libp2r2p 0.8.0 → 0.9.0

package/nwt/index.js

@@ -0,0 +1,241 @@
+import { base64UrlToBytes, bytesToBase64Url } from '../base64/index.js'
+import { ValidationError } from '../error/index.js'
+import { isValidEvent } from '../event/index.js'
+import { NWT } from '../kind/index.js'
+
+const textDecoder = new TextDecoder('utf-8', { fatal: true })
+const textEncoder = new TextEncoder()
+const BASE64URL = /^[A-Za-z0-9_-]+$/
+const REGISTERED_CLAIMS = new Set(['iss', 'sub', 'aud', 'iat', 'exp', 'nbf'])
+const SINGLE_CLAIMS = new Set(['iss', 'sub', 'iat', 'exp', 'nbf'])
+const TIMESTAMP_CLAIMS = new Set(['iat', 'exp', 'nbf'])
+const MAX_CLAIMS = 512
+
+function fail (code, { message = code, cause } = {}) {
+  throw new ValidationError(code, { message, cause })
+}
+
+function cloneTags (tags) {
+  return tags.map(tag => tag.slice())
+}
+
+function areTagsEqual (left, right) {
+  return left.length === right.length && left.every((tag, index) => {
+    const other = right[index]
+    return tag.length === other.length && tag.every((value, valueIndex) => value === other[valueIndex])
+  })
+}
+
+function normalizeTimestamp (value, code) {
+  if (!Number.isSafeInteger(value) || value < 0) fail(code)
+  return value
+}
+
+function parseTimestamp (value, code) {
+  if (!/^(?:0|[1-9][0-9]*)$/.test(value)) fail(code)
+  return normalizeTimestamp(Number(value), code)
+}
+
+function normalizeStringClaim (value, code) {
+  if (typeof value !== 'string' || value.length === 0) fail(code)
+  return value
+}
+
+function normalizeAudience (audience, { required = false } = {}) {
+  if (audience === undefined) {
+    if (required) fail('INVALID_AUDIENCE')
+    return []
+  }
+  const values = typeof audience === 'string' ? [audience] : audience
+  if (!Array.isArray(values) || (required && values.length === 0)) fail('INVALID_AUDIENCE')
+  return values.map(value => normalizeStringClaim(value, 'INVALID_AUDIENCE'))
+}
+
+function normalizeExtraClaims (claims) {
+  if (claims === undefined) return []
+  if (!Array.isArray(claims)) fail('INVALID_CLAIMS')
+  return claims.map(tag => {
+    if (!Array.isArray(tag) || tag.length < 2 || tag.some(value => typeof value !== 'string')) fail('INVALID_CLAIM')
+    if (tag[0].length === 0 || REGISTERED_CLAIMS.has(tag[0])) fail('INVALID_CUSTOM_CLAIM')
+    return tag.slice()
+  })
+}
+
+function parseClaims (event) {
+  if (event.tags.length > MAX_CLAIMS) fail('TOO_MANY_CLAIMS')
+
+  const single = new Map()
+  const audience = []
+  const claims = []
+
+  for (const tag of event.tags) {
+    if (tag.length < 2 || tag[0].length === 0) fail('INVALID_CLAIM')
+    const name = tag[0]
+
+    if (!REGISTERED_CLAIMS.has(name)) {
+      claims.push(tag.slice())
+      continue
+    }
+    if (tag.length !== 2 || tag[1].length === 0) fail('INVALID_REGISTERED_CLAIM')
+    if (name === 'aud') {
+      audience.push(tag[1])
+      continue
+    }
+    if (SINGLE_CLAIMS.has(name) && single.has(name)) fail('DUPLICATE_SINGLE_CLAIM')
+    single.set(name, TIMESTAMP_CLAIMS.has(name)
+      ? parseTimestamp(tag[1], `INVALID_${name.toUpperCase()}_CLAIM`)
+      : tag[1])
+  }
+
+  const expiration = single.get('exp') ?? null
+  const notBefore = single.get('nbf') ?? null
+  if (expiration !== null && notBefore !== null && notBefore > expiration) fail('INVALID_TIME_WINDOW')
+
+  return {
+    event,
+    id: event.id,
+    signer: event.pubkey,
+    issuer: single.get('iss') ?? event.pubkey,
+    subject: single.get('sub') ?? event.pubkey,
+    audience,
+    issuedAt: single.get('iat') ?? event.created_at,
+    expiration,
+    notBefore,
+    claims,
+    content: event.content
+  }
+}
+
+function parseVerifiedEvent (event) {
+  if (!isValidEvent(event)) fail('INVALID_NWT_EVENT')
+  if (event.kind !== NWT) fail('INVALID_NWT_KIND')
+  return parseClaims(event)
+}
+
+function wireEvent (event) {
+  return {
+    id: event.id,
+    pubkey: event.pubkey,
+    created_at: event.created_at,
+    kind: event.kind,
+    tags: cloneTags(event.tags),
+    content: event.content,
+    sig: event.sig
+  }
+}
+
+export async function createToken ({
+  signEvent,
+  issuer,
+  subject,
+  audience,
+  issuedAt,
+  expiration,
+  notBefore,
+  claims,
+  content = '',
+  createdAt = Math.floor(Date.now() / 1000)
+} = {}) {
+  if (typeof signEvent !== 'function') fail('SIGN_EVENT_SHOULD_BE_A_FUNCTION')
+  if (typeof content !== 'string') fail('INVALID_CONTENT')
+
+  const tags = []
+  if (issuer !== undefined) tags.push(['iss', normalizeStringClaim(issuer, 'INVALID_ISSUER')])
+  if (subject !== undefined) tags.push(['sub', normalizeStringClaim(subject, 'INVALID_SUBJECT')])
+  for (const value of normalizeAudience(audience)) tags.push(['aud', value])
+  if (issuedAt !== undefined) tags.push(['iat', String(normalizeTimestamp(issuedAt, 'INVALID_ISSUED_AT'))])
+  if (expiration !== undefined) tags.push(['exp', String(normalizeTimestamp(expiration, 'INVALID_EXPIRATION'))])
+  if (notBefore !== undefined) tags.push(['nbf', String(normalizeTimestamp(notBefore, 'INVALID_NOT_BEFORE'))])
+  tags.push(...normalizeExtraClaims(claims))
+  if (tags.length > MAX_CLAIMS) fail('TOO_MANY_CLAIMS')
+
+  const expected = {
+    kind: NWT,
+    created_at: normalizeTimestamp(createdAt, 'INVALID_CREATED_AT'),
+    tags,
+    content
+  }
+  if (expiration !== undefined && notBefore !== undefined && notBefore > expiration) fail('INVALID_TIME_WINDOW')
+
+  const event = await signEvent({ ...expected, tags: cloneTags(expected.tags) })
+  parseVerifiedEvent(event)
+  if (
+    event.kind !== expected.kind ||
+    event.created_at !== expected.created_at ||
+    event.content !== expected.content ||
+    !areTagsEqual(event.tags, expected.tags)
+  ) fail('SIGNED_NWT_EVENT_WAS_CHANGED')
+  return event
+}
+
+export function encodeToken (event, { includeAuthorizationScheme = false } = {}) {
+  parseVerifiedEvent(event)
+  const token = bytesToBase64Url(textEncoder.encode(JSON.stringify(wireEvent(event))))
+  return includeAuthorizationScheme ? `Nostr ${token}` : token
+}
+
+export function decodeToken (value) {
+  if (typeof value !== 'string' || value.length === 0) fail('INVALID_NWT_TOKEN')
+  let token = value
+  if (value.startsWith('Nostr ')) token = value.slice(6)
+  else if (/\s/.test(value)) fail('INVALID_AUTHORIZATION_HEADER')
+  if (!BASE64URL.test(token) || token.length % 4 === 1) fail('INVALID_NWT_ENCODING')
+
+  let bytes
+  try {
+    bytes = base64UrlToBytes(token)
+    if (bytesToBase64Url(bytes) !== token) fail('INVALID_NWT_ENCODING')
+  } catch (cause) {
+    fail('INVALID_NWT_ENCODING', { cause })
+  }
+
+  try {
+    const event = JSON.parse(textDecoder.decode(bytes))
+    if (!event || typeof event !== 'object' || Array.isArray(event)) fail('INVALID_NWT_EVENT_JSON')
+    return event
+  } catch (error) {
+    if (error instanceof ValidationError && error.code === 'INVALID_NWT_EVENT_JSON') throw error
+    fail('INVALID_NWT_EVENT_JSON', { cause: error })
+  }
+}
+
+export function validateToken (value, {
+  audience,
+  signer,
+  issuer,
+  subject,
+  now = Math.floor(Date.now() / 1000),
+  clockSkewSeconds = 60,
+  requireAudience = false,
+  requireExpiration = false
+} = {}) {
+  const event = typeof value === 'string' ? decodeToken(value) : value
+  const token = parseVerifiedEvent(event)
+  normalizeTimestamp(now, 'INVALID_NOW')
+  normalizeTimestamp(clockSkewSeconds, 'INVALID_CLOCK_SKEW')
+  if (!Number.isSafeInteger(now + clockSkewSeconds) || !Number.isSafeInteger(now - clockSkewSeconds)) {
+    fail('INVALID_CLOCK_SKEW')
+  }
+
+  if (token.notBefore !== null && now + clockSkewSeconds < token.notBefore) fail('NWT_NOT_YET_VALID')
+  if (token.expiration !== null && now - clockSkewSeconds >= token.expiration) fail('NWT_EXPIRED')
+  if (requireExpiration && token.expiration === null) fail('NWT_EXPIRATION_REQUIRED')
+
+  if (token.audience.length === 0) {
+    if (requireAudience) fail('NWT_AUDIENCE_REQUIRED')
+  } else {
+    if (audience === undefined) fail('NWT_AUDIENCE_REQUIRED')
+    const expectedAudience = normalizeAudience(audience, { required: true })
+    if (!expectedAudience.some(value => token.audience.includes(value))) fail('NWT_AUDIENCE_MISMATCH')
+  }
+
+  for (const [expected, actual, code] of [
+    [signer, token.signer, 'NWT_SIGNER_MISMATCH'],
+    [issuer, token.issuer, 'NWT_ISSUER_MISMATCH'],
+    [subject, token.subject, 'NWT_SUBJECT_MISMATCH']
+  ]) {
+    if (expected !== undefined && normalizeStringClaim(expected, code) !== actual) fail(code)
+  }
+
+  return token
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",
@@ -20,20 +20,30 @@
     "content-key",
     "double-dh",
     "ecdh",
+    "error",
+    "event",
     "idb",
     "idb-queue",
     "i18n",
     "index.js",
     "key",
+    "kind",
     "network",
+    "nip04",
+    "nip05",
     "nip19",
+    "nip44",
     "nip44-v3",
     "nip46",
+    "nip96",
+    "nip98",
+    "nwt",
     "private-channel",
     "private-message",
     "private-messenger",
     "relay",
     "temporary-storage",
+    "url",
     "web-storage-queue"
   ],
   "scripts": {
@@ -51,28 +61,37 @@
     "./content-key/event": "./content-key/event/index.js",
     "./double-dh": "./double-dh/index.js",
     "./ecdh": "./ecdh/index.js",
+    "./error": "./error/index.js",
+    "./event": "./event/index.js",
     "./idb": "./idb/index.js",
     "./idb-queue": "./idb-queue/index.js",
     "./i18n": "./i18n/index.js",
     "./key": "./key/index.js",
+    "./kind": "./kind/index.js",
     "./network": "./network/index.js",
+    "./nip04": "./nip04/index.js",
+    "./nip05": "./nip05/index.js",
     "./nip19": "./nip19/index.js",
+    "./nip44": "./nip44/index.js",
     "./nip44-v3": "./nip44-v3/index.js",
     "./nip46": "./nip46/index.js",
+    "./nip96": "./nip96/index.js",
+    "./nip98": "./nip98/index.js",
+    "./nwt": "./nwt/index.js",
     "./private-channel": "./private-channel/index.js",
     "./private-message": "./private-message/index.js",
     "./private-messenger": "./private-messenger/index.js",
     "./private-messenger/recovery": "./private-messenger/recovery/index.js",
     "./relay": "./relay/index.js",
     "./temporary-storage": "./temporary-storage/index.js",
+    "./url": "./url/index.js",
     "./web-storage-queue": "./web-storage-queue/index.js"
   },
   "dependencies": {
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@scure/base": "2.0.0",
-    "nostr-tools": "2.23.5"
+    "@scure/base": "2.0.0"
   },
   "devDependencies": {
     "fake-indexeddb": "6.2.5"

package/private-channel/helpers/chunks.js

@@ -1,7 +1,8 @@
-import { generateSecretKey, getPublicKey } from 'nostr-tools'
+import { generateSecretKey, getPublicKey } from '../../key/index.js'
 import { bytesToBase64, base64ToBytes } from '../../base64/index.js'
 import { bytesToHex } from '../../base16/index.js'
-import { verifyIykcProof } from '../../content-key/event/index.js'
+import { isValidIykcProof } from '../../content-key/event/index.js'
+import { ValidationError } from '../../error/index.js'
 import * as nip44v3 from '../../nip44-v3/index.js'
 import { JSONL_CHUNK_BYTES } from './chunk-size.js'
 import { ROUTER_KIND } from '../constants/index.js'
@@ -28,7 +29,7 @@ function rowTempKey (id, index) {
 
 function normalizeContentKey ({ receiverPubkey, iykcPubkey = '', iykcProof = '' } = {}) {
   if (!iykcPubkey) return { iykcPubkey: '', iykcProof: '' }
-  if (!verifyIykcProof({ receiverPubkey, iykcPubkey, iykcProof })) throw new Error('INVALID_IYKC_PROOF')
+  if (!isValidIykcProof({ receiverPubkey, iykcPubkey, iykcProof })) throw new ValidationError('INVALID_IYKC_PROOF')
   return { iykcPubkey, iykcProof }
 }
 
@@ -157,7 +158,7 @@ function setPreparedRow (id, index, row, temporaryStorage) {
 
 function readPreparedRow (preparedRows, index) {
   const row = storageFor(preparedRows.temporaryStorage).getItem(rowTempKey(preparedRows.id, index))
-  if (typeof row !== 'string') throw new Error('MISSING_PREPARED_ROW')
+  if (typeof row !== 'string') throw new ValidationError('MISSING_PREPARED_ROW')
   return row
 }
 
@@ -187,7 +188,7 @@ async function prepareEnvelopeRowsOnce ({ id, senderSigner, receivers, receiverC
       ciphertext = encrypted[0]
       const nextContentPubkey = encrypted[1] || ''
       if (foundOwnContentPubkey && nextContentPubkey !== usedOwnContentPubkey) {
-        throw new Error('INCONSISTENT_IMKC_PUBKEY')
+        throw new ValidationError('INCONSISTENT_IMKC_PUBKEY')
       }
       foundOwnContentPubkey = true
       if (nextContentPubkey) usedOwnContentPubkey = nextContentPubkey
@@ -240,7 +241,7 @@ export function preparedRowIndexesForReceivers (preparedRows, receivers) {
   for (const receiver of receivers || []) {
     const pubkey = receiverRecord(receiver, {}).receiverPubkey
     const index = preparedRows?.receiverRowIndexesByPubkey?.[pubkey]
-    if (!pubkey || index === undefined) throw new Error('MISSING_PREPARED_RECEIVER')
+    if (!pubkey || index === undefined) throw new ValidationError('MISSING_PREPARED_RECEIVER')
     if (seen.has(index)) continue
     seen.add(index)
     indexes.push(index)

package/private-channel/helpers/event.js

@@ -1,4 +1,5 @@
 import { NYM_CARRIER_KIND, ROUTER_KIND } from '../constants/index.js'
+import { ValidationError } from '../../error/index.js'
 
 const encoder = new TextEncoder()
 
@@ -16,7 +17,7 @@ export function readReceiverTag (event) {
 
 export function readSenderTag (event) {
   const senderPubkey = event.tags?.find(t => t[0] === 'f')?.[1]
-  if (!senderPubkey) throw new Error('MISSING_SENDER_TAG')
+  if (!senderPubkey) throw new ValidationError('MISSING_SENDER_TAG')
   return senderPubkey
 }
 
@@ -41,7 +42,7 @@ export function readChunkTag (event) {
   const index = Number(tag?.[1])
   const total = Number(tag?.[2])
   if (!Number.isInteger(index) || !Number.isInteger(total) || index < 0 || total < 1) {
-    throw new Error('INVALID_CHUNK_TAG')
+    throw new ValidationError('INVALID_CHUNK_TAG')
   }
   return { index, total }
 }
@@ -49,7 +50,7 @@ export function readChunkTag (event) {
 export function makeRouterEvent ({ pubkey, senderPubkey, imkcPubkey, imkcProof, receiverPubkey, chunkIndex, chunkTotal, content }) {
   const tags = [['f', senderPubkey]]
   if (imkcPubkey) {
-    if (!imkcProof) throw new Error('INVALID_IMKC_PROOF')
+    if (!imkcProof) throw new ValidationError('INVALID_IMKC_PROOF')
     tags.push(['imkc', imkcPubkey, imkcProof])
   }
   tags.push(['c', String(chunkIndex), String(chunkTotal)])
@@ -58,7 +59,7 @@ export function makeRouterEvent ({ pubkey, senderPubkey, imkcPubkey, imkcProof,
 }
 
 export function makeNymCarrierEvent ({ innerId, chunkIndex, chunkTotal, content, createdAt = nowSeconds() }) {
-  if (!innerId) throw new Error('INNER_EVENT_ID_REQUIRED')
+  if (!innerId) throw new ValidationError('INNER_EVENT_ID_REQUIRED')
   return {
     kind: NYM_CARRIER_KIND,
     created_at: createdAt,