@calimero-network/mero-js 22.7.0 → 22.9.0

package/dist/events/sse.d.ts

@@ -19,9 +19,22 @@ type SseEvent = SseEventData | GroupMembershipEventData | GroupMigrationEventDat
 type SseEventHandler = (event: SseEvent) => void;
 type SseConnectHandler = (sessionId: string) => void;
 type SseErrorHandler = (error: Error) => void;
+/**
+ * How one request to the SSE endpoints is authenticated.
+ *
+ * A bearer token is one value reused across requests; a request proof commits to
+ * the method, the path and the body, so it must be produced per request. Both
+ * reduce to the same thing from this client's point of view — headers — so the
+ * stream takes the general form and {@link SseClient} adapts `getAuthToken` to it.
+ */
+export type SseAuthorizer = (request: {
+    method: string;
+    path: string;
+    body?: string;
+}) => Promise<Record<string, string>>;
 export declare class SseClient {
     private baseUrl;
-    private getAuthToken;
+    private authorize;
     private reconnectDelayMs;
     private sessionId;
     private abortController;
@@ -33,7 +46,14 @@ export declare class SseClient {
     private fetchImpl;
     constructor(opts: {
         baseUrl: string;
-        getAuthToken: () => Promise<string>;
+        /** A bearer token provider. The historical form, and still the default. */
+        getAuthToken?: () => Promise<string>;
+        /**
+         * Per-request authorization, for a credential that commits to the request —
+         * a device cert signing a request proof. Takes precedence over
+         * `getAuthToken`; one of the two is required.
+         */
+        authorize?: SseAuthorizer;
         reconnectDelayMs?: number;
         fetch?: typeof fetch;
     });

package/dist/events/sse.js

@@ -42,7 +42,16 @@ export class SseClient {
         this.closed = false;
         this.listeners = { connect: [], event: [], error: [] };
         this.baseUrl = opts.baseUrl.replace(/\/+$/, '');
-        this.getAuthToken = opts.getAuthToken;
+        if (opts.authorize) {
+            this.authorize = opts.authorize;
+        }
+        else if (opts.getAuthToken) {
+            const getAuthToken = opts.getAuthToken;
+            this.authorize = async () => ({ Authorization: `Bearer ${await getAuthToken()}` });
+        }
+        else {
+            throw new Error('SseClient needs either `getAuthToken` or `authorize`');
+        }
         this.reconnectDelayMs = opts.reconnectDelayMs ?? 3000;
         // globalThis.fetch must be called as a method on globalThis, not through a
         // variable, or browsers throw "Illegal invocation".
@@ -123,11 +132,10 @@ export class SseClient {
         this.closed = false;
         this.abortController = new AbortController();
         try {
-            const token = await this.getAuthToken();
             const url = `${this.baseUrl}/sse`;
             const response = await this.fetchImpl(url, {
                 headers: {
-                    'Authorization': `Bearer ${token}`,
+                    ...(await this.authorize({ method: 'GET', path: new URL(url).pathname })),
                     'Accept': 'text/event-stream',
                 },
                 signal: this.abortController.signal,
@@ -297,23 +305,24 @@ export class SseClient {
     }
     async sendSubscription(method, ids) {
         try {
-            const token = await this.getAuthToken();
             const params = {};
             if (ids.contextIds && ids.contextIds.length > 0)
                 params.contextIds = ids.contextIds;
             if (ids.groupIds && ids.groupIds.length > 0)
                 params.groupIds = ids.groupIds;
-            const response = await this.fetchImpl(`${this.baseUrl}/sse/subscription`, {
+            const url = `${this.baseUrl}/sse/subscription`;
+            // Serialized once and both signed and sent, because a proof commits to the
+            // body: re-stringifying for the signature risks two byte sequences that
+            // differ in key order, which fails as a refused credential rather than as
+            // anything that names the real cause.
+            const body = JSON.stringify({ id: this.sessionId, method, params });
+            const response = await this.fetchImpl(url, {
                 method: 'POST',
                 headers: {
-                    'Authorization': `Bearer ${token}`,
+                    ...(await this.authorize({ method: 'POST', path: new URL(url).pathname, body })),
                     'Content-Type': 'application/json',
                 },
-                body: JSON.stringify({
-                    id: this.sessionId,
-                    method,
-                    params,
-                }),
+                body,
             });
             if (!response.ok) {
                 // The subscribe path used to report only the status. On the one failure

package/dist/http-client/http-types.d.ts

@@ -4,6 +4,24 @@ export interface Transport {
     baseUrl: string;
     defaultHeaders?: Record<string, string>;
     getAuthToken?: () => Promise<string | undefined>;
+    /**
+     * Per-request authorization, for a credential that commits to the request.
+     *
+     * `getAuthToken` returns one value reused across requests; a request proof
+     * signs the method, the path and the body, so it can only be produced where
+     * those are known. This is called with exactly that, and whatever it returns
+     * is merged into the headers.
+     *
+     * It runs AFTER `getAuthToken`, so a transport holding both sends both and
+     * lets the node decide — which it does by answering a request carrying a token
+     * by that token, and consulting a proof only when there is none.
+     */
+    authorizeRequest?: (request: {
+        method: string;
+        /** The path the node will see, query excluded. */
+        path: string;
+        body?: string | Uint8Array;
+    }) => Promise<Record<string, string>>;
     /**
      * Sign each request instead of, or alongside, presenting a session.
      *

package/dist/http-client/web-client.js

@@ -193,8 +193,28 @@ export class WebHttpClient {
         else {
             headersObj = headers;
         }
+        const method = init?.method || 'GET';
+        // A credential that commits to the request can only be produced here, where
+        // the method, the assembled path and the body are all known. The path comes
+        // from the URL rather than from `path`, because a base URL may carry a prefix
+        // (`…/admin-api`) that the node sees and a bare relative path would not sign.
+        if (this.transport.authorizeRequest) {
+            const body = init?.body;
+            if (body !== undefined && typeof body !== 'string' && !(body instanceof Uint8Array)) {
+                throw new Error('this transport authorizes each request against its body, so the body must be a string ' +
+                    'or Uint8Array — a stream cannot be signed, because the signature would have to read ' +
+                    'bytes the request then cannot send.');
+            }
+            Object.assign(headersObj, await this.transport.authorizeRequest({
+                method,
+                path: new URL(url).pathname,
+                // Narrowed by the guard above; `BodyInit` is wider than what can be
+                // signed.
+                body: body,
+            }));
+        }
         const requestInit = {
-            method: init?.method || 'GET',
+            method,
             headers: headersObj,
         };
         // Check if body is a stream (ReadableStream) that can't be reused