trustbase-seller-backend 0.1.5

package/oauth/token-v2.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * OAuth Access Token v2 — 结构化签名令牌（R2-1，冻结稿 c49024d+549ae91+7c20ce7）
+ *
+ * 传输形态: tv2.<base64url(JSON payload)>.<base64url(issuer_sig r||s 64B)>
+ *
+ * payload = {
+ *   v: 2,
+ *   iss:  签发索引器 node_id (tct1..., 链上 IndexerEndpoint 可查公钥),
+ *   sub:  用户链上地址,
+ *   client_id, scopes[], iat, exp, jti,
+ *   grant: { sub, client_id, scopes, iss, grant_exp, nonce, user_pubkey(b64 33B) },
+ *   grant_sig: 用户钱包对 canonicalize(grant) 的签名 (b64 r||s 64B),
+ * }
+ * issuer_sig = 签发节点密钥对 canonicalize(payload) 的签名 (剥离 signature 段后验)。
+ *
+ * spec 钉死（终审结论）：
+ * - exp <= iat + 24h 签发强制（无 min 双轨，本地/跨索引器同一条规则）
+ * - 验证方不拒未知字段；按收到的原始 payload 验签，不用解析后重建
+ *   （实现上：验签对象是 base64url 段原文解码后的 JSON——canonicalize 后与签名时
+ *    字节一致，未知字段自然 passthrough）
+ * - 用户 grant 签名内嵌：签发者密钥泄露也伪造不了用户授权（A1 风险闭合）
+ * - 撤销：本地 revoked-jti + revoke-all(sub,client_id,before_iat) + gossip 加速层；
+ *   链上撤销表等 R2-a 子稿，此处留接口
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLOCK_SKEW_MS = exports.MAX_CROSS_INDEXER_AGE_MS = exports.TOKEN_V2_PREFIX = void 0;
+exports.deriveAddressFromPubkey = deriveAddressFromPubkey;
+exports.tokenV2Hash = tokenV2Hash;
+exports.verifyGrantSig = verifyGrantSig;
+exports.issueTokenV2 = issueTokenV2;
+exports.parseTokenV2 = parseTokenV2;
+exports.verifyIssuerSig = verifyIssuerSig;
+exports.verifyTokenV2Offline = verifyTokenV2Offline;
+const crypto_1 = require("crypto");
+const encoding_1 = require("@cosmjs/encoding");
+const crypto_2 = require("@cosmjs/crypto");
+const encoding_2 = require("@cosmjs/encoding");
+const signing_1 = require("../p2p/signing");
+exports.TOKEN_V2_PREFIX = 'tv2.';
+exports.MAX_CROSS_INDEXER_AGE_MS = 24 * 60 * 60 * 1000; // exp<=iat+24h 签发强制
+exports.CLOCK_SKEW_MS = 5 * 60 * 1000;
+const BECH32_PREFIX = 'tct';
+function b64urlEncode(buf) {
+    return Buffer.from(buf).toString('base64url');
+}
+function b64urlDecode(s) {
+    return Buffer.from(s, 'base64url');
+}
+/** 用户地址派生：ripemd160(sha256(pubkey)) → bech32（与 wallet-auth 同规则） */
+function deriveAddressFromPubkey(pubkey) {
+    return (0, encoding_2.toBech32)(BECH32_PREFIX, (0, crypto_2.ripemd160)((0, crypto_2.sha256)(pubkey)));
+}
+/** token 内容哈希（S4：库里只存这个，明文不落盘） */
+function tokenV2Hash(token) {
+    return (0, crypto_1.createHash)('sha256').update(token, 'utf8').digest('hex');
+}
+/**
+ * 验证用户 grant 签名：grant_sig 必须是对 canonicalize(grant) 的、
+ * 由 grant.user_pubkey 对应私钥作出的有效签名，且 user_pubkey 派生地址 === grant.sub。
+ */
+async function verifyGrantSig(grant, grantSig) {
+    let pubBytes;
+    try {
+        pubBytes = (0, encoding_1.fromBase64)(grant.user_pubkey);
+    }
+    catch {
+        return false;
+    }
+    if (pubBytes.length !== 33)
+        return false;
+    if (deriveAddressFromPubkey(pubBytes) !== grant.sub)
+        return false;
+    return (0, signing_1.verifySignature)({ ...grant, signature: grantSig }, pubBytes);
+}
+/**
+ * 签发 v2 token（签发方 A 用）。
+ * 调用前必须已 verifyGrantSig 通过（exchange 路径负责）。
+ * exp 被钳制到 iat+24h 以内（签发强制，钉死 spec）。
+ */
+async function issueTokenV2(grant, grantSig, issuerPrivkey, opts = {}) {
+    const iat = opts.iat ?? Date.now();
+    const expCap = iat + exports.MAX_CROSS_INDEXER_AGE_MS;
+    const requested = opts.requestedExp ?? expCap;
+    const exp = Math.min(requested, expCap, grant.grant_exp);
+    const payload = {
+        v: 2,
+        iss: grant.iss,
+        sub: grant.sub,
+        client_id: grant.client_id,
+        scopes: grant.scopes,
+        iat,
+        exp,
+        jti: opts.jti ?? (0, crypto_1.randomBytes)(32).toString('hex'),
+        grant,
+        grant_sig: grantSig,
+    };
+    const sig = await (0, signing_1.signObject)(payload, issuerPrivkey);
+    const token = exports.TOKEN_V2_PREFIX + b64urlEncode(Buffer.from(JSON.stringify(payload), 'utf8')) + '.' + b64urlEncode((0, encoding_1.fromBase64)(sig));
+    return { token, payload };
+}
+/** 解析 tv2 token；格式错误返回 null（不抛） */
+function parseTokenV2(token) {
+    if (!token.startsWith(exports.TOKEN_V2_PREFIX))
+        return null;
+    const rest = token.slice(exports.TOKEN_V2_PREFIX.length);
+    const dot = rest.lastIndexOf('.');
+    if (dot <= 0 || dot === rest.length - 1)
+        return null;
+    const payloadRaw = rest.slice(0, dot);
+    const sigRaw = rest.slice(dot + 1);
+    let payload;
+    let issuerSig;
+    try {
+        payload = JSON.parse(b64urlDecode(payloadRaw).toString('utf8'));
+        issuerSig = b64urlDecode(sigRaw);
+    }
+    catch {
+        return null;
+    }
+    if (issuerSig.length !== 64)
+        return null;
+    if (!payload || payload.v !== 2 || !payload.iss || !payload.sub || !payload.jti)
+        return null;
+    if (typeof payload.iat !== 'number' || typeof payload.exp !== 'number')
+        return null;
+    return { payload, payloadRaw, issuerSig };
+}
+/**
+ * 用签发者公钥验 issuer_sig。
+ * 纪律：验签对象 = JSON.parse(payload 段原文) —— 未知字段随原文 passthrough，
+ * 绝不从已知字段重建对象（重建会丢未知字段导致验签假阴性）。
+ */
+async function verifyIssuerSig(parsed, issuerPubkey) {
+    const obj = JSON.parse(b64urlDecode(parsed.payloadRaw).toString('utf8'));
+    obj.signature = (0, encoding_1.toBase64)(parsed.issuerSig);
+    return (0, signing_1.verifySignature)(obj, issuerPubkey);
+}
+/**
+ * B 节点离线验证主线（不碰签发方、不碰本地用户表）：
+ * 撤销缓存 → 有效期 → grant 签 → issuer 签（公钥由调用方从链上 IndexerEndpoint 取）。
+ */
+async function verifyTokenV2Offline(token, issuerPubkey, revocations, now = Date.now()) {
+    const parsed = parseTokenV2(token);
+    if (!parsed)
+        return { ok: false, reason: 'malformed' };
+    const p = parsed.payload;
+    if (revocations.isJtiRevoked(p.jti))
+        return { ok: false, reason: 'revoked-jti' };
+    const beforeIat = revocations.getRevokeAllBeforeIat(p.sub, p.client_id);
+    if (beforeIat !== null && p.iat < beforeIat)
+        return { ok: false, reason: 'revoked-all' };
+    if (now - exports.CLOCK_SKEW_MS > p.exp)
+        return { ok: false, reason: 'expired' };
+    if (p.iat - exports.CLOCK_SKEW_MS > now)
+        return { ok: false, reason: 'not-yet-valid' };
+    if (p.exp > p.iat + exports.MAX_CROSS_INDEXER_AGE_MS + exports.CLOCK_SKEW_MS)
+        return { ok: false, reason: 'exp-window-exceeded' };
+    if (now - exports.CLOCK_SKEW_MS > p.grant.grant_exp)
+        return { ok: false, reason: 'grant-expired' };
+    if (!(await verifyGrantSig(p.grant, p.grant_sig)))
+        return { ok: false, reason: 'grant-sig-invalid' };
+    if (!(await verifyIssuerSig(parsed, issuerPubkey)))
+        return { ok: false, reason: 'issuer-sig-invalid' };
+    return { ok: true, payload: p };
+}
+//# sourceMappingURL=token-v2.js.map

package/oauth/token-v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-v2.js","sourceRoot":"","sources":["../../src/oauth/token-v2.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;AA4CH,0DAEC;AAGD,kCAEC;AAMD,wCAUC;AAOD,oCAyBC;AASD,oCAmBC;AAOD,0CAIC;AAuBD,oDAuBC;AAtLD,mCAAiD;AACjD,+CAAwD;AACxD,2CAAmD;AACnD,+CAA4C;AAC5C,4CAA2E;AAE9D,QAAA,eAAe,GAAG,MAAM,CAAC;AACzB,QAAA,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;AACpE,QAAA,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,aAAa,GAAG,KAAK,CAAC;AAyB5B,SAAS,YAAY,CAAC,GAAwB;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AACD,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,mEAAmE;AACnE,SAAgB,uBAAuB,CAAC,MAAkB;IACxD,OAAO,IAAA,mBAAQ,EAAC,aAAa,EAAE,IAAA,kBAAS,EAAC,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,kCAAkC;AAClC,SAAgB,WAAW,CAAC,KAAa;IACvC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAAC,KAAmB,EAAE,QAAgB;IACxE,IAAI,QAAoB,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,qBAAU,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,IAAA,yBAAe,EAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,YAAY,CAChC,KAAmB,EACnB,QAAgB,EAChB,aAAyB,EACzB,OAA8D,EAAE;IAEhE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,GAAG,gCAAwB,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,OAAO,GAAmB;QAC9B,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG;QACH,GAAG;QACH,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChD,KAAK;QACL,SAAS,EAAE,QAAQ;KACpB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAU,EAAC,OAAc,EAAE,aAAa,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,uBAAe,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,IAAA,qBAAU,EAAC,GAAG,CAAC,CAAC,CAAC;IACjI,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAQD,mCAAmC;AACnC,SAAgB,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,uBAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,OAAuB,CAAC;IAC5B,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,MAAqB,EAAE,YAAwB;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,GAAG,CAAC,SAAS,GAAG,IAAA,mBAAQ,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,IAAA,yBAAe,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAmBD;;;GAGG;AACI,KAAK,UAAU,oBAAoB,CACxC,KAAa,EACb,YAAwB,EACxB,WAA6B,EAC7B,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IAEzB,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjF,MAAM,SAAS,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEzF,IAAI,GAAG,GAAG,qBAAa,GAAG,CAAC,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzE,IAAI,CAAC,CAAC,GAAG,GAAG,qBAAa,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,gCAAwB,GAAG,qBAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAClH,IAAI,GAAG,GAAG,qBAAa,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE3F,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACrG,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEvG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC"}