stellarium-ts 0.6.0 → 0.8.0

package/dist/client/operatorClient.js

@@ -12,7 +12,7 @@ export class OperatorClient {
             },
         });
         if (!response.ok) {
-            throw new Error(`Failed to settle payment: ${response.statusText}`);
+            console.error(`Failed to settle payment: ${response.statusText} body: ${await response.text()}`);
         }
     }
 }

package/dist/resource/invoker.d.ts

@@ -9,6 +9,22 @@ export interface PaymentVoucher {
     expiresAt: string;
     publicKey: string;
 }
+/**
+ * The object `createPaymentVoucher` signs. `signature` is excluded, and
+ * `resourcePath`, `resourceName`, and `parameters` come from the invocation,
+ * not from the voucher itself. Key order is part of the signed bytes.
+ */
+export declare function paymentVoucherPayload(voucher: Omit<PaymentVoucher, "signature">, resourcePath: string, resourceName: string, parameters: ResourceFunctionCallParameter[]): {
+    requestId: string;
+    invocationId: string;
+    amount: number;
+    recipientAddress: string;
+    expiresAt: string;
+    resourcePath: string;
+    resourceName: string;
+    parameters: ResourceFunctionCallParameter[];
+    publicKey: string;
+};
 export declare class CombinationResourceInvoker implements ResourceInvoker {
     private readonly resourceRepository;
     private readonly costLimitLamports;

package/dist/resource/invoker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"invoker.d.ts","sourceRoot":"","sources":["../../src/resource/invoker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,6BAA6B,EAA6B,eAAe,EAAE,MAAM,eAAe,CAAC;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,0BAA2B,YAAW,eAAe;IAElD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAAsB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAhL,YAA6B,kBAAkB,EAAE,kBAAkB,EAAmB,iBAAiB,EAAE,MAAM,EAAmB,SAAS,EAAE,MAAM,EAAmB,UAAU,EAAE,MAAM,EAAI;IAC5L;;;;;;;;;;OAUG;IACG,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAiDhH;IAED,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,cAAc,CAOtK;CACJ"}
+{"version":3,"file":"invoker.d.ts","sourceRoot":"","sources":["../../src/resource/invoker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,6BAA6B,EAA6B,eAAe,EAAE,MAAM,eAAe,CAAC;AACpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,MAAM,WAAW,cAAc;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACjC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,EAC1C,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,6BAA6B,EAAE;;;;;;;;;;EAI9C;AAED,qBAAa,0BAA2B,YAAW,eAAe;IAElD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAAsB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAhL,YAA6B,kBAAkB,EAAE,kBAAkB,EAAmB,iBAAiB,EAAE,MAAM,EAAmB,SAAS,EAAE,MAAM,EAAmB,UAAU,EAAE,MAAM,EAAI;IAC5L;;;;;;;;;;OAUG;IACG,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAkDhH;IAED,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,cAAc,CAOtK;CACJ"}

package/dist/resource/invoker.js

@@ -1,4 +1,13 @@
 import { signData } from "../crypto/utils.js";
+/**
+ * The object `createPaymentVoucher` signs. `signature` is excluded, and
+ * `resourcePath`, `resourceName`, and `parameters` come from the invocation,
+ * not from the voucher itself. Key order is part of the signed bytes.
+ */
+export function paymentVoucherPayload(voucher, resourcePath, resourceName, parameters) {
+    const { requestId, invocationId, amount, recipientAddress, expiresAt, publicKey } = voucher;
+    return { requestId, invocationId, amount, recipientAddress, expiresAt, resourcePath, resourceName, parameters, publicKey };
+}
 export class CombinationResourceInvoker {
     resourceRepository;
     costLimitLamports;
@@ -39,6 +48,7 @@ export class CombinationResourceInvoker {
             }
             let paymentVoucher;
             if (resourceFunction.paymentManifest) {
+                console.log(`Resource function ${resource.name}.${functionName} has a payment manifest, creating payment voucher...`);
                 if (resourceFunction.paymentManifest.costLamports > this.costLimitLamports) {
                     throw new Error(`Function ${functionName} cost ${resourceFunction.paymentManifest.costLamports} lamports, which exceeds the cost limit of ${this.costLimitLamports} lamports`);
                 }
@@ -71,7 +81,7 @@ export class CombinationResourceInvoker {
         const invocationId = crypto.randomUUID();
         // Expire in 2 minutes
         const expiresAt = new Date(Date.now() + 1000 * 60 * 2).toISOString();
-        const signature = signData({ requestId, invocationId, amount, recipientAddress, expiresAt, resourcePath, resourceName, parameters, publicKey: this.publicKey }, this.privateKey);
+        const signature = signData(paymentVoucherPayload({ requestId, invocationId, amount, recipientAddress, expiresAt, publicKey: this.publicKey }, resourcePath, resourceName, parameters), this.privateKey);
         return { requestId, invocationId, amount, recipientAddress, signature, expiresAt, publicKey: this.publicKey };
     }
 }

package/dist/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAKlD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,UAAU,YAAY;IAClB,OAAO,EAAE,OAAO,CAAC;CACpB;AA+BD;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAoI5C,CAAC;eAGa,MAAM"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAKlD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,UAAU,YAAY;IAClB,OAAO,EAAE,OAAO,CAAC;CACpB;AA+BD;;;;GAIG;AACH,QAAA,MAAM,MAAM,EAAE,kBAAkB,CAAC,YAAY,CAyI5C,CAAC;eAGa,MAAM"}

package/dist/routes.js

@@ -1,4 +1,5 @@
 import { interpretParsed, parseScript } from 'requestscript';
+import { paymentVoucherPayload } from './resource/invoker.js';
 import { verifyData } from './crypto/utils.js';
 /**
  * Encapsulates the routes
@@ -88,7 +89,7 @@ const routes = async (fastify, options) => {
         const resourceRequest = request.body;
         const paymentVoucher = resourceRequest.paymentVoucher;
         if (paymentVoucher) {
-            const isValid = verifyData(paymentVoucher, paymentVoucher.publicKey, paymentVoucher.signature);
+            const isValid = verifyData(paymentVoucherPayload(paymentVoucher, resourceRequest.resourcePath, resourceRequest.resourceName, resourceRequest.parameters), paymentVoucher.publicKey, paymentVoucher.signature);
             if (!isValid) {
                 return reply.status(400).send({ error: 'Invalid payment voucher' });
             }

package/dist/tests/resource/invoker.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=invoker.test.d.ts.map

package/dist/tests/resource/invoker.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoker.test.d.ts","sourceRoot":"","sources":["../../../src/tests/resource/invoker.test.ts"],"names":[],"mappings":""}

package/dist/tests/resource/invoker.test.js

@@ -0,0 +1,24 @@
+import { generateKeyPairSync } from "node:crypto";
+import { describe, expect, test } from "vitest";
+import { verifyData } from "../../crypto/utils.js";
+import { CombinationResourceInvoker, paymentVoucherPayload } from "../../resource/invoker.js";
+function generateBase64KeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
+        publicKeyEncoding: { type: "spki", format: "der" },
+        privateKeyEncoding: { type: "pkcs8", format: "der" },
+    });
+    return {
+        publicKey: publicKey.toString("base64url"),
+        privateKey: privateKey.toString("base64url"),
+    };
+}
+describe("payment voucher", () => {
+    test("verifies the signed invocation payload, not the voucher object", () => {
+        const { publicKey, privateKey } = generateBase64KeyPair();
+        const invoker = new CombinationResourceInvoker({}, 100_000, publicKey, privateKey);
+        const parameters = [{ name: "city", value: "Oslo" }];
+        const voucher = invoker.createPaymentVoucher("4HkmXgXCJ8tw1ih5VFHetRt4kWdo1VLBVmV7B5p6ctK2", 10000, "com.example", "Weather", parameters);
+        expect(verifyData(paymentVoucherPayload(voucher, "com.example", "Weather", parameters), voucher.publicKey, voucher.signature)).toBe(true);
+        expect(verifyData(voucher, voucher.publicKey, voucher.signature)).toBe(false);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stellarium-ts",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "A Stellarium Node in TypeScript.",
   "homepage": "https://github.com/qualletio/stellarium-ts#readme",
   "bugs": {