@calimero-network/mero-js 25.0.2 → 25.0.4

package/dist/index.cjs

@@ -10191,15 +10191,70 @@ function base643(bytes) {
   return btoa(binary);
 }
 
+// src/cloud/link-state.ts
+var KEY2 = "calimero.cloud.link.pending";
+var STATE_PARAM = "link_state";
+var LIFETIME_MS = 10 * 60 * 1e3;
+var ACCOUNT_HEX = /^[0-9a-f]{64}$/;
+var MAX_PENDING = 20;
+function readPending(now) {
+  try {
+    const raw = localStorage.getItem(KEY2);
+    const pending = raw ? JSON.parse(raw) : {};
+    return Object.fromEntries(
+      Object.entries(pending).filter(
+        ([, p]) => p && typeof p.expiresAt === "number" && p.expiresAt > now
+      )
+    );
+  } catch {
+    return {};
+  }
+}
+function writePending(pending) {
+  try {
+    localStorage.setItem(KEY2, JSON.stringify(pending));
+  } catch {
+  }
+}
+function beginLinkState(account, returnTo) {
+  if (!ACCOUNT_HEX.test(account)) {
+    throw new Error("accountId must be 64 lowercase hex characters");
+  }
+  const url = new URL(returnTo);
+  const now = Date.now();
+  const pending = readPending(now);
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  const state = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join(
+    ""
+  );
+  pending[state] = { account, expiresAt: now + LIFETIME_MS };
+  writePending(Object.fromEntries(Object.entries(pending).slice(-MAX_PENDING)));
+  url.searchParams.set(STATE_PARAM, state);
+  return url.toString();
+}
+function takeLinkState(search) {
+  const state = new URLSearchParams(search).get(STATE_PARAM);
+  const pending = readPending(Date.now());
+  if (!state || !Object.prototype.hasOwnProperty.call(pending, state))
+    return null;
+  const entry = pending[state];
+  delete pending[state];
+  writePending(pending);
+  return entry;
+}
+function withoutLinkState(search) {
+  const params = new URLSearchParams(search);
+  params.delete(STATE_PARAM);
+  const rest = params.toString();
+  return rest ? `?${rest}` : "";
+}
+
 // src/cloud/link-redirect.ts
 var DEFAULT_CLOUD_WEB_URL = "https://cloud.calimero.network";
 function cloudLinkUrl(options) {
-  if (!/^[0-9a-f]{64}$/.test(options.accountId)) {
-    throw new Error("accountId must be 64 lowercase hex characters");
-  }
   const url = new URL(options.cloudWebUrl ?? DEFAULT_CLOUD_WEB_URL);
   url.searchParams.set("link-account", options.accountId);
-  url.searchParams.set("callback-url", options.returnTo);
+  url.searchParams.set("callback-url", beginLinkState(options.accountId, options.returnTo));
   return url.toString();
 }
 function beginCloudLink(options) {
@@ -10210,6 +10265,7 @@ function readCloudLinkCallback(location2 = window.location) {
   const params = new URLSearchParams(location2.hash.replace(/^#/, ""));
   const error = params.get("error");
   if (error) {
+    takeLinkState(location2.search ?? "");
     stripFragment();
     throw new Error(
       error === "denied" ? "the account link was declined at the cloud" : `the cloud refused this link: ${error}`
@@ -10218,12 +10274,18 @@ function readCloudLinkCallback(location2 = window.location) {
   const grant = params.get("grant");
   const account = params.get("account");
   if (!grant || !account) return null;
+  if (takeLinkState(location2.search ?? "")?.account !== account) {
+    stripFragment();
+    throw new Error(
+      "this account link answers a request this browser did not make - start the link again from here"
+    );
+  }
   stripFragment();
   return { grant, account };
 }
 function stripFragment() {
   if (typeof history === "undefined" || !history.replaceState) return;
-  history.replaceState(null, "", location.pathname + location.search);
+  history.replaceState(null, "", location.pathname + withoutLinkState(location.search));
 }
 async function completeCloudLink(options) {
   const root = await resolveRoot(options.root);
@@ -10243,7 +10305,7 @@ async function completeCloudLink(options) {
 var DEVICE_PARAM = "enrol-device";
 var KEM_PARAM = "enrol-kem";
 var CALLBACK_PARAM = "callback-url";
-var STATE_PARAM = "state";
+var STATE_PARAM2 = "state";
 function deviceEnrolmentUrl(options) {
   assertHex(options.devicePublicKey, "devicePublicKey");
   assertHex(options.kemPublicKey, "kemPublicKey");
@@ -10253,7 +10315,7 @@ function deviceEnrolmentUrl(options) {
   url.searchParams.set(DEVICE_PARAM, options.devicePublicKey);
   url.searchParams.set(KEM_PARAM, options.kemPublicKey);
   url.searchParams.set(CALLBACK_PARAM, options.returnTo);
-  if (options.state) url.searchParams.set(STATE_PARAM, options.state);
+  if (options.state) url.searchParams.set(STATE_PARAM2, options.state);
   return url.toString();
 }
 function beginDeviceEnrolment(options) {
@@ -10360,17 +10422,6 @@ function normaliseAccount(account) {
   const bare = trimmed.startsWith("0x") ? trimmed.slice(2) : trimmed;
   return bare.length > 0 ? bare : null;
 }
-function httpAdmitterOrigins(addrs) {
-  const out = [];
-  for (const addr of addrs ?? []) {
-    try {
-      const url = new URL(addr);
-      if (url.protocol === "http:" || url.protocol === "https:") out.push(addr.replace(/\/+$/, ""));
-    } catch {
-    }
-  }
-  return out;
-}
 function isInvited(node, invited) {
   if (invited.size === 0) return true;
   const account = normaliseAccount(node.account);
@@ -10395,23 +10446,6 @@ async function resolveRelayFromInvitation(input) {
     };
   }
   if (nodes.length === 0) {
-    const [relayUrl] = httpAdmitterOrigins(input.admitterAddrs);
-    if (relayUrl) {
-      const admitters = (input.admitters ?? []).map(normaliseAccount).filter((a) => a !== null);
-      return {
-        ok: true,
-        relayUrl,
-        admitUrl: `${relayUrl}/admin-api/namespaces/${input.namespaceId}/admit`,
-        admitterAccount: admitters.length === 1 ? admitters[0] : null,
-        peerId: null,
-        // The relay a founder's session runs through executes that founder's
-        // warrants, so it authors on behalf; the node's answer to the first
-        // write is the authoritative one, as for a cloud-routed node.
-        writable: true,
-        stale: false,
-        via: "invitation"
-      };
-    }
     return {
       ok: false,
       step: "no-nodes",
@@ -10455,8 +10489,7 @@ async function resolveRelayFromInvitation(input) {
     // Stale when the node's own heartbeat lapsed OR when the cloud's summary
     // disagrees with trying it at all. Both mean the same thing to a caller:
     // this was attempted on advisory data, so if the admit fails that is why.
-    stale: !chosen.fresh || advisory,
-    via: "cloud"
+    stale: !chosen.fresh || advisory
   };
 }
 
@@ -10742,7 +10775,6 @@ async function bootstrapFromInvitation(input) {
       // separately: two sources for one fact is how an intersection ends up
       // being performed against the wrong list.
       admitters: input.invitation.invitation.admitters,
-      admitterAddrs: input.invitation.admitter_addrs,
       credential: input.credential.credential,
       deviceSecret: input.credential.deviceSecret,
       cloudBaseUrl: input.cloudBaseUrl
@@ -10961,7 +10993,7 @@ async function attestedNodeKey(relay) {
     key.kind === "unavailable" ? "the relay's signing key could not be learned: its attestation did not answer, try again" : "the relay's attestation was refused, so founding through it is not possible: it is not a signed locked-read-only release"
   );
 }
-var HA_ACCOUNT_NOT_LINKED_MESSAGE = "link this account to your cloud user in the wallet so invitees can find this namespace";
+var HA_ACCOUNT_NOT_LINKED_MESSAGE = "link this account to your cloud user in the wallet so the cloud can host this namespace on its fleet";
 var HA_REFUSAL_MESSAGES = {
   account_not_linked: HA_ACCOUNT_NOT_LINKED_MESSAGE,
   account_linked_to_several_users: "this account is linked to more than one cloud user, so the cloud cannot tell whose plan hosts the namespace: unlink it from all but one in the wallet",
@@ -11066,7 +11098,7 @@ var NoRelayError = class extends Error {
 var InvitationNotClaimableError = class extends Error {
   constructor(namespaceId, reason) {
     super(
-      reason === "not-hosted" ? `nobody could claim an invitation to ${namespaceId} yet: the namespace is not hosted in the cloud and has no relay in it, so an invitee with no node has no relay to be admitted through. Link this account to your cloud user in the wallet and enable HA for the namespace, then invite.` : `nobody could claim an invitation to ${namespaceId}: the cloud routes to none of the relays or admins it would name as admitters`
+      reason === "not-hosted" ? `nobody could claim an invitation to ${namespaceId} yet: the cloud lists no node holding the namespace, so an invitee with no node of their own has no relay to be admitted through.` : `nobody could claim an invitation to ${namespaceId}: the cloud routes to none of the relays or admins it would name as admitters`
     );
     this.namespaceId = namespaceId;
     this.reason = reason;
@@ -11254,7 +11286,6 @@ function createAccountAdmin(input, deps = {}) {
     async createNamespaceInvitation(namespaceId) {
       const [{ members }, info] = await Promise.all([relay().listGroupMembers(namespaceId), relay().getGroupInfo(namespaceId)]);
       const relays = members.filter((m) => m.role === "RelayTee").map((m) => m.identity.toLowerCase());
-      let admitterAddrs;
       if (routing) {
         const named = new Set(
           relays.length > 0 ? relays : members.filter((m) => m.role === "Admin").map((m) => m.identity.toLowerCase())
@@ -11265,10 +11296,8 @@ function createAccountAdmin(input, deps = {}) {
         } catch {
         }
         if (nodes !== null) {
-          if (nodes.length === 0) {
-            if (relays.length === 0 || !s.relayUrl) throw new InvitationNotClaimableError(namespaceId, "not-hosted");
-            admitterAddrs = [s.relayUrl];
-          } else if (!nodes.some((n) => n.account !== null && named.has(n.account.toLowerCase()))) {
+          if (nodes.length === 0) throw new InvitationNotClaimableError(namespaceId, "not-hosted");
+          if (!nodes.some((n) => n.account !== null && named.has(n.account.toLowerCase()))) {
             throw new InvitationNotClaimableError(namespaceId, "no-named-node");
           }
         }
@@ -11278,7 +11307,6 @@ function createAccountAdmin(input, deps = {}) {
         inviterAccount: s.account,
         deviceSecret: s.deviceSecret,
         ...relays.length > 0 ? { admitters: relays } : {},
-        ...admitterAddrs ? { admitterAddrs } : {},
         members,
         applicationId: info.targetApplicationId,
         appKey: info.appKey
@@ -11385,7 +11413,6 @@ function joinOf(row) {
     reportedAt: typeof join.reported_at === "string" ? join.reported_at : null
   };
 }
-var ACCOUNT_HEX = /^[0-9a-f]{64}$/;
 function accountHexOrNull(value) {
   return typeof value === "string" && ACCOUNT_HEX.test(value) ? value : null;
 }
@@ -11659,9 +11686,8 @@ var CloudClient = class {
    * are answered together rather than across two endpoints — the per-context
    * read needs a context id a joiner does not yet have.
    *
-   * An empty `nodes` list is a state, not an error: a namespace with no fleet
-   * assignment has no cloud node, and the joiner must use one of the
-   * invitation's other admitters — another admin's node, or a self-hosted peer.
+   * An empty `nodes` list is a state, not an error: the cloud has no record of
+   * a node holding the namespace, so there is no hosted admitter.
    */
   async getNamespaceRouting(namespaceId) {
     const body = await this.request("GET", `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/admitters`, {
@@ -12114,7 +12140,7 @@ var CloudClient = class {
     const portal = options.portalUrl.replace(/\/+$/, "");
     const query = new URLSearchParams({
       "link-account": options.accountId,
-      "callback-url": options.callbackUrl
+      "callback-url": beginLinkState(options.accountId, options.callbackUrl)
     });
     return { url: `${portal}/?${query.toString()}`, accountId: options.accountId };
   }
@@ -12124,14 +12150,19 @@ var CloudClient = class {
    * Returns `{}` when there is nothing to read, so it is safe to call on every
    * load — which is how a redirected app finds out it has been sent back.
    *
+   * A grant is only returned when it answers a handoff this browser began, for the
+   * account that handoff named; anything else comes back as
+   * `error: 'unexpected_callback'`, because the redirect URL can be forwarded.
+   *
    * @param href defaults to the current location, when there is one.
    */
   static readAccountLinkCallback(href) {
     const source = href ?? (typeof window === "undefined" ? "" : window.location.href);
     if (!source) return {};
     let hash;
+    let search;
     try {
-      hash = new URL(source).hash;
+      ({ hash, search } = new URL(source));
     } catch {
       return {};
     }
@@ -12140,6 +12171,10 @@ var CloudClient = class {
     const accountId = params.get("account");
     const error = params.get("error");
     const out = {};
+    if (error) takeLinkState(search);
+    if (grant && takeLinkState(search)?.account !== accountId) {
+      return { error: "unexpected_callback" };
+    }
     if (grant) out.grant = grant;
     if (accountId) out.accountId = accountId;
     if (error) out.error = error;