@1sat/connect 0.0.31 → 0.0.32

package/dist/index.js

@@ -100080,41 +100080,6 @@ function permissionKeyToString(key) {
       return `spend:${key.originator}`;
   }
 }
-function permissionKeysFromGroup(originator, permissions) {
-  const normalized = normalizeOriginator(originator);
-  const keys = [];
-  if (permissions.spendingAuthorization) {
-    keys.push({ type: "spending", originator: normalized });
-  }
-  for (const p of permissions.protocolPermissions ?? []) {
-    if (p.counterparty === "")
-      continue;
-    const level = p.protocolID[0];
-    const counterparty = level === 1 ? "" : p.counterparty ?? "self";
-    keys.push({
-      type: "protocol",
-      originator: normalized,
-      privileged: false,
-      protocolLevel: level,
-      protocolName: p.protocolID[1],
-      counterparty
-    });
-  }
-  for (const b of permissions.basketAccess ?? []) {
-    keys.push({ type: "basket", originator: normalized, basket: b.basket });
-  }
-  for (const c of permissions.certificateAccess ?? []) {
-    keys.push({
-      type: "certificate",
-      originator: normalized,
-      privileged: false,
-      verifier: c.verifierPublicKey,
-      certType: c.type,
-      fields: [...c.fields].sort()
-    });
-  }
-  return keys;
-}
 function isExpired(expiry, now = Date.now()) {
   if (!expiry)
     return false;
@@ -100157,6 +100122,8 @@ class InMemoryPermissionStore {
 }
 // ../wallet/dist/permissions/manager.js
 var import_index_client = __toESM(require_index_client5(), 1);
+var IDB_TXID_PREFIX = "idb:";
+
 class LocalWalletPermissionsManager extends import_index_client.WalletPermissionsManager {
   permissionStore;
   pendingSingle = new Map;
@@ -100173,16 +100140,6 @@ class LocalWalletPermissionsManager extends import_index_client.WalletPermission
       const userHandler2 = handler;
       const wrapped2 = async (request3) => {
         this.pendingGrouped.set(request3.requestID, request3);
-        const keys = permissionKeysFromGroup(request3.originator, request3.permissions);
-        if (keys.length > 0) {
-          const grants = await Promise.all(keys.map((k) => this.permissionStore.findGrant(k)));
-          const allHit = grants.length === keys.length && grants.every((g) => g != null && !isExpired(g.expiry));
-          if (allHit) {
-            await super.dismissGroupedPermission(request3.requestID);
-            this.pendingGrouped.delete(request3.requestID);
-            return;
-          }
-        }
         return userHandler2(request3);
       };
       return super.bindCallback(eventName, wrapped2);
@@ -100190,20 +100147,62 @@ class LocalWalletPermissionsManager extends import_index_client.WalletPermission
     const userHandler = handler;
     const wrapped = async (request3) => {
       this.pendingSingle.set(request3.requestID, request3);
-      const key = permissionKeyFromRequest(request3);
-      const existing = await this.permissionStore.findGrant(key);
-      if (existing && !isExpired(existing.expiry)) {
-        await super.grantPermission({
-          requestID: request3.requestID,
-          ephemeral: true
-        });
-        this.pendingSingle.delete(request3.requestID);
-        return;
-      }
       return userHandler(request3);
     };
     return super.bindCallback(eventName, wrapped);
   }
+  async ensureProtocolPermission(args) {
+    const counterparty = args.protocolID[0] === 1 ? "" : args.counterparty ?? "self";
+    const key = {
+      type: "protocol",
+      originator: normalizeOriginator(args.originator),
+      privileged: !!args.privileged,
+      protocolLevel: args.protocolID[0],
+      protocolName: args.protocolID[1],
+      counterparty
+    };
+    if (await this.storeHit(key))
+      return true;
+    return super.ensureProtocolPermission(args);
+  }
+  async ensureBasketAccess(args) {
+    const key = {
+      type: "basket",
+      originator: normalizeOriginator(args.originator),
+      basket: args.basket
+    };
+    if (await this.storeHit(key))
+      return true;
+    return super.ensureBasketAccess(args);
+  }
+  async ensureCertificateAccess(args) {
+    const key = {
+      type: "certificate",
+      originator: normalizeOriginator(args.originator),
+      privileged: !!args.privileged,
+      verifier: args.verifier,
+      certType: args.certType,
+      fields: [...args.fields].sort()
+    };
+    if (await this.storeHit(key))
+      return true;
+    return super.ensureCertificateAccess(args);
+  }
+  async ensureSpendingAuthorization(args) {
+    const key = {
+      type: "spending",
+      originator: normalizeOriginator(args.originator)
+    };
+    const grant = await this.permissionStore.findGrant(key);
+    if (grant && !isExpired(grant.expiry) && (grant.authorizedAmount ?? 0) >= args.satoshis) {
+      return true;
+    }
+    return super.ensureSpendingAuthorization(args);
+  }
+  async storeHit(key) {
+    const grant = await this.permissionStore.findGrant(key);
+    return !!grant && !isExpired(grant.expiry);
+  }
   async grantPermission(params) {
     const request3 = this.pendingSingle.get(params.requestID);
     if (request3) {
@@ -100214,7 +100213,9 @@ class LocalWalletPermissionsManager extends import_index_client.WalletPermission
         grantedAt: Date.now(),
         reason: request3.reason
       };
-      if (request3.type === "spending" && request3.spending?.satoshis != null) {
+      if (key.type === "spending" && params.amount != null) {
+        grant.authorizedAmount = params.amount;
+      } else if (request3.type === "spending" && request3.spending?.satoshis != null) {
         grant.authorizedAmount = request3.spending.satoshis;
       }
       await this.permissionStore.putGrant(grant);
@@ -100229,21 +100230,63 @@ class LocalWalletPermissionsManager extends import_index_client.WalletPermission
   async grantGroupedPermission(params) {
     const request3 = this.pendingGrouped.get(params.requestID);
     if (request3) {
-      const normalized = normalizeOriginator(request3.originator);
-      const grantedKeys = permissionKeysFromGroup(normalized, params.granted);
+      const originator = normalizeOriginator(request3.originator);
       const now = Date.now();
       const expiry = params.expiry ?? 0;
-      for (const key of grantedKeys) {
-        const grant = { key, expiry, grantedAt: now };
-        if (key.type === "spending" && params.granted.spendingAuthorization) {
-          grant.authorizedAmount = params.granted.spendingAuthorization.amount;
-          grant.reason = params.granted.spendingAuthorization.description;
-        }
-        await this.permissionStore.putGrant(grant);
+      if (params.granted.spendingAuthorization) {
+        await this.permissionStore.putGrant({
+          key: { type: "spending", originator },
+          expiry,
+          grantedAt: now,
+          authorizedAmount: params.granted.spendingAuthorization.amount,
+          reason: params.granted.spendingAuthorization.description
+        });
+      }
+      for (const p of params.granted.protocolPermissions ?? []) {
+        if (p.counterparty === "")
+          continue;
+        const level = p.protocolID[0];
+        const counterparty = level === 1 ? "" : p.counterparty ?? "self";
+        await this.permissionStore.putGrant({
+          key: {
+            type: "protocol",
+            originator,
+            privileged: false,
+            protocolLevel: level,
+            protocolName: p.protocolID[1],
+            counterparty
+          },
+          expiry,
+          grantedAt: now,
+          reason: p.description
+        });
+      }
+      for (const b of params.granted.basketAccess ?? []) {
+        await this.permissionStore.putGrant({
+          key: { type: "basket", originator, basket: b.basket },
+          expiry,
+          grantedAt: now,
+          reason: b.description
+        });
+      }
+      for (const c of params.granted.certificateAccess ?? []) {
+        await this.permissionStore.putGrant({
+          key: {
+            type: "certificate",
+            originator,
+            privileged: false,
+            verifier: c.verifierPublicKey,
+            certType: c.type,
+            fields: [...c.fields].sort()
+          },
+          expiry,
+          grantedAt: now,
+          reason: c.description
+        });
       }
       this.pendingGrouped.delete(params.requestID);
     }
-    return super.grantGroupedPermission(params);
+    return super.dismissGroupedPermission(params.requestID);
   }
   async denyGroupedPermission(requestID) {
     this.pendingGrouped.delete(requestID);
@@ -100253,11 +100296,241 @@ class LocalWalletPermissionsManager extends import_index_client.WalletPermission
     this.pendingGrouped.delete(requestID);
     return super.dismissGroupedPermission(requestID);
   }
+  async listProtocolPermissions(filter = {}) {
+    const onchain = await super.listProtocolPermissions(filter);
+    const idb = await this.idbTokensFor("protocol", filter.originator, (g) => {
+      if (g.key.type !== "protocol")
+        return false;
+      if (filter.privileged !== undefined && g.key.privileged !== filter.privileged) {
+        return false;
+      }
+      if (filter.protocolName !== undefined && g.key.protocolName !== filter.protocolName) {
+        return false;
+      }
+      if (filter.protocolSecurityLevel !== undefined && g.key.protocolLevel !== filter.protocolSecurityLevel) {
+        return false;
+      }
+      if (filter.counterparty !== undefined && g.key.counterparty !== filter.counterparty) {
+        return false;
+      }
+      return true;
+    });
+    return mergeTokens(onchain, idb);
+  }
+  async listBasketAccess(params = {}) {
+    const onchain = await super.listBasketAccess(params);
+    const idb = await this.idbTokensFor("basket", params.originator, (g) => {
+      if (g.key.type !== "basket")
+        return false;
+      if (params.basket !== undefined && g.key.basket !== params.basket) {
+        return false;
+      }
+      return true;
+    });
+    return mergeTokens(onchain, idb);
+  }
+  async listSpendingAuthorizations(params) {
+    const onchain = await super.listSpendingAuthorizations(params);
+    const idb = await this.idbTokensFor("spending", params.originator, (g) => g.key.type === "spending");
+    return mergeTokens(onchain, idb);
+  }
+  async listCertificateAccess(params = {}) {
+    const onchain = await super.listCertificateAccess(params);
+    const idb = await this.idbTokensFor("certificate", params.originator, (g) => {
+      if (g.key.type !== "certificate")
+        return false;
+      if (params.privileged !== undefined && g.key.privileged !== params.privileged) {
+        return false;
+      }
+      if (params.certType !== undefined && g.key.certType !== params.certType) {
+        return false;
+      }
+      if (params.verifier !== undefined && g.key.verifier !== params.verifier) {
+        return false;
+      }
+      return true;
+    });
+    return mergeTokens(onchain, idb);
+  }
+  async idbTokensFor(type, originator, predicate) {
+    const filter = { type };
+    if (originator)
+      filter.originator = normalizeOriginator(originator);
+    const grants = await this.permissionStore.listGrants(filter);
+    return grants.filter(predicate).map(grantToToken);
+  }
   async revokeAllForOriginator(originator) {
     const normalized = normalizeOriginator(originator);
     await this.permissionStore.deleteAllForOriginator(normalized);
     return super.revokeAllForOriginator(normalized);
   }
+  async revokePermission(oldToken) {
+    const idbKey = idbKeyFromToken(oldToken);
+    if (idbKey) {
+      await this.permissionStore.deleteGrant(idbKey);
+    }
+    if (oldToken.txid.startsWith(IDB_TXID_PREFIX)) {
+      return;
+    }
+    return super.revokePermission(oldToken);
+  }
+}
+function grantToToken(grant) {
+  const base = {
+    txid: `${IDB_TXID_PREFIX}${permissionKeyToString(grant.key)}`,
+    tx: [],
+    outputIndex: 0,
+    outputScript: "",
+    satoshis: 0,
+    originator: grant.key.originator,
+    expiry: grant.expiry
+  };
+  switch (grant.key.type) {
+    case "protocol":
+      base.privileged = grant.key.privileged;
+      base.protocol = grant.key.protocolName;
+      base.securityLevel = grant.key.protocolLevel;
+      base.counterparty = grant.key.counterparty;
+      break;
+    case "basket":
+      base.basketName = grant.key.basket;
+      break;
+    case "certificate":
+      base.privileged = grant.key.privileged;
+      base.certType = grant.key.certType;
+      base.certFields = grant.key.fields;
+      base.verifier = grant.key.verifier;
+      break;
+    case "spending":
+      if (grant.authorizedAmount != null) {
+        base.authorizedAmount = grant.authorizedAmount;
+      }
+      break;
+  }
+  return base;
+}
+function idbKeyFromToken(token) {
+  if (token.txid.startsWith(IDB_TXID_PREFIX)) {
+    return parseIdbKey(token.txid.slice(IDB_TXID_PREFIX.length));
+  }
+  const originator = normalizeOriginator(token.originator);
+  if (token.basketName) {
+    return { type: "basket", originator, basket: token.basketName };
+  }
+  if (token.protocol && token.securityLevel !== undefined) {
+    return {
+      type: "protocol",
+      originator,
+      privileged: !!token.privileged,
+      protocolLevel: token.securityLevel,
+      protocolName: token.protocol,
+      counterparty: token.counterparty ?? "self"
+    };
+  }
+  if (token.certType && token.verifier && token.certFields) {
+    return {
+      type: "certificate",
+      originator,
+      privileged: !!token.privileged,
+      verifier: token.verifier,
+      certType: token.certType,
+      fields: [...token.certFields].sort()
+    };
+  }
+  if (token.authorizedAmount !== undefined) {
+    return { type: "spending", originator };
+  }
+  return null;
+}
+function parseIdbKey(serialized) {
+  const idx = serialized.indexOf(":");
+  if (idx < 0)
+    return null;
+  const tag = serialized.slice(0, idx);
+  const rest = serialized.slice(idx + 1);
+  if (tag === "basket") {
+    const sep = rest.indexOf(":");
+    if (sep < 0)
+      return null;
+    return {
+      type: "basket",
+      originator: rest.slice(0, sep),
+      basket: rest.slice(sep + 1)
+    };
+  }
+  if (tag === "spend") {
+    return { type: "spending", originator: rest };
+  }
+  if (tag === "proto") {
+    const parts = rest.split(":");
+    if (parts.length < 4)
+      return null;
+    const [originator, privileged, levelAndName, counterparty] = parts;
+    const commaIdx = levelAndName.indexOf(",");
+    if (commaIdx < 0)
+      return null;
+    const level = Number(levelAndName.slice(0, commaIdx));
+    const protocolName = levelAndName.slice(commaIdx + 1);
+    return {
+      type: "protocol",
+      originator,
+      privileged: privileged === "true",
+      protocolLevel: level,
+      protocolName,
+      counterparty
+    };
+  }
+  if (tag === "cert") {
+    const parts = rest.split(":");
+    if (parts.length < 5)
+      return null;
+    const [originator, privileged, verifier, certType, fieldsJoined] = parts;
+    return {
+      type: "certificate",
+      originator,
+      privileged: privileged === "true",
+      verifier,
+      certType,
+      fields: fieldsJoined ? fieldsJoined.split("|") : []
+    };
+  }
+  return null;
+}
+function mergeTokens(onchain, idb) {
+  const seen = new Set;
+  const out = [];
+  for (const t of onchain) {
+    const k = onchainSignature(t);
+    if (k)
+      seen.add(k);
+    out.push(t);
+  }
+  for (const t of idb) {
+    const k = idbSignature(t);
+    if (k && seen.has(k))
+      continue;
+    out.push(t);
+  }
+  return out;
+}
+function onchainSignature(t) {
+  const originator = normalizeOriginator(t.originator);
+  if (t.basketName)
+    return `basket:${originator}:${t.basketName}`;
+  if (t.protocol && t.securityLevel !== undefined) {
+    return `proto:${originator}:${!!t.privileged}:${t.securityLevel},${t.protocol}:${t.counterparty ?? "self"}`;
+  }
+  if (t.certType && t.verifier && t.certFields) {
+    return `cert:${originator}:${!!t.privileged}:${t.verifier}:${t.certType}:${[...t.certFields].sort().join("|")}`;
+  }
+  if (t.authorizedAmount !== undefined)
+    return `spend:${originator}`;
+  return null;
+}
+function idbSignature(t) {
+  if (!t.txid.startsWith(IDB_TXID_PREFIX))
+    return null;
+  return t.txid.slice(IDB_TXID_PREFIX.length);
 }
 // src/connectWallet.ts
 var LAST_PROVIDER_KEY = "cwi_last_provider";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1sat/connect",
-  "version": "0.0.31",
+  "version": "0.0.32",
   "description": "Connection layer for 1Sat wallet - popup flow, events, session management",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,7 +28,7 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@1sat/wallet": "0.0.43",
+    "@1sat/wallet": "0.0.44",
     "@sigma-auth/better-auth-plugin": "^0.0.84",
     "better-auth": "^1.5.4",
     "eventemitter3": "^5.0.1"
@@ -40,4 +40,4 @@
     "@bsv/sdk": "^2.0.13",
     "typescript": "^5.9.3"
   }
-}
+}