Skip to content

fix: replace publicKey with w3id #430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 14, 2025
Merged

fix: replace publicKey with w3id #430

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions platforms/evoting-api/src/controllers/SigningController.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,13 +93,13 @@ export class SigningController {
// Handle signed payload callback from eID Wallet
async handleSignedPayload(req: Request, res: Response) {
try {
const { sessionId, signature, publicKey, message } = req.body;
const { sessionId, signature, w3id, message } = req.body;

if (!sessionId || !signature || !publicKey || !message) {
if (!sessionId || !signature || !w3id || !message) {
const missingFields = [];
if (!sessionId) missingFields.push('sessionId');
if (!signature) missingFields.push('signature');
if (!publicKey) missingFields.push('publicKey');
if (!w3id) missingFields.push('w3id');
if (!message) missingFields.push('message');

return res.status(400).json({
Expand All @@ -112,7 +112,7 @@ export class SigningController {
const result = await this.ensureService().processSignedPayload(
sessionId,
signature,
publicKey,
w3id,
message
);

Expand Down
26 changes: 13 additions & 13 deletions platforms/evoting-api/src/services/SigningService.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ export interface SigningSession {
export interface SignedPayload {
sessionId: string;
signature: string;
publicKey: string;
w3id: string;
message: string;
}

Expand Down Expand Up @@ -112,7 +112,7 @@ export class SigningService {
return session;
}

async processSignedPayload(sessionId: string, signature: string, publicKey: string, message: string): Promise<SigningResult> {
async processSignedPayload(sessionId: string, signature: string, w3id: string, message: string): Promise<SigningResult> {
const session = await this.getSession(sessionId);

if (!session) {
Expand All @@ -128,7 +128,7 @@ export class SigningService {
}

try {
// 🔐 SECURITY ASSERTION: Verify that the publicKey matches the user's ename who created the session
// 🔐 SECURITY ASSERTION: Verify that the w3id matches the user's ename who created the session
try {
const { UserService } = await import('./UserService');
const userService = new UserService();
Expand All @@ -139,14 +139,14 @@ export class SigningService {
}

// Strip @ prefix from both enames before comparison
const cleanPublicKey = publicKey.replace(/^@/, '');
const cleanW3id = w3id.replace(/^@/, '');
const cleanUserEname = user.ename.replace(/^@/, '');

if (cleanPublicKey !== cleanUserEname) {
console.error(`🔒 SECURITY VIOLATION: publicKey mismatch!`, {
publicKey,
if (cleanW3id !== cleanUserEname) {
console.error(`🔒 SECURITY VIOLATION: w3id mismatch!`, {
w3id,
userEname: user.ename,
cleanPublicKey,
cleanW3id,
cleanUserEname,
sessionUserId: session.userId
});
Expand All @@ -160,18 +160,18 @@ export class SigningService {
this.notifySubscribers(sessionId, {
type: "security_violation",
status: "security_violation",
error: "Public key does not match the user who created this signing session",
error: "W3ID does not match the user who created this signing session",
sessionId
});

// Return success: false but don't throw error - let the wallet think it succeeded
return { success: false, error: "Public key does not match the user who created this signing session" };
return { success: false, error: "W3ID does not match the user who created this signing session" };
}

console.log(`✅ Public key verification passed: ${cleanPublicKey} matches ${cleanUserEname}`);
console.log(`✅ W3ID verification passed: ${cleanW3id} matches ${cleanUserEname}`);
} catch (error) {
console.error("Error during public key verification:", error);
return { success: false, error: "Failed to verify public key: " + (error instanceof Error ? error.message : "Unknown error") };
console.error("Error during w3id verification:", error);
return { success: false, error: "Failed to verify w3id: " + (error instanceof Error ? error.message : "Unknown error") };
}

// Verify the signature (basic verification for now)
Expand Down