{"_id":"@baaluo/rpc-auth","_rev":"3-c4eef46991bd51f8e7d569efe28aedd9","name":"@baaluo/rpc-auth","dist-tags":{"latest":"1.1.3"},"versions":{"1.1.1":{"name":"@baaluo/rpc-auth","description":"JSON-RPC 2.0 authentication using bears blockchain authorities","version":"1.1.1","license":"MIT","main":"./lib/index","typings":"./lib/index","scripts":{"test":"make ci-test","prepublish":"make lib"},"engines":{"node":">=8"},"dependencies":{"@baaluo/libcrypto":"^1.0.1"},"devDependencies":{"@types/mocha":"^2.2.47","@types/node":"^9.3.0","dbears":"^0.8.5","mocha":"^5.0.0","mocha-junit-reporter":"^1.16.0","node-fetch":"^1.7.3","nsp":"^3.1.0","nyc":"^11.4.1","ts-node":"^4.1.0","tslint":"^5.9.1","typescript":"^2.6.2"},"_id":"@baaluo/rpc-auth@1.1.1","_npmVersion":"6.4.1","_nodeVersion":"10.13.0","_npmUser":{"name":"baaluo","email":"b.hbigheart_2009@yahoo.com"},"dist":{"integrity":"sha512-KKyF4M75/LtezPQOCV392WdhHzZkb84ZCqI6vUApOdiwku4elHpGjripYIqlwjJUnMMzrPwKnonGYG7guS/bxw==","shasum":"918ac62e39f296af56854f0bf67a8865fe6b63f1","tarball":"https://registry.npmjs.org/@baaluo/rpc-auth/-/rpc-auth-1.1.1.tgz","fileCount":4,"unpackedSize":14554,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJcn9heCRA9TVsSAnZWagAALgEP/iU1o7GwkQ78DtwZTub+\n+94Tf8+cV/HeiMiiDuyeKQHmPV0fETNPeI6KeEPfVkdtYoMoGxvin5vl4MWd\nYL3BWlb8NY1m/midwPQpeSRDMcxpCKlfkl5YJSDxq/KTU2nd9RvInnoE6BDx\nVqbJ699ywIAz/zFaJFSxw/KSPINztUzpwzBn39jzBoxgdydGvq5f/4EKQAwe\n6MmzA3JDcbh2X6nYV1SxfLeDHwi2cZ3HmNtKmsEjaXtunT3HLI3l8VDtveY1\n6dKmJVAsWygdZw/lxNgAOuVqiOaSwSC9C85lPun4shnzRrDKyZ3K1x/umjB+\nwvC0yKn4k0pApJwHuQCELjHyPJszyRMsw1Zmkryg1rkh39g1rsKuytxM0HCA\noYnQI61q4hleexM5zDYZVD1PFZN0hDSezgVew0PBN5Jf2zhiD+7LyjcuXPN+\n225Lke+6Xs1YzvM4NJESW0UalZQkp6b0X6nFf0l+cSZ9/2/RBDiQcn/22zOq\nScAhvphQMf0p2aHoxZ2fmxWuaJuOSGvWM/Mag+rG+1plrFoOSwOZqCYnCR6Y\n8EIa5NDq7RmrbJqrzmIuogAZdkooZaKCflUSn0xHoF0+ABf2/FFTPXAQRH22\nlOijEMOjRDDwDmpcUqNlTExOmt/RBQwzzNvQmD+n9FoB4HdcAMMbPpea5itz\nbJNa\r\n=yAXV\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQD97EAb32qYJ306e+W+ctpoTnxv3kTHGn5eSAD3q80p0AIhAMzPenaUod9nKR7OgvxBr/bGHUl9fS57Icx6PZDUjnNm"}]},"maintainers":[{"name":"baaluo","email":"b.hbigheart_2009@yahoo.com"}],"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/rpc-auth_1.1.1_1553979486023_0.9971970539150756"},"_hasShrinkwrap":false},"1.1.2":{"name":"@baaluo/rpc-auth","description":"JSON-RPC 2.0 authentication using bears blockchain authorities","version":"1.1.2","license":"MIT","main":"./lib/index","typings":"./lib/index","scripts":{"test":"make ci-test","prepublish":"make lib"},"engines":{"node":">=8"},"dependencies":{"@baaluo/libcrypto":"^1.0.1"},"devDependencies":{"@types/mocha":"^2.2.47","@types/node":"^9.3.0","dbears":"^0.8.5","mocha":"^5.0.0","mocha-junit-reporter":"^1.16.0","node-fetch":"^1.7.3","nsp":"^3.1.0","nyc":"^11.4.1","ts-node":"^4.1.0","tslint":"^5.9.1","typescript":"^2.6.2"},"_id":"@baaluo/rpc-auth@1.1.2","_npmVersion":"6.4.1","_nodeVersion":"10.13.0","_npmUser":{"name":"baaluo","email":"b.hbigheart_2009@yahoo.com"},"dist":{"integrity":"sha512-I0Muvpqt5/44o6oQVwLMV3kpPaySYNLMhGsmwMTatQovf1vS0iEoZAOiTtr6uEF7pHnnU0M1AnK1xx2Poy/jig==","shasum":"20bd7bf52ce3fee4b54def7474bd5e4553fb84ac","tarball":"https://registry.npmjs.org/@baaluo/rpc-auth/-/rpc-auth-1.1.2.tgz","fileCount":4,"unpackedSize":14550,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJcn9iqCRA9TVsSAnZWagAAhd0P/R+erVJMhojljOU1/5b5\nQMRWgPJUdlXVVeFA1+0TbCc1PX016jrK86RoSManPKva17HP9iH1QYkhRXrh\nCAMs+YFGCi5ph5tbBr3dwhDsyPFkXY+B5U7mPD3jTEBVf6erfEBM8HMiqC34\nGnygQBlSX2Djdf4WUVj9S7KZZHm8N65ARHzd1wC7WZomnT6Lj/1VTR1u/PRr\nKVYMgcRfiOUATw3FDATchguPRQCCO52tfkBGRn2N5gUHB5iYYDEE5TQ+LE2p\nZV1mDs/sHN6v7jmpV4lTfPa+v6zXJsRyklF1Q8mDkxbrjX9kiWKu4k8YR0BZ\nub/9BsjmCC5bPr5NfPuNcfb1bLwK7N1h0oDGM3xhVvZ4cyVW8JYyQ08B6Xa5\nZirdDP7WZD5vDpoSPCLm6Q7EAgyIZFRAg+U6drOIKqajcy6ZGdER9H/qdxVV\n4vaIT5cAIyrHcE6CInEK2qK8/Af+UK3W452GV/4tZ2/rLAZNmkBT2xjmP1M8\nas4WEhPlATsPEftRe/xs0ULj/tGUBxeuQ19iEdu61+4Tda+18y6wLRxVDzy3\nEG3h8gyHmXFXOf4Aj/7HKD37svPrCEp8Xvuwn6pvcr67RrqIpc2bC7sXrdca\nxzzikKvDufWrqSsH1bGnpT18MF73eUkrBe+I6joSOplm8vX/Hezdopl+PsPN\nVyhW\r\n=AreS\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIFE1n7g2pskf434eF/MfC4+7YXnpYAizHW2lgAnHXlftAiEA2S+Cc+EAsZ/EOIGTvBCZ9TVWYo6hRSF21pTISjnyD00="}]},"maintainers":[{"name":"baaluo","email":"b.hbigheart_2009@yahoo.com"}],"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/rpc-auth_1.1.2_1553979561456_0.12833353374739365"},"_hasShrinkwrap":false},"1.1.3":{"name":"@baaluo/rpc-auth","description":"JSON-RPC 2.0 authentication using bears blockchain authorities","version":"1.1.3","license":"MIT","main":"./lib/index","typings":"./lib/index","scripts":{"test":"make ci-test","prepublish":"make lib"},"engines":{"node":">=8"},"dependencies":{"@baaluo/libcrypto":"^1.0.1"},"devDependencies":{"@types/mocha":"^2.2.47","@types/node":"^9.3.0","dbears":"^0.8.5","mocha":"^5.0.0","mocha-junit-reporter":"^1.16.0","node-fetch":"^1.7.3","nsp":"^3.1.0","nyc":"^11.4.1","ts-node":"^4.1.0","tslint":"^5.9.1","typescript":"^2.6.2"},"_id":"@baaluo/rpc-auth@1.1.3","_npmVersion":"6.4.1","_nodeVersion":"10.13.0","_npmUser":{"name":"baaluo","email":"b.hbigheart_2009@yahoo.com"},"dist":{"integrity":"sha512-W3OuW5W+AjTE7u0RGdfi3O2nGst3JWNCefvQzQmujJP6SR+QAi/+kh/WJbK4jAObAoEWci5BBz4Z0PsRJhrh1w==","shasum":"5bfe15b42c1070e8307df12aba5beb0478d97135","tarball":"https://registry.npmjs.org/@baaluo/rpc-auth/-/rpc-auth-1.1.3.tgz","fileCount":4,"unpackedSize":14546,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJcn9kcCRA9TVsSAnZWagAA1y4P/RlL0PVEZ6iVuMtNRn3v\nW+ImF8o3i19afiJOIajrNbTmgxZAvlgNP66kWDSL4jjVjMdPl1/AKYLADvf1\nEwmvRDmz3X0lLh2HYuvDoDlRGMCXNVLbY/CSsAHR/bRYsezuer9/9AjY70Jh\nBS9P/4oJ5rvBfXlch+/YP23RmZC2zB+zpsrbYAw8eEodCaA8cbz0OhhOCM5N\nZA/ZRTVXSwEwnYHtNZuZjYM7OdsD3/csUz16V0lb6LazG0yD4oZzX5g5he11\nIb4SaplziaiRcCM4fY+om2zz7A7lgaaTl+MHodg+qvu3LsFPj7FhYDqfw0fE\noaCTeMTZuZYkjtxtHJ6t5JUz16JkLnqCN8vDTQPjAOKtjcwrKerDBSp2g0v7\n+4zgVv7opc+S7FfNFc+Yc3YkA5wmEP0d4AMQyBYHTd3WUFs9Q1LhhndQWt5v\n2BnAbMPEHKi44ZFj4zq7oQalUZIb+9e59b7NY5x4MDUPEOHjGse4mBSpZrm+\nrNB9lrF4eAE6XgQoA9+RdM38MdBQRN6FgfOFM1XL0WLGj4FKP7GjcYA9aKQd\nPR2rnRI62RNblMhnbLEkQ7DCrsLjITH2b/bhu+I9rtWS0P2f2TM+IjX9Tc9l\nsBod9dtmlMvBBkoutfJ3C9duLqB95oLLzEizv8jdmdRVYWwCjgV4i7JaomSu\ne1cp\r\n=5U4O\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDSBBcbsXpr9XVHlisSUSpnFW3pWPgrrO0LxS0KCiArKAIgfttJ1XCDYv2FZrQIn2HqWytbEMOpg3kX5z/Pl/d1S4Y="}]},"maintainers":[{"name":"baaluo","email":"b.hbigheart_2009@yahoo.com"}],"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/rpc-auth_1.1.3_1553979676427_0.39951946134025285"},"_hasShrinkwrap":false}},"time":{"created":"2019-03-30T20:58:05.831Z","1.1.1":"2019-03-30T20:58:06.149Z","modified":"2022-04-04T17:24:38.212Z","1.1.2":"2019-03-30T20:59:21.669Z","1.1.3":"2019-03-30T21:01:16.526Z"},"maintainers":[{"name":"baaluo","email":"b.hbigheart_2009@yahoo.com"}],"description":"JSON-RPC 2.0 authentication using bears blockchain authorities","license":"MIT","readme":"\n@baaluo/rpc-auth\n=================\n\nJSONRPC 2.0 authentication with bears authorities\n\n\nSpecification\n-------------\n\n### Overview\n\nRequest signing for [JSON-RPC 2.0](http://www.jsonrpc.org/specification) implemented using [bears](https://bears.io) authorities.\n\n### Signed request\n\nRequests are signed with bears keys belonging to the sender.\n\nExample JSON-RPC request:\n```json\n{\n    \"jsonrpc\": \"2.0\",\n    \"id\": 123,\n    \"method\": \"foo.bar\",\n    \"params\": {\n        \"hello\": \"there\"\n    }\n}\n```\n\nAbove request signed with the posting key belonging to `foo`:\n```json\n{\n    \"jsonrpc\": \"2.0\",\n    \"method\": \"foo.bar\",\n    \"id\": 123,\n    \"params\": {\n        \"__signed\": {\n            \"account\": \"foo\",\n            \"nonce\": \"1773e363793b44c3\",\n            \"params\": \"eyJoZWxsbyI6InRoZXJlIn0=\",\n            \"signatures\": [\n                \"1f02df499f15c8757754c11251a6e5238296f56b17f7229202fce6ccd7289e224c49c32eaf77d5905e2b4d8a8a5ddcc215c51ce45c207ef0f038328200578d1bee\"\n            ],\n            \"timestamp\": \"2017-11-26T16:57:40.633Z\"\n        }\n    }\n}\n```\n\nSignature creation pseudocode:\n```python\n\n# JSON+Base64 request params\nparams = base64(json_encode(request['params']))\n\n# 8 byte nonce\nnonce = random_bytes(8)\n\n# ISO 8601 formatted timestamp\ntimestamp = date_now() # \"2017-11-26T16:57:40.633Z\"\n\n# Signer account name\naccount = 'foo'\n\n# Private posting key belonging to foo\nsigning_key = PrivateKey('...')\n\n# Signing constant K (sha256('bears_jsonrpc_auth'))\nK = bytes_from_hex('3b3b081e46ea808d5a96b08c4bc5003f5e15767090f344faab531ec57565136b')\n\n# first round of sha256\nfirst = sha256(timestamp + account + method + params)\n\n# message to be signed\nmessage = sha256(K + first + nonce)\n\n\nsignature = ecdsa_sign(message, signing_key)\n```\n\n### Signature validation\n\n  1. Entire request must be <64k for sanity/anti-DoS\n  1. Request must be valid json and json-rpc\n  1. `request['params']['__signed']` must exist\n  1. `request['params']['__signed']` must be the only item in `request['params']`\n  1. `request['params']['__signed']['params']` must be valid base64\n  1. `request['params']['__signed']['params']` when base64 decoded must be valid json\n  1. `request['params']['__signed']['nonce']` must exist and be a hex string of length 16 (8 bytes decoded)\n  1. `request['params']['__signed']['timestamp']` must exist and be a valid iso8601 datetime ending in Z\n  1. `request['params']['__signed']['timestamp']` must be within the last 60 seconds\n  1. `request['params']['__signed']['account']` must be a valid bears blockchain account\n  1. `request['params']['__signed']['signature']` must be a hex string >= 64 chars (32+ bytes decoded)\n  1. construct `first = sha256( request['params']['__signed']['timestamp'] + request['params']['__signed']['account'] + request['method'] + request['params']['__signed']['params'] ).bytes()`\n  1. construct `signedstring = sha256( K + first + unhexlify(nonce)).bytes()`\n  1. check signature, signedstring against posting authorities for `request['params']['__signed']['account']`\n","readmeFilename":"README.md"}