uport - npm Package Compare versions

Comparing version 0.5.4 to 0.6.0-alpha-1

lib/Credentials.js

@@ -42,3 +42,3 @@ 'use strict';
    * import { Credentials, SimpleSigner } from 'uport'
-   * const networks = {  '0x94365e3b': { rpcUrl: 'https://private.chain/rpc', address: '0x0101.... }}
+   * const networks = {  '0x94365e3b': { rpcUrl: 'https://private.chain/rpc', registry: '0x0101.... }}
    * const setttings = { networks, address: '5A8bRWU3F7j3REx3vkJ...', signer: new SimpleSigner(process.env.PRIVATE_KEY)}
@@ -128,3 +128,3 @@ * const credentials = new Credentials(settings)
       } else {
-        payload.exp = new Date().getTime() + 600000;
+        payload.exp = Date().getTime() / 1000 + 600;
       }
@@ -188,3 +188,3 @@ return (0, _JWT.createJWT)(this.settings, _extends({}, payload, { type: 'shareReq' }));
           } else {
-            console.log('Challenge was not included in response');
+            throw new Error('Challenge was not included in response');
           }
@@ -254,3 +254,3 @@ } else {
       * @param    {String}            credential.claim       claim about subject single key value or key mapping to object with multiple values (ie { address: {street: ..., zip: ..., country: ...}})
-      * @param    {String}            credential.exp         time at which this claim expires and is no longer valid
+      * @param    {String}            credential.exp         time at which this claim expires and is no longer valid (seconds since epoch)
       * @return   {Promise<Object, Error>}                   a promise which resolves with a credential (JWT) or rejects with an error
@@ -257,0 +257,0 @@ */

lib/JWT.js

@@ -16,4 +16,17 @@ 'use strict';
 
+var _base64url = require('base64url');
+
+var _base64url2 = _interopRequireDefault(_base64url);
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
 var JOSE_HEADER = { typ: 'JWT', alg: 'ES256K' };
 
+function encodeSection(data) {
+  return _base64url2.default.encode(JSON.stringify(data));
+}
+
+var ENCODED_HEADER = encodeSection(JOSE_HEADER);
+
+var LEGACY_MS = 1000000000000;
 /**  @module uport-js/JWT */
@@ -40,3 +53,4 @@
 
-  var signingInput = (0, _jsontokens.createUnsignedToken)(JOSE_HEADER, _extends({}, payload, { iss: address, iat: new Date().getTime() }));
+  var signingInput = [ENCODED_HEADER, encodeSection(_extends({ iss: address, iat: Date.now() / 1000 }, payload))].join('.');
+
   return new Promise(function (resolve, reject) {
@@ -87,3 +101,6 @@ if (!signer) return reject(new Error('No Signer functionality has been configured'));
       if (verifier.verify(jwt)) {
-        if (payload.exp && payload.exp <= new Date().getTime()) {
+        if (payload.iat >= LEGACY_MS && payload.iat > Date.now() || payload.iat < LEGACY_MS && payload.iat > Date.now() / 1000) {
+          return reject(new Error('JWT not valid yet (issued in the future)'));
+        }
+        if (payload.exp && payload.exp >= LEGACY_MS && payload.exp <= Date.now() || payload.iat < LEGACY_MS && payload.exp <= Date.now() / 1000) {
           return reject(new Error('JWT has expired'));
@@ -90,0 +107,0 @@ }

package.json

 {
   "name": "uport",
-  "version": "0.5.4",
+  "version": "0.6.0-alpha-1",
   "description": "Library for interacting with uport profiles and attestations",
@@ -26,3 +26,3 @@ "main": "lib/index.js",
     "ethjs-util": "^0.1.3",
-    "jsontokens": "^0.6.5",
+    "jsontokens": "^0.7.6",
     "mnid": "^0.1.1",
@@ -29,0 +29,0 @@ "nets": "^3.2.0",

src/Credentials.js

@@ -19,3 +19,3 @@ import { createJWT, verifyJWT } from './JWT'
    * import { Credentials, SimpleSigner } from 'uport'
-   * const networks = {  '0x94365e3b': { rpcUrl: 'https://private.chain/rpc', address: '0x0101.... }}
+   * const networks = {  '0x94365e3b': { rpcUrl: 'https://private.chain/rpc', registry: '0x0101.... }}
    * const setttings = { networks, address: '5A8bRWU3F7j3REx3vkJ...', signer: new SimpleSigner(process.env.PRIVATE_KEY)}
@@ -92,3 +92,3 @@ * const credentials = new Credentials(settings)
     } else {
-      payload.exp = new Date().getTime() + 600000
+      payload.exp = Date().getTime() / 1000 + 600
     }
@@ -138,3 +138,3 @@ return createJWT(this.settings, {...payload, type: 'shareReq'})
         } else {
-          console.log('Challenge was not included in response')
+          throw new Error('Challenge was not included in response')
         }
@@ -200,3 +200,3 @@ } else {
   * @param    {String}            credential.claim       claim about subject single key value or key mapping to object with multiple values (ie { address: {street: ..., zip: ..., country: ...}})
-  * @param    {String}            credential.exp         time at which this claim expires and is no longer valid
+  * @param    {String}            credential.exp         time at which this claim expires and is no longer valid (seconds since epoch)
   * @return   {Promise<Object, Error>}                   a promise which resolves with a credential (JWT) or rejects with an error
@@ -203,0 +203,0 @@ */

src/JWT.js

@@ -1,6 +0,14 @@
-import { createUnsignedToken, TokenVerifier, decodeToken } from 'jsontokens'
+import { TokenVerifier, decodeToken } from 'jsontokens'
 import { isMNID, decode} from 'mnid'
+import base64url from 'base64url'
 
 const JOSE_HEADER = {typ: 'JWT', alg: 'ES256K'}
 
+function encodeSection (data) {
+  return base64url.encode(JSON.stringify(data))
+}
+
+const ENCODED_HEADER = encodeSection(JOSE_HEADER)
+
+const LEGACY_MS = 1000000000000
 /**  @module uport-js/JWT */
@@ -24,6 +32,6 @@
 export function createJWT ({address, signer}, payload) {
-  const signingInput = createUnsignedToken(
-    JOSE_HEADER,
-    {...payload, iss: address, iat: new Date().getTime()}
-  )
+  const signingInput = [ENCODED_HEADER,
+    encodeSection({iss: address, iat: ( Date.now() / 1000), ...payload })
+  ].join('.')
+
   return new Promise((resolve, reject) => {
@@ -68,3 +76,6 @@ if (!signer) return reject(new Error('No Signer functionality has been configured'))
       if (verifier.verify(jwt)) {
-        if (payload.exp && payload.exp <= new Date().getTime()) {
+        if ((payload.iat >=LEGACY_MS && payload.iat > Date.now()) || ( payload.iat < LEGACY_MS && payload.iat > Date.now() / 1000)) {
+          return reject(new Error('JWT not valid yet (issued in the future)'))
+        }
+        if (payload.exp && (payload.exp >=LEGACY_MS && payload.exp <= Date.now()) || (payload.iat < LEGACY_MS && payload.exp <= Date.now() / 1000)) {
           return reject(new Error('JWT has expired'))
@@ -71,0 +82,0 @@ }

tutorial/createcredential.js

@@ -20,4 +20,4 @@
   credentials.attest({
-    sub: '2opT3phRXKtkaqjv6LAyR9pqkVwADVECZwx',
-    exp: 1552046024213,
+    sub: '2ovkMrL4jxwRbr1ia9CUUMN5TddtBx9zKmN',
+    exp: 1552046024,
     claim: {'Custom Attestation' : 'Custom Value'}
@@ -35,4 +35,4 @@ }).then(function (att) {
 
-var server = app.listen(8081, function () {  
+var server = app.listen(8081, function () {
   console.log("Tutorial app running...")
 })

tutorial/tutorial.md

@@ -29,3 +29,3 @@ # Server-side Credentials
 
-When we hit the default route using `app.get('/')` we will call `credentials.attest()` in order to sign the credential. For the fields of the credential, the `sub` field is the subject. Set this to the uPort Id of the user that is supposed to receive the credential. For testing purposes this would be the uPort identity shown on the mobile app of the reader. The `exp` field is the expiry of the token, in Unix time. As `claim` field, put your own custom object. We have here `{'Custom Attestation' : 'Custom Value'}` as an example.
+When we hit the default route using `app.get('/')` we will call `credentials.attest()` in order to sign the credential. For the fields of the credential, the `sub` field is the subject. Set this to the uPort Id of the user that is supposed to receive the credential. For testing purposes this would be the uPort identity shown on the mobile app of the reader. The `exp` field is the expiry of the token, in Unix time (seconds precision). As `claim` field, put your own custom object. We have here `{'Custom Attestation' : 'Custom Value'}` as an example.
 
@@ -35,3 +35,3 @@ ```js
   sub: '2oVV33jifY2nPBLowRS8H7Rkh7fCUDN7hNb',
-  exp: 1552046024213,
+  exp: 1552046024,
   claim: {'Custom Attestation' : 'Custom Value'}
@@ -38,0 +38,0 @@ })

No alert changes

Improved metrics

Total package byte prevSize

1177586

increased by71.49%

Lines of code

35165

increased by79.45%

Dependency changes

• + Addedasn1.js@4.10.15.4.1(transitive)

• + Addedbase64url@3.0.1(transitive)

• + Addedjsontokens@0.7.8(transitive)

• + Addedkey-encoder@1.1.7(transitive)

• + Addedvalidator@7.2.0(transitive)

• - Removedbase64-url@1.3.3(transitive)

• - Removedbase64url@2.0.0(transitive)

• - Removedcrypto@0.0.3(transitive)

• - Removedjsontokens@0.6.5(transitive)

• Updatedjsontokens@^0.7.6