trustplane-sdk 0.1.1 → 0.2.0

package/README.md

@@ -1,4 +1,4 @@
-# Trustplane JS SDK (v0.1)
+# Trustplane JS SDK (v0.2)
 
 Minimal SDK to generate Trustplane proof headers.
 
@@ -55,3 +55,22 @@ const out = client.sign({
   privateKey: '<private_key_b64url>'
 });
 ```
+
+## Blindfold verify (one call)
+
+```js
+const { blindfoldVerify } = require('trustplane-sdk');
+
+const res = await blindfoldVerify({
+  authBaseUrl: 'https://auth.trustplane.mergematter.io',
+  tenantId: 'new_tenant',
+  apiId: 'api_demo_2',
+  clientId: 'client_demo',
+  privateKey: '<private_key_b64url>',
+  method: 'GET',
+  path: '/orders',
+  body: '',
+});
+
+console.log(res.status, res.data);
+```

package/index.d.ts

@@ -30,6 +30,18 @@ export type SignOutput = {
 
 export function sign(input: SignInput): SignOutput;
 export function signAsync(input: SignInput): Promise<SignOutput>;
+export function blindfoldVerify(input: SignInput & {
+  authBaseUrl: string;
+  fetchFn?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+}): Promise<{
+  step: string;
+  status: number;
+  ok: boolean;
+  data: any;
+  verifyPayload?: any;
+  transcript?: string;
+  digest?: string;
+}>;
 
 export function createClient(input: {
   tenantId: string;
@@ -39,6 +51,18 @@ export function createClient(input: {
 }): {
   sign(input: Omit<SignInput, "tenantId" | "apiId" | "clientId" | "bucketSeconds">): SignOutput;
   signAsync(input: Omit<SignInput, "tenantId" | "apiId" | "clientId" | "bucketSeconds">): Promise<SignOutput>;
+  blindfoldVerify(input: Omit<SignInput, "tenantId" | "apiId" | "clientId" | "bucketSeconds"> & {
+    authBaseUrl: string;
+    fetchFn?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+  }): Promise<{
+    step: string;
+    status: number;
+    ok: boolean;
+    data: any;
+    verifyPayload?: any;
+    transcript?: string;
+    digest?: string;
+  }>;
 };
 
 export function fromFile(path: string): ReturnType<typeof createClient>;

package/index.js

@@ -198,12 +198,79 @@ function createClient({ tenantId, apiId, clientId, bucketSeconds }) {
       signProof({ tenantId, apiId, clientId, privateKey, method, path, body, bucketSeconds }),
     signAsync: ({ method, path, body, privateKey }) =>
       signProofAsync({ tenantId, apiId, clientId, privateKey, method, path, body, bucketSeconds }),
+    blindfoldVerify: async ({ authBaseUrl, method, path, body, privateKey, fetchFn }) =>
+      blindfoldVerify({ authBaseUrl, tenantId, apiId, clientId, privateKey, method, path, body, bucketSeconds, fetchFn }),
+  };
+}
+
+async function httpJSON(url, payload, fetchFn) {
+  const impl = fetchFn || (typeof fetch !== 'undefined' ? fetch : null);
+  if (!impl) {
+    throw new Error('fetch is required; provide fetchFn or run in an environment with global fetch');
+  }
+  const res = await impl(url, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(payload),
+  });
+  const text = await res.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch (err) {
+    data = { raw: text };
+  }
+  return { status: res.status, ok: res.ok, data };
+}
+
+async function blindfoldVerify({ authBaseUrl, tenantId, apiId, clientId, privateKey, method, path, body, bucketSeconds, fetchFn }) {
+  if (!authBaseUrl) throw new Error('authBaseUrl is required');
+  const signed = signProof({ tenantId, apiId, clientId, privateKey, method, path, body, bucketSeconds });
+  const base = String(authBaseUrl).replace(/\/+$/, '');
+  const start = await httpJSON(base + '/auth/blindfold/start', {
+    tenant_id: signed.verifyPayload.tenant_id,
+    api_id: signed.verifyPayload.api_id,
+    client_id: signed.verifyPayload.client_id,
+    method: signed.verifyPayload.method,
+    path: signed.verifyPayload.path,
+    body_hash: signed.verifyPayload.body_hash,
+    time_bucket: signed.verifyPayload.time_bucket,
+    nonce: signed.verifyPayload.nonce,
+  }, fetchFn);
+  if (!start.ok) {
+    return { step: 'start', ...start };
+  }
+  const evalRes = await httpJSON(base + '/oprf/full-evaluate', {
+    input_b64url: (start.data || {}).input_b64url,
+  }, fetchFn);
+  if (!evalRes.ok) {
+    return { step: 'evaluate', ...evalRes };
+  }
+  const finalize = await httpJSON(base + '/auth/blindfold/finalize', {
+    session_id: (start.data || {}).session_id,
+    output_b64url: (evalRes.data || {}).output_b64url,
+  }, fetchFn);
+  if (!finalize.ok) {
+    return { step: 'finalize', ...finalize };
+  }
+  const verifyPayload = Object.assign({}, signed.verifyPayload, {
+    proof_type: 'blindfold',
+    proof_payload: ((finalize.data || {}).verify_payload || {}).proof_payload || '',
+  });
+  const verify = await httpJSON(base + '/auth/verify', verifyPayload, fetchFn);
+  return {
+    step: 'verify',
+    ...verify,
+    verifyPayload,
+    transcript: signed.transcript,
+    digest: signed.digest,
   };
 }
 
 module.exports = {
   sign: signProof,
   signAsync: signProofAsync,
+  blindfoldVerify,
   createClient,
   fromFile,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustplane-sdk",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Trustplane SDK (JS) for generating request proof headers",
   "main": "index.js",
   "types": "index.d.ts",