Merge pull-request #1166

Author: moeodeh3

.changeset/khaki-grapes-talk.md

@@ -2,4 +2,4 @@
 "@turnkey/crypto": patch
 ---
 
-Remove `@turnkey/http` from devDependencies
+Remove `@turnkey/http` and `@turnkey/api-key-stamper` from devDependencies

packages/crypto/package.json

@@ -56,7 +56,6 @@
     "cbor-js": "0.1.0"
   },
   "devDependencies": {
-    "@turnkey/api-key-stamper": "workspace:*",
     "@types/cbor-js": "^0.1.1",
     "@types/jest": "^29.5.3",
     "jest": "29.7.0"

packages/crypto/src/__tests__/crypto-test.ts

@@ -1,6 +1,7 @@
 import { test, expect, describe } from "@jest/globals";
-import { ApiKeyStamper } from "@turnkey/api-key-stamper";
 import { uint8ArrayFromHexString } from "@turnkey/encoding";
+import { p256 } from "@noble/curves/p256";
+import { sha256 } from "@noble/hashes/sha256";
 import {
   getPublicKey,
   generateP256KeyPair,
@@ -198,27 +199,23 @@ describe("Turnkey Crypto Primitives", () => {
   test("verifyRequestStamp", async () => {
     const { publicKey: apiPublicKey, privateKey: apiPrivateKey } =
       generateP256KeyPair();
-    const apiKeyStamper = new ApiKeyStamper({
-      apiPublicKey,
-      apiPrivateKey,
-    });
 
     // we create a sample request payload
     const requestBody = JSON.stringify({
       organizationId: "00000000-00000000-00000000-00000000",
       timestampMs: Date.now().toString(),
     });
 
-    // we stamp the request payload to get the signature
-    const { stampHeaderValue } = await apiKeyStamper.stamp(requestBody);
-
-    const decodedStampContents = atob(stampHeaderValue);
-    const parsedStampContents = JSON.parse(decodedStampContents);
-    const signature = parsedStampContents.signature;
+    // we manually create a signature using @noble/curves directly
+    // to avoid a circular dependency with ApiKeyStamper
+    const messageHash = sha256(new TextEncoder().encode(requestBody));
+    const privateKeyBytes = uint8ArrayFromHexString(apiPrivateKey);
+    const signatureBytes = p256.sign(messageHash, privateKeyBytes).toDERHex();
 
+    // we verify the signature
     const verified = await verifyStampSignature(
       apiPublicKey,
-      signature,
+      signatureBytes,
       requestBody,
     );