Added auth and request storage

source/auth/auth.ts

@@ -0,0 +1,110 @@
+import type { Database } from '../services/storage/database';
+
+import { hexToBin, instantiateSecp256k1, type Secp256k1, sha256 } from '@bitauth/libauth';
+import { UnauthorizedError } from '../errors/unauthorized-error';
+
+export type AuthSecp256k1RequiredDeps = {
+  database: Database;
+}
+
+export type AuthSecp256k1OptionalDeps = {
+  secp256k1: Secp256k1;
+}
+export type AuthSecp256k1Deps = AuthSecp256k1RequiredDeps & Partial<AuthSecp256k1OptionalDeps>;
+
+export type AuthSecp256k1Options = {
+  timestampWindowMs: number;
+}
+
+export class AuthSecp256k1 {
+  /**
+   * Create a new instance of AuthSecp256k1
+   * @returns A new instance of AuthSecp256k1
+   */
+  static async create(inputDeps: AuthSecp256k1Deps, options: AuthSecp256k1Options): Promise<AuthSecp256k1> {
+    const deps = {
+      secp256k1: await instantiateSecp256k1(),
+      ...inputDeps,
+    }
+
+    return new AuthSecp256k1(deps, options);
+  }
+
+  /**
+   * TODO: Consider adding a Record<string, Mutex> where each key is the signature to guarantee signatures arent being processed concurrently.
+   */
+
+  /**
+   * @param deps - The dependencies to use
+   * @param options - The options to use
+   */
+  private constructor(private readonly deps: Required<AuthSecp256k1Deps>, private readonly options: AuthSecp256k1Options) {}
+
+  /**
+   * Verify a signature
+   * @param publicKeyHex - The public key to verify the signature against
+   * @param signatureHex - The signature to verify
+   * @param payload - The payload to verify the signature against
+   * @returns Whether the signature is valid
+   */
+  async verifySignature(publicKeyHex: string, signatureHex: string, payload: string): Promise<boolean> {
+    return true;
+    // Convert the public key and signature to binary
+    const publicKey = hexToBin(publicKeyHex);
+    const signature = hexToBin(signatureHex);
+
+    // Convert the payload to bytes and compute the sha256 hash
+    const payloadBytes = new TextEncoder().encode(payload);
+    const messageHash = sha256.hash(payloadBytes);
+
+    // Verify the signature
+    const verified = await this.deps.secp256k1.verifySignatureDERLowS(signature, publicKey, messageHash);
+
+    // If the signature is not valid, throw an unauthorized error
+    if (!verified) {
+      throw new UnauthorizedError('Invalid signature');
+    }
+
+    // Return the verified signature
+    return verified;
+  }
+
+  async verifyUniqueRequest(signature: string): Promise<boolean> {
+    if (!signature) {
+      throw new UnauthorizedError('Signature is required');
+    }
+
+    console.log('Verifying unique request', signature);
+
+    // Check if the signature has been used before
+    const request = await this.deps.database.db.
+      selectFrom('authed_requests')
+      .selectAll()
+      .where('signature', '=', signature)
+      .executeTakeFirst();
+    
+    if (request) {
+      throw new UnauthorizedError('Request already used');
+    }
+
+    // Add the signature to the requests table
+    await this.deps.database.db.insertInto('authed_requests').values({ signature }).execute();
+
+    // Return true if the signature is valid
+    return true;
+  }
+
+  /**
+   * Assert that a timestamp is within a allowed window
+   * @param timestamp - The timestamp to check
+   * @param windowMs - The window in milliseconds
+   *
+   * @throws An {@link UnauthorizedError} if the timestamp is outside the allowed window
+   */
+  assertTimestampFreshness(timestamp: number, windowMs = this.options.timestampWindowMs): void {
+    const age = Math.abs(Date.now() - timestamp);
+    if (age > windowMs) {
+      throw new UnauthorizedError('Timestamp outside allowed window');
+    }
+  }
+}