@unchainedshop/api 3.1.0 → 3.1.2

package/lib/resolvers/mutations/accounts/verifyWeb3Address.d.ts

@@ -1,6 +1,6 @@
 import { Context } from '../../../context.js';
 export default function verifyWeb3Address(root: never, { address, hash }: {
     address: string;
-    hash: string;
+    hash: `0x${string}`;
 }, { modules, userId, user }: Context): Promise<import("@unchainedshop/core-users").User>;
 //# sourceMappingURL=verifyWeb3Address.d.ts.map

package/lib/resolvers/mutations/accounts/verifyWeb3Address.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyWeb3Address.d.ts","sourceRoot":"","sources":["../../../../src/resolvers/mutations/accounts/verifyWeb3Address.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,wBAA8B,iBAAiB,CAC7C,IAAI,EAAE,KAAK,EACX,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACpD,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,qDAqDnC"}
+{"version":3,"file":"verifyWeb3Address.d.ts","sourceRoot":"","sources":["../../../../src/resolvers/mutations/accounts/verifyWeb3Address.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,wBAA8B,iBAAiB,CAC7C,IAAI,EAAE,KAAK,EACX,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,EAC3D,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,qDAwDnC"}

package/lib/resolvers/mutations/accounts/verifyWeb3Address.js

@@ -8,16 +8,17 @@ export default async function verifyWeb3Address(root, { address, hash }, { modul
     if (!foundCredentials) {
         throw new UserWeb3AddressNotFoundError({ userId, address });
     }
-    const msg = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
     // eslint-disable-next-line
     // @ts-ignore
-    const { recoverPersonalSignature } = await import('@metamask/eth-sig-util');
-    const recoveredAddr = recoverPersonalSignature({
-        data: msg,
-        signature: hash,
-    });
-    const signatureCorrectForAddress = recoveredAddr.toLowerCase() === foundCredentials.address.toLowerCase();
-    if (!signatureCorrectForAddress) {
+    const { bufferToHex, fromRpcSig, ecrecover, toBuffer, hashPersonalMessage, publicToAddress } = await import('@ethereumjs/util');
+    const message = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
+    const messageHash = hashPersonalMessage(toBuffer(message));
+    const sigParams = fromRpcSig(hash);
+    const publicKey = ecrecover(messageHash, sigParams.v, sigParams.r, sigParams.s);
+    const sender = publicToAddress(publicKey);
+    const recoveredAddr = bufferToHex(sender);
+    const isSignatureCorrectForAddress = recoveredAddr.toLowerCase() === foundCredentials.address.toLowerCase();
+    if (!isSignatureCorrectForAddress) {
         throw new UserWeb3AddressSignatureError({ userId, address: foundCredentials.address });
     }
     const web3Services = user.services.web3.map((service) => {

package/lib/resolvers/mutations/accounts/verifyWeb3Address.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyWeb3Address.js","sourceRoot":"","sources":["../../../../src/resolvers/mutations/accounts/verifyWeb3Address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAGjG,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,iBAAiB,CAC7C,IAAW,EACX,EAAE,OAAO,EAAE,IAAI,EAAqC,EACpD,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAW;IAElC,GAAG,CAAC,8BAA8B,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE;QAC5D,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAChD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CACrE,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAE/E,2BAA2B;IAC3B,aAAa;IACb,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAE5E,MAAM,aAAa,GAAG,wBAAwB,CAAC;QAC7C,IAAI,EAAE,GAAG;QACT,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,MAAM,0BAA0B,GAC9B,aAAa,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAEzE,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAChC,MAAM,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,YAAY,GAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7D,IAAI,gBAAgB,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO;gBACL,GAAG,OAAO;gBACV,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAC7B,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;QACE,IAAI,EAAE;YACJ,2BAA2B;YAC3B,aAAa;YACb,eAAe,EAAE,YAAY;SAC9B;KACF,EACD,EAAE,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verifyWeb3Address.js","sourceRoot":"","sources":["../../../../src/resolvers/mutations/accounts/verifyWeb3Address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAGjG,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,iBAAiB,CAC7C,IAAW,EACX,EAAE,OAAO,EAAE,IAAI,EAA4C,EAC3D,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAW;IAElC,GAAG,CAAC,8BAA8B,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE;QAC5D,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAChD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CACrE,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,2BAA2B;IAC3B,aAAa;IACb,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,GAC1F,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnF,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAEhF,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAE1C,MAAM,4BAA4B,GAChC,aAAa,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAEzE,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,MAAM,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,YAAY,GAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7D,IAAI,gBAAgB,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO;gBACL,GAAG,OAAO;gBACV,KAAK,EAAE,SAAS;gBAChB,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAC7B,EAAE,GAAG,EAAE,MAAM,EAAE,EACf;QACE,IAAI,EAAE;YACJ,2BAA2B;YAC3B,aAAa;YACb,eAAe,EAAE,YAAY;SAC9B;KACF,EACD,EAAE,CACH,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unchainedshop/api",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",
@@ -9,8 +9,8 @@
     "build": "tsc -b",
     "prepublishOnly": "npm run clean && npm run build",
     "watch": "tsc -w",
-    "test": "NODE_OPTIONS=--experimental-vm-modules jest --detectOpenHandles --forceExit",
-    "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch --detectOpenHandles --forceExit"
+    "test": "tsx --test",
+    "test:watch": "tsx --test --watch"
   },
   "repository": {
     "type": "git",
@@ -31,14 +31,14 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "peerDependencies": {
+    "@ethereumjs/util": ">= 8 < 10",
     "@fastify/cookie": ">= 11.0 < 12",
     "@fastify/session": ">= 11.0 < 12",
-    "@metamask/eth-sig-util": ">= 8.1 < 9",
     "connect-mongo": ">= 5.1.0 < 6",
     "express": ">= 5.0 < 6",
     "express-session": ">= 1.18 < 2",
-    "graphql-yoga": ">= 5.9 < 6.0",
     "fastify": ">= 5.2 < 6",
+    "graphql-yoga": ">= 5.9 < 6.0",
     "passport": ">= 0.7 < 1"
   },
   "peerDependenciesMeta": {
@@ -48,7 +48,7 @@
     "connect-mongo": {
       "optional": false
     },
-    "@metamask/eth-sig-util": {
+    "@ethereumjs/util": {
       "optional": true
     },
     "@fastify/cookie": {
@@ -84,17 +84,16 @@
     "p-memoize": "^7.1.1"
   },
   "devDependencies": {
+    "@ethereumjs/util": "^9.1.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/session": "^11.1.0",
-    "@metamask/eth-sig-util": "^8.2.0",
     "@types/express": "^5.0.0",
-    "@types/node": "^22.13.1",
+    "@types/node": "^22.13.4",
     "express": "^5.0.1",
     "express-session": "^1.18.1",
     "fastify": "^5.2.1",
-    "jest": "^29.7.0",
     "passport": "^0.7.0",
-    "ts-jest": "^29.2.5",
+    "tsx": "^4.19.2",
     "typescript": "^5.7.3"
   }
 }

package/src/resolvers/mutations/accounts/verifyWeb3Address.ts

@@ -4,7 +4,7 @@ import { Context } from '../../../context.js';
 
 export default async function verifyWeb3Address(
   root: never,
-  { address, hash }: { address: string; hash: string },
+  { address, hash }: { address: string; hash: `0x${string}` },
   { modules, userId, user }: Context,
 ) {
   log(`mutation verifyWeb3Address ${address} ${user.username}`, {
@@ -18,21 +18,24 @@ export default async function verifyWeb3Address(
     throw new UserWeb3AddressNotFoundError({ userId, address });
   }
 
-  const msg = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
-
   // eslint-disable-next-line
   // @ts-ignore
-  const { recoverPersonalSignature } = await import('@metamask/eth-sig-util');
+  const { bufferToHex, fromRpcSig, ecrecover, toBuffer, hashPersonalMessage, publicToAddress } =
+    await import('@ethereumjs/util');
 
-  const recoveredAddr = recoverPersonalSignature({
-    data: msg,
-    signature: hash,
-  });
+  const message = `0x${Buffer.from(foundCredentials.nonce, 'utf8').toString('hex')}`;
+  const messageHash = hashPersonalMessage(toBuffer(message));
+
+  const sigParams = fromRpcSig(hash);
+  const publicKey = ecrecover(messageHash, sigParams.v, sigParams.r, sigParams.s);
+
+  const sender = publicToAddress(publicKey);
+  const recoveredAddr = bufferToHex(sender);
 
-  const signatureCorrectForAddress =
+  const isSignatureCorrectForAddress =
     recoveredAddr.toLowerCase() === foundCredentials.address.toLowerCase();
 
-  if (!signatureCorrectForAddress) {
+  if (!isSignatureCorrectForAddress) {
     throw new UserWeb3AddressSignatureError({ userId, address: foundCredentials.address });
   }
 

package/tests/api-index.test.ts

@@ -1,4 +1,6 @@
 // Import the function to be tested.
+import { describe, it, mock } from 'node:test';
+import assert from 'node:assert';
 import { admin } from '../src/roles/admin.js';
 import { actions } from '../src/roles/index.js';
 import { checkAction, ensureActionExists, ensureIsFunction } from '../src/acl.js';
@@ -8,24 +10,28 @@ import { Roles } from '@unchainedshop/roles';
 describe('API', () => {
   describe('roles', () => {
     const role = {
-      allow: import.meta.jest.fn(),
+      allow: mock.fn(),
     };
 
     it('creates the admin role and grants permissions to all actions', () => {
       admin(role, actions);
       for (const actionName of Object.keys(actions)) {
-        expect(role.allow).toHaveBeenCalledWith(actions[actionName], expect.any(Function));
+        assert.equal(
+          role.allow.mock.calls.some((call) => call.arguments[0] === actions[actionName]),
+          true,
+          "action wasn't granted",
+        );
       }
     });
   });
 
   describe('ensureActionExists', () => {
     it('should throw a PermissionSystemError if the action is undefined', () => {
-      expect(() => ensureActionExists(undefined, {})).toThrow(PermissionSystemError);
+      assert.throws(() => ensureActionExists(undefined, {}), PermissionSystemError);
     });
 
     it('should not throw an error if the action is defined', () => {
-      expect(() => ensureActionExists('some action', {})).not.toThrow();
+      assert.doesNotThrow(() => ensureActionExists('some action', {}));
     });
   });
 
@@ -34,14 +40,14 @@ describe('API', () => {
       const action = 'some action';
       const options = { showKey: true };
       const key = 'some key';
-      expect(() => ensureIsFunction(null, action, options, key)).toThrow(PermissionSystemError);
+      assert.throws(() => ensureIsFunction(null, action, options, key), PermissionSystemError);
     });
 
     it('should not throw an error if the provided value is a function', () => {
       const action = 'some action';
       const options = { showKey: true };
       const key = 'some key';
-      expect(() =>
+      assert.doesNotThrow(() =>
         ensureIsFunction(
           () => {
             /**/
@@ -50,30 +56,31 @@ describe('API', () => {
           options,
           key,
         ),
-      ).not.toThrow();
+      );
     });
   });
 
   describe('checkAction', () => {
     it('should throw a NoPermissionError if the user does not have permission to perform the action', async () => {
-      Roles.userHasPermission = import.meta.jest.fn(async () => false);
+      Roles.userHasPermission = mock.fn(async () => false);
 
       const context = { userId: '123' };
       const action = 'some action';
       const args: any = [];
       const options = { key: 'some key' };
 
-      return expect(checkAction(context, action, args, options)).rejects.toThrow(NoPermissionError);
+      return assert.rejects(checkAction(context, action, args, options), NoPermissionError);
     });
 
     it('should not throw an error if the user has permission to perform the action', async () => {
-      Roles.userHasPermission = import.meta.jest.fn(async () => true);
+      Roles.userHasPermission = mock.fn(async () => true);
+
       const context = { userId: '123' };
       const action = 'some action';
       const args: any = {};
       const options = { key: 'some key' };
 
-      return expect(checkAction(context, action, args, options)).resolves.not.toThrow();
+      return assert.doesNotReject(checkAction(context, action, args, options));
     });
   });
 });

package/jest.config.js

@@ -1,17 +0,0 @@
-/** @type {import('ts-jest/dist/types').InitialOptionsTsJest} */
-export default {
-  preset: 'ts-jest/presets/default-esm', // or other ESM presets
-  testEnvironment: 'node',
-  extensionsToTreatAsEsm: ['.ts'],
-  transform: {
-    '^.+\\.tsx?$': [
-      'ts-jest',
-      {
-        useESM: true,
-      },
-    ],
-  },
-  moduleNameMapper: {
-    '^(\\.{1,2}/.*)\\.js$': '$1',
-  },
-};