@tchain/tcabci-read-js-client 2.8.3 → 2.8.5

package/bytea.d.ts

@@ -1,3 +1,9 @@
+/** Present PostgreSQL bytea JSON returned by the read node. */
+export interface ByteaJSON {
+  readonly Bytes: string
+  readonly Status: 2
+}
+
 export declare class Bytea {
   constructor(bytes: Uint8Array, status: number)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tchain/tcabci-read-js-client",
-  "version": "2.8.3",
+  "version": "2.8.5",
   "description": "TransferChain Fastest Read Network WebSocket Client",
   "homepage": "https://github.com/TransferChain/tcabci-read-js-client#readme",
   "bugs": {
@@ -21,6 +21,7 @@
     "client.js",
     "errors.js",
     "message.js",
+    "passKey.js",
     "transaction.js",
     "util.js",
     "websocket.js",
@@ -38,9 +39,9 @@
     "lint:check": "oxfmt --check ./ && oxlint ./",
     "test": "pnpm run test:unit && pnpm run test:security && pnpm run test:types",
     "test:all": "pnpm test",
-    "test:coverage": "node --experimental-test-coverage --test test/security.test.js",
+    "test:coverage": "node --experimental-test-coverage --test test/security.test.js test/transaction.test.js",
     "test:unit": "mocha --timeout 5000 test/errors_test.js test/websocketOptions_test.js test/websocket_test.js",
-    "test:security": "node --test test/security.test.js",
+    "test:security": "node --test test/security.test.js test/transaction.test.js",
     "test:types": "tsc --noEmit --strict --module NodeNext --moduleResolution NodeNext --target ES2022 test/consumer.ts",
     "test:integration": "mocha --timeout 7000 test/client_test.js"
   },

package/passKey.js

@@ -0,0 +1,48 @@
+/**
+ * SHA-512 of four concatenated lowercase UUID-v4 ASCII identifiers, matching
+ * SDK passKey defaults. Uses WebCrypto without a dependency on the SDK.
+ * Owned entropy, ASCII and digest bytes are cleared on success and failure.
+ * Immutable returned hex and runtime/native copies cannot be explicitly erased.
+ * @param {(Uint8Array) => Uint8Array} randomizer
+ * @returns {Promise<string>} 128 lowercase hex characters; not an auth credential.
+ */
+export async function passKey(randomizer = null) {
+  const entropy = new Uint8Array(64),
+    ascii = new Uint8Array(144)
+  let digest
+
+  try {
+    if (!randomizer) globalThis.crypto.getRandomValues(entropy)
+    else randomizer(entropy)
+
+    let offset = 0
+
+    for (let uuid = 0; uuid < 4; uuid++) {
+      const start = uuid * 16
+
+      entropy[start + 6] = (entropy[start + 6] & 15) | 64
+      entropy[start + 8] = (entropy[start + 8] & 63) | 128
+
+      for (let index = 0; index < 16; index++) {
+        if ([4, 6, 8, 10].includes(index)) ascii[offset++] = 45
+
+        const value = entropy[start + index]
+
+        for (const nibble of [value >>> 4, value & 15])
+          ascii[offset++] = nibble < 10 ? 48 + nibble : 87 + nibble
+      }
+    }
+
+    digest = new Uint8Array(
+      await globalThis.crypto.subtle.digest('SHA-512', ascii)
+    )
+
+    return Array.from(digest, (byte) =>
+      byte.toString(16).padStart(2, '0')
+    ).join('')
+  } finally {
+    entropy.fill(0)
+    ascii.fill(0)
+    digest?.fill(0)
+  }
+}

package/transaction.d.ts

@@ -1,4 +1,5 @@
 import { JSONValue, ParseResult } from './types.js'
+import { ByteaJSON } from './bytea.js'
 
 export type TXType =
   | 'initial_storage'
@@ -126,7 +127,7 @@ export interface TransactionInput {
   sender_addr: string
   recipient_addr: string
   data: JSONValue
-  sign: string
+  sign: string | ByteaJSON
   fee: number
   hash?: string
   /** Date text/RFC3339Nano, Unix milliseconds or a caller-owned Date. */
@@ -161,7 +162,7 @@ export declare class Transaction {
 
   get CipherData(): JSONValue | undefined
 
-  get Sign(): string
+  get Sign(): string | ByteaJSON
 
   get Fee(): number
 

package/transaction.js

@@ -146,7 +146,7 @@ export class Transaction {
    * @param {string} sender_addr
    * @param {string} recipient_addr
    * @param {string} data
-   * @param {string} sign
+   * @param {string|import('./bytea.js').ByteaJSON} sign
    * @param {number} fee
    * @param {string} hash
    * @param {string|number|Date} [inserted_at] Date text/RFC3339Nano, Unix milliseconds or Date.
@@ -240,6 +240,7 @@ export class Transaction {
     return this._cipherData
   }
 
+  /** @returns {string|import('./bytea.js').ByteaJSON} Factory signatures are detached and frozen. */
   get Sign() {
     return this._sign
   }
@@ -310,7 +311,7 @@ export class Transaction {
       if (typeof obj.cipher_data !== 'undefined')
         tx._cipherData = cloneAndFreeze(obj.cipher_data)
 
-      tx._sign = obj.sign
+      tx._sign = cloneAndFreeze(obj.sign)
       tx._fee = obj.fee
       tx._hash = obj.hash
 
@@ -435,7 +436,18 @@ export class Transaction {
     if (typeof this._data === 'undefined')
       throw new Error(INVALID_ARGUMENT_WITH_CS('data'))
 
-    if (typeof this._sign !== 'string' || !this._sign.length)
+    if (
+      !(typeof this._sign === 'string' && this._sign.length > 0) &&
+      !(
+        this._sign &&
+        typeof this._sign === 'object' &&
+        !Array.isArray(this._sign) &&
+        [Object.prototype, null].includes(Object.getPrototypeOf(this._sign)) &&
+        typeof this._sign.Bytes === 'string' &&
+        this._sign.Bytes.length > 0 &&
+        this._sign.Status === 2
+      )
+    )
       throw new Error(INVALID_ARGUMENT_WITH_CS('sign'))
 
     if (!Number.isFinite(this._fee) || this._fee < 0)