[ID-1139] add js bindings by decentralgabe · Pull Request #8 · worldcoin/idkit

decentralgabe · 2025-11-07T19:27:47Z

No description provided.

…of truth)

…ft-kotlin-js # Conflicts: # Cargo.lock # rust/core/Cargo.toml # rust/core/src/bridge.rs # rust/core/src/constraints.rs # rust/core/src/crypto.rs # rust/core/src/error.rs # rust/core/src/lib.rs # rust/core/src/types.rs # rust/core/src/verification.rs # rust/uniffi-bindings/src/lib.rs # rust/wasm/src/lib.rs

…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

socket-security · 2025-11-07T19:28:00Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: Happy DOM: VM Context Escape can lead to Remote Code Execution in npm `happy-dom` CVE: GHSA-37j7-fg3j-429f Happy DOM: VM Context Escape can lead to Remote Code Execution (CRITICAL) Affected versions: < 20.0.0 Patched version: 20.0.0 From: js/packages/core/package-lock.json → `npm/happy-dom@15.11.7` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/happy-dom@15.11.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: npm `happy-dom`'s `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript CVE: GHSA-qpm2-6cq5-7pq5 happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript (CRITICAL) Affected versions: < 20.0.2 Patched version: 20.0.2 From: js/packages/core/package-lock.json → `npm/happy-dom@15.11.7` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/happy-dom@15.11.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: npm `glob` CLI: Command injection via -c/--cmd executes matches with shell:true CVE: GHSA-5j98-mcp5-4vw2 glob CLI: Command injection via -c/--cmd executes matches with shell:true (HIGH) Affected versions: >= 11.0.0 < 11.1.0; >= 10.2.0 < 10.5.0 Patched version: 10.5.0 From: js/packages/core/package-lock.json → `npm/@vitest/coverage-v8@2.1.9` → `npm/tsup@8.5.0` → `npm/glob@10.4.5` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/glob@10.4.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

decentralgabe · 2025-11-07T23:28:28Z

js/packages/core/src/bridge.ts

+		// Ensure WASM is initialized
+		await initIDKit()
+
+		// Validate bridge URL (optional for v3)


now clear how best to handle the v3/2 switching @andy-t-wang

andy-t-wang · 2025-11-17T16:30:36Z

js/packages/core/examples/browser/index.html

+                statusDiv.style.display = 'block';
+                statusText.textContent = 'Creating verification request...';
+
+                await store.createClient({


I generally prefer example html files to just be barebones so it's easier to find relevant code from reading. No need for all the styling

andy-t-wang · 2025-11-17T16:33:30Z

js/packages/core/src/lib/hashing.ts

+export function packAndEncode(input: [string, unknown][]): HashFunctionOutput {
+	// For now, we'll convert to string representation
+	// TODO: Implement proper ABI encoding in WASM
+	const packed = input.map(([type, value]) => `${type}:${value}`).join(',')


I think this will break on chain verifications if not implemented properly

andy-t-wang · 2025-11-17T16:34:31Z

js/packages/core/src/lib/validation.ts

+	}
+
+	// Remove once restriction lifted in world app
+	if (!test_url.hostname.endsWith('.worldcoin.org') && !test_url.hostname.endsWith('.toolsforhumanity.com')) {


probably good to add world.org here too

andy-t-wang · 2025-11-17T16:35:03Z

js/packages/core/src/types/config.ts

+/**
+ * @deprecated in IDKit@1.0.0, use VerificationLevel instead
+ */
+export enum CredentialType {


good time to clean this up and get rid of it since we are going to 3.0 now

andy-t-wang · 2025-11-17T16:40:09Z

js/packages/core/wasm/idkit_wasm.js

+        let deferred2_0;
+        let deferred2_1;
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);


Are these functions auto generated or implemented. Otherwise good to have some tests here too

autogenerated

andy-t-wang · 2025-11-17T16:41:37Z

js/packages/core/README.md

+const store = useWorldBridgeStore()
+
+// 2. Create client - returns immutable client object
+const client = await store.createClient({


This is kind of similar to the session hook. But, I like it!
https://docs.world.org/world-id/id/web-react#session-hook

…-core-js-bindings-examples

Gabe Cohen and others added 30 commits October 30, 2025 20:18

let's see what claude can do

9b8dfea

more robust

91c2e80

clippy

88817c6

remove generated mobile code

9e54c19

use walletkit structure

5669d37

more like idkit-rs

3377b14

doc updates

72e04ba

Merge origin/main into full-implementation (accepting main as source …

cc9fabe

…of truth)

rebase

6971569

simpler

be6b262

doc updates

b933520

js wasm progress

0edef22

js impl

9dbc79f

simpler

806adcc

remove deprecated cred type

dbc30e4

more drop in

fa0c7bc

updates to match api

8f434a5

ci

986e2e8

Potential fix for code scanning alert no. 1: Workflow does not contai…

e652b19

…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Potential fix for code scanning alert no. 2: Workflow does not contai…

5d96902

…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

remove old tests

4012ede

formatting

8906a98

smoke tests

b77b0c5

update

ed9803e

update ci

7e87e9e

Merge branch 'main' into language-bindings-swift-kotlin-js

8d5b192

update wasm'

1475821

Merge origin/main favoring main branch changes

fb89e04

update ci

15f3ceb

Gabe Cohen and others added 2 commits November 7, 2025 11:09

Fix cargo formatting - add trailing newlines

4e43acc

Merge branch 'main' into language-bindings-swift-kotlin-js

e197ab9

decentralgabe requested review from SeanROlszewski, andy-t-wang and paolodamico as code owners November 7, 2025 19:27

decentralgabe and others added 7 commits November 7, 2025 11:33

Merge branch 'main' into gabe-id-1139-add-rust-core-js-bindings-examples

9c08f25

remove codeql

56d64f1

update v2/v3 api

b26bbfd

Merge branch 'main' into gabe-id-1139-add-rust-core-js-bindings-examples

b04faee

update lint

5473c1a

lints

8df303f

update

6e0bc26

decentralgabe commented Nov 7, 2025

View reviewed changes

Rename

c8bd897

andy-t-wang previously approved these changes Nov 17, 2025

View reviewed changes

Gabe Cohen added 4 commits November 24, 2025 11:24

Merge remote-tracking branch 'origin/main' into gabe-id-1139-add-rust…

cf347e5

…-core-js-bindings-examples

simplify styling

439821b

fix anbi encoding

ab106cb

pr feedback

99d16d2

decentralgabe dismissed andy-t-wang’s stale review via 99d16d2 November 24, 2025 23:00

andy-t-wang approved these changes Nov 24, 2025

View reviewed changes

decentralgabe merged commit e885359 into main Nov 24, 2025
8 checks passed

decentralgabe deleted the gabe-id-1139-add-rust-core-js-bindings-examples branch November 24, 2025 23:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ID-1139] add js bindings#8

[ID-1139] add js bindings#8
decentralgabe merged 44 commits intomainfrom
gabe-id-1139-add-rust-core-js-bindings-examples

decentralgabe commented Nov 7, 2025

Uh oh!

socket-security bot commented Nov 7, 2025 •

edited

Loading

Uh oh!

decentralgabe Nov 7, 2025

Uh oh!

andy-t-wang Nov 17, 2025

Uh oh!

andy-t-wang Nov 17, 2025

Uh oh!

andy-t-wang Nov 17, 2025

Uh oh!

andy-t-wang Nov 17, 2025

Uh oh!

andy-t-wang Nov 17, 2025

Uh oh!

decentralgabe Nov 24, 2025

Uh oh!

andy-t-wang Nov 17, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

decentralgabe commented Nov 7, 2025

Uh oh!

socket-security bot commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

socket-security bot commented Nov 7, 2025 •

edited

Loading