@calimero-network/mero-js 19.14.1 → 19.16.0

package/dist/index.cjs

@@ -42,6 +42,7 @@ __export(index_exports, {
   accountRootFromPhrase: () => accountRootFromPhrase,
   accountRootFromSecret: () => accountRootFromSecret,
   buildAuthLoginUrl: () => buildAuthLoginUrl,
+  callerProof: () => callerProof,
   combineSignals: () => combineSignals,
   compareSemver: () => compareSemver,
   connectCloud: () => connectCloud,
@@ -59,6 +60,7 @@ __export(index_exports, {
   createNodeAdminApiClient: () => createNodeAdminApiClient,
   createNodeAuthApiClient: () => createNodeAuthApiClient,
   createNodeHttpClient: () => createNodeHttpClient,
+  createProofSigner: () => createProofSigner,
   createRetryableMethod: () => createRetryableMethod,
   createTimeoutSignal: () => createTimeoutSignal,
   createUniversalHttpClient: () => createUniversalHttpClient,
@@ -77,12 +79,14 @@ __export(index_exports, {
   nodeEndpoint: () => nodeEndpoint,
   parseAuthCallback: () => parseAuthCallback,
   probeNodeHealth: () => probeNodeHealth,
+  requestBodyHash: () => requestBodyHash,
   routingProofHeaders: () => routingProofHeaders,
   signAccountLink: () => signAccountLink,
   signAccountLogin: () => signAccountLogin,
   signDeviceCert: () => signDeviceCert,
   signLoginStatement: () => signLoginStatement,
   signMemberJoinOp: () => signMemberJoinOp,
+  signRequest: () => signRequest,
   signRoutingChallenge: () => signRoutingChallenge,
   signWarrant: () => signWarrant,
   withCap: () => withCap,
@@ -178,6 +182,14 @@ function headersToRecord(headers) {
   });
   return record;
 }
+function pathForProof(url) {
+  try {
+    return new URL(url).pathname;
+  } catch {
+    const query = url.indexOf("?");
+    return query === -1 ? url : url.slice(0, query);
+  }
+}
 var WebHttpClient = class {
   constructor(transport) {
     this.transport = transport;
@@ -304,6 +316,16 @@ var WebHttpClient = class {
     if (init?.keepalive !== void 0) {
       requestInit.keepalive = init.keepalive;
     }
+    if (this.transport.getProof) {
+      const proof = await this.transport.getProof({
+        method: requestInit.method ?? "GET",
+        path: pathForProof(url),
+        body: requestInit.body
+      });
+      if (proof) {
+        headersObj["X-Calimero-Proof"] = proof;
+      }
+    }
     try {
       const response = await this.transport.fetch(url, requestInit);
       if (!response.ok) {
@@ -500,6 +522,7 @@ function createBrowserHttpClient(options) {
     fetch: (url, init) => globalThis.fetch(url, init),
     baseUrl: options.baseUrl,
     getAuthToken: options.getAuthToken,
+    getProof: options.getProof,
     onTokenRefresh: options.onTokenRefresh,
     refreshToken: options.refreshToken,
     onAuthRevoked: options.onAuthRevoked,
@@ -526,6 +549,7 @@ function createNodeHttpClient(options) {
     fetch: isDefaultFetch ? (url, init) => globalThis.fetch(url, init) : (url, init) => fetchImpl(url, init),
     baseUrl: options.baseUrl,
     getAuthToken: options.getAuthToken,
+    getProof: options.getProof,
     onTokenRefresh: options.onTokenRefresh,
     refreshToken: options.refreshToken,
     onAuthRevoked: options.onAuthRevoked,
@@ -2665,6 +2689,17 @@ function fromHex(value, label, expectedBytes) {
   }
   return bytes;
 }
+function fromHexUnsized(value, label) {
+  const clean = value.trim();
+  if (!/^[0-9a-fA-F]*$/.test(clean) || clean.length % 2 !== 0) {
+    throw new Error(`${label} must be an even number of hex characters`);
+  }
+  const bytes = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < bytes.length; i += 1) {
+    bytes[i] = Number.parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
 function u64le(value) {
   const out = new Uint8Array(8);
   new DataView(out.buffer).setBigUint64(0, BigInt(value), true);
@@ -6535,8 +6570,88 @@ async function signMemberJoinOp(input) {
   return hex(concat(signable, signature, unendorsed));
 }
 
+// src/request/request-sig.ts
+var SIGN_DOMAIN2 = new TextEncoder().encode("calimero.auth.request.v1");
+var BODY_DOMAIN = new TextEncoder().encode("calimero.auth.request.body.v1");
+function borshString2(value) {
+  const bytes = new TextEncoder().encode(value);
+  return concat(u32le(bytes.length), bytes);
+}
+async function requestBodyHash(body = new Uint8Array(0)) {
+  const bytes = typeof body === "string" ? new TextEncoder().encode(body) : body;
+  return domainHash(BODY_DOMAIN, [bytes]);
+}
+async function signRequest(input) {
+  const key = await importSigningKey(input.signerSecret);
+  const bodyHash = await requestBodyHash(input.body);
+  const issuedAt = u64le(input.issuedAt);
+  const expiresAt = u64le(input.expiresAt);
+  const encoder = new TextEncoder();
+  const preimage = await domainHash(SIGN_DOMAIN2, [
+    encoder.encode(input.method),
+    encoder.encode(input.path),
+    bodyHash,
+    issuedAt,
+    expiresAt
+  ]);
+  const signature = new Uint8Array(
+    await crypto.subtle.sign({ name: "Ed25519" }, key, preimage)
+  );
+  return hex(
+    concat(
+      borshString2(input.method),
+      borshString2(input.path),
+      bodyHash,
+      issuedAt,
+      expiresAt,
+      signature
+    )
+  );
+}
+
+// src/request/caller-proof.ts
+function callerProof(input) {
+  const credential = fromHexUnsized(input.credential, "credential");
+  const request = fromHexUnsized(input.request, "request signature");
+  const session = input.session === void 0 ? new Uint8Array([0]) : concat(new Uint8Array([1]), fromHexUnsized(input.session, "session statement"));
+  return hex(concat(credential, session, request));
+}
+
+// src/request/proof-signer.ts
+function bodyBytes(body) {
+  if (body === void 0 || body === null) return new Uint8Array(0);
+  if (typeof body === "string") return body;
+  if (body instanceof Uint8Array) return body;
+  if (body instanceof ArrayBuffer) return new Uint8Array(body);
+  if (ArrayBuffer.isView(body)) {
+    return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+  }
+  throw new Error(
+    `a request-carried proof cannot commit to a ${body?.constructor?.name ?? typeof body} body: pass a string or bytes, or use a session for this call`
+  );
+}
+function createProofSigner(options) {
+  const ttl = options.ttlSeconds ?? 120;
+  const clock = options.now ?? (() => Math.floor(Date.now() / 1e3));
+  return async (request) => {
+    const issuedAt = clock();
+    return callerProof({
+      credential: options.credential,
+      session: options.session,
+      request: await signRequest({
+        method: request.method,
+        path: request.path,
+        body: bodyBytes(request.body),
+        issuedAt,
+        expiresAt: issuedAt + ttl,
+        signerSecret: options.signerSecret
+      })
+    });
+  };
+}
+
 // src/login/login.ts
-var SIGN_DOMAIN2 = new TextEncoder().encode("calimero.auth.login.v1");
+var SIGN_DOMAIN3 = new TextEncoder().encode("calimero.auth.login.v1");
 var AUDIENCE_TAG = {
   webOrigin: 0,
   codeSigningId: 1,
@@ -6575,7 +6690,7 @@ async function signLoginStatement(input) {
   const deviceKey = await derivePublicKey(input.deviceSecret);
   const issuedAt = u64le(input.issuedAt);
   const expiresAt = u64le(input.expiresAt);
-  const preimage = await domainHash(SIGN_DOMAIN2, [
+  const preimage = await domainHash(SIGN_DOMAIN3, [
     node,
     audienceSigningBytes(input.audience),
     challenge,