@calimero-network/mero-js 25.0.3 → 25.0.4

package/dist/index.mjs

@@ -9906,15 +9906,70 @@ function base643(bytes) {
   return btoa(binary);
 }
 
+// src/cloud/link-state.ts
+var KEY2 = "calimero.cloud.link.pending";
+var STATE_PARAM = "link_state";
+var LIFETIME_MS = 10 * 60 * 1e3;
+var ACCOUNT_HEX = /^[0-9a-f]{64}$/;
+var MAX_PENDING = 20;
+function readPending(now) {
+  try {
+    const raw = localStorage.getItem(KEY2);
+    const pending = raw ? JSON.parse(raw) : {};
+    return Object.fromEntries(
+      Object.entries(pending).filter(
+        ([, p]) => p && typeof p.expiresAt === "number" && p.expiresAt > now
+      )
+    );
+  } catch {
+    return {};
+  }
+}
+function writePending(pending) {
+  try {
+    localStorage.setItem(KEY2, JSON.stringify(pending));
+  } catch {
+  }
+}
+function beginLinkState(account, returnTo) {
+  if (!ACCOUNT_HEX.test(account)) {
+    throw new Error("accountId must be 64 lowercase hex characters");
+  }
+  const url = new URL(returnTo);
+  const now = Date.now();
+  const pending = readPending(now);
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  const state = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join(
+    ""
+  );
+  pending[state] = { account, expiresAt: now + LIFETIME_MS };
+  writePending(Object.fromEntries(Object.entries(pending).slice(-MAX_PENDING)));
+  url.searchParams.set(STATE_PARAM, state);
+  return url.toString();
+}
+function takeLinkState(search) {
+  const state = new URLSearchParams(search).get(STATE_PARAM);
+  const pending = readPending(Date.now());
+  if (!state || !Object.prototype.hasOwnProperty.call(pending, state))
+    return null;
+  const entry = pending[state];
+  delete pending[state];
+  writePending(pending);
+  return entry;
+}
+function withoutLinkState(search) {
+  const params = new URLSearchParams(search);
+  params.delete(STATE_PARAM);
+  const rest = params.toString();
+  return rest ? `?${rest}` : "";
+}
+
 // src/cloud/link-redirect.ts
 var DEFAULT_CLOUD_WEB_URL = "https://cloud.calimero.network";
 function cloudLinkUrl(options) {
-  if (!/^[0-9a-f]{64}$/.test(options.accountId)) {
-    throw new Error("accountId must be 64 lowercase hex characters");
-  }
   const url = new URL(options.cloudWebUrl ?? DEFAULT_CLOUD_WEB_URL);
   url.searchParams.set("link-account", options.accountId);
-  url.searchParams.set("callback-url", options.returnTo);
+  url.searchParams.set("callback-url", beginLinkState(options.accountId, options.returnTo));
   return url.toString();
 }
 function beginCloudLink(options) {
@@ -9925,6 +9980,7 @@ function readCloudLinkCallback(location2 = window.location) {
   const params = new URLSearchParams(location2.hash.replace(/^#/, ""));
   const error = params.get("error");
   if (error) {
+    takeLinkState(location2.search ?? "");
     stripFragment();
     throw new Error(
       error === "denied" ? "the account link was declined at the cloud" : `the cloud refused this link: ${error}`
@@ -9933,12 +9989,18 @@ function readCloudLinkCallback(location2 = window.location) {
   const grant = params.get("grant");
   const account = params.get("account");
   if (!grant || !account) return null;
+  if (takeLinkState(location2.search ?? "")?.account !== account) {
+    stripFragment();
+    throw new Error(
+      "this account link answers a request this browser did not make - start the link again from here"
+    );
+  }
   stripFragment();
   return { grant, account };
 }
 function stripFragment() {
   if (typeof history === "undefined" || !history.replaceState) return;
-  history.replaceState(null, "", location.pathname + location.search);
+  history.replaceState(null, "", location.pathname + withoutLinkState(location.search));
 }
 async function completeCloudLink(options) {
   const root = await resolveRoot(options.root);
@@ -9958,7 +10020,7 @@ async function completeCloudLink(options) {
 var DEVICE_PARAM = "enrol-device";
 var KEM_PARAM = "enrol-kem";
 var CALLBACK_PARAM = "callback-url";
-var STATE_PARAM = "state";
+var STATE_PARAM2 = "state";
 function deviceEnrolmentUrl(options) {
   assertHex(options.devicePublicKey, "devicePublicKey");
   assertHex(options.kemPublicKey, "kemPublicKey");
@@ -9968,7 +10030,7 @@ function deviceEnrolmentUrl(options) {
   url.searchParams.set(DEVICE_PARAM, options.devicePublicKey);
   url.searchParams.set(KEM_PARAM, options.kemPublicKey);
   url.searchParams.set(CALLBACK_PARAM, options.returnTo);
-  if (options.state) url.searchParams.set(STATE_PARAM, options.state);
+  if (options.state) url.searchParams.set(STATE_PARAM2, options.state);
   return url.toString();
 }
 function beginDeviceEnrolment(options) {
@@ -11066,7 +11128,6 @@ function joinOf(row) {
     reportedAt: typeof join.reported_at === "string" ? join.reported_at : null
   };
 }
-var ACCOUNT_HEX = /^[0-9a-f]{64}$/;
 function accountHexOrNull(value) {
   return typeof value === "string" && ACCOUNT_HEX.test(value) ? value : null;
 }
@@ -11794,7 +11855,7 @@ var CloudClient = class {
     const portal = options.portalUrl.replace(/\/+$/, "");
     const query = new URLSearchParams({
       "link-account": options.accountId,
-      "callback-url": options.callbackUrl
+      "callback-url": beginLinkState(options.accountId, options.callbackUrl)
     });
     return { url: `${portal}/?${query.toString()}`, accountId: options.accountId };
   }
@@ -11804,14 +11865,19 @@ var CloudClient = class {
    * Returns `{}` when there is nothing to read, so it is safe to call on every
    * load — which is how a redirected app finds out it has been sent back.
    *
+   * A grant is only returned when it answers a handoff this browser began, for the
+   * account that handoff named; anything else comes back as
+   * `error: 'unexpected_callback'`, because the redirect URL can be forwarded.
+   *
    * @param href defaults to the current location, when there is one.
    */
   static readAccountLinkCallback(href) {
     const source = href ?? (typeof window === "undefined" ? "" : window.location.href);
     if (!source) return {};
     let hash;
+    let search;
     try {
-      hash = new URL(source).hash;
+      ({ hash, search } = new URL(source));
     } catch {
       return {};
     }
@@ -11820,6 +11886,10 @@ var CloudClient = class {
     const accountId = params.get("account");
     const error = params.get("error");
     const out = {};
+    if (error) takeLinkState(search);
+    if (grant && takeLinkState(search)?.account !== accountId) {
+      return { error: "unexpected_callback" };
+    }
     if (grant) out.grant = grant;
     if (accountId) out.accountId = accountId;
     if (error) out.error = error;