taquito-remote-signer.ts

/**
 * @packageDocumentation
 * @module @taquito/remote-signer
 */
import { HttpBackend, HttpResponseError, STATUS_CODE } from '@taquito/http-utils';
import {
  b58cdecode,
  b58cencode,
  buf2hex,
  hex2buf,
  isValidPrefix,
  mergebuf,
  prefix,
  verifySignature,
  validateKeyHash,
  ValidationResult,
  invalidDetail,
} from '@taquito/utils';
import { hash } from '@stablelib/blake2b';
import toBuffer from 'typedarray-to-buffer';
import {
  BadSigningDataError,
  OperationNotAuthorizedError,
  PublicKeyVerificationError,
  SignatureVerificationError,
} from './errors';
import { Signer } from '@taquito/taquito';
import {
  InvalidSignatureError,
  InvalidKeyHashError,
  ProhibitedActionError,
  PublicKeyNotFoundError,
} from '@taquito/core';

interface PublicKeyResponse {
  public_key: string;
}

interface SignResponse {
  signature: string;
}

type curves = 'ed' | 'p2' | 'sp';

export interface RemoteSignerOptions {
  headers?: { [key: string]: string };
}

export { VERSION } from './version';

const pref = {
  ed: {
    pk: prefix['edpk'],
    sk: prefix['edsk'],
    pkh: prefix.tz1,
    sig: prefix.edsig,
  },
  p2: {
    pk: prefix['p2pk'],
    sk: prefix['p2sk'],
    pkh: prefix.tz3,
    sig: prefix.p2sig,
  },
  sp: {
    pk: prefix['sppk'],
    sk: prefix['spsk'],
    pkh: prefix.tz2,
    sig: prefix.spsig,
  },
};

export class RemoteSigner implements Signer {
  constructor(
    private pkh: string,
    private rootUrl: string,
    private options: RemoteSignerOptions = {},
    private http = new HttpBackend()
  ) {
    const pkhValidation = validateKeyHash(this.pkh);
    if (pkhValidation !== ValidationResult.VALID) {
      throw new InvalidKeyHashError(this.pkh, invalidDetail(pkhValidation));
    }
  }

  async publicKeyHash(): Promise<string> {
    return this.pkh;
  }

  private createURL(path: string) {
    // Trim trailing slashes because it is assumed to be included in path
    // the regex solution is prone to ReDoS. Please see: https://stackoverflow.com/questions/6680825/return-string-without-trailing-slash#comment124306698_6680877
    // We also got a CodeQL error for the regex based solution
    let rootUrl = this.rootUrl;
    while (rootUrl.endsWith('/')) {
      rootUrl = rootUrl.slice(0, -1);
    }
    return `${rootUrl}${path}`;
  }

  async publicKey(): Promise<string> {
    try {
      const { public_key } = await this.http.createRequest<PublicKeyResponse>({
        url: this.createURL(`/keys/${this.pkh}`),
        method: 'GET',
        headers: this.options.headers,
      });
      return public_key;
    } catch (ex) {
      if (ex instanceof HttpResponseError) {
        if (ex.status === STATUS_CODE.NOT_FOUND) {
          throw new PublicKeyNotFoundError(this.pkh, ex);
        }
      }
      throw ex;
    }
  }

  async secretKey(): Promise<string> {
    throw new ProhibitedActionError('Secret key cannot be exposed');
  }

  async sign(bytes: string, watermark?: Uint8Array) {
    try {
      let bb = hex2buf(bytes);
      if (typeof watermark !== 'undefined') {
        bb = mergebuf(watermark, bb);
      }
      const watermarkedBytes = buf2hex(toBuffer(bb));
      const { signature } = await this.http.createRequest<SignResponse>(
        {
          url: this.createURL(`/keys/${this.pkh}`),
          method: 'POST',
          headers: this.options.headers,
        },
        watermarkedBytes
      );
      const pref = signature.startsWith('sig')
        ? signature.substring(0, 3)
        : signature.substring(0, 5);

      if (!isValidPrefix(pref)) {
        throw new InvalidSignatureError(
          signature,
          invalidDetail(ValidationResult.NO_PREFIX_MATCHED) + ` from a remote signer.`
        );
      }

      const decoded = b58cdecode(signature, prefix[pref]);

      const pk = await this.publicKey();
      await this.verifyPublicKey(pk);
      const signatureVerified = verifySignature(watermarkedBytes, pk, signature);
      if (!signatureVerified) {
        throw new SignatureVerificationError(watermarkedBytes, signature);
      }

      return {
        bytes,
        sig: b58cencode(decoded, prefix.sig),
        prefixSig: signature,
        sbytes: bytes + buf2hex(toBuffer(decoded)),
      };
    } catch (ex) {
      if (ex instanceof HttpResponseError) {
        if (ex.status === STATUS_CODE.NOT_FOUND) {
          throw new PublicKeyNotFoundError(this.pkh, ex);
        } else if (ex.status === STATUS_CODE.FORBIDDEN) {
          throw new OperationNotAuthorizedError('Signing Operation not authorized', ex);
        } else if (ex.status === STATUS_CODE.BAD_REQUEST) {
          throw new BadSigningDataError(ex, bytes, watermark);
        }
      }
      throw ex;
    }
  }

  async verifyPublicKey(publicKey: string) {
    const curve = publicKey.substring(0, 2) as curves;
    const _publicKey = b58cdecode(publicKey, pref[curve].pk);

    const publicKeyHash = b58cencode(hash(_publicKey, 20), pref[curve].pkh);
    if (publicKeyHash !== this.pkh) {
      throw new PublicKeyVerificationError(publicKey, publicKeyHash, this.pkh);
    }
  }
}