@thurinlabs/identity-kit 1.0.0 → 1.0.2

package/dist/index.js

@@ -1339,6 +1339,7 @@ function keyIdToBytes(keyId) {
 }
 
 // src/core/pgp.ts
+var PGP_CONFIG = { rejectCurves: /* @__PURE__ */ new Set() };
 function algorithmName(keyOrSubkey) {
   try {
     const info = keyOrSubkey.getAlgorithmInfo();
@@ -1379,7 +1380,9 @@ async function parsePgpKey(armoredKey) {
           await cert.verify(
             key.keyPacket,
             cert.signatureType,
-            { userID: user.userID, key: key.keyPacket }
+            { userID: user.userID, key: key.keyPacket },
+            void 0,
+            PGP_CONFIG
           );
         } catch {
           continue;
@@ -1430,7 +1433,7 @@ async function verifyAttestation({
       return { verified: false, reason: "Key fingerprint mismatch" };
     }
     const message = await readCleartextMessage({ cleartextMessage: pgpSignature });
-    const { signatures } = await verify({ message, verificationKeys: publicKey });
+    const { signatures } = await verify({ message, verificationKeys: publicKey, config: PGP_CONFIG });
     await signatures[0].verified;
     const signedText = message.getText();
     if (!signedText.toLowerCase().includes(ethAddress.toLowerCase())) {
@@ -1625,6 +1628,14 @@ var PROVIDERS = [
     pattern: /^https:\/\/gist\.github\.com\/([^/]+)\/([a-f0-9]+)$/i,
     parse: (m) => ({ user: m[1], gistId: m[2] })
   },
+  {
+    // A repository's description — the form an organisation can use, since
+    // gists belong to user accounts only. Same shape as the Codeberg proof.
+    provider: "github",
+    label: "GitHub",
+    pattern: /^https:\/\/github\.com\/([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/i,
+    parse: (m) => ({ user: m[1], repo: m[2] })
+  },
   {
     provider: "dns",
     label: "DNS",
@@ -1696,6 +1707,7 @@ function containsFingerprintUrl(text, fingerprint) {
   return text.toUpperCase().includes(fingerprint.toUpperCase());
 }
 async function verifyGitHub(proof, fingerprint) {
+  if (proof.repo) return verifyGitHubRepo(proof, fingerprint);
   try {
     const resp = await fetch(`https://api.github.com/gists/${proof.gistId}`);
     if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
@@ -1713,6 +1725,24 @@ async function verifyGitHub(proof, fingerprint) {
     return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
   }
 }
+async function verifyGitHubRepo(proof, fingerprint) {
+  try {
+    const resp = await fetch(
+      `https://api.github.com/repos/${encodeURIComponent(proof.user)}/${encodeURIComponent(proof.repo)}`
+    );
+    if (!resp.ok) return { verified: false, reason: `GitHub API returned ${resp.status}` };
+    const data = await resp.json();
+    if (data.owner?.login?.toLowerCase() !== proof.user.toLowerCase()) {
+      return { verified: false, reason: "Repository owner does not match claimed account" };
+    }
+    if (data.description && containsFingerprint(data.description, fingerprint)) {
+      return { verified: true };
+    }
+    return { verified: false, reason: "Fingerprint token not found in repository description" };
+  } catch (err) {
+    return { verified: false, reason: `GitHub fetch failed: ${err.message}` };
+  }
+}
 async function verifyDNS(proof, fingerprint) {
   try {
     const resp = await fetch(