@calimero-network/mero-js 19.7.2 → 19.8.1

package/dist/index.cjs

@@ -76,10 +76,12 @@ __export(index_exports, {
   nodeEndpoint: () => nodeEndpoint,
   parseAuthCallback: () => parseAuthCallback,
   probeNodeHealth: () => probeNodeHealth,
+  routingProofHeaders: () => routingProofHeaders,
   signAccountLink: () => signAccountLink,
   signDeviceCert: () => signDeviceCert,
   signLoginStatement: () => signLoginStatement,
   signMemberJoinOp: () => signMemberJoinOp,
+  signRoutingChallenge: () => signRoutingChallenge,
   signWarrant: () => signWarrant,
   withCap: () => withCap,
   withRetry: () => withRetry,
@@ -4838,6 +4840,38 @@ function base64(bytes) {
   return btoa(binary);
 }
 
+// src/cloud/routing-proof.ts
+var ROUTING_PROOF_DOMAIN = new TextEncoder().encode(
+  "calimero.mdma.routing-read.v1\0"
+);
+async function signRoutingChallenge(nonce, deviceSecret) {
+  fromHex(deviceSecret, "deviceSecret", 32);
+  const key = await importSigningKey(deviceSecret);
+  const message = concat(
+    ROUTING_PROOF_DOMAIN,
+    new TextEncoder().encode(nonce)
+  );
+  const signature = new Uint8Array(
+    await crypto.subtle.sign({ name: "Ed25519" }, key, message)
+  );
+  return base642(signature);
+}
+async function routingProofHeaders(challenge, credential) {
+  return {
+    "X-Calimero-Credential": credential.credential,
+    "X-Calimero-Nonce": challenge.nonce,
+    "X-Calimero-Signature": await signRoutingChallenge(
+      challenge.nonce,
+      credential.deviceSecret
+    )
+  };
+}
+function base642(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
 // src/cloud/cloud-client.ts
 var DEFAULT_CLOUD_BASE_URL = "https://cloud.calimero.network";
 var REFRESH_HEADER = "x-mdma-session-refresh";
@@ -4850,6 +4884,7 @@ var CloudClient = class {
     const injected = config.fetch;
     this.fetchImpl = injected ? (input, init) => injected(input, init) : (input, init) => globalThis.fetch(input, init);
     this.timeoutMs = config.timeoutMs ?? 1e4;
+    this.routingCredential = config.routingCredential;
     if (config.sessionToken) {
       this.session = {
         sessionToken: config.sessionToken,
@@ -4976,7 +5011,8 @@ var CloudClient = class {
    */
   async getNamespaceRouting(namespaceId) {
     const body = await this.request("GET", `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/admitters`, {
-      anonymous: true
+      anonymous: true,
+      headers: await this.routingProof(namespaceId)
     });
     return {
       namespaceId: String(body.namespace_id ?? namespaceId),
@@ -4995,6 +5031,41 @@ var CloudClient = class {
       writable: body.writable === true
     };
   }
+  /**
+   * Ask the cloud for a challenge to prove an account against.
+   *
+   * Public and unauthenticated on purpose, and safe to be: the nonce is sealed
+   * and bound to this one namespace, so it is not a capability — it is the
+   * thing a capability gets demonstrated against. A caller with no credential
+   * gains nothing by holding one.
+   *
+   * {@link getNamespaceRouting} calls this for you when the client was
+   * constructed with a `routingCredential`. Call it directly only to sign a
+   * challenge somewhere this client cannot reach the key.
+   */
+  async getRoutingChallenge(namespaceId) {
+    const body = await this.request("GET", `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/challenge`, {
+      anonymous: true
+    });
+    return {
+      namespaceId: String(body.namespace_id ?? namespaceId),
+      nonce: String(body.nonce ?? ""),
+      expiresAtMs: Number(body.expires_at_ms ?? 0)
+    };
+  }
+  /**
+   * The proof headers for one routing read, or nothing when no credential was
+   * configured.
+   *
+   * A challenge per read rather than a cached one: they expire in about two
+   * minutes and are single-namespace, so caching would trade one cheap request
+   * for a class of expiry bug that only shows up on a slow client.
+   */
+  async routingProof(namespaceId) {
+    if (!this.routingCredential) return void 0;
+    const challenge = await this.getRoutingChallenge(namespaceId);
+    return routingProofHeaders(challenge, this.routingCredential);
+  }
   /**
    * The node to send a signed join to, chosen from those an invitation names.
    *
@@ -5248,7 +5319,10 @@ var CloudClient = class {
         "Not signed in to Calimero Cloud: call signInWithGoogle() or construct the client with a sessionToken"
       );
     }
-    const headers = { Accept: "application/json" };
+    const headers = {
+      ...options.headers,
+      Accept: "application/json"
+    };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     if (!options.anonymous && this.session) {
       headers.Authorization = `Bearer ${this.session.sessionToken}`;