@zkpassport/sdk 0.3.1 → 0.3.3

package/dist/cjs/index.d.ts

@@ -29,6 +29,7 @@ export type SolidityVerifierParameters = {
     validityPeriodInDays: number;
     scope: string;
     subscope: string;
+    devMode: boolean;
 };
 export type EVMChain = "ethereum_sepolia" | "local_anvil";
 export type * from "@zkpassport/utils";
@@ -195,15 +196,17 @@ export declare class ZKPassport {
      * @param purpose To explain what you want to do with the user's data
      * @param scope Scope this request to a specific use case
      * @param validity How many days ago should have the ID been last scanned by the user?
+     * @param devMode Whether to enable dev mode. This will allow you to verify mock proofs (i.e. from ZKR)
      * @returns The query builder object.
      */
-    request({ name, logo, purpose, scope, mode, validity, topicOverride, keyPairOverride, }: {
+    request({ name, logo, purpose, scope, mode, validity, devMode, topicOverride, keyPairOverride, }: {
         name: string;
         logo: string;
         purpose: string;
         scope?: string;
         mode?: ProofMode;
         validity?: number;
+        devMode?: boolean;
         topicOverride?: string;
         keyPairOverride?: {
             privateKey: Uint8Array;
@@ -219,6 +222,7 @@ export declare class ZKPassport {
     private checkNationalityInclusionPublicInputs;
     private checkIssuingCountryInclusionPublicInputs;
     private checkScopeFromDisclosureProof;
+    private checkCertificateRegistryRoot;
     private checkPublicInputs;
     /**
      * @notice Verify the proofs received from the mobile app.
@@ -228,11 +232,12 @@ export declare class ZKPassport {
      * @returns An object containing the unique identifier associated to the user
      * and a boolean indicating whether the proofs were successfully verified.
      */
-    verify({ proofs, queryResult, validity, scope, }: {
+    verify({ proofs, queryResult, validity, scope, devMode, }: {
         proofs: Array<ProofResult>;
         queryResult: QueryResult;
         validity?: number;
         scope?: string;
+        devMode?: boolean;
     }): Promise<{
         uniqueIdentifier: string | undefined;
         verified: boolean;
@@ -256,11 +261,12 @@ export declare class ZKPassport {
             }[];
         }[];
     };
-    getSolidityVerifierParameters({ proof, validityPeriodInDays, domain, scope, }: {
+    getSolidityVerifierParameters({ proof, validityPeriodInDays, domain, scope, devMode, }: {
         proof: ProofResult;
         validityPeriodInDays?: number;
         domain?: string;
         scope?: string;
+        devMode?: boolean;
     }): SolidityVerifierParameters;
     /**
      * @notice Returns the URL of the request.

package/dist/cjs/index.js

@@ -13,9 +13,10 @@ const logger_1 = require("./logger");
 const pako_1 = require("pako");
 const en_json_1 = tslib_1.__importDefault(require("i18n-iso-countries/langs/en.json"));
 const buffer_1 = require("buffer/");
-const sha256_1 = require("@noble/hashes/sha256");
+const sha2_1 = require("@noble/hashes/sha2");
 const utils_3 = require("@noble/hashes/utils");
 const ZKPassportVerifier_json_1 = tslib_1.__importDefault(require("./assets/abi/ZKPassportVerifier.json"));
+const registry_1 = require("@zkpassport/registry");
 const DEFAULT_DATE_VALUE = new Date(1111, 10, 11);
 // If Buffer is not defined, then we use the Buffer from the buffer package
 if (typeof globalThis.Buffer === "undefined") {
@@ -40,9 +41,12 @@ function hasRequestedAccessToField(credentialsRequest, field) {
     return false;
 }
 function normalizeCountry(country) {
+    if (country === "Zero Knowledge Republic") {
+        return "ZKR";
+    }
     let normalizedCountry;
     const alpha3 = (0, i18n_iso_countries_1.getAlpha3Code)(country, "en");
-    normalizedCountry = alpha3 || country;
+    normalizedCountry = alpha3 || country || "ZKR";
     return normalizedCountry;
 }
 function numericalCompare(fnName, key, value, requestId, requestIdToConfig) {
@@ -106,6 +110,7 @@ class ZKPassport {
             queryResult: result,
             validity: this.topicToLocalConfig[topic]?.validity,
             scope: this.topicToService[topic]?.scope,
+            devMode: this.topicToLocalConfig[topic]?.devMode,
         });
         delete this.topicToProofs[topic];
         const hasFailedProofs = this.topicToFailedProofCount[topic] > 0;
@@ -352,9 +357,10 @@ class ZKPassport {
      * @param purpose To explain what you want to do with the user's data
      * @param scope Scope this request to a specific use case
      * @param validity How many days ago should have the ID been last scanned by the user?
+     * @param devMode Whether to enable dev mode. This will allow you to verify mock proofs (i.e. from ZKR)
      * @returns The query builder object.
      */
-    async request({ name, logo, purpose, scope, mode, validity, topicOverride, keyPairOverride, }) {
+    async request({ name, logo, purpose, scope, mode, validity, devMode, topicOverride, keyPairOverride, }) {
         const topic = topicOverride || (0, crypto_1.randomBytes)(16).toString("hex");
         const keyPair = keyPairOverride || (await (0, encryption_1.generateECDHKeyPair)());
         this.topicToKeyPair[topic] = {
@@ -369,6 +375,7 @@ class ZKPassport {
             // Default to 6 months
             validity: validity || 6 * 30,
             mode: mode || "fast",
+            devMode: devMode || false,
         };
         this.onRequestReceivedCallbacks[topic] = [];
         this.onGeneratingProofCallbacks[topic] = [];
@@ -1267,16 +1274,39 @@ class ZKPassport {
         }
         return { isCorrect, queryResultErrors };
     }
+    async checkCertificateRegistryRoot(root, queryResultErrors, outer) {
+        let isCorrect = true;
+        try {
+            // Maintained certificate registry settled onchain
+            // Here we use Ethereum Sepolia
+            const registryClient = new registry_1.RegistryClient({ chainId: 11155111 });
+            await registryClient.getCertificates(`0x${root}`);
+        }
+        catch (error) {
+            console.warn(error);
+            // Check the legacy static roots that were used before the registry was deployed onchain
+            const VALID_CERTIFICATE_REGISTRY_ROOT = [
+                BigInt("20192042006788880778219739574377003123593792072535937278552252195461520776494"),
+                BigInt("21301853597069384763054217328384418971999152625381818922211526730996340553696"),
+                BigInt("10839898448097753834842514286432152806152415606387598803678317315409344029817"),
+            ];
+            if (!VALID_CERTIFICATE_REGISTRY_ROOT.includes(BigInt(root))) {
+                console.warn("The ID was signed by an unrecognized root certificate");
+                isCorrect = false;
+                queryResultErrors[outer ? "outer" : "sig_check_dsc"].certificate = {
+                    expected: `A valid root from ZKPassport Registry`,
+                    received: `Got invalid certificate registry root: ${root}`,
+                    message: "The ID was signed by an unrecognized root certificate",
+                };
+            }
+        }
+        return { isCorrect, queryResultErrors };
+    }
     async checkPublicInputs(proofs, queryResult, validity, scope) {
         let commitmentIn;
         let commitmentOut;
         let isCorrect = true;
         let uniqueIdentifier;
-        const VALID_CERTIFICATE_REGISTRY_ROOT = [
-            BigInt("20192042006788880778219739574377003123593792072535937278552252195461520776494"),
-            BigInt("21301853597069384763054217328384418971999152625381818922211526730996340553696"),
-            BigInt("10839898448097753834842514286432152806152415606387598803678317315409344029817"),
-        ];
         const currentTime = new Date();
         const today = new Date(currentTime.getFullYear(), currentTime.getMonth(), currentTime.getDate(), 0, 0, 0, 0);
         let queryResultErrors = {
@@ -1324,15 +1354,12 @@ class ZKPassport {
             if (proof.name?.startsWith("outer")) {
                 const isForEVM = proof.name?.startsWith("outer_evm");
                 const certificateRegistryRoot = (0, utils_1.getCertificateRegistryRootFromOuterProof)(proofData);
-                if (!VALID_CERTIFICATE_REGISTRY_ROOT.includes(certificateRegistryRoot)) {
-                    console.warn("The ID was signed by an unrecognized root certificate");
-                    isCorrect = false;
-                    queryResultErrors.outer.certificate = {
-                        expected: `Certificate registry root: ${VALID_CERTIFICATE_REGISTRY_ROOT.join(", ")}`,
-                        received: `Certificate registry root: ${certificateRegistryRoot.toString()}`,
-                        message: "The ID was signed by an unrecognized root certificate",
-                    };
-                }
+                const { isCorrect: isCorrectCertificateRegistryRoot, queryResultErrors: queryResultErrorsCertificateRegistryRoot, } = await this.checkCertificateRegistryRoot(certificateRegistryRoot.toString(16), queryResultErrors, true);
+                isCorrect = isCorrect && isCorrectCertificateRegistryRoot;
+                queryResultErrors = {
+                    ...queryResultErrors,
+                    ...queryResultErrorsCertificateRegistryRoot,
+                };
                 const currentDate = (0, utils_1.getCurrentDateFromOuterProof)(proofData);
                 const todayToCurrentDate = today.getTime() - currentDate.getTime();
                 const differenceInDays = validity ?? 180;
@@ -1555,15 +1582,12 @@ class ZKPassport {
             else if (proof.name?.startsWith("sig_check_dsc")) {
                 commitmentOut = (0, utils_1.getCommitmentFromDSCProof)(proofData);
                 const merkleRoot = (0, utils_1.getMerkleRootFromDSCProof)(proofData);
-                if (!VALID_CERTIFICATE_REGISTRY_ROOT.includes(merkleRoot)) {
-                    console.warn("The ID was signed by an unrecognized root certificate");
-                    isCorrect = false;
-                    queryResultErrors.sig_check_dsc.certificate = {
-                        expected: `Certificate registry root: ${VALID_CERTIFICATE_REGISTRY_ROOT.join(", ")}`,
-                        received: `Certificate registry root: ${merkleRoot.toString()}`,
-                        message: "The ID was signed by an unrecognized root certificate",
-                    };
-                }
+                const { isCorrect: isCorrectCertificateRegistryRoot, queryResultErrors: queryResultErrorsCertificateRegistryRoot, } = await this.checkCertificateRegistryRoot(merkleRoot.toString(16), queryResultErrors, false);
+                isCorrect = isCorrect && isCorrectCertificateRegistryRoot;
+                queryResultErrors = {
+                    ...queryResultErrors,
+                    ...queryResultErrorsCertificateRegistryRoot,
+                };
             }
             else if (proof.name?.startsWith("sig_check_id_data")) {
                 commitmentIn = (0, utils_1.getCommitmentInFromIDDataProof)(proofData);
@@ -1885,7 +1909,7 @@ class ZKPassport {
      * @returns An object containing the unique identifier associated to the user
      * and a boolean indicating whether the proofs were successfully verified.
      */
-    async verify({ proofs, queryResult, validity, scope, }) {
+    async verify({ proofs, queryResult, validity, scope, devMode = false, }) {
         const formattedResult = queryResult;
         // Make sure to reconvert the dates to Date objects
         if (formattedResult.birthdate && formattedResult.birthdate.disclose) {
@@ -1903,6 +1927,13 @@ class ZKPassport {
         uniqueIdentifier = uniqueIdentifierFromPublicInputs;
         verified = isCorrect;
         queryResultErrors = isCorrect ? undefined : queryResultErrorsFromPublicInputs;
+        if (uniqueIdentifier && BigInt(uniqueIdentifier) === BigInt(0) && !devMode) {
+            // If the unique identifier is 0 and it is not in dev mode,
+            // the proofs are considered invalid as these are mock proofs only meant
+            // for testing purposes
+            verified = false;
+            console.warn("You are trying to verify a mock proof. This is only allowed in dev mode. To enable dev mode, set the `devMode` parameter to `true` in the request function parameters.");
+        }
         // Only proceed with the proof verification if the public inputs are correct
         if (verified) {
             for (const proof of proofs) {
@@ -1922,6 +1953,7 @@ class ZKPassport {
                             validityPeriodInDays: validity,
                             domain: this.domain,
                             scope,
+                            devMode,
                         });
                         const result = await client.readContract({
                             address,
@@ -1969,18 +2001,18 @@ class ZKPassport {
         if (network === "ethereum_sepolia") {
             return {
                 ...baseConfig,
-                address: "0x21E12Fa30a1F98699F242ac062Db4a8e7b344B5d",
+                address: "0x8c6982D77f7a8f60aE3133cA9b2FAA6f3e78c394",
             };
         }
         else if (network === "local_anvil") {
             return {
                 ...baseConfig,
-                address: "0x2279B7A0a67DB372996a5FaB50D91eAA73d2eBe6",
+                address: "0x0",
             };
         }
         throw new Error(`Unsupported network: ${network}`);
     }
-    getSolidityVerifierParameters({ proof, validityPeriodInDays = 7, domain, scope, }) {
+    getSolidityVerifierParameters({ proof, validityPeriodInDays = 7, domain, scope, devMode = false, }) {
         if (!proof.name?.startsWith("outer_evm")) {
             throw new Error("This proof cannot be verified on an EVM chain. Please make sure to use the `compressed-evm` mode.");
         }
@@ -2072,7 +2104,7 @@ class ZKPassport {
         let committedInputCountsArray = [];
         for (const commitment of parameterCommitments) {
             const committedInput = committedInputs.find((x) => {
-                const rawHashedInputs = (0, sha256_1.sha256)((0, utils_3.hexToBytes)(x.inputs));
+                const rawHashedInputs = (0, sha2_1.sha256)((0, utils_3.hexToBytes)(x.inputs));
                 // Shift the hash 8 bits to the right (1 byte)
                 // as one byte is dropped in the circuit to fit in the 254-bit field size
                 const hashedInputs = new Uint8Array(rawHashedInputs.length);
@@ -2108,6 +2140,7 @@ class ZKPassport {
             validityPeriodInDays,
             scope: domain ?? this.domain,
             subscope: scope ?? "",
+            devMode,
         };
         return params;
     }