@zkpassport/sdk 0.3.0 → 0.3.2

package/src/index.ts

@@ -53,6 +53,10 @@ import {
   getCommittedInputCount,
   ProofMode,
   ProofType,
+  getScopeHash,
+  ProofData,
+  getScopeFromOuterProof,
+  getSubscopeFromOuterProof,
 } from "@zkpassport/utils"
 import { bytesToHex } from "@noble/ciphers/utils"
 import { getWebSocketClient, WebSocketClient } from "./websocket"
@@ -62,9 +66,10 @@ import { noLogger as logger } from "./logger"
 import { inflate } from "pako"
 import i18en from "i18n-iso-countries/langs/en.json"
 import { Buffer } from "buffer/"
-import { sha256 } from "@noble/hashes/sha256"
+import { sha256 } from "@noble/hashes/sha2"
 import { hexToBytes } from "@noble/hashes/utils"
 import ZKPassportVerifierAbi from "./assets/abi/ZKPassportVerifier.json"
+import { RegistryClient } from "@zkpassport/registry"
 
 const DEFAULT_DATE_VALUE = new Date(1111, 10, 11)
 
@@ -101,6 +106,7 @@ export type QueryResultErrors = {
     commitment?: QueryResultError<string>
     date?: QueryResultError<string>
     certificate?: QueryResultError<string>
+    scope?: QueryResultError<string>
   }
 }
 
@@ -111,6 +117,9 @@ export type SolidityVerifierParameters = {
   committedInputs: string
   committedInputCounts: number[]
   validityPeriodInDays: number
+  scope: string
+  subscope: string
+  devMode: boolean
 }
 
 export type EVMChain = "ethereum_sepolia" | "local_anvil"
@@ -135,9 +144,12 @@ function hasRequestedAccessToField(credentialsRequest: Query, field: IDCredentia
 }
 
 function normalizeCountry(country: CountryName | Alpha3Code) {
-  let normalizedCountry: Alpha3Code | undefined
-  const alpha3 = getAlpha3Code(country, "en") as Alpha3Code | undefined
-  normalizedCountry = alpha3 || (country as Alpha3Code)
+  if (country === "Zero Knowledge Republic") {
+    return "ZKR"
+  }
+  let normalizedCountry: Alpha3Code | "ZKR" | undefined
+  const alpha3 = getAlpha3Code(country as CountryName, "en") as Alpha3Code | "ZKR" | undefined
+  normalizedCountry = alpha3 || (country as Alpha3Code) || "ZKR"
   return normalizedCountry
 }
 
@@ -336,6 +348,7 @@ export class ZKPassport {
     {
       validity: number
       mode: ProofMode
+      devMode: boolean
     }
   > = {}
   private topicToKeyPair: Record<string, { privateKey: Uint8Array; publicKey: Uint8Array }> = {}
@@ -386,6 +399,8 @@ export class ZKPassport {
       proofs: this.topicToProofs[topic],
       queryResult: result,
       validity: this.topicToLocalConfig[topic]?.validity,
+      scope: this.topicToService[topic]?.scope,
+      devMode: this.topicToLocalConfig[topic]?.devMode,
     })
     delete this.topicToProofs[topic]
     const hasFailedProofs = this.topicToFailedProofCount[topic] > 0
@@ -674,6 +689,7 @@ export class ZKPassport {
    * @param purpose To explain what you want to do with the user's data
    * @param scope Scope this request to a specific use case
    * @param validity How many days ago should have the ID been last scanned by the user?
+   * @param devMode Whether to enable dev mode. This will allow you to verify mock proofs (i.e. from ZKR)
    * @returns The query builder object.
    */
   public async request({
@@ -683,6 +699,7 @@ export class ZKPassport {
     scope,
     mode,
     validity,
+    devMode,
     topicOverride,
     keyPairOverride,
   }: {
@@ -692,6 +709,7 @@ export class ZKPassport {
     scope?: string
     mode?: ProofMode
     validity?: number
+    devMode?: boolean
     topicOverride?: string
     keyPairOverride?: { privateKey: Uint8Array; publicKey: Uint8Array }
   }): Promise<QueryBuilder> {
@@ -711,6 +729,7 @@ export class ZKPassport {
       // Default to 6 months
       validity: validity || 6 * 30,
       mode: mode || "fast",
+      devMode: devMode || false,
     }
 
     this.onRequestReceivedCallbacks[topic] = []
@@ -1756,20 +1775,76 @@ export class ZKPassport {
     return { isCorrect, queryResultErrors }
   }
 
+  private checkScopeFromDisclosureProof(
+    proofData: ProofData,
+    queryResultErrors: QueryResultErrors,
+    key: string,
+    scope?: string,
+  ) {
+    let isCorrect = true
+    if (this.domain && getScopeHash(this.domain) !== BigInt(proofData.publicInputs[1])) {
+      console.warn("The proof comes from a different domain than the one expected")
+      isCorrect = false
+      queryResultErrors[key as keyof QueryResultErrors].scope = {
+        expected: `Scope: ${getScopeHash(this.domain).toString()}`,
+        received: `Scope: ${BigInt(proofData.publicInputs[1]).toString()}`,
+        message: "The proof comes from a different domain than the one expected",
+      }
+    }
+    if (scope && getScopeHash(scope) !== BigInt(proofData.publicInputs[2])) {
+      console.warn("The proof uses a different scope than the one expected")
+      isCorrect = false
+      queryResultErrors[key as keyof QueryResultErrors].scope = {
+        expected: `Scope: ${getScopeHash(scope).toString()}`,
+        received: `Scope: ${BigInt(proofData.publicInputs[2]).toString()}`,
+        message: "The proof uses a different scope than the one expected",
+      }
+    }
+    return { isCorrect, queryResultErrors }
+  }
+
+  private async checkCertificateRegistryRoot(
+    root: string,
+    queryResultErrors: any,
+    outer?: boolean,
+  ) {
+    let isCorrect = true
+    try {
+      // Maintained certificate registry settled onchain
+      // Here we use Ethereum Sepolia
+      const registryClient = new RegistryClient({ chainId: 11155111 })
+      await registryClient.getCertificates(`0x${root}`)
+    } catch (error) {
+      console.warn(error)
+      // Check the legacy static roots that were used before the registry was deployed onchain
+      const VALID_CERTIFICATE_REGISTRY_ROOT = [
+        BigInt("20192042006788880778219739574377003123593792072535937278552252195461520776494"),
+        BigInt("21301853597069384763054217328384418971999152625381818922211526730996340553696"),
+        BigInt("10839898448097753834842514286432152806152415606387598803678317315409344029817"),
+      ]
+      if (!VALID_CERTIFICATE_REGISTRY_ROOT.includes(BigInt(root))) {
+        console.warn("The ID was signed by an unrecognized root certificate")
+        isCorrect = false
+        queryResultErrors[outer ? "outer" : "sig_check_dsc"].certificate = {
+          expected: `A valid root from ZKPassport Registry`,
+          received: `Got invalid certificate registry root: ${root}`,
+          message: "The ID was signed by an unrecognized root certificate",
+        }
+      }
+    }
+    return { isCorrect, queryResultErrors }
+  }
+
   private async checkPublicInputs(
     proofs: Array<ProofResult>,
     queryResult: QueryResult,
     validity?: number,
+    scope?: string,
   ) {
     let commitmentIn: bigint | undefined
     let commitmentOut: bigint | undefined
     let isCorrect = true
     let uniqueIdentifier: string | undefined
-    const VALID_CERTIFICATE_REGISTRY_ROOT = [
-      BigInt("20192042006788880778219739574377003123593792072535937278552252195461520776494"),
-      BigInt("21301853597069384763054217328384418971999152625381818922211526730996340553696"),
-      BigInt("10839898448097753834842514286432152806152415606387598803678317315409344029817"),
-    ]
     const currentTime = new Date()
     const today = new Date(
       currentTime.getFullYear(),
@@ -1827,14 +1902,18 @@ export class ZKPassport {
       if (proof.name?.startsWith("outer")) {
         const isForEVM = proof.name?.startsWith("outer_evm")
         const certificateRegistryRoot = getCertificateRegistryRootFromOuterProof(proofData)
-        if (!VALID_CERTIFICATE_REGISTRY_ROOT.includes(certificateRegistryRoot)) {
-          console.warn("The ID was signed by an unrecognized root certificate")
-          isCorrect = false
-          queryResultErrors.outer.certificate = {
-            expected: `Certificate registry root: ${VALID_CERTIFICATE_REGISTRY_ROOT.join(", ")}`,
-            received: `Certificate registry root: ${certificateRegistryRoot.toString()}`,
-            message: "The ID was signed by an unrecognized root certificate",
-          }
+        const {
+          isCorrect: isCorrectCertificateRegistryRoot,
+          queryResultErrors: queryResultErrorsCertificateRegistryRoot,
+        } = await this.checkCertificateRegistryRoot(
+          certificateRegistryRoot.toString(16),
+          queryResultErrors,
+          true,
+        )
+        isCorrect = isCorrect && isCorrectCertificateRegistryRoot
+        queryResultErrors = {
+          ...queryResultErrors,
+          ...queryResultErrorsCertificateRegistryRoot,
         }
         const currentDate = getCurrentDateFromOuterProof(proofData)
         const todayToCurrentDate = today.getTime() - currentDate.getTime()
@@ -1866,6 +1945,24 @@ export class ZKPassport {
             message: "The proof does not verify all the requested conditions and information",
           }
         }
+        if (this.domain && getScopeHash(this.domain) !== getScopeFromOuterProof(proofData)) {
+          console.warn("The proof comes from a different domain than the one expected")
+          isCorrect = false
+          queryResultErrors.outer.scope = {
+            expected: `Scope: ${getScopeHash(this.domain).toString()}`,
+            received: `Scope: ${getScopeFromOuterProof(proofData).toString()}`,
+            message: "The proof comes from a different domain than the one expected",
+          }
+        }
+        if (scope && getScopeHash(scope) !== getSubscopeFromOuterProof(proofData)) {
+          console.warn("The proof uses a different scope than the one expected")
+          isCorrect = false
+          queryResultErrors.outer.scope = {
+            expected: `Scope: ${getScopeHash(scope).toString()}`,
+            received: `Scope: ${getSubscopeFromOuterProof(proofData).toString()}`,
+            message: "The proof uses a different scope than the one expected",
+          }
+        }
         if (!!committedInputs?.compare_age) {
           const ageCommittedInputs = committedInputs?.compare_age as AgeCommittedInputs
           const ageParameterCommitment = isForEVM
@@ -2113,14 +2210,18 @@ export class ZKPassport {
       } else if (proof.name?.startsWith("sig_check_dsc")) {
         commitmentOut = getCommitmentFromDSCProof(proofData)
         const merkleRoot = getMerkleRootFromDSCProof(proofData)
-        if (!VALID_CERTIFICATE_REGISTRY_ROOT.includes(merkleRoot)) {
-          console.warn("The ID was signed by an unrecognized root certificate")
-          isCorrect = false
-          queryResultErrors.sig_check_dsc.certificate = {
-            expected: `Certificate registry root: ${VALID_CERTIFICATE_REGISTRY_ROOT.join(", ")}`,
-            received: `Certificate registry root: ${merkleRoot.toString()}`,
-            message: "The ID was signed by an unrecognized root certificate",
-          }
+        const {
+          isCorrect: isCorrectCertificateRegistryRoot,
+          queryResultErrors: queryResultErrorsCertificateRegistryRoot,
+        } = await this.checkCertificateRegistryRoot(
+          merkleRoot.toString(16),
+          queryResultErrors,
+          false,
+        )
+        isCorrect = isCorrect && isCorrectCertificateRegistryRoot
+        queryResultErrors = {
+          ...queryResultErrors,
+          ...queryResultErrorsCertificateRegistryRoot,
         }
       } else if (proof.name?.startsWith("sig_check_id_data")) {
         commitmentIn = getCommitmentInFromIDDataProof(proofData)
@@ -2194,12 +2295,20 @@ export class ZKPassport {
             message: "The disclosed data does not match the data committed by the proof",
           }
         }
+        const { isCorrect: isCorrectScope, queryResultErrors: queryResultErrorsScope } =
+          this.checkScopeFromDisclosureProof(proofData, queryResultErrors, "disclose", scope)
+        isCorrect = isCorrect && isCorrectScope
+        queryResultErrors = {
+          ...queryResultErrors,
+          ...queryResultErrorsScope,
+        }
         const { isCorrect: isCorrectDisclose, queryResultErrors: queryResultErrorsDisclose } =
           this.checkDiscloseBytesPublicInputs(proof, queryResult)
-        isCorrect = isCorrect && isCorrectDisclose
+        isCorrect = isCorrect && isCorrectDisclose && isCorrectScope
         queryResultErrors = {
           ...queryResultErrors,
           ...queryResultErrorsDisclose,
+          ...queryResultErrorsScope,
         }
         uniqueIdentifier = getNullifierFromDisclosureProof(proofData).toString(10)
       } else if (proof.name === "compare_age") {
@@ -2235,12 +2344,15 @@ export class ZKPassport {
               "The conditions for the age check do not match the conditions checked by the proof",
           }
         }
+        const { isCorrect: isCorrectScope, queryResultErrors: queryResultErrorsScope } =
+          this.checkScopeFromDisclosureProof(proofData, queryResultErrors, "age", scope)
         const { isCorrect: isCorrectAge, queryResultErrors: queryResultErrorsAge } =
           this.checkAgePublicInputs(proof, queryResult)
-        isCorrect = isCorrect && isCorrectAge
+        isCorrect = isCorrect && isCorrectAge && isCorrectScope
         queryResultErrors = {
           ...queryResultErrors,
           ...queryResultErrorsAge,
+          ...queryResultErrorsScope,
         }
         uniqueIdentifier = getNullifierFromDisclosureProof(proofData).toString(10)
       } else if (proof.name === "compare_birthdate") {
@@ -2277,12 +2389,15 @@ export class ZKPassport {
               "The conditions for the birthdate check do not match the conditions checked by the proof",
           }
         }
+        const { isCorrect: isCorrectScope, queryResultErrors: queryResultErrorsScope } =
+          this.checkScopeFromDisclosureProof(proofData, queryResultErrors, "birthdate", scope)
         const { isCorrect: isCorrectBirthdate, queryResultErrors: queryResultErrorsBirthdate } =
           this.checkBirthdatePublicInputs(proof, queryResult)
-        isCorrect = isCorrect && isCorrectBirthdate
+        isCorrect = isCorrect && isCorrectBirthdate && isCorrectScope
         queryResultErrors = {
           ...queryResultErrors,
           ...queryResultErrorsBirthdate,
+          ...queryResultErrorsScope,
         }
         uniqueIdentifier = getNullifierFromDisclosureProof(proofData).toString(10)
       } else if (proof.name === "compare_expiry") {
@@ -2318,12 +2433,15 @@ export class ZKPassport {
               "The conditions for the expiry date check do not match the conditions checked by the proof",
           }
         }
+        const { isCorrect: isCorrectScope, queryResultErrors: queryResultErrorsScope } =
+          this.checkScopeFromDisclosureProof(proofData, queryResultErrors, "expiry_date", scope)
         const { isCorrect: isCorrectExpiryDate, queryResultErrors: queryResultErrorsExpiryDate } =
           this.checkExpiryDatePublicInputs(proof, queryResult)
-        isCorrect = isCorrect && isCorrectExpiryDate
+        isCorrect = isCorrect && isCorrectExpiryDate && isCorrectScope
         queryResultErrors = {
           ...queryResultErrors,
           ...queryResultErrorsExpiryDate,
+          ...queryResultErrorsScope,
         }
         uniqueIdentifier = getNullifierFromDisclosureProof(proofData).toString(10)
       } else if (proof.name === "exclusion_check_nationality") {
@@ -2361,15 +2479,17 @@ export class ZKPassport {
               "The committed country list for the exclusion check does not match the one from the proof",
           }
         }
-
+        const { isCorrect: isCorrectScope, queryResultErrors: queryResultErrorsScope } =
+          this.checkScopeFromDisclosureProof(proofData, queryResultErrors, "nationality", scope)
         const {
           isCorrect: isCorrectNationalityExclusion,
           queryResultErrors: queryResultErrorsNationalityExclusion,
         } = this.checkNationalityExclusionPublicInputs(queryResult, countryList)
-        isCorrect = isCorrect && isCorrectNationalityExclusion
+        isCorrect = isCorrect && isCorrectNationalityExclusion && isCorrectScope
         queryResultErrors = {
           ...queryResultErrors,
           ...queryResultErrorsNationalityExclusion,
+          ...queryResultErrorsScope,
         }
         uniqueIdentifier = getNullifierFromDisclosureProof(proofData).toString(10)
       } else if (proof.name === "exclusion_check_issuing_country") {
@@ -2407,14 +2527,17 @@ export class ZKPassport {
               "The committed country list for the issuing country exclusion check does not match the one from the proof",
           }
         }
+        const { isCorrect: isCorrectScope, queryResultErrors: queryResultErrorsScope } =
+          this.checkScopeFromDisclosureProof(proofData, queryResultErrors, "nationality", scope)
         const {
           isCorrect: isCorrectIssuingCountryExclusion,
           queryResultErrors: queryResultErrorsIssuingCountryExclusion,
         } = this.checkIssuingCountryExclusionPublicInputs(queryResult, countryList)
-        isCorrect = isCorrect && isCorrectIssuingCountryExclusion
+        isCorrect = isCorrect && isCorrectIssuingCountryExclusion && isCorrectScope
         queryResultErrors = {
           ...queryResultErrors,
           ...queryResultErrorsIssuingCountryExclusion,
+          ...queryResultErrorsScope,
         }
         uniqueIdentifier = getNullifierFromDisclosureProof(proofData).toString(10)
       } else if (proof.name === "inclusion_check_nationality") {
@@ -2452,14 +2575,17 @@ export class ZKPassport {
               "The committed country list for the nationality inclusion check does not match the one from the proof",
           }
         }
+        const { isCorrect: isCorrectScope, queryResultErrors: queryResultErrorsScope } =
+          this.checkScopeFromDisclosureProof(proofData, queryResultErrors, "nationality", scope)
         const {
           isCorrect: isCorrectNationalityInclusion,
           queryResultErrors: queryResultErrorsNationalityInclusion,
         } = this.checkNationalityInclusionPublicInputs(queryResult, countryList)
-        isCorrect = isCorrect && isCorrectNationalityInclusion
+        isCorrect = isCorrect && isCorrectNationalityInclusion && isCorrectScope
         queryResultErrors = {
           ...queryResultErrors,
           ...queryResultErrorsNationalityInclusion,
+          ...queryResultErrorsScope,
         }
         uniqueIdentifier = getNullifierFromDisclosureProof(proofData).toString(10)
       } else if (proof.name === "inclusion_check_issuing_country") {
@@ -2497,14 +2623,17 @@ export class ZKPassport {
               "The committed country list for the issuing country inclusion check does not match the one from the proof",
           }
         }
+        const { isCorrect: isCorrectScope, queryResultErrors: queryResultErrorsScope } =
+          this.checkScopeFromDisclosureProof(proofData, queryResultErrors, "nationality", scope)
         const {
           isCorrect: isCorrectIssuingCountryInclusion,
           queryResultErrors: queryResultErrorsIssuingCountryInclusion,
         } = this.checkIssuingCountryInclusionPublicInputs(queryResult, countryList)
-        isCorrect = isCorrect && isCorrectIssuingCountryInclusion
+        isCorrect = isCorrect && isCorrectIssuingCountryInclusion && isCorrectScope
         queryResultErrors = {
           ...queryResultErrors,
           ...queryResultErrorsIssuingCountryInclusion,
+          ...queryResultErrorsScope,
         }
         uniqueIdentifier = getNullifierFromDisclosureProof(proofData).toString(10)
       }
@@ -2524,10 +2653,14 @@ export class ZKPassport {
     proofs,
     queryResult,
     validity,
+    scope,
+    devMode = false,
   }: {
     proofs: Array<ProofResult>
     queryResult: QueryResult
     validity?: number
+    scope?: string
+    devMode?: boolean
   }): Promise<{
     uniqueIdentifier: string | undefined
     verified: boolean
@@ -2555,10 +2688,19 @@ export class ZKPassport {
       isCorrect,
       uniqueIdentifier: uniqueIdentifierFromPublicInputs,
       queryResultErrors: queryResultErrorsFromPublicInputs,
-    } = await this.checkPublicInputs(proofs, formattedResult, validity)
+    } = await this.checkPublicInputs(proofs, formattedResult, validity, scope)
     uniqueIdentifier = uniqueIdentifierFromPublicInputs
     verified = isCorrect
     queryResultErrors = isCorrect ? undefined : queryResultErrorsFromPublicInputs
+    if (uniqueIdentifier && BigInt(uniqueIdentifier) === BigInt(0) && !devMode) {
+      // If the unique identifier is 0 and it is not in dev mode,
+      // the proofs are considered invalid as these are mock proofs only meant
+      // for testing purposes
+      verified = false
+      console.warn(
+        "You are trying to verify a mock proof. This is only allowed in dev mode. To enable dev mode, set the `devMode` parameter to `true` in the request function parameters.",
+      )
+    }
     // Only proceed with the proof verification if the public inputs are correct
     if (verified) {
       for (const proof of proofs) {
@@ -2571,24 +2713,24 @@ export class ZKPassport {
           try {
             const { createPublicClient, http } = await import("viem")
             const { sepolia } = await import("viem/chains")
-            const verifierDetails = this.getSolidityVerifierDetails("ethereum_sepolia")
+            const { address, abi, functionName } =
+              this.getSolidityVerifierDetails("ethereum_sepolia")
             const client = createPublicClient({
               chain: sepolia,
               transport: http("https://ethereum-sepolia-rpc.publicnode.com"),
             })
-            const params = this.getSolidityVerifierParameters(proof)
+            const params = this.getSolidityVerifierParameters({
+              proof,
+              validityPeriodInDays: validity,
+              domain: this.domain,
+              scope,
+              devMode,
+            })
             const result = await client.readContract({
-              address: verifierDetails.address as `0x${string}`,
-              abi: verifierDetails.abi,
-              functionName: "verifyProof",
-              args: [
-                params.vkeyHash,
-                params.proof,
-                params.publicInputs,
-                params.committedInputs,
-                params.committedInputCounts,
-                params.validityPeriodInDays,
-              ],
+              address,
+              abi,
+              functionName,
+              args: [params],
             })
             const isVerified = Array.isArray(result) ? Boolean(result[0]) : false
             verified = isVerified
@@ -2624,7 +2766,8 @@ export class ZKPassport {
   }
 
   public getSolidityVerifierDetails(network: EVMChain): {
-    address: string
+    address: `0x${string}`
+    functionName: string
     abi: {
       type: "function" | "event" | "constructor"
       name: string
@@ -2632,21 +2775,37 @@ export class ZKPassport {
       outputs: { name: string; type: string; internalType: string }[]
     }[]
   } {
+    const baseConfig = {
+      functionName: "verifyProof",
+      abi: ZKPassportVerifierAbi.abi as any,
+    }
     if (network === "ethereum_sepolia") {
       return {
-        address: "0xca644D3424c2ee577FaaF2b56C0f9D1937E8e87C",
-        abi: ZKPassportVerifierAbi.abi as any,
+        ...baseConfig,
+        address: "0x8c6982D77f7a8f60aE3133cA9b2FAA6f3e78c394",
       }
     } else if (network === "local_anvil") {
       return {
+        ...baseConfig,
         address: "0x0",
-        abi: ZKPassportVerifierAbi.abi as any,
       }
     }
     throw new Error(`Unsupported network: ${network}`)
   }
 
-  public getSolidityVerifierParameters(proof: ProofResult, validityPeriodInDays: number = 7) {
+  public getSolidityVerifierParameters({
+    proof,
+    validityPeriodInDays = 7,
+    domain,
+    scope,
+    devMode = false,
+  }: {
+    proof: ProofResult
+    validityPeriodInDays?: number
+    domain?: string
+    scope?: string
+    devMode?: boolean
+  }) {
     if (!proof.name?.startsWith("outer_evm")) {
       throw new Error(
         "This proof cannot be verified on an EVM chain. Please make sure to use the `compressed-evm` mode.",
@@ -2779,6 +2938,9 @@ export class ZKPassport {
       committedInputs: `0x${compressedCommittedInputs}`,
       committedInputCounts: committedInputCountsArray,
       validityPeriodInDays,
+      scope: domain ?? this.domain,
+      subscope: scope ?? "",
+      devMode,
     }
     return params
   }