@virtonetwork/authenticators-substrate 1.0.0

package/README.md

@@ -0,0 +1,9 @@
+# Substrate Authentication for Virto Signer
+
+A TypeScript helper that wires **substrate**-style signatures to the [@virtonetwork/signer](https://github.com/virto-network/papi-signers) stack. It exposes a single class, `Substrate`, that fulfils the `Authenticator<number>` interface used by `PassSigner`.
+
+## ✨ Features
+
+* **One‑line setup** → `await new Substrate(user, { sign }).setup()`
+* Deterministic `deviceId = Blake2‑256(credentialId)`
+* Produces SCALE‑encoded `PassAuthenticate` objects

package/dist/cjs/index.js

@@ -0,0 +1,163 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubstrateKey = exports.KREIVO_AUTHORITY_ID = void 0;
+var signer_1 = require("@virtonetwork/signer");
+var types_ts_1 = require("./types.js");
+var polkadot_api_1 = require("polkadot-api");
+exports.KREIVO_AUTHORITY_ID = polkadot_api_1.Binary.fromText("kreivo_p".padEnd(32, "\0"));
+var SubstrateKey = /** @class */ (function () {
+    function SubstrateKey(userId, signer, getChallenge, addressGenerator) {
+        if (addressGenerator === void 0) { addressGenerator = signer_1.kreivoPassDefaultAddressGenerator; }
+        this.userId = userId;
+        this.signer = signer;
+        this.getChallenge = getChallenge;
+        this.addressGenerator = addressGenerator;
+        /**
+         * SHA‑256 hash of {@link userId}. Filled once by {@link setup} and reused
+         * for all WebAuthn operations.
+         */
+        this.hashedUserId = new Uint8Array(32);
+    }
+    /**
+     * Pre‑computes {@link hashedUserId}.
+     *
+     * Must be awaited **once** before any other interaction.
+     * Returns `this` for fluent chaining.
+     */
+    SubstrateKey.prototype.setup = function () {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _a = this;
+                        return [4 /*yield*/, SubstrateKey.getHashedUserId(this.userId)];
+                    case 1:
+                        _a.hashedUserId = _b.sent();
+                        return [2 /*return*/, this];
+                }
+            });
+        });
+    };
+    SubstrateKey.getHashedUserId = function (userId) {
+        return __awaiter(this, void 0, void 0, function () {
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        _a = Uint8Array.bind;
+                        return [4 /*yield*/, crypto.subtle.digest("SHA-256", new TextEncoder().encode(userId))];
+                    case 1: return [2 /*return*/, new (_a.apply(Uint8Array, [void 0, _b.sent()]))()];
+                }
+            });
+        });
+    };
+    SubstrateKey.prototype.register = function (context) {
+        return __awaiter(this, void 0, void 0, function () {
+            var challenge, message, _a, _b;
+            var _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0: return [4 /*yield*/, this.getChallenge(context, this.addressGenerator(this.hashedUserId))];
+                    case 1:
+                        challenge = _d.sent();
+                        message = types_ts_1.SignedMessage.enc({
+                            context: context,
+                            authority_id: exports.KREIVO_AUTHORITY_ID,
+                            challenge: polkadot_api_1.Binary.fromBytes(challenge),
+                        });
+                        _c = {
+                            message: types_ts_1.SignedMessage.dec(message),
+                            public: polkadot_api_1.Binary.fromBytes(this.signer.publicKey)
+                        };
+                        _b = (_a = polkadot_api_1.Binary).fromBytes;
+                        return [4 /*yield*/, this.signer.sign(message)];
+                    case 2: return [2 /*return*/, (_c.signature = _b.apply(_a, [_d.sent()]),
+                            _c)];
+                }
+            });
+        });
+    };
+    /**
+     * Signs an arbitrary challenge with the substrate key and produces a
+     * {@link TPassAuthenticate} payload understood by `PassSigner`.
+     *
+     * @param challenge - 32‑byte buffer supplied by the runtime.
+     * @param context   - Block number (or any numeric context expected by the pallet).
+     *
+     * @returns SCALE‑encoded authentication payload.
+     * @throws Error If no credential id is available.
+     */
+    SubstrateKey.prototype.authenticate = function (context, xtc) {
+        return __awaiter(this, void 0, void 0, function () {
+            var challenge, message, _a, _b, _c, _d;
+            var _e, _f, _g;
+            return __generator(this, function (_h) {
+                switch (_h.label) {
+                    case 0: return [4 /*yield*/, this.getChallenge(context, xtc)];
+                    case 1:
+                        challenge = _h.sent();
+                        message = {
+                            context: context,
+                            authority_id: exports.KREIVO_AUTHORITY_ID,
+                            challenge: polkadot_api_1.Binary.fromBytes(challenge),
+                        };
+                        _e = {
+                            deviceId: polkadot_api_1.Binary.fromBytes(this.signer.publicKey)
+                        };
+                        _f = {
+                            tag: "SubstrateKey"
+                        };
+                        _b = (_a = types_ts_1.KeySignature).enc;
+                        _g = {
+                            message: message
+                        };
+                        _d = (_c = polkadot_api_1.Binary).fromBytes;
+                        return [4 /*yield*/, this.signer.sign(types_ts_1.SignedMessage.enc(message))];
+                    case 2: return [2 /*return*/, (_e.credentials = (_f.value = _b.apply(_a, [(_g.signature = _d.apply(_c, [_h.sent()]),
+                                _g)]),
+                            _f),
+                            _e)];
+                }
+            });
+        });
+    };
+    return SubstrateKey;
+}());
+exports.SubstrateKey = SubstrateKey;

package/dist/cjs/types.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeySignature = exports.SignedMessage = void 0;
+var substrate_bindings_1 = require("@polkadot-api/substrate-bindings");
+var scale_ts_1 = require("scale-ts");
+exports.SignedMessage = (0, scale_ts_1.Struct)({
+    context: scale_ts_1.u32,
+    challenge: (0, substrate_bindings_1.Bin)(),
+    authority_id: (0, substrate_bindings_1.Bin)(32),
+});
+exports.KeySignature = (0, scale_ts_1.Struct)({
+    message: exports.SignedMessage,
+    signature: (0, substrate_bindings_1.Bin)(),
+});

package/dist/esm/index.d.ts

@@ -0,0 +1,36 @@
+import { AddressGenerator, Authenticator, Challenger, TPassAuthenticate } from "@virtonetwork/signer";
+import { SubstrateSigner, TKeyRegistration } from "./types.ts";
+import { Binary } from "polkadot-api";
+export declare const KREIVO_AUTHORITY_ID: Binary;
+export declare class SubstrateKey implements Authenticator<number> {
+    readonly userId: string;
+    private signer;
+    readonly getChallenge: Challenger<number>;
+    readonly addressGenerator: AddressGenerator;
+    /**
+     * SHA‑256 hash of {@link userId}. Filled once by {@link setup} and reused
+     * for all WebAuthn operations.
+     */
+    hashedUserId: Uint8Array;
+    constructor(userId: string, signer: SubstrateSigner, getChallenge: Challenger<number>, addressGenerator?: AddressGenerator);
+    /**
+     * Pre‑computes {@link hashedUserId}.
+     *
+     * Must be awaited **once** before any other interaction.
+     * Returns `this` for fluent chaining.
+     */
+    setup(): Promise<this>;
+    private static getHashedUserId;
+    register(context: number): Promise<TKeyRegistration<number>>;
+    /**
+     * Signs an arbitrary challenge with the substrate key and produces a
+     * {@link TPassAuthenticate} payload understood by `PassSigner`.
+     *
+     * @param challenge - 32‑byte buffer supplied by the runtime.
+     * @param context   - Block number (or any numeric context expected by the pallet).
+     *
+     * @returns SCALE‑encoded authentication payload.
+     * @throws Error If no credential id is available.
+     */
+    authenticate(context: number, xtc: Uint8Array): Promise<TPassAuthenticate>;
+}

package/dist/esm/index.js

@@ -0,0 +1,75 @@
+import { kreivoPassDefaultAddressGenerator, } from "@virtonetwork/signer";
+import { KeySignature, SignedMessage, } from "./types.js";
+import { Binary } from "polkadot-api";
+export const KREIVO_AUTHORITY_ID = Binary.fromText("kreivo_p".padEnd(32, "\0"));
+export class SubstrateKey {
+    userId;
+    signer;
+    getChallenge;
+    addressGenerator;
+    /**
+     * SHA‑256 hash of {@link userId}. Filled once by {@link setup} and reused
+     * for all WebAuthn operations.
+     */
+    hashedUserId = new Uint8Array(32);
+    constructor(userId, signer, getChallenge, addressGenerator = kreivoPassDefaultAddressGenerator) {
+        this.userId = userId;
+        this.signer = signer;
+        this.getChallenge = getChallenge;
+        this.addressGenerator = addressGenerator;
+    }
+    /**
+     * Pre‑computes {@link hashedUserId}.
+     *
+     * Must be awaited **once** before any other interaction.
+     * Returns `this` for fluent chaining.
+     */
+    async setup() {
+        this.hashedUserId = await SubstrateKey.getHashedUserId(this.userId);
+        return this;
+    }
+    static async getHashedUserId(userId) {
+        return new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(userId)));
+    }
+    async register(context) {
+        const challenge = await this.getChallenge(context, this.addressGenerator(this.hashedUserId));
+        const message = SignedMessage.enc({
+            context,
+            authority_id: KREIVO_AUTHORITY_ID,
+            challenge: Binary.fromBytes(challenge),
+        });
+        return {
+            message: SignedMessage.dec(message),
+            public: Binary.fromBytes(this.signer.publicKey),
+            signature: Binary.fromBytes(await this.signer.sign(message)),
+        };
+    }
+    /**
+     * Signs an arbitrary challenge with the substrate key and produces a
+     * {@link TPassAuthenticate} payload understood by `PassSigner`.
+     *
+     * @param challenge - 32‑byte buffer supplied by the runtime.
+     * @param context   - Block number (or any numeric context expected by the pallet).
+     *
+     * @returns SCALE‑encoded authentication payload.
+     * @throws Error If no credential id is available.
+     */
+    async authenticate(context, xtc) {
+        const challenge = await this.getChallenge(context, xtc);
+        const message = {
+            context,
+            authority_id: KREIVO_AUTHORITY_ID,
+            challenge: Binary.fromBytes(challenge),
+        };
+        return {
+            deviceId: Binary.fromBytes(this.signer.publicKey),
+            credentials: {
+                tag: "SubstrateKey",
+                value: KeySignature.enc({
+                    message: message,
+                    signature: Binary.fromBytes(await this.signer.sign(SignedMessage.enc(message))),
+                }),
+            },
+        };
+    }
+}

package/dist/esm/types.d.ts

@@ -0,0 +1,23 @@
+import { Binary, FixedSizeBinary } from "@polkadot-api/substrate-bindings";
+import { Codec } from "scale-ts";
+import { AuthorityId } from "@virtonetwork/signer";
+export type SubstrateSigner = {
+    publicKey: Uint8Array;
+    sign: (bytes: Uint8Array) => Promise<Uint8Array> | Uint8Array;
+};
+export type TSignedMessage<Cx> = {
+    context: Cx;
+    challenge: Binary;
+    authority_id: AuthorityId;
+};
+export declare const SignedMessage: Codec<TSignedMessage<number>>;
+export type TKeyRegistration<Cx> = {
+    message: TSignedMessage<Cx>;
+    public: FixedSizeBinary<32>;
+    signature: AuthorityId;
+};
+export type TKeySignature<Cx> = {
+    message: TSignedMessage<Cx>;
+    signature: Binary;
+};
+export declare const KeySignature: Codec<TKeySignature<number>>;

package/dist/esm/types.js

@@ -0,0 +1,11 @@
+import { Bin } from "@polkadot-api/substrate-bindings";
+import { Struct, u32 } from "scale-ts";
+export const SignedMessage = Struct({
+    context: u32,
+    challenge: Bin(),
+    authority_id: Bin(32),
+});
+export const KeySignature = Struct({
+    message: SignedMessage,
+    signature: Bin(),
+});

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@virtonetwork/authenticators-substrate",
+  "description": "An Authenticator compatible with KreivoPassSigner that uses substrate-style signatures",
+  "version": "1.0.0",
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/esm/index.d.ts",
+      "module": "./dist/esm/index.js",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "browser": "./dist/esm/index.js",
+  "types": "./dist/esm/index.d.ts",
+  "scripts": {
+    "test": "node --loader ts-node/esm test/test.ts",
+    "build": "tsc && tsc -p tsconfig.cjs.json",
+    "prepack": "npm run build"
+  },
+  "author": "Virto Network <contact@virto.networks>",
+  "license": "MIT",
+  "keywords": [
+    "virto-sdk",
+    "signer",
+    "papi",
+    "scale",
+    "polkadot.js",
+    "polkadot"
+  ],
+  "dependencies": {
+    "@polkadot-labs/hdkd": "0.0.26",
+    "@virtonetwork/signer": "^1.2.0"
+  },
+  "devDependencies": {
+    "ts-node": "^10.9.2"
+  },
+  "repository": {
+    "url": "https://github.com/virto-network/papi-signers",
+    "directory": "authenticators/substrate"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}