pear-git / bin / sign-helper.mjs

/**
 * Sign helper for CLI authentication
 */

import * as ed25519 from '@noble/ed25519'
import { sha512 } from '@noble/hashes/sha512'

// Configure ed25519 v2.x
ed25519.etc.sha512Sync = (...m) => sha512(ed25519.etc.concatBytes(...m))
ed25519.etc.sha512Async = async (...m) => sha512(ed25519.etc.concatBytes(...m))

function base64ToBytes(base64) {
  return Uint8Array.from(Buffer.from(base64, 'base64'))
}

function bytesToBase64(bytes) {
  return Buffer.from(bytes).toString('base64')
}

export async function sign(challenge, secretKeyB64) {
  const challengeBytes = new TextEncoder().encode(challenge)
  const secretKeyBytes = base64ToBytes(secretKeyB64)

  // ed25519 private key is first 32 bytes
  const privateKey = secretKeyBytes.slice(0, 32)
  const signature = await ed25519.signAsync(challengeBytes, privateKey)

  return bytesToBase64(signature)
}