✨ Use hyli noir lib for check_jwt (#43)

Author: hhalex

hyli-wallet/bun.lock

@@ -24,8 +24,7 @@
     "peerDependencies": {
         "react": "^19.1.0",
         "react-dom": "^19.1.0",
-        "react-router-dom": "^7.6.1",
-        "hyli-noir": "^0.1.0"
+        "react-router-dom": "^7.6.1"
     },
     "scripts": {
         "clean": "rm -rf dist",
@@ -43,6 +42,7 @@
         "elliptic": "^6.6.1",
         "noir-jwt": "^0.4.5",
         "hyli": "^0.4.1",
+        "hyli-noir": "0.2.6",
         "js-sha3": "^0.9.3"
     },
     "devDependencies": {

hyli-wallet/package.json

@@ -1,14 +1,11 @@
 import React, { useState, useEffect } from "react";
-import { AuthCredentials, AuthProvider } from "../../providers/BaseAuthProvider";
+import { AuthProvider } from "../../providers/BaseAuthProvider";
 import { ProviderOption, useWalletInternal } from "../../hooks/useWallet";
-import { RegistrationStage, WalletErrorCallback, WalletEvent, WalletEventCallback } from "../../types/wallet";
+import { RegistrationStage, WalletEvent } from "../../types/wallet";
 import { getAuthErrorMessage } from "../../utils/errorMessages";
 import "./AuthForm.css";
 import { PasswordAuthCredentials } from "../../providers/PasswordAuthProvider";
 import type { GoogleAuthCredentials } from "../../providers/GoogleAuthProvider";
-import { bytesToBigInt, extractClaimsFromJwt, JWTCircuitHelper, pubkeyModulusFromJWK } from "../../utils/jwt";
-import { fetchGooglePublicKey } from "../../utils/google";
-import { Barretenberg, Fr } from "@aztec/bb.js";
 
 type AuthStage =
     | "idle" // Initial state, no authentication in progress
@@ -80,7 +77,7 @@ export const AuthForm: React.FC<AuthFormProps> = ({
     forceSessionKey,
     setLockOpen,
 }) => {
-    const { login, registerAccount: registerWallet, sessionKeyConfig, onWalletEvent, onError } = useWalletInternal();
+    const { login, registerAccount: registerWallet, onWalletEvent, onError } = useWalletInternal();
     const isLocalhost =
         typeof window !== "undefined" &&
         (window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1");
@@ -170,7 +167,7 @@ export const AuthForm: React.FC<AuthFormProps> = ({
         if (onError) onError(err);
     };
 
-    const handleGoogleSubmit = async (e: React.FormEvent) => {
+    const handleGoogleSubmit = async (_: React.FormEvent) => {
         try {
             setIsSubmitting(true);
             setStage("sending_blob");

hyli-wallet/src/components/auth/AuthForm.tsx

@@ -9,7 +9,6 @@ import {
     addSessionKeyBlob, // <- version corrigée ci-dessus
     WalletEventCallback,
     walletContractName,
-    build_check_jwt_blob,
 } from "../types/wallet"; // ajuste le chemin si besoin
 
 import { BlobTransaction } from "hyli"; // ajuste le chemin si besoin
@@ -18,11 +17,8 @@ import { IndexerService } from "../services/IndexerService";
 import { sessionKeyService } from "../services/SessionKeyService";
 
 import * as WalletOperations from "../services/WalletOperations";
-import { Barretenberg, Fr } from "@aztec/bb.js";
-import { bytesToBigInt, extractClaimsFromJwt, JWTCircuitHelper, register_contract } from "../utils/jwt";
-import { fetchGooglePublicKey } from "../utils/google";
-import { circuit } from "../utils/jwt_circuit";
-import { Blob } from "hyli";
+import { check_jwt } from "hyli-noir";
+import { fetchGooglePublicKeys } from "../utils/google";
 
 export interface GoogleAuthCredentials {
     username: string; // requis par AuthCredentials
@@ -167,14 +163,14 @@ export class GoogleAuthProvider implements AuthProvider<GoogleAuthCredentials> {
 
             onWalletEvent?.({ account, type: "checking_password", message: "Verifying Google identity…" });
 
-            const jwtBlobData = await this.buildCheckJwtBlob(credentials.googleToken, onError);
+            const { keys } = await fetchGooglePublicKeys();
+
+            const jwtBlobData = await check_jwt.build_blob_from_jwt(credentials.googleToken, keys);
 
             if (jwtBlobData instanceof Error) {
                 return { success: false, error: jwtBlobData.message };
             }
 
-            console.log("Blob0 data (stored_hash):", jwtBlobData.blob.data);
-
             const blob1 = verifyIdentityBlob(username, jwtBlobData.nonce);
 
             const blobTx: BlobTransaction = {
@@ -190,7 +186,7 @@ export class GoogleAuthProvider implements AuthProvider<GoogleAuthCredentials> {
                 blobTx.blobs.push(addSessionKeyBlob(username, newSessionKey.publicKey, expiration, whitelist));
             }
 
-            await register_contract(nodeService.client, circuit as any);
+            await check_jwt.register_contract(nodeService.client);
 
             onWalletEvent?.({ account, type: "sending_blob", message: `Sending blob transaction` });
             // Skipped, to make sure we send the proof alongside.
@@ -207,17 +203,15 @@ export class GoogleAuthProvider implements AuthProvider<GoogleAuthCredentials> {
             onWalletEvent?.({ account, type: "custom", message: `Generating proof of jwt` });
 
             // Generate proof using JWT circuit
-            const proof_tx = await JWTCircuitHelper.generateProofTx({
-                identity: account,
-                stored_hash: jwtBlobData.blob.data,
-                tx: txHash,
-                blob_index: 0,
-                tx_blob_count: 2,
-                idToken: credentials.googleToken,
-                jwtPubkey: jwtBlobData.pubkey,
-            });
-
-            console.log("Generated JWT proof:", proof_tx);
+            const proof_tx = await check_jwt.build_proof_transaction(
+                account,
+                jwtBlobData.blob.data,
+                txHash,
+                0,
+                2,
+                credentials.googleToken,
+                jwtBlobData.pubkey,
+            );
 
             await nodeService.client.sendProofTx(proof_tx);
 
@@ -243,47 +237,6 @@ export class GoogleAuthProvider implements AuthProvider<GoogleAuthCredentials> {
         }
     }
 
-    async buildCheckJwtBlob(
-        googleToken: string,
-        onError?: (error: Error) => void,
-    ): Promise<{ blob: Blob; nonce: number; mail_hash: Fr; pubkey: JsonWebKey } | Error> {
-        const { email, nonce, kid } = extractClaimsFromJwt(googleToken);
-
-        if (!email || !nonce || !kid) {
-            const error = "Invalid Google token: missing email, nonce, or kid";
-            onError?.(new Error(error));
-            return new Error(error);
-        }
-
-        // Get Google pubkey
-        const googleJWTPubkey = await fetchGooglePublicKey(kid);
-
-        let mail_hash: Fr = Fr.ZERO;
-
-        console.log("Computing mail_hash for email", email);
-        const bb = await Barretenberg.new();
-        console.log("selected_mail", email);
-        console.log("email byte array", new TextEncoder().encode(email));
-        console.log("email bigint:", bytesToBigInt(new TextEncoder().encode(email)));
-        mail_hash = await bb.poseidon2Hash([new Fr(bytesToBigInt(new TextEncoder().encode(email)))]).catch((err) => {
-            console.error("Error computing poseidon hash:", err);
-            throw err;
-        });
-
-        console.log("Computed mail_hash:", mail_hash);
-        console.log("mail_hash as bigint:", bytesToBigInt(mail_hash.value));
-        console.log("mail_hash as hex:", mail_hash.toString());
-
-        // Generate proof using JWT circuit
-
-        return {
-            nonce: parseInt(nonce, 10),
-            mail_hash,
-            pubkey: googleJWTPubkey,
-            blob: build_check_jwt_blob(mail_hash.value, nonce, googleJWTPubkey.n as string) as Blob,
-        };
-    }
-
     async register(params: RegisterAccountParams<GoogleAuthCredentials>): Promise<AuthResult> {
         console.log("[Hyli][Google] register() called");
         const nodeService = NodeService.getInstance();
@@ -318,7 +271,9 @@ export class GoogleAuthProvider implements AuthProvider<GoogleAuthCredentials> {
                 };
             }
 
-            const jwtBlobData = await this.buildCheckJwtBlob(googleToken, onError);
+            const { keys } = await fetchGooglePublicKeys();
+
+            const jwtBlobData = await check_jwt.build_blob_from_jwt(googleToken, keys);
 
             if (jwtBlobData instanceof Error) {
                 return { success: false, error: jwtBlobData.message };
@@ -330,7 +285,7 @@ export class GoogleAuthProvider implements AuthProvider<GoogleAuthCredentials> {
                 username,
                 jwtBlobData.nonce,
                 "",
-                { Jwt: { hash: Array.from(jwtBlobData.mail_hash.value) } },
+                { Jwt: { hash: jwtBlobData.mail_hash } },
                 inviteCode,
             );
 
@@ -347,7 +302,7 @@ export class GoogleAuthProvider implements AuthProvider<GoogleAuthCredentials> {
                 blobTx.blobs.push(addSessionKeyBlob(username, newSessionKey.publicKey, expiration, whitelist));
             }
 
-            await register_contract(nodeService.client, circuit as any);
+            await check_jwt.register_contract(nodeService.client);
 
             onWalletEvent?.({ account: identity, type: "sending_blob", message: `Sending blob transaction` });
             // Skipped, to make sure we send the proof alongside.
@@ -364,17 +319,15 @@ export class GoogleAuthProvider implements AuthProvider<GoogleAuthCredentials> {
             onWalletEvent?.({ account: identity, type: "custom", message: `Generating proof of jwt` });
 
             // Generate proof using JWT circuit
-            const proof_tx = await JWTCircuitHelper.generateProofTx({
+            const proof_tx = await check_jwt.build_proof_transaction(
                 identity,
-                stored_hash: jwtBlobData.blob.data,
-                tx: txHash,
-                blob_index: 0,
-                tx_blob_count: 3,
-                idToken: googleToken,
-                jwtPubkey: jwtBlobData.pubkey,
-            });
-
-            console.log("Generated JWT proof:", proof_tx);
+                jwtBlobData.blob.data,
+                txHash,
+                0,
+                3,
+                googleToken,
+                jwtBlobData.pubkey,
+            );
 
             await nodeService.client.sendProofTx(proof_tx);
 

hyli-wallet/src/providers/GoogleAuthProvider.ts

@@ -1,16 +1,4 @@
-export async function fetchGooglePublicKey(keyId: string) {
-    if (!keyId) {
-        return null;
-    }
-
+export async function fetchGooglePublicKeys<T extends JsonWebKey & { kid: string }>(): Promise<{ keys: T[] }> {
     const response = await fetch("https://www.googleapis.com/oauth2/v3/certs");
-    const keys = await response.json();
-
-    const key = keys.keys.find((key: { kid: string }) => key.kid === keyId);
-    if (!key) {
-        console.error(`Google public key with id ${keyId} not found`);
-        return null;
-    }
-
-    return key;
+    return await response.json();
 }