PROFILE)) {
-        db.createObjectStore(STORE_PROFILE, { keyPath: "profileId" });
-      }
-    };
-
-    request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(request.error);
-  });
-}
-
-// ── Profile State ──
-
-/** Save or update profile state. */
-export async function saveProfileState(
-  profileId: string,
-  state: ProfileState,
-): Promise<void> {
-  const db = await openDb();
-  return new Promise((resolve, reject) => {
-    const tx = db.transaction(STORE_PROFILE, "readwrite");
-    tx.objectStore(STORE_PROFILE).put({ profileId, ...state });
-    tx.oncomplete = () => resolve();
-    tx.onerror = () => reject(tx.error);
-  });
-}
-
-/** Load profile state by ID. Returns null if not found. */
-export async function loadProfileState(
-  profileId: string,
-): Promise<ProfileState | null> {
-  const db = await openDb();
-  return new Promise((resolve, reject) => {
-    const tx = db.transaction(STORE_PROFILE, "readonly");
-    const request = tx.objectStore(STORE_PROFILE).get(profileId);
-    request.onsuccess = () => {
-      const result = request.result;
-      if (!result) {
-        resolve(null);
-        return;
-      }
-      // Strip the profileId key we added for IndexedDB
-      const { profileId: _profileId, ...state } = result;
-      resolve(state as ProfileState);
-    };
-    request.onerror = () => reject(request.error);
-  });
-}
-
-/** Delete profile state. */
-export async function deleteProfileState(profileId: string): Promise<void> {
-  const db = await openDb();
-  return new Promise((resolve, reject) => {
-    const tx = db.transaction(STORE_PROFILE, "readwrite");
-    tx.objectStore(STORE_PROFILE).delete(profileId);
-    tx.oncomplete = () => resolve();
-    tx.onerror = () => reject(tx.error);
-  });
-}
-
-// ── Bindings ──
-
-/** Save or update a binding entry. */
-export async function saveBinding(
-  serviceSector: string,
-  entry: BindingEntry,
-): Promise<void> {
-  const db = await openDb();
-  return new Promise((resolve, reject) => {
-    const tx = db.transaction(STORE_BINDINGS, "readwrite");
-    tx.objectStore(STORE_BINDINGS).put({ serviceSector, ...entry });
-    tx.oncomplete = () => resolve();
-    tx.onerror = () => reject(tx.error);
-  });
-}
-
-/** Load a binding by service sector. */
-export async function loadBinding(
-  serviceSector: string,
-): Promise<BindingEntry | null> {
-  const db = await openDb();
-  return new Promise((resolve, reject) => {
-    const tx = db.transaction(STORE_BINDINGS, "readonly");
-    const request = tx.objectStore(STORE_BINDINGS).get(serviceSector);
-    request.onsuccess = () => {
-      const result = request.result;
-      if (!result) {
-        resolve(null);
-        return;
-      }
-      const { serviceSector: _serviceSector, ...entry } = result;
-      resolve(entry as BindingEntry);
-    };
-    request.onerror = () => reject(request.error);
-  });
-}
-
-/** List all stored bindings. */
-export async function listBindings(): Promise<
-  Array<{ serviceSector: string } & BindingEntry>
-> {
-  const db = await openDb();
-  return new Promise((resolve, reject) => {
-    const tx = db.transaction(STORE_BINDINGS, "readonly");
-    const request = tx.objectStore(STORE_BINDINGS).getAll();
-    request.onsuccess = () => resolve(request.result ?? []);
-    request.onerror = () => reject(request.error);
-  });
-}
-
-/** Delete a binding. */
-export async function deleteBinding(serviceSector: string): Promise<void> {
-  const db = await openDb();
-  return new Promise((resolve, reject) => {
-    const tx = db.transaction(STORE_BINDINGS, "readwrite");
-    tx.objectStore(STORE_BINDINGS).delete(serviceSector);
-    tx.oncomplete = () => resolve();
-    tx.onerror = () => reject(tx.error);
-  });
-}
-
-/** Clear all data (profile state + bindings). */
-export async function clearAll(): Promise<void> {
-  const db = await openDb();
-  return new Promise((resolve, reject) => {
-    const tx = db.transaction([STORE_PROFILE, STORE_BINDINGS], "readwrite");
-    tx.objectStore(STORE_PROFILE).clear();
-    tx.objectStore(STORE_BINDINGS).clear();
-    tx.oncomplete = () => resolve();
-    tx.onerror = () => reject(tx.error);
-  });
-}
-
-/** Check if IndexedDB is available in this environment. */
-export function isIndexedDbAvailable(): boolean {
-  return typeof indexedDB !== "undefined";
-}

package/src/browser-vp/types.ts

@@ -1,95 +0,0 @@
-/**
- * Browser VP types.
- */
-
-/** VP strategy — automatically selected based on browser capabilities. */
-export type VpStrategy = "prf" | "device-key";
-
-/** Profile state stored in IndexedDB. */
-export interface ProfileState {
-  /** Which strategy this profile uses. */
-  strategy: VpStrategy;
-
-  /** Encrypted profile blob (< 1MB typical). */
-  encryptedBlob: ArrayBuffer;
-
-  /** Optimistic sync version with SID server. */
-  blobVersion: number;
-
-  // Strategy A (PRF) fields
-  /** PRF salt identifier (for versioning). */
-  prfSalt?: string;
-  /** SHA-256 of master public key (authenticator change detection). */
-  masterPublicKeyHash?: string;
-
-  // Strategy B (device-key) fields
-  /** Non-extractable CryptoKey reference (browser-managed). */
-  cryptoKeyRef?: CryptoKey;
-
-  /** Last sync timestamp with SID server. */
-  lastSyncedAt: Date;
-  /** SID device ID for this browser instance. */
-  deviceId: string;
-}
-
-/** Per-service binding stored in IndexedDB. */
-export interface BindingEntry {
-  /** Opaque BindingId (pairwise per-service). */
-  bindingId: string;
-  /** HD derivation index for this binding. */
-  bindingIndex: number;
-  /** Per-binding certificate chain (DER-encoded). */
-  certChain: ArrayBuffer;
-  /** Certificate expiry date. */
-  certExpiry: Date;
-  /** Last time a VP was created for this binding. */
-  lastUsedAt: Date;
-}
-
-/** Key material derived from PRF or generated via WebCrypto. */
-export interface DerivedKeys {
-  /** ECDSA P-256 signing key (non-extractable). */
-  signingKey: CryptoKeyPair;
-  /** AES-256-GCM data encryption key. */
-  dataKey: CryptoKey;
-}
-
-/** Verifiable Presentation payload. */
-export interface VerifiablePresentation {
-  /** The service sector this VP is bound to. */
-  serviceSector: string;
-  /** Binding ID (pairwise). */
-  bindingId: string;
-  /** Signed VP payload (CBOR or JSON). */
-  payload: ArrayBuffer;
-  /** Signature over payload. */
-  signature: ArrayBuffer;
-  /** Certificate chain for verification. */
-  certChain: ArrayBuffer;
-  /** Nonce from relying party (replay protection). */
-  nonce: string;
-  /** Audience (relying party origin). */
-  audience: string;
-}
-
-/** Options for VP creation request from a relying party. */
-export interface VpRequest {
-  /** Nonce for replay protection. */
-  nonce: string;
-  /** Requested claims (e.g., ["email", "name"]). */
-  requestedClaims: string[];
-  /** Audience (relying party origin). */
-  audience: string;
-  /** Service sector identifier. */
-  serviceSector: string;
-}
-
-/** Result of browser VP initialization. */
-export interface BrowserVpContext {
-  /** Active strategy. */
-  strategy: VpStrategy;
-  /** Profile ID. */
-  profileId: string;
-  /** Whether VP creation is available (keys + blob + cert ready). */
-  ready: boolean;
-}

package/src/browser-vp/vp.test.ts

@@ -1,43 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { needsRenewal } from "./vp";
-import type { BindingEntry } from "./types";
-
-function makeBinding(certExpiry: Date): BindingEntry {
-  return {
-    bindingId: "bind_test",
-    bindingIndex: 0,
-    certChain: new ArrayBuffer(0),
-    certExpiry,
-    lastUsedAt: new Date(),
-  };
-}
-
-describe("needsRenewal", () => {
-  it("returns true when cert expires in less than 7 days", () => {
-    const sixDays = Date.now() + 6 * 24 * 60 * 60 * 1000;
-    expect(needsRenewal(makeBinding(new Date(sixDays)))).toBe(true);
-  });
-
-  it("returns true when cert is already expired", () => {
-    const yesterday = Date.now() - 24 * 60 * 60 * 1000;
-    expect(needsRenewal(makeBinding(new Date(yesterday)))).toBe(true);
-  });
-
-  it("returns false when cert expires in more than 7 days", () => {
-    const eightDays = Date.now() + 8 * 24 * 60 * 60 * 1000;
-    expect(needsRenewal(makeBinding(new Date(eightDays)))).toBe(false);
-  });
-
-  it("returns true at exactly 7 days boundary", () => {
-    // At exactly 7 days, difference < 7 days in ms because of execution time
-    // At exactly 7 days, could be true or false depending on execution timing.
-    // We test just under 7 days to be deterministic.
-    const justUnder = Date.now() + 7 * 24 * 60 * 60 * 1000 - 1000;
-    expect(needsRenewal(makeBinding(new Date(justUnder)))).toBe(true);
-  });
-
-  it("returns false for far-future expiry", () => {
-    const oneYear = Date.now() + 365 * 24 * 60 * 60 * 1000;
-    expect(needsRenewal(makeBinding(new Date(oneYear)))).toBe(false);
-  });
-});

package/src/browser-vp/vp.ts

@@ -1,111 +0,0 @@
-/**
- * Verifiable Presentation creation.
- *
- * Builds and signs VPs using cached keys and profile blob.
- * VP creation is fully offline (~50ms with biometric cache).
- */
-
-import type { VpRequest, VerifiablePresentation, BindingEntry } from "./types";
-import { sign } from "./crypto";
-import { loadBinding, saveBinding } from "./storage";
-
-const encoder = new TextEncoder();
-
-/**
- * Create a Verifiable Presentation for a service.
- *
- * @param request - VP request from the relying party.
- * @param signingKey - ECDSA P-256 private key (master or per-binding).
- * @param profileBlob - Decrypted profile blob.
- * @returns Signed VP, or null if binding not found.
- */
-export async function createVp(
-  request: VpRequest,
-  signingKey: CryptoKey,
-  profileBlob: ArrayBuffer,
-): Promise<VerifiablePresentation | null> {
-  // Load binding for this service sector
-  const binding = await loadBinding(request.serviceSector);
-  if (!binding) {
-    return null;
-  }
-
-  // Check certificate expiry
-  if (binding.certExpiry < new Date()) {
-    // Certificate expired — VP creation blocked
-    // Caller should trigger online renewal
-    return null;
-  }
-
-  // Build VP payload
-  const payload = buildPayload(request, binding, profileBlob);
-
-  // Sign with binding key
-  const signature = await sign(payload, signingKey);
-
-  // Update last used timestamp
-  await saveBinding(request.serviceSector, {
-    ...binding,
-    lastUsedAt: new Date(),
-  });
-
-  return {
-    serviceSector: request.serviceSector,
-    bindingId: binding.bindingId,
-    payload,
-    signature,
-    certChain: binding.certChain,
-    nonce: request.nonce,
-    audience: request.audience,
-  };
-}
-
-/**
- * Build the VP payload to be signed.
- *
- * The payload contains:
- * - nonce (replay protection)
- * - audience (relying party)
- * - bindingId (pairwise identifier)
- * - requested claims (selective disclosure)
- * - timestamp
- */
-function buildPayload(
-  request: VpRequest,
-  binding: BindingEntry,
-  _profileBlob: ArrayBuffer,
-): ArrayBuffer {
-  // Simplified payload structure.
-  // Production: SD-JWT or Merkle-based selective disclosure
-  // from the profile blob.
-  const payload = {
-    nonce: request.nonce,
-    aud: request.audience,
-    sub: binding.bindingId,
-    iat: Math.floor(Date.now() / 1000),
-    claims: request.requestedClaims,
-  };
-
-  return encoder.encode(JSON.stringify(payload)).buffer as ArrayBuffer;
-}
-
-/**
- * Check if a binding's certificate needs renewal.
- *
- * Renewal is attempted 7 days before expiry (background).
- */
-export function needsRenewal(binding: BindingEntry): boolean {
-  const sevenDays = 7 * 24 * 60 * 60 * 1000;
-  return binding.certExpiry.getTime() - Date.now() < sevenDays;
-}
-
-/**
- * List all bindings that need certificate renewal.
- */
-export async function getExpiringSoon(): Promise<
-  Array<{ serviceSector: string } & BindingEntry>
-> {
-  const { listBindings } = await import("./storage");
-  const all = await listBindings();
-  return all.filter((b) => needsRenewal(b));
-}