@agnostack/next-shopify 1.15.0-beta.8 → 1.15.0

package/dist/umd/verification.js

@@ -1,641 +0,0 @@
-(function (global, factory) {
-  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
-  typeof define === 'function' && define.amd ? define(['exports'], factory) :
-  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global["@agnostack/next-shopify/umd-verification"] = {}));
-})(this, (function (exports) { 'use strict';
-
-  var n,r=((n=function(){return r}).toString=n.toLocaleString=n[Symbol.toPrimitive]=function(){return ""},n.valueOf=function(){return !1},new Proxy(Object.freeze(n),{get:function(n,t){return n.hasOwnProperty(t)?n[t]:r}})),u=function(n){return n===r};
-
-  let win = global.window;
-  let exists = (variable) => !u(variable);
-  let window = typeof win !== "undefined" ? win : r;
-
-  /* eslint-disable no-use-before-define */
-
-  const isType = (value, type) => (
-    // eslint-disable-next-line eqeqeq, valid-typeof
-    (value != undefined) && (typeof value === type)
-  );
-
-  const safeTrim = (value) => {
-    if (isType(value, 'string')) {
-      // eslint-disable-next-line no-param-reassign
-      value = value.trim();
-    }
-
-    return value
-  };
-
-  const safeParse = (value, trim) => {
-    if (isType(value, 'string')) {
-      if (trim) {
-        // eslint-disable-next-line no-param-reassign
-        value = safeTrim(value);
-      }
-
-      if (value.startsWith('{') || value.startsWith('[') || value.startsWith('"')) {
-        // eslint-disable-next-line no-param-reassign
-        value = JSON.parse(value);
-      }
-    }
-
-    // TODO: should this be value ?? {}
-    return value
-  };
-
-  const ensureString = (string) => (
-    string ? `${string}` : ''
-  );
-
-  const ensureArray = (array = []) => (
-    // eslint-disable-next-line no-nested-ternary
-    !array ? [] : Array.isArray(array) ? array : [array]
-  );
-
-  const ensureObject = (object) => (
-    object ?? {}
-  );
-
-  // NOTE: this does not ensure !isType(string)
-  const objectEmpty = (object) => (
-    !object || !Object.keys(object).length
-  );
-
-  const stringNotEmpty = (stringable) => {
-    const string = ensureString(stringable);
-    return ((string.length > 0) && !['null', 'undefined'].includes(string))
-  };
-
-  const stringEmpty = (stringable) => (
-    !stringNotEmpty(stringable)
-  );
-
-  const compareString = (string1, string2) => {
-    if (stringEmpty(string1)) {
-      return 1
-    }
-
-    if (stringEmpty(string2)) {
-      return -1
-    }
-
-    return ensureString(string1).localeCompare(string2)
-  };
-
-  const compareEntryKeys = ([string1], [string2]) => (
-    compareString(string1, string2)
-  );
-
-  const objectToSortedString = (object, separator = '') => (
-    Object.entries(ensureObject(object))
-      .sort(compareEntryKeys)
-      .map(([key, value]) => `${key}=${value}`)
-      .join(separator)
-  );
-
-  const uppercase = (string) => (
-    ensureString(string).toUpperCase()
-  );
-
-  const removeLeadingSlash = (string) => (
-    ensureString(string).replace(/^\//, '')
-  );
-
-  const ensureLeadingSlash = (string) => (
-    `/${removeLeadingSlash(string)}`
-  );
-
-  const isTrue = (value, falsy) => {
-    const string = ensureString(value);
-    return ![...ensureArray(falsy), '', 'false'].includes(string)
-  };
-
-  const getWebCrypto = async () => {
-    try {
-      const crypto = (await import('isomorphic-webcrypto')).default;
-      return crypto
-    } catch (error) {
-      console.error('Failed to import isomorphic-webcrypto', error);
-      throw error
-    }
-  };
-
-  const getTextDecoder = async () => {
-    if (exists(window) && (typeof window?.TextDecoder === 'function')) {
-      return window.TextDecoder
-    }
-
-    try {
-      const TextDecoder = (await import('util')).TextDecoder;
-      return TextDecoder
-    } catch (error) {
-      console.error('Failed to import utils.TextDecoder', error);
-      throw error
-    }
-  };
-
-  const getTextEncoder = async () => {
-    if (exists(window) && (typeof window?.TextEncoder === 'function')) {
-      return window.TextEncoder
-    }
-
-    try {
-      const TextEncoder = (await import('util')).TextEncoder;
-      return TextEncoder
-    } catch (error) {
-      console.error('Failed to import utils.TextEncoder', error);
-      throw error
-    }
-  };
-
-  const timingSafeEqual = (value1, value2) => {
-    if (
-      (value1 == undefined) ||
-      (value2 == undefined) ||
-      (value1.length !== value2.length)
-    ) {
-      return false
-    }
-
-    let result = 0;
-    // eslint-disable-next-line no-plusplus
-    for (let i = 0; i < value1.length; i++) {
-      // eslint-disable-next-line no-bitwise
-      result |= value1[i] ^ value2[i];
-    }
-
-    return (result === 0)
-  };
-
-  const stringToHex = (stringValue) => (
-    Array.from(ensureString(stringValue), (char) => (
-      char.charCodeAt(0).toString(16).padStart(2, '0')
-    )).join('')
-  );
-
-  const hexToString = (hexValue) => (
-    ensureArray(
-      ensureString(hexValue).match(/.{1,2}/g)
-    )
-      .map((byte) => String.fromCharCode(parseInt(byte, 16)))
-      .join('')
-  );
-
-  const arrayBufferToString = async (arrayBuffer) => {
-    const uint8Array = new Uint8Array(arrayBuffer);
-    const Decoder = await getTextDecoder();
-    return new Decoder().decode(uint8Array)
-  };
-
-  const arrayToArrayBuffer = (array) => (
-    (ArrayBuffer.from != undefined)
-      ? ArrayBuffer.from(array)
-      : new Uint8Array(array).buffer
-  );
-
-  const ensureArrayBuffer = (arrayOrArrayBuffer) => (
-    (arrayOrArrayBuffer instanceof ArrayBuffer)
-      ? arrayOrArrayBuffer
-      : arrayToArrayBuffer(arrayOrArrayBuffer)
-  );
-
-  const generateKeyPair = async () => {
-    const crypto = await getWebCrypto();
-    const keyPair = await crypto.subtle.generateKey(
-      {
-        name: 'ECDH',
-        namedCurve: 'P-256',
-      },
-      true,
-      ['deriveKey']
-    );
-
-    return keyPair
-  };
-
-  const getKeyOperations = (keyType) => {
-    switch (keyType) {
-      case 'private':
-      case 'privateKey': {
-        return ['deriveKey']
-      }
-
-      case 'secret':
-      case 'secretKey':
-      case 'sharedSecret': {
-        return ['encrypt', 'decrypt'] 
-      }
-
-      default: {
-        return []
-      }
-    }
-  };
-
-  const getKeyAlgorythm = (keyType) => {
-    switch (keyType) {
-      case 'derivedKey':
-      case 'derived':
-      case 'secret':
-      case 'secretKey':
-      case 'sharedSecret': {
-        return {
-          name: 'AES-GCM',
-        }
-      }
-
-      default: {
-        return {
-          name: 'ECDH',
-          namedCurve: 'P-256',
-        }
-      }
-    }
-  };
-
-  const generateHMAC = async (message, derivedKey) => {
-    if (!message || !derivedKey) {
-      return undefined
-    } 
-
-    const crypto = await getWebCrypto();
-    const Encoder = await getTextEncoder();
-
-    const signature = await crypto.subtle.sign(
-      'HMAC',
-      derivedKey,
-      new Encoder().encode(message)
-    );
-
-    return stringToHex(
-      arrayBufferToString(signature)
-    )
-  };
-
-  const verifyHMAC = async (message, derivedKey, verifiableHMAC) => {
-    const calculatedHMAC = await generateHMAC(message, derivedKey);
-
-    return timingSafeEqual(calculatedHMAC, verifiableHMAC)
-  };
-
-  const getStorableKey = async (key) => {
-    const crypto = await getWebCrypto();
-
-    const exportedJWK = await crypto.subtle.exportKey('jwk', key);
-    return stringToHex(JSON.stringify(exportedJWK))
-  };
-
-  const restoreStorableKey = async (keyType, storableHex) => {
-    if (!storableHex) {
-      return undefined
-    }
-    const crypto = await getWebCrypto();
-
-    const exportedJWK = JSON.parse(hexToString(storableHex) || '{}');
-    if (objectEmpty(exportedJWK)) {
-      return undefined
-    }
-
-    return crypto.subtle.importKey(
-      'jwk',
-      exportedJWK,
-      getKeyAlgorythm(keyType),
-      true,
-      getKeyOperations(keyType)
-    )
-  };
-
-  const getStorableKeyPair = async (keyPair) => {
-    const storableKeys = {};
-
-    // eslint-disable-next-line no-restricted-syntax
-    for (const [keyType, key] of Object.entries(keyPair)) {
-      // eslint-disable-next-line no-await-in-loop
-      storableKeys[keyType] = await getStorableKey(key);
-    }
-
-    return storableKeys
-  };
-
-  const restoreStorableKeyPair = async (keyPair) => {
-    const restoredKeys = {};
-
-    // eslint-disable-next-line no-restricted-syntax
-    for (const [keyType, key] of Object.entries(keyPair)) {
-      // eslint-disable-next-line no-await-in-loop
-      restoredKeys[keyType] = await restoreStorableKey(keyType, key);
-    }
-
-    return restoredKeys
-  };
-
-  const deriveSharedKey = async ({ publicKey, privateKey }) => {
-    if (!publicKey || !privateKey) {
-      return undefined
-    }
-
-    const crypto = await getWebCrypto();
-    const derivedKey = await crypto.subtle.deriveKey(
-      {
-        name: 'ECDH',
-        public: publicKey,
-      },
-      privateKey,
-      {
-        name: 'AES-GCM',
-        length: 256,
-      },
-      true,
-      ['encrypt', 'decrypt']
-    );
-    return derivedKey
-  };
-
-  const deriveHMACKey = async ({ publicKey, privateKey }) => {
-    if (!publicKey || !privateKey) {
-      return undefined
-    }
-
-    const crypto = await getWebCrypto();
-    const derivedKey = await crypto.subtle.deriveKey(
-      {
-        name: 'ECDH',
-        public: publicKey,
-      },
-      privateKey,
-      {
-        name: 'HMAC',
-        hash: { name: 'SHA-256' },
-        length: 256,  // Adjusted key length, e.g., 128 bits
-      },
-      true,
-      ['sign', 'verify']
-    );
-    return derivedKey
-  };
-
-  const getVerificationKeys = async ({ publicKey, privateKey }) => {
-    if (!publicKey || !privateKey) {
-      return {}
-    }
-
-    const sharedKeyPair = await restoreStorableKeyPair({ publicKey, privateKey });
-    const derivedHMACKey = await deriveHMACKey(sharedKeyPair);
-    const derivedSecretKey = await deriveSharedKey(sharedKeyPair);
-
-    return {
-      derivedSecretKey,
-      derivedHMACKey,
-    }
-  };
-
-  const encryptMessage = async (decryptedMessage, derivedKey) => {
-    if (!decryptedMessage || !derivedKey) {
-      return undefined
-    }
-
-    const crypto = await getWebCrypto();
-    const iv = crypto.getRandomValues(new Uint8Array(12));
-    const Encoder = await getTextEncoder();
-    const encodedMessage = new Encoder().encode(decryptedMessage);
-    const ciphertext = await crypto.subtle.encrypt(
-      {
-        name: 'AES-GCM',
-        iv,
-      },
-      derivedKey,
-      encodedMessage
-    );
-
-    const encryptedMessage = new Uint8Array([
-      ...iv,
-      ...new Uint8Array(ciphertext)
-    ]);
-    return Array.from(encryptedMessage)
-  };
-
-  const decryptMessage = async (encryptedMessage, derivedKey) => {
-    if (!encryptedMessage || !derivedKey) {
-      return undefined
-    }
-
-    const crypto = await getWebCrypto();
-    // NOTE: this presumed an array or arrayBuffer coming in as encryptedMessage (will fail w/ IV error if its a string)
-    const encryptedArrayBuffer = ensureArrayBuffer(encryptedMessage);
-    const iv = encryptedArrayBuffer.slice(0, 12);
-    const ciphertext = encryptedArrayBuffer.slice(12);
-
-    const decryptedArrayBuffer = await crypto.subtle.decrypt(
-      {
-        name: 'AES-GCM',
-        iv,
-      },
-      derivedKey,
-      ciphertext
-    );
-
-    const Decoder = await getTextDecoder();
-    const decryptedMessage = new Decoder().decode(decryptedArrayBuffer);
-    return decryptedMessage
-  };
-
-  const subtle = {
-    generateKeyPair,
-    generateHMAC,
-    verifyHMAC,
-    getStorableKey,
-    getStorableKeyPair,
-    restoreStorableKeyPair,
-    deriveSharedKey,
-    deriveHMACKey,
-    getVerificationKeys,
-    encryptMessage,
-    decryptMessage,
-  };
-
-  const TEMP_HOSTNAME = 'xyz.com';
-  const REMOVABLE_KEYS = ['shop', 'host'];
-
-  const getRequestMethod = (body, _method) => {
-    const method = _method ?? (body ? 'POST' : 'GET');
-
-    return uppercase(method)
-  };
-
-  const convertToURL = (uri) => {
-    if (stringEmpty(uri)) {
-      return undefined
-    }
-
-    const protocolRegex = /^(https?:\/\/).+/i;
-
-    if (!protocolRegex.test(uri)) {
-      return new URL(`https://${TEMP_HOSTNAME}${ensureLeadingSlash(uri)}`)
-    }
-
-    return new URL(uri)
-  };
-
-  const normalizeURIParts = (uri) => {
-    const urlObject = convertToURL(uri);
-    if (!urlObject) {
-      return undefined
-    }
-
-    REMOVABLE_KEYS.forEach((key) => urlObject.searchParams.delete(key));
-
-    return {
-      ...(urlObject.hostname !== TEMP_HOSTNAME) && {
-        origin: urlObject.origin,
-      },
-      pathname: urlObject.pathname,
-      search: urlObject.search,
-    }
-  };
-
-  class VerificationError extends Error {
-    constructor(message, _data) {
-      super(message);
-      const { code = 500, ...data } = _data ?? {};
-      this.code = code;
-      this.data = data;
-      this.name = 'VerificationError';
-      Object.setPrototypeOf(this, VerificationError.prototype);
-    }
-  }
-
-  // import getRawBody from 'raw-body'
-  // import * as getRawBody from 'raw-body'
-
-  const getChunkedRawBody = async (readable) => {
-    const chunks = [];
-
-    for await (const chunk of readable) {
-      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-    }
-
-    return Buffer.concat(chunks)
-  };
-
-  // TODO: explore returning mutated request object adding on req.rawBody??
-  // TODO: move to req.text() after next 13.5: https://github.com/vercel/next.js/discussions/13405
-  const ensureRawBody = async (req) => (
-    getChunkedRawBody(req)
-    // getRawBody(req)
-      .then((_rawBody) => _rawBody.toString())
-      .catch((error) => {
-        // NOTE: this is intended to ensure if getRawBody is called 2x w/in a route that it returns the already streamed body
-        if ((error?.type === 'stream.not.readable')) {
-          if (!req?.rawBody) {
-            // eslint-disable-next-line max-len
-            console.info('Ignoring error reading raw requst body. This can occur if the body is attempted to be read twice in a single request. If intentional, please mutate the request to add the result of this call as req.rawBody (to prevent this warning).');
-            return req?.body
-          }
-
-          return req?.rawBody
-        }
-
-        console.error(`Error getting raw body for '${req?.url}'`, error);
-        throw error
-    })
-  );
-
-  const getVerificationHelpers = ({ keyPairs }) => (
-    async (req, params) => {
-      const {
-        'x-public-key': apiKey,
-        'x-ephemeral-key': ephemeralPublicKey,
-        'x-authorization-timestamp': customAuthTimestamp,
-        'x-authorization': customAuth,
-      } = req.headers ?? {};
-
-      const { uri: _uri, disableRecryption: _disableRecryption } = params ?? {};
-      const uri = _uri ?? req.url;
-      const disableRecryption = isTrue(_disableRecryption);
-
-      let isVerifiable;
-      try {
-        const [authProtocol, authSignature] = ensureString(customAuth).split(' ');
-        isVerifiable = isTrue(
-          apiKey &&
-          ephemeralPublicKey &&
-          keyPairs?.shared &&
-          customAuthTimestamp &&
-          authSignature &&
-          (authProtocol === 'HMAC-SHA256')
-        );
-
-        let verificationKeys;
-        const rawBody = await ensureRawBody(req);
-
-        // NOTE: requestBody should be wind up decrypted when isVerifiable (unless disableRecryption, then will pass through)
-        let requestBody = safeParse(rawBody);
-
-        // TEMP!!! remove isVerifiable check once webwidget moved to react
-        if (isVerifiable) {
-          if (
-            !apiKey ||
-            !ephemeralPublicKey ||
-            !customAuthTimestamp ||
-            !authSignature ||
-            !keyPairs?.shared ||
-            (apiKey !== keyPairs.shared.publicKey) ||
-            (authProtocol !== 'HMAC-SHA256')
-          ) {
-            throw new VerificationError('Invalid or missing authorization', { code: 401 })
-          }
-
-          verificationKeys = await subtle.getVerificationKeys({
-            publicKey: ephemeralPublicKey,
-            privateKey: keyPairs.shared.privateKey,
-          });
-
-          if (!verificationKeys) {
-            throw new VerificationError('Invalid or missing verification', { code: 412 })
-          }
-
-          const verificationPayload = objectToSortedString({
-            method: getRequestMethod(rawBody, req.method),
-            timestamp: customAuthTimestamp,
-            body: requestBody, // NOTE: requestBody should be encrypted when isVerifiable
-            ...normalizeURIParts(uri),
-          });
-
-          const isValid = await subtle.verifyHMAC(
-            verificationPayload,
-            verificationKeys.derivedHMACKey,
-            authSignature
-          );
-
-          if (!isValid) {
-            throw new VerificationError('Invalid or missing verification', { code: 412 })
-          }
-
-          if (!disableRecryption && requestBody) {
-            const decryptedMessage = await subtle.decryptMessage(requestBody, verificationKeys.derivedSecretKey);
-            requestBody = safeParse(decryptedMessage);
-          }
-        }
-
-        const processResponse = async (response) => {
-          if (!response || disableRecryption || !isVerifiable || !verificationKeys?.derivedSecretKey) {
-            return response
-          }
-
-          return subtle.encryptMessage(JSON.stringify(response), verificationKeys.derivedSecretKey)
-        };
-
-        return { rawBody, requestBody, processResponse }
-      } catch (error) {
-        console.error(`Error handling request verification for '${uri}'`, { error, isVerifiable, disableRecryption });
-        throw error
-      }
-    }
-  );
-
-  exports.getVerificationHelpers = getVerificationHelpers;
-
-  Object.defineProperty(exports, '__esModule', { value: true });
-
-}));
-//# sourceMappingURL=verification.js.map