2f:T23f3,DKIM = { const DKIM = { /** * Canonicalize the message body according to * methods defined in RFC[XXXX] * @memberOf DKIM * @param {Buffer|String} message * @param {String} method - (simple|relaxed) * @throws {Error} If canonicalization method is unsupported * @return {String} */ processBody: function processBody(message, method) { method = method || "simple"; if (method !== "simple" && method !== "relaxed") { throw new Error( 'Canonicalization method "' + method + '" not supported' ); } // @see https://tools.ietf.org/html/rfc6376#section-3.4.3 if (method === "simple") { return message.toString("binary").replace(/(\r\n)+$/m, "") + "\r\n"; } // @see https://tools.ietf.org/html/rfc6376#section-3.4.4 if (method === "relaxed") { return ( message .toString("binary") // Ignore all whitespace at the end of lines. .replace(/[\x20\x09]+(?=\r\n)/g, "") // Reduce all sequences of WSP within a line to a single SP .replace(/[\x20\x09]+/g, " ") // Ignore all empty lines at the end of the message body. .replace(/(\r\n)+$/, "\r\n") ); } }, /** * Canonicalize the message header according to * methods defined in RFC[6376] * @memberOf DKIM * @param {Array} headers - Each header is formatted as `: ` * @param {Array} signHeaders * @param {String} method - (simple|relaxed) * @return {String} * @throws {Error} If canonicalization method is unsupported * @example * DKIM.processHeader( [ 'A: X', 'B : Y\t\r\n\tZ '], [ 'A' ], 'relaxed' ) */ processHeader: function processHeader(headers, signHeaders, method) { if (typeof signHeaders === "string") { method = signHeaders; signHeaders = null; } method = method || "simple"; if (method !== "simple" && method !== "relaxed") { throw new Error( 'Canonicalization method "' + method + '" not supported' ); } if (signHeaders != null) { // Clone this array so that newely added headers don't show up outsite this "processHeader" function // See https://tools.ietf.org/html/rfc5322#section-3.6 signHeaders = signHeaders.slice(); signHeaders.push("DKIM-Signature"); signHeaders.push("X-Google-DKIM-Signature"); signHeaders = signHeaders.map(function (header) { return header.toLowerCase(); }); // Remove duplicates // signHeaders = signHeaders.reduce((ac, val) => [...ac, ...ac.includes(val) ? [] : [val]], []) signHeaders = signHeaders.reduce(function (ac, val) { if (ac.indexOf(val) < 0) { ac.push(val); } return ac; }, []); // Sort elements of headers array using the "signHeaders" order var indexedHeaders = headers.map(function (header) { var key = header.slice(0, header.indexOf(":")).trim().toLowerCase(); var idx = signHeaders.indexOf(key); return { idx, header }; }); headers = indexedHeaders .filter(function (h) { return h.idx > -1; }) .sort(function (h1, h2) { return h1.idx - h2.idx; }) .map(function (h) { return h.header; }); // headers = headers.filter( function( header ) { // var key = header.slice( 0, header.indexOf( ':' ) ).trim().toLowerCase() // return signHeaders.indexOf( key ) !== -1 // }) } if (method === "simple") { return headers.join("\r\n"); } // TODO: Something's not right here... // relaxed signatures still don't verify if (method === "relaxed") { return headers .map(function (line) { var lines = {}; var colon = line.indexOf(":"); var value = line.slice(colon); // Convert all header field names to lowercase var key = line.slice(0, colon).toLowerCase(); // Unfold all header field continuation lines value = value.replace(/\r\n(?=[\x20\x09])/g, ""); // Convert all sequences of one or more WSP characters to a single SP value = value.replace(/[\x20\x09]+/g, " "); // Devare all WSP characters at the end of each unfolded header field value = value.replace(/[\x20\x09]+$/g, ""); // Remove signature value for "dkim-signature" header if (/^(dkim-signature|x-google-dkim-signature)/i.test(key)) { value = value.replace(/ b=([^;]*)/, " b="); } if (key === "x-google-dkim-signature") { key = key.replace("x-google-dkim-signature", "dkim-signature"); } // Remove any WSP characters remaining before and after the colon return (key + value).replace(/[\x20\x09]*[:][\x20\x09]*/, ":"); }) .join("\r\n"); } }, /** * Verify a message signature * @memberOf DKIM * @param {Buffer} body * @param {Array} headers * @param {Function} callback */ verifySignature: async function verifySignature(body, headers, key) { var signature = null; // NOTE: result.status counts only if verified is not true var result = { verified: false, status: DKIM.NONE, error: null, signature: null, key: null }; if (!/^(DKIM-Signature|X-Google-DKIM-Signature)/i.test(headers[0])) { throw new Error("Missing DKIM-Signature"); } signature = result.signature = DKIM.Signature.parse( headers[0].slice(headers[0].indexOf(":") + 1) ); // Truncate body to defined length body = signature.length != null ? body.slice(0, signature.length) : body; result.key = key; var message = DKIM.processBody( body, signature.canonical.split("/").pop() ); var processedHeader = DKIM.processHeader( headers, signature.headers, signature.canonical.split("/").shift() ); const encoder = new TextEncoder(); const { digest } = await sha256.digest(encoder.encode(message)); const hash = base64pad.baseEncode(digest); // if (digest.compare(signature.hash) !== 0) { // result.error = new Error("Body hash did not verify"); // result.error.code = result.status = DKIM.PERMFAIL; // return callback(error, result); // } var verified = false; var pubKey = "-----BEGIN PUBLIC KEY-----\n" + key.key.toString("base64") + "\n-----END PUBLIC KEY-----"; result.processedHeader = processedHeader; verified = await key.verify( new TextEncoder().encode(processedHeader), Signature.create(RSA.signatureCode, signature.signature) ); result.verified = verified; result.status = result.verified ? DKIM.OK : DKIM.PERMFAIL; if (verified !== true) { result.error = new Error("Signature did not verify"); result.error.code = result.status = DKIM.PERMFAIL; return result; } return result; }, /** * Verify a message's signatures * @memberOf DKIM * @param {Buffer} message * @param {Function} callback * @throws {Error} If input is not a buffer */ verify: async function verify(message, key) { var boundary = message.indexOf("\r\n\r\n"); if (boundary === -1) { throw new Error("No header boundary found"); } var header = message.slice(0, boundary); var body = message.slice(boundary + 4); var results = []; var signatures = []; header.split(/\r\n(?=[^\x20\x09]|$)/g).forEach(function (h, i, headers) { // ISSUE: executing line below, may result in including a different 'DKIM-Signature' header // signatures.push( headers.slice( i ) ) // FIX: after slicing, remove any included 'DKIM-Signature' header that differ from "oneHeader" if (isDKIM(h)) { // remove DKIM headers const sigHeaders = headers.filter((v) => !isDKIM(v)); // add one DKIM header sigHeaders.unshift(h); signatures.push(sigHeaders); } }); async function verifyNextSignature() { while (true) { var headers = signatures.pop(); if (headers == null) { break; } const result = await DKIM.verifySignature(body, headers, key); results.push(result); } return results; } return verifyNextSignature(); }, Signature: DKIMSignature }; const isDKIM = (v) => /^(DKIM-Signature|X-Google-DKIM-Signature)/.test(v); /** @type {String} */ DKIM.NONE = "NONE"; /** @type {String} */ DKIM.OK = "OK"; /** @type {String} */ DKIM.TEMPFAIL = "TEMPFAIL"; /** @type {String} */ DKIM.PERMFAIL = "PERMFAIL"; return DKIM; }30:T521,class DKIMKey { static parse(source) { const data = parseTXTRecordValue(source); if (data.k.toLowerCase() === "rsa") { // We take 24 bytes here because we need to unpack SPKI const bytes = base64.baseDecode(data.p).slice(24); const key = varint.tagWith(0x1205, bytes); const verifier = RSA.Verifier.decode(key); return new DKIMKey(data, verifier); } else { throw new Error(`Unsupported key type ${data.k}`); } } constructor(data, verifier) { this.data = data; this.verifier = verifier; } did() { return this.verifier.did(); } verify(payload, signature) { return this.verifier.verify(payload, signature); } withDID(did) { return this.verifier.withDID(did); } toDIDKey() { return this.verify.toDIDKey(); } get code() { return this.verifier.code; } get signatureCode() { return this.verifier.signatureCode; } get signatureAlgorithm() { return this.verifier.signatureAlgorithm; } get version() { return this.data.v; } get type() { return this.data.k; } get notes() { return this.data.n; } get hash() { return this.data.h; } get flags() { return this.data.t; } get granularity() { return this.data.g; } get key() { return this.data.p; } }31:Tbc7,DKIMCanonicalizer = { /** *

DKIM canonicalization functions

* * @memberOf dkimsign * @private */ var DKIMCanonicalizer = { /** *

Simple body canonicalization by rfc4871 #3.4.3

* * @param {String} body E-mail body part * @return {String} Canonicalized body */ simpleBody: function (body) { return (body || "").toString().replace(/(?:\r?\n|\r)*$/, "\r\n"); }, /** *

Relaxed body canonicalization by rfc4871 #3.4.4

* * @param {String} body E-mail body part * @return {String} Canonicalized body */ relaxedBody: function (body) { return (body || "") .toString() .replace(/\r?\n|\r/g, "\n") .split("\n") .map(function (line) { return line .replace(/\s*$/, "") //rtrim .replace(/\s+/g, " "); // only single spaces }) .join("\n") .replace(/\n*$/, "\n") .replace(/\n/g, "\r\n"); }, /** *

Relaxed headers canonicalization by rfc4871 #3.4.2 with filtering

* * @param {String} body E-mail headers part * @return {String} Canonicalized headers */ relaxedHeaders: function (headers, fieldNames) { var includedFields = (fieldNames || "") .toLowerCase() .split(":") .map(function (field) { return field.trim(); }), headerFields = {}, headerLines = headers.split(/\r?\n|\r/), line, i; // join lines for (i = headerLines.length - 1; i >= 0; i--) { if (i && headerLines[i].match(/^\s/)) { headerLines[i - 1] += headerLines.splice(i, 1); } else { line = DKIMCanonicalizer.relaxedHeaderLine(headerLines[i]); // on multiple values, include only the first one (the one in the bottom of the list) if ( includedFields.indexOf(line.key) >= 0 && !(line.key in headerFields) ) { headerFields[line.key] = line.value; } } } headers = []; for (i = includedFields.length - 1; i >= 0; i--) { if (!headerFields[includedFields[i]]) { includedFields.splice(i, 1); } else { headers.unshift( includedFields[i] + ":" + headerFields[includedFields[i]] ); } } return { headers: headers.join("\r\n") + "\r\n", fieldNames: includedFields.join(":") }; }, /** *

Relaxed header canonicalization for single header line

* * @param {String} line Single header line * @return {String} Canonicalized header line */ relaxedHeaderLine: function (line) { var value = line.split(":"), key = (value.shift() || "").toLowerCase().trim(); value = value.join(":").replace(/\s+/g, " ").trim(); return { key: key, value: value }; } }; return DKIMCanonicalizer; }32:[{"id":"e50dce62ec8fc0edad4007f11d9c6ce2aac6c516de49682ba69762748e757792df96b8899cf175e7c5f100f3c6d01e1ebdc2ac1dca2f2733bbcffe78af71a8a9","href":"https://static.observableusercontent.com/files/e50dce62ec8fc0edad4007f11d9c6ce2aac6c516de49682ba69762748e757792df96b8899cf175e7c5f100f3c6d01e1ebdc2ac1dca2f2733bbcffe78af71a8a9","name":"authorization.eml","type":"message/rfc822","lastModified":1676790312251.748,"size":5505},{"id":"640fa9cc2465d96c476bf33d99ce141caaf9cacd9dbfc4def8fd51f6960defb2d98504d888323298c05750e8c460594d4f3491a699e63f7aa9f3b22111cbf206","href":"https://static.observableusercontent.com/files/640fa9cc2465d96c476bf33d99ce141caaf9cacd9dbfc4def8fd51f6960defb2d98504d888323298c05750e8c460594d4f3491a699e63f7aa9f3b22111cbf206","name":"auth2.eml","type":"message/rfc822","lastModified":1676790312251.748,"size":6580}] 2d:{"title":"DKIM Exploration","cells":[{"id":0,"value":"# DKIM Exploration","pinned":false,"hidden":false,"mode":"md"},{"id":432,"value":"authMessage.text()","pinned":true,"hidden":false,"mode":"ojs"},{"id":120,"value":"authMessage = FileAttachment(\"authorization.eml\")","pinned":false,"hidden":false,"mode":"ojs"},{"id":124,"value":"message = parseEmailBody(await authMessage.text())","pinned":true,"hidden":false,"mode":"ojs"},{"id":177,"value":"keys = await resolveDomainKey(message.dkim)","pinned":true,"hidden":false,"mode":"ojs"},{"id":324,"value":"key = keys[0]","pinned":true,"hidden":false,"mode":"ojs"},{"id":392,"value":"dkim = Object.fromEntries(\n message.headers[\"DKIM-Signature\"]\n .split(\";\")\n .map((line) => line.trim())\n .map((field) => [\n field.slice(0, field.indexOf(\"=\")),\n field.slice(field.indexOf(\"=\") + 1)\n ])\n)","pinned":false,"hidden":false,"mode":"ojs"},{"id":607,"value":"sig = Signature.create(RSA.signatureCode, message.dkim.signature)","pinned":true,"hidden":false,"mode":"ojs"},{"id":365,"value":"dkimPayload = formatDKIMPayload(message)","pinned":true,"hidden":false,"mode":"ojs"},{"id":580,"value":"key.key.verify(new TextEncoder().encode(dkimPayload), sig)","pinned":true,"hidden":false,"mode":"ojs"},{"id":359,"value":"formatDKIMPayload = (message) => {\n // @see https://www.rfc-editor.org/rfc/rfc6376#section-3.4\n // this well convert all header keys into lower case as per\n // https://www.rfc-editor.org/rfc/rfc6376#section-3.4.2\n const headers = new Headers(message.headers);\n const used = new Set();\n const content = [];\n for (const name of message.dkim.headers) {\n if (!used.has(name)) {\n used.add(name);\n const value = headers.get(name);\n\n if (value) {\n content.push(`${name}:${value.replace(/\\s+/g, \" \").trim()}`);\n }\n }\n }\n\n const key = \"dkim-signature\";\n const value = headers.get(key);\n content.push(`${key}:${value.slice(0, value.indexOf(\"b=\") + 2)}`);\n\n return content.join(\"\\r\\n\");\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":689,"value":"$2f","pinned":true,"hidden":false,"mode":"ojs"},{"id":613,"value":"key.key.verifier.publicKey","pinned":true,"hidden":false,"mode":"ojs"},{"id":371,"value":"dkimPayloadBytes = new TextEncoder().encode(dkimPayload)","pinned":true,"hidden":false,"mode":"ojs"},{"id":374,"value":"multihash = sha256.digest(dkimPayloadBytes)","pinned":true,"hidden":false,"mode":"ojs"},{"id":385,"value":"actualHash = base64pad.baseEncode(multihash.digest)","pinned":true,"hidden":false,"mode":"ojs"},{"id":388,"value":"expectHash = base64pad.baseEncode(message.dkim.hash)","pinned":true,"hidden":false,"mode":"ojs"},{"id":170,"value":"resolveDomainKey = async ({ selector, domain }) => {\n const TXT = 16;\n const query = new URLSearchParams({\n name: `${selector}._domainkey.${domain}`,\n type: TXT\n });\n const url = new URL(`https://cloudflare-dns.com/dns-query?${query}`);\n const response = await fetch(url.href, {\n headers: {\n accept: \"application/dns-json\"\n }\n });\n\n const { Answer } = await response.json();\n return Answer.map((record) => ({\n ...record,\n // If your provider gave you the DKIM record and it included double quotes around\n // the record, or backslashes before semi-colons in the record, you may safely remove\n // them.\n // @see https://support.dnsimple.com/articles/dkim-record/#quotes-and-slashes\n key: DKIMKey.parse(record.data.replaceAll(`\"`, \"\").replaceAll(`\\\\`, \"\"))\n }));\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":128,"value":"parseEmailBody = (source) => {\n const delimiter = source.match(/^\\r?\\n|(?:\\r?\\n){2}/);\n\n const input = {\n headers: delimiter ? source.substr(0, delimiter.index) : \"\",\n body: delimiter\n ? source.substr(delimiter.index + delimiter[0].length)\n : source\n };\n\n const headers = HeaderParser.parseHeaders(input.headers);\n\n return {\n source: input,\n headers,\n ...(headers[\"DKIM-Signature\"]\n ? { dkim: DKIMSignature.parse(headers[\"DKIM-Signature\"]) }\n : {})\n };\n}","pinned":true,"hidden":false,"mode":"ojs"},{"id":273,"value":"parseTXTRecordValue = (source) => {\n // If your provider gave you the DKIM record and it included double quotes around\n // the record, or backslashes before semi-colons in the record, you may safely remove\n // them.\n // @see https://support.dnsimple.com/articles/dkim-record/#quotes-and-slashes\n const content = source.replace(/\\r|\\n|\\s|\\\"|\\\\/g, \"\");\n return Object.fromEntries(\n content.split(\";\").map((attribute) => attribute.split(\"=\"))\n );\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":289,"value":"$30","pinned":false,"hidden":false,"mode":"ojs"},{"id":506,"value":"$31","pinned":false,"hidden":false,"mode":"ojs"},{"id":166,"value":"DKIMSignature = import(\"https://cdn.skypack.dev/dkim-signature\")","pinned":true,"hidden":false,"mode":"ojs"},{"id":65,"value":"viewof email = Inputs.email()","pinned":false,"hidden":false,"mode":"ojs"},{"id":97,"value":"md`Confirm Authorization`","pinned":false,"hidden":false,"mode":"ojs"},{"id":67,"value":"account = new AuthorizationSigner(toMailtoDID(email))","pinned":true,"hidden":false,"mode":"ojs"},{"id":71,"value":"toMailtoDID = (source) => {\n const offset = source.indexOf(\"@\");\n const user = source.slice(0, offset);\n const domain = source.slice(offset + 1);\n if (user.length > 0 && domain.length > 0 && domain.includes(\".\")) {\n return `did:mailto:${domain}:${user}`;\n } else {\n return null;\n }\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":87,"value":"formatMaltoURL = (authorization) => {\n const subject = `I am signing ipfs://${authorization.cid} to grant access to this account`;\n const [, , domain, user] = authorization.issuer.did().split(\":\");\n return new URL(\n `mailto:${user}+ucan@${domain}?subject=${subject}`\n );\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":14,"value":"spaceDelegation = delegate({\n issuer: space,\n audience: account,\n capabilities: [\n {\n with: \"ucan:*\",\n can: \"*\"\n }\n ],\n expiration: Infinity\n})","pinned":false,"hidden":false,"mode":"ojs"},{"id":32,"value":"agent = Verifier.parse(\n \"did:key:z6MkuK1zNYBMt3tSksBZzME2hMaiFcLPGkoVLkM2LFKE5qzE\"\n)","pinned":false,"hidden":false,"mode":"ojs"},{"id":36,"value":"authorization = delegate({\n issuer: account,\n audience: agent,\n capabilities: [\n {\n with: `space://${space.did()}`,\n can: \"*\"\n }\n ],\n expiration: Infinity,\n proofs: [spaceDelegation]\n})","pinned":false,"hidden":false,"mode":"ojs"},{"id":11,"value":"space = ed25519.parse(\n \"MgCYKXoHVy7Vk4/QjcEGi+MCqjntUiasxXJ8uJKY0qh11e+0Bs8WsdqGK7xothgrDzzWD0ME7ynPjz2okXDh8537lId8=\"\n)","pinned":false,"hidden":false,"mode":"ojs"},{"id":38,"value":"class AuthorizationSigner {\n constructor(id) {\n this.id = id;\n }\n did() {\n return this.id;\n }\n /* c8 ignore next 3 */\n get signatureCode() {\n return Signature.NON_STANDARD;\n }\n get signatureAlgorithm() {\n return \"\";\n }\n sign() {\n return Signature.createNonStandard(\n this.signatureAlgorithm,\n new Uint8Array(0)\n );\n }\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":5,"value":"import {\n json,\n CBOR,\n Block,\n Link,\n sha256,\n base64,\n base64pad,\n base64url,\n base64urlpad,\n CID,\n varint\n} from \"@gozala/ipld\"","pinned":false,"hidden":false,"mode":"ojs"},{"id":7,"value":"import { show } from \"@gozala/show\"","pinned":true,"hidden":false,"mode":"ojs"},{"id":8,"value":"import {\n delegate,\n Signer,\n Verifier,\n ed25519,\n RSA,\n UCAN,\n Signature\n} from \"@gozala/ucanto\"","pinned":false,"hidden":false,"mode":"ojs"},{"id":142,"value":"HeaderParser = await import(\"https://cdn.skypack.dev/header-parse\")","pinned":true,"hidden":false,"mode":"ojs"},{"id":642,"value":"SPKI = import(\"https://cdn.skypack.dev/@ucanto/principal/src/rsa/spki\")","pinned":true,"hidden":false,"mode":"ojs"},{"id":758,"value":"MAIL = FileAttachment(\"auth2.eml\").text()","pinned":true,"hidden":false,"mode":"ojs"}],"files":"$W32","stdlib":"1","titling":"auto"}