@didtools/pkh-tezos - npm Package Compare versions

Comparing version 0.1.0 to 0.2.0

dist/verifier.d.ts

 import { Cacao, VerifyOptions, Verifiers } from '@didtools/cacao';
 export declare function getTezosVerifier(): Verifiers;
+export declare function getPkhfromPk(publicKey: string): string;
+export declare function verifySignature(payload: string, publicKey: string, signature: string): boolean;
 export declare function verifyTezosSignature(cacao: Cacao, options: VerifyOptions): void;

dist/verifier.js

@@ -1,4 +0,33 @@
-import { verifySignature, getPkhfromPk } from '@taquito/utils';
 import { SiwTezosMessage, verifyTimeChecks, assertSigned } from '@didtools/cacao';
 import { AccountId } from 'caip';
+import * as u8a from 'uint8arrays';
+import { hash } from '@stablelib/blake2b';
+import { hash as sha256 } from '@stablelib/sha256';
+import { verify } from '@stablelib/ed25519';
+// ED
+const TZ1Prefix = new Uint8Array([
+    6,
+    161,
+    159
+]);
+const TZ1Length = 20;
+const EDPKPrefix = new Uint8Array([
+    13,
+    15,
+    37,
+    217
+]);
+const EDSIGPrefix = new Uint8Array([
+    9,
+    245,
+    205,
+    134,
+    18
+]);
+const SIGPrefix = new Uint8Array([
+    4,
+    130,
+    43
+]);
+const Base58CheckSumLength = 4;
 export function getTezosVerifier() {
@@ -12,2 +41,46 @@ return {
 }
+export function getPkhfromPk(publicKey) {
+    const pkPrefix = publicKey.substring(0, 4);
+    if (pkPrefix !== 'edpk') throw new Error('Tezos Signature type not supported, only type tezos:ed25519');
+    const decoded = b58cdecode(publicKey, EDPKPrefix);
+    const hashed = hash(decoded, TZ1Length);
+    const result = b58cencode(hashed, TZ1Prefix);
+    return result;
+}
+function verifyEdSignature(decodedSig, bytesHash, decodedPublicKey) {
+    try {
+        return verify(decodedPublicKey, bytesHash, decodedSig);
+    } catch (e) {
+        return false;
+    }
+}
+//bs58btc decoding, bs58check - checksum
+function b58cdecode(enc, prefixArg) {
+    const u8akey = u8a.fromString(enc, 'base58btc');
+    return u8akey.slice(prefixArg.length, u8akey.length - Base58CheckSumLength);
+}
+//bs58check encoding, bs58btc + checksum
+function b58cencode(value, prefix) {
+    const n = new Uint8Array(prefix.length + value.length);
+    n.set(prefix);
+    n.set(value, prefix.length);
+    const checksum = getCheckSum(n);
+    const nc = new Uint8Array(n.length + 4);
+    nc.set(n);
+    nc.set(checksum, prefix.length + value.length);
+    return u8a.toString(nc, 'base58btc');
+}
+function getCheckSum(u8a) {
+    const hashed = sha256(sha256(u8a));
+    return hashed.slice(0, 4);
+}
+export function verifySignature(payload, publicKey, signature) {
+    const pkPrefix = publicKey.substring(0, 4);
+    const sigPrefix = signature.startsWith('sig') ? signature.substr(0, 3) : signature.substr(0, 5);
+    if (pkPrefix !== 'edpk' || !(sigPrefix === 'edsig' || sigPrefix === 'sig')) throw new Error('Tezos Signature type not supported, only type tezos:ed25519');
+    const decodedPublicKey = b58cdecode(publicKey, EDPKPrefix);
+    const decodedSig = b58cdecode(signature, sigPrefix === 'edsig' ? EDSIGPrefix : SIGPrefix);
+    const bytesHash = hash(u8a.fromString(payload, 'base16'), 32);
+    return verifyEdSignature(decodedSig, bytesHash, decodedPublicKey);
+}
 export function verifyTezosSignature(cacao, options) {
@@ -14,0 +87,0 @@ assertSigned(cacao);

package.json

 {
   "name": "@didtools/pkh-tezos",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "(Apache-2.0 OR MIT)",
@@ -18,2 +18,15 @@ "type": "module",
   "sideEffects": false,
+  "scripts": {
+    "build:clean": "del dist",
+    "build:js": "swc src -d ./dist --config-file ../../.swcrc",
+    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "build": "pnpm run build:clean && pnpm run build:types && pnpm run build:js",
+    "lint": "eslint src --fix",
+    "test": "node --experimental-vm-modules ../../node_modules/jest/bin/jest.js",
+    "test:ci": "pnpm run test --ci --coverage",
+    "prepare": "pnpm run build",
+    "prepublishOnly": "package-check",
+    "size": "./node_modules/.bin/size-limit",
+    "analyze": "./node_modules/.bin/size-limit --why"
+  },
   "repository": {
@@ -34,21 +47,16 @@ "type": "git",
   "devDependencies": {
+    "@taquito/signer": "^15.1.0",
+    "@taquito/taquito": "^15.1.0",
+    "@taquito/utils": "^15.1.0",
     "typescript": "^4.9.5"
   },
   "dependencies": {
-    "@didtools/cacao": "^2.0.0",
+    "@didtools/cacao": "workspace:^2.0.0",
+    "@stablelib/blake2b": "^1.0.1",
+    "@stablelib/ed25519": "^1.0.3",
     "@stablelib/random": "^1.0.2",
-    "@taquito/utils": "^15.1.0",
-    "caip": "^1.1.0"
-  },
-  "scripts": {
-    "build:clean": "del dist",
-    "build:js": "swc src -d ./dist --config-file ../../.swcrc",
-    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
-    "build": "pnpm run build:clean && pnpm run build:types && pnpm run build:js",
-    "lint": "eslint src --fix",
-    "test": "node --experimental-vm-modules ../../node_modules/jest/bin/jest.js",
-    "test:ci": "pnpm run test --ci --coverage",
-    "size": "./node_modules/.bin/size-limit",
-    "analyze": "./node_modules/.bin/size-limit --why"
+    "@stablelib/sha256": "^1.0.1",
+    "caip": "^1.1.0",
+    "uint8arrays": "^4.0.3"
   }
-}
+}

README.md

@@ -27,3 +27,3 @@ ## Tezos AuthMethod and Verifier
 const accountId = await getAccountId(tzProvider, address)
-const authMethod = await TezosWebAuth.getAuthMethod(tzProvider, accountId, publicKey)
+const authMethod = await TezosWebAuth.getAuthMethod(tzProvider, accountId)
 ```
@@ -30,0 +30,0 @@

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

19057

increased by17.45%

Lines of code

395

increased by23.44%

Worsened metrics

Dependency count

7

increased by75%

Dev dependency count

4

increased by300%

Dependency changes

• + Added@stablelib/blake2b@^1.0.1

• + Added@stablelib/ed25519@^1.0.3

• + Added@stablelib/sha256@^1.0.1

• + Addeduint8arrays@^4.0.3

• + Added@stablelib/sha256@1.0.1(transitive)

• - Removed@taquito/utils@^15.1.0

• - Removed@didtools/cacao@2.1.0(transitive)

• - Removed@didtools/codecs@1.0.1(transitive)

• - Removed@didtools/siwx@1.0.0(transitive)

• - Removed@ipld/dag-cbor@9.2.2(transitive)

• - Removed@taquito/utils@15.1.0(transitive)

• - Removed@types/bs58check@2.1.2(transitive)

• - Removed@types/node@22.13.4(transitive)

• - Removedbase-x@3.0.10(transitive)

• - Removedbase64-js@1.5.1(transitive)

• - Removedbignumber.js@9.1.2(transitive)

• - Removedblakejs@1.2.1(transitive)

• - Removedbn.js@4.12.1(transitive)

• - Removedbrorand@1.1.0(transitive)

• - Removedbs58@4.0.1(transitive)

• - Removedbs58check@2.1.2(transitive)

• - Removedbuffer@6.0.3(transitive)

• - Removedcborg@4.2.8(transitive)

• - Removedcipher-base@1.0.6(transitive)

• - Removedcodeco@1.4.3(transitive)

• - Removedcreate-hash@1.2.0(transitive)

• - Removedelliptic@6.6.1(transitive)

• - Removedhash-base@3.1.0(transitive)

• - Removedhash.js@1.1.7(transitive)

• - Removedhmac-drbg@1.0.1(transitive)

• - Removedieee754@1.2.1(transitive)

• - Removedinherits@2.0.4(transitive)

• - Removedmd5.js@1.3.5(transitive)

• - Removedminimalistic-assert@1.0.1(transitive)

• - Removedminimalistic-crypto-utils@1.0.1(transitive)

• - Removedmultiformats@11.0.213.3.2(transitive)

• - Removedreadable-stream@3.6.2(transitive)

• - Removedripemd160@2.0.2(transitive)

• - Removedsafe-buffer@5.2.1(transitive)

• - Removedsha.js@2.4.11(transitive)

• - Removedstring_decoder@1.3.0(transitive)

• - Removedtypedarray-to-buffer@4.0.0(transitive)

• - Removedundici-types@6.20.0(transitive)

• - Removedutil-deprecate@1.0.2(transitive)

• Updated@didtools/cacao@workspace:^2.0.0