Files
self/circuits/scripts/build/build_r1cs_wasm.sh
Nesopie 07352a5ac6 feat: migrate from Sumsub to Didit KYC provider (#1860)
* chore: swap @sumsub/react-native-mobilesdk-module for @didit-protocol/sdk-react-native

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: rename SUMSUB_TEE_URL to DIDIT_TEE_URL

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: rename PendingKycVerification.userId to sessionId

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add Didit integration module, remove Sumsub integration

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add useDiditWebSocket hook, remove useSumsubWebSocket

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add useDiditLauncher hook, remove useSumsubLauncher

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: rename userId to sessionId in pendingKycStore, bump persist version

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: rename sumsub error injection triggers to didit

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: rename KycSuccess route param userId to sessionId

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: update KycSuccessScreen to use useDiditWebSocket and sessionId

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: update all consumer files from Sumsub to Didit

Updates usePendingKycRecovery, selfClientProvider, 5 fallback screens,
LogoConfirmationScreen, HomeScreen, KYCVerifiedScreen, and KycIdCard.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* test: update jest mocks and config for Didit SDK

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* build: swap Sumsub native deps for Didit in Podfile and build.gradle

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: remove hardcoded sumsub namespace from nullifier generation

Read namespace from id_type field instead of hardcoding 'sumsub'.
The didit-tee encodes id_type as [namespace_len][namespace][doc_type],
so the namespace is already in the signed data.

Also fix deserializeApplicantInfo to parse the namespaced encoding
and extract just the document type for display.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: lint and formatting issues from Didit migration

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: add register_kyc support to build_r1cs_wasm.sh and build_cpp.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use circuits/node_modules paths in build_r1cs_wasm.sh

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: emit ack_success after receiving KYC data to trigger session deletion

The didit-tee now expects the client to ack receipt of signed data,
which triggers DELETE of the session from Didit's API for data cleanup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use raw bytes for KYC commitment/nullifier instead of deserialize+reserialize

The deserialize→reserialize path strips the namespace prefix from
id_type, producing different bytes than the TEE signed. Work on the
raw base64-decoded bytes directly to match the circuit inputs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: lint

* Revert "fix: lint"

This reverts commit d3dde1460b.

* fix: lint

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-25 15:49:49 +05:30

169 lines
6.3 KiB
Bash
Executable File

#!/bin/bash
# run from root
# first argument should register | dsc | disclose
if [[ $1 != "register" && $1 != "dsc" && $1 != "disclose" && $1 != "register_id" && $1 != "register_kyc" ]]; then
echo "first argument should be register | dsc | disclose | register_id | register_kyc"
exit 1
fi
REGISTER_CIRCUITS=(
# passport
"register_sha1_sha1_sha1_ecdsa_brainpoolP224r1:true"
"register_sha1_sha1_sha1_ecdsa_secp256r1:true"
"register_sha1_sha1_sha1_rsa_65537_4096:true"
"register_sha1_sha256_sha256_rsa_65537_4096:true"
"register_sha224_sha224_sha224_ecdsa_brainpoolP224r1:true"
"register_sha256_sha224_sha224_ecdsa_secp224r1:true"
"register_sha256_sha256_sha224_ecdsa_secp224r1:true"
"register_sha256_sha256_sha256_ecdsa_brainpoolP256r1:true"
"register_sha256_sha256_sha256_ecdsa_brainpoolP384r1:true"
"register_sha256_sha256_sha256_ecdsa_secp256r1:true"
"register_sha256_sha256_sha256_ecdsa_secp384r1:true"
"register_sha256_sha256_sha256_rsa_3_4096:true"
"register_sha256_sha256_sha256_rsa_65537_4096:true"
"register_sha256_sha256_sha256_rsapss_3_32_2048:true"
"register_sha256_sha256_sha256_rsapss_65537_32_2048:true"
"register_sha256_sha256_sha256_rsapss_65537_32_3072:true"
"register_sha256_sha256_sha256_rsapss_65537_64_2048:true"
"register_sha384_sha384_sha384_ecdsa_brainpoolP384r1:true"
"register_sha384_sha384_sha384_ecdsa_brainpoolP512r1:true"
"register_sha384_sha384_sha384_ecdsa_secp384r1:true"
"register_sha384_sha384_sha384_rsapss_65537_48_2048:true"
"register_sha512_sha512_sha256_rsa_65537_4096:true"
"register_sha512_sha512_sha512_ecdsa_brainpoolP512r1:true"
"register_sha512_sha512_sha512_ecdsa_secp521r1:true"
"register_sha512_sha512_sha512_rsa_65537_4096:true"
"register_sha512_sha512_sha512_rsapss_65537_64_2048:true"
)
REGISTER_ID_CIRCUITS=(
# eu id
"register_id_sha1_sha1_sha1_ecdsa_brainpoolP224r1:true"
"register_id_sha1_sha1_sha1_ecdsa_secp256r1:true"
"register_id_sha1_sha1_sha1_rsa_65537_4096:true"
"register_id_sha1_sha256_sha256_rsa_65537_4096:true"
"register_id_sha224_sha224_sha224_ecdsa_brainpoolP224r1:true"
"register_id_sha256_sha224_sha224_ecdsa_secp224r1:true"
"register_id_sha256_sha256_sha224_ecdsa_secp224r1:true"
"register_id_sha256_sha256_sha256_ecdsa_brainpoolP256r1:true"
"register_id_sha256_sha256_sha256_ecdsa_brainpoolP384r1:true"
"register_id_sha256_sha256_sha256_ecdsa_secp256r1:true"
"register_id_sha256_sha256_sha256_ecdsa_secp384r1:true"
"register_id_sha256_sha256_sha256_rsa_3_4096:true"
"register_id_sha256_sha256_sha256_rsa_65537_4096:true"
"register_id_sha256_sha256_sha256_rsapss_3_32_2048:true"
"register_id_sha256_sha256_sha256_rsapss_65537_32_2048:true"
"register_id_sha256_sha256_sha256_rsapss_65537_32_3072:true"
"register_id_sha256_sha256_sha256_rsapss_65537_64_2048:true"
"register_id_sha384_sha384_sha384_ecdsa_brainpoolP384r1:true"
"register_id_sha384_sha384_sha384_ecdsa_brainpoolP512r1:true"
"register_id_sha384_sha384_sha384_ecdsa_secp384r1:true"
"register_id_sha384_sha384_sha384_rsapss_65537_48_2048:true"
"register_id_sha512_sha512_sha256_rsa_65537_4096:true"
"register_id_sha512_sha512_sha512_ecdsa_brainpoolP512r1:true"
"register_id_sha512_sha512_sha512_ecdsa_secp521r1:true"
"register_id_sha512_sha512_sha512_rsa_65537_4096:true"
"register_id_sha512_sha512_sha512_rsapss_65537_64_2048:true"
)
REGISTER_KYC_CIRCUITS=(
"register_kyc:true"
)
DISCLOSE_CIRCUITS=(
"vc_and_disclose:true"
"vc_and_disclose_id:true"
)
DSC_CIRCUITS=(
"dsc_sha1_ecdsa_brainpoolP256r1:true"
"dsc_sha1_ecdsa_secp256r1:true"
"dsc_sha1_rsa_65537_4096:true"
"dsc_sha256_ecdsa_brainpoolP256r1:true"
"dsc_sha256_ecdsa_brainpoolP384r1:true"
"dsc_sha256_ecdsa_secp256r1:true"
"dsc_sha256_ecdsa_secp384r1:true"
"dsc_sha256_ecdsa_secp521r1:true"
"dsc_sha256_rsa_65537_4096:true"
"dsc_sha256_rsapss_3_32_3072:true"
"dsc_sha256_rsapss_65537_32_3072:true"
"dsc_sha256_rsapss_65537_32_4096:true"
"dsc_sha384_ecdsa_brainpoolP384r1:true"
"dsc_sha384_ecdsa_brainpoolP512r1:true"
"dsc_sha384_ecdsa_secp384r1:true"
"dsc_sha512_ecdsa_brainpoolP512r1:true"
"dsc_sha512_ecdsa_secp521r1:true"
"dsc_sha512_rsa_65537_4096:true"
"dsc_sha512_rsapss_65537_64_4096:true"
"dsc_sha384_rsapss_65537_48_3072:true"
)
if [[ $1 == "register" ]]; then
allowed_circuits=("${REGISTER_CIRCUITS[@]}")
output="output/register"
mkdir -p $output
basepath="./circuits/circuits/register/instances"
elif [[ $1 == "register_id" ]]; then
allowed_circuits=("${REGISTER_ID_CIRCUITS[@]}")
output="output/register"
mkdir -p $output
basepath="./circuits/circuits/register_id/instances"
elif [[ $1 == "register_kyc" ]]; then
allowed_circuits=("${REGISTER_KYC_CIRCUITS[@]}")
output="output/register"
mkdir -p $output
basepath="./circuits/circuits/register/instances"
elif [[ $1 == "dsc" ]]; then
allowed_circuits=("${DSC_CIRCUITS[@]}")
output="output/dsc"
mkdir -p $output
basepath="./circuits/circuits/dsc/instances"
elif [[ $1 == "disclose" ]]; then
allowed_circuits=("${DISCLOSE_CIRCUITS[@]}")
output="output/disclose"
mkdir -p $output
basepath="./circuits/circuits/disclose"
fi
pids=()
for item in "${allowed_circuits[@]}"; do
filename=$(echo "$item" | cut -d':' -f1)
allowed=$(echo "$item" | cut -d':' -f2)
if [[ $allowed == 'false' ]]; then
echo "Skipping $filename (not in allowed circuits)"
continue
fi
while [[ ${#pids[@]} -ge 5 ]]; do
new_pids=()
for pid in "${pids[@]}"; do
if kill -0 "$pid" 2>/dev/null; then
new_pids+=("$pid")
else
echo "Process $pid finished"
fi
done
pids=("${new_pids[@]}")
sleep 1
done
echo $filename $allowed
filepath=${basepath}/${filename}.circom
circom_pid=$!
circuit_name="${filename%.*}"
(
circom $filepath \
-l "circuits/node_modules" \
-l "circuits/node_modules/@zk-kit/binary-merkle-root.circom/src" \
-l "circuits/node_modules/circomlib/circuits" \
--O1 --r1cs --wasm --output $output
) &
pids+=($!)
done
echo "Waiting for all circuits to compile..."
wait "${pids[@]}"
echo "All circuits compiled successfully!"