{"version":3,"sources":["../../src/internal/keyless.ts"],"sourcesContent":["// Copyright © Endless\n// Copyright © Aptos Foundation\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * This file contains the underlying implementations for exposed API surface in\n * the {@link api/keyless}. By moving the methods out into a separate file,\n * other namespaces and processes can access these methods without depending on the entire\n * keyless namespace and without having a dependency cycle error.\n */\nimport { EndlessConfig } from \"../api/endlessConfig\";\nimport { postEndlessPepperService, postEndlessProvingService } from \"../client\";\nimport {\n  EphemeralSignature,\n  Groth16Zkp,\n  Hex,\n  KeylessPublicKey,\n  ZeroKnowledgeSig,\n  getKeylessConfig,\n} from \"../core\";\nimport { HexInput } from \"../types\";\nimport { EphemeralKeyPair, KeylessAccount, ProofFetchCallback } from \"../account\";\nimport { PepperFetchRequest, PepperFetchResponse, ProverRequest, ProverResponse } from \"../types/keyless\";\nimport { nowInSeconds } from \"../utils/helpers\";\n\nexport async function getPepper(args: {\n  endlessConfig: EndlessConfig;\n  jwt: string;\n  ephemeralKeyPair: EphemeralKeyPair;\n  uidKey?: string;\n  derivationPath?: string;\n}): Promise<Uint8Array> {\n  const { endlessConfig, jwt, ephemeralKeyPair, uidKey = \"sub\", derivationPath } = args;\n\n  const body = {\n    jwt_b64: jwt,\n    epk: ephemeralKeyPair.getPublicKey().bcsToHex().toStringWithoutPrefix(),\n    exp_date_secs: ephemeralKeyPair.expiryDateSecs,\n    epk_blinder: Hex.fromHexInput(ephemeralKeyPair.blinder).toStringWithoutPrefix(),\n    uid_key: uidKey,\n    derivation_path: derivationPath,\n  };\n  const { data } = await postEndlessPepperService<PepperFetchRequest, PepperFetchResponse>({\n    endlessConfig,\n    path: \"fetch\",\n    body,\n    originMethod: \"getPepper\",\n    overrides: { WITH_CREDENTIALS: false },\n  });\n  return Hex.fromHexInput(data.pepper).toUint8Array();\n}\n\nexport async function getProof(args: {\n  endlessConfig: EndlessConfig;\n  jwt: string;\n  ephemeralKeyPair: EphemeralKeyPair;\n  pepper: HexInput;\n  uidKey?: string;\n}): Promise<ZeroKnowledgeSig> {\n  const { endlessConfig, jwt, ephemeralKeyPair, pepper, uidKey = \"sub\" } = args;\n  if (Hex.fromHexInput(pepper).toUint8Array().length !== KeylessAccount.PEPPER_LENGTH) {\n    throw new Error(`Pepper needs to be ${KeylessAccount.PEPPER_LENGTH} bytes`);\n  }\n  const maxExpHorizonSecs = endlessConfig.maxExpHorizonSecs ?? (await getKeylessConfig({ endlessConfig })).maxExpHorizonSecs;\n  if (maxExpHorizonSecs < ephemeralKeyPair.expiryDateSecs - nowInSeconds()) {\n    throw Error(`The EphemeralKeyPair is too long lived.  It's lifespan must be less than ${maxExpHorizonSecs}`);\n  }\n  const json = {\n    jwt_b64: jwt,\n    epk: ephemeralKeyPair.getPublicKey().bcsToHex().toStringWithoutPrefix(),\n    epk_blinder: Hex.fromHexInput(ephemeralKeyPair.blinder).toStringWithoutPrefix(),\n    exp_date_secs: ephemeralKeyPair.expiryDateSecs,\n    exp_horizon_secs: maxExpHorizonSecs,\n    pepper: Hex.fromHexInput(pepper).toStringWithoutPrefix(),\n    uid_key: uidKey,\n  };\n\n  const { data } = await postEndlessProvingService<ProverRequest, ProverResponse>({\n    endlessConfig,\n    path: \"prove\",\n    body: json,\n    originMethod: \"getProof\",\n    overrides: { WITH_CREDENTIALS: false },\n  });\n\n  const proofPoints = data.proof;\n  const groth16Zkp = new Groth16Zkp({\n    a: proofPoints.a,\n    b: proofPoints.b,\n    c: proofPoints.c,\n  });\n  const nonMalleabilitySignature = ephemeralKeyPair.sign(groth16Zkp.hash());\n  const signedProof = new ZeroKnowledgeSig({\n    proof: groth16Zkp,\n    nonMalleabilitySignature,\n    trainingWheelsSignature: data.training_wheels_signature ? EphemeralSignature.fromHex(data.training_wheels_signature) : undefined,\n    expHorizonSecs: maxExpHorizonSecs,\n  });\n  return signedProof;\n}\n\nexport async function deriveKeylessAccount(args: {\n  endlessConfig: EndlessConfig;\n  jwt: string;\n  ephemeralKeyPair: EphemeralKeyPair;\n  pepper: HexInput;\n  uidKey?: string;\n  proofFetchCallback?: ProofFetchCallback;\n}): Promise<KeylessAccount> {\n  const { jwt, uidKey, proofFetchCallback, pepper } = args;\n  const proofPromise = getProof({ ...args });\n  // If a callback is provided, pass in the proof as a promise to KeylessAccount.create.  This will make the proof be fetched in the\n  // background and the callback will handle the outcome of the fetch.  This allows the developer to not have to block on the proof fetch\n  // allowing for faster rendering of UX.\n  //\n  // If no callback is provided, the just await the proof fetch and continue syncronously.\n  const proof = proofFetchCallback ? proofPromise : await proofPromise;\n\n  // Look up the original address to handle key rotations\n  const publicKey = KeylessPublicKey.fromJwtAndPepper({ jwt, pepper, uidKey });\n  // const address = await lookupOriginalAccountAddress({\n  //   endlessConfig,\n  //   authenticationKey: publicKey.authKey().derivedAddress(),\n  // });\n  const address = publicKey.authKey().derivedAddress();\n\n  const keylessAccount = KeylessAccount.create({ ...args, address, proof, pepper, proofFetchCallback });\n\n  return keylessAccount;\n}\n"],"mappings":"6QAyBA,eAAsBA,EAAUC,EAMR,CACtB,GAAM,CAAE,cAAAC,EAAe,IAAAC,EAAK,iBAAAC,EAAkB,OAAAC,EAAS,MAAO,eAAAC,CAAe,EAAIL,EAE3EM,EAAO,CACX,QAASJ,EACT,IAAKC,EAAiB,aAAa,EAAE,SAAS,EAAE,sBAAsB,EACtE,cAAeA,EAAiB,eAChC,YAAaI,EAAI,aAAaJ,EAAiB,OAAO,EAAE,sBAAsB,EAC9E,QAASC,EACT,gBAAiBC,CACnB,EACM,CAAE,KAAAG,CAAK,EAAI,MAAMC,EAAkE,CACvF,cAAAR,EACA,KAAM,QACN,KAAAK,EACA,aAAc,YACd,UAAW,CAAE,iBAAkB,EAAM,CACvC,CAAC,EACD,OAAOC,EAAI,aAAaC,EAAK,MAAM,EAAE,aAAa,CACpD,CAEA,eAAsBE,EAASV,EAMD,CAC5B,GAAM,CAAE,cAAAC,EAAe,IAAAC,EAAK,iBAAAC,EAAkB,OAAAQ,EAAQ,OAAAP,EAAS,KAAM,EAAIJ,EACzE,GAAIO,EAAI,aAAaI,CAAM,EAAE,aAAa,EAAE,SAAWC,EAAe,cACpE,MAAM,IAAI,MAAM,sBAAsBA,EAAe,aAAa,QAAQ,EAE5E,IAAMC,EAAoBZ,EAAc,oBAAsB,MAAMa,EAAiB,CAAE,cAAAb,CAAc,CAAC,GAAG,kBACzG,GAAIY,EAAoBV,EAAiB,eAAiBY,EAAa,EACrE,MAAM,MAAM,4EAA4EF,CAAiB,EAAE,EAE7G,IAAMG,EAAO,CACX,QAASd,EACT,IAAKC,EAAiB,aAAa,EAAE,SAAS,EAAE,sBAAsB,EACtE,YAAaI,EAAI,aAAaJ,EAAiB,OAAO,EAAE,sBAAsB,EAC9E,cAAeA,EAAiB,eAChC,iBAAkBU,EAClB,OAAQN,EAAI,aAAaI,CAAM,EAAE,sBAAsB,EACvD,QAASP,CACX,EAEM,CAAE,KAAAI,CAAK,EAAI,MAAMS,EAAyD,CAC9E,cAAAhB,EACA,KAAM,QACN,KAAMe,EACN,aAAc,WACd,UAAW,CAAE,iBAAkB,EAAM,CACvC,CAAC,EAEKE,EAAcV,EAAK,MACnBW,EAAa,IAAIC,EAAW,CAChC,EAAGF,EAAY,EACf,EAAGA,EAAY,EACf,EAAGA,EAAY,CACjB,CAAC,EACKG,EAA2BlB,EAAiB,KAAKgB,EAAW,KAAK,CAAC,EAOxE,OANoB,IAAIG,EAAiB,CACvC,MAAOH,EACP,yBAAAE,EACA,wBAAyBb,EAAK,0BAA4Be,EAAmB,QAAQf,EAAK,yBAAyB,EAAI,OACvH,eAAgBK,CAClB,CAAC,CAEH,CAEA,eAAsBW,EAAqBxB,EAOf,CAC1B,GAAM,CAAE,IAAAE,EAAK,OAAAE,EAAQ,mBAAAqB,EAAoB,OAAAd,CAAO,EAAIX,EAC9C0B,EAAehB,EAAS,CAAE,GAAGV,CAAK,CAAC,EAMnC2B,EAAQF,EAAqBC,EAAe,MAAMA,EAQlDE,EALYC,EAAiB,iBAAiB,CAAE,IAAA3B,EAAK,OAAAS,EAAQ,OAAAP,CAAO,CAAC,EAKjD,QAAQ,EAAE,eAAe,EAInD,OAFuBQ,EAAe,OAAO,CAAE,GAAGZ,EAAM,QAAA4B,EAAS,MAAAD,EAAO,OAAAhB,EAAQ,mBAAAc,CAAmB,CAAC,CAGtG","names":["getPepper","args","endlessConfig","jwt","ephemeralKeyPair","uidKey","derivationPath","body","Hex","data","postEndlessPepperService","getProof","pepper","KeylessAccount","maxExpHorizonSecs","getKeylessConfig","nowInSeconds","json","postEndlessProvingService","proofPoints","groth16Zkp","Groth16Zkp","nonMalleabilitySignature","ZeroKnowledgeSig","EphemeralSignature","deriveKeylessAccount","proofFetchCallback","proofPromise","proof","address","KeylessPublicKey"]}