@unchainedshop/api 3.1.0 → 3.1.1

package/lib/resolvers/mutations/accounts/verifyWeb3Address.d.ts

@@ -1,6 +1,6 @@
 import { Context } from '../../../context.js';
 export default function verifyWeb3Address(root: never, { address, hash }: {
     address: string;
-    hash: string;
+    hash: `0x${string}`;
 }, { modules, userId, user }: Context): Promise<import("@unchainedshop/core-users").User>;
 //# sourceMappingURL=verifyWeb3Address.d.ts.map

package/lib/resolvers/mutations/accounts/verifyWeb3Address.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyWeb3Address.d.ts","sourceRoot":"","sources":["../../../../src/resolvers/mutations/accounts/verifyWeb3Address.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,wBAA8B,iBAAiB,CAC7C,IAAI,EAAE,KAAK,EACX,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACpD,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,qDAqDnC"}
+{"version":3,"file":"verifyWeb3Address.d.ts","sourceRoot":"","sources":["../../../../src/resolvers/mutations/accounts/verifyWeb3Address.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,wBAA8B,iBAAiB,CAC7C,IAAI,EAAE,KAAK,EACX,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,EAC3D,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,qDAwDnC"}

package/lib/resolvers/mutations/accounts/verifyWeb3Address.js

@@ -8,16 +8,17 @@ export default async function verifyWeb3Address(root, { address, hash }, { modul
     if (!foundCredentials) {
         throw new UserWeb3AddressNotFoundError({ userId, address });
     }
-    const msg = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
     // eslint-disable-next-line
     // @ts-ignore
-    const { recoverPersonalSignature } = await import('@metamask/eth-sig-util');
-    const recoveredAddr = recoverPersonalSignature({
-        data: msg,
-        signature: hash,
-    });
-    const signatureCorrectForAddress = recoveredAddr.toLowerCase() === foundCredentials.address.toLowerCase();
-    if (!signatureCorrectForAddress) {
+    const { bufferToHex, fromRpcSig, ecrecover, toBuffer, hashPersonalMessage, publicToAddress } = await import('@ethereumjs/util');
+    const message = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
+    const messageHash = hashPersonalMessage(toBuffer(message));
+    const sigParams = fromRpcSig(hash);
+    const publicKey = ecrecover(messageHash, sigParams.v, sigParams.r, sigParams.s);
+    const sender = publicToAddress(publicKey);
+    const recoveredAddr = bufferToHex(sender);
+    const isSignatureCorrectForAddress = recoveredAddr.toLowerCase() === foundCredentials.address.toLowerCase();
+    if (!isSignatureCorrectForAddress) {
         throw new UserWeb3AddressSignatureError({ userId, address: foundCredentials.address });
     }
     const web3Services = user.services.web3.map((service) => {

package/lib/resolvers/mutations/accounts/verifyWeb3Address.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyWeb3Address.js","sourceRoot":"","sources":["../../../../src/resolvers/mutations/accounts/verifyWeb3Address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAGjG,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,iBAAiB,CAC7C,IAAW,EACX,EAAE,OAAO,EAAE,IAAI,EAAqC,EACpD,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAW;IAElC,GAAG,CAAC,8BAA8B,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE;QAC5D,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAChD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CACrE,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAE/E,2BAA2B;IAC3B,aAAa;IACb,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAE5E,MAAM,aAAa,GAAG,wBAAwB,CAAC;QAC7C,IAAI,EAAE,GAAG;QACT,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAC9B,aAAa,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAEzE,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAChC,MAAM,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,YAAY,GAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7D,IAAI,gBAAgB,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO;gBACL,GAAG,OAAO;gBACV,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAC7B,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;QACE,IAAI,EAAE;YACJ,2BAA2B;YAC3B,aAAa;YACb,eAAe,EAAE,YAAY;SAC9B;KACF,EACD,EAAE,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verifyWeb3Address.js","sourceRoot":"","sources":["../../../../src/resolvers/mutations/accounts/verifyWeb3Address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAGjG,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,iBAAiB,CAC7C,IAAW,EACX,EAAE,OAAO,EAAE,IAAI,EAA4C,EAC3D,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAW;IAElC,GAAG,CAAC,8BAA8B,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE;QAC5D,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAChD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CACrE,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,2BAA2B;IAC3B,aAAa;IACb,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,GAC1F,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnF,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAE1C,MAAM,4BAA4B,GAChC,aAAa,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAEzE,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,MAAM,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,YAAY,GAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7D,IAAI,gBAAgB,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO;gBACL,GAAG,OAAO;gBACV,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAC7B,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;QACE,IAAI,EAAE;YACJ,2BAA2B;YAC3B,aAAa;YACb,eAAe,EAAE,YAAY;SAC9B;KACF,EACD,EAAE,CACH,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unchainedshop/api",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",
@@ -31,9 +31,9 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "peerDependencies": {
+    "@ethereumjs/util": ">= 8 < 10",
     "@fastify/cookie": ">= 11.0 < 12",
     "@fastify/session": ">= 11.0 < 12",
-    "@metamask/eth-sig-util": ">= 8.1 < 9",
     "connect-mongo": ">= 5.1.0 < 6",
     "express": ">= 5.0 < 6",
     "express-session": ">= 1.18 < 2",
@@ -48,7 +48,7 @@
     "connect-mongo": {
       "optional": false
     },
-    "@metamask/eth-sig-util": {
+    "@ethereumjs/util": {
       "optional": true
     },
     "@fastify/cookie": {
@@ -84,11 +84,11 @@
     "p-memoize": "^7.1.1"
   },
   "devDependencies": {
+    "@ethereumjs/util": "^9.1.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/session": "^11.1.0",
-    "@metamask/eth-sig-util": "^8.2.0",
     "@types/express": "^5.0.0",
-    "@types/node": "^22.13.1",
+    "@types/node": "^22.13.4",
     "express": "^5.0.1",
     "express-session": "^1.18.1",
     "fastify": "^5.2.1",

package/src/resolvers/mutations/accounts/verifyWeb3Address.ts

@@ -4,7 +4,7 @@ import { Context } from '../../../context.js';
 
 export default async function verifyWeb3Address(
   root: never,
-  { address, hash }: { address: string; hash: string },
+  { address, hash }: { address: string; hash: `0x${string}` },
   { modules, userId, user }: Context,
 ) {
   log(`mutation verifyWeb3Address ${address} ${user.username}`, {
@@ -18,21 +18,24 @@ export default async function verifyWeb3Address(
     throw new UserWeb3AddressNotFoundError({ userId, address });
   }
 
-  const msg = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
-
   // eslint-disable-next-line
   // @ts-ignore
-  const { recoverPersonalSignature } = await import('@metamask/eth-sig-util');
+  const { bufferToHex, fromRpcSig, ecrecover, toBuffer, hashPersonalMessage, publicToAddress } =
+    await import('@ethereumjs/util');
 
-  const recoveredAddr = recoverPersonalSignature({
-    data: msg,
-    signature: hash,
-  });
+  const message = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
+  const messageHash = hashPersonalMessage(toBuffer(message));
+
+  const sigParams = fromRpcSig(hash);
+  const publicKey = ecrecover(messageHash, sigParams.v, sigParams.r, sigParams.s);
+
+  const sender = publicToAddress(publicKey);
+  const recoveredAddr = bufferToHex(sender);
 
-  const signatureCorrectForAddress =
+  const isSignatureCorrectForAddress =
     recoveredAddr.toLowerCase() === foundCredentials.address.toLowerCase();
 
-  if (!signatureCorrectForAddress) {
+  if (!isSignatureCorrectForAddress) {
     throw new UserWeb3AddressSignatureError({ userId, address: foundCredentials.address });
   }