Quickstart: a signed request in 5 steps

status: the signing code is [BT] (@neungaming/predictions-server 0.1.0, published on the Neun GitHub Packages registry). Keys below are FAKE and never valid anywhere.

1. Install the server SDK, Node 20+ (see How to install the SDK below). [BT]
2. Get a key pair. [NB] There is no Back Office wallet-key generator yet; DEV keys are handed over by Neun staff through a secret manager. Here a FAKE key is used.
3. Sign the request with signWalletRequest over the raw body bytes. [BT]
4. Verify it on the wallet side with verifyWalletRequest, which hashes raw bytes only. [BT]
5. Sign each response with signWalletResponse. [BT]

The block below is run by the doc test.

import { signWalletRequest, verifyWalletRequest } from '@neungaming/predictions-server';

// FAKE key: 43 base62 characters after the npwq_sbx_ prefix. Never valid anywhere.
const secret = 'npwq_sbx_FAKEtestKEYdoNOTuse000000000000000000000000';
const keyId = 'wrq_sbx_FAKE';
const body = Buffer.from('{"operationId":"7b0c1d4e-0000-5000-8000-000000000001","operationType":"DEBIT","amount":{"amount":"10.00","currency":"EUR"}}');
const now = 1793232000000;

const signed = signWalletRequest({ key: { keyId, secret }, method: 'POST', path: '/wallet/v1/debit', body, nowMs: now, nonce: 'quickstart-nonce-0001' });
const seen = new Set<string>();
const guard = { nowMs: () => now, claimNonce: (n: string) => (seen.has(n) ? false : (seen.add(n), true)) };

verifyWalletRequest(
  { method: 'POST', path: '/wallet/v1/debit', rawBody: body, headers: { 'Neun-Wallet-Version': '1', ...signed } },
  { [keyId]: secret },
  guard,
).then((r) => console.log('verified: ' + JSON.stringify(r)));

How to install the SDK

The packages are on the GitHub Packages npm registry of the Neun GitHub host. Your GitHub account on that host needs the read:packages permission. Ask Neun to add you.

1. Make a token for your account with read:packages. Keep it in your secret manager.
2. Add this to .npmrc in your project (read the token from the environment, never commit it):

@neungaming:registry=https://npm.bright-entertainment.ghe.com
//npm.bright-entertainment.ghe.com/:_authToken=${NEUN_NPM_TOKEN}

1. Install. Node 20 or newer, TypeScript.

npm install @neungaming/predictions-server
npm install --save-dev @neungaming/wallet-conformance

Version 0.1.0 is published. If you cannot get access, ask Neun for the handover tarballs instead.

Handover files

status: [NB] not merged yet. The handover tarballs come from pnpm pack:handover (branch feat/v20-r15-packaging, commit 525f22a8). Check them with sha256sum -c SHA256SUMS. The packer's own --verify needs scripts/pack-handover.mjs from the repo, which is not inside the tarballs.

• The packages are published (see above). The tarballs are for teams that cannot reach the registry.
• Typed client generation is not available yet. Open owner row P-1: new dependency approval.

Next: signing guide, sandbox, certification.