aboutsummaryrefslogtreecommitdiff
path: root/packages/taler-util/src/http-client/officer-account.ts
blob: 2c1426be2b8ba89c92d521ef1d221240211314b3 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
/*
 This file is part of GNU Taler
 (C) 2022-2024 Taler Systems S.A.

 GNU Taler is free software; you can redistribute it and/or modify it under the
 terms of the GNU General Public License as published by the Free Software
 Foundation; either version 3, or (at your option) any later version.

 GNU Taler is distributed in the hope that it will be useful, but WITHOUT ANY
 WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
 A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

 You should have received a copy of the GNU General Public License along with
 GNU Taler; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
 */

import {
  EncryptionNonce,
  LockedAccount,
  OfficerAccount,
  OfficerId,
  SigningKey,
  createEddsaKeyPair,
  decodeCrock,
  decryptWithDerivedKey,
  eddsaGetPublic,
  encodeCrock,
  encryptWithDerivedKey,
  getRandomBytesF,
  kdf,
  stringToBytes,
} from "@gnu-taler/taler-util";

/**
 * Restore previous session and unlock account with password
 *
 * @param salt string from which crypto params will be derived
 * @param key secured private key
 * @param password password for the private key
 * @returns
 */
export async function unlockOfficerAccount(
  account: LockedAccount,
  password: string,
): Promise<OfficerAccount> {
  const rawKey = decodeCrock(account);
  const rawPassword = stringToBytes(password);

  const signingKey = (await decryptWithDerivedKey(
    rawKey,
    rawPassword,
    password,
  ).catch((e: Error) => {
    throw new UnwrapKeyError(e.message);
  })) as SigningKey;

  const publicKey = eddsaGetPublic(signingKey);

  const accountId = encodeCrock(publicKey) as OfficerId;

  return { id: accountId, signingKey };
}

/**
 * Create new account (secured private key)
 * secured with the given password
 *
 * @param sessionId
 * @param password
 * @returns
 */
export async function createNewOfficerAccount(
  password: string,
  extraNonce: EncryptionNonce,
): Promise<OfficerAccount & { safe: LockedAccount }> {
  const { eddsaPriv, eddsaPub } = createEddsaKeyPair();

  const key = stringToBytes(password);

  const localRnd = getRandomBytesF(24);
  const mergedRnd: EncryptionNonce = extraNonce
    ? kdf(24, stringToBytes("aml-officer"), extraNonce, localRnd)
    : localRnd;

  const protectedPrivKey = await encryptWithDerivedKey(
    mergedRnd,
    key,
    eddsaPriv,
    password,
  );

  const signingKey = eddsaPriv as SigningKey;
  const accountId = encodeCrock(eddsaPub) as OfficerId;
  const safe = encodeCrock(protectedPrivKey) as LockedAccount;

  return { id: accountId, signingKey, safe };
}

export class UnwrapKeyError extends Error {
  public cause: string;
  constructor(cause: string) {
    super(`Recovering private key failed on: ${cause}`);
    this.cause = cause;
  }
}