@thurinlabs/identity-kit 1.0.0 → 1.0.2

package/dist/index.cjs

@@ -1339,6 +1339,7 @@ function keyIdToBytes(keyId) {
 }
 
 // src/core/pgp.ts
+var PGP_CONFIG = { rejectCurves: /* @__PURE__ */ new Set() };
 function algorithmName(keyOrSubkey) {
   try {
     const info = keyOrSubkey.getAlgorithmInfo();
@@ -1379,7 +1380,9 @@ async function parsePgpKey(armoredKey) {
           await cert.verify(
             key.keyPacket,
             cert.signatureType,
-            { userID: user.userID, key: key.keyPacket }
+            { userID: user.userID, key: key.keyPacket },
+            void 0,
+            PGP_CONFIG
           );
         } catch (e3) {
           continue;
@@ -1430,7 +1433,7 @@ async function verifyAttestation({
       return { verified: false, reason: "Key fingerprint mismatch" };
     }
     const message = await readCleartextMessage({ cleartextMessage: pgpSignature });
-    const { signatures } = await verify({ message, verificationKeys: publicKey });
+    const { signatures } = await verify({ message, verificationKeys: publicKey, config: PGP_CONFIG });
     await signatures[0].verified;
     const signedText = message.getText();
     if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
@@ -1625,6 +1628,14 @@ var PROVIDERS = [
     pattern: /^https:\/\/gist\.github\.com\/([^/]+)\/([a-f0-9]+)$/i,
     parse: (m) => ({ user: m[1], gistId: m[2] })
   },
+  {
+    // A repository's description — the form an organisation can use, since
+    // gists belong to user accounts only. Same shape as the Codeberg proof.
+    provider: "github",
+    label: "GitHub",
+    pattern: /^https:\/\/github\.com\/([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/i,
+    parse: (m) => ({ user: m[1], repo: m[2] })
+  },
   {
     provider: "dns",
     label: "DNS",
@@ -1696,6 +1707,7 @@ function containsFingerprintUrl(text, fingerprint) {
   return text.toUpperCase().includes(fingerprint.toUpperCase());
 }
 async function verifyGitHub(proof, fingerprint) {
+  if (proof.repo) return verifyGitHubRepo(proof, fingerprint);
   try {
     const resp = await fetch(`https://api.github.com/gists/${proof.gistId}`);
     if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
@@ -1713,6 +1725,24 @@ async function verifyGitHub(proof, fingerprint) {
     return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
   }
 }
+async function verifyGitHubRepo(proof, fingerprint) {
+  try {
+    const resp = await fetch(
+      `https://api.github.com/repos/${encodeURIComponent(proof.user)}/${encodeURIComponent(proof.repo)}`
+    );
+    if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
+    const data = await resp.json();
+    if (_optionalChain([data, 'access', _26 => _26.owner, 'optionalAccess', _27 => _27.login, 'optionalAccess', _28 => _28.toLowerCase, 'call', _29 => _29()]) !== proof.user.toLowerCase()) {
+      return { verified: false, reason: "Repository owner does not match claimed account" };
+    }
+    if (data.description && containsFingerprint(data.description, fingerprint)) {
+      return { verified: true };
+    }
+    return { verified: false, reason: "Fingerprint token not found in repository description" };
+  } catch (err) {
+    return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
+  }
+}
 async function verifyDNS(proof, fingerprint) {
   try {
     const resp = await fetch(
@@ -1758,7 +1788,7 @@ async function verifyFarcaster(proof, fingerprint, neynarApiKey) {
       const data = await resp.json();
       for (const msg of data.messages || []) {
         if (msg.hash && msg.hash.startsWith(proof.castHash)) {
-          const text = _optionalChain([msg, 'access', _26 => _26.data, 'optionalAccess', _27 => _27.castAddBody, 'optionalAccess', _28 => _28.text]) || "";
+          const text = _optionalChain([msg, 'access', _30 => _30.data, 'optionalAccess', _31 => _31.castAddBody, 'optionalAccess', _32 => _32.text]) || "";
           if (containsFingerprint(text, fingerprint)) {
             return { verified: true };
           }
@@ -1834,7 +1864,7 @@ function usePGPProofs(fingerprint, armoredKey) {
   const { data } = _reactquery.useQuery.call(void 0, {
     // The key is large; key the query on its length + fingerprint, which
     // changes whenever a different attestation's key is supplied.
-    queryKey: ["pgp-proofs", fingerprint, _nullishCoalesce(_optionalChain([armoredKey, 'optionalAccess', _29 => _29.length]), () => ( 0))],
+    queryKey: ["pgp-proofs", fingerprint, _nullishCoalesce(_optionalChain([armoredKey, 'optionalAccess', _33 => _33.length]), () => ( 0))],
     queryFn: async () => {
       if (!fingerprint || !armoredKey) return { keyInfo: null, proofs: [] };
       const keyInfo = await parsePgpKey(armoredKey);
@@ -1869,8 +1899,8 @@ function usePGPProofs(fingerprint, armoredKey) {
     staleTime: 3e5
   });
   return {
-    keyInfo: _nullishCoalesce(_optionalChain([data, 'optionalAccess', _30 => _30.keyInfo]), () => ( null)),
-    proofs: _nullishCoalesce(_optionalChain([data, 'optionalAccess', _31 => _31.proofs]), () => ( [])),
+    keyInfo: _nullishCoalesce(_optionalChain([data, 'optionalAccess', _34 => _34.keyInfo]), () => ( null)),
+    proofs: _nullishCoalesce(_optionalChain([data, 'optionalAccess', _35 => _35.proofs]), () => ( [])),
     // Report loading whenever a fingerprint is set but its proofs haven't
     // resolved yet. Using react-query's own isLoading leaves a gap while the
     // query is enabling (fingerprint just became known), during which the card
@@ -1919,13 +1949,13 @@ function useThurinIdentity(ensOrAddress) {
     isLoading: claimsLoading
   } = useAttestations(address);
   const currentClaim = [...claims].reverse().find(
-    (c) => !c.revoked && _optionalChain([c, 'access', _32 => _32.verification, 'optionalAccess', _33 => _33.verified]) && c.fingerprint === currentFingerprint
+    (c) => !c.revoked && _optionalChain([c, 'access', _36 => _36.verification, 'optionalAccess', _37 => _37.verified]) && c.fingerprint === currentFingerprint
   );
   const {
     keyInfo: pgpKeyInfo,
     proofs,
     isLoading: proofsLoading
-  } = usePGPProofs(currentFingerprint, _nullishCoalesce(_optionalChain([currentClaim, 'optionalAccess', _34 => _34.pgpPublicKey]), () => ( null)));
+  } = usePGPProofs(currentFingerprint, _nullishCoalesce(_optionalChain([currentClaim, 'optionalAccess', _38 => _38.pgpPublicKey]), () => ( null)));
   const { efp, isLoading: efpLoading } = useEFPGraph(address);
   return {
     address,
@@ -1964,7 +1994,7 @@ function ThurinCard({ ens, address, theme = "thurin" }) {
   }
   const displayAddress = identity.address || null;
   const verifiedProofs = identity.proofs.filter((p) => p.status === "verified").length;
-  const hasVerifiedPgp = identity.claims.some((c) => _optionalChain([c, 'access', _35 => _35.verification, 'optionalAccess', _36 => _36.verified]) && !c.revoked);
+  const hasVerifiedPgp = identity.claims.some((c) => _optionalChain([c, 'access', _39 => _39.verification, 'optionalAccess', _40 => _40.verified]) && !c.revoked);
   return /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "thurin-card", "data-thurin-theme": theme, children: [
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "a", { className: "thurin-card-header", href: profileUrl || void 0, target: "_blank", rel: "noopener noreferrer", children: [
       identity.ensAvatar ? /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
@@ -1990,13 +2020,13 @@ function ThurinCard({ ens, address, theme = "thurin" }) {
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "thurin-card-stat-label", children: "Proofs" })
       ] }),
       /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "thurin-card-stat", children: [
-        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "thurin-card-stat-value", children: _nullishCoalesce(_optionalChain([identity, 'access', _37 => _37.efp, 'optionalAccess', _38 => _38.followers]), () => ( 0)) }),
+        /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "thurin-card-stat-value", children: _nullishCoalesce(_optionalChain([identity, 'access', _41 => _41.efp, 'optionalAccess', _42 => _42.followers]), () => ( 0)) }),
         /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "thurin-card-stat-label", children: "Followers" })
       ] })
     ] }),
     /* @__PURE__ */ _jsxruntime.jsxs.call(void 0, "div", { className: "thurin-card-badges", children: [
       hasVerifiedPgp && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "thurin-card-badge thurin-card-badge--verified", children: "PGP Verified" }),
-      _optionalChain([identity, 'access', _39 => _39.efp, 'optionalAccess', _40 => _40.hasEfp]) && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "thurin-card-badge thurin-card-badge--verified", children: "EFP" }),
+      _optionalChain([identity, 'access', _43 => _43.efp, 'optionalAccess', _44 => _44.hasEfp]) && /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "span", { className: "thurin-card-badge thurin-card-badge--verified", children: "EFP" }),
       identity.proofs.map((p, i) => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
         "span",
         {