Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 28 additions & 13 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,11 @@
"@babel/runtime": "7.x"
},
"dependencies": {
"@toruslabs/bs58": "^1.0.0",
"@noble/curves": "^2.0.1",
"@toruslabs/constants": "^16.0.0",
"@toruslabs/eccrypto": "^7.0.0",
"@noble/curves": "^2.0.1",
"@toruslabs/http-helpers": "^9.0.0",
"bs58": "^6.0.0",
"ethereum-cryptography": "^3.2.0",
"json-stable-stringify": "^1.3.0",
"loglevel": "^1.9.2"
Expand All @@ -41,6 +41,7 @@
"@toruslabs/eslint-config-typescript": "^5.0.0",
"@toruslabs/fetch-node-details": "^16.0.0",
"@toruslabs/torus-scripts": "^8.0.0",
"@types/bs58": "^5.0.0",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deprecated @types/bs58 added as unnecessary devDependency

Low Severity

The @types/bs58 package (v5.0.0) is deprecated and unnecessary — bs58 v6 ships its own type definitions. The lockfile even explicitly says: "This is a stub types definition. bs58 provides its own type definitions, so you do not need this installed." This adds a redundant dependency that could confuse future contributors.

Fix in Cursor Fix in Web

"@types/json-stable-stringify": "^1.2.0",
"@types/jsonwebtoken": "^9.0.10",
"@vitest/coverage-istanbul": "^4.0.17",
Expand Down
2 changes: 1 addition & 1 deletion src/helpers/keyUtils.ts
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import { mod } from "@noble/curves/abstract/modular.js";
import { bs58 } from "@toruslabs/bs58";
import { INodePub, KEY_TYPE } from "@toruslabs/constants";
import { Ecies, encrypt } from "@toruslabs/eccrypto";
import bs58 from "bs58";
import { keccak256 as keccakHash } from "ethereum-cryptography/keccak";
import { sha512 } from "ethereum-cryptography/sha512";
import stringify from "json-stable-stringify";
Expand Down
47 changes: 15 additions & 32 deletions src/helpers/nodeUtils.ts
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import { INodePub, KEY_TYPE, SIGNER_MAP, TORUS_NETWORK_TYPE } from "@toruslabs/constants";
import { generatePrivate, getPublic } from "@toruslabs/eccrypto";
import { generateJsonRPCObject, get, post } from "@toruslabs/http-helpers";
import { generateJsonRPCObject, post } from "@toruslabs/http-helpers";

import { config } from "../config";
import { JRPC_METHODS } from "../constants";
Expand Down Expand Up @@ -363,7 +363,7 @@ export async function retrieveOrImportShare(params: {
newImportedShares?: ImportedShare[];
checkCommitment?: boolean;
source?: string;
authorizationServerUrl?: string;
citadelServerUrl?: string;
}): Promise<TorusKey> {
const {
legacyMetadataHost,
Expand All @@ -385,37 +385,20 @@ export async function retrieveOrImportShare(params: {
serverTimeOffset,
checkCommitment = true,
source,
authorizationServerUrl,
citadelServerUrl,
} = params;
if (authorizationServerUrl) {
await post<void>(
authorizationServerUrl,
{
verifier,
verifier_id: verifierParams.verifier_id,
network,
client_id: clientId,
enable_gating: "true",
...(source ? { source } : {}),
},
{},
{ useAPIKey: true }
);
} else {
await get<void>(
`${SIGNER_MAP[network]}/api/allow`,
{
headers: {
verifier,
verifierid: verifierParams.verifier_id,
network,
clientid: clientId,
enablegating: "true",
},
},
{ useAPIKey: true }
);
}

await post<void>(
citadelServerUrl || `${SIGNER_MAP[network]}/api/allow`,
{
verifier,
verifier_id: verifierParams.verifier_id,
network,
client_id: clientId,
source: source || "torus-utils-web",
},
{}
);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Authorization POST request missing useAPIKey option

Medium Severity

The refactored post call to the citadel/allow endpoint no longer passes { useAPIKey: true } as the fourth argument. The previous code included this flag in both the POST and GET paths. Every other post call in metadataUtils.ts consistently passes { useAPIKey: true }. Without it, the API key set via Torus.setAPIKey() won't be sent with this request, which could cause authentication failures.

Fix in Cursor Fix in Web


// generate temporary private and public key that is used to secure receive shares
const sessionAuthKey = generatePrivate();
Expand Down
2 changes: 1 addition & 1 deletion src/interfaces.ts
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ export interface TorusCtorOptions {
serverTimeOffset?: number;
legacyMetadataHost?: string;
source?: string;
authorizationServerUrl?: string;
citadelServerUrl?: string;
}

export interface LegacyVerifierLookupResponse {
Expand Down
10 changes: 5 additions & 5 deletions src/torus.ts
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ class Torus {

private source?: string;

private authorizationServerUrl?: string;
private citadelServerUrl?: string;

constructor({
enableOneKey = false,
Expand All @@ -65,7 +65,7 @@ class Torus {
legacyMetadataHost,
keyType = KEY_TYPE.SECP256K1,
source,
authorizationServerUrl,
citadelServerUrl,
}: TorusCtorOptions) {
if (!clientId) throw new Error("Please provide a valid clientId in constructor");
if (!network) throw new Error("Please provide a valid network in constructor");
Expand All @@ -80,7 +80,7 @@ class Torus {
this.enableOneKey = enableOneKey;
this.legacyMetadataHost = legacyMetadataHost || (isLegacyNetwork(network) ? METADATA_MAP[network] : undefined);
this.source = source;
this.authorizationServerUrl = authorizationServerUrl;
this.citadelServerUrl = citadelServerUrl;
}

static enableLogging(v = true): void {
Expand Down Expand Up @@ -167,7 +167,7 @@ class Torus {
extraParams,
checkCommitment,
source: this.source,
authorizationServerUrl: this.authorizationServerUrl,
citadelServerUrl: this.citadelServerUrl,
});
}

Expand Down Expand Up @@ -251,7 +251,7 @@ class Torus {
extraParams,
checkCommitment,
source: this.source,
authorizationServerUrl: this.authorizationServerUrl,
citadelServerUrl: this.citadelServerUrl,
});
}

Expand Down
2 changes: 1 addition & 1 deletion test/sapphire_devnet_ed25519.test.ts
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import { faker } from "@faker-js/faker";
import { bs58 as base58 } from "@toruslabs/bs58";
import { TORUS_SAPPHIRE_NETWORK } from "@toruslabs/constants";
import { NodeDetailManager } from "@toruslabs/fetch-node-details";
import { default as base58 } from "bs58";
import { beforeEach, describe, expect, it } from "vitest";

import { bytesToHex, keccak256, utf8ToBytes } from "../src";
Expand Down
Loading