epistery 2.2.0 → 2.2.2

package/client/wallet.js

@@ -28,6 +28,11 @@ export class Wallet {
     // every wallet variant exposes the three-fact shape uniformly.
     this.contractAddress = null;
     this.rivetAddress = null;
+    // Capability declaration: true when this wallet holds a rivet key that
+    // implements encryptForPeer/decryptFromPeer. Consumers check THIS flag
+    // — never the source name, never typeof (the base stubs below always
+    // exist). Only a wallet whose key can actually run the ECDH sets it.
+    this.canPeerEncrypt = false;
   }
 
   // The rivet. For wallets that have been upgraded to a contract,
@@ -49,9 +54,26 @@ export class Wallet {
       address: this.address,
       publicKey: this.publicKey,
       source: this.source,
+      // Contract binding is a base-class fact — persist it for EVERY rivet
+      // kind, or adopting an identity silently unbinds on reload.
+      contractAddress: this.contractAddress,
+      rivetAddress: this.rivetAddress,
     };
   }
 
+  // Bind this rivet to an identity contract. A base-class capability: any
+  // rivet kind (browser, FIDO, web3) can be a signer on a contract. Does
+  // NOT flip `address` — the device key stays `address`/`rivetAddress`;
+  // the contract is a separate fact exposed via contractAddress /
+  // identityAddress.
+  upgradeToContract(contractAddress) {
+    if (this.contractAddress) {
+      throw new Error("Rivet is already using an identity contract");
+    }
+    this.rivetAddress = this.address;
+    this.contractAddress = contractAddress;
+  }
+
   // Factory method to create appropriate wallet type from saved data.
   // The three rivet types — web3, browser (rivet), and fido — are the only
   // valid identities. Anything else is a legacy/unsupported entry (e.g. the
@@ -141,20 +163,77 @@ async function _aesGcmDecrypt(aesKey, ciphertextBytes, ivBytes, tagBytes) {
   );
 }
 
-// Web3 Wallet (MetaMask, etc.)
+// Web3 Wallet — a RIVET locked by a plugin wallet (MetaMask, etc.).
+//
+// The common model: every wallet IS a nimble rivet key; the sources differ
+// only in what LOCKS that key. RivetWallet's key is locked by the
+// non-extractable WebCrypto master key; FidoWallet's by the authenticator's
+// PRF secret; here the plugin wallet is the lock. The rivet private key is
+// DERIVED from one deterministic personal_sign over a fixed message that
+// binds BOTH the site (hostname) and the plugin account:
+//
+//   priv = keccak256( sign("epistery rivet key v1\n<hostname>\n<web3Address>…") )
+//
+// ECDSA in every major plugin wallet is RFC-6979 deterministic, so the same
+// account on the same site always re-derives the same rivet — nothing
+// secret is stored, and the rivet is recoverable on any device that holds
+// the plugin wallet. Binding the hostname makes web3 rivets ORIGIN-SCOPED,
+// exactly like browser rivets (whose keys live in origin-scoped
+// localStorage) and consistent with the one-rivet-one-contract policy: a
+// different site derives a different rivet, so identities don't link
+// across sites — and a signature phished on another site derives that
+// site's rivet, useless here. The wallet's ADDRESS and publicKey are the
+// RIVET's; the plugin account is kept as `web3Address` (the lock, shown in
+// UI, usable as a value/recovery signer on-chain). Everything a rivet does
+// — sign, transact, peer encryption — runs on the derived key, unlocked
+// once per session.
+//
+// Phishing note: only a page the user believes is <hostname> can obtain a
+// useful signature. The message names the site and the account; plugin
+// wallets display it verbatim. Same posture as the widely used
+// signature-derived-key pattern (dYdX/StarkEx et al.), tightened by the
+// hostname binding.
+//
+// Legacy records (pre-lock, address == plugin account, placeholder pubkey)
+// load in a signing-only compatibility mode (`canPeerEncrypt` stays false);
+// re-adding the plugin wallet mints the locked rivet.
+const WEB3_LOCK_MESSAGE_V1 = (hostname, addr) =>
+  `epistery rivet key v1\n${hostname}\n${addr.toLowerCase()}\n\nSigning this unlocks your epistery device key on ${hostname}. Only sign it on that site.`;
+
+// The site component of the lock message. hostname (not origin/host): stable
+// across ports and schemes so dev restarts don't orphan rivets, while still
+// separating every domain.
+function _lockHostname() {
+  if (typeof window === "undefined" || !window.location || !window.location.hostname) {
+    throw new Error("web3 rivets exist only in a browser context (no hostname to bind)");
+  }
+  return window.location.hostname.toLowerCase();
+}
+
 export class Web3Wallet extends Wallet {
   constructor() {
     super();
     this.source = "web3";
-    this.signer = null;
+    this.web3Address = null;   // the plugin account that locks the rivet
+    this.label = null;
+    this.createdAt = null;
+    this.signer = null;        // plugin signer (the lock) — session only
     this.provider = null;
+    this._priv = null;         // unlocked rivet key — closure/session only
+    this._legacy = false;      // pre-lock record: address IS the plugin account
+    this.canPeerEncrypt = false;   // true once the rivet exists (locked mode)
   }
 
   toJSON() {
-    // Only persist the essential data, not the complex objects
+    // Nothing secret persists: the rivet re-derives from the plugin
+    // signature on unlock. signer/provider/_priv are session-only.
     return {
       ...super.toJSON(),
-      // Don't serialize signer/provider - they'll be recreated
+      // A legacy record must round-trip as legacy: writing web3Address
+      // would dress it up as a locked rivet it never minted.
+      web3Address: this._legacy ? null : this.web3Address,
+      label: this.label,
+      createdAt: this.createdAt,
     };
   }
 
@@ -162,100 +241,121 @@ export class Web3Wallet extends Wallet {
     const wallet = new Web3Wallet();
     wallet.address = data.address;
     wallet.publicKey = data.publicKey;
-
-    // Attempt to reconnect to Web3 provider
-    await wallet.reconnectWeb3(ethers);
+    // Locked-rivet records carry web3Address. Legacy pre-lock records don't:
+    // their address IS the plugin account and no rivet was ever minted —
+    // they stay signing-only (the plugin signs directly) until re-added.
+    wallet._legacy = !data.web3Address;
+    wallet.web3Address = data.web3Address || data.address;
+    wallet.label = data.label || null;
+    wallet.createdAt = data.createdAt || null;
+    wallet.contractAddress = data.contractAddress || null;
+    wallet.rivetAddress = data.rivetAddress || null;
+    wallet.canPeerEncrypt = !wallet._legacy;
+    // Lazy: the plugin reconnect + unlock signature happen on first use,
+    // not at restore — a locked wallet still reports address/publicKey.
     return wallet;
   }
 
   static async create(ethers) {
     const wallet = new Web3Wallet();
-
-    if (await wallet.connectWeb3(ethers)) {
+    try {
+      if (!(await wallet._connectPlugin(ethers))) return null;
+      await wallet._unlock(ethers);   // derives + installs the rivet
+      wallet.createdAt = Date.now();
       return wallet;
+    } catch (error) {
+      console.warn("Web3Wallet.create failed:", error.message);
+      return null;   // user declined, or no plugin wallet available
     }
-    return null; // Connection failed
   }
 
-  async connectWeb3(ethers) {
-    try {
-      if (typeof window !== "undefined" && (window.ethereum || window.web3)) {
-        const provider = window.ethereum || window.web3.currentProvider;
-
-        // Request account access
-        const accounts = await provider.request({
-          method: "eth_requestAccounts",
-        });
-
-        if (accounts && accounts.length > 0) {
-          this.address = accounts[0];
-          this.provider = new ethers.providers.Web3Provider(provider);
-          this.signer = this.provider.getSigner();
-
-          // Get public key from first signature
-          this.publicKey = await this.derivePublicKeyPlaceholder();
-
-          return true;
-        }
-      }
-      return false;
-    } catch (error) {
+  async _connectPlugin(ethers) {
+    if (typeof window === "undefined" || !(window.ethereum || window.web3)) {
       return false;
     }
+    const provider = window.ethereum || window.web3.currentProvider;
+    const accounts = await provider.request({ method: "eth_requestAccounts" });
+    if (!accounts || !accounts.length) return false;
+    this.provider = new ethers.providers.Web3Provider(provider);
+    this.signer = this.provider.getSigner();
+    if (!this.web3Address) this.web3Address = accounts[0];
+    if (accounts[0].toLowerCase() !== this.web3Address.toLowerCase()) {
+      throw new Error(
+        `This wallet is locked by ${this.web3Address} — switch the plugin wallet to that account to unlock it`,
+      );
+    }
+    return true;
   }
 
-  async reconnectWeb3(ethers) {
-    try {
-      if (typeof window !== "undefined" && (window.ethereum || window.web3)) {
-        const provider = window.ethereum || window.web3.currentProvider;
-        this.provider = new ethers.providers.Web3Provider(provider);
-        this.signer = this.provider.getSigner();
-
-        // Verify the address matches what we have stored
-        const currentAddress = await this.signer.getAddress();
-        if (currentAddress.toLowerCase() !== this.address.toLowerCase()) {
-          this.address = currentAddress;
-        }
-        return true;
-      }
-      return false;
-    } catch (error) {
-      return false;
+  // Unlock: one deterministic plugin signature → the rivet key, cached for
+  // the session. Verifies against the stored rivet address so a different
+  // plugin account (different derivation) fails closed instead of silently
+  // becoming a different rivet.
+  async _unlock(ethers) {
+    if (this._legacy) {
+      throw new Error("legacy web3 wallet has no rivet — remove and re-add it to mint one");
+    }
+    if (this._priv) return this._priv;
+    if (!this.signer && !(await this._connectPlugin(ethers))) {
+      throw new Error("Plugin wallet not available — connect it to unlock this rivet");
     }
+    const signature = await this.signer.signMessage(
+      WEB3_LOCK_MESSAGE_V1(_lockHostname(), this.web3Address),
+    );
+    const priv = ethers.utils.keccak256(ethers.utils.arrayify(signature));
+    const signingKey = new ethers.utils.SigningKey(priv);
+    const address = ethers.utils.computeAddress(signingKey.publicKey);
+    if (this.address && address.toLowerCase() !== this.address.toLowerCase()) {
+      throw new Error(
+        "Unlock produced a different rivet — sign with the plugin account that created this wallet",
+      );
+    }
+    this._priv = priv;
+    this.address = address;
+    this.publicKey = signingKey.publicKey;   // real uncompressed secp256k1
+    this.canPeerEncrypt = true;
+    return priv;
   }
 
   async sign(message, ethers) {
-    if (!this.signer) {
-      throw new Error("Web3 signer not available");
+    if (this._legacy) {
+      // Pre-lock record: its address IS the plugin account, which may
+      // already be a rivet on an IdentityContract — it must keep signing
+      // (that's how the owner authorizes adding a locked rivet later).
+      if (!this.signer && !(await this._connectPlugin(ethers))) {
+        throw new Error("Plugin wallet not available");
+      }
+      return await this.signer.signMessage(message);
     }
+    const priv = await this._unlock(ethers);
+    return await new ethers.Wallet(priv).signMessage(message);
+  }
 
-    const signature = await this.signer.signMessage(message);
-
-    // Always update public key from signature for Web3 wallets
-    if (ethers) {
-      this.publicKey = await this.derivePublicKeyFromSignature(
-        message,
-        signature,
-        ethers,
-      );
+  async signTransaction(unsignedTx, ethers) {
+    if (this._legacy) {
+      // Plugin signers can't produce raw signed txs (and never could here).
+      throw new Error("legacy web3 wallet cannot sign transactions — remove and re-add it to mint its locked rivet");
     }
-
-    return signature;
+    const priv = await this._unlock(ethers);
+    return await new ethers.Wallet(priv).signTransaction(unsignedTx);
   }
 
-  async derivePublicKeyPlaceholder() {
-    // Placeholder until we get a real signature
-    return `0x04${this.address.slice(2)}${"0".repeat(64)}`;
+  async encryptForPeer(peerPublicKey, plaintextBytes, ethers) {
+    if (!this.canPeerEncrypt) {
+      throw new Error("legacy web3 wallet — remove and re-add it to mint its locked rivet");
+    }
+    const priv = await this._unlock(ethers);
+    const aesKey = await _deriveAesKeyFromPriv(priv, peerPublicKey, ethers);
+    return await _aesGcmEncrypt(aesKey, plaintextBytes);
   }
 
-  async derivePublicKeyFromSignature(message, signature, ethers) {
-    try {
-      const messageHash = ethers.utils.hashMessage(message);
-      return ethers.utils.recoverPublicKey(messageHash, signature);
-    } catch (error) {
-      console.error("Failed to derive public key from signature:", error);
-      return this.derivePublicKeyPlaceholder();
+  async decryptFromPeer(peerPublicKey, ciphertextBytes, ivBytes, tagBytes, ethers) {
+    if (!this.canPeerEncrypt) {
+      throw new Error("legacy web3 wallet — remove and re-add it to mint its locked rivet");
     }
+    const priv = await this._unlock(ethers);
+    const aesKey = await _deriveAesKeyFromPriv(priv, peerPublicKey, ethers);
+    return await _aesGcmDecrypt(aesKey, ciphertextBytes, ivBytes, tagBytes);
   }
 }
 
@@ -265,6 +365,7 @@ export class RivetWallet extends Wallet {
   constructor() {
     super();
     this.source = "rivet";
+    this.canPeerEncrypt = true;
     this.keyId = null;
     this.type = "Browser"; // Browser, Contract, or Web3
     this.label = null;
@@ -287,8 +388,6 @@ export class RivetWallet extends Wallet {
       createdAt: this.createdAt,
       lastUpdated: this.lastUpdated,
       encryptedPrivateKey: this.encryptedPrivateKey,
-      contractAddress: this.contractAddress,
-      rivetAddress: this.rivetAddress,
       associations: this.associations,
     };
   }
@@ -1011,23 +1110,10 @@ export class RivetWallet extends Wallet {
 
   /**
    * Upgrades this rivet to use an identity contract
-   * Updates the wallet to present the contract address instead of rivet address
    * @param {string} contractAddress - The deployed identity contract address
    */
   upgradeToContract(contractAddress) {
-    if (this.contractAddress) {
-      throw new Error("Rivet is already using an identity contract");
-    }
-
-    // Do NOT flip `address` to the contract. `address` stays the rivet (device
-    // key) for the life of the wallet; the contract is a separate fact exposed
-    // via contractAddress / identityAddress. Flipping used to make the device
-    // wallet masquerade as its contract — the device list then showed the
-    // contract address, and every consumer that read `address` expecting the
-    // signer was wrong. rivetAddress is kept set (== address) for the
-    // signerAddress getter and a stable persisted shape.
-    this.rivetAddress = this.address;
-    this.contractAddress = contractAddress;
+    super.upgradeToContract(contractAddress);
     this.type = "Contract";
     this.lastUpdated = Date.now();
   }
@@ -1052,6 +1138,7 @@ export class FidoWallet extends Wallet {
   constructor() {
     super();
     this.source = "fido";
+    this.canPeerEncrypt = true;
     this.credentialId = null; // base64url string
     this.encryptedPrivateKey = null; // JSON: { ciphertext, iv } as hex
     this.label = null;
@@ -1079,6 +1166,8 @@ export class FidoWallet extends Wallet {
     wallet.label = data.label;
     wallet.createdAt = data.createdAt;
     wallet.lastUpdated = data.lastUpdated;
+    wallet.contractAddress = data.contractAddress || null;
+    wallet.rivetAddress = data.rivetAddress || null;
     return wallet;
   }
 

package/client/witness.js

@@ -393,6 +393,12 @@ export default class Witness {
     if (!this.wallet || this.wallet.source !== "web3" || !this.serverInfo) {
       return;
     }
+    // Locked-rivet web3 wallets restore lazily — no provider until first
+    // plugin use. Chain compatibility only matters when the plugin itself
+    // sends a tx (legacy path), and that path switches chains at tx time.
+    if (!this.wallet.provider || typeof this.wallet.provider.getNetwork !== "function") {
+      return;
+    }
 
     try {
       const targetChainId = this.serverInfo.chainId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "epistery",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Epistery brings blockchain capabilities to mundane web tasks like engagement metrics, authentication and commerce of all sorts.",
   "author": "Rootz Corp.",
   "license": "MIT",

package/test/config/.epistery/localhost/config.ini

@@ -1,5 +1,4 @@
 domain=localhost
-pending=true
 
 [wallet]
 address=0x5277286b5821D1bF5c2395F38c3250A5B0F14da3