@authon/react-native-wallet 0.0.0-stage → 0.4.0

package/ios/vendor/AuthonWallet/Wallet/WalletAPI.swift

@@ -0,0 +1,361 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonWallet/Wallet/WalletAPI.swift. Do not edit: change the source and run the script.
+import Foundation
+
+public struct WalletDevice: Equatable, Sendable {
+    public var id: String
+    public var label: String?
+    public var shareVersion: Int?
+    public var createdAt: String?
+    public var lastUsedAt: String?
+    public var revokedAt: String?
+}
+
+public struct ServerWallet: Equatable, Sendable {
+    public var id: String
+    public var address: String
+    public var status: String
+    public var isProtected: Bool
+    /// nil without a backup; false for a legacy backup that has no passkey public key.
+    public var backupVerifiable: Bool?
+    public var shareVersion: Int
+    public var devices: [WalletDevice]
+}
+
+/// `GET /v1/wallet/app-config`, the native counterpart of the frame's frame-config.
+public struct WalletAppConfig: Equatable, Sendable {
+    public var projectId: String?
+    /// The app (team ID + bundle ID) is registered for this project.
+    public var allowed: Bool
+    /// A platform admin approved the registration, so passkeys for the wallet RP work.
+    public var approved: Bool
+    public var enabled: Bool
+    public var chainIds: [Int]
+    /// Server-side project setting. Missing means true.
+    public var confirmSigning: Bool
+    public var prfSaltVersion: BackupVersion
+    public var rpId: String
+    public var minFrameProtocol: Int?
+    /// `X-Request-Id` of the app-config response.
+    public var diagnosticId: String? = nil
+    /// False when the API answered 403/404 (unknown publishable key or project).
+    var projectFound = true
+}
+
+enum ProofKind: String {
+    case create, device, restore
+}
+
+struct DeviceProof: Equatable {
+    var deviceId: String
+    var challenge: String
+    var signature: String
+
+    var fields: [(String, JSONValue)] {
+        [("deviceId", .string(deviceId)), ("challenge", .string(challenge)), ("signature", .string(signature))]
+    }
+}
+
+struct RestoreStart {
+    var backupCiphertext: String?
+    var credentialId: String?
+    /// Present only for backups without a registered passkey key (older backups).
+    var companyShare: String?
+    var upgradeRecommended: Bool
+    var passkeyChallenge: String?
+}
+
+/// HTTP client for `/v1/wallet/*`, request for request the same as `apps/wallet/src/api.ts`.
+final class WalletAPIClient: @unchecked Sendable {
+    /// Protocol sent as `protocol` in proof and backup requests (the API's CURRENT_FRAME_PROTOCOL).
+    static let frameProtocol = 2
+
+    private let base: String
+    let publishableKey: String
+    private let session: URLSession
+
+    init(apiURL: String, publishableKey: String, session: URLSession = .shared) {
+        var b = apiURL
+        while b.hasSuffix("/") { b.removeLast() }
+        base = b
+        self.publishableKey = publishableKey
+        self.session = session
+    }
+
+    private static let statusCodes: [Int: WalletErrorCode] = [
+        400: .invalidRequest, 401: .unauthorized, 403: .forbidden, 404: .notFound,
+        409: .alreadyExists, 426: .frameOutdated, 429: .rateLimited,
+    ]
+    private static let restoreCodes: Set<String> = ["NEEDS_RESTORE", "DEVICE_REVOKED", "DEVICE_NOT_FOUND", "STALE_SHARE_VERSION"]
+    private static let knownCodes: Set<String> = [
+        "NOT_PROTECTED", "ORIGIN_NOT_ALLOWED", "ALREADY_EXISTS", "NOT_FOUND", "LAST_DEVICE", "SESSION_REQUIRED",
+        "WALLET_PENDING", "RATE_LIMITED", "FRAME_OUTDATED", "BACKUP_KEY_REQUIRED", "ALREADY_UPGRADED",
+    ]
+
+    struct Response {
+        var status: Int
+        var data: JSONObject
+        /// `X-Request-Id` response header.
+        var requestId: String?
+
+        /// The server's diagnostic ID: `requestId` in the body, else the header.
+        var diagnosticId: String? { data["requestId"]?.stringValue ?? requestId }
+    }
+
+    private func call(_ method: String, _ path: String, _ token: String?, _ body: JSONValue? = nil) async throws -> Response {
+        guard let url = URL(string: "\(base)/v1/wallet\(path)") else { throw WalletError(.apiError, "invalid URL") }
+        var req = URLRequest(url: url)
+        req.httpMethod = method
+        req.cachePolicy = .reloadIgnoringLocalCacheData
+        req.httpShouldHandleCookies = false
+        req.setValue(publishableKey, forHTTPHeaderField: "x-api-key")
+        req.setValue("application/json", forHTTPHeaderField: "accept")
+        if let token { req.setValue("Bearer \(token)", forHTTPHeaderField: "authorization") }
+        if let body {
+            req.setValue("application/json", forHTTPHeaderField: "content-type")
+            req.httpBody = Data(body.compact().utf8)
+        }
+        let data: Data
+        let response: URLResponse
+        do {
+            (data, response) = try await session.data(for: req)
+        } catch {
+            throw WalletError.network()
+        }
+        let http = response as? HTTPURLResponse
+        let parsed = (try? JSONValue.parse(String(decoding: data, as: UTF8.self)))?.objectValue ?? JSONObject()
+        return Response(status: http?.statusCode ?? 0, data: parsed, requestId: http?.value(forHTTPHeaderField: "X-Request-Id"))
+    }
+
+    private func ensureOk(_ res: Response) throws -> JSONObject {
+        if (200..<300).contains(res.status) { return res.data }
+        let id = res.diagnosticId
+        if case .string(let code) = res.data["code"] ?? .null {
+            if Self.restoreCodes.contains(code) { throw WalletError(.needsRestore, diagnosticId: id) }
+            if Self.knownCodes.contains(code), let c = WalletErrorCode(rawValue: code) { throw WalletError(c, diagnosticId: id) }
+        }
+        throw WalletError(Self.statusCodes[res.status] ?? .apiError, diagnosticId: id)
+    }
+
+    private static func string(_ v: JSONValue?) -> String? { v?.stringValue }
+
+    /// JavaScript String(x) for ids.
+    private static func text(_ v: JSONValue?) -> String {
+        guard let v else { return "undefined" }
+        return EvmAddress.jsString(v)
+    }
+
+    /// JavaScript Number(x) for integer fields.
+    private static func int(_ v: JSONValue?, default d: Int? = nil) -> Int? {
+        guard let v, v != .null else { return d }
+        if let n = v.jsBigInt, let u = n.magnitude.uint64, u <= UInt64(Int.max) { return n.negative ? -Int(u) : Int(u) }
+        return nil
+    }
+
+    static func normalizeWallet(_ raw: JSONValue?) -> ServerWallet {
+        let w = raw?.objectValue ?? JSONObject()
+        let devices: [WalletDevice] = (w["devices"]?.arrayValue ?? []).map { d in
+            WalletDevice(
+                id: text(d["id"]),
+                label: string(d["label"]),
+                shareVersion: int(d["shareVersion"]),
+                createdAt: string(d["createdAt"]),
+                lastUsedAt: string(d["lastUsedAt"]),
+                revokedAt: d["revokedAt"]?.isTruthy == true ? text(d["revokedAt"]) : nil
+            )
+        }
+        let isProtected: Bool
+        if case .bool(let b) = w["protected"] ?? .null { isProtected = b } else { isProtected = w["protectedAt"]?.isTruthy == true }
+        var backupVerifiable: Bool?
+        if case .bool(let b) = w["backupVerifiable"] ?? .null { backupVerifiable = b }
+        let idValue = (w["id"].flatMap { $0 == .null ? nil : $0 }) ?? w["walletId"]
+        let statusValue = (w["status"].flatMap { $0 == .null ? nil : $0 }).map { text($0) } ?? "active"
+        return ServerWallet(
+            id: text(idValue),
+            address: text(w["address"]),
+            status: statusValue,
+            isProtected: isProtected,
+            backupVerifiable: backupVerifiable,
+            shareVersion: int(w["shareVersion"], default: 1) ?? 1,
+            devices: devices
+        )
+    }
+
+    private static func bound(_ fields: [(String, JSONValue)], _ bound: ProofNonce) -> JSONValue {
+        .object(JSONObject(fields + [
+            ("nonce", .string(bound.nonce)),
+            ("nonceExpiresAt", .number(String(bound.expiresAt))),
+            ("protocol", .number(String(frameProtocol))),
+        ]))
+    }
+
+    // MARK: - Endpoints
+
+    func appConfig(platform: String, appId: String) async throws -> WalletAppConfig {
+        let query = "platform=\(Self.encode(platform))&appId=\(Self.encode(appId))"
+        let res = try await call("GET", "/app-config?\(query)", nil)
+        if res.status == 403 || res.status == 404 {
+            return WalletAppConfig(projectId: nil, allowed: false, approved: false, enabled: false, chainIds: [], confirmSigning: true, prfSaltVersion: .v1, rpId: "wallet.authon.dev", minFrameProtocol: nil, diagnosticId: res.diagnosticId, projectFound: false)
+        }
+        let data = try ensureOk(res)
+        let cfg = data["walletConfig"]?.objectValue ?? JSONObject()
+        let rpId = Self.string(data["rpId"]).flatMap { $0.isEmpty ? nil : $0 } ?? "wallet.authon.dev"
+        return WalletAppConfig(
+            projectId: Self.string(data["projectId"]),
+            allowed: data["allowed"] != .bool(false),
+            approved: data["approved"] == .bool(true),
+            enabled: cfg["enabled"] == .bool(true),
+            chainIds: (cfg["chainIds"]?.arrayValue ?? []).compactMap { Self.int($0) },
+            confirmSigning: cfg["confirmSigning"] != .bool(false),
+            prfSaltVersion: Self.int(cfg["prfSaltVersion"]) == 2 ? .v2 : .v1,
+            rpId: rpId,
+            minFrameProtocol: Self.int(data["minFrameProtocol"]),
+            diagnosticId: res.diagnosticId
+        )
+    }
+
+    func getMe(_ token: String) async throws -> ServerWallet? {
+        let res = try await call("GET", "/me", token)
+        if res.status == 404 { return nil }
+        let data = try ensureOk(res)
+        return Self.normalizeWallet(data["wallet"].flatMap { $0 == .null ? nil : $0 } ?? .object(data))
+    }
+
+    func proofChallenge(_ token: String, kind: ProofKind) async throws -> ProofNonce {
+        let data = try ensureOk(try await call("POST", "/me/proof-challenge", token, .object(JSONObject([("kind", .string(kind.rawValue))]))))
+        guard case .string(let nonce) = data["nonce"] ?? .null, case .number(let exp) = data["expiresAt"] ?? .null,
+              let expiresAt = Int64(exp) ?? Double(exp).map({ Int64($0) }) else {
+            throw WalletError(.apiError)
+        }
+        return ProofNonce(nonce: nonce, expiresAt: expiresAt)
+    }
+
+    struct Created {
+        var wallet: ServerWallet?
+        var walletId: String
+        var deviceId: String
+        var shareVersion: Int
+    }
+
+    func createWallet(_ token: String, address: String, companyShare: String, devicePublicKey: DevicePublicJwk, proof: String, bound: ProofNonce) async throws -> Created {
+        let body = Self.bound([
+            ("address", .string(address)), ("companyShare", .string(companyShare)),
+            ("devicePublicKey", devicePublicKey.json), ("proof", .string(proof)),
+        ], bound)
+        let data = try ensureOk(try await call("POST", "/me", token, body))
+        let wallet: ServerWallet?
+        if let w = data["wallet"], w.isTruthy {
+            wallet = Self.normalizeWallet(w)
+        } else if data["id"]?.isTruthy == true {
+            wallet = Self.normalizeWallet(.object(data))
+        } else {
+            wallet = nil
+        }
+        let device = data["device"]?.objectValue ?? JSONObject()
+        let walletIdValue = data["walletId"].flatMap { $0 == .null ? nil : $0 }
+        let deviceIdValue = data["deviceId"].flatMap { $0 == .null ? nil : $0 } ?? device["id"]
+        return Created(
+            wallet: wallet,
+            walletId: walletIdValue.map { Self.text($0) } ?? wallet?.id ?? "undefined",
+            deviceId: Self.text(deviceIdValue),
+            shareVersion: Self.int(data["shareVersion"]) ?? wallet?.shareVersion ?? 1
+        )
+    }
+
+    func confirmWallet(_ token: String, _ proof: DeviceProof) async throws {
+        _ = try ensureOk(try await call("POST", "/me/confirm", token, .object(JSONObject(proof.fields))))
+    }
+
+    func discardPending(_ token: String) async throws {
+        let res = try await call("DELETE", "/me/pending", token)
+        if res.status == 404 { return }
+        _ = try ensureOk(res)
+    }
+
+    func challenge(_ token: String, deviceId: String) async throws -> String {
+        let data = try ensureOk(try await call("POST", "/me/share/challenge", token, .object(JSONObject([("deviceId", .string(deviceId))]))))
+        guard case .string(let c) = data["challenge"] ?? .null else { throw WalletError(.apiError) }
+        return c
+    }
+
+    func releaseShare(_ token: String, _ proof: DeviceProof) async throws -> String {
+        let data = try ensureOk(try await call("POST", "/me/share", token, .object(JSONObject(proof.fields))))
+        guard case .string(let s) = data["companyShare"] ?? .null else { throw WalletError(.apiError) }
+        return s
+    }
+
+    struct BackupKeyFields {
+        var credentialPublicKey: String?
+        var credentialAlg: Int?
+        var attestationObject: String?
+    }
+
+    func putBackup(_ token: String, proof: DeviceProof, backupCiphertext: String, credentialId: String, newCompanyShare: String, key: BackupKeyFields, upgrade: Bool) async throws -> Int {
+        var fields = proof.fields + [
+            ("backupCiphertext", .string(backupCiphertext)), ("credentialId", .string(credentialId)),
+            ("newCompanyShare", .string(newCompanyShare)),
+        ]
+        if let pk = key.credentialPublicKey, let alg = key.credentialAlg {
+            fields += [("credentialPublicKey", .string(pk)), ("credentialAlg", .number(String(alg)))]
+        } else if let att = key.attestationObject {
+            fields += [("attestationObject", .string(att))]
+        }
+        if upgrade { fields.append(("upgrade", .bool(true))) }
+        fields.append(("protocol", .number(String(Self.frameProtocol))))
+        let data = try ensureOk(try await call("PUT", "/me/backup", token, .object(JSONObject(fields))))
+        guard let v = Self.int(data["shareVersion"]) else { throw WalletError(.apiError) }
+        return v
+    }
+
+    func restoreStart(_ token: String) async throws -> RestoreStart {
+        let data = try ensureOk(try await call("POST", "/me/restore/start", token, .object(JSONObject())))
+        let companyShare = Self.string(data["companyShare"])
+        let passkeyChallenge = Self.string(data["passkeyChallenge"])
+        if (companyShare ?? "").isEmpty && (passkeyChallenge ?? "").isEmpty { throw WalletError(.apiError) }
+        return RestoreStart(
+            backupCiphertext: Self.string(data["backupCiphertext"]),
+            credentialId: Self.string(data["credentialId"]),
+            companyShare: companyShare,
+            upgradeRecommended: !(companyShare ?? "").isEmpty || data["upgradeRecommended"] == .bool(true),
+            passkeyChallenge: passkeyChallenge
+        )
+    }
+
+    func restoreAssert(_ token: String, _ a: PasskeyAssertion, challenge: String) async throws -> String {
+        let body = JSONValue.object(JSONObject([
+            ("credentialId", .string(a.credentialId)), ("clientDataJSON", .string(a.clientDataJSON)),
+            ("authenticatorData", .string(a.authenticatorData)), ("signature", .string(a.signature)),
+            ("challenge", .string(challenge)),
+        ]))
+        let data = try ensureOk(try await call("POST", "/me/restore/assert", token, body))
+        guard case .string(let s) = data["companyShare"] ?? .null else { throw WalletError(.apiError) }
+        return s
+    }
+
+    func restore(_ token: String, newCompanyShare: String, newBackupCiphertext: String, newDevicePublicKey: DevicePublicJwk, credentialId: String, proof: String, bound: ProofNonce) async throws -> (deviceId: String, shareVersion: Int) {
+        let body = Self.bound([
+            ("newCompanyShare", .string(newCompanyShare)), ("newBackupCiphertext", .string(newBackupCiphertext)),
+            ("newDevicePublicKey", newDevicePublicKey.json), ("credentialId", .string(credentialId)), ("proof", .string(proof)),
+        ], bound)
+        let data = try ensureOk(try await call("POST", "/me/restore", token, body))
+        let deviceId = data["deviceId"].flatMap { $0 == .null ? nil : $0 } ?? data["device"]?["id"]
+        guard let v = Self.int(data["shareVersion"]) else { throw WalletError(.apiError) }
+        return (Self.text(deviceId), v)
+    }
+
+    func addDevice(_ token: String, devicePublicKey: DevicePublicJwk, proof: String, bound: ProofNonce) async throws -> (deviceId: String, shareVersion: Int) {
+        let body = Self.bound([("devicePublicKey", devicePublicKey.json), ("proof", .string(proof))], bound)
+        let data = try ensureOk(try await call("POST", "/me/devices", token, body))
+        guard let v = Self.int(data["shareVersion"]) else { throw WalletError(.apiError) }
+        return (Self.text(data["deviceId"]), v)
+    }
+
+    func revokeDevice(_ token: String, deviceId: String, proof: DeviceProof) async throws {
+        _ = try ensureOk(try await call("DELETE", "/me/devices/\(Self.encode(deviceId))", token, .object(JSONObject(proof.fields))))
+    }
+
+    /// encodeURIComponent
+    static func encode(_ s: String) -> String {
+        let allowed = CharacterSet(charactersIn: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.!~*'()")
+        return s.addingPercentEncoding(withAllowedCharacters: allowed) ?? s
+    }
+}